coder · f0ssel · Apr 6, 2022 · Apr 1, 2022 · Apr 1, 2022 · Apr 1, 2022
diff --git a/cli/start.go b/cli/start.go
@@ -31,6 +31,7 @@ import (
 	"github.com/coder/coder/coderd"
 	"github.com/coder/coder/coderd/database"
 	"github.com/coder/coder/coderd/database/databasefake"
+	"github.com/coder/coder/coderd/gitsshkey"
 	"github.com/coder/coder/coderd/tunnel"
 	"github.com/coder/coder/codersdk"
 	"github.com/coder/coder/provisioner/terraform"
@@ -57,6 +58,7 @@ func start() *cobra.Command {
 		useTunnel              bool
 		traceDatadog           bool
 		secureAuthCookie       bool
+		sshKeygenAlgorithmRaw  string
 	)
 	root := &cobra.Command{
 		Use: "start",
@@ -126,6 +128,12 @@ func start() *cobra.Command {
 			if err != nil {
 				return xerrors.Errorf("parse access url %q: %w", accessURL, err)
 			}
+
+			sshKeygenAlgorithm, err := gitsshkey.ParseSSHKeygenAlgorithm(sshKeygenAlgorithmRaw)
+			if err != nil {
+				return xerrors.Errorf("parse ssh keygen algorithm %s: %w", sshKeygenAlgorithmRaw, err)
+			}
+
 			logger := slog.Make(sloghuman.Sink(os.Stderr))
 			options := &coderd.Options{
 				AccessURL:            accessURLParsed,
@@ -134,6 +142,7 @@ func start() *cobra.Command {
 				Pubsub:               database.NewPubsubInMemory(),
 				GoogleTokenValidator: validator,
 				SecureAuthCookie:     secureAuthCookie,
+				SSHKeygenAlgorithm:   sshKeygenAlgorithm,
 			}
 
 			if !dev {
@@ -337,6 +346,8 @@ func start() *cobra.Command {
 	_ = root.Flags().MarkHidden("tunnel")
 	cliflag.BoolVarP(root.Flags(), &traceDatadog, "trace-datadog", "", "CODER_TRACE_DATADOG", false, "Send tracing data to a datadog agent")
 	cliflag.BoolVarP(root.Flags(), &secureAuthCookie, "secure-auth-cookie", "", "CODER_SECURE_AUTH_COOKIE", false, "Specifies if the 'Secure' property is set on browser session cookies")
+	cliflag.StringVarP(root.Flags(), &sshKeygenAlgorithmRaw, "ssh-keygen-algorithm", "", "CODER_SSH_KEYGEN_ALGORITHM", "ed25519", "Specifies the algorithm to use for generating ssh keys. "+
+		`Accepted values are "ed25519", "ecdsa", or "rsa4096"`)
 
 	return root
 }

diff --git a/coderd/coderd.go b/coderd/coderd.go
@@ -14,6 +14,7 @@ import (
 	"cdr.dev/slog"
 	"github.com/coder/coder/coderd/awsidentity"
 	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/gitsshkey"
 	"github.com/coder/coder/coderd/httpapi"
 	"github.com/coder/coder/coderd/httpmw"
 	"github.com/coder/coder/site"
@@ -30,7 +31,8 @@ type Options struct {
 	AWSCertificates      awsidentity.Certificates
 	GoogleTokenValidator *idtoken.Validator
 
-	SecureAuthCookie bool
+	SecureAuthCookie   bool
+	SSHKeygenAlgorithm gitsshkey.Algorithm
 }
 
 // New constructs the Coder API into an HTTP handler.
@@ -137,6 +139,8 @@ func New(options *Options) (http.Handler, func()) {
 						r.Get("/", api.workspacesByUser)
 						r.Get("/{workspacename}", api.workspaceByUserAndName)
 					})
+					r.Get("/gitsshkey", api.gitSSHKey)
+					r.Put("/gitsshkey", api.regenerateGitSSHKey)
 				})
 			})
 		})
@@ -148,6 +152,7 @@ func New(options *Options) (http.Handler, func()) {
 			r.Route("/agent", func(r chi.Router) {
 				r.Use(httpmw.ExtractWorkspaceAgent(options.Database))
 				r.Get("/", api.workspaceAgentListen)
+				r.Get("/gitsshkey", api.agentGitSSHKey)
 			})
 			r.Route("/{workspaceresource}", func(r chi.Router) {
 				r.Use(

diff --git a/coderd/coderdtest/coderdtest.go b/coderd/coderdtest/coderdtest.go
@@ -38,6 +38,7 @@ import (
 	"github.com/coder/coder/coderd/database"
 	"github.com/coder/coder/coderd/database/databasefake"
 	"github.com/coder/coder/coderd/database/postgres"
+	"github.com/coder/coder/coderd/gitsshkey"
 	"github.com/coder/coder/codersdk"
 	"github.com/coder/coder/cryptorand"
 	"github.com/coder/coder/provisioner/echo"
@@ -49,6 +50,7 @@ import (
 type Options struct {
 	AWSInstanceIdentity    awsidentity.Certificates
 	GoogleInstanceIdentity *idtoken.Validator
+	SSHKeygenAlgorithm     gitsshkey.Algorithm
 }
 
