From 1a8e59d7733e420a56bf587fec0978fb892ff8bd Mon Sep 17 00:00:00 2001
From: nold <nold@gnu.one>
Date: Tue, 24 Mar 2020 16:00:00 +0100
Subject: [PATCH] Created Init-Container that pulls pubkeys from git, creates
 authorized_keys, ssh-host-keys and backup-repo folders

---
 .gitignore                   |   1 +
 Dockerfile                   |  31 ----------
 build.sh                     |   2 +
 data/run.sh                  |  95 -------------------------------
 docker-compose.yml           |  58 +++++++++++++------
 env.example                  |   2 +
 init/Dockerfile              |  13 +++++
 init/entrypoint.sh           | 107 +++++++++++++++++++++++++++++++++++
 server/Dockerfile            |  36 ++++++++++++
 server/entrypoint.sh         |  64 +++++++++++++++++++++
 {data => server}/sshd_config |  10 ++--
 11 files changed, 273 insertions(+), 146 deletions(-)
 delete mode 100644 Dockerfile
 create mode 100644 build.sh
 delete mode 100755 data/run.sh
 create mode 100644 env.example
 create mode 100644 init/Dockerfile
 create mode 100755 init/entrypoint.sh
 create mode 100644 server/Dockerfile
 create mode 100755 server/entrypoint.sh
 rename {data => server}/sshd_config (69%)

diff --git a/.gitignore b/.gitignore
index ae9c630..60ba08a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 /backup
 /sshkeys
+.env
diff --git a/Dockerfile b/Dockerfile
deleted file mode 100644
index a682457..0000000
--- a/Dockerfile
+++ /dev/null
@@ -1,31 +0,0 @@
-############################################################
-# Dockerfile to build borgbackup server images
-# Based on Debian
-############################################################
-FROM debian:buster-slim
-
-# Volume for SSH-Keys
-VOLUME /sshkeys
-
-# Volume for borg repositories
-VOLUME /backup
-
-ENV DEBIAN_FRONTEND noninteractive
-
-RUN apt-get update && apt-get -y --no-install-recommends install \
-		borgbackup openssh-server && apt-get clean && \
-		useradd -s /bin/bash -m -U borg && \
-		mkdir /home/borg/.ssh && \
-		chmod 700 /home/borg/.ssh && \
-		chown borg:borg /home/borg/.ssh && \
-		mkdir /run/sshd && \
-		rm -f /etc/ssh/ssh_host*key* && \
-		rm -rf /var/lib/apt/lists/* /var/tmp/* /tmp/*
-
-COPY ./data/run.sh /run.sh
-COPY ./data/sshd_config /etc/ssh/sshd_config
-
-ENTRYPOINT /run.sh
-
-# Default SSH-Port for clients
-EXPOSE 22
diff --git a/build.sh b/build.sh
new file mode 100644
index 0000000..f4f38e6
--- /dev/null
+++ b/build.sh
@@ -0,0 +1,2 @@
+docker build -t borg:git server
+docker build -t borg:init init
diff --git a/data/run.sh b/data/run.sh
deleted file mode 100755
index e794704..0000000
--- a/data/run.sh
+++ /dev/null
@@ -1,95 +0,0 @@
-#!/bin/bash
-# Start Script for docker-borgserver
-
-PUID=${PUID:-1000}
-PGID=${PGID:-1000}
-
-usermod -o -u "$PUID" borg &>/dev/null
-groupmod -o -g "$PGID" borg &>/dev/null
-
-BORG_DATA_DIR=/backup
-SSH_KEY_DIR=/sshkeys
-BORG_CMD='cd ${BORG_DATA_DIR}/${client_name}; borg serve --restrict-to-path ${BORG_DATA_DIR}/${client_name} ${BORG_SERVE_ARGS}'
-AUTHORIZED_KEYS_PATH=/home/borg/.ssh/authorized_keys
-
-# Append only mode?
-BORG_APPEND_ONLY=${BORG_APPEND_ONLY:=no}
-
-echo "########################################################"
-echo -n " * Docker BorgServer powered by "
-borg -V
-echo "########################################################"
-echo " * User  id: $(id -u borg)"
-echo " * Group id: $(id -g borg)"
-echo "########################################################"
-
-
-# Precheck if BORG_ADMIN is set
-if [ "${BORG_APPEND_ONLY}" == "yes" ] && [ -z "${BORG_ADMIN}" ] ; then
-	echo "WARNING: BORG_APPEND_ONLY is active, but no BORG_ADMIN was specified!"
