labnet: split maintainers from access, fetch keys from GitHub

aparcar · claude · aparcar · commit 0f6dda35c8d0 · 2026-04-25T19:00:13.000+08:00
Maintainers are notified via @user mentions in healthcheck issue bodies; access lists which GitHub users get SSH keys fetched from github.com/<user>.keys and authorized on the lab host. Both are stored without the @ prefix; the coordinator authorizes the union of all access entries. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Paul Spooren <mail@aparcar.org>
diff --git a/.github/workflows/healthcheck.yml b/.github/workflows/healthcheck.yml
@@ -178,6 +178,7 @@ jobs:
             const issueTitle = "Healthcheck ${{ matrix.proxy }}/${{ matrix.device }}";
             const runUrl = "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}";
             const isSuccess = "${{ job.status }}" === "success";
+            const maintainers = ${{ toJSON(matrix.maintainers) }}.map(m => '@' + m).join(', ');
 
             const failureBody = `
               ### ❌ Healthcheck Failed
@@ -186,7 +187,7 @@ jobs:
 
               - **Proxy**: \`${{ matrix.proxy }}\`
               - **Device**: \`${{ matrix.device }}\`
-              - **Maintainers**: ${{ join(matrix.maintainers, ', ') }}
+              - **Maintainers**: ${maintainers}
 
               has **failed**. Please review the logs and investigate the issue.
 
diff --git a/ansible/coordinator.yml b/ansible/coordinator.yml
@@ -1,18 +1,20 @@
 - hosts: coordinator
   become: true
+  vars:
+    labnet: "{{ lookup('file', '../labnet.yaml') | from_yaml }}"
   tasks:
     - name: Create a user account called labgrid-dev
       user:
         name: labgrid-dev
         state: present
 
-    - name: Add SSH keys to labgrid-dev based on labnet.yaml
+    - name: Add SSH keys to labgrid-dev from GitHub
       authorized_key:
         user: labgrid-dev
         state: present
-        key: "{{ item.value.sshkey }}"
-        comment: "{{ item.key }}"
-      loop: "{{ hostvars[inventory_hostname]['developers'] | dict2items | default([]) }}"
+        key: "{{ lookup('url', 'https://github.com/' + item + '.keys', split_lines=false) }}"
+        comment: "{{ item }}"
+      loop: "{{ labnet.labs.values() | map(attribute='access') | flatten | unique | list }}"
 
     - name: Add public SSH key of CI runner
       authorized_key:
diff --git a/ansible/lab.yml b/ansible/lab.yml
@@ -1,5 +1,7 @@
 - hosts: labs
   become: true
+  vars:
+    labnet: "{{ lookup('file', '../labnet.yaml') | from_yaml }}"
   tasks:
     - name: Set hostname
       hostname:
@@ -24,13 +26,13 @@
           - dialout
           - plugdev
 
-    - name: Add SSH keys to labgrid-dev based on labnet.yaml
+    - name: Add SSH keys to labgrid-dev from GitHub
       authorized_key:
         user: labgrid-dev
         state: present
-        key: "{{ hostvars[inventory_hostname]['developers'][item]['sshkey'] }}"
+        key: "{{ lookup('url', 'https://github.com/' + item + '.keys', split_lines=false) }}"
         comment: "{{ item }}"
-      loop: "{{ hostvars[inventory_hostname]['labs'][inventory_hostname]['developers'] | default([]) }}"
+      loop: "{{ labnet.labs[inventory_hostname].access | default([]) }}"
 
     - name: Set /etc/hosts
       lineinfile:
@@ -289,8 +291,6 @@
         mode: "0755"
         owner: labgrid-dev
         group: labgrid-dev
-      vars:
-        labnet: "{{ lookup('file', '../labnet.yaml') | from_yaml }}"
       notify:
         - Restart labgrid-coordinator
       tags:
diff --git a/ansible/playbook_labgrid.yml b/ansible/playbook_labgrid.yml
@@ -1,5 +1,7 @@
 - hosts: labs
   become: true
+  vars:
+    labnet: "{{ lookup('file', '../labnet.yaml') | from_yaml }}"
   tasks:
     - name: Set hostname
       hostname:
@@ -24,13 +26,13 @@
           - dialout
           - plugdev
 
-    - name: Add SSH keys to labgrid-dev based on labnet.yaml
+    - name: Add SSH keys to labgrid-dev from GitHub
       authorized_key:
         user: labgrid-dev
         state: present
-        key: "{{ hostvars[inventory_hostname]['developers'][item]['sshkey'] }}"
+        key: "{{ lookup('url', 'https://github.com/' + item + '.keys', split_lines=false) }}"
         comment: "{{ item }}"
-      loop: "{{ hostvars[inventory_hostname]['labs'][inventory_hostname]['developers'] | default([]) }}"
+      loop: "{{ labnet.labs[inventory_hostname].access | default([]) }}"
 
