From 0108fcf6532a7cc14042fbc18da0af5001668e45 Mon Sep 17 00:00:00 2001
From: Pietro <pietro.abate@tezcore.com>
Date: Mon, 23 Mar 2020 12:38:34 +0100
Subject: [PATCH 01/14] Split run.sh and add git retrival

This patch modularize run.sh, adding two new helper scripts and
make it possible to specify a git repository for ssh keys via a
new env variable `BORG_SSHKEYS_REPO`.

the modularization add two new files :
- `env.sh` : define a few envriroment variables
- `create-client-dirs.sh`  : update and create user directories and
  re-create authorized_keys

We also add a new script `update-ssh-keys.sh` to be called regurlarly
in a cron job to check if the git repository is up-to-date and
eventually adding/removing users.
---
 Dockerfile                 |  5 ++-
 data/create-client-dirs.sh | 66 ++++++++++++++++++++++++++++++++++++++
 data/env.sh                |  9 ++++++
 data/run.sh                | 59 +++++++++++++---------------------
 data/update-ssh-keys.sh    | 17 ++++++++++
 5 files changed, 118 insertions(+), 38 deletions(-)
 create mode 100755 data/create-client-dirs.sh
 create mode 100755 data/env.sh
 create mode 100755 data/update-ssh-keys.sh

diff --git a/Dockerfile b/Dockerfile
index a682457..e8cd4ca 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@ VOLUME /backup
 ENV DEBIAN_FRONTEND noninteractive
 
 RUN apt-get update && apt-get -y --no-install-recommends install \
-		borgbackup openssh-server && apt-get clean && \
+		borgbackup openssh-server git ca-certificates && apt-get clean && \
 		useradd -s /bin/bash -m -U borg && \
 		mkdir /home/borg/.ssh && \
 		chmod 700 /home/borg/.ssh && \
@@ -24,6 +24,9 @@ RUN apt-get update && apt-get -y --no-install-recommends install \
 
 COPY ./data/run.sh /run.sh
 COPY ./data/sshd_config /etc/ssh/sshd_config
+COPY ./data/update-ssh-keys.sh /usr/local/bin/
+COPY ./data/create-client-dirs.sh /usr/local/bin/
+COPY ./data/env.sh /usr/local/bin/env.sh
 
 ENTRYPOINT /run.sh
 
diff --git a/data/create-client-dirs.sh b/data/create-client-dirs.sh
new file mode 100755
index 0000000..2eddb32
--- /dev/null
+++ b/data/create-client-dirs.sh
@@ -0,0 +1,66 @@
+#!/bin/bash
+
+set -e
+
+source env.sh
+
+function error_exit {
+    echo
+    echo "$@"
+    if [ -e "${AUTHORIZED_KEYS_PATH}.bkp" ]; then
+      echo "Restore authorized_keys backup ${AUTHORIZED_KEYS_PATH}.bkp"
+      mv "${AUTHORIZED_KEYS_PATH}.bkp" "${AUTHORIZED_KEYS_PATH}"
+    fi
+    exit 1
+}
+
+#Trap the killer signals so that we can exit with a good message.
+trap "error_exit 'Received signal SIGHUP'" SIGHUP
+trap "error_exit 'Received signal SIGINT'" SIGINT
+trap "error_exit 'Received signal SIGTERM'" SIGTERM
+
+echo "######################################################"
+echo "* Regenerate borgserver authorized_keys *"
+echo "######################################################"
+
+if [ -e "${AUTHORIZED_KEYS_PATH}" ]; then
+  cp "${AUTHORIZED_KEYS_PATH}" "${AUTHORIZED_KEYS_PATH}.bkp"
+  rm "${AUTHORIZED_KEYS_PATH}"
+fi
+
+# Add every key to borg-users authorized_keys
+for keyfile in $(find "${SSH_KEY_DIR}/clients" ! -regex '.*/\..*' -a -type f); do
+  client_name=$(basename ${keyfile})
+  echo "Add $client_name ssh key"
+  if [ ! -d "${BORG_DATA_DIR}/${client_name}" ]; then
+    mkdir "${BORG_DATA_DIR}/${client_name}" #2>/dev/null
+    echo "  ** Adding client ${client_name} with repo path ${BORG_DATA_DIR}/${client_name}"
+  else
+    echo "Directory ${BORG_DATA_DIR}/${client_name} exists: Nothing to do"
+  fi
+
+  # If client is $BORG_ADMIN unset $client_name, so path restriction equals $BORG_DATA_DIR
+  # Otherwise add --append-only, if enabled
+  borg_cmd=${BORG_CMD}
+  if [ "${client_name}" == "${BORG_ADMIN}" ] ; then
+    echo "   ** Client '${client_name}' is BORG_ADMIN! **"
+    unset client_name
+  elif [ "${BORG_APPEND_ONLY}" == "yes" ] ; then
+    borg_cmd="${BORG_CMD} --append-only"
+  fi
+
+  echo -n "command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${AUTHORIZED_KEYS_PATH}
+  cat ${keyfile} >> ${AUTHORIZED_KEYS_PATH}
+done
+
+echo " * Validating structure of generated ${AUTHORIZED_KEYS_PATH}..."
+ERROR=$(ssh-keygen -lf ${AUTHORIZED_KEYS_PATH} 2>&1 >/dev/null)
+if [ $? -ne 0 ]; then
+    echo "ERROR: ${ERROR}"
+    exit 1
+fi
+
+chown -R borg:borg ${BORG_DATA_DIR}
+chown borg:borg ${AUTHORIZED_KEYS_PATH}
+chmod 600 ${AUTHORIZED_KEYS_PATH}
+rm -f ${AUTHORIZED_KEYS_PATH}.bkp
diff --git a/data/env.sh b/data/env.sh
new file mode 100755
index 0000000..ad8fd4f
--- /dev/null
+++ b/data/env.sh
@@ -0,0 +1,9 @@
+BORG_DATA_DIR=/backup
+SSH_KEY_DIR=/sshkeys
+BORG_CMD='cd ${BORG_DATA_DIR}/${client_name}; borg serve --restrict-to-path ${BORG_DATA_DIR}/${client_name} ${BORG_SERVE_ARGS}'
+AUTHORIZED_KEYS_PATH=/home/borg/.ssh/authorized_keys
+
+# Append only mode?
+BORG_APPEND_ONLY=${BORG_APPEND_ONLY:=no}
+
+export BORG_DATA_DIR SSH_KEY_DIR BORG_CMD AUTHORIZED_KEYS_PATH BORG_APPEND_ONLY
diff --git a/data/run.sh b/data/run.sh
index e794704..e717be5 100755
--- a/data/run.sh
+++ b/data/run.sh
@@ -1,19 +1,16 @@
 #!/bin/bash
 # Start Script for docker-borgserver
 
