Git key import again

This commit is contained in:
nold 2020-03-26 18:16:56 +01:00
parent 0108fcf653
commit 0dc25d5428
8 changed files with 69 additions and 71 deletions

1
.gitignore vendored
View file

@ -1,2 +1,3 @@
/backup /backup
/sshkeys /sshkeys
.env

View file

@ -13,7 +13,7 @@ VOLUME /backup
ENV DEBIAN_FRONTEND noninteractive ENV DEBIAN_FRONTEND noninteractive
RUN apt-get update && apt-get -y --no-install-recommends install \ RUN apt-get update && apt-get -y --no-install-recommends install \
borgbackup openssh-server git ca-certificates && apt-get clean && \ borgbackup openssh-server && apt-get clean && \
useradd -s /bin/bash -m -U borg && \ useradd -s /bin/bash -m -U borg && \
mkdir /home/borg/.ssh && \ mkdir /home/borg/.ssh && \
chmod 700 /home/borg/.ssh && \ chmod 700 /home/borg/.ssh && \

9
Dockerfile.pullgit Normal file
View file

@ -0,0 +1,9 @@
############################################################
# Dockerfile to build borgbackup server images with git-pull support!
# Based on Debian
############################################################
FROM borgserver:latest
RUN apt-get update && apt-get -y --no-install-recommends install \
git ca-certificates && apt-get clean && \
rm -rf /var/lib/apt/lists/* /var/tmp/* /tmp/*

View file

@ -1,40 +1,28 @@
#!/bin/bash #!/bin/bash
# This script generates the authorized_keys file from SSH_KEY_DIR
# authorized_keys will only get overridden after syntax check
set -e set -e
source env.sh source env.sh
function error_exit { TMPFILE=$(mktemp)
echo
echo "$@"
if [ -e "${AUTHORIZED_KEYS_PATH}.bkp" ]; then
echo "Restore authorized_keys backup ${AUTHORIZED_KEYS_PATH}.bkp"
mv "${AUTHORIZED_KEYS_PATH}.bkp" "${AUTHORIZED_KEYS_PATH}"
fi
exit 1
}
#Trap the killer signals so that we can exit with a good message.
trap "error_exit 'Received signal SIGHUP'" SIGHUP
trap "error_exit 'Received signal SIGINT'" SIGINT
trap "error_exit 'Received signal SIGTERM'" SIGTERM
echo "######################################################" echo "######################################################"
echo "* Regenerate borgserver authorized_keys *" echo "* Regenerate borgserver authorized_keys *"
echo "######################################################" echo "######################################################"
if [ -e "${AUTHORIZED_KEYS_PATH}" ]; then
cp "${AUTHORIZED_KEYS_PATH}" "${AUTHORIZED_KEYS_PATH}.bkp"
rm "${AUTHORIZED_KEYS_PATH}"
fi
# Add every key to borg-users authorized_keys # Add every key to borg-users authorized_keys
for keyfile in $(find "${SSH_KEY_DIR}/clients" ! -regex '.*/\..*' -a -type f); do for keyfile in $(find "${SSH_KEY_DIR}/clients" ! -regex '.*/\..*' -a -type f); do
client_name=$(basename ${keyfile}) client_name=$(basename ${keyfile})
echo "Add $client_name ssh key"
# Only import valid keyfiles, skip other files
if ! ssh-keygen -lf $keyfile >/dev/null ; then
echo " Warning: Skipping invalid ssh-key file '$keyfile'"
continue
fi
if [ ! -d "${BORG_DATA_DIR}/${client_name}" ]; then if [ ! -d "${BORG_DATA_DIR}/${client_name}" ]; then
mkdir "${BORG_DATA_DIR}/${client_name}" #2>/dev/null
echo " ** Adding client ${client_name} with repo path ${BORG_DATA_DIR}/${client_name}" echo " ** Adding client ${client_name} with repo path ${BORG_DATA_DIR}/${client_name}"
mkdir "${BORG_DATA_DIR}/${client_name}"
else else
echo "Directory ${BORG_DATA_DIR}/${client_name} exists: Nothing to do" echo "Directory ${BORG_DATA_DIR}/${client_name} exists: Nothing to do"
fi fi
@ -49,18 +37,19 @@ for keyfile in $(find "${SSH_KEY_DIR}/clients" ! -regex '.*/\..*' -a -type f); d
borg_cmd="${BORG_CMD} --append-only" borg_cmd="${BORG_CMD} --append-only"
fi fi
echo -n "command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${AUTHORIZED_KEYS_PATH} echo -n "command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${TMPFILE}
cat ${keyfile} >> ${AUTHORIZED_KEYS_PATH} cat ${keyfile} >> ${TMPFILE}
done done
# Due to `set -e` the script will end here on failure anyways
echo " * Validating structure of generated ${AUTHORIZED_KEYS_PATH}..." echo " * Validating structure of generated ${AUTHORIZED_KEYS_PATH}..."
ERROR=$(ssh-keygen -lf ${AUTHORIZED_KEYS_PATH} 2>&1 >/dev/null) ssh-keygen -lf ${TMPFILE} >/dev/null
if [ $? -ne 0 ]; then
echo "ERROR: ${ERROR}" mv ${TMPFILE} ${AUTHORIZED_KEYS_PATH}
exit 1 echo " ** Success"
fi
chown -R borg:borg ${BORG_DATA_DIR} chown -R borg:borg ${BORG_DATA_DIR}
chown borg:borg ${AUTHORIZED_KEYS_PATH} chown borg:borg ${AUTHORIZED_KEYS_PATH}
chmod 600 ${AUTHORIZED_KEYS_PATH} chmod 600 ${AUTHORIZED_KEYS_PATH}
rm -f ${AUTHORIZED_KEYS_PATH}.bkp
exit 0