-fi
-
-# Precheck directories & client ssh-keys
-for dir in BORG_DATA_DIR SSH_KEY_DIR ; do
-	dirpath=$(eval echo '$'${dir})
-	echo " * Testing Volume ${dir}: ${dirpath}"
-	if [ ! -d "${dirpath}" ] ; then
-		echo "ERROR: ${dirpath} is no directory!"
-		exit 1
-	fi
-
-	if [ "$(find ${SSH_KEY_DIR}/clients ! -regex '.*/\..*' -a -type f | wc -l)" == "0" ] ; then
-		echo "ERROR: No SSH-Pubkey file found in ${SSH_KEY_DIR}"
-		exit 1
-	fi
-done
-
-# Create SSH-Host-Keys on persistent storage, if not exist
-mkdir -p ${SSH_KEY_DIR}/host 2>/dev/null
-echo " * Checking / Preparing SSH Host-Keys..."
-for keytype in ed25519 rsa ; do
-	if [ ! -f "${SSH_KEY_DIR}/host/ssh_host_${keytype}_key" ] ; then
-		echo "  ** Creating SSH Hostkey [${keytype}]..."
-		ssh-keygen -q -f "${SSH_KEY_DIR}/host/ssh_host_${keytype}_key" -N '' -t ${keytype}
-	fi
-done
-
-echo "########################################################"
-echo " * Starting SSH-Key import..."
-
-# Add every key to borg-users authorized_keys
-rm ${AUTHORIZED_KEYS_PATH} &>/dev/null
-for keyfile in $(find "${SSH_KEY_DIR}/clients" ! -regex '.*/\..*' -a -type f); do
-    client_name=$(basename ${keyfile})
-    mkdir ${BORG_DATA_DIR}/${client_name} 2>/dev/null
-    echo "  ** Adding client ${client_name} with repo path ${BORG_DATA_DIR}/${client_name}"
-
-	# If client is $BORG_ADMIN unset $client_name, so path restriction equals $BORG_DATA_DIR
-	# Otherwise add --append-only, if enabled
-	borg_cmd=${BORG_CMD}
-	if [ "${client_name}" == "${BORG_ADMIN}" ] ; then
-		echo "   ** Client '${client_name}' is BORG_ADMIN! **"
-		unset client_name
-	elif [ "${BORG_APPEND_ONLY}" == "yes" ] ; then
-		borg_cmd="${BORG_CMD} --append-only"
-	fi
-
-    echo -n "command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${AUTHORIZED_KEYS_PATH}
-	cat ${keyfile} >> ${AUTHORIZED_KEYS_PATH}
-done
-
-echo " * Validating structure of generated ${AUTHORIZED_KEYS_PATH}..."
-ERROR=$(ssh-keygen -lf ${AUTHORIZED_KEYS_PATH} 2>&1 >/dev/null)
-if [ $? -ne 0 ]; then
-    echo "ERROR: ${ERROR}"
-    exit 1
-fi
-
-chown -R borg:borg ${BORG_DATA_DIR}
-chown borg:borg ${AUTHORIZED_KEYS_PATH}
-chmod 600 ${AUTHORIZED_KEYS_PATH}
-
-echo "########################################################"
-echo " * Init done! Starting SSH-Daemon..."
-
-/usr/sbin/sshd -D -e
diff --git a/docker-compose.yml b/docker-compose.yml
index aabaf84..2f02b4f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,20 +1,46 @@
 version: '3'
 services:
- borgserver:
-  image: nold360/borgserver
-  #build: .
-  volumes:
-   - ./backup:/backup
-   - ./sshkeys:/sshkeys
-  ports:
-   - "2222:22"
-  environment:
-   BORG_SERVE_ARGS: ""
+  init:
+    image: borg:init
+    env_file: .env
+    volumes:
+      - borg-home:/home/borg/.ssh:rw
+      - host-keys:/sshkeys:rw
 
-   # If set to "yes", only the BORG_ADMIN
-   # can delete/prune the all clients archives/repos
-   BORG_APPEND_ONLY: "no"
+      # FIXME: i want to get rid of that..