+set -e
+
 PUID=${PUID:-1000}
 PGID=${PGID:-1000}
 
 usermod -o -u "$PUID" borg &>/dev/null
 groupmod -o -g "$PGID" borg &>/dev/null
 
-BORG_DATA_DIR=/backup
-SSH_KEY_DIR=/sshkeys
-BORG_CMD='cd ${BORG_DATA_DIR}/${client_name}; borg serve --restrict-to-path ${BORG_DATA_DIR}/${client_name} ${BORG_SERVE_ARGS}'
-AUTHORIZED_KEYS_PATH=/home/borg/.ssh/authorized_keys
-
-# Append only mode?
-BORG_APPEND_ONLY=${BORG_APPEND_ONLY:=no}
+#source variables
+source env.sh
 
 echo "########################################################"
 echo -n " * Docker BorgServer powered by "
@@ -21,6 +18,9 @@ borg -V
 echo "########################################################"
 echo " * User  id: $(id -u borg)"
 echo " * Group id: $(id -g borg)"
+if [ -z "${BORG_SSHKEYS_REPO}" ] ; then
+  echo "* Pulling keys from ${BORG_SSHKEYS_REPO}"
+fi
 echo "########################################################"
 
 
@@ -29,6 +29,15 @@ if [ "${BORG_APPEND_ONLY}" == "yes" ] && [ -z "${BORG_ADMIN}" ] ; then
 	echo "WARNING: BORG_APPEND_ONLY is active, but no BORG_ADMIN was specified!"
 fi
 
+# Init the ssh keys directory from a remote git repository
+if [ ! -z "${BORG_SSHKEYS_REPO}" ] ; then
+  if [ ! -d ${SSH_KEY_DIR}/clients ] ; then
+    git clone "${BORG_SSHKEYS_REPO}" ${SSH_KEY_DIR}/clients
+  else
+     /usr/local/bin/update-ssh-keys.sh ${SSH_KEY_DIR}
+  fi
+fi
+
 # Precheck directories & client ssh-keys
 for dir in BORG_DATA_DIR SSH_KEY_DIR ; do
 	dirpath=$(eval echo '$'${dir})
@@ -58,36 +67,12 @@ echo "########################################################"
 echo " * Starting SSH-Key import..."
 
 # Add every key to borg-users authorized_keys
-rm ${AUTHORIZED_KEYS_PATH} &>/dev/null
-for keyfile in $(find "${SSH_KEY_DIR}/clients" ! -regex '.*/\..*' -a -type f); do
-    client_name=$(basename ${keyfile})
-    mkdir ${BORG_DATA_DIR}/${client_name} 2>/dev/null
-    echo "  ** Adding client ${client_name} with repo path ${BORG_DATA_DIR}/${client_name}"
-
-	# If client is $BORG_ADMIN unset $client_name, so path restriction equals $BORG_DATA_DIR
-	# Otherwise add --append-only, if enabled
-	borg_cmd=${BORG_CMD}
-	if [ "${client_name}" == "${BORG_ADMIN}" ] ; then
-		echo "   ** Client '${client_name}' is BORG_ADMIN! **"
-		unset client_name
-	elif [ "${BORG_APPEND_ONLY}" == "yes" ] ; then
-		borg_cmd="${BORG_CMD} --append-only"
-	fi
-
-    echo -n "command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${AUTHORIZED_KEYS_PATH}
-	cat ${keyfile} >> ${AUTHORIZED_KEYS_PATH}
-done
-
-echo " * Validating structure of generated ${AUTHORIZED_KEYS_PATH}..."
-ERROR=$(ssh-keygen -lf ${AUTHORIZED_KEYS_PATH} 2>&1 >/dev/null)
-if [ $? -ne 0 ]; then
-    echo "ERROR: ${ERROR}"
-    exit 1
-fi
-
-chown -R borg:borg ${BORG_DATA_DIR}
-chown borg:borg ${AUTHORIZED_KEYS_PATH}
-chmod 600 ${AUTHORIZED_KEYS_PATH}
+create-client-dirs.sh \
+  "${SSH_KEY_DIR}" \
+  "${BORG_DATA_DIR}" \
+  "${AUTHORIZED_KEYS_PATH}" \
+  "${BORG_CMD}" \
+  "${BORG_APPEND_ONLY}"
 
 echo "########################################################"
 echo " * Init done! Starting SSH-Daemon..."
diff --git a/data/update-ssh-keys.sh b/data/update-ssh-keys.sh
new file mode 100755
index 0000000..c24c53a
--- /dev/null
+++ b/data/update-ssh-keys.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -e
+
+source env.sh
+
+if [ -d "${SSH_KEY_DIR}/clients/.git" ] ; then
+  cd "${SSH_KEY_DIR}/clients" || exit 0
+  git fetch
+  if ! git diff --quiet remotes/origin/HEAD; then
+    echo "Pull from git repository"
+    git pull
+    create-client-dirs.sh
+  else
+    echo "$0: Nothing to do"
+  fi
+fi

