rsshfs conatiners

modules/k3s/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }@args:
 with lib;
 let
   cfg = config.nyxs-nix.services.k3s;
@@ -6,6 +6,7 @@ in
 {
   imports = [
     ./secrets.nix
+    ./images
   ];
 
   options.nyxs-nix.services.k3s = with types; {
@@ -63,6 +64,7 @@ in
       clusterInit = mkIf cfg.initServer true;
       serverAddr = mkIf (!cfg.initServer) "https://10.5.0.103:6443";
       manifests = import ./manifests.nix { inherit lib cfg inputs; };
+      images = import ./images args;
       disable = [];
     };
 

modules/k3s/deployments/authentik.nix

@@ -22,6 +22,20 @@ in
               runAsUser = 1000;
               runAsGroup = 1000;
             };
+            initContainers = [
+              {
+                name = "rssfs";
+                image = "rsshfs-client:latest";
+                args = ["/bin/rsshfs" "rsshfs-server" "/data" "/containers/authentik"];
+                restartPolicy = "Always";
+                volumeMounts = [
+                  {
+                    mountPath = "/data";
+                    name = "iscsi";
+                  }
+                ];
+              }
+            ];
             containers = [
               {
                 name = "authentik-postgres";

modules/k3s/deployments/storage-combo.nix

@@ -0,0 +1,51 @@
+{ ... }:
+{
+  storage-combo.content = [
+    {
+      apiVersion = "apps/v1";
+      kind = "Deployment";
+      metadata = {
+        name = "storage-combo";
+        labels.app = "storage-combo";
+      };
+      spec = {
+        selector.matchLabels.app = "storage-combo";
+        template = {
+          metadata = {
+            labels.app = "storage-combo";
+          };
+          spec = {
+            containers = [
+              {
+                name = "storage-combo";
+                image = "rsshfs-server:latest";
+                ports = [
+                  {
+                    name = "ssh-port";
+                    containerPort = 2222; 
+                  }
+                ];
+              }
+            ];
+          };
+        };
+      };
+    }
+    {
+      apiVersion = "v1";
+      kind = "Service";
+      metadata.name = "rsshfs-server";
+      spec = {
+        selector.app = "storage-combo";
+        ports = [
+          {
+            name = "ssh-port";
+            portocol = "TCP";
+            port = 22;
+            targetport = 2222;
+          }
+        ];
+      };
+    }
+  ];
+}

modules/k3s/images/default.nix

@@ -0,0 +1,9 @@
+{ cfg, lib, inputs, ... }@args:
+let
+  images = [
+    ./rsshfs-client.nix
+    ./rsshfs-server.nix
+  ];
+  imported = map ( n: import n args ) images;
+in
+  lib.foldl' lib.recursiveUpdate {} imported

