Git key import again

.gitignore

@@ -1,2 +1,3 @@
 /backup
 /sshkeys
+.env

Dockerfile

@@ -13,7 +13,7 @@ VOLUME /backup
 ENV DEBIAN_FRONTEND noninteractive
 
 RUN apt-get update && apt-get -y --no-install-recommends install \
-		borgbackup openssh-server git ca-certificates && apt-get clean && \
+		borgbackup openssh-server && apt-get clean && \
 		useradd -s /bin/bash -m -U borg && \
 		mkdir /home/borg/.ssh && \
 		chmod 700 /home/borg/.ssh && \

Dockerfile.pullgit

@@ -0,0 +1,9 @@
+############################################################
+# Dockerfile to build borgbackup server images with git-pull support!
+# Based on Debian
+############################################################
+FROM borgserver:latest
+
+RUN apt-get update && apt-get -y --no-install-recommends install \
+		git ca-certificates && apt-get clean && \
+		rm -rf /var/lib/apt/lists/* /var/tmp/* /tmp/*

data/create-client-dirs.sh

@@ -1,40 +1,28 @@
 #!/bin/bash
-
+# This script generates the authorized_keys file from SSH_KEY_DIR
+# authorized_keys will only get overridden after syntax check
 set -e
-
 source env.sh
 
-function error_exit {
-    echo
-    echo "$@"
-    if [ -e "${AUTHORIZED_KEYS_PATH}.bkp" ]; then
-      echo "Restore authorized_keys backup ${AUTHORIZED_KEYS_PATH}.bkp"
-      mv "${AUTHORIZED_KEYS_PATH}.bkp" "${AUTHORIZED_KEYS_PATH}"
-    fi
-    exit 1
-}
-
-#Trap the killer signals so that we can exit with a good message.
-trap "error_exit 'Received signal SIGHUP'" SIGHUP
-trap "error_exit 'Received signal SIGINT'" SIGINT
-trap "error_exit 'Received signal SIGTERM'" SIGTERM
+TMPFILE=$(mktemp)
 
 echo "######################################################"
 echo "* Regenerate borgserver authorized_keys *"
 echo "######################################################"
 
-if [ -e "${AUTHORIZED_KEYS_PATH}" ]; then
-  cp "${AUTHORIZED_KEYS_PATH}" "${AUTHORIZED_KEYS_PATH}.bkp"
-  rm "${AUTHORIZED_KEYS_PATH}"
-fi
-
 # Add every key to borg-users authorized_keys
 for keyfile in $(find "${SSH_KEY_DIR}/clients" ! -regex '.*/\..*' -a -type f); do
   client_name=$(basename ${keyfile})
-  echo "Add $client_name ssh key"
+
+	# Only import valid keyfiles, skip other files
+  if ! ssh-keygen -lf $keyfile >/dev/null ; then
+		echo " Warning: Skipping invalid ssh-key file '$keyfile'"
+		continue
+	fi
+
   if [ ! -d "${BORG_DATA_DIR}/${client_name}" ]; then
-    mkdir "${BORG_DATA_DIR}/${client_name}" #2>/dev/null
     echo "  ** Adding client ${client_name} with repo path ${BORG_DATA_DIR}/${client_name}"
+    mkdir "${BORG_DATA_DIR}/${client_name}"
   else
     echo "Directory ${BORG_DATA_DIR}/${client_name} exists: Nothing to do"
   fi
@@ -49,18 +37,19 @@ for keyfile in $(find "${SSH_KEY_DIR}/clients" ! -regex '.*/\..*' -a -type f); d
     borg_cmd="${BORG_CMD} --append-only"
   fi
 
-  echo -n "command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${AUTHORIZED_KEYS_PATH}
-  cat ${keyfile} >> ${AUTHORIZED_KEYS_PATH}
+  echo -n "command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${TMPFILE}
+  cat ${keyfile} >> ${TMPFILE}
 done
 
+# Due to `set -e` the script will end here on failure anyways
 echo " * Validating structure of generated ${AUTHORIZED_KEYS_PATH}..."
-ERROR=$(ssh-keygen -lf ${AUTHORIZED_KEYS_PATH} 2>&1 >/dev/null)
-if [ $? -ne 0 ]; then
-    echo "ERROR: ${ERROR}"
-    exit 1
-fi
+ssh-keygen -lf ${TMPFILE} >/dev/null
+
+mv ${TMPFILE} ${AUTHORIZED_KEYS_PATH}
+echo " ** Success"
 
 chown -R borg:borg ${BORG_DATA_DIR}
 chown borg:borg ${AUTHORIZED_KEYS_PATH}
 chmod 600 ${AUTHORIZED_KEYS_PATH}
-rm -f ${AUTHORIZED_KEYS_PATH}.bkp
+
+exit 0

data/env.sh

@@ -1,9 +1,23 @@
-BORG_DATA_DIR=/backup
-SSH_KEY_DIR=/sshkeys
-BORG_CMD='cd ${BORG_DATA_DIR}/${client_name}; borg serve --restrict-to-path ${BORG_DATA_DIR}/${client_name} ${BORG_SERVE_ARGS}'
-AUTHORIZED_KEYS_PATH=/home/borg/.ssh/authorized_keys
+# Default values for environment
+PATH=$PATH:/usr/local/bin
+PUID=${PUID:-1000}
+PGID=${PGID:-1000}
 
