Search code examples
githubsshsystemdsystemctl

systemclt services and ssh

I have a simple bash script that makes a call to a git repository on github (/home/user/simple_git.sh):

#!/bin/bash

# Change to the Git repoistory
cd /home/user/git/a_git_repo

remote=$(
    git ls-remote -h origin master |
    awk '{print $1}'
)

local=$(
    git rev-parse HEAD
)

printf "Local : %s\nRemote: %s\n" $local $remote

It gives the following output:

Local : a10dc1d7d30ed67ed1e514a3c1ffc5a824cea14b
Remote: a10dc1d7d30ed67ed1e514a3c1ffc5a824cea14b

git authentication is done via ssh keys - the following is my my .bashrc

# ssh
eval `ssh-agent -s`
ssh-add

The script runs just fine as user as well as with sudo (by preserving the user environment) ie.

~/.simple_git.sh
or
sudo -E ~/simple_git.sh

However, I've still not yet found a way to run the script as a service (/etc/systemd/user/simple_git.service or /etc/systemd/system/simple_git.service)

[Unit]
Description=TestScript

[Service]
Type=simple
ExecStart=/home/user/simple_git.sh

I've tried running the systemctl command with the --user option as well as modifying visudo to include the line

Defaults env_keep += SSH_AUTH_SOCK

but to no avail. Everytime I check the status of the job:

Feb 21 23:16:00 alarmpi systemd[484]: Started TestScript.
Feb 21 23:16:01 alarmpi simple_git.sh[15255]: Permission denied (publickey).
Feb 21 23:16:01 alarmpi simple_git.sh[15255]: fatal: Could not read from remote repository.
Feb 21 23:16:01 alarmpi simple_git.sh[15255]: Please make sure you have the correct access rights
Feb 21 23:16:01 alarmpi simple_git.sh[15255]: and the repository exists.
Feb 21 23:16:01 alarmpi simple_git.sh[15255]: Local : a10dc1d7d30ed67ed1e514a3c1ffc5a824cea14b
Solution

  • Systemd is not running the service with your environment variables from your session. I would recommend you to

    • Use git using https, which will not require authentication (instead of ssh)
    • Create an unprotected "deploy key", which will be in standard location (~alarmpi/.ssh/id_rsa), which will get picked up by git automatically without ssh-agent.