SSH Access

#!/bin/bash
set -euo pipefail

# When not the designated ssh sidecar, skip sshd and idle as the main container.
if [ "${SSH_CONTAINER_ROLE:-}" != "sidecar" ]; then
    exec /bin/sleep infinity
fi

RUNTIME="${SSH_RUNTIME_DIR:-/ssh-runtime}"
SSH_UID="${PUID:-1000}"
SSH_GID="${PGID:-1000}"

if [ ! -d "${RUNTIME}" ]; then
    echo "ERROR: SSH runtime dir ${RUNTIME} is missing; ensure the ssh-runtime volume is mounted here" >&2
    exit 1
fi

# SSH_USERNAMES: comma-separated list of all usernames that SSHPiper may forward.
# Each gets a passwd entry so sshd can resolve them (all map to uid/gid 1000).
IFS=',' read -ra USERS <<< "${SSH_USERNAMES:-${SSH_USERNAME:-deployment-user}}"

: > "${RUNTIME}/nss-passwd"
: > "${RUNTIME}/nss-group"

for USER in "${USERS[@]}"; do
    USER="${USER// /}"  # trim spaces
    [ -n "${USER}" ] || continue
    echo "${USER}:x:${SSH_UID}:${SSH_GID}:SSH User:${RUNTIME}/home:/bin/bash" >> "${RUNTIME}/nss-passwd"
done

echo "${USERS[0]}:x:${SSH_GID}:" >> "${RUNTIME}/nss-group"

NSS_WRAPPER_LIB=$(find /usr/lib -name "libnss_wrapper.so*" -type f 2>/dev/null | head -1)
if [ -z "${NSS_WRAPPER_LIB}" ]; then
    echo "ERROR: libnss_wrapper.so not found — cannot resolve SSH username" >&2
    exit 1
fi

export NSS_WRAPPER_PASSWD="${RUNTIME}/nss-passwd"
export NSS_WRAPPER_GROUP="${RUNTIME}/nss-group"
export LD_PRELOAD="${NSS_WRAPPER_LIB}"

if [ ! -f "${RUNTIME}/sshd_config" ]; then
    if [ -x /ssh-init/05-ssh-init.sh ]; then
        /bin/bash /ssh-init/05-ssh-init.sh
    else
        # main_container mode: no init container pre-runs; self-initialise.
        ssh-keygen -t ed25519 -f "${RUNTIME}/ssh_host_ed25519_key" -N "" -q
        ssh-keygen -t rsa -b 4096 -f "${RUNTIME}/ssh_host_rsa_key" -N "" -q
        chmod 600 "${RUNTIME}/ssh_host_"*

        AUTH_KEYS="${SSH_AUTHORIZED_KEYS_FILE:-${RUNTIME}/home/.ssh/authorized_keys}"
        mkdir -p "$(dirname "${AUTH_KEYS}")"
        [ -f "${AUTH_KEYS}" ] || touch "${AUTH_KEYS}"
        chmod 600 "${AUTH_KEYS}"

        if [ "${SSH_AUDIT_LOGGING:-true}" = "true" ]; then
            cat > "${RUNTIME}/ssh-audit-shell" << 'AUDIT_EOF'
#!/bin/bash
SESSION_ID=$(tr -dc 'a-f0-9' < /dev/urandom 2>/dev/null | head -c8 || printf '%x' "$(date +%s)")
SRC_IP="${SSH_CLIENT%% *}"
TS="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
printf '%s SSH_AUDIT connect user=%s src=%s session=%s\n' "$TS" "$USER" "$SRC_IP" "$SESSION_ID" >&2
if [ -n "${SSH_ORIGINAL_COMMAND:-}" ]; then
  printf '%s SSH_AUDIT exec user=%s src=%s session=%s cmd=%s\n' "$TS" "$USER" "$SRC_IP" "$SESSION_ID" "$(printf '%q' "$SSH_ORIGINAL_COMMAND")" >&2
  exec /bin/bash -c "$SSH_ORIGINAL_COMMAND"
else
  exec /bin/bash -l
fi
AUDIT_EOF
            chmod +x "${RUNTIME}/ssh-audit-shell"
        fi

        SSH_PORT_VAL="${SSH_PORT:-2222}"
        cat > "${RUNTIME}/sshd_config" << EOF
Port ${SSH_PORT_VAL}
HostKey ${RUNTIME}/ssh_host_ed25519_key
HostKey ${RUNTIME}/ssh_host_rsa_key
PidFile ${RUNTIME}/sshd.pid
AuthorizedKeysFile ${AUTH_KEYS}

UsePAM no
PasswordAuthentication no
ChallengeResponseAuthentication no
KbdInteractiveAuthentication no

PermitRootLogin no
AllowTcpForwarding no
AllowAgentForwarding no
GatewayPorts no
X11Forwarding no
MaxAuthTries 3
MaxSessions 2
LoginGraceTime 30
ClientAliveInterval 120
ClientAliveCountMax 2
PermitEmptyPasswords no
PermitUserEnvironment no
PermitUserRC no
PermitTunnel no
PrintLastLog yes
EOF
        if [ "${SSH_AUDIT_LOGGING:-true}" = "true" ]; then
            echo "ForceCommand ${RUNTIME}/ssh-audit-shell" >> "${RUNTIME}/sshd_config"
        fi
    fi
fi

exec /usr/sbin/sshd -D -e -f "${RUNTIME}/sshd_config"