mirror-only

1	#!/bin/bash
2	# Forced command for backup keys in ~/.ssh/authorized_keys on DreamHost:
3	#
4	# restrict,command="/home/fuzzygamer/fw/tools/server/mirror-only" ssh-ed25519 AAAA... truenas-mirror
5	#
6	# The key can then only read repos: `git fetch`/`git clone` of ~/git/<name>.git, plus
7	# `list` (repo names, one per line) and `visibility <name>`. Anything else is refused.
8	set -u
9	cmd=${SSH_ORIGINAL_COMMAND:-}
10	log="$HOME/fw/logs/mirror-only.log"
11	mkdir -p "$(dirname "$log")"
12	echo "$(date -u '+%F %T') ${SSH_CLIENT%% *} $cmd" >> "$log"
13
14	valid_repo() { [[ "$1" =~ ^git/[A-Za-z0-9][A-Za-z0-9._-]*\.git$ ]] && [ -d "$HOME/$1" ]; }
15
16	case "$cmd" in
17	"git-upload-pack '"*"'")
18	repo=${cmd#git-upload-pack \'}; repo=${repo%\'}; repo=${repo#/home/fuzzygamer/}; repo=${repo#\~/}
19	valid_repo "$repo" \|\| { echo "mirror-only: no such repo" >&2; exit 1; }
20	exec git-upload-pack "$HOME/$repo" ;;
21	list)
22	for r in "$HOME"/git/*.git; do basename "$r" .git; done ;;
23	"visibility "*)
24	name=${cmd#visibility }
25	valid_repo "git/$name.git" \|\| { echo "mirror-only: no such repo" >&2; exit 1; }
26	v=$(git -C "$HOME/git/$name.git" config --get fuzzyworld.visibility \|\| true)
27	[ "$v" = public ] && echo public \|\| echo private ;;
28	*)
29	echo "mirror-only: this key may only fetch repos (refused: $cmd)" >&2; exit 1 ;;
30	esac