From 0dc25d54283fe064f22b504f5e5982e6a9a41752 Mon Sep 17 00:00:00 2001
From: nold <nold@gnu.one>
Date: Thu, 26 Mar 2020 18:16:56 +0100
Subject: [PATCH 02/14] Git key import again

---
 .gitignore                 |  1 +
 Dockerfile                 |  2 +-
 Dockerfile.pullgit         |  9 +++++++
 data/create-client-dirs.sh | 51 +++++++++++++++-----------------------
 data/env.sh                | 24 ++++++++++++++----
 data/run.sh                | 31 ++++-------------------
 data/update-ssh-keys.sh    | 15 ++++++-----
 docker-compose.yml         |  7 ++++--
 8 files changed, 69 insertions(+), 71 deletions(-)
 create mode 100644 Dockerfile.pullgit

diff --git a/.gitignore b/.gitignore
index ae9c630..60ba08a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 /backup
 /sshkeys
+.env
diff --git a/Dockerfile b/Dockerfile
index e8cd4ca..af7b621 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@ VOLUME /backup
 ENV DEBIAN_FRONTEND noninteractive
 
 RUN apt-get update && apt-get -y --no-install-recommends install \
-		borgbackup openssh-server git ca-certificates && apt-get clean && \
+		borgbackup openssh-server && apt-get clean && \
 		useradd -s /bin/bash -m -U borg && \
 		mkdir /home/borg/.ssh && \
 		chmod 700 /home/borg/.ssh && \
diff --git a/Dockerfile.pullgit b/Dockerfile.pullgit
new file mode 100644
index 0000000..ab642cf
--- /dev/null
+++ b/Dockerfile.pullgit
@@ -0,0 +1,9 @@
+############################################################
+# Dockerfile to build borgbackup server images with git-pull support!
+# Based on Debian
+############################################################
+FROM borgserver:latest
+
+RUN apt-get update && apt-get -y --no-install-recommends install \
+		git ca-certificates && apt-get clean && \
+		rm -rf /var/lib/apt/lists/* /var/tmp/* /tmp/*
diff --git a/data/create-client-dirs.sh b/data/create-client-dirs.sh
index 2eddb32..e3bc7dd 100755
--- a/data/create-client-dirs.sh
+++ b/data/create-client-dirs.sh
@@ -1,40 +1,28 @@
 #!/bin/bash
-
+# This script generates the authorized_keys file from SSH_KEY_DIR
+# authorized_keys will only get overridden after syntax check
 set -e
-
 source env.sh
 
-function error_exit {
-    echo
-    echo "$@"
-    if [ -e "${AUTHORIZED_KEYS_PATH}.bkp" ]; then
-      echo "Restore authorized_keys backup ${AUTHORIZED_KEYS_PATH}.bkp"
-      mv "${AUTHORIZED_KEYS_PATH}.bkp" "${AUTHORIZED_KEYS_PATH}"
-    fi
-    exit 1
-}
-
-#Trap the killer signals so that we can exit with a good message.
-trap "error_exit 'Received signal SIGHUP'" SIGHUP
-trap "error_exit 'Received signal SIGINT'" SIGINT
-trap "error_exit 'Received signal SIGTERM'" SIGTERM
+TMPFILE=$(mktemp)
 
 echo "######################################################"
 echo "* Regenerate borgserver authorized_keys *"
 echo "######################################################"
 
-if [ -e "${AUTHORIZED_KEYS_PATH}" ]; then
-  cp "${AUTHORIZED_KEYS_PATH}" "${AUTHORIZED_KEYS_PATH}.bkp"
-  rm "${AUTHORIZED_KEYS_PATH}"
-fi
-
 # Add every key to borg-users authorized_keys
 for keyfile in $(find "${SSH_KEY_DIR}/clients" ! -regex '.*/\..*' -a -type f); do
   client_name=$(basename ${keyfile})
-  echo "Add $client_name ssh key"
+
+	# Only import valid keyfiles, skip other files
+  if ! ssh-keygen -lf $keyfile >/dev/null ; then
+		echo " Warning: Skipping invalid ssh-key file '$keyfile'"
+		continue
+	fi
+
   if [ ! -d "${BORG_DATA_DIR}/${client_name}" ]; then
-    mkdir "${BORG_DATA_DIR}/${client_name}" #2>/dev/null
     echo "  ** Adding client ${client_name} with repo path ${BORG_DATA_DIR}/${client_name}"
+    mkdir "${BORG_DATA_DIR}/${client_name}"
   else
     echo "Directory ${BORG_DATA_DIR}/${client_name} exists: Nothing to do"
   fi
@@ -49,18 +37,19 @@ for keyfile in $(find "${SSH_KEY_DIR}/clients" ! -regex '.*/\..*' -a -type f); d
     borg_cmd="${BORG_CMD} --append-only"
   fi
 
-  echo -n "command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${AUTHORIZED_KEYS_PATH}
-  cat ${keyfile} >> ${AUTHORIZED_KEYS_PATH}
+  echo -n "command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${TMPFILE}
+  cat ${keyfile} >> ${TMPFILE}
 done
 