     - name: Set /etc/hosts
       lineinfile:
@@ -289,8 +291,6 @@
         mode: "0755"
         owner: labgrid-dev
         group: labgrid-dev
-      vars:
-        labnet: "{{ lookup('file', '../labnet.yaml') | from_yaml }}"
       notify:
         - Restart labgrid-coordinator
       tags:
diff --git a/docs/sharing-target-files.md b/docs/sharing-target-files.md
@@ -10,7 +10,9 @@ labs:
     proxy: labgrid-example
     hostkey: ssh-ed25519 AAAA...
     maintainers:
-      - "@maintainer"
+      - maintainer
+    access:
+      - maintainer
     devices:
       - linksys_e8450
     device_instances:
diff --git a/labnet.yaml b/labnet.yaml
@@ -3,7 +3,11 @@ labs:
     proxy: labgrid-aparcar
     hostkey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPRn1GsHlmQ02c8aOsQrSKz0qtK6IEO7uTRjrrDOKai7
     maintainers:
-      - "@aparcar"
+      - aparcar
+    access:
+      - aparcar
+      - dangowrt
+      - jonasjelonek
     devices:
       - openwrt_one
       - bananapi_bpi-r4-lite
@@ -14,84 +18,83 @@ labs:
       # - glinet_gl-mt6000
       # - enterasys_ws-ap3710i
       # - ignitenet_ss-w2-ac2600
-    developers:
-      - aparcar
-      - dangowrt
-      - jonasjelonek
   labgrid-bastian:
     proxy: labgrid-bastian
     hostkey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGxdB8NmJRjrS9lztZDKld8OprqY5ELjZ7koQ3b5atLd
     maintainers:
-      - "@bittorf"
+      - bittorf
+    access:
+      - aparcar
     devices:
       - cznic_turris-omnia
       - tplink_tl-wdr4300-v1
-    developers:
-      - aparcar
   labgrid-blocktrron:
     proxy: labgrid-blocktrron
     hostkey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGLL+T3zunt13cl9ZSZZkc/W+tnvIENEB28x/VoU2QnV
     maintainers:
-      - "@blocktrron"
+      - blocktrron
+    access:
+      - aparcar
     devices:
       - hpe_msm460
       - tplink_tl-wr842n-v3
-    developers:
-      - aparcar
   labgrid-leinelab:
     proxy: labgrid-leinelab
     hostkey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILDEM6JDEorz8cURSX7fXOdKsLKMJZQpzccpSEKytjAf
     maintainers:
-      - "@lemoer"
+      - lemoer
+    access:
+      - aparcar
     devices:
       - tplink_tl-wr1043nd-v3
-    developers:
-      - aparcar
   labgrid-hsn:
     proxy: labgrid-hsn
     hostkey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP5kAZ/gVDTHp2rOWmybFSf+JFtoQJPH4KFE+lUGKH0c
     maintainers:
-      - "@jonasjelonek"
+      - jonasjelonek
+    access:
+      - aparcar
+      - jonasjelonek
     devices:
       - genexis_pulse-ex400
       - bananapi_bpi-r64
       - bananapi_bpi-r4
       - glinet_gl-mt1300
       - linksys_e8450
       - tplink_tl-wr1043nd-v4
-    developers:
-      - aparcar
-      - jonasjelonek
   labgrid-wigyori:
     proxy: labgrid-wigyori
     hostkey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINoXHDKDcWBZ5mj2GSiWomYzaqjaElFQiqmqM4c8K8Q3
     maintainers:
-      - "@wigyori"
+      - wigyori
+    access:
+      - wigyori
     devices:
       - linksprite_a10-pcduino
       - olimex_a10-olinuxino-lime
       - olimex_a20-olinuxino-micro
       - pine64_pine64-plus
       - xunlong_orangepi-2
       - xunlong_orangepi-zero2
-    developers:
-      - wigyori
   labgrid-hauke:
     proxy: labgrid-hauke
     hostkey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHuOU1Tc2XIpd8B3Oy+Hg1aHYL+L+IznbVvdCJ04wizX
     maintainers:
-      - "@hauke"
+      - hauke
+    access:
+      - hauke
     devices:
       - openwrt_one
-    developers:
-      - hauke
   labgrid-fcefyn:
     proxy: labgrid-fcefyn
     hostkey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0ANF89u6x2DjGv8wEZ6Yc07WjcV7QM4izgy4EwafYo
     maintainers:
-      - "@francoriba"
-      - "@ccasanueva7"
-      - "@javierbrk"
+      - francoriba
+      - ccasanueva7
+      - javierbrk
+    access:
+      - francoriba
+      - aparcar
     devices:
       - linksys_e8450
       - openwrt_one
@@ -104,19 +107,3 @@ labs:
         - belkin_rt3200_3
       librerouter_librerouter-v1:
         - librerouter_1
-    developers:
-      - francoriba
-      - aparcar
-developers:
-  aparcar:
-    sshkey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDZTxjQ3/KTefKvsPlVBWz+ITD7dGWcOt8/C55ekd2VE
-  dangowrt:
-    sshkey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDe6tUbVJW3bYUVCYyQQFpNrJ1wP5kzvEkCruSjyA6TM
-  jonasjelonek:
-    sshkey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDy4T0osxR8yS4RjJcsMn3rSacKvNzu+ZRNfe2lXTSHS
-  wigyori:
-    sshkey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG8vcHMKcl6W6OuzSdjOhQ0ZehtH+McjLB7WzgP9P4Ls
-  hauke:
-    sshkey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDhbJDeGBfpn8vkd1wjHgOWvN9WGWS3mRgqqFqNqgpNE
-  francoriba:
-    sshkey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPaNY9LyGgQlwlMaWxSWq5xD++UGCJtdqxHPHDADFACi
