Merge pull request #26 from JoshPiper/dependabot/docker/alpine-3.20.0

Bump alpine from 3.19.1 to 3.20.0

Dockerfile

@@ -1,10 +1,16 @@
-FROM alpine:latest
+FROM alpine:3.20.0
+MAINTAINER Dr Internet <internet@limelightgaming.net>
 
-# Update
-RUN apk --update --no-cache add rsync bash openssh-client
+# Install RSync and Open SSH.
+RUN apk update && apk add --no-cache rsync openssh-client
+RUN rm -rf /var/cache/apk/*
 
-# Copy entrypoint
-ADD entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
+# Prepare SSH dir.
+RUN mkdir ~/.ssh
 
-ENTRYPOINT ["/entrypoint.sh"]
+# Copy in our executables.
+COPY agent-* hosts-* /bin/
+RUN chmod +x /bin/agent-* /bin/hosts-*
+
+# Prepare for known hosts.
+RUN hosts-clear

LICENSE

@@ -1,7 +1,6 @@
 MIT License
 
-Copyright (c) 2019 Contention
-Copyright (c) 2019 Burnett01
+Copyright (c) 2020 Joshua Piper
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,144 +1,93 @@
-# rsync deployments
+# rsync docker image.
 
-Forked from [Contention/rsync-deployments](https://github.com/Contention/rsync-deployments)
+A simple alpine based docker image for rsync and ssh deployments.
 
+## Using this image
+This image has two primary uses. Firstly, as a deployment image for GitLab CI runs. Secondly, as a base image for other images.
 
-This GitHub Action deploys files in `GITHUB_WORKSPACE` to a remote folder via rsync over ssh. 
+### gitlab-ci.yml
+```yml
+image: drinternet/rsync:1.0.1
+...
+before_script:
+  - source agent-autostart "$CI_PROJECT_ID-$CI_PIPELINE_ID-$_CI_CONCURRENT_ID"
+  - hosts-add "$SSH_KNOWN_HOSTS"
 
-Use this action in a CD workflow which leaves deployable code in `GITHUB_WORKSPACE`.
-
-The base-image is very small (Alpine+Cache) which results in faster deployments.
-
----
-
-## Inputs
-
-- `switches`* - The first is for any initial/required rsync flags, eg: `-avzr --delete`
-
-- `rsh` - Remote shell commands
-
-- `path` - The source path. Defaults to GITHUB_WORKSPACE
-
-- `remote_path`* - The deployment target path
-
-- `remote_host`* - The remote host
-
-- `remote_port` - The remote port. Defaults to 22
-
-- `remote_user`* - The remote user
-
-- `remote_key`* - The remote ssh key
-
-``* = Required``
-
-## Required secret
-
-This action needs a `DEPLOY_KEY` secret variable. This should be the private key part of a ssh key pair. The public key part should be added to the authorized_keys file on the server that receives the deployment. This should be set in the Github secrets section and then referenced as the  `remote_key` input.
-
-## Example usage
-
-Simple:
-
-```
-name: DEPLOY
-on:
-  push:
-    branches:
-    - master
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v1
-    - name: rsync deployments
-      uses: burnett01/rsync-deployments@3.0
-      with:
-        switches: -avzr --delete
-        path: src/
-        remote_path: /var/www/html/
-        remote_host: example.com
-        remote_user: debian
-        remote_key: ${{ secrets.DEPLOY_KEY }}
+after_script:
+  - agent-stop "$CI_PROJECT_ID-$CI_PIPELINE_ID-$_CI_CONCURRENT_ID"
 ```
 
-Advanced:
-
-```
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v1
-    - name: rsync deployments
-      uses: burnett01/rsync-deployments@3.0
-      with:
-        switches: -avzr --delete --exclude="" --include="" --filter=""
-        path: src/
-        remote_path: /var/www/html/
-        remote_host: example.com
-        remote_port: 5555
-        remote_user: debian
-        remote_key: ${{ secrets.DEPLOY_KEY }}
+### Base image in a `Dockerfile
+```dockerfile
+FROM drinternet/rsync:1.0.1
+COPY some/file or/whatever
 ```
 
-For better security, I suggest you create additional secrets for remote_host, remote_port and remote_user inputs.
+## Inbuilt commands.
 