 # Append only mode?
 BORG_APPEND_ONLY=${BORG_APPEND_ONLY:=no}
 
-export BORG_DATA_DIR SSH_KEY_DIR BORG_CMD AUTHORIZED_KEYS_PATH BORG_APPEND_ONLY
+# Volume for backup repositories
+BORG_DATA_DIR=${BORG_DATA_DIR:-/backup}
+
+# Branch of KEY_GIT_URL
+KEY_GIT_BRANCH=${KEY_GIT_BRANCH:-master}
+
+# This will contain the host and client keys
+SSH_KEY_DIR=${SSH_KEY_DIR:-/sshkeys}
+
+### CAUTION
+# This is more of a template then something you need to change, it should stay static
+BORG_CMD='cd ${BORG_DATA_DIR}/${client_name}; borg serve --restrict-to-path ${BORG_DATA_DIR}/${client_name} ${BORG_SERVE_ARGS}'
+
+# Path to authorized_keys file
+AUTHORIZED_KEYS_PATH=${AUTHORIZED_KEYS_PATH:-/home/borg/.ssh/authorized_keys}

data/run.sh

@@ -1,42 +1,29 @@
 #!/bin/bash
 # Start Script for docker-borgserver
-
 set -e
-
-PUID=${PUID:-1000}
-PGID=${PGID:-1000}
+source env.sh
 
 usermod -o -u "$PUID" borg &>/dev/null
 groupmod -o -g "$PGID" borg &>/dev/null
 
-#source variables
-source env.sh
-
 echo "########################################################"
 echo -n " * Docker BorgServer powered by "
 borg -V
 echo "########################################################"
 echo " * User  id: $(id -u borg)"
 echo " * Group id: $(id -g borg)"
-if [ -z "${BORG_SSHKEYS_REPO}" ] ; then
-  echo "* Pulling keys from ${BORG_SSHKEYS_REPO}"
+if [ -z "${KEY_GIT_URL}" ] ; then
+  echo "* Pulling keys from ${KEY_GIT_URL}"
 fi
 echo "########################################################"
 
-
 # Precheck if BORG_ADMIN is set
 if [ "${BORG_APPEND_ONLY}" == "yes" ] && [ -z "${BORG_ADMIN}" ] ; then
 	echo "WARNING: BORG_APPEND_ONLY is active, but no BORG_ADMIN was specified!"
 fi
 
 # Init the ssh keys directory from a remote git repository
-if [ ! -z "${BORG_SSHKEYS_REPO}" ] ; then
-  if [ ! -d ${SSH_KEY_DIR}/clients ] ; then
-    git clone "${BORG_SSHKEYS_REPO}" ${SSH_KEY_DIR}/clients
-  else
-     /usr/local/bin/update-ssh-keys.sh ${SSH_KEY_DIR}
-  fi
-fi
+update-ssh-keys.sh
 
 # Precheck directories & client ssh-keys
 for dir in BORG_DATA_DIR SSH_KEY_DIR ; do
@@ -63,16 +50,8 @@ for keytype in ed25519 rsa ; do
 	fi
 done
 
-echo "########################################################"
-echo " * Starting SSH-Key import..."
-
 # Add every key to borg-users authorized_keys
-create-client-dirs.sh \
-  "${SSH_KEY_DIR}" \
-  "${BORG_DATA_DIR}" \
-  "${AUTHORIZED_KEYS_PATH}" \
-  "${BORG_CMD}" \
-  "${BORG_APPEND_ONLY}"
+create-client-dirs.sh
 
 echo "########################################################"
 echo " * Init done! Starting SSH-Daemon..."

data/update-ssh-keys.sh

@@ -1,17 +1,20 @@
 #!/bin/bash
-
+# This script updates the authorized_keys file
+# Will clone/pull ssh-pubkeys from GIT_KEY_URL if set
 set -e
-
 source env.sh
 
 if [ -d "${SSH_KEY_DIR}/clients/.git" ] ; then
-  cd "${SSH_KEY_DIR}/clients" || exit 0
-  git fetch
-  if ! git diff --quiet remotes/origin/HEAD; then
+  git -C "${SSH_KEY_DIR}/clients" fetch
+  if ! git -C "${SSH_KEY_DIR}/clients" diff --quiet remotes/origin/HEAD; then
     echo "Pull from git repository"
-    git pull
+    git -C "${SSH_KEY_DIR}/clients" pull
     create-client-dirs.sh
   else
     echo "$0: Nothing to do"
   fi
+elif [ ! -z "${KEY_GIT_URL}" ] ; then
+	git clone --depth=1 -b ${KEY_GIT_BRANCH} ${KEY_GIT_URL} ${SSH_KEY_DIR}/clients
 fi
+
+exit 0

docker-compose.yml

@@ -1,13 +1,16 @@
 version: '3'
 services:
  borgserver:
-  image: nold360/borgserver
-  #build: .
+  #image: nold360/borgserver
+  build:
+    context: .
+    dockerfile: Dockerfile.pullgit
   volumes:
    - ./backup:/backup
    - ./sshkeys:/sshkeys
   ports:
    - "2222:22"
+  env_file: .env
   environment:
    BORG_SERVE_ARGS: ""