gitreef

commit 46c5aee60c0c1d25b7e8577a2d466875186f77d4
parent 3f3affbbf43c1184878950b1202dfa45cb081962
Author: Matthias Jaros <jaros@mailbox.org>
Date:   Mon, 20 Oct 2025 08:26:24 +0200

Put user authorized keys into environment file

Diffstat:
M
docker-compose.yml
 | 
4
++--
M
init
 | 
18
+++++++++++-------
M
ssh.conf
 | 
6
+++---

3 files changed, 16 insertions(+), 12 deletions(-)
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -9,8 +9,8 @@ services:
     restart: no
     environment:
       - GIT_UID=1000
-      - USER_PASS=pass
-      - REPO_PASS=/pass.git:pass
+      - USER_handy=handy:ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPsl91WPAT8aWwZ6y5WAfXU9PoHzxJ3YG9uFgSmlGQr2HwV+gL/XaTBJ4Brj+pa+R7tfYEBMi+7Navx/ZsEmr9E= mj@xps15
+      - REPO_pass=/pass.git:handy
     volumes:
       - ./ssh:/var/ssh
       - ./repos:/srv/repos
diff --git a/init b/init
@@ -10,7 +10,9 @@ set _REPO_PERMISSIONS /etc/repo-permissions
 set _REPO_REGEX "^((?:\/[a-zA-Z-]+)+.git)\$"
 
 function createUser
-	set -l user $argv[1]
+	set -l userConfig (string split ':' $argv[1])
+	set -l user $userConfig[1]
+	set -l key $userConfig[2]
 	echo "Setting up user: $user"
 	if [ "$user" = git ]
 		echo "Error: User git is reserved"
@@ -24,7 +26,7 @@ function createUser
 	# unlock account to allow ssh logins
 	passwd -u "$user"
 	mkdir "$HOME/.ssh"
-	cp "/var/ssh/clients/$user" "$HOME/.ssh/authorized_keys"
+	echo "$key" > "$HOME/.ssh/authorized_keys"
 	chown -R $user "$HOME"
 	chmod -R 700 "$HOME"
 end
@@ -74,9 +76,9 @@ if set -q _flag_h
 	echo -e ""
 	echo -e "OPTIONS"
 	echo -e "\t -h, --help \t\t Display this page"
-	echo -e "\t -g, --git-uid \t UID of the git user that is used also as ownership for all repos"
-	echo -e "\t -u, --user \t\t Setting up a user"
-	echo -e "\t -r, --repo \t\t Setting up a repo in form <repo-path>[:user1]+ for each user who should have access to it"
+	echo -e "\t -g, --git-uid \t\t UID of the git user that is used also as ownership for all repos"
+	echo -e "\t -u, --user \t\t User setting in form of <user-name>:<public-key>"
+	echo -e "\t -r, --repo \t\t Repo setting in form of <repo-path>:<allowed-user1>. You can add as many users as you want. Currently if a user is allowed he has all permissions read/write"
 	echo -e ""
 	return
 end
@@ -97,9 +99,11 @@ if set -q $_flag_g
 end
 
 # Setup users
+# git user has read/write access to all repos, set git-shell
+# and no password login allowed -> no ssh login possible
 adduser git -u $GIT_UID -D --shell "/usr/bin/git-shell"
-for user in $users
-	createUser "$user"
+for userConfig in $users
+	createUser "$userConfig"
 end
 
 # Setup repos
diff --git a/ssh.conf b/ssh.conf
@@ -5,9 +5,9 @@ PermitTTY no
 AllowAgentForwarding no
 
 # Point keys to shared data dir
-HostKey /var/ssh/host/etc/ssh/ssh_host_rsa_key
-HostKey /var/ssh/host/etc/ssh/ssh_host_ecdsa_key
-HostKey /var/ssh/host/etc/ssh/ssh_host_ed25519_key
+HostKey /var/ssh/etc/ssh/ssh_host_rsa_key
+HostKey /var/ssh/etc/ssh/ssh_host_ecdsa_key
+HostKey /var/ssh/etc/ssh/ssh_host_ed25519_key
 
 # Logging
 SyslogFacility AUTH