import files

2021-02-09 17:05:00 +01:00
parent f5c4576411
commit 44a6d37ba5
425 changed files with 23195 additions and 0 deletions
@@ -0,0 +1,83 @@
+FROM alpine:latest as dist
+LABEL maintainer 1001Pharmacies <technique+docker@1001pharmacies.com>
+ARG DOCKER_BUILD_DIR
+
+ARG S3FS_VERSION=v1.85
+
+# Install s3fs-fuse
+RUN apk --no-cache upgrade \
+ && apk --no-cache add --virtual .build-deps \
+        alpine-sdk \
+        automake \
+        autoconf \
+        curl-dev \
+        fuse-dev \
+        libressl-dev \
+        libgcrypt-dev \
+        libxml2-dev \
+ && git clone https://github.com/s3fs-fuse/s3fs-fuse \
+ && cd s3fs-fuse \
+ && git checkout tags/${S3FS_VERSION} -b ${S3FS_VERSION} \
+ && ./autogen.sh \
+ && ./configure --prefix=/usr/local \
+ && make install \
+ && cd .. \
+ && rm -rf s3fs-fuse \
+ && runDeps="$( \
+    scanelf --needed --nobanner --recursive /usr/local \
+      | awk '{ gsub(/,/, "\nso:", $2); print "so:" $2 }' \
+      | xargs -r apk info --installed \
+      | sort -u \
+  )" \
+ && apk del .build-deps \
+ && apk add --no-cache --virtual .run-deps $runDeps curl openssl
+
+ARG S3FS_DIR=/srv/s3
+ENV S3FS_DIR=${S3FS_DIR}
+RUN mkdir -p ${S3FS_DIR}
+VOLUME ${S3FS_DIR}
+
+COPY ${DOCKER_BUILD_DIR}/docker-entrypoint.sh /
+ENTRYPOINT /docker-entrypoint.sh
+
+FROM dist as local
+ARG DOCKER_BUILD_DIR
+ARG UID=0
+ARG USER=root
+ENV UID=${UID}
+ENV GID=${UID}
+ENV USER=${USER}
+LABEL com.1001pharmacies.uid=${UID}
+LABEL com.1001pharmacies.user=${USER}
+
+# If we provide a specific UID
+RUN let $UID >/dev/null 2>&1 \
+# Remove user with $UID if it is not our $USER
+ && if [ "$(getent passwd $UID |awk 'BEGIN {FS=":"} {print $1}')" != "$USER" ]; then \
+      sed -i '/^'$(getent passwd $UID |awk 'BEGIN {FS=":"} {print $1}')':x:'$UID':/d' /etc/passwd; \
+      sed -i '/^'$(getent group $GID |awk 'BEGIN {FS=":"} {print $1}')':x:'$GID':/d' /etc/group; \
+    fi \
+# Force $UID if our $USER already exists
+ && sed -i 's/^'$USER':x:[0-9]\+:[0-9]\+:/'$USER':x:'$UID':'$GID':/' /etc/passwd \
+ && sed -i 's/^'$USER':x:[0-9]\+:/'$USER':x:'$GID':/' /etc/group \
+# Create $USER if it does not exist
+ && if [ "$(getent passwd $UID)" = "" ]; then \
+      echo "$USER:x:$UID:$GID::/home/$USER:/bin/false" >> /etc/passwd; \
+      echo "$USER:!:$(($(date +%s) / 60 / 60 / 24)):0:99999:7:::" >> /etc/shadow; \
+      echo "$USER:x:$GID:" >> /etc/group; \
+    fi \
+ && mkdir -p /home/$USER \
+ && chown $UID:$GID /home/$USER \
+ || true
+
+FROM local as debug
+ARG DOCKER_BUILD_DIR
+
+FROM local as tests
+ARG DOCKER_BUILD_DIR
+
+FROM tests as preprod
+ARG DOCKER_BUILD_DIR
+
+FROM preprod as prod
+ARG DOCKER_BUILD_DIR
@@ -0,0 +1,64 @@
+#!/usr/bin/env ash
+set -euo pipefail
+set -o errexit
+
+trap 'kill -SIGQUIT $PID' INT
+
