From 5e85de9130c559588addb12217400399bdb86a28 Mon Sep 17 00:00:00 2001
From: Timothy Kim <timothykim@fastmail.fm>
Date: Fri, 10 Apr 2026 15:00:10 -0400
Subject: [PATCH] fix deploy race condition and harden security

- reorder app.sh to run cert before commit/push (fixes workflow failure on first run)
- quote $SSH_ORIGINAL_COMMAND in authorized_keys to prevent command injection
- add port validation in service.sh nginx command
- pin host key in deploy-beszel.yml workflow
- fix append vs overwrite for known_hosts in deploy-nginx.yml
---
 .gitea/workflows/deploy-beszel.yml | 3 ++-
 .gitea/workflows/deploy-nginx.yml  | 3 +--
 scripts/bootstrap.sh               | 2 +-
 tools/app.sh                       | 2 +-
 tools/service.sh                   | 5 +++++
 5 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/deploy-beszel.yml b/.gitea/workflows/deploy-beszel.yml
index e9c2735..891ffdd 100644
--- a/.gitea/workflows/deploy-beszel.yml
+++ b/.gitea/workflows/deploy-beszel.yml
@@ -13,6 +13,7 @@ jobs:
       - name: Deploy via SSH
         run: |
           mkdir -p ~/.ssh
+          echo "${{ vars.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts
           echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-          ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-beszel
+          ssh -o StrictHostKeyChecking=yes -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-beszel
diff --git a/.gitea/workflows/deploy-nginx.yml b/.gitea/workflows/deploy-nginx.yml
index 1829557..0633da1 100644
--- a/.gitea/workflows/deploy-nginx.yml
+++ b/.gitea/workflows/deploy-nginx.yml
@@ -15,8 +15,7 @@ jobs:
       - name: Deploy via SSH
         run: |
           mkdir -p ~/.ssh
-          echo "${{ vars.DEPLOY_HOST_KEY }}" >> ~/.ssh/known_hosts
-          chmod 644 ~/.ssh/known_hosts
+          echo "${{ vars.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts
           echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
           ssh -o StrictHostKeyChecking=yes -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-nginx
diff --git a/scripts/bootstrap.sh b/scripts/bootstrap.sh
index 1555f27..cccfa28 100755
--- a/scripts/bootstrap.sh
+++ b/scripts/bootstrap.sh
@@ -99,7 +99,7 @@ fi
 echo "==> Setting up deploy SSH key..."
 mkdir -p /home/deploy/.ssh
 chmod 700 /home/deploy/.ssh
-echo "command=\"sudo /opt/hantim/scripts/deploy.sh \$SSH_ORIGINAL_COMMAND\",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty $DEPLOY_PUBKEY" > /home/deploy/.ssh/authorized_keys
+echo "command=\"sudo /opt/hantim/scripts/deploy.sh \\\"\$SSH_ORIGINAL_COMMAND\\\"\",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty $DEPLOY_PUBKEY" > /home/deploy/.ssh/authorized_keys
 chmod 600 /home/deploy/.ssh/authorized_keys
 chown -R deploy:deploy /home/deploy/.ssh
 
diff --git a/tools/app.sh b/tools/app.sh
index 082b4a0..7630706 100755
--- a/tools/app.sh
+++ b/tools/app.sh
@@ -529,6 +529,7 @@ cmd_monitor() {
 cmd_all() {
     cmd_dns
     cmd_repo
+    cmd_cert
     cmd_files
 
     echo "==> Committing and pushing hantim-server..."
@@ -541,7 +542,6 @@ cmd_all() {
         git push
     fi
 
-    cmd_cert
     cmd_garage
     cmd_build
     cmd_verify
diff --git a/tools/service.sh b/tools/service.sh
index 2335f07..703d7a5 100755
--- a/tools/service.sh
+++ b/tools/service.sh
@@ -256,6 +256,11 @@ cmd_nginx() {
     local port="$2"
     local fqdn="$name.hantim.net"
 
+    if ! [[ "$port" =~ ^[0-9]+$ ]]; then
+        echo "Error: port must be a number."
+        exit 1
+    fi
+
     if [ -e "$REPO_ROOT/docker/nginx/conf.d/$fqdn.conf" ]; then
         echo "  docker/nginx/conf.d/$fqdn.conf already exists, skipping."
         return