+# Due to `set -e` the script will end here on failure anyways
 echo " * Validating structure of generated ${AUTHORIZED_KEYS_PATH}..."
-ERROR=$(ssh-keygen -lf ${AUTHORIZED_KEYS_PATH} 2>&1 >/dev/null)
-if [ $? -ne 0 ]; then
-    echo "ERROR: ${ERROR}"
-    exit 1
-fi
+ssh-keygen -lf ${TMPFILE} >/dev/null
+
+mv ${TMPFILE} ${AUTHORIZED_KEYS_PATH}
+echo " ** Success"
 
 chown -R borg:borg ${BORG_DATA_DIR}
 chown borg:borg ${AUTHORIZED_KEYS_PATH}
 chmod 600 ${AUTHORIZED_KEYS_PATH}
-rm -f ${AUTHORIZED_KEYS_PATH}.bkp
+
+exit 0
diff --git a/data/env.sh b/data/env.sh
index ad8fd4f..0f32096 100755
--- a/data/env.sh
+++ b/data/env.sh
@@ -1,9 +1,23 @@
-BORG_DATA_DIR=/backup
-SSH_KEY_DIR=/sshkeys
-BORG_CMD='cd ${BORG_DATA_DIR}/${client_name}; borg serve --restrict-to-path ${BORG_DATA_DIR}/${client_name} ${BORG_SERVE_ARGS}'
-AUTHORIZED_KEYS_PATH=/home/borg/.ssh/authorized_keys
+# Default values for environment
+PATH=$PATH:/usr/local/bin
+PUID=${PUID:-1000}
+PGID=${PGID:-1000}
 
 # Append only mode?
 BORG_APPEND_ONLY=${BORG_APPEND_ONLY:=no}
 
-export BORG_DATA_DIR SSH_KEY_DIR BORG_CMD AUTHORIZED_KEYS_PATH BORG_APPEND_ONLY
+# Volume for backup repositories
+BORG_DATA_DIR=${BORG_DATA_DIR:-/backup}
+
+# Branch of KEY_GIT_URL
+KEY_GIT_BRANCH=${KEY_GIT_BRANCH:-master}
+
+# This will contain the host and client keys
+SSH_KEY_DIR=${SSH_KEY_DIR:-/sshkeys}
+
+### CAUTION
+# This is more of a template then something you need to change, it should stay static
+BORG_CMD='cd ${BORG_DATA_DIR}/${client_name}; borg serve --restrict-to-path ${BORG_DATA_DIR}/${client_name} ${BORG_SERVE_ARGS}'
+
+# Path to authorized_keys file
+AUTHORIZED_KEYS_PATH=${AUTHORIZED_KEYS_PATH:-/home/borg/.ssh/authorized_keys}
diff --git a/data/run.sh b/data/run.sh
index e717be5..f57d8ec 100755
--- a/data/run.sh
+++ b/data/run.sh
@@ -1,42 +1,29 @@
 #!/bin/bash
 # Start Script for docker-borgserver
-
 set -e
-
-PUID=${PUID:-1000}
-PGID=${PGID:-1000}
+source env.sh
 
 usermod -o -u "$PUID" borg &>/dev/null
 groupmod -o -g "$PGID" borg &>/dev/null
 
-#source variables
-source env.sh
-
 echo "########################################################"
 echo -n " * Docker BorgServer powered by "
 borg -V
 echo "########################################################"
 echo " * User  id: $(id -u borg)"
 echo " * Group id: $(id -g borg)"
-if [ -z "${BORG_SSHKEYS_REPO}" ] ; then
-  echo "* Pulling keys from ${BORG_SSHKEYS_REPO}"
+if [ -z "${KEY_GIT_URL}" ] ; then
+  echo "* Pulling keys from ${KEY_GIT_URL}"
 fi
 echo "########################################################"
 
-
 # Precheck if BORG_ADMIN is set
 if [ "${BORG_APPEND_ONLY}" == "yes" ] && [ -z "${BORG_ADMIN}" ] ; then
 	echo "WARNING: BORG_APPEND_ONLY is active, but no BORG_ADMIN was specified!"
 fi
 
 # Init the ssh keys directory from a remote git repository
-if [ ! -z "${BORG_SSHKEYS_REPO}" ] ; then
-  if [ ! -d ${SSH_KEY_DIR}/clients ] ; then
-    git clone "${BORG_SSHKEYS_REPO}" ${SSH_KEY_DIR}/clients
-  else
-     /usr/local/bin/update-ssh-keys.sh ${SSH_KEY_DIR}
-  fi
-fi
+update-ssh-keys.sh
 
 # Precheck directories & client ssh-keys
 for dir in BORG_DATA_DIR SSH_KEY_DIR ; do
@@ -63,16 +50,8 @@ for keytype in ed25519 rsa ; do
 	fi
 done
 
-echo "########################################################"
-echo " * Starting SSH-Key import..."
-
 # Add every key to borg-users authorized_keys
-create-client-dirs.sh \
-  "${SSH_KEY_DIR}" \
-  "${BORG_DATA_DIR}" \
-  "${AUTHORIZED_KEYS_PATH}" \
-  "${BORG_CMD}" \
-  "${BORG_APPEND_ONLY}"
+create-client-dirs.sh
 
 echo "########################################################"
 echo " * Init done! Starting SSH-Daemon..."
diff --git a/data/update-ssh-keys.sh b/data/update-ssh-keys.sh
index c24c53a..bb5f4b0 100755
--- a/data/update-ssh-keys.sh
+++ b/data/update-ssh-keys.sh
@@ -1,17 +1,20 @@
 #!/bin/bash
-
+# This script updates the authorized_keys file
+# Will clone/pull ssh-pubkeys from GIT_KEY_URL if set
 set -e
-
 source env.sh
 
 if [ -d "${SSH_KEY_DIR}/clients/.git" ] ; then
-  cd "${SSH_KEY_DIR}/clients" || exit 0
-  git fetch
-  if ! git diff --quiet remotes/origin/HEAD; then
+  git -C "${SSH_KEY_DIR}/clients" fetch
+  if ! git -C "${SSH_KEY_DIR}/clients" diff --quiet remotes/origin/HEAD; then
     echo "Pull from git repository"
-    git pull
+    git -C "${SSH_KEY_DIR}/clients" pull
     create-client-dirs.sh
   else
     echo "$0: Nothing to do"
   fi
+elif [ ! -z "${KEY_GIT_URL}" ] ; then
+	git clone --depth=1 -b ${KEY_GIT_BRANCH} ${KEY_GIT_URL} ${SSH_KEY_DIR}/clients
 fi
+
+exit 0
diff --git a/docker-compose.yml b/docker-compose.yml
index aabaf84..5c3e12c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,13 +1,16 @@
 version: '3'
 services:
  borgserver:
-  image: nold360/borgserver
-  #build: .
+  #image: nold360/borgserver
+  build:
+    context: .
+    dockerfile: Dockerfile.pullgit
   volumes:
    - ./backup:/backup
    - ./sshkeys:/sshkeys
   ports:
    - "2222:22"
+  env_file: .env
   environment:
    BORG_SERVE_ARGS: ""
 

