Created Init-Container that pulls pubkeys from git, creates authorized_keys, ssh-host-keys and backup-repo folders

server/Dockerfile

@@ -0,0 +1,36 @@
+############################################################
+# Dockerfile to build borgbackup server images
+# Based on Debian
+############################################################
+FROM debian:buster-slim
+
+# Volume for SSH-Host-Keys
+VOLUME /sshkeys
+
+# Volume for borg repositories
+VOLUME /backup
+
+# Volume for authorized_keys exchange from init
+VOLUME /home/borg
+
+RUN export DEBIAN_FRONTEND=noninteractive && \
+		apt-get update && \
+		apt-get -y --no-install-recommends install \
+		borgbackup openssh-server iputils-ping && \
+		apt-get clean && \
+		useradd -s /bin/bash -m -U borg && \
+		mkdir /home/borg/.ssh && \
+		chmod 700 /home/borg/.ssh && \
+		touch /home/borg/.ssh/authorized_keys && \
+		chown -R borg:borg /home/borg /backup && \
+		mkdir /run/sshd && \
+		rm -f /etc/ssh/ssh_host*key* && \
+		rm -rf /var/lib/apt/lists/* /var/tmp/* /tmp/*
+
+COPY ./entrypoint.sh /entrypoint.sh
+COPY ./sshd_config /etc/ssh/sshd_config
+
+USER borg
+EXPOSE 2222
+
+ENTRYPOINT /entrypoint.sh

server/entrypoint.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+# Start Script for docker-borgserver
+
+PUID=${PUID:-1000}
+PGID=${PGID:-1000}
+
+usermod -o -u "$PUID" borg &>/dev/null
+groupmod -o -g "$PGID" borg &>/dev/null
+
+BORG_DATA_DIR=${BORG_DATA_DIR:-/backup}
+SSH_KEY_DIR=${SSH_KEY_DIR:-/sshkeys}
+BORG_CMD='cd ${BORG_DATA_DIR}/${client_name}; borg serve --restrict-to-path ${BORG_DATA_DIR}/${client_name} ${BORG_SERVE_ARGS}'
+AUTHORIZED_KEYS_PATH=/home/borg/.ssh/authorized_keys
+
+# Append only mode?
+BORG_APPEND_ONLY=${BORG_APPEND_ONLY:=no}
+
+echo "########################################################"
+echo " * Docker BorgServer powered by $(borg -V)"
+echo "########################################################"
+echo " * $(id)"
+echo "########################################################"
+
+echo -n "Waiting for init-container to finish..."
+sleep 5
+while ping -c2 init >/dev/null 2>/dev/null ; do
+  echo .
+  sleep 3
+done
+echo " done"
+
+# Precheck if BORG_ADMIN is set
+if [ "${BORG_APPEND_ONLY}" == "yes" ] && [ -z "${BORG_ADMIN}" ] ; then
+  echo "WARNING: BORG_APPEND_ONLY is active, but no BORG_ADMIN was specified!"
+fi
+
+# Precheck directories & client ssh-keys
+for dir in BORG_DATA_DIR SSH_KEY_DIR ; do
+  dirpath=$(eval echo '$'${dir})
+  echo " * Testing Volume ${dir}: ${dirpath}"
+  if [ ! -d "${dirpath}" ] ; then
+    echo " ! ERROR: ${dirpath} is no directory!"
+    exit 1
+  fi
+done
+
+for keytype in ed25519 rsa ; do
+  if [ ! -f "${SSH_KEY_DIR}/ssh_host_${keytype}_key" ] ; then
+    echo " ! WARNING: SSH-Host-Key $keytype doesn't exist!"
+    continue
+  fi
+done
+
+echo "########################################################"
+echo " * Checking authorized_keys file..."
+# Check if authorzied_keys is valid
+if ! ssh-keygen -lf ${AUTHORIZED_KEYS_PATH} >/dev/null; then
+  echo " ! ERROR: '${AUTHORIZED_KEYS_PATH}' is not a valid authorized_keys-file."
+  exit 1
+fi
+
+echo "########################################################"
+echo " * Init done! Starting SSH-Daemon..."
+/usr/sbin/sshd -D -e

server/sshd_config

@@ -0,0 +1,29 @@
+Port 2222
+AddressFamily any
+ListenAddress 0.0.0.0
+ListenAddress ::
+
+HostKey /sshkeys/ssh_host_rsa_key
+HostKey /sshkeys/ssh_host_ed25519_key
+
+PidFile /tmp/sshd.pid
+
+PermitRootLogin no
+StrictModes yes
+MaxSessions 20
+
+PubkeyAuthentication yes
+AuthorizedKeysFile	/home/borg/.ssh/authorized_keys
+
+LogLevel INFO
+
+PasswordAuthentication no
+ChallengeResponseAuthentication no
+UsePAM yes
+AllowAgentForwarding no
+AllowTcpForwarding no
+X11Forwarding no
+PermitTTY no
+PrintMotd no
+PermitTunnel no
+Subsystem	sftp	/bin/false