From f603a49d1d4c8df8ce78af5477ea10605de17420 Mon Sep 17 00:00:00 2001 From: Adrien Ferrand Date: Wed, 15 Nov 2017 11:24:53 +0100 Subject: [PATCH 1/6] Deals with already existing user/group backuppc --- files/entrypoint.sh | 26 +++++++++++++++++++------- files/lighttpd.conf | 4 ++-- files/supervisord.conf | 2 +- 3 files changed, 22 insertions(+), 10 deletions(-) diff --git a/files/entrypoint.sh b/files/entrypoint.sh index d85f53d..37216e7 100755 --- a/files/entrypoint.sh +++ b/files/entrypoint.sh @@ -10,14 +10,26 @@ if [ -f /firstrun ]; then cp /usr/share/zoneinfo/$TZ /etc/localtime fi - # Create backuppc user - addgroup -S -g ${BACKUPPC_GUID:-1000} backuppc - adduser -D -S -h /home/backuppc -G backuppc -u ${BACKUPPC_UUID:-1000} backuppc - chown backuppc:backuppc /home/backuppc + # Create backuppc user/group if needed + BACKUPPC_GROUPNAME=`getent group "${BACKUPPC_GUID:-1000}" | cut -d: -f1` + if [ -z "$BACKUPPC_GROUPNAME" ]; then + groupadd -r -g "${BACKUPPC_GUID:-1000}" backuppc + BACKUPPC_GROUPNAME="backuppc" + fi + BACKUPPC_USERNAME=`getent group "${BACKUPPC_UUID:-1000}" | cut -d: -f1` + if [ -z "$BACKUPPC_USERNAME" ]; then + useradd -r -d /home/backuppc -g "${BACKUPPC_GUID:-1000}" -u ${BACKUPPC_UUID:-1000} -M -N backuppc + BACKUPPC_USERNAME="backuppc" + else + usermod -d /home/backuppc "$BACKUPPC_USERNAME" + fi + chown "$BACKUPPC_USERNAME":"$BACKUPPC_GROUPNAME" /home/backuppc + export BACKUPPC_USERNAME + export BACKUPPC_GROUPNAME # Generate cryptographic key if [ ! -f /home/backuppc/.ssh/id_rsa ]; then - su backuppc -s /bin/sh -c "ssh-keygen -t rsa -N '' -f /home/backuppc/.ssh/id_rsa" + su "$BACKUPPC_USERNAME" -s /bin/sh -c "ssh-keygen -t rsa -N '' -f /home/backuppc/.ssh/id_rsa" fi # Extract BackupPC @@ -59,14 +71,14 @@ if [ -f /firstrun ]; then -subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=IT Department/CN=example.com" openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt cat server.key server.crt > server.pem - chown backuppc:backuppc server.pem + chown "$BACKUPPC_USERNAME":"$BACKUPPC_GROUPNAME" server.pem chmod 0600 server.pem rm -f server.pass.key server.key server.csr server.crt # Reconfigure lighttpd to use ssl echo "ssl.engine = \"enable\"" >> /etc/lighttpd/lighttpd.conf echo "ssl.pemfile = \"/etc/lighttpd/server.pem\"" >> /etc/lighttpd/lighttpd.conf fi - touch /var/log/lighttpd/error.log && chown -R backuppc:backuppc /var/log/lighttpd + touch /var/log/lighttpd/error.log && chown -R "$BACKUPPC_USERNAME":"$BACKUPPC_GROUPNAME" /var/log/lighttpd # Configure standard mail delivery parameters (may be overriden by backuppc user-wide config) echo "account default" > /etc/msmtprc diff --git a/files/lighttpd.conf b/files/lighttpd.conf index 1d98e88..d2209c8 100644 --- a/files/lighttpd.conf +++ b/files/lighttpd.conf @@ -1,6 +1,6 @@ server.port = 8080 -server.username = "backuppc" -server.groupname = "backuppc" +server.username = env.BACKUPPC_USERNAME +server.groupname = env.BACKUPPC_GROUPNAME server.document-root = "/srv/http" server.errorlog = "/var/log/lighttpd/error.log" dir-listing.activate = "enable" diff --git a/files/supervisord.conf b/files/supervisord.conf index e3deabb..a5e559f 100644 --- a/files/supervisord.conf +++ b/files/supervisord.conf @@ -30,4 +30,4 @@ killasgroup = true [program:backuppc] command = /usr/local/BackupPC/bin/BackupPC redirect_stderr = true -user = backuppc +user = %(ENV_BACKUPPC_USERNAME)s From 25e1ac4997f902500f094e3c1242eff72326adbb Mon Sep 17 00:00:00 2001 From: Adrien Ferrand Date: Wed, 15 Nov 2017 11:42:17 +0100 Subject: [PATCH 2/6] Add shadow to manipulate groups --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index a9046bf..4c91de4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -11,7 +11,7 @@ RUN apk --no-cache add \ # Install backuppc build dependencies gcc g++ autoconf automake make git patch perl perl-dev perl-cgi expat expat-dev curl wget \ # Install backuppc runtime dependencies -supervisor rsync samba-client iputils openssh openssl rrdtool msmtp lighttpd lighttpd-mod_auth gzip apache2-utils tzdata libstdc++ libgomp libgcc \ +supervisor rsync samba-client iputils openssh openssl rrdtool msmtp lighttpd lighttpd-mod_auth gzip apache2-utils tzdata libstdc++ libgomp libgcc shadow \ # Compile and install needed perl modules && cpan App::cpanminus \ && cpanm -n Archive::Zip XML::RSS File::Listing \ From bd919669dfdb88b9451853d25342b318450f83bc Mon Sep 17 00:00:00 2001 From: Adrien Ferrand Date: Wed, 15 Nov 2017 11:51:54 +0100 Subject: [PATCH 3/6] Correction --- files/entrypoint.