From 9291374d2ebd60bee6710dc9fe8375657dd8ff87 Mon Sep 17 00:00:00 2001 From: nyxerinys Date: Mon, 29 Jun 2026 10:53:55 -0500 Subject: [PATCH] rsshfs conatiners --- hosts/artemis/homebrew.nix | 1 + modules/home/nyxerinys/default.nix | 1 + modules/k3s/default.nix | 4 +- modules/k3s/deployments/authentik.nix | 14 ++ modules/k3s/deployments/storage-combo.nix | 51 +++++++ modules/k3s/images/default.nix | 9 ++ modules/k3s/images/rsshfs-client.nix | 172 ++++++++++++++++++++++ modules/k3s/images/rsshfs-server.nix | 92 ++++++++++++ 8 files changed, 343 insertions(+), 1 deletion(-) create mode 100644 modules/k3s/deployments/storage-combo.nix create mode 100644 modules/k3s/images/default.nix create mode 100644 modules/k3s/images/rsshfs-client.nix create mode 100644 modules/k3s/images/rsshfs-server.nix diff --git a/hosts/artemis/homebrew.nix b/hosts/artemis/homebrew.nix index 482df3c..5d19871 100644 --- a/hosts/artemis/homebrew.nix +++ b/hosts/artemis/homebrew.nix @@ -46,6 +46,7 @@ "discord" "Sikarugir-App/sikarugir/sikarugir" "zen" + "python" ]; }; } \ No newline at end of file diff --git a/modules/home/nyxerinys/default.nix b/modules/home/nyxerinys/default.nix index 8f03583..1a822e9 100644 --- a/modules/home/nyxerinys/default.nix +++ b/modules/home/nyxerinys/default.nix @@ -15,6 +15,7 @@ sops age ssh-to-age + tmux ]; diff --git a/modules/k3s/default.nix b/modules/k3s/default.nix index 7c3dfdb..f5413e6 100644 --- a/modules/k3s/default.nix +++ b/modules/k3s/default.nix @@ -1,4 +1,4 @@ -{ config, lib, pkgs, inputs, ... }: +{ config, lib, pkgs, inputs, ... }@args: with lib; let cfg = config.nyxs-nix.services.k3s; @@ -6,6 +6,7 @@ in { imports = [ ./secrets.nix + ./images ]; options.nyxs-nix.services.k3s = with types; { @@ -63,6 +64,7 @@ in clusterInit = mkIf cfg.initServer true; serverAddr = mkIf (!cfg.initServer) "https://10.5.0.103:6443"; manifests = import ./manifests.nix { inherit lib cfg inputs; }; + images = import ./images args; disable = []; }; diff --git a/modules/k3s/deployments/authentik.nix b/modules/k3s/deployments/authentik.nix index 92dbc2a..6f7617a 100644 --- a/modules/k3s/deployments/authentik.nix +++ b/modules/k3s/deployments/authentik.nix @@ -22,6 +22,20 @@ in runAsUser = 1000; runAsGroup = 1000; }; + initContainers = [ + { + name = "rssfs"; + image = "rsshfs-client:latest"; + args = ["/bin/rsshfs" "rsshfs-server" "/data" "/containers/authentik"]; + restartPolicy = "Always"; + volumeMounts = [ + { + mountPath = "/data"; + name = "iscsi"; + } + ]; + } + ]; containers = [ { name = "authentik-postgres"; diff --git a/modules/k3s/deployments/storage-combo.nix b/modules/k3s/deployments/storage-combo.nix new file mode 100644 index 0000000..c00b85f --- /dev/null +++ b/modules/k3s/deployments/storage-combo.nix @@ -0,0 +1,51 @@ +{ ... }: +{ + storage-combo.content = [ + { + apiVersion = "apps/v1"; + kind = "Deployment"; + metadata = { + name = "storage-combo"; + labels.app = "storage-combo"; + }; + spec = { + selector.matchLabels.app = "storage-combo"; + template = { + metadata = { + labels.app = "storage-combo"; + }; + spec = { + containers = [ + { + name = "storage-combo"; + image = "rsshfs-server:latest"; + ports = [ + { + name = "ssh-port"; + containerPort = 2222; + } + ]; + } + ]; + }; + }; + }; + } + { + apiVersion = "v1"; + kind = "Service"; + metadata.name = "rsshfs-server"; + spec = { + selector.app = "storage-combo"; + ports = [ + { + name = "ssh-port"; + portocol = "TCP"; + port = 22; + targetport = 2222; + } + ]; + }; + } + ]; +} \ No newline at end of file diff --git a/modules/k3s/images/default.nix b/modules/k3s/images/default.nix new file mode 100644 index 0000000..481c94c --- /dev/null +++ b/modules/k3s/images/default.nix @@ -0,0 +1,9 @@ +{ cfg, lib, inputs, ... }@args: +let + images = [ + ./rsshfs-client.nix + ./rsshfs-server.nix + ]; + imported = map ( n: import n args ) images; +in + lib.foldl' lib.recursiveUpdate {} imported \ No newline at end of file diff --git a/modules/k3s/images/rsshfs-client.nix b/modules/k3s/images/rsshfs-client.nix new file mode 100644 index 0000000..595d498 --- /dev/null +++ b/modules/k3s/images/rsshfs-client.nix @@ -0,0 +1,172 @@ +{ pkgs, ... }: +let + rsshfsCmd = pkgs.writeShellScriptBin "rsshfs" '' + # CONFIG OPTIONS + Host="$1" + LFolder="$2" + RFolder="$3" + SSHCMD="ssh -o "StrictHostKeyChecking=no,UserKnownHostsFile=/dev/null" -q -S /tmp/sshfs.sock" + TmuxName="rsshfs" + + # SETUP + + # Args + # 1: channel + # 2: command + ftmux() { + tmux wait-for -L "$1" + tmux send-keys -t "$TmuxName" "$2; tmux wait-for -S $1" C-m + tmux wait-for "$1" & + local wait_pid=$! + wait "$wait_pid" 2>/dev/null + tmux wait-for -U "$1" + } + + pause() { + echo "[ Waiting for user input to end ]" + ftmux "pause" "read -n1 -rsp $'[ Press any key to continue ]\n'" + } + + cleanup() { + trap "" SIGTERM SIGINT + + tmux send-keys -t "$TmuxName" C-m + + while { + $SSHCMD null "df | grep -q \"$RFolder\"" || + $SSHCMD null "[ -d \"$RFolder\" ]"; + }; do + echo "[ Trying to unmount $RFolder ]" + $SSHCMD null "umount $RFolder >/dev/null 2>&1" + $SSHCMD null "rmdir $RFolder >/dev/null 2>&1" + if { + $SSHCMD null "df | grep -q \"$RFolder\"" || + $SSHCMD null "[ -d $RFolder ]" + }; then + echo "[ Failed to unmount $RFolder, sending you in soldier ]" + ftmux "unmount" "$SSHCMD null" + fi + done + echo "[ Unmounted $RFolder successfully! ]" + + echo "[ Exiting ssh connection ]" + while [[ -e /tmp/sshfs.sock ]]; do + $SSHCMD -O exit null + if [[ -e /tmp/sshfs.sock ]]; then + echo "[ Failed to remove the ssh socket, interactive mode activate]" + ftmux "sshsock" "$SHELL" + fi + done + echo "[ Exited ssh connection ]" + + tmux kill-session -t "$TmuxName" + + exit 0 + } + + trap cleanup SIGTERM SIGINT + tmux new-session -d -s "$TmuxName" /bin/bash + + # MAIN SCRIPT + echo "[ Creating ssh connection socket ]" + $SSHCMD -MfNx dev@$host + + echo "[ Opening ssh reverse proxy ]" + PORT=$($SSHCMD -O forward -R 0:localhost:2222 null) + echo "[ Reverse port opened on $PORT ]" + echo "[ Pushing local $LFolder to the remote $RFolder ]" + $SSHCMD null "if [[ ! -d $RFolder ]]; then mkdir -p $RFolder; fi" + $SSHCMD null "sshfs --run \"sshfs -o "StrictHostKeyChecking=no,UserKnownHostsFile=/dev/null" -p $PORT localhost:$LFolder $RFolder\"" + + pause + + cleanup + + echo "[ End of Line ]" + ''; + rsshfsEntrypoint = pkgs.writeShellScriptBin "entrypoint" '' + if [ ! -f /tmp/ssh_host_ed25519_key ]; then + /bin/ssh-keygen -t ed25519 -f /tmp/ssh_host_ed25519_key -N "" + fi + + echo "Launching OpenSSH Server (Unauthenticated Access Mode)..." + /bin/sshd -f /etc/ssh/sshd_config + + sleep 1 + eval "exec $@" + ''; + sshdConfig = pkgs.writeTextDir "etc/ssh/sshd_config" '' + Port 22 + ListenAddress 0.0.0.0 + PidFile /tmp/sshd.pid + + # Turn off auth + PermitEmptyPasswords yes + AuthenticationMethods none + + # Turn off backup auth + UsePAM no + KbdInteractiveAuthentication no + PasswordAuthentication no + PubkeyAuthentication no + + # Only allow dev account + PermitRootLogin no + AllowUsers dev + + AllowTcpForwarding yes + X11Forwarding no + + HostKey /tmp/ssh_host_ed25519_key + ''; +in +{ + pkgs.dockerTools.buildLayeredImage { + name = "rsshfs-server"; + tag = "latest"; + copyToRoot = pkgs.buildEnv { + name = "root"; + pathsToLink = [ "/bin" "/etc" "/libexec" ]; + paths = [ + pkgs.bashInteractive + pkgs.coreutils + pkgs.openssh + pkgs.tmux + sshdConfig + rsshfsCmd + rsshfsEntrypoint + ]; + }; + fakeRootCommands = '' + mkdir -p ./etc + + cat < /etc/passwd + root:x:0:0:root:/root:/bin/sh + dev:x:1000:1000:dev:/home/dev:/bin/bash + EOF + + cat < /etc/group + root:x:0: + dev:x:1000: + EOF + + cat < /etc/shadow + root:*:19000:0:99999:7::: + dev::19000:0:99999:7::: + EOF + + mkdir -p /var/run/sshd + chmod 755 /var/run/sshd + + mkdir -p /home/dev/.ssh + chown -R 1000:1000 /home/dev + ''; + Env = [ + "PATH=/bin" + ]; + config = { + Entrypoint = [ "/bin/entrypoint" ]; + Cmd = [ "/bin/rsshfs" "rsshfs" "/" "/containers/tmp" ]; + }; + } +} \ No newline at end of file diff --git a/modules/k3s/images/rsshfs-server.nix b/modules/k3s/images/rsshfs-server.nix new file mode 100644 index 0000000..541cc46 --- /dev/null +++ b/modules/k3s/images/rsshfs-server.nix @@ -0,0 +1,92 @@ +{ pkgs, ... }: +let + rsshfsEntrypoint = pkgs.writeShellScriptBin "entrypoint" '' + if [ ! -f /tmp/ssh_host_ed25519_key ]; then + /bin/ssh-keygen -t ed25519 -f /tmp/ssh_host_ed25519_key -N "" + fi + + echo "Launching OpenSSH Server (Unauthenticated Access Mode)..." + /bin/sshd -f /etc/ssh/sshd_config + + sleep 1 + eval "exec $@" + ''; + sshdConfig = pkgs.writeTextDir "etc/ssh/sshd_config" '' + Port 22 + ListenAddress 0.0.0.0 + PidFile /tmp/sshd.pid + + # Turn off auth + PermitEmptyPasswords yes + AuthenticationMethods none + + # Turn off backup auth + UsePAM no + KbdInteractiveAuthentication no + PasswordAuthentication no + PubkeyAuthentication no + + # Only allow dev account + PermitRootLogin no + AllowUsers dev + + AllowTcpForwarding yes + X11Forwarding no + + HostKey /tmp/ssh_host_ed25519_key + ''; +in +{ + pkgs.dockerTools.buildLayeredImage { + name = "rsshfs-client"; + tag = "latest"; + copyToRoot = pkgs.buildEnv { + name = "root"; + pathsToLink = [ "/bin" "/etc" "/libexec" ]; + paths = [ + pkgs.bashInteractive + pkgs.coreutils + pkgs.openssh + pkgs.tmux + pkgs.sshfs + sshdConfig + rsshfsEntrypoint + ]; + }; + fakeRootCommands = '' + mkdir -p ./etc + + cat < /etc/passwd + root:x:0:0:root:/root:/bin/sh + dev:x:1000:1000:dev:/home/dev:/bin/bash + EOF + + cat < /etc/group + root:x:0: + dev:x:1000: + EOF + + cat < /etc/shadow + root:*:19000:0:99999:7::: + dev::19000:0:99999:7::: + EOF + + mkdir -p /var/run/sshd + chmod 755 /var/run/sshd + + mkdir -p /home/dev/.ssh + chown -R 1000:1000 /home/dev + + mkdir -p /containers + chown -R 1000:1000 /containers + ''; + Env = [ + "PATH=/bin" + ]; + config = { + Entrypoint = [ "/bin/entrypoint" ]; + Cmd = [ "tail" "-f" "/dev/null" ]; + ExposedPorts = { "2222/tcp" = {}; }; + }; + } +} \ No newline at end of file