 // New constructs an in-memory coderd instance and returns
@@ -98,6 +100,12 @@ func New(t *testing.T, options *Options) *codersdk.Client {
 	serverURL, err := url.Parse(srv.URL)
 	require.NoError(t, err)
 	var closeWait func()
+
+	// match default with cli default
+	if options.SSHKeygenAlgorithm == "" {
+		options.SSHKeygenAlgorithm = gitsshkey.AlgorithmEd25519
+	}
+
 	// We set the handler after server creation for the access URL.
 	srv.Config.Handler, closeWait = coderd.New(&coderd.Options{
 		AgentConnectionUpdateFrequency: 25 * time.Millisecond,
@@ -108,6 +116,7 @@ func New(t *testing.T, options *Options) *codersdk.Client {
 
 		AWSCertificates:      options.AWSInstanceIdentity,
 		GoogleTokenValidator: options.GoogleInstanceIdentity,
+		SSHKeygenAlgorithm:   options.SSHKeygenAlgorithm,
 	})
 	t.Cleanup(func() {
 		srv.Close()

diff --git a/coderd/database/databasefake/databasefake.go b/coderd/database/databasefake/databasefake.go
@@ -31,6 +31,7 @@ func New() database.Store {
 		provisionerJobResource: make([]database.WorkspaceResource, 0),
 		workspaceBuild:         make([]database.WorkspaceBuild, 0),
 		provisionerJobAgent:    make([]database.WorkspaceAgent, 0),
+		gitsshkey:              make([]database.GitSshKey, 0),
 	}
 }
 
@@ -57,6 +58,7 @@ type fakeQuerier struct {
 	provisionerJobLog      []database.ProvisionerJobLog
 	workspace              []database.Workspace
 	workspaceBuild         []database.WorkspaceBuild
+	gitsshkey              []database.GitSshKey
 }
 
 // InTx doesn't rollback data properly for in-memory yet.
@@ -1239,3 +1241,63 @@ func (q *fakeQuerier) UpdateWorkspaceDeletedByID(_ context.Context, arg database
 	}
 	return sql.ErrNoRows
 }
+
+func (q *fakeQuerier) InsertGitSSHKey(_ context.Context, arg database.InsertGitSSHKeyParams) (database.GitSshKey, error) {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	//nolint:gosimple
+	gitsshkey := database.GitSshKey{
+		UserID:     arg.UserID,
+		CreatedAt:  arg.CreatedAt,
+		UpdatedAt:  arg.UpdatedAt,
+		PrivateKey: arg.PrivateKey,
+		PublicKey:  arg.PublicKey,
+	}
+	q.gitsshkey = append(q.gitsshkey, gitsshkey)
+	return gitsshkey, nil
+}
+
+func (q *fakeQuerier) GetGitSSHKey(_ context.Context, userID uuid.UUID) (database.GitSshKey, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, key := range q.gitsshkey {
+		if key.UserID == userID {
+			return key, nil
+		}
+	}
+	return database.GitSshKey{}, sql.ErrNoRows
+}
+
+func (q *fakeQuerier) UpdateGitSSHKey(_ context.Context, arg database.UpdateGitSSHKeyParams) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, key := range q.gitsshkey {
+		if key.UserID.String() != arg.UserID.String() {
+			continue
+		}
+		key.UpdatedAt = arg.UpdatedAt
+		key.PrivateKey = arg.PrivateKey
+		key.PublicKey = arg.PublicKey
+		q.gitsshkey[index] = key
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *fakeQuerier) DeleteGitSSHKey(_ context.Context, userID uuid.UUID) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, key := range q.gitsshkey {
+		if key.UserID.String() != userID.String() {
+			continue
+		}
+		q.gitsshkey[index] = q.gitsshkey[len(q.gitsshkey)-1]
+		q.gitsshkey = q.gitsshkey[:len(q.gitsshkey)-1]
+		return nil
+	}
+	return sql.ErrNoRows
+}
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/migrations/000005_gitsshkey.down.sql b/coderd/database/migrations/000005_gitsshkey.down.sql
@@ -0,0 +1 @@
+DROP TABLE git_ssh_keys;
diff --git a/coderd/database/migrations/000005_gitsshkey.up.sql b/coderd/database/migrations/000005_gitsshkey.up.sql
@@ -0,0 +1,7 @@
+CREATE TABLE IF NOT EXISTS git_ssh_keys (
+    user_id uuid PRIMARY KEY NOT NULL REFERENCES users (id),
+    created_at timestamptz NOT NULL,
+    updated_at timestamptz NOT NULL,
+    private_key text NOT NULL,
+    public_key text NOT NULL
+);
diff --git a/coderd/database/models.go b/coderd/database/models.go
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go