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/files/entrypoint.sh b/files/entrypoint.sh index 37216e7..99e5790 100755 --- a/files/entrypoint.sh +++ b/files/entrypoint.sh @@ -16,7 +16,7 @@ if [ -f /firstrun ]; then groupadd -r -g "${BACKUPPC_GUID:-1000}" backuppc BACKUPPC_GROUPNAME="backuppc" fi - BACKUPPC_USERNAME=`getent group "${BACKUPPC_UUID:-1000}" | cut -d: -f1` + BACKUPPC_USERNAME=`getent passwd "${BACKUPPC_UUID:-1000}" | cut -d: -f1` if [ -z "$BACKUPPC_USERNAME" ]; then useradd -r -d /home/backuppc -g "${BACKUPPC_GUID:-1000}" -u ${BACKUPPC_UUID:-1000} -M -N backuppc BACKUPPC_USERNAME="backuppc" From f48b6187661257ba1ad1e684b1070313494aa72e Mon Sep 17 00:00:00 2001 From: Adrien Ferrand Date: Wed, 15 Nov 2017 11:58:01 +0100 Subject: [PATCH 4/6] Correct runtime --- files/entrypoint.sh | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/files/entrypoint.sh b/files/entrypoint.sh index 99e5790..adebf98 100755 --- a/files/entrypoint.sh +++ b/files/entrypoint.sh @@ -1,6 +1,9 @@ #!/bin/sh set -e +BACKUPPC_USERNAME=`getent passwd "${BACKUPPC_UUID:-1000}" | cut -d: -f1` +BACKUPPC_GROUPNAME=`getent group "${BACKUPPC_GUID:-1000}" | cut -d: -f1` + if [ -f /firstrun ]; then echo 'First run of the container. BackupPC will be installed.' echo 'If exist, configuration and data will be reused and upgraded as needed.' @@ -11,12 +14,10 @@ if [ -f /firstrun ]; then fi # Create backuppc user/group if needed - BACKUPPC_GROUPNAME=`getent group "${BACKUPPC_GUID:-1000}" | cut -d: -f1` if [ -z "$BACKUPPC_GROUPNAME" ]; then groupadd -r -g "${BACKUPPC_GUID:-1000}" backuppc BACKUPPC_GROUPNAME="backuppc" fi - BACKUPPC_USERNAME=`getent passwd "${BACKUPPC_UUID:-1000}" | cut -d: -f1` if [ -z "$BACKUPPC_USERNAME" ]; then useradd -r -d /home/backuppc -g "${BACKUPPC_GUID:-1000}" -u ${BACKUPPC_UUID:-1000} -M -N backuppc BACKUPPC_USERNAME="backuppc" @@ -24,8 +25,6 @@ if [ -f /firstrun ]; then usermod -d /home/backuppc "$BACKUPPC_USERNAME" fi chown "$BACKUPPC_USERNAME":"$BACKUPPC_GROUPNAME" /home/backuppc - export BACKUPPC_USERNAME - export BACKUPPC_GROUPNAME # Generate cryptographic key if [ ! -f /home/backuppc/.ssh/id_rsa ]; then @@ -92,5 +91,8 @@ if [ -f /firstrun ]; then rm -rf /root/BackupPC-$BACKUPPC_VERSION.tar.gz /root/BackupPC-$BACKUPPC_VERSION /firstrun fi +export BACKUPPC_USERNAME +export BACKUPPC_GROUPNAME + # Exec given CMD in Dockerfile exec "$@" From 17604e78be7d16afcbea177fb6b6d15d39b2229c Mon Sep 17 00:00:00 2001 From: Adrien Ferrand Date: Wed, 15 Nov 2017 12:06:58 +0100 Subject: [PATCH 5/6] Configure backuppc user accordingly --- files/entrypoint.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/files/entrypoint.sh b/files/entrypoint.sh index adebf98..1b7c9b9 100755 --- a/files/entrypoint.sh +++ b/files/entrypoint.sh @@ -58,6 +58,7 @@ if [ -f /firstrun ]; then --html-dir /var/www/html/BackupPC \ --html-dir-url /BackupPC \ --install-dir /usr/local/BackupPC \ + --backuppc-user "$BACKUPPC_USERNAME" \ $configure_admin # Prepare lighttpd From bf8d0a2fd1f73822321ce1c02cddf9fbdde63591 Mon Sep 17 00:00:00 2001 From: Adrien Ferrand Date: Wed, 15 Nov 2017 12:12:16 +0100 Subject: [PATCH 6/6] Improve login of supervisord --- files/supervisord.conf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/files/supervisord.conf b/files/supervisord.conf index a5e559f..9510303 100644 --- a/files/supervisord.conf +++ b/files/supervisord.conf @@ -24,10 +24,14 @@ password = dummy [program:lighttpd] command = /usr/sbin/lighttpd -f /etc/lighttpd/lighttpd.conf -D redirect_stderr = true +stdout_logfile = /dev/stdout +stdout_logfile_maxbytes = 0 stopasgroup = true killasgroup = true [program:backuppc] command = /usr/local/BackupPC/bin/BackupPC redirect_stderr = true +stdout_logfile = /dev/stdout +stdout_logfile_maxbytes = 0 user = %(ENV_BACKUPPC_USERNAME)s