babbarc/workspaces
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: update secure location

Browse Source
This commit is contained in:
phoenix 2025-04-17 05:03:36 +01:00
parent 32a1ce5504
commit aee704d3c4
2 changed files with 14 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
DESIGN.md
View File

@ -13,11 +13,11 @@
| User Location | Host Location | attach mode | Mode | Attribute | Owner | Description | | User Location | Host Location | attach mode | Mode | Attribute | Owner | Description |
| ------------------------------------ | ------------- | ----------- | ---- | --------- | ----- | ------------------------ | | ------------------------------------ | ------------- | ----------- | ---- | --------- | ----- | ------------------------ |
| /home/devuser/.gitconfig | - | mount | 600 | +i | user | Git configuration file | | /home/devuser/.gitconfig | - | mount | 600 | +i | user | Git configuration file |
| /root/ssh/config | - | copy | 100 | +i | root | ssh config file | | /opt/secure/ssh/config | - | copy | 100 | +i | root | ssh config file |
| /root/ssh/authorized_keys | - | mount | 000 | +i | root | authorized keys file | | /opt/secure/ssh/authorized_keys | - | mount | 000 | +i | root | authorized keys file |
| /root/ssh/ssh_blocker.sh | - | copy | 100 | +i | root | ssh blocker shell script | | /opt/secure/ssh/ssh_blocker.sh | - | copy | 100 | +i | root | ssh blocker shell script |
| /root/ssh/id_ed25519 | - | mount | 100 | +i | root | private shh key file | | /opt/secure/ssh/id_ed25519 | - | mount | 100 | +i | root | private shh key file |
| /root/ssh/id_ed25519.pub | - | mount | 100 | +i | root | public shh key file | | /opt/secure/ssh/id_ed25519.pub | - | mount | 100 | +i | root | public shh key file |
| /home/devuser/lazygit/config.yml | - | copy | 600 | +i | user | lazygit config file | | /home/devuser/lazygit/config.yml | - | copy | 600 | +i | user | lazygit config file |
| /home/devuser/.config/nvim | - | copy | 600 | +i | user | neovim config files | | /home/devuser/.config/nvim | - | copy | 600 | +i | user | neovim config files |
| /home/devuser/.config/tmux | - | copy | 600 | +i | user | tmux config files | | /home/devuser/.config/tmux | - | copy | 600 | +i | user | tmux config files |

37
build-analytics-backend-workspace.sh
View File

@ -5,6 +5,7 @@
set -euo pipefail set -euo pipefail
IMG_NAME="analytics-backend-workspace" IMG_NAME="analytics-backend-workspace"
SECURE=/opt/secure
ctr=$(buildah from registry.fedoraproject.org/fedora-minimal:40) ctr=$(buildah from registry.fedoraproject.org/fedora-minimal:40)
@ -18,13 +19,14 @@ buildah run "$ctr" -- useradd -ms /bin/zsh devuser
buildah run "$ctr" -- bash -c 'echo "devuser ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/devuser' buildah run "$ctr" -- bash -c 'echo "devuser ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/devuser'
# SSH setup # SSH setup
buildah run "$ctr" -- mkdir -p /root/ssh buildah run "$ctr" -- mkdir -p /"$SECURE"/ssh
buildah copy "$ctr" ssh/config /root/ssh/config buildah copy "$ctr" ssh/config /"$SECURE"/ssh/config
buildah copy "$ctr" ssh/ssh_blocker.sh /root/ssh/ssh_blocker.sh buildah copy "$ctr" ssh/ssh_blocker.sh /"$SECURE"/ssh/ssh_blocker.sh
buildah run "$ctr" -- chmod 100 /root/ssh/ssh_blocker.sh buildah run "$ctr" -- chmod 100 /"$SECURE"/ssh/ssh_blocker.sh
buildah run "$ctr" -- chattr +i /root/ssh/ssh_blocker.sh buildah run "$ctr" -- chattr +i /"$SECURE"/ssh/ssh_blocker.sh
buildah run "$ctr" -- chmod 000 /root/ssh/config buildah run "$ctr" -- chmod 000 /"$SECURE"/ssh/config
buildah run "$ctr" -- chattr +i /root/ssh/config buildah run "$ctr" -- chattr +i /"$SECURE"/ssh/config
buildah run "$ctr" -- chown -R root:root ssh/config /"$SECURE"/ssh_blocker.sh
# Neovim config (immutable) # Neovim config (immutable)
buildah copy "$ctr" config/nvim /home/devuser/.config/nvim buildah copy "$ctr" config/nvim /home/devuser/.config/nvim
@ -44,27 +46,6 @@ buildah copy "$ctr" ./gpg-key.asc /home/devuser/.gnupg/gpg-key.asc
buildah run "$ctr" -- chattr +i /home/devuser/.gitconfig buildah run "$ctr" -- chattr +i /home/devuser/.gitconfig
buildah run "$ctr" -- chattr +i /home/devuser/.gnupg/gpg-key.asc buildah run "$ctr" -- chattr +i /home/devuser/.gnupg/gpg-key.asc
# Secure SSH wrapper and config
buildah run "$ctr" -- mkdir -p /opt/secure/ssh
buildah copy "$ctr" ./id_ed25519 /opt/secure/ssh/id_ed25519
buildah copy "$ctr" ./ssh_config /opt/secure/ssh/config
buildah run "$ctr" -- chmod 600 /opt/secure/ssh/id_ed25519
buildah run "$ctr" -- chmod 100 /opt/secure/ssh/config
buildah run "$ctr" -- chown root:root /opt/secure/ssh/id_ed25519 /opt/secure/ssh/config
buildah run "$ctr" -- chattr +i /opt/secure/ssh/id_ed25519 /opt/secure/ssh/config
# Create SSH wrapper script
buildah run "$ctr" -- bash -c '
cat <<EOF > /usr/local/bin/git-ssh-wrapper.sh
#!/bin/bash
exec ssh -F /opt/secure/ssh/config "\$@"
EOF
chmod +x /usr/local/bin/git-ssh-wrapper.sh'
# Entrypoint to start SSH
buildah run "$ctr" -- mkdir -p /run/sshd
buildah run "$ctr" -- bash -c 'echo "/usr/sbin/sshd -D" > /home/devuser/start.sh && chmod +x /home/devuser/start.sh'
buildah run "$ctr" -- chown -R devuser:devuser /home/devuser buildah run "$ctr" -- chown -R devuser:devuser /home/devuser
buildah config --user devuser "$ctr" buildah config --user devuser "$ctr"