From 40630b86b948460fb281d3c5d3762b02ceacd59d Mon Sep 17 00:00:00 2001
From: Kevin Baensch <kb@ujamii.