From 674b4d8757365e9f64a9d163511c5b997647239d Mon Sep 17 00:00:00 2001
From: nold <nold@gnu.one>
Date: Fri, 13 Aug 2021 12:50:23 +0200
Subject: [PATCH 03/14] Add: drone.yml

---
 .drone.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 .drone.yml

diff --git a/.drone.yml b/.drone.yml
new file mode 100644
index 0000000..efcda51
--- /dev/null
+++ b/.drone.yml
@@ -0,0 +1,18 @@
+---
+kind: pipeline
+name: build
+type: kubernetes
+
+steps:
+- name: build-image
+  image: plugins/buildah-docker
+  settings:
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+    repo: nold360/borgserver
+    dockerfile: Dockerfile
+    tags:
+      - latest
+      - buster

From 7d29e33747a51bb24a43ae840241d72b15e061ca Mon Sep 17 00:00:00 2001
From: nold <nold@gnu.one>
Date: Mon, 29 Nov 2021 17:39:31 +0100
Subject: [PATCH 04/14] Fix: drone - use kaniko for building

---
 .drone.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.drone.yml b/.drone.yml
index efcda51..e79c02f 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -5,7 +5,7 @@ type: kubernetes
 
 steps:
 - name: build-image
-  image: plugins/buildah-docker
+  image: plugins/kaniko
   settings:
     username:
       from_secret: docker_username

From 7b241c142bd30d5c0b2a76d2bd7239265879a005 Mon Sep 17 00:00:00 2001
From: nold <nold@gnu.one>
Date: Fri, 21 Jan 2022 10:02:01 +0100
Subject: [PATCH 05/14] Update: README & docker-compose example

---
 README.md          | 18 +-----------------
 docker-compose.yml |  5 +++--
 2 files changed, 4 insertions(+), 19 deletions(-)

diff --git a/README.md b/README.md
index 0560555..a0d7eec 100644
--- a/README.md
+++ b/README.md
@@ -112,23 +112,7 @@ In this directory will borg write all the client data to. It's best to start wit
 
 ## Example Setup
 ### docker-compose.yml
-Here is a quick example, how to run borgserver using docker-compose:
-```
-services:
- borgserver:
-  image: nold360/borgserver
-  volumes:
-   - /backup:/backup
-   - ./sshkeys:/sshkeys
-  ports:
-   - "2222:22"
-  environment:
-   BORG_SERVE_ARGS: ""
-   BORG_APPEND_ONLY: "no"
-   BORG_ADMIN: ""
-   PUID: 1000
-   PGID: 1000
-```
+Here is a quick example, how to run borgserver using docker-compose: [docker-compose.yml](https://github.com/Nold360/docker-borgserver/blob/master/docker-compose.yml)
 
 ### ~/.ssh/config for clients
 With this configuration (on your borg client) you can easily connect to your borgserver.
diff --git a/docker-compose.yml b/docker-compose.yml
index aabaf84..e66b4cd 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,12 +9,13 @@ services:
   ports:
    - "2222:22"
   environment:
+  # Additional Arguments, see https://borgbackup.readthedocs.io/en/stable/usage/serve.html
    BORG_SERVE_ARGS: ""
 
    # If set to "yes", only the BORG_ADMIN
-   # can delete/prune the all clients archives/repos
+   # can delete/prune the other clients archives/repos
    BORG_APPEND_ONLY: "no"
 
-   # Hostname of Admin's SSH-Key
+   # Filename of Admins SSH-Key; has full access to all repos
    BORG_ADMIN: ""
   restart: unless-stopped

From 0b641a82539a473ae861dbc21981f717425749cc Mon Sep 17 00:00:00 2001
From: Nold <Nold360@users.noreply.github.com>
Date: Fri, 21 Jan 2022 10:33:54 +0100
Subject: [PATCH 06/14] Upgrade: bullseye & borgbackup 1.1.16 (#13)

* Upgrade to bullseye-slim image
* Fix(run.sh): authorized_keys permissions
* Change(run.sh): Add restrict to client keys & output debian version
* Change(Dockerfile): Allow different base images
* Update(drone): Build buster & bullseye images
* Update README
---
 .drone.yml  | 20 +++++++++++++++++++-
 Dockerfile  |  3 ++-
 README.md   |  6 ++++++
 data/run.sh |  5 ++++-
 4 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index e79c02f..f204aa3 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -4,7 +4,7 @@ name: build
 type: kubernetes
 
 steps:
-- name: build-image
+- name: build-bullseye
   image: plugins/kaniko
   settings:
     username:
@@ -13,6 +13,24 @@ steps:
       from_secret: docker_password
     repo: nold360/borgserver
     dockerfile: Dockerfile
+    build_args:
+      - BASE_IMAGE=debian:bullseye-slim
     tags:
       - latest
+      - bullseye
+      - 1.1.16
+
+- name: build-buster
+  image: plugins/kaniko
+  settings:
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+    repo: nold360/borgserver
+    dockerfile: Dockerfile
+    build_args:
+      - BASE_IMAGE=debian:buster-slim
+    tags:
       - buster
+      - 1.1.9
diff --git a/Dockerfile b/Dockerfile
index a682457..a7cd5d1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,8 @@
 # Dockerfile to build borgbackup server images
 # Based on Debian
 ############################################################
-FROM debian:buster-slim
+ARG BASE_IMAGE=debian:bullseye-slim
+FROM $BASE_IMAGE
 
