infra/codestorage/hg-ssh

Paddy 2015-10-15 Parent:bf7b66df555f

6:4c6afe37e83a Go to Latest

infra/codestorage/hg-ssh/Dockerfile

Pull hostkeys when pulling SSH keys. Rather than relying on Kubernetes secrets and baking public keys right in, which was bound to get fraught, we now have some graceful degradation. It defaults to automatically-generated random keys, but will try to download some keys from Google Cloud Storage for the host. If it can find some, it'll try to use those, instead.

Download raw file
View source Diff to previous Annotate
History
1 FROM secondbit/hg-repo-sync
2 MAINTAINER Paddy "<paddy@secondbit.org>"
3
4 ADD create_user.sh /usr/local/bin/helpers/create_user.sh
5 RUN chmod +x /usr/local/bin/helpers/create_user.sh
6 ADD run.sh /usr/local/bin/helpers/run-ssh.sh
7 RUN chmod +x /usr/local/bin/helpers/run-ssh.sh
8 ADD pullkeys.sh /usr/local/bin/helpers/pullkeys.sh
9 RUN chmod +x /usr/local/bin/helpers/pullkeys.sh
10 ADD post-commit-broadcast.sh /usr/local/bin/helpers/broadcast-to-frontends.sh
11 RUN chmod +x /usr/local/bin/helpers/broadcast-to-frontends.sh
12
13 ADD hgrc /etc/mercurial/hgrc
14
15 RUN mkdir /var/run/sshd
16
17 # install required packages
18 RUN apt-get -y update
19 RUN apt-get -y install openssh-server dnsutils
20
21 #ADD sshd_config /etc/ssh/sshd_config
22 RUN sed -ri 's/session required pam_loginuid.so/session optional pam_loginuid.so/g' /etc/pam.d/sshd
23 RUN sed -ri 's/#PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config
24 RUN sed -ri 's/PermitRootLogin without-password/PermitRootLogin no/g' /etc/ssh/sshd_config
25
26 EXPOSE 22
27
28 CMD ["/usr/local/bin/helpers/run-ssh.sh"]