+      - backup:/backup:rw
+    restart: "no"
 
-   # Hostname of Admin's SSH-Key
-   BORG_ADMIN: ""
-  restart: unless-stopped
+  borgserver:
+    #image: nold360/borgserver
+    image: borg:git
+    user: 1000:1000
+    volumes:
+      # generated authorized_keys by init
+      - borg-home:/home/borg/.ssh:ro
+
+      # only contains host-keys now
+      - host-keys:/sshkeys:ro
+
+      # Backup repository for borg
+      - backup:/backup:rw
+    ports:
+      - "2222:2222"
+    environment:
+      BORG_SERVE_ARGS: ""
+
+      # If set to "yes", only the BORG_ADMIN
+      # can delete/prune the all clients archives/repos
+      BORG_APPEND_ONLY: "no"
+
+      # Hostname of Admin's SSH-Key
+      BORG_ADMIN: ""
+    depends_on:
+      - init
+    restart: unless-stopped
+
+# Shared volume to exchange authorized_keys between init & server
+volumes:
+  borg-home:
+  host-keys:
+  backup:
diff --git a/env.example b/env.example
new file mode 100644
index 0000000..7ff0b3e
--- /dev/null
+++ b/env.example
@@ -0,0 +1,2 @@
+KEY_GIT_URL=https://github.com/yourName/your-ssh-pub-keys.git
+KEY_GIT_BRANCH=master
diff --git a/init/Dockerfile b/init/Dockerfile
new file mode 100644
index 0000000..35b333f
--- /dev/null
+++ b/init/Dockerfile
@@ -0,0 +1,13 @@
+# Borgserver Init-Container, simply replace entrypoiny and install git
+#FROM nold360/borgserver:latest
+FROM borg:git
+
+USER root
+RUN export DEBIAN_FRONTEND=noninteractive && \
+		apt-get update && \
+		apt-get -y --no-install-recommends install \
+		git ca-certificates && \
+		apt-get clean && \
+		rm -rf /var/lib/apt/lists/* /var/tmp/* /tmp/*
+
+COPY ./entrypoint.sh /entrypoint.sh
diff --git a/init/entrypoint.sh b/init/entrypoint.sh
new file mode 100755
index 0000000..c0df36e
--- /dev/null
+++ b/init/entrypoint.sh
@@ -0,0 +1,107 @@
+#!/bin/bash
+# Init-Start Script for docker-borgserver
+# Will pull ssh-keys from git specified via KEY_GIT_URL and KEY_GIT_BRANCH [default: master]
+# and merge them into a single [openssh] authorized_keys file.
+PUID=${PUID:-1000}
+PGID=${PGID:-1000}
+
+usermod -o -u "$PUID" borg &>/dev/null
+groupmod -o -g "$PGID" borg &>/dev/null
+
+# FIXME: Is this changeable? guess it should be.. should move it to some kind of
+# build-env file
+BORG_DATA_DIR=${BORG_DATA_DIR:-/backup}
+
+BORG_CMD='cd ${BORG_DATA_DIR}/${client_name}; borg serve --restrict-to-path ${BORG_DATA_DIR}/${client_name} ${BORG_SERVE_ARGS}'
+KEY_GIT_BRANCH=${KEY_GIT_BRANCH:-master}
+
+# This is the path where the final authorized_keys will be written:
+AUTHORIZED_KEYS_PATH=${AUTHORIZED_KEYS_PATH:-/home/borg/.ssh/authorized_keys}
+
+# This will only contain host-keys now
+SSH_KEY_DIR=${SSH_KEY_DIR:-/sshkeys}
+
+# This is no volume anymore, only temporary during init
+GIT_KEY_DIR=/tmp/gitkeys
+echo "########################################################"
+echo " * Docker BorgServer | Git Init-Container *"
+echo " * $(id)"
+
+if [ ! -z "${KEY_GIT_URL}" ] ; then
+  # FIXME: Should the container die here, in case of error?
+  # To workaround the limitations of docker-compose we could just loop here like.. forever
+
+  # INFO: simle git clone would be enouth, but you can also use a volume for SSH_KEY_DIR if you like
+  echo " * Cloning '${KEY_GIT_URL}' into '${GIT_KEY_DIR}/clients'"
+  if [ ! -d "${GIT_KEY_DIR}/clients/.git" ] ; then
+    git clone -b ${KEY_GIT_BRANCH} --depth=1 "${KEY_GIT_URL}" "${GIT_KEY_DIR}/clients"
+  else
+    git -C "${GIT_KEY_DIR}/clients" pull
+  fi
+else
+  echo " ! FATAL ERROR: KEY_GIT_URL is not set! Can't continue."