 # Volume for SSH-Keys
 VOLUME /sshkeys
diff --git a/README.md b/README.md
index a0d7eec..e381cdc 100644
--- a/README.md
+++ b/README.md
@@ -132,3 +132,9 @@ And create your first backup!
 ```
  $ borg create backup:my_first_borg_repo::documents-2017-11-01 /home/user/MyImportentDocs
 ```
+
+## Tags
+
+All images are freshly built every week & published as `nold360/borgserver` with the following tags:
+ - Latest / Stable [borg 1.1.16]: `bullseye`, `1.1.16`, `latest`
+ - Legacy / Buster [borg 1.1.9 ]: `buster`, `1.1.9`
diff --git a/data/run.sh b/data/run.sh
index e794704..63ec0eb 100755
--- a/data/run.sh
+++ b/data/run.sh
@@ -15,9 +15,11 @@ AUTHORIZED_KEYS_PATH=/home/borg/.ssh/authorized_keys
 # Append only mode?
 BORG_APPEND_ONLY=${BORG_APPEND_ONLY:=no}
 
+source /etc/os-release
 echo "########################################################"
 echo -n " * Docker BorgServer powered by "
 borg -V
+echo " * Based on ${PRETTY_NAME}"
 echo "########################################################"
 echo " * User  id: $(id -u borg)"
 echo " * Group id: $(id -g borg)"
@@ -74,9 +76,10 @@ for keyfile in $(find "${SSH_KEY_DIR}/clients" ! -regex '.*/\..*' -a -type f); d
 		borg_cmd="${BORG_CMD} --append-only"
 	fi
 
-    echo -n "command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${AUTHORIZED_KEYS_PATH}
+    echo -n "restrict,command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${AUTHORIZED_KEYS_PATH}
 	cat ${keyfile} >> ${AUTHORIZED_KEYS_PATH}
 done
+chmod 0600 "${AUTHORIZED_KEYS_PATH}"
 
 echo " * Validating structure of generated ${AUTHORIZED_KEYS_PATH}..."
 ERROR=$(ssh-keygen -lf ${AUTHORIZED_KEYS_PATH} 2>&1 >/dev/null)

From 95ec06eb800e5a8925e900873a56fb793d7f2429 Mon Sep 17 00:00:00 2001
From: Gerrit Pannek <nold@gnu.one>
Date: Sat, 5 Feb 2022 18:12:37 +0100
Subject: [PATCH 07/14] Fix(run.sh): Add new line in authorized_keys [Fixes
 #12]

---
 data/run.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/data/run.sh b/data/run.sh
index 63ec0eb..215cbe6 100755
--- a/data/run.sh
+++ b/data/run.sh
@@ -76,8 +76,9 @@ for keyfile in $(find "${SSH_KEY_DIR}/clients" ! -regex '.*/\..*' -a -type f); d
 		borg_cmd="${BORG_CMD} --append-only"
 	fi
 
-    echo -n "restrict,command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${AUTHORIZED_KEYS_PATH}
-	cat ${keyfile} >> ${AUTHORIZED_KEYS_PATH}
+  echo -n "restrict,command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${AUTHORIZED_KEYS_PATH}
+  cat ${keyfile} >> ${AUTHORIZED_KEYS_PATH}
+  echo >> ${AUTHORIZED_KEYS_PATH}
 done
 chmod 0600 "${AUTHORIZED_KEYS_PATH}"
 

From ea677a7da9b6b037dd01ce35967511e74e4e0f62 Mon Sep 17 00:00:00 2001
From: nold <nold@gnu.one>
Date: Wed, 11 May 2022 18:53:24 +0200
Subject: [PATCH 08/14] Add(drone): Build Bookworm

---
 .drone.yml | 15 +++++++++++++++
 README.md  |  1 +
 2 files changed, 16 insertions(+)

diff --git a/.drone.yml b/.drone.yml
index f204aa3..56aceab 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -4,6 +4,21 @@ name: build
 type: kubernetes
 
 steps:
+- name: build-bookworm
+  image: plugins/kaniko
+  settings:
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+    repo: nold360/borgserver
+    dockerfile: Dockerfile
+    build_args:
+      - BASE_IMAGE=debian:bookworm-slim
+    tags:
+      - bookworm
+      - 1.2.0
+
 - name: build-bullseye
   image: plugins/kaniko
   settings:
diff --git a/README.md b/README.md
index e381cdc..5b4defd 100644
--- a/README.md
+++ b/README.md
@@ -136,5 +136,6 @@ And create your first backup!
 ## Tags
 
 All images are freshly built every week & published as `nold360/borgserver` with the following tags:
+ - Next / Unstable [borg 1.2.0]: `bookworm`, `1.2.0`
  - Latest / Stable [borg 1.1.16]: `bullseye`, `1.1.16`, `latest`
  - Legacy / Buster [borg 1.1.9 ]: `buster`, `1.1.9`

From 2c76a45aca8e864da665eccbf43e33a9f9243aad Mon Sep 17 00:00:00 2001
From: Nold <Nold360@users.noreply.github.com>
Date: Wed, 20 Jul 2022 11:01:57 +0200
Subject: [PATCH 09/14] Update: bookworm image version 1.2.1

---
 .drone.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.drone.yml b/.drone.yml
index 56aceab..25c3848 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -17,7 +17,7 @@ steps:
       - BASE_IMAGE=debian:bookworm-slim
     tags:
       - bookworm
-      - 1.2.0
+      - 1.2.1
 
 - name: build-bullseye
   image: plugins/kaniko

From 57ed075e223aa6af4a6faba5bcc5cf1043661da3 Mon Sep 17 00:00:00 2001
From: nold <nold@gnu.one>
Date: Tue, 20 Sep 2022 09:06:17 +0200
Subject: [PATCH 10/14] Update(drone): Image tag for bookwork v1.2 & v1.2.2

