fix: run syndication webhook inside node jail (jsonwebtoken not on runner)

.github/workflows/deploy.yml

@@ -196,23 +196,31 @@ jobs:
         env:
           SECRET: ${{ secrets.SECRET }}
           SITE_URL: ${{ secrets.SITE_URL }}
-          INDIEKIT_INTERNAL_URL: http://10.100.0.20:3000
         run: |
-          TOKEN=$(node --input-type=commonjs <<'EOF'
+          # Write script to host /tmp, then copy into jail and run it there.
-          const jwt = require('jsonwebtoken');
+          # jsonwebtoken is only available inside the node jail at /usr/local/indiekit/node_modules.
-          const token = jwt.sign(
+          cat > /tmp/syndicate.sh << 'SCRIPT'
-            { me: process.env.SITE_URL, scope: 'update' },
+          #!/bin/sh
-            process.env.SECRET,
+          set -eu
-            { expiresIn: '10m' }
+          TOKEN=$(node --input-type=commonjs << 'JSEOF'
-          );
+const jwt = require('/usr/local/indiekit/node_modules/jsonwebtoken');
-          process.stdout.write(token);
+process.stdout.write(jwt.sign({ me: process.env.SITE_URL, scope: 'update' }, process.env.SECRET, { expiresIn: '10m' }));
-          EOF
+JSEOF
           )
           RESPONSE=$(curl -sS -w "\n%{http_code}" -X POST \
             -H "Content-Type: application/json" \
             -d "{\"access_token\": \"$TOKEN\"}" \
-            "$INDIEKIT_INTERNAL_URL/syndicate")
+            http://10.100.0.20:3000/syndicate)
           HTTP_CODE=$(echo "$RESPONSE" | tail -1)
           BODY=$(echo "$RESPONSE" | sed '$d')
           echo "HTTP $HTTP_CODE: $BODY"
           [ "$HTTP_CODE" -lt 400 ]
+          SCRIPT
+          scp -P 222 -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no \
+            /tmp/syndicate.sh \
+            ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:/tmp/syndicate.sh
+          ssh -p 222 -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no \
+            ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} \
+            "doas cp /tmp/syndicate.sh /usr/local/bastille/jails/node/root/tmp/syndicate.sh && \
+             SECRET='$SECRET' SITE_URL='$SITE_URL' \
+             doas bastille cmd node sh /tmp/syndicate.sh"