mirror of
https://github.com/sotashimozono/obsidian-remote-ssh.git
synced 2026-07-22 17:10:32 +00:00
31cef52612
Bumps alpine from 3.23 to 3.24. --- updated-dependencies: - dependency-name: alpine dependency-version: '3.24' dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: sotashimozono <shimozono-sota631@g.ecc.u-tokyo.ac.jp>
52 lines
2.7 KiB
Docker
52 lines
2.7 KiB
Docker
# Production-oriented sshd container for obsidian-remote-ssh.
|
|
#
|
|
# Deliberately minimal: openssh-server + a single non-privileged
|
|
# `obsidian` user (uid 1000) whose home holds the vault dir the
|
|
# plugin reads/writes. The plugin auto-deploys its `obsidian-remote-
|
|
# server` daemon binary into `~/.obsidian-remote/` on connect; this
|
|
# image just provides a stable, locked-down sshd endpoint to deploy
|
|
# into.
|
|
#
|
|
# Authentication: pubkey-only. The container reads the user's
|
|
# authorized_keys via bind-mount so key rotation doesn't need a
|
|
# rebuild.
|
|
#
|
|
# Host keys: the entrypoint regenerates them on first launch and
|
|
# writes them into `/etc/ssh/keys` which is intended to be
|
|
# bind-mounted by docker-compose so the keys persist across
|
|
# container restarts (otherwise users would TOFU-prompt every time
|
|
# the container is recreated).
|
|
|
|
FROM alpine:3.24
|
|
|
|
RUN apk add --no-cache openssh-server bash shadow tini iproute2 \
|
|
&& mkdir -p /var/empty /etc/ssh/keys \
|
|
&& adduser -D -u 1000 -s /bin/bash obsidian \
|
|
&& mkdir -p /home/obsidian/.ssh /home/obsidian/vault \
|
|
&& chown -R obsidian:obsidian /home/obsidian \
|
|
&& chmod 700 /home/obsidian/.ssh
|
|
|
|
# sshd config: pubkey-only, no root login, point at the persistent
|
|
# host-key dir, force a known port. StrictModes stays ON (production
|
|
# default) — users get warned about bad key permissions rather than
|
|
# silently accepting them; the test container at docker/test-sshd
|
|
# disables it but that's a developer convenience, not a prod default.
|
|
RUN sed -i 's/#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config \
|
|
&& sed -i 's/#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config \
|
|
&& sed -i 's/#\?PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config \
|
|
&& sed -i 's/#\?ChallengeResponseAuthentication.*/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config \
|
|
&& sed -i 's/#\?UsePAM.*/UsePAM no/' /etc/ssh/sshd_config \
|
|
&& sed -i 's|#\?HostKey /etc/ssh/ssh_host_rsa_key|HostKey /etc/ssh/keys/ssh_host_rsa_key|' /etc/ssh/sshd_config \
|
|
&& sed -i 's|#\?HostKey /etc/ssh/ssh_host_ecdsa_key|HostKey /etc/ssh/keys/ssh_host_ecdsa_key|' /etc/ssh/sshd_config \
|
|
&& sed -i 's|#\?HostKey /etc/ssh/ssh_host_ed25519_key|HostKey /etc/ssh/keys/ssh_host_ed25519_key|' /etc/ssh/sshd_config \
|
|
&& echo 'AllowUsers obsidian' >> /etc/ssh/sshd_config
|
|
|
|
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
|
|
RUN chmod +x /usr/local/bin/entrypoint.sh
|
|
|
|
EXPOSE 22
|
|
|
|
# tini handles PID-1 reaping (sshd forks; without an init the
|
|
# zombies pile up over a long-running container's lifetime).
|
|
ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/entrypoint.sh"]
|
|
CMD ["/usr/sbin/sshd", "-D", "-e"]
|