+# For each user (default to $USER:$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY:$AWS_S3_BUCKET)
+echo "${USERS:-${USER}:${AWS_ACCESS_KEY_ID}:${AWS_SECRET_ACCESS_KEY}:${AWS_S3_BUCKETS:-${AWS_S3_BUCKET:-}}}" |sed 's/ /\n/g' | while read -r line; do
+  [ -n "${line}" ] && echo "${line//:/ }" | while read -r user aws_access_key_id aws_secret_access_key aws_s3_buckets; do
+
+    # Skip user if no AWS credentials
+    [ -n "${aws_access_key_id:-$AWS_ACCESS_KEY_ID}" ] && [ -n "${aws_secret_access_key:-$AWS_SECRET_ACCESS_KEY}" ] || continue
+
+    # Create user if not exists
+    id "${user:-root}" >/dev/null 2>&1 || adduser -h "/home/${user:-root}" -s /sbin/nologin -D "${user:-root}"
+
+    # Configure s3fs
+    passwd_file="$(eval echo ~"${user:-root}")/.passwd-s3fs"
+    echo "${aws_access_key_id:-$AWS_ACCESS_KEY_ID}:${aws_secret_access_key:-$AWS_SECRET_ACCESS_KEY}" > "${passwd_file}"
+    chmod 0400 "${passwd_file}"
+
+    # Find all buckets readable with our credentials
+    if [ -z "${aws_s3_buckets}" ]; then
+        date="$(date -R)"
+        string="GET\n\n\n${date}\n/"
+        authorization="AWS ${aws_access_key_id:-$AWS_ACCESS_KEY_ID}:$(echo -ne "${string}" | openssl sha1 -hmac "${aws_secret_access_key:-$AWS_SECRET_ACCESS_KEY}" -binary | openssl base64)"
+# posix
+        aws_s3_buckets=$(curl -s -H "Date: $date" -H "Authorization: $authorization" https://s3.amazonaws.com/ | awk -F"<|>" 'BEGIN {RS="<"} /Name/ {print $2}')
+# bash only
+#        aws_s3_buckets=$(curl -s -H "Date: $date" -H "Authorization: $authorization" https://s3.amazonaws.com/ \
+#          | while IFS='>' read -rd '<' element value; do
+#            case "${element}" in
+#              'Name')
+#                echo "${value}"
+#                ;;
+#              *)
+#                ;;
+#            esac
+#        done)
+    fi
+
+    # For each bucket (default to all buckets readable by AWS_ACCESS_KEY_ID)
+    echo "${aws_s3_buckets}" |sed 's/,/\n/g' |while read -r aws_s3_bucket; do
+
+        # Skip empty values
+        [ -n "${aws_s3_bucket}" ] || continue
+
+        # Create s3fs mountpoint
+        s3fs_bucket_dir="${S3FS_DIR:-/srv/s3}/${aws_s3_bucket}"
+        mkdir -p "${s3fs_bucket_dir}"
+
+        # Mount s3fs
+        /usr/local/bin/s3fs "${aws_s3_bucket}" "${s3fs_bucket_dir}" -o nosuid,nonempty,nodev,allow_other,complement_stat,mp_umask=027,uid=$(id -u "${user:-root}"),gid=$(id -g "${user:-root}"),passwd_file="${passwd_file}",default_acl="${AWS_S3_ACL:-private}",retries=5
+
+        # Exit docker if the s3 filesystem is not reachable anymore
+        ( crontab -l && echo "* * * * * timeout 3 touch '${s3fs_bucket_dir}/.s3fs_watchdog' >/dev/null 2>&1 || kill -KILL -1" ) | crontab -
+
+    done
+  done
+done
+
+# Keep container running
+[ $# -eq 0 ] && tail -f /dev/null || exec "$@" &
+PID=$! && wait