infra/codestorage/hg-ssh

Paddy 2015-10-11 Child:4c6afe37e83a

1:2f4a2a20ad6d Go to Latest

infra/codestorage/hg-ssh/pullkeys.sh

Update to be more modular. We updated our Mercurial serving architecture to be a bit more modular. The main difference is that we now are based off the secondbit/hg-repo-sync image, and don't need to do as much setup to get the basics (Mercurial, folders, etc.) We now have a pullkeys.ssh script, which pulls down the SSH keys stored in a specified GCS bucket, and creates users for them. This allows us to update who has push access, without modifying the docker image. We also have a custom run.sh script now, instead of starting sshd directly, because we need to do a few things when starting this up: 1. Modify the permissions on the mounted directories while we're root so SSH users can write and read the committed files. We have to do this at start time instead of at image build time because Kubernetes' volumes don't respect the permissions set at build time. 2. Pull all the repos backed up to GCS to local disk, which means that startup automatically picks up at the last known state. This script is built into the image by secondbit/hg-repo-sync. 3. Pull all the SSH keys from GCS, using the new script. This creates the new users and lets us SSH into the server, while keeping the user definitions separate from the image itself. 4. Finally, start the SSH daemon.

Download raw file
View source Diff to previous Annotate
History
1 #!/bin/bash
2 DOMAIN=${DOMAIN:-code.secondbit.org}
3 SSH_KEYS_BUCKET=${SSH_KEYS_BUCKET:-sshkeys.$DOMAIN}
4
5 mkdir -p /tmp/sshkeys
6
7 echo "Cleaning up..."
8 rm -rf /tmp/sshkeys/*
9
10 echo "Downloading keys from gs://${SSH_KEYS_BUCKET}/"
11
12 output=$(gsutil cp -R gs://$SSH_KEYS_BUCKET/\* /tmp/sshkeys/ 2>&1)
13 echo $output
14
15 keys=$(find /tmp/sshkeys -name '*.pub')
16
17 for key in $keys
18 do
19 dir=$(dirname $key)
20 stripped=${dir#.}
21 stripped=${stripped#/tmp/sshkeys}
22 target=${key#/tmp/sshkeys}
23 target=${target%.pub}
24 target=${target#/}
25 IFS='-' read -ra USERSPEC <<< $target
26 if [ -d "/home${USERSPEC[0]}" ]
27 then
28 echo "User ${USERSPEC[0]} already exists, skipping."
29 else
30 echo "Creating user ${USERSPEC[0]} with ID ${USERSPEC[1]}."
31 /bin/bash /usr/local/bin/helpers/create_user.sh "${USERSPEC[0]}" "${USERSPEC[1]}"
32 cat $key > /home/${USERSPEC[0]}/.ssh/authorized_keys
33 fi
34 done
35
36 echo "Cleaning up..."
37 rm -rf /tmp/sshkeys/*
38
39 echo "SSH key pull complete."