Merge pull request 'fix(ipa): stream keytab via sudo cat instead of scp' (#78 ) from worktree-ipa-client-module into main

Reviewed-on: #78
fix(ipa): stream keytab via sudo cat instead of scp
2026-07-27 23:14:41 +00:00 · 2026-07-28 09:08:19 +10:00
1 changed files with 4 additions and 3 deletions
@@ -219,10 +219,11 @@ log "Fetching keytab for host/${FQDN}"
 dc_run "sudo ipa-getkeytab -s '${DC_HOST}' -p 'host/${FQDN}' -k '${DC_TMP}'"

 if $DRY_RUN; then
-  echo "[dry-run] Would scp ${DC_USER}@${DC_HOST}:${DC_TMP} ${KEYTAB_SECRET}"
+  echo "[dry-run] Would stream ${DC_USER}@${DC_HOST}:${DC_TMP} → secrets/${HOSTNAME}.keytab"
 else
-  logn "Copying keytab from ${DC_HOST}:${DC_TMP} → secrets/${HOSTNAME}.keytab"
-  scp "${DC_USER}@${DC_HOST}:${DC_TMP}" "${KEYTAB_SECRET}"
+  logn "Streaming keytab from ${DC_HOST}:${DC_TMP} → secrets/${HOSTNAME}.keytab"
+  # scp can't read a root-owned temp file as wayne; pipe through sudo cat instead.
+  ssh "${DC_USER}@${DC_HOST}" "sudo cat '${DC_TMP}'" > "${KEYTAB_SECRET}"

  logn "Removing temp file on ${DC_HOST}"
  dc_run "sudo rm -f '${DC_TMP}'"
Author	SHA1	Message	Date
beatzaplenty	01ee261cf8	Merge pull request 'fix(ipa): stream keytab via sudo cat instead of scp' (#78 ) from worktree-ipa-client-module into main Check NixOS configurations / eval-hosts (push) Successful in 10m22s Details Reviewed-on: #78	2026-07-27 23:14:41 +00:00
beatzaplentyandClaude Sonnet 4.6	f6f30c675f	fix(ipa): stream keytab via sudo cat instead of scp Check NixOS configurations / eval-hosts (pull_request) Successful in 10m25s Details ipa-getkeytab runs as root via sudo so the temp file is root-owned; scp as wayne gets Permission denied. Pipe through `sudo cat` over SSH instead, which reads as root but writes locally as the invoking user. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 09:08:19 +10:00