View file

@ -1,9 +1,23 @@
BORG_DATA_DIR=/backup # Default values for environment
SSH_KEY_DIR=/sshkeys PATH=$PATH:/usr/local/bin
BORG_CMD='cd ${BORG_DATA_DIR}/${client_name}; borg serve --restrict-to-path ${BORG_DATA_DIR}/${client_name} ${BORG_SERVE_ARGS}' PUID=${PUID:-1000}
AUTHORIZED_KEYS_PATH=/home/borg/.ssh/authorized_keys PGID=${PGID:-1000}
# Append only mode? # Append only mode?
BORG_APPEND_ONLY=${BORG_APPEND_ONLY:=no} BORG_APPEND_ONLY=${BORG_APPEND_ONLY:=no}
export BORG_DATA_DIR SSH_KEY_DIR BORG_CMD AUTHORIZED_KEYS_PATH BORG_APPEND_ONLY # Volume for backup repositories
BORG_DATA_DIR=${BORG_DATA_DIR:-/backup}
# Branch of KEY_GIT_URL
KEY_GIT_BRANCH=${KEY_GIT_BRANCH:-master}
# This will contain the host and client keys
SSH_KEY_DIR=${SSH_KEY_DIR:-/sshkeys}
### CAUTION
# This is more of a template then something you need to change, it should stay static
BORG_CMD='cd ${BORG_DATA_DIR}/${client_name}; borg serve --restrict-to-path ${BORG_DATA_DIR}/${client_name} ${BORG_SERVE_ARGS}'
# Path to authorized_keys file
AUTHORIZED_KEYS_PATH=${AUTHORIZED_KEYS_PATH:-/home/borg/.ssh/authorized_keys}

