90 lines
1.9 KiB
Nix
90 lines
1.9 KiB
Nix
{ pkgs, ... }:
|
|
let
|
|
rsshfsEntrypoint = pkgs.writeShellScriptBin "entrypoint" ''
|
|
if [ ! -f /tmp/ssh_host_ed25519_key ]; then
|
|
/bin/ssh-keygen -t ed25519 -f /tmp/ssh_host_ed25519_key -N ""
|
|
fi
|
|
|
|
echo "Launching OpenSSH Server (Unauthenticated Access Mode)..."
|
|
/bin/sshd -f /etc/ssh/sshd_config
|
|
|
|
sleep 1
|
|
eval "exec $@"
|
|
'';
|
|
sshdConfig = pkgs.writeTextDir "etc/ssh/sshd_config" ''
|
|
Port 2222
|
|
ListenAddress 0.0.0.0
|
|
PidFile /tmp/sshd.pid
|
|
|
|
# Turn off auth
|
|
PermitEmptyPasswords yes
|
|
PasswordAuthentication yes
|
|
AuthenticationMethods none
|
|
|
|
# Turn off backup auth
|
|
UsePAM no
|
|
KbdInteractiveAuthentication no
|
|
PubkeyAuthentication no
|
|
|
|
# Only allow dev account
|
|
PermitRootLogin no
|
|
AllowUsers dev
|
|
|
|
AllowTcpForwarding yes
|
|
X11Forwarding no
|
|
|
|
HostKey /tmp/ssh_host_ed25519_key
|
|
'';
|
|
in
|
|
pkgs.dockerTools.buildLayeredImage {
|
|
name = "rsshfs-server";
|
|
tag = "latest";
|
|
contents = [
|
|
pkgs.bashInteractive
|
|
pkgs.coreutils
|
|
(pkgs.symlinkJoin {
|
|
name = "openssh-with-custom-config";
|
|
paths = [ sshdConfig pkgs.openssh ];
|
|
})
|
|
pkgs.tmux
|
|
pkgs.sshfs
|
|
rsshfsEntrypoint
|
|
];
|
|
fakeRootCommands = ''
|
|
mkdir -p ./etc
|
|
mkdir -p ./tmp
|
|
chmod 777 ./tmp
|
|
|
|
cat <<EOF > ./etc/passwd
|
|
root:x:0:0:root:/root:/bin/sh
|
|
dev:x:1000:1000:dev:/home/dev:/bin/bash
|
|
EOF
|
|
|
|
cat <<EOF > ./etc/group
|
|
root:x:0:
|
|
dev:x:1000:
|
|
EOF
|
|
|
|
cat <<EOF > ./etc/shadow
|
|
root:*:19000:0:99999:7:::
|
|
dev::19000:0:99999:7:::
|
|
EOF
|
|
|
|
mkdir -p ./var/run/sshd
|
|
chmod 755 ./var/run/sshd
|
|
|
|
mkdir -p ./home/dev/.ssh
|
|
chown -R 1000:1000 ./home/dev
|
|
|
|
mkdir -p ./containers
|
|
chown -R 1000:1000 ./containers
|
|
'';
|
|
config = {
|
|
Entrypoint = [ "/bin/entrypoint" ];
|
|
Cmd = [ "tail" "-f" "/dev/null" ];
|
|
ExposedPorts = { "2222/tcp" = {}; };
|
|
Env = [
|
|
"PATH=/bin"
|
|
];
|
|
};
|
|
}
|