Vsevolod Sauta
e820b1ebd2
build-and-push / build (push) Failing after 1m37s
chown -R over a multi-GB PVC blocked sshd past liveness and risked restart loops after volume reattach.
46 lines
1.9 KiB
Bash
Executable File
46 lines
1.9 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
HOME_DIR=/home/developer
|
|
HOST_KEY_DIR="${HOME_DIR}/.ssh-host"
|
|
AUTH_KEYS_SRC=/etc/ssh-authorized-keys/authorized_keys
|
|
|
|
mkdir -p "${HOME_DIR}/.ssh" "${HOME_DIR}/workspace" "${HOST_KEY_DIR}"
|
|
|
|
# Persist host keys on the PVC so SSH fingerprints stay stable across restarts.
|
|
if [ ! -f "${HOST_KEY_DIR}/ssh_host_ed25519_key" ]; then
|
|
ssh-keygen -t ed25519 -f "${HOST_KEY_DIR}/ssh_host_ed25519_key" -N "" -q
|
|
fi
|
|
if [ ! -f "${HOST_KEY_DIR}/ssh_host_rsa_key" ]; then
|
|
ssh-keygen -t rsa -b 4096 -f "${HOST_KEY_DIR}/ssh_host_rsa_key" -N "" -q
|
|
fi
|
|
|
|
cat > /etc/ssh/sshd_config.d/98-hostkeys.conf <<EOF
|
|
HostKey ${HOST_KEY_DIR}/ssh_host_ed25519_key
|
|
HostKey ${HOST_KEY_DIR}/ssh_host_rsa_key
|
|
EOF
|
|
|
|
if [ -f "${AUTH_KEYS_SRC}" ]; then
|
|
install -m 600 -o developer -g developer "${AUTH_KEYS_SRC}" "${HOME_DIR}/.ssh/authorized_keys"
|
|
fi
|
|
# sshd StrictModes rejects auth if $HOME is group/world-writable.
|
|
# Do not chown -R the whole PVC (tens of GB) — that blocks sshd past liveness and
|
|
# caused empty-home recovery restarts to loop. Ownership is uid 1000 (developer).
|
|
chmod 755 "${HOME_DIR}"
|
|
chmod 700 "${HOME_DIR}/.ssh"
|
|
chown developer:developer "${HOME_DIR}" "${HOME_DIR}/.ssh" "${HOME_DIR}/workspace" 2>/dev/null || true
|
|
chown -R developer:developer "${HOME_DIR}/.ssh-host" 2>/dev/null || true
|
|
|
|
# DinD sidecar listens on TCP; ensure SSH login shells see DOCKER_HOST.
|
|
grep -q '^DOCKER_HOST=' /etc/environment 2>/dev/null \
|
|
|| echo 'DOCKER_HOST=tcp://127.0.0.1:2375' >> /etc/environment
|
|
if [ ! -f "${HOME_DIR}/.profile" ] || ! grep -q 'DOCKER_HOST' "${HOME_DIR}/.profile" 2>/dev/null; then
|
|
printf '\nexport DOCKER_HOST=tcp://127.0.0.1:2375\n' >> "${HOME_DIR}/.profile"
|
|
chown developer:developer "${HOME_DIR}/.profile"
|
|
fi
|
|
|
|
# Tiny HTTP for TrinityIngress / health (Traefik terminates TLS).
|
|
python3 -m http.server 8080 --bind 0.0.0.0 --directory /usr/share/devbox-http >/tmp/http-8080.log 2>&1 &
|
|
|
|
exec /usr/sbin/sshd -D -e
|