authorgravatar for git@paperclover.netclover caruso <git@paperclover.net> 2026-05-15 20:26:18-07:00
committergravatar for git@paperclover.netclover caruso <git@paperclover.net> 2026-05-15 20:35:26-07:00
log8f1d2e181c2e47008364c10edc1a6692e4ca1bca
tree0b47020cccdc9edf436b607f80a8accbd96504f2
parentf9eb79553ff10e71e7957c722bd47c7e82ccc543
signaturebadge-check Signed by SSH key SHA256:xbd+BjjhyBfwk7GVoURf9Yx0gzDerHbvYv7SddNWmAs

feat: route knot ssh repos through shared git endpoint

2 files changed, 90 insertions(+), 12 deletions(-)

config/forgejo/ssh/keys.py+34-1
......@@ -2,6 +2,7 @@
22import sys
33import subprocess
44import re
5import json
56
67user, key_type, key = sys.argv[1:4]
78
......@@ -41,8 +42,38 @@ def get_key_id(container: str):
4142
4243clover_id = get_key_id("forgejo")
4344evil_id = get_key_id("evil-forgejo")
45knot_did = None
4446
45if not clover_id and not evil_id:
47try:
48 result = subprocess.run(
49 [
50 "sudo",
51 "/usr/bin/docker",
52 "exec",
53 "knot",
54 "/usr/bin/knot",
55 "keys",
56 "-output",
57 "json",
58 "-internal-api",
59 "http://localhost:5444",
60 "-git-dir",
61 "/home/git/repositories",
62 "-log-path",
63 "/tmp/knotguard.log",
64 ],
65 capture_output=True,
66 text=True,
67 check=False,
68 )
69 for entry in json.loads(result.stdout):
70 if entry.get("key") == f"{key_type} {key}":
71 knot_did = entry.get("did")
72 break
73except:
74 pass
75
76if not clover_id and not evil_id and not knot_did:
4677 sys.exit(0)
4778
4879args: list[str] = []
......@@ -50,6 +81,8 @@ if clover_id:
5081 args.extend(["--clover", clover_id])
5182if evil_id:
5283 args.extend(["--evil", evil_id])
84if knot_did:
85 args.extend(["--knot", knot_did])
5386
5487cmd = "/mnt/storage1/apps/home-infra/config/forgejo/ssh/route.sh " + " ".join(args)
5588print(
config/forgejo/ssh/route.sh+56-11
......@@ -1,6 +1,7 @@
11#!/bin/bash
22clover_id=""
33evil_id=""
4knot_did=""
45
56while [ $# -gt 0 ]; do
67 case "$1" in
......@@ -12,6 +13,10 @@ while [ $# -gt 0 ]; do
1213 evil_id="$2"
1314 shift 2
1415 ;;
16 --knot)
17 knot_did="$2"
18 shift 2
19 ;;
1520 *) shift ;;
1621 esac
1722done
......@@ -20,29 +25,69 @@ repo="${SSH_ORIGINAL_COMMAND#* }"
2025repo="${repo%\'*}"
2126repo="${repo#\'}"
2227repo="${repo#/}"
28repo="${repo%.git}"
29
30if [ -z "$repo" ]; then
31 echo "your git ssh key works :3" >&2
32 exit 1
33fi
34
35git_command="${SSH_ORIGINAL_COMMAND%% *}"
36
37case "$git_command" in
38git-receive-pack | git-upload-pack | git-upload-archive) ;;
39*)
40 echo "invalid git command" >&2
41 exit 1
42 ;;
43esac
2344
2445case "$repo" in
46did:plc:*)
47 case "${repo#did:plc:}" in
48 *[!a-zA-Z0-9]* | "")
49 echo "invalid repo name: $repo" >&2
50 exit 1
51 ;;
52 esac
53 ;;
2554*[!a-zA-Z0-9/_.-]*)
2655 echo "invalid repo name: $repo" >&2
2756 exit 1
2857 ;;
29*..*)
58esac
59
60case "$repo" in
61*..* | /*)
3062 echo "invalid repo name: $repo" >&2
3163 exit 1
3264 ;;
33/*)
34 echo "invalid repo name: $repo" >&2
35 exit 1
65esac
66
67route_knot() {
68 [ -z "$knot_did" ] && echo "ssh key is not configured for repository on knot.paperclover.net" >&2 && exit 1
69 exec sudo docker exec -i -u git knot /usr/bin/env \
70 SSH_ORIGINAL_COMMAND="$git_command '$repo'" \
71 SSH_CONNECTION="$SSH_CONNECTION" \
72 /usr/bin/knot guard \
73 -git-dir /home/git/repositories \
74 -user "$knot_did" \
75 -log-path /tmp/knotguard.log \
76 -internal-api http://localhost:5444
77}
78
79case "$repo" in
80did:plc:*)
81 route_knot
82 ;;
83*/*)
84 if [ ! -d "/mnt/storage1/apps/forgejo/git/repositories/${repo}.git" ] && [ ! -d "/mnt/storage1/apps/evil-infra/forgejo/git/repositories/${repo}.git" ]; then
85 route_knot
86 fi
3687 ;;
3788esac
3889
39if [ -z "$repo" ]; then
40 echo "your git ssh key works :3" >&2
41 exit 1
42fi
43if [[ "$repo" != *".git" ]]; then
44 repo="$repo.git"
45fi
90repo="$repo.git"
4691
4792if [ -d "/mnt/storage1/apps/forgejo/git/repositories/${repo}" ]; then
4893 [ -z "$clover_id" ] && echo "ssh key is not configured for repository on git.paperclover.net" >&2 && exit 1