modules/k3s/images/rsshfs-client.nix

@@ -0,0 +1,172 @@
+{ pkgs, ... }:
+let
+  rsshfsCmd = pkgs.writeShellScriptBin "rsshfs" ''
+    # CONFIG OPTIONS
+    Host="$1"
+    LFolder="$2"
+    RFolder="$3"
+    SSHCMD="ssh -o "StrictHostKeyChecking=no,UserKnownHostsFile=/dev/null" -q -S /tmp/sshfs.sock"
+    TmuxName="rsshfs"
+
+    # SETUP
+
+    # Args
+    # 1: channel
+    # 2: command
+    ftmux() {
+      tmux wait-for -L "$1"
+      tmux send-keys -t "$TmuxName" "$2; tmux wait-for -S $1" C-m
+      tmux wait-for "$1" &
+      local wait_pid=$!
+      wait "$wait_pid" 2>/dev/null
+      tmux wait-for -U "$1"
+    }
+
+    pause() {
+      echo "[ Waiting for user input to end ]"
+      ftmux "pause" "read -n1 -rsp $'[ Press any key to continue ]\n'"
+    }
+
+    cleanup() {
+      trap "" SIGTERM SIGINT
+
+      tmux send-keys -t "$TmuxName" C-m 
+
+      while {
+        $SSHCMD null "df | grep -q \"$RFolder\"" || 
+        $SSHCMD null "[ -d \"$RFolder\" ]";
+      }; do
+        echo "[ Trying to unmount $RFolder ]"
+        $SSHCMD null "umount $RFolder >/dev/null 2>&1"
+        $SSHCMD null "rmdir $RFolder >/dev/null 2>&1"
+        if {
+          $SSHCMD null "df | grep -q \"$RFolder\"" ||
+          $SSHCMD null "[ -d $RFolder ]"
+        }; then
+          echo "[ Failed to unmount $RFolder, sending you in soldier ]"
+          ftmux "unmount" "$SSHCMD null"
+        fi
+      done
+      echo "[ Unmounted $RFolder successfully! ]"
+
+      echo "[ Exiting ssh connection ]"
+      while [[ -e /tmp/sshfs.sock ]]; do
+        $SSHCMD -O exit null
+        if [[ -e /tmp/sshfs.sock ]]; then
+          echo "[ Failed to remove the ssh socket, interactive mode activate]"
+          ftmux "sshsock" "$SHELL"
+        fi
+      done
+      echo "[ Exited ssh connection ]"
+
+      tmux kill-session -t "$TmuxName"
+      
+      exit 0
+    }
+
+    trap cleanup SIGTERM SIGINT
+    tmux new-session -d -s "$TmuxName" /bin/bash
+
+    # MAIN SCRIPT
+    echo "[ Creating ssh connection socket ]"
+    $SSHCMD -MfNx dev@$host
+
+    echo "[ Opening ssh reverse proxy ]"
+    PORT=$($SSHCMD -O forward -R 0:localhost:2222 null)
+    echo "[ Reverse port opened on $PORT ]"
+    echo "[ Pushing local $LFolder to the remote $RFolder ]"
+    $SSHCMD null "if [[ ! -d $RFolder ]]; then mkdir -p $RFolder; fi"
+    $SSHCMD null "sshfs --run \"sshfs -o "StrictHostKeyChecking=no,UserKnownHostsFile=/dev/null" -p $PORT localhost:$LFolder $RFolder\""
+
+    pause
+
+    cleanup
+
+    echo "[ End of Line ]"
+  '';
+  rsshfsEntrypoint = pkgs.writeShellScriptBin "entrypoint" ''
+    if [ ! -f /tmp/ssh_host_ed25519_key ]; then
+      /bin/ssh-keygen -t ed25519 -f /tmp/ssh_host_ed25519_key -N ""
+    fi
+
+    echo "Launching OpenSSH Server (Unauthenticated Access Mode)..."
+    /bin/sshd -f /etc/ssh/sshd_config
+
+    sleep 1
+    eval "exec $@"
+  '';
+  sshdConfig = pkgs.writeTextDir "etc/ssh/sshd_config" ''
+    Port 22
+    ListenAddress 0.0.0.0
+    PidFile /tmp/sshd.pid
+
+    # Turn off auth
+    PermitEmptyPasswords yes
+    AuthenticationMethods none
+
+    # Turn off backup auth
+    UsePAM no
+    KbdInteractiveAuthentication no
+    PasswordAuthentication no
+    PubkeyAuthentication no
+
+    # Only allow dev account
+    PermitRootLogin no
+    AllowUsers dev
+
+    AllowTcpForwarding yes
+    X11Forwarding no
+
+    HostKey /tmp/ssh_host_ed25519_key
+  '';
+in
+{
+  pkgs.dockerTools.buildLayeredImage {
+    name = "rsshfs-server";
+    tag = "latest";
+    copyToRoot = pkgs.buildEnv {
+      name = "root";
+      pathsToLink = [ "/bin" "/etc" "/libexec" ];
+      paths = [
+        pkgs.bashInteractive
+        pkgs.coreutils
+        pkgs.openssh
+        pkgs.tmux
+        sshdConfig
+        rsshfsCmd
+        rsshfsEntrypoint
+      ];
+    };
+    fakeRootCommands = ''
+      mkdir -p ./etc
+  
+      cat <<EOF > /etc/passwd
+      root:x:0:0:root:/root:/bin/sh
+      dev:x:1000:1000:dev:/home/dev:/bin/bash
+      EOF
+
+      cat <<EOF > /etc/group
+      root:x:0:
+      dev:x:1000:
+      EOF
+
+      cat <<EOF > /etc/shadow
+      root:*:19000:0:99999:7:::
+      dev::19000:0:99999:7:::
+      EOF
+
+      mkdir -p /var/run/sshd
+      chmod 755 /var/run/sshd
+      
+      mkdir -p /home/dev/.ssh
+      chown -R 1000:1000 /home/dev
+    '';
+    Env = [
+      "PATH=/bin"
+    ];
+    config = {
+      Entrypoint = [ "/bin/entrypoint" ];
+      Cmd = [ "/bin/rsshfs" "rsshfs" "/" "/containers/tmp" ];
+    };
+  }
+}