View file

@ -1,42 +1,29 @@
#!/bin/bash #!/bin/bash
# Start Script for docker-borgserver # Start Script for docker-borgserver
set -e set -e
source env.sh
PUID=${PUID:-1000}
PGID=${PGID:-1000}
usermod -o -u "$PUID" borg &>/dev/null usermod -o -u "$PUID" borg &>/dev/null
groupmod -o -g "$PGID" borg &>/dev/null groupmod -o -g "$PGID" borg &>/dev/null
#source variables
source env.sh
echo "########################################################" echo "########################################################"
echo -n " * Docker BorgServer powered by " echo -n " * Docker BorgServer powered by "
borg -V borg -V
echo "########################################################" echo "########################################################"
echo " * User id: $(id -u borg)" echo " * User id: $(id -u borg)"
echo " * Group id: $(id -g borg)" echo " * Group id: $(id -g borg)"
if [ -z "${BORG_SSHKEYS_REPO}" ] ; then if [ -z "${KEY_GIT_URL}" ] ; then
echo "* Pulling keys from ${BORG_SSHKEYS_REPO}" echo "* Pulling keys from ${KEY_GIT_URL}"
fi fi
echo "########################################################" echo "########################################################"
# Precheck if BORG_ADMIN is set # Precheck if BORG_ADMIN is set
if [ "${BORG_APPEND_ONLY}" == "yes" ] && [ -z "${BORG_ADMIN}" ] ; then if [ "${BORG_APPEND_ONLY}" == "yes" ] && [ -z "${BORG_ADMIN}" ] ; then
echo "WARNING: BORG_APPEND_ONLY is active, but no BORG_ADMIN was specified!" echo "WARNING: BORG_APPEND_ONLY is active, but no BORG_ADMIN was specified!"
fi fi
# Init the ssh keys directory from a remote git repository # Init the ssh keys directory from a remote git repository
if [ ! -z "${BORG_SSHKEYS_REPO}" ] ; then update-ssh-keys.sh
if [ ! -d ${SSH_KEY_DIR}/clients ] ; then
git clone "${BORG_SSHKEYS_REPO}" ${SSH_KEY_DIR}/clients
else
/usr/local/bin/update-ssh-keys.sh ${SSH_KEY_DIR}
fi
fi
# Precheck directories & client ssh-keys # Precheck directories & client ssh-keys
for dir in BORG_DATA_DIR SSH_KEY_DIR ; do for dir in BORG_DATA_DIR SSH_KEY_DIR ; do
@ -63,16 +50,8 @@ for keytype in ed25519 rsa ; do
fi fi
done done
echo "########################################################"
echo " * Starting SSH-Key import..."
# Add every key to borg-users authorized_keys # Add every key to borg-users authorized_keys
create-client-dirs.sh \ create-client-dirs.sh
"${SSH_KEY_DIR}" \
"${BORG_DATA_DIR}" \
"${AUTHORIZED_KEYS_PATH}" \
"${BORG_CMD}" \
"${BORG_APPEND_ONLY}"
echo "########################################################" echo "########################################################"
echo " * Init done! Starting SSH-Daemon..." echo " * Init done! Starting SSH-Daemon..."

View file

@ -1,17 +1,20 @@
#!/bin/bash #!/bin/bash
# This script updates the authorized_keys file
# Will clone/pull ssh-pubkeys from GIT_KEY_URL if set
set -e set -e
source env.sh source env.sh
if [ -d "${SSH_KEY_DIR}/clients/.git" ] ; then if [ -d "${SSH_KEY_DIR}/clients/.git" ] ; then
cd "${SSH_KEY_DIR}/clients" || exit 0 git -C "${SSH_KEY_DIR}/clients" fetch
git fetch if ! git -C "${SSH_KEY_DIR}/clients" diff --quiet remotes/origin/HEAD; then
if ! git diff --quiet remotes/origin/HEAD; then
echo "Pull from git repository" echo "Pull from git repository"
git pull git -C "${SSH_KEY_DIR}/clients" pull
create-client-dirs.sh create-client-dirs.sh
else else
echo "$0: Nothing to do" echo "$0: Nothing to do"
fi fi
elif [ ! -z "${KEY_GIT_URL}" ] ; then
git clone --depth=1 -b ${KEY_GIT_BRANCH} ${KEY_GIT_URL} ${SSH_KEY_DIR}/clients
fi fi
exit 0

View file

@ -1,13 +1,16 @@
version: '3' version: '3'
services: services:
borgserver: borgserver:
image: nold360/borgserver #image: nold360/borgserver
#build: . build:
context: .
dockerfile: Dockerfile.pullgit
volumes: volumes:
- ./backup:/backup - ./backup:/backup
- ./sshkeys:/sshkeys - ./sshkeys:/sshkeys
ports: ports:
- "2222:22" - "2222:22"
env_file: .env
environment: environment:
BORG_SERVE_ARGS: "" BORG_SERVE_ARGS: ""