+  exit 1
+fi
+
+if [ "$(find ${GIT_KEY_DIR}/clients ! -regex '.*/\..*' -a -type f | wc -l)" == "0" ] ; then
+  echo " ! FATAL ERROR: No SSH-Pubkey file found in ${GIT_KEY_DIR}. Can't continue."
+  exit 2
+fi
+
+# Create SSH-Host-Keys on persistent storage, if not exist
+# This also means that `${SSH_KEY_DIR}` has to be a shared volume
+echo " * Checking / Preparing SSH Host-Keys..."
+for keytype in ed25519 rsa ; do
+  if [ ! -f "${SSH_KEY_DIR}/ssh_host_${keytype}_key" ] ; then
+    echo "  ** Creating SSH Hostkey [${keytype}]..."
+    ssh-keygen -q -f "${SSH_KEY_DIR}/ssh_host_${keytype}_key" -N '' -t ${keytype}
+  fi
+done
+
+echo "########################################################"
+echo " * Starting SSH-Key import..."
+
+# Add every key to borg-users authorized_keys
+# FIXME: mkdir of filestructure must still be done by server-container
+# since we shouldn't have access to the backup-data volume in init
+rm -f ${AUTHORIZED_KEYS_PATH} &>/dev/null
+for keyfile in $(find "${GIT_KEY_DIR}" ! -regex '.*/\..*' -a -type f); do
+  client_name=$(basename ${keyfile})
+
+  # check if file is a valid openssh public key
+  if ! ssh-keygen -lf $keyfile &>/dev/null ; then
+    echo " ! WARNING: '$keyfile' is not a valid [open]ssh-public-key. Will continue anyway."
+    continue
+  fi
+
+  # If client is $BORG_ADMIN unset $client_name, so path restriction equals $BORG_DATA_DIR
+  # Otherwise add --append-only, if enabled
+  borg_cmd=${BORG_CMD}
+  if [ "${client_name}" == "${BORG_ADMIN}" ] ; then
+    echo "   ** Client '${client_name}' is BORG_ADMIN! **"
+    unset client_name
+  elif [ "${BORG_APPEND_ONLY}" == "yes" ] ; then
+    borg_cmd="${BORG_CMD} --append-only"
+  fi
+
+  echo -n "command=\"$(eval echo -n \"${borg_cmd}\")\" " >> ${AUTHORIZED_KEYS_PATH}
+  cat ${keyfile} >> ${AUTHORIZED_KEYS_PATH}
+done
+
+# This will also fail if there wasn't a single valid pubkey found
+echo " * Validating structure of generated ${AUTHORIZED_KEYS_PATH}..."
+if ! ssh-keygen -lf ${AUTHORIZED_KEYS_PATH} >/dev/null ; then
+  echo " ! FATAL ERROR: ${AUTHORIZED_KEYS_PATH} is no valid authorized_keys file. Can't continue."
+  exit 3
+fi
+
+echo " * Correcting Permissions..."
+chown borg:borg ${AUTHORIZED_KEYS_PATH}
+chown -R borg:borg ${SSH_KEY_DIR}/*
+chown borg:borg ${BORG_DATA_DIR}
+chmod 600 ${AUTHORIZED_KEYS_PATH}
+
+echo "########################################################"
+echo " * Init done! Ready to fire up your borgserver!"
