From 0dc25d54283fe064f22b504f5e5982e6a9a41752 Mon Sep 17 00:00:00 2001 From: nold Date: Thu, 26 Mar 2020 18:16:56 +0100 Subject: [PATCH] Git key import again --- .gitignore | 1 + Dockerfile | 2 +- Dockerfile.pullgit | 9 +++++++ data/create-client-dirs.sh | 51 +++++++++++++++----------------------- data/env.sh | 24 ++++++++++++++---- data/run.sh | 31 ++++------------------- data/update-ssh-keys.sh | 15 ++++++----- docker-compose.yml | 7 ++++-- 8 files changed, 69 insertions(+), 71 deletions(-) create mode 100644 Dockerfile.pullgit diff --git a/.gitignore b/.gitignore index ae9c630..60ba08a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /backup /sshkeys +.env diff --git a/Dockerfile b/Dockerfile index e8cd4ca..af7b621 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,7 +13,7 @@ VOLUME /backup ENV DEBIAN_FRONTEND noninteractive RUN apt-get update && apt-get -y --no-install-recommends install \ - borgbackup openssh-server git ca-certificates && apt-get clean && \ + borgbackup openssh-server && apt-get clean && \ useradd -s /bin/bash -m -U borg && \ mkdir /home/borg/.ssh && \ chmod 700 /home/borg/.ssh && \ diff --git a/Dockerfile.pullgit b/Dockerfile.pullgit new file mode 100644 index 0000000..ab642cf --- /dev/null +++ b/Dockerfile.pullgit @@ -0,0 +1,9 @@ +############################################################ +# Dockerfile to build borgbackup server images with git-pull support! +# Based on Debian +############################################################ +FROM borgserver:latest + +RUN apt-get update && apt-get -y --no-install-recommends install \ + git ca-certificates && apt-get clean && \ + rm -rf /var/lib/apt/lists/* /var/tmp/* /tmp/* diff --git a/data/create-client-dirs.sh b/data/create-client-dirs.sh index 2eddb32..e3bc7dd 100755 --- a/data/create-client-dirs.sh +++ b/data/create-client-dirs.sh @@ -1,40 +1,28 @@ #!/bin/bash - +# This script generates the authorized_keys file from SSH_KEY_DIR +# authorized_keys will only get overridden after syntax check set -e - source env.sh -function error_exit { - echo - echo "$@" - if [ -e "${AUTHORIZED_KEYS_PATH}.bkp" ]; then - echo "Restore authorized_keys backup ${AUTHORIZED_KEYS_PATH}.bkp" - mv "${AUTHORIZED_KEYS_PATH}.bkp" "${AUTHORIZED_KEYS_PATH}" - fi - exit 1 -} - -#Trap the killer signals so that we can exit with a good message. -trap "error_exit 'Received signal SIGHUP'" SIGHUP -trap "error_exit 'Received signal SIGINT'" SIGINT -trap "error_exit 'Received signal SIGTERM'" SIGTERM +TMPFILE=$(mktemp) echo "######################################################" echo "* Regenerate borgserver authorized_keys *" echo "######################################################" -if [ -e "${AUTHORIZED_KEYS_PATH}" ]; then - cp "${AUTHORIZED_KEYS_PATH}" "${AUTHORIZED_KEYS_PATH}.bkp" - rm "${AUTHORIZED_KEYS_PATH}" -fi - # Add every key to borg-users authorized_keys for keyfile in $(find "${SSH_KEY_DIR}/clients" ! -regex '.*/\..*' -a -type f); do client_name=$(basename ${keyfile}) - echo "Add $client_name ssh key" + + # Only import valid keyfiles, skip other files + if ! ssh-keygen -lf $keyfile >/dev/null ; then + echo " Warning: Skipping invalid ssh-key file '$keyfile'" + continue + fi + if [ ! -d "${BORG_DATA_DIR}/${client_name}" ]; then - mkdir "${BORG_DATA_DIR}/${client_name}" #2>/dev/null echo " ** Adding client ${client_name} with repo path ${BORG_DATA_DIR}/${client_name}" + mkdir "${BORG_DATA_DIR}/${client_name}" else echo "Directory ${BORG_DATA_DIR}/${client_name} exists: Nothing to do" fi @@ -49,18 +37,19 @@ for keyfile in $(find "${SSH_KEY_DIR}/clients" ! -regex '.*/\..*' -a -type f); d borg_cmd="${BORG_CMD} --append-only" fi - echo -n "command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${AUTHORIZED_KEYS_PATH} - cat ${keyfile} >> ${AUTHORIZED_KEYS_PATH} + echo -n "command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${TMPFILE} + cat ${keyfile} >> ${TMPFILE} done +# Due to `set -e` the script will end here on failure anyways echo " * Validating structure of generated ${AUTHORIZED_KEYS_PATH}..." -ERROR=$(ssh-keygen -lf ${AUTHORIZED_KEYS_PATH} 2>&1 >/dev/null) -if [ $? -ne 0 ]; then - echo "ERROR: ${ERROR}" - exit 1 -fi +ssh-keygen -lf ${TMPFILE} >/dev/null + +mv ${TMPFILE} ${AUTHORIZED_KEYS_PATH} +echo " ** Success" chown -R borg:borg ${BORG_DATA_DIR} chown borg:borg ${AUTHORIZED_KEYS_PATH} chmod 600 ${AUTHORIZED_KEYS_PATH} -rm -f ${AUTHORIZED_KEYS_PATH}.bkp + +exit 0 diff --git a/data/env.sh b/data/env.sh index ad8fd4f..0f32096 100755 --- a/data/env.sh +++ b/data/env.sh @@ -1,9 +1,23 @@ -BORG_DATA_DIR=/backup -SSH_KEY_DIR=/sshkeys -BORG_CMD='cd ${BORG_DATA_DIR}/${client_name}; borg serve --restrict-to-path ${BORG_DATA_DIR}/${client_name} ${BORG_SERVE_ARGS}' -AUTHORIZED_KEYS_PATH=/home/borg/.ssh/authorized_keys +# Default values for environment +PATH=$PATH:/usr/local/bin +PUID=${PUID:-1000} +PGID=${PGID:-1000} # Append only mode? BORG_APPEND_ONLY=${BORG_APPEND_ONLY:=no} -export BORG_DATA_DIR SSH_KEY_DIR BORG_CMD AUTHORIZED_KEYS_PATH BORG_APPEND_ONLY +# Volume for backup repositories +BORG_DATA_DIR=${BORG_DATA_DIR:-/backup} + +# Branch of KEY_GIT_URL +KEY_GIT_BRANCH=${KEY_GIT_BRANCH:-master} + +# This will contain the host and client keys +SSH_KEY_DIR=${SSH_KEY_DIR:-/sshkeys} + +### CAUTION +# This is more of a template then something you need to change, it should stay static +BORG_CMD='cd ${BORG_DATA_DIR}/${client_name}; borg serve --restrict-to-path ${BORG_DATA_DIR}/${client_name} ${BORG_SERVE_ARGS}' + +# Path to authorized_keys file +AUTHORIZED_KEYS_PATH=${AUTHORIZED_KEYS_PATH:-/home/borg/.ssh/authorized_keys} diff --git a/data/run.sh b/data/run.sh index e717be5..f57d8ec 100755 --- a/data/run.sh +++ b/data/run.sh @@ -1,42 +1,29 @@ #!/bin/bash # Start Script for docker-borgserver - set -e - -PUID=${PUID:-1000} -PGID=${PGID:-1000} +source env.sh usermod -o -u "$PUID" borg &>/dev/null groupmod -o -g "$PGID" borg &>/dev/null -#source variables -source env.sh - echo "########################################################" echo -n " * Docker BorgServer powered by " borg -V echo "########################################################" echo " * User id: $(id -u borg)" echo " * Group id: $(id -g borg)" -if [ -z "${BORG_SSHKEYS_REPO}" ] ; then - echo "* Pulling keys from ${BORG_SSHKEYS_REPO}" +if [ -z "${KEY_GIT_URL}" ] ; then + echo "* Pulling keys from ${KEY_GIT_URL}" fi echo "########################################################" - # Precheck if BORG_ADMIN is set if [ "${BORG_APPEND_ONLY}" == "yes" ] && [ -z "${BORG_ADMIN}" ] ; then echo "WARNING: BORG_APPEND_ONLY is active, but no BORG_ADMIN was specified!" fi # Init the ssh keys directory from a remote git repository -if [ ! -z "${BORG_SSHKEYS_REPO}" ] ; then - if [ ! -d ${SSH_KEY_DIR}/clients ] ; then - git clone "${BORG_SSHKEYS_REPO}" ${SSH_KEY_DIR}/clients - else - /usr/local/bin/update-ssh-keys.sh ${SSH_KEY_DIR} - fi -fi +update-ssh-keys.sh # Precheck directories & client ssh-keys for dir in BORG_DATA_DIR SSH_KEY_DIR ; do @@ -63,16 +50,8 @@ for keytype in ed25519 rsa ; do fi done -echo "########################################################" -echo " * Starting SSH-Key import..." - # Add every key to borg-users authorized_keys -create-client-dirs.sh \ - "${SSH_KEY_DIR}" \ - "${BORG_DATA_DIR}" \ - "${AUTHORIZED_KEYS_PATH}" \ - "${BORG_CMD}" \ - "${BORG_APPEND_ONLY}" +create-client-dirs.sh echo "########################################################" echo " * Init done! Starting SSH-Daemon..." diff --git a/data/update-ssh-keys.sh b/data/update-ssh-keys.sh index c24c53a..bb5f4b0 100755 --- a/data/update-ssh-keys.sh +++ b/data/update-ssh-keys.sh @@ -1,17 +1,20 @@ #!/bin/bash - +# This script updates the authorized_keys file +# Will clone/pull ssh-pubkeys from GIT_KEY_URL if set set -e - source env.sh if [ -d "${SSH_KEY_DIR}/clients/.git" ] ; then - cd "${SSH_KEY_DIR}/clients" || exit 0 - git fetch - if ! git diff --quiet remotes/origin/HEAD; then + git -C "${SSH_KEY_DIR}/clients" fetch + if ! git -C "${SSH_KEY_DIR}/clients" diff --quiet remotes/origin/HEAD; then echo "Pull from git repository" - git pull + git -C "${SSH_KEY_DIR}/clients" pull create-client-dirs.sh else echo "$0: Nothing to do" fi +elif [ ! -z "${KEY_GIT_URL}" ] ; then + git clone --depth=1 -b ${KEY_GIT_BRANCH} ${KEY_GIT_URL} ${SSH_KEY_DIR}/clients fi + +exit 0 diff --git a/docker-compose.yml b/docker-compose.yml index aabaf84..5c3e12c 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,13 +1,16 @@ version: '3' services: borgserver: - image: nold360/borgserver - #build: . + #image: nold360/borgserver + build: + context: . + dockerfile: Dockerfile.pullgit volumes: - ./backup:/backup - ./sshkeys:/sshkeys ports: - "2222:22" + env_file: .env environment: BORG_SERVE_ARGS: ""