modules/k3s/images/rsshfs-server.nix

@@ -0,0 +1,92 @@
+{ pkgs, ... }:
+let
+  rsshfsEntrypoint = pkgs.writeShellScriptBin "entrypoint" ''
+    if [ ! -f /tmp/ssh_host_ed25519_key ]; then
+      /bin/ssh-keygen -t ed25519 -f /tmp/ssh_host_ed25519_key -N ""
+    fi
+
+    echo "Launching OpenSSH Server (Unauthenticated Access Mode)..."
+    /bin/sshd -f /etc/ssh/sshd_config
+    
+    sleep 1
+    eval "exec $@"
+  '';
+  sshdConfig = pkgs.writeTextDir "etc/ssh/sshd_config" ''
+    Port 22
+    ListenAddress 0.0.0.0
+    PidFile /tmp/sshd.pid
+
+    # Turn off auth
+    PermitEmptyPasswords yes
+    AuthenticationMethods none
+
+    # Turn off backup auth
+    UsePAM no
+    KbdInteractiveAuthentication no
+    PasswordAuthentication no
+    PubkeyAuthentication no
+
+    # Only allow dev account
+    PermitRootLogin no
+    AllowUsers dev
+
+    AllowTcpForwarding yes
+    X11Forwarding no
+
+    HostKey /tmp/ssh_host_ed25519_key
+  '';
+in
+{
+  pkgs.dockerTools.buildLayeredImage {
+    name = "rsshfs-client";
+    tag = "latest";
+    copyToRoot = pkgs.buildEnv {
+      name = "root";
+      pathsToLink = [ "/bin" "/etc" "/libexec" ];
+      paths = [
+        pkgs.bashInteractive
+        pkgs.coreutils
+        pkgs.openssh
+        pkgs.tmux
+        pkgs.sshfs
+        sshdConfig
+        rsshfsEntrypoint
+      ];
+    };
+    fakeRootCommands = ''
+      mkdir -p ./etc
+  
+      cat <<EOF > /etc/passwd
+      root:x:0:0:root:/root:/bin/sh
+      dev:x:1000:1000:dev:/home/dev:/bin/bash
+      EOF
+
+      cat <<EOF > /etc/group
+      root:x:0:
+      dev:x:1000:
+      EOF
+
+      cat <<EOF > /etc/shadow
+      root:*:19000:0:99999:7:::
+      dev::19000:0:99999:7:::
+      EOF
+
+      mkdir -p /var/run/sshd
+      chmod 755 /var/run/sshd
+      
+      mkdir -p /home/dev/.ssh
+      chown -R 1000:1000 /home/dev
+
+      mkdir -p /containers
+      chown -R 1000:1000 /containers
+    '';
+    Env = [
+      "PATH=/bin"
+    ];
+    config = {
+      Entrypoint = [ "/bin/entrypoint" ];
+      Cmd = [ "tail" "-f" "/dev/null" ];
+      ExposedPorts = { "2222/tcp" = {}; };
+    };
+  }
+}