+
+exit 0
diff --git a/server/Dockerfile b/server/Dockerfile
new file mode 100644
index 0000000..829ec5d
--- /dev/null
+++ b/server/Dockerfile
@@ -0,0 +1,36 @@
+############################################################
+# Dockerfile to build borgbackup server images
+# Based on Debian
+############################################################
+FROM debian:buster-slim
+
+# Volume for SSH-Host-Keys
+VOLUME /sshkeys
+
+# Volume for borg repositories
+VOLUME /backup
+
+# Volume for authorized_keys exchange from init
+VOLUME /home/borg
+
+RUN export DEBIAN_FRONTEND=noninteractive && \
+		apt-get update && \
+		apt-get -y --no-install-recommends install \
+		borgbackup openssh-server iputils-ping && \
+		apt-get clean && \
+		useradd -s /bin/bash -m -U borg && \
+		mkdir /home/borg/.ssh && \
+		chmod 700 /home/borg/.ssh && \
+		touch /home/borg/.ssh/authorized_keys && \
+		chown -R borg:borg /home/borg /backup && \
+		mkdir /run/sshd && \
+		rm -f /etc/ssh/ssh_host*key* && \
+		rm -rf /var/lib/apt/lists/* /var/tmp/* /tmp/*
+
+COPY ./entrypoint.sh /entrypoint.sh
+COPY ./sshd_config /etc/ssh/sshd_config
+
+USER borg
+EXPOSE 2222
+
+ENTRYPOINT /entrypoint.sh
diff --git a/server/entrypoint.sh b/server/entrypoint.sh
new file mode 100755
index 0000000..ab5b38f
--- /dev/null
+++ b/server/entrypoint.sh
@@ -0,0 +1,64 @@
+#!/bin/bash
+# Start Script for docker-borgserver
+
+PUID=${PUID:-1000}
+PGID=${PGID:-1000}
+
+usermod -o -u "$PUID" borg &>/dev/null
+groupmod -o -g "$PGID" borg &>/dev/null
+
+BORG_DATA_DIR=${BORG_DATA_DIR:-/backup}
+SSH_KEY_DIR=${SSH_KEY_DIR:-/sshkeys}
+BORG_CMD='cd ${BORG_DATA_DIR}/${client_name}; borg serve --restrict-to-path ${BORG_DATA_DIR}/${client_name} ${BORG_SERVE_ARGS}'
+AUTHORIZED_KEYS_PATH=/home/borg/.ssh/authorized_keys
+
+# Append only mode?
+BORG_APPEND_ONLY=${BORG_APPEND_ONLY:=no}
+
+echo "########################################################"
+echo " * Docker BorgServer powered by $(borg -V)"
+echo "########################################################"
+echo " * $(id)"
+echo "########################################################"
+
+echo -n "Waiting for init-container to finish..."
+sleep 5
+while ping -c2 init >/dev/null 2>/dev/null ; do
+  echo .
+  sleep 3
+done
+echo " done"
+
+# Precheck if BORG_ADMIN is set
+if [ "${BORG_APPEND_ONLY}" == "yes" ] && [ -z "${BORG_ADMIN}" ] ; then
+  echo "WARNING: BORG_APPEND_ONLY is active, but no BORG_ADMIN was specified!"
+fi
+
+# Precheck directories & client ssh-keys
+for dir in BORG_DATA_DIR SSH_KEY_DIR ; do
+  dirpath=$(eval echo '$'${dir})
+  echo " * Testing Volume ${dir}: ${dirpath}"
+  if [ ! -d "${dirpath}" ] ; then
+    echo " ! ERROR: ${dirpath} is no directory!"
+    exit 1
+  fi
+done
+
+for keytype in ed25519 rsa ; do
+  if [ ! -f "${SSH_KEY_DIR}/ssh_host_${keytype}_key" ] ; then
+    echo " ! WARNING: SSH-Host-Key $keytype doesn't exist!"
+    continue
+  fi
+done
+
+echo "########################################################"
+echo " * Checking authorized_keys file..."
+# Check if authorzied_keys is valid
+if ! ssh-keygen -lf ${AUTHORIZED_KEYS_PATH} >/dev/null; then
+  echo " ! ERROR: '${AUTHORIZED_KEYS_PATH}' is not a valid authorized_keys-file."
+  exit 1
+fi
+
+echo "########################################################"
+echo " * Init done! Starting SSH-Daemon..."
+/usr/sbin/sshd -D -e
diff --git a/data/sshd_config b/server/sshd_config
similarity index 69%
rename from data/sshd_config
rename to server/sshd_config
index b1c2206..4cbdc79 100644
--- a/data/sshd_config
+++ b/server/sshd_config
@@ -1,17 +1,19 @@
-Port 22
+Port 2222
 AddressFamily any
 ListenAddress 0.0.0.0
 ListenAddress ::
 
-HostKey /sshkeys/host/ssh_host_rsa_key
-HostKey /sshkeys/host/ssh_host_ed25519_key
+HostKey /sshkeys/ssh_host_rsa_key
+HostKey /sshkeys/ssh_host_ed25519_key
+
+PidFile /tmp/sshd.pid
 
 PermitRootLogin no
 StrictModes yes
 MaxSessions 20
 
 PubkeyAuthentication yes
-AuthorizedKeysFile	.ssh/authorized_keys
+AuthorizedKeysFile	/home/borg/.ssh/authorized_keys
 
 LogLevel INFO