43 lines
1.6 KiB
Bash
43 lines
1.6 KiB
Bash
|
#!/bin/bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
HOME_DIR=/home/developer
|
||
|
|
HOST_KEY_DIR="${HOME_DIR}/.ssh-host"
|
||
|
|
AUTH_KEYS_SRC=/etc/ssh-authorized-keys/authorized_keys
|
||
|
|
|
||
|
|
mkdir -p "${HOME_DIR}/.ssh" "${HOME_DIR}/workspace" "${HOST_KEY_DIR}"
|
||
|
|
|
||
|
|
# Persist host keys on the PVC so SSH fingerprints stay stable across restarts.
|
||
|
|
if [ ! -f "${HOST_KEY_DIR}/ssh_host_ed25519_key" ]; then
|
||
|
|
ssh-keygen -t ed25519 -f "${HOST_KEY_DIR}/ssh_host_ed25519_key" -N "" -q
|
||
|
|
fi
|
||
|
|
if [ ! -f "${HOST_KEY_DIR}/ssh_host_rsa_key" ]; then
|
||
|
|
ssh-keygen -t rsa -b 4096 -f "${HOST_KEY_DIR}/ssh_host_rsa_key" -N "" -q
|
||
|
|
fi
|
||
|
|
|
||
|
|
cat > /etc/ssh/sshd_config.d/98-hostkeys.conf <<EOF
|
||
|
|
HostKey ${HOST_KEY_DIR}/ssh_host_ed25519_key
|
||
|
|
HostKey ${HOST_KEY_DIR}/ssh_host_rsa_key
|
||
|
|
EOF
|
||
|
|
|
||
|
|
if [ -f "${AUTH_KEYS_SRC}" ]; then
|
||
|
|
install -m 600 -o developer -g developer "${AUTH_KEYS_SRC}" "${HOME_DIR}/.ssh/authorized_keys"
|
||
|
|
fi
|
||
|
|
# sshd StrictModes rejects auth if $HOME is group/world-writable.
|
||
|
|
chmod 755 "${HOME_DIR}"
|
||
|
|
chmod 700 "${HOME_DIR}/.ssh"
|
||
|
|
chown -R developer:developer "${HOME_DIR}"
|
||
|
|
|
||
|
|
# DinD sidecar listens on TCP; ensure SSH login shells see DOCKER_HOST.
|
||
|
|
grep -q '^DOCKER_HOST=' /etc/environment 2>/dev/null \
|
||
|
|
|| echo 'DOCKER_HOST=tcp://127.0.0.1:2375' >> /etc/environment
|
||
|
|
if [ ! -f "${HOME_DIR}/.profile" ] || ! grep -q 'DOCKER_HOST' "${HOME_DIR}/.profile" 2>/dev/null; then
|
||
|
|
printf '\nexport DOCKER_HOST=tcp://127.0.0.1:2375\n' >> "${HOME_DIR}/.profile"
|
||
|
|
chown developer:developer "${HOME_DIR}/.profile"
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Tiny HTTP for TrinityIngress / health (Traefik terminates TLS).
|
||
|
|
python3 -m http.server 8080 --bind 0.0.0.0 --directory /usr/share/devbox-http >/tmp/http-8080.log 2>&1 &
|
||
|
|
|
||
|
|
exec /usr/sbin/sshd -D -e
|