NAME

api — scripts and CI over HTTPS

DESCRIPTION

Where ssh is awkward, in CI runners for instance, the same commands run over HTTPS with a token. A token is an account key with limits: which commands, which VM, until when. Removing the key revokes the token.

CREATE A TOKEN

$ ssh chroot.dev ssh-key generate-api-key --label ci \
    --cmds new,ls,rm --exp 30d

Without --cmds the token runs help, ls, new, whoami, ssh-key list and share show.

RUN A COMMAND

POST the command line to /exec; the answer is the --json output of the command:

$ curl -X POST -H "Authorization: Bearer $TOKEN" \
    -d 'new -n ci-1234 -w' https://chroot.run/exec

RUN INSIDE A VM

‘ssh name command’ runs command in the VM. Output and errors come back together; the exit status is in the ‘X-Fcm-Exit’ header:

$ curl -sD - -X POST -H "Authorization: Bearer $TOKEN" \
    -d 'ssh ci-1234 make test' https://chroot.run/exec

REVOKE

$ ssh chroot.dev ssh-key rm ci

SEE ALSO

intro(1), ssh-key(1)