-```
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v1
-    - name: rsync deployments
-      uses: burnett01/rsync-deployments@3.0
-      with:
-        switches: -avzr --delete
-        path: src/
-        remote_path: /var/www/html/
-        remote_host: ${{ secrets.DEPLOY_HOST }}
-        remote_port: ${{ secrets.DEPLOY_PORT }}
-        remote_user: ${{ secrets.DEPLOY_USER }}
-        remote_key: ${{ secrets.DEPLOY_KEY }}
+This base image also includes a few shell scripts, to help with managing SSH agents and known hosts files.
+### SSH Agent Management
+#### agent-start
+This command starts the SSH agent, if it isn't already started (SSH_AGENT_PID set or ssh agent ID file found).
+It takes one optional argument, for the name of the agent to be started. Defaults to "default".
+This program needs to be source'd to work correctly.
+`source agent-start "default"`
+
+#### agent-stop
+This command stops the SSH agent, if it is started (SSH_AGENT_PID set or ssh agent ID file found).
+It takes one optional argument, for the name of the agent to be stopped. Defaults to "default".
+`agent-stop "my-agent-name"`
+
+#### agent-add
+This command adds a key to the currently running SSH agent. The key is taken from stdin, and the agent used is that in SSH_AGENT_PID.
+
+#### agent-autostart
+This command starts the SSH agent and loads the private key from the "SSH_PRIVATE_KEY" environment var. The command takes one optional argument, for the name of the agent to be started. Defaults to "default".
+As with agent-start, this command needs to be sourced.
+
+#### agent-askpass
+This command is called by ssh-add when the [SSH_ASKPASS](https://man.openbsd.org/ssh-add.1#ENVIRONMENT) variable is set active. The command returns the SSH_PASS to [ssh-askpass(1)](https://man.openbsd.org/ssh-askpass.1).
+
+This command is ignored by ssh-add if the key does not require a passphrase.
+
+### known_hosts management
+#### hosts-clear
+This command truncates the known_hosts file and sets its permissions.
+
+#### hosts-add
+This command adds an entry to the known hosts file, and ensures its permissions are correct. It takes one argument, which is the new key to add.
+
+## Tags
+Both the repository and Docker Hub images follow the [semantic versioning](https://semver.org/) standard.
+Docker Hub image versions are prefixed with v, and contain the full version, version sub patch number and version sub minor and patch.
+
+For example, the repository tag 1.2.3, creates the Hub tags v1.2.3, v1.2 and v1, to allow for binding to a specific version, specific minor version or specific major version.
+
+
+## Example gitlab-ci.yml
+```yml
+image: drinternet/rsync:1.0.1
+
+stages:
+  - deploy
+
+before_script:
+  - source agent-autostart "$CI_PROJECT_ID-$CI_PIPELINE_ID-$_CI_CONCURRENT_ID"
+  - hosts-add "$SSH_KNOWN_HOSTS"
+
+after_script:
+  - agent-stop "$CI_PROJECT_ID-$CI_PIPELINE_ID-$_CI_CONCURRENT_ID"
+
+deploy:
+  stage: deploy
+  script:
+    - rsync -zrSlhaO --chmod=D2775,F664 --delete-after . $FTP_USER@$FTP_HOST:/var/www/deployment/
 ```
 
-For maximum speed limit the checkout action (``actions/checkout@v1``) to a depth of 1:
+## Using with passphrase protected key
+
+You can supply a passphrase with ``SSH_PASS`` to ``agent-add``, ``agent-start`` or ``agent-autostart``.
 
