From df5b984c7327a26cfeecb4e5b9a60a80c3c951aa Mon Sep 17 00:00:00 2001 From: Divya Jain Date: Sun, 23 Mar 2025 22:36:20 +0530 Subject: [PATCH] add code --- .dockerignore | 4 ++++ .env.example | 4 ++++ .gitignore | 1 + Dockerfile | 38 ++++++++++++++++++++++++++++++++++++++ README.md | 18 ++++++++++++++++++ docker-compose.yaml | 34 ++++++++++++++++++++++++++++++++++ entrypoint.sh | 16 ++++++++++++++++ sshd_config | 25 +++++++++++++++++++++++++ 8 files changed, 140 insertions(+) create mode 100644 .dockerignore create mode 100644 .env.example create mode 100644 .gitignore create mode 100644 Dockerfile create mode 100644 docker-compose.yaml create mode 100644 entrypoint.sh create mode 100644 sshd_config diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..a7a5e07 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,4 @@ +* +!Dockerfile +!entrypoint.sh +!sshd_config \ No newline at end of file diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..fec91b0 --- /dev/null +++ b/.env.example @@ -0,0 +1,4 @@ +KNOT_SERVER_HOSTNAME= +KNOT_SERVER_SECRET= + +KNOT_SERVER_SSH_PORT=2222 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..4c49bd7 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.env diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..89ba913 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,38 @@ +FROM golang:1.23-alpine AS build + +RUN apk add git go gcc musl-dev + +RUN git clone https://tangled.sh/@tangled.sh/core /src +WORKDIR /src + +ENV CGO_ENABLED=1 +RUN go mod download +RUN go build -o ./bin/knotserver ./cmd/knotserver +RUN go build -o ./bin/keyfetch ./cmd/keyfetch +RUN go build -o ./bin/repoguard ./cmd/repoguard + + +FROM alpine + +RUN apk add git openssh-server su-exec +RUN addgroup -g 1000 git && \ + adduser -D -u 1000 -G git -h /home/git git && \ + mkdir -p /home/git && \ + chown -R git:git /home/git && \ + passwd -u git + +COPY --from=build /src/bin/knotserver /usr/bin/knotserver +COPY --from=build /src/bin/keyfetch /usr/bin/keyfetch +COPY --from=build /src/bin/repoguard /usr/bin/repoguard + +COPY sshd_config /etc/ssh/sshd_config +COPY entrypoint.sh /entrypoint.sh + +ENV KNOT_REPO_SCAN_PATH=/home/git +ENV KNOT_REPO_MAIN_BRANCH=main +ENV KNOT_SERVER_DB_PATH=/home/git/knotserver.db +ENV APPVIEW_ENDPOINT=https://tangled.sh +ENV KNOT_SERVER_INTERNAL_LISTEN_ADDR=0.0.0.0:5444 +ENV KNOT_SERVER_LISTEN_ADDR=0.0.0.0:5555 + +ENTRYPOINT ["/entrypoint.sh"] diff --git a/README.md b/README.md index f4df41d..634aacf 100644 --- a/README.md +++ b/README.md @@ -1 +1,19 @@ # knot-docker + +## quickstart + +- register a knot on [tangled.sh/knots](https://tangled.sh/knot) +- copy `.env.example` to `.env` +- fill the host name and secret in the `.env` file +- run `docker-compose up -d` + +## ssh client setup + +the ssh daemon runs on port 2222. you can configure your ssh client to use port +2222 to push code to the server by adding the following to your ssh config: + +``` +Host knot.example.com + User git + Port 2222 +``` diff --git a/docker-compose.yaml b/docker-compose.yaml new file mode 100644 index 0000000..eea360d --- /dev/null +++ b/docker-compose.yaml @@ -0,0 +1,34 @@ +services: + proxy: + image: caddy:2-alpine + command: > + caddy + reverse-proxy + --from ${KNOT_SERVER_HOSTNAME} + --to knotserver:5555 + depends_on: + - knotserver + ports: + - "443:443" + volumes: + - caddy_data:/data + restart: always + + knotserver: + build: + context: . + dockerfile: Dockerfile + environment: + - KNOT_SERVER_HOSTNAME=${KNOT_SERVER_HOSTNAME} + - KNOT_SERVER_SECRET=${KNOT_SERVER_SECRET} + volumes: + - knot_data:/home/git + - knot_keys:/etc/ssh/keys + ports: + - "2222:22" + restart: always + +volumes: + caddy_data: + knot_data: + knot_keys: diff --git a/entrypoint.sh b/entrypoint.sh new file mode 100644 index 0000000..63c4a98 --- /dev/null +++ b/entrypoint.sh @@ -0,0 +1,16 @@ +#!/bin/sh + +set -ex + +if [ ! -f /etc/ssh/keys/ssh_host_ed25519_key ]; then + ssh-keygen -t ed25519 -f /etc/ssh/keys/ssh_host_ed25519_key -N "" + chmod 600 /etc/ssh/keys/ssh_host_ed25519_key + chmod 644 /etc/ssh/keys/ssh_host_ed25519_key.pub +fi +/usr/sbin/sshd -e -D & + +if [ ! -f /home/git/knotserver.db ]; then + touch /home/git/knotserver.db +fi +chown -R git:git /home/git +su-exec git knotserver diff --git a/sshd_config b/sshd_config new file mode 100644 index 0000000..5d426f8 --- /dev/null +++ b/sshd_config @@ -0,0 +1,25 @@ +Port 22 +ListenAddress 0.0.0.0 + +LogLevel INFO + +HostKey /etc/ssh/keys/ssh_host_ed25519_key + +PasswordAuthentication no +KbdInteractiveAuthentication no +PubkeyAuthentication yes + +PermitRootLogin no +AllowTcpForwarding no +GatewayPorts no +X11Forwarding no +PermitTTY no +PermitUserEnvironment no +UseDNS no +MaxAuthTries 3 +LoginGraceTime 30s +Subsystem sftp internal-sftp + +Match User git + AuthorizedKeysCommand /usr/bin/keyfetch -repoguard-path /usr/bin/repoguard + AuthorizedKeysCommandUser nobody -- 2.51.2