lukegb/depot
1
0
Fork 0
Code Issues 1 Pull requests Projects Packages Activity Actions

heptapod: enable SSH CA

Browse source
This commit is contained in:
Luke Granger-Brown 2022-03-13 00:24:57 +00:00
parent f1fcda810a
commit c9bd0696ed
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
nix/docker/heptapod/default.nix
View file

@ -23,10 +23,22 @@ in pkgs.dockerTools.buildImage rec {
diskSize = 8192;
runAsRoot = ''
#!{pkgs.runtimeShell}
cat <<"EOF" >/sshd_ca.pub
${builtins.readFile ../../../ops/secrets/client-ca.pub}
EOF
cat <<"EOF" >/assets/wrapper_wrapper
#!/bin/bash
/usr/bin/id hg || /usr/sbin/useradd -g $(id -u git) -u $(id -g git) -o -d /var/opt/gitlab -p "*" hg
/usr/bin/grep "AllowUsers git hg" /assets/sshd_config || /bin/sed -i "s/AllowUsers git/AllowUsers git hg/" /assets/sshd_config
/usr/bin/cat <<"EOC" >>/assets/sshd_config
TrustedUserCAKeys /sshd_ca.pub
Match User git
AuthorizedPrincipalsCommandUser root
AuthorizedPrincipalsCommand /opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell-authorized-principals-check lukegb lukegb
Match User hg
AuthorizedPrincipalsCommandUser root
AuthorizedPrincipalsCommand /opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell-authorized-principals-check lukegb lukegb
EOC
exec /assets/wrapper "$@"
EOF
chmod ugo=rx /assets/wrapper_wrapper