 ```
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v1
-      with:
-        fetch-depth: 1
-    - name: rsync deployments
-      uses: burnett01/rsync-deployments@3.0
-      with:
-        switches: -avzr --delete
-        path: src/
-        remote_path: /var/www/html/
-        remote_host: ${{ secrets.DEPLOY_HOST }}
-        remote_port: ${{ secrets.DEPLOY_PORT }}
-        remote_user: ${{ secrets.DEPLOY_USER }}
-        remote_key: ${{ secrets.DEPLOY_KEY }}
+SSH_PASS="THE_PASSPHRASE" agent-add
 ```
-
----
-
-## Version 2.0
-
-Looking for version 2.0?
-
-Check here: https://github.com/Burnett01/rsync-deployments/tree/2.0
-
-Version 2.0 uses a larger base-image (``ubuntu:latest``).<br>
-Consider upgrading to 3.0 for even faster deployments.
-
-## Version 1.0 (EOL)
-
-Looking for version 1.0?
-
-Check here: https://github.com/Burnett01/rsync-deployments/tree/1.0
-
-Please note that version 1.0 has reached end of life state.

action.yml

@@ -1,37 +0,0 @@
-name: 'Rsync Deployments Action'
-description: 'GitHub Action for deploying code via rsync over ssh'
-author: 'Burnett01'
-inputs:
-  switches:
-    description: 'The switches'
-    required: true
-  rsh:
-    description: 'The remote shell argument'
-    required: false
-    default: ''
-  path:
-    description: 'The local path'
-    required: false
-    default: ''
-  remote_path:
-    description: 'The remote path'
-    required: true
-  remote_host:
-    description: 'The remote host'
-    required: true
-  remote_port:
-    description: 'The remote port'
-    required: false
-    default: 22
-  remote_user:
-    description: 'The remote user'
-    required: true
-  remote_key:
-    description: 'The remote key'
-    required: true
-runs:
-  using: 'docker'
-  image: 'Dockerfile'
-branding:
-  icon: 'send'  
-  color: 'gray-dark'

agent-add

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+source agent-start "${1:-default}"
+cat - | tr -d '\r' | DISPLAY=1 SSH_ASKPASS=agent-askpass ssh-add - >/dev/null

agent-askpass

@@ -0,0 +1,2 @@
+#!/bin/sh
+echo "$SSH_PASS"

agent-autostart

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+source agent-start "${1:-default}"
+echo "$SSH_PRIVATE_KEY" | agent-add

agent-start

@@ -0,0 +1,22 @@
+#!/bin/sh
+
+FOLDER=${1:-default}
+STORE_PATH="/tmp/ssh-agent/$FOLDER"
+mkdir -p "$STORE_PATH"
+
+# Start the SSH agent if it isn't already.
+if [ -z "$SSH_AGENT_PID" ]; then
+	if [ -f "$STORE_PATH/id" ]; then
+		# Our auth agent is already running.
+		# Reload the vars, and export them.
+		SSH_AGENT_PID=$(cat "$STORE_PATH/id")
+		export SSH_AGENT_PID
+
+		SSH_AUTH_SOCK=$(cat "$STORE_PATH/sock")
+		export SSH_AUTH_SOCK
+	else
+		eval "$(ssh-agent)" > /dev/null
+		echo "$SSH_AGENT_PID" > "$STORE_PATH"/id
+		echo "$SSH_AUTH_SOCK" > "$STORE_PATH"/sock
+	fi
+fi

agent-stop

@@ -0,0 +1,35 @@
+#!/bin/sh
+
+if [ ! -z "$SSH_AGENT_PID" ]; then
+	# Here, the environment is set already, just kill the script.
+	eval $(ssh-agent -k) >/dev/null
+	exit $?
+else
+	# The env isn't set, construct the file path.
+	FOLDER=${1:-default}
+	STORE_PATH="/tmp/ssh-agent/$FOLDER"
+	if [ ! -d "$STORE_PATH" ]; then
+		echo "Store Path $STORE_PATH doesn't exist!" >&2
+		exit 1
+	fi
+
+	# And check our files exist.
+	if [ -f "$STORE_PATH/id" ]; then
+		# Grab our PID and socket.
+		SSH_AGENT_PID=$(cat "$STORE_PATH/id")
+		export SSH_AGENT_PID
+		rm "$STORE_PATH/id"
+
+		SSH_AUTH_SOCK=$(cat "$STORE_PATH/sock")
+		export SSH_AUTH_SOCK
+		rm "$STORE_PATH/sock"
+
+
+		rmdir "$STORE_PATH"
+		eval $(ssh-agent -k) >/dev/null
+		exit $?
+	else
+		echo "SSH_AGENT_PID not set, $STORE_PATH/id doesn't exist!" >&2
+		exit 1
+	fi
+fi

entrypoint.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-
-set -eu
-
-# Set deploy key
-SSH_PATH="$HOME/.ssh"
-
-# Create .ssh dir if it doesn't exist
-[ -d "$SSH_PATH" ] || mkdir "$SSH_PATH"
-
-# Place deploy_key into .ssh dir
-echo "$INPUT_REMOTE_KEY" > "$SSH_PATH/key"
-
-# Set r+w to user only
-chmod 600 "$SSH_PATH/key"
-
-# Do deployment
-sh -c "rsync $INPUT_SWITCHES -e 'ssh -i $SSH_PATH/key -o StrictHostKeyChecking=no -p $INPUT_REMOTE_PORT $INPUT_RSH' $GITHUB_WORKSPACE/$INPUT_PATH $INPUT_REMOTE_USER@$INPUT_REMOTE_HOST:$INPUT_REMOTE_PATH"

hosts-add

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+echo "$@" >> ~/.ssh/known_hosts
+chmod 0664 ~/.ssh/known_hosts

hosts-clear

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+truncate -s 0 ~/.ssh/known_hosts
+chmod 0664 ~/.ssh/known_hosts