mward4
a6f8e67976
Build the image from the vendor vshell-https .deb on ubuntu:24.04 (required: GLIBC_2.38 / GLIBCXX_3.4.32). Contains the Dockerfile, the entrypoint that starts and supervises the three VShell daemons without systemd, the no-container-runtime build/validate/push tooling used to publish the image, and the vendored .deb (sha256 pinned). Published as gitea.milesward.dev/mward4/vshell:5.0.1-3985 and :latest. Manifest digest sha256:8b0ff00be981fa05f1e4a4e4ff5307b6c7e5e61b487d4fbe7e02fefb2a04659f.
77 lines
2.8 KiB
Bash
77 lines
2.8 KiB
Bash
#!/usr/bin/env bash
|
|
# VShell container entrypoint.
|
|
#
|
|
# VShell ships three forking daemons (systemd Type=forking). This script seeds
|
|
# the configuration on first start, creates the PKCS#12 certificate the
|
|
# HTTPS/FTPS listeners require, launches all three daemons, and then stays in
|
|
# the foreground as PID 1 so the container lives exactly as long as the
|
|
# services do.
|
|
set -euo pipefail
|
|
|
|
CFG=${VSHELL_CONFIG:-/usr/local/etc/vshelld_config}
|
|
PRIMES=/usr/local/etc/vshelld_primes.txt
|
|
CERT=${VSHELL_TLS_P12:-/usr/local/etc/vshell-https.p12}
|
|
|
|
SSH_ADDR=${VSHELL_SSH_ADDR:-0.0.0.0:22}
|
|
HTTPS_ADDR=${VSHELL_HTTPS_ADDR:-0.0.0.0:443}
|
|
HTTP_ADDR=${VSHELL_HTTP_ADDR:-0.0.0.0:80}
|
|
FTPS_EXPLICIT_ADDR=${VSHELL_FTPS_EXPLICIT_ADDR:-0.0.0.0:21}
|
|
FTPS_IMPLICIT_ADDR=${VSHELL_FTPS_IMPLICIT_ADDR:-0.0.0.0:990}
|
|
|
|
# Seed the configuration exactly the way the vendor postinst does.
|
|
[ -f "$CFG" ] || { echo "seeding $CFG from vshelld_config.default"; cp /usr/local/etc/vshelld_config.default "$CFG"; }
|
|
[ -f "$PRIMES" ] || { echo "seeding $PRIMES from vshelld_primes.txt.default"; cp /usr/local/etc/vshelld_primes.txt.default "$PRIMES"; }
|
|
|
|
# HTTPS and implicit FTPS need a PKCS#12 bundle with an empty passphrase;
|
|
# VShell cannot read PEM and has no way to supply a passphrase.
|
|
if [ ! -f "$CERT" ]; then
|
|
echo "generating self-signed certificate $CERT"
|
|
tmp=$(mktemp -d)
|
|
openssl req -x509 -newkey rsa:2048 -nodes -days 825 \
|
|
-subj "/CN=$(hostname)/O=VShell Container" \
|
|
-keyout "$tmp/key.pem" -out "$tmp/cert.pem" >/dev/null 2>&1
|
|
openssl pkcs12 -export -out "$CERT" -inkey "$tmp/key.pem" -in "$tmp/cert.pem" -passout pass: >/dev/null 2>&1
|
|
rm -rf "$tmp"
|
|
chmod 600 "$CERT"
|
|
fi
|
|
|
|
# Add the container's listen addresses unless the mounted configuration
|
|
# already defines them.
|
|
if ! grep -qE '^[[:space:]]*HTTPSListenAddresses' "$CFG"; then
|
|
echo "adding container listen addresses to $CFG"
|
|
cat >>"$CFG" <<EOF
|
|
|
|
# Container defaults added by vshell-entrypoint.
|
|
ListenAddresses { $SSH_ADDR }
|
|
HTTPListenAddresses {{ Address $HTTP_ADDR }}
|
|
HTTPSListenAddresses {{ Address $HTTPS_ADDR, CertificatePath $CERT }}
|
|
FTPSExplicitListenAddressesV2 {{ Address $FTPS_EXPLICIT_ADDR, CertificatePath $CERT, RequiredEncryptionLevel 0 }}
|
|
FTPSImplicitListenAddressesV2 {{ Address $FTPS_IMPLICIT_ADDR, CertificatePath $CERT, RequiredEncryptionLevel 2 }}
|
|
EOF
|
|
fi
|
|
|
|
for d in vshelld vshell-httpsd vshell-ftpsd; do
|
|
echo "starting $d"
|
|
"/usr/local/sbin/$d" -f "$CFG"
|
|
done
|
|
|
|
stop() {
|
|
for d in vshelld vshell-httpsd vshell-ftpsd; do
|
|
if [ -f "/var/run/$d.pid" ]; then
|
|
kill "$(cat "/var/run/$d.pid")" 2>/dev/null || true
|
|
fi
|
|
done
|
|
}
|
|
trap 'echo "stopping VShell"; stop; exit 0' TERM INT
|
|
|
|
while :; do
|
|
sleep 5
|
|
for d in vshelld vshell-httpsd vshell-ftpsd; do
|
|
if [ ! -f "/var/run/$d.pid" ]; then
|
|
echo "$d exited; stopping container" >&2
|
|
stop
|
|
exit 1
|
|
fi
|
|
done
|
|
done
|