mirror-only

Blame: the commit that last changed each line · file · history

`f7a634ab` 2026-10-27 Pavel Safronov	1	#!/bin/bash
	2	# Forced command for backup keys in ~/.ssh/authorized_keys on DreamHost:
	3	#
	4	# restrict,command="/home/fuzzygamer/fw/tools/server/mirror-only" ssh-ed25519 AAAA... truenas-mirror
	5	#
	6	# The key can then only read repos: `git fetch`/`git clone` of ~/git/<name>.git, plus
	7	# `list` (repo names, one per line) and `visibility <name>`. Anything else is refused.
	8	set -u
	9	cmd=${SSH_ORIGINAL_COMMAND:-}
	10	log="$HOME/fw/logs/mirror-only.log"
	11	mkdir -p "$(dirname "$log")"
	12	echo "$(date -u '+%F %T') ${SSH_CLIENT%% *} $cmd" >> "$log"
	13
	14	valid_repo() { [[ "$1" =~ ^git/[A-Za-z0-9][A-Za-z0-9._-]*\.git$ ]] && [ -d "$HOME/$1" ]; }
	15
	16	case "$cmd" in
	17	"git-upload-pack '"*"'")
	18	repo=${cmd#git-upload-pack \'}; repo=${repo%\'}; repo=${repo#/home/fuzzygamer/}; repo=${repo#\~/}
	19	valid_repo "$repo" \|\| { echo "mirror-only: no such repo" >&2; exit 1; }
	20	exec git-upload-pack "$HOME/$repo" ;;
	21	list)
	22	for r in "$HOME"/git/*.git; do basename "$r" .git; done ;;
	23	"visibility "*)
	24	name=${cmd#visibility }
	25	valid_repo "git/$name.git" \|\| { echo "mirror-only: no such repo" >&2; exit 1; }
	26	v=$(git -C "$HOME/git/$name.git" config --get fuzzyworld.visibility \|\| true)
	27	[ "$v" = public ] && echo public \|\| echo private ;;
	28	*)
	29	echo "mirror-only: this key may only fetch repos (refused: $cmd)" >&2; exit 1 ;;
	30	esac