---
 .drone.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.drone.yml b/.drone.yml
index 25c3848..e41176d 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -17,7 +17,8 @@ steps:
       - BASE_IMAGE=debian:bookworm-slim
     tags:
       - bookworm
-      - 1.2.1
+      - 1.2
+      - 1.2.2
 
 - name: build-bullseye
   image: plugins/kaniko

From ef02f845dc12fa46a3ec1e3ab9daf493100f198a Mon Sep 17 00:00:00 2001
From: nold <nold@gnu.one>
Date: Tue, 22 Nov 2022 22:15:49 +0100
Subject: [PATCH 11/14] add(ci): woodpecker.yml

---
 .drone.yml      | 52 -------------------------------------------------
 .woodpecker.yml | 30 ++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 52 deletions(-)
 delete mode 100644 .drone.yml
 create mode 100644 .woodpecker.yml

diff --git a/.drone.yml b/.drone.yml
deleted file mode 100644
index e41176d..0000000
--- a/.drone.yml
+++ /dev/null
@@ -1,52 +0,0 @@
----
-kind: pipeline
-name: build
-type: kubernetes
-
-steps:
-- name: build-bookworm
-  image: plugins/kaniko
-  settings:
-    username:
-      from_secret: docker_username
-    password:
-      from_secret: docker_password
-    repo: nold360/borgserver
-    dockerfile: Dockerfile
-    build_args:
-      - BASE_IMAGE=debian:bookworm-slim
-    tags:
-      - bookworm
-      - 1.2
-      - 1.2.2
-
-- name: build-bullseye
-  image: plugins/kaniko
-  settings:
-    username:
-      from_secret: docker_username
-    password:
-      from_secret: docker_password
-    repo: nold360/borgserver
-    dockerfile: Dockerfile
-    build_args:
-      - BASE_IMAGE=debian:bullseye-slim
-    tags:
-      - latest
-      - bullseye
-      - 1.1.16
-
-- name: build-buster
-  image: plugins/kaniko
-  settings:
-    username:
-      from_secret: docker_username
-    password:
-      from_secret: docker_password
-    repo: nold360/borgserver
-    dockerfile: Dockerfile
-    build_args:
-      - BASE_IMAGE=debian:buster-slim
-    tags:
-      - buster
-      - 1.1.9
diff --git a/.woodpecker.yml b/.woodpecker.yml
new file mode 100644
index 0000000..5cd8b9e
--- /dev/null
+++ b/.woodpecker.yml
@@ -0,0 +1,30 @@
+---
+variables:
+  - &kaniko_plugin 'plugins/kaniko:1.6'
+
+matrix:
+  include:
+    - BASE: bookworm-slim
+      TAGS: '[ "bookwork", "1.2", "1.2.2" ]'
+    - BASE: bullseye-slim
+      TAGS: '[ "bullseye", "latest", "1.1.16" ]'
+    - BASE: buster-slim
+      TAGS: '[ "buster", "1.1.9" ]'
+
+pipeline:
+  build:
+    image: *kaniko_plugin
+    group: build
+    settings:
+      repo: nold360/borgserver
+      dockerfile: Dockerfile
+      build_args:
+        - BASE_IMAGE=debian:${BASE}
+      tags: ${TAGS}
+      username:
+        from_secret: docker_username
+      password:
+        from_secret: docker_password
+    when:
+      - branch: master
+      - event: cron

From 45e8883cae9a844ba93baeed252bda6bdb3b5ac2 Mon Sep 17 00:00:00 2001
From: nold <nold@gnu.one>
Date: Thu, 24 Nov 2022 16:22:39 +0100
Subject: [PATCH 12/14] fix(sshd_config): recommended keepalive values

---
 data/sshd_config | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/data/sshd_config b/data/sshd_config
index b1c2206..29e39c3 100644
--- a/data/sshd_config
+++ b/data/sshd_config
@@ -25,3 +25,6 @@ PermitTTY no
 PrintMotd no
 PermitTunnel no
 Subsystem	sftp	/bin/false
+
+ClientAliveInterval 10
+ClientAliveCountMax 30

From 49b78cf10f85a10dd006c5b80dce8c05c77446e4 Mon Sep 17 00:00:00 2001
From: Andreas Mieke <andreas@mieke.at>
Date: Sat, 13 Jan 2024 03:14:36 +0100
Subject: [PATCH 13/14] feat(platforms): Add ARM support

---
 .woodpecker.yml    | 63 ++++++++++++++++++++++++++--------------------
 Dockerfile         |  3 +--
 README.md          | 13 +++-------
 docker-compose.yml |  2 +-
 4 files changed, 41 insertions(+), 40 deletions(-)

