gitreef

commit 2815b312653c4f5d108a8a5ffead27898f68a6e8
parent 74f0b3ba3318ae196726929647ece4f2d0d11f6c
Author: Matthias Jaros <jaros@mailbox.org>
Date:   Sun, 19 Oct 2025 18:19:14 +0200

Cleaned up file structure and script

Diffstat:
M
docker-compose.yml
 | 
10
+++++-----
M
init
 | 
51
++++++++++++++++++++++++++++++++++++++++-----------
M
run
 | 
14
++++++++++----
M
ssh.conf
 | 
6
+++---

4 files changed, 58 insertions(+), 23 deletions(-)
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -8,10 +8,10 @@ services:
       - "2222:22"
     restart: no
     command:
-      - "--users"
-      - pass,yolo
-      - "--repos"
-      - pass:pass,yolo:yolo
+      - --users
+      - pass,yolo,git
+      - --repos
+      - /pass.git:pass,/yolo.git:yolo
     volumes:
-      - ./keys:/var/keys
+      - ./ssh:/var/ssh
       - ./repos:/srv/repos
diff --git a/init b/init
@@ -3,15 +3,15 @@
 argparse 'u/users=+' 'r/repos=+' -- $argv
 or exit 1;
 
-# setup git user
-adduser git -D --shell "/usr/bin/git-shell"
+set REPO_PERMISSIONS /etc/repo-permissions
+set REPO_REGEX "^((?:\/[a-zA-Z-]+)+.git)\$"
 
-# create users and copy keys in correct location, set permissions
-for user in (string split ',' $_flag_u)
+function createUser
+	set -l user $argv[1]
 	echo "Setting up user: $user"
 	if [ "$user" = git ]
-		echo "Denied because user git is reserved"
-		continue
+		echo "Error: User git is reserved"
+		return 1
 	end
 
 	set -l HOME "/home/$user"
@@ -20,22 +20,31 @@ for user in (string split ',' $_flag_u)
 	adduser --home $HOME -D "$user"
 	passwd -u "$user"
 	mkdir "$HOME/.ssh"
-	cp "/var/keys/$user/authorized_keys" "$HOME/.ssh/"
+	cp "/var/ssh/clients/$user" "$HOME/.ssh/authorized_keys"
 	chown -R $user "$HOME"
 	chmod -R 700 "$HOME"
 end
 
-for repoConfig in (string split ',' $_flag_r)
+function setupRepo
+	set -l repoConfig $argv[1]
 	set -l parsedConfig (string split ':' $repoConfig)
 	set -l repo $parsedConfig[1]
 
+	# check repo name
+	set -l matcher (string match -r -g $REPO_REGEX $repo)
+	if test -z $matcher[1]
+		echo "Invalid repo name $repo"
+		return 1
+	end
+
 	# we assume all repos to be in /srv/repos
-	set -l repoDir "/srv/repos/$repo.git"
+	set -l repoDir srv repos
+	set -l repoDir /(string join -n '/' $repoDir (string split '/' $repo))
 	echo "Setting up repo: $repo"
 
 	# write user as allowed into permission file
 	for user in $parsedConfig[2..]
-		echo "$repoDir:$user" >> /srv/repos/permissions
+		echo "$repoDir:$user" >> $REPO_PERMISSIONS
 	end
 
 	# setup repo dir
@@ -47,8 +56,28 @@ for repoConfig in (string split ',' $_flag_r)
 	chmod -R 700 "$repoDir"
 end
 
+#
+# Setup users
+# First and reserved is git user, which has access to all 
+# git repos
+#
+adduser git -D --shell "/usr/bin/git-shell"
+for user in (string split ',' $_flag_u)
+	createUser "$user"
+end
+
+#
+# Setup repos
+# First and reserved is git user, which has access to all 
+# git repos
+#
+echo > $REPO_PERMISSIONS
+for repoConfig in (string split ',' $_flag_r)
+	setupRepo "$repoConfig"
+end
+
 echo "Setting up server"
 # generate host keys in case
-mkdir -p /var/keys/etc/ssh/ && ssh-keygen -A -f /var/keys
+mkdir -p /var/ssh/host/etc/ssh/ && ssh-keygen -A -f /var/ssh/host
 # run ssh daemon
 /usr/sbin/sshd -D -e
diff --git a/run b/run
@@ -1,10 +1,16 @@
 #!/usr/bin/env fish
 
+set REPO_PERMISSIONS /etc/repo-permissions
+set GIT_COMMAND_REGEX "^(git-(?:upload-pack|receive-pack|upload-archive)) '((?:\/[a-zA-Z-]+)+.git)'\$"
 # echo check for permissions
-set -l USER (whoami)
-set matcher (string match -r -g "^.*'(.*)'\$" "$argv")
-cat /srv/repos/permissions | grep -q -E "^$matcher[1]:$USER"
+set -l checkUser (whoami)
+set -l matcher (string match -r -g $GIT_COMMAND_REGEX "$argv")
+set -l gitCommand $matcher[1]
+set -l repo $matcher[2]
+set -l repoDir srv repos
+set -l repoDir /(string join -n '/' $repoDir (string split '/' $repo))
+cat $REPO_PERMISSIONS | grep -q -E "^$repoDir:$checkUser"
 or exit 1;
 
 # run command
-/usr/bin/sudo -u git /usr/bin/git-shell -c "$argv"
+/usr/bin/sudo -u git /usr/bin/git-shell -c "$gitCommand '$repoDir'"
diff --git a/ssh.conf b/ssh.conf
@@ -1,9 +1,9 @@
 PermitRootLogin no
 PasswordAuthentication no
 
-HostKey /var/keys/etc/ssh/ssh_host_rsa_key
-HostKey /var/keys/etc/ssh/ssh_host_ecdsa_key
-HostKey /var/keys/etc/ssh/ssh_host_ed25519_key
+HostKey /var/ssh/host/etc/ssh/ssh_host_rsa_key
+HostKey /var/ssh/host/etc/ssh/ssh_host_ecdsa_key
+HostKey /var/ssh/host/etc/ssh/ssh_host_ed25519_key
 
 # Logging
 SyslogFacility AUTH