gitoria

1.1 KB

1. #!/bin/sh
2. # Start: the account `git` takes the owner of the repo folder (the app's user; files stay writable for both), the shared secret is
3. # written where only `git` reads it, host keys live in /hostkeys (a volume: clients keep trusting the server).
4. set -e
5. [ -n "$GITORIA_SSH_SECRET" ] || { echo "GITORIA_SSH_SECRET is not set" >&2; exit 1; }
6. uid=$(stat -c %u /repos); gid=$(stat -c %g /repos)
7. grep -q "^git:" /etc/passwd || echo "git:x:$uid:$gid:git:/repos:/bin/sh" >> /etc/passwd
8. echo "git:*:19000:0:99999:7:::" >> /etc/shadow
9. [ -n "$(getent group "$gid")" ] || echo "gitgroup:x:$gid:" >> /etc/group
10. ( umask 077; printf '%s' "$GITORIA_SSH_SECRET" > /run/gitoria-secret ); chown "$uid:$gid" /run/gitoria-secret
11. # sshd hands its commands an empty environment: what they need is written to files
12. printf "%s" "${GITORIA_URL:-http://127.0.0.1:45004}" > /run/gitoria-url
13. mkdir -p /hostkeys
14. [ -f /hostkeys/ssh_host_ed25519_key ] || ssh-keygen -q -t ed25519 -N '' -f /hostkeys/ssh_host_ed25519_key
15. [ -f /hostkeys/ssh_host_rsa_key ] || ssh-keygen -q -t rsa -b 3072 -N '' -f /hostkeys/ssh_host_rsa_key
16. git config --system --add safe.directory '*'
17. exec /usr/sbin/sshd -D -e -p "${GITORIA_SSH_PORT:-2222}"