diff --git a/.woodpecker.yml b/.woodpecker.yml
index 5cd8b9e..75acfa0 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -1,30 +1,39 @@
----
-variables:
-  - &kaniko_plugin 'plugins/kaniko:1.6'
-
-matrix:
-  include:
-    - BASE: bookworm-slim
-      TAGS: '[ "bookwork", "1.2", "1.2.2" ]'
-    - BASE: bullseye-slim
-      TAGS: '[ "bullseye", "latest", "1.1.16" ]'
-    - BASE: buster-slim
-      TAGS: '[ "buster", "1.1.9" ]'
-
-pipeline:
+steps:
   build:
-    image: *kaniko_plugin
-    group: build
+    image: woodpeckerci/plugin-docker-buildx
     settings:
-      repo: nold360/borgserver
-      dockerfile: Dockerfile
-      build_args:
-        - BASE_IMAGE=debian:${BASE}
-      tags: ${TAGS}
-      username:
-        from_secret: docker_username
-      password:
-        from_secret: docker_password
+      dry-run: true
+      repo: git.merp.digital/${CI_REPO_OWNER}/borgserver
+      platforms: linux/386,linux/amd64,linux/arm/v5,linux/arm/v7,linux/arm64/v8,linux/mips64le,linux/ppc64le,linux/s390x
+      registry: git.merp.digital
     when:
-      - branch: master
-      - event: cron
+      - event: push
+        branch: 
+          exclude: [develop, master]
+
+  publish-nightly:
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: git.merp.digital/${CI_REPO_OWNER}/borgserver
+      platforms: linux/386,linux/amd64,linux/arm/v5,linux/arm/v7,linux/arm64/v8,linux/mips64le,linux/ppc64le,linux/s390x
+      registry: git.merp.digital
+      tags: develop-${CI_COMMIT_SHA}
+      username: ${CI_REPO_OWNER}
+      password:
+        from_secret: cb_token
+    when:
+      - event: push
+        branch: develop
+
+  publish-release:
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: git.merp.digital/${CI_REPO_OWNER}/borgserver
+      platforms: linux/386,linux/amd64,linux/arm/v5,linux/arm/v7,linux/arm64/v8,linux/mips64le,linux/ppc64le,linux/s390x
+      registry: git.merp.digital
+      tags: ${CI_COMMIT_TAG}
+      username: ${CI_REPO_OWNER}
+      password:
+        from_secret: cb_token
+    when:
+      - event: tag
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index a7cd5d1..893a84c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,8 +2,7 @@
 # Dockerfile to build borgbackup server images
 # Based on Debian
 ############################################################
-ARG BASE_IMAGE=debian:bullseye-slim
-FROM $BASE_IMAGE
+FROM debian:12.4-slim
 
 # Volume for SSH-Keys
 VOLUME /sshkeys
diff --git a/README.md b/README.md
index 5b4defd..2ae399d 100644
--- a/README.md
+++ b/README.md
@@ -29,7 +29,7 @@ docker run -td \
 	-p 2222:22  \
 	--volume ./borg/sshkeys:/sshkeys \
 	--volume ./borg/backup:/backup \
-	nold360/borgserver:latest
+	git.merp.digital/eranmorkon/borgserver:1.0.0
 ```
 
 
@@ -45,7 +45,7 @@ See the the documentation for all available arguments: [borgbackup.readthedocs.i
 
 ##### Example
 ```
-docker run --rm -e BORG_SERVE_ARGS="--progress --debug" (...) nold360/borgserver
+docker run --rm -e BORG_SERVE_ARGS="--progress --debug" (...) git.merp.digital/eranmorkon/borgserver
 ```
 
 #### BORG_APPEND_ONLY
@@ -62,7 +62,7 @@ To declare a client as admin, set this variable to the name of the client/sshkey
 
 ##### Example
 ```
-docker run --rm -e BORG_APPEND_ONLY="yes" -e BORG_ADMIN="nolds_notebook" (...) nold360/borgserver
+docker run --rm -e BORG_APPEND_ONLY="yes" -e BORG_ADMIN="nolds_notebook" (...) git.merp.digital/eranmorkon/borgserver
 ```
 
 To prune repos from another client, you have to add the path to the repository in the clients directory:
@@ -132,10 +132,3 @@ And create your first backup!
 ```
  $ borg create backup:my_first_borg_repo::documents-2017-11-01 /home/user/MyImportentDocs
 ```
-
-## Tags
-
-All images are freshly built every week & published as `nold360/borgserver` with the following tags:
- - Next / Unstable [borg 1.2.0]: `bookworm`, `1.2.0`
- - Latest / Stable [borg 1.1.16]: `bullseye`, `1.1.16`, `latest`
- - Legacy / Buster [borg 1.1.9 ]: `buster`, `1.1.9`
diff --git a/docker-compose.yml b/docker-compose.yml
index e66b4cd..6557ab3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,7 +1,7 @@
 version: '3'
 services:
  borgserver:
-  image: nold360/borgserver
+  image: git.merp.digital/eranmorkon/borgserver
   #build: .
   volumes:
    - ./backup:/backup

From 397f800372c87d8ea45b682f4762da78a5842943 Mon Sep 17 00:00:00 2001
From: Andreas Mieke <andreas@mieke.at>
Date: Sat, 13 Jan 2024 03:17:42 +0100
Subject: [PATCH 14/14] fix(platforms): Remove useless platforms

---
 .woodpecker.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.woodpecker.yml b/.woodpecker.yml
index 75acfa0..b765cde 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -4,7 +4,7 @@ steps:
     settings:
       dry-run: true
       repo: git.merp.digital/${CI_REPO_OWNER}/borgserver
-      platforms: linux/386,linux/amd64,linux/arm/v5,linux/arm/v7,linux/arm64/v8,linux/mips64le,linux/ppc64le,linux/s390x
+      platforms: linux/386,linux/amd64,linux/arm/v7,linux/arm64/v8
       registry: git.merp.digital
     when:
       - event: push
@@ -15,7 +15,7 @@ steps:
     image: woodpeckerci/plugin-docker-buildx
     settings:
       repo: git.merp.digital/${CI_REPO_OWNER}/borgserver
-      platforms: linux/386,linux/amd64,linux/arm/v5,linux/arm/v7,linux/arm64/v8,linux/mips64le,linux/ppc64le,linux/s390x
+      platforms: linux/386,linux/amd64,linux/arm/v7,linux/arm64/v8
       registry: git.merp.digital
       tags: develop-${CI_COMMIT_SHA}
       username: ${CI_REPO_OWNER}
@@ -29,7 +29,7 @@ steps:
     image: woodpeckerci/plugin-docker-buildx
     settings:
       repo: git.merp.digital/${CI_REPO_OWNER}/borgserver
-      platforms: linux/386,linux/amd64,linux/arm/v5,linux/arm/v7,linux/arm64/v8,linux/mips64le,linux/ppc64le,linux/s390x
+      platforms: linux/386,linux/amd64,linux/arm/v7,linux/arm64/v8
       registry: git.merp.digital
       tags: ${CI_COMMIT_TAG}
       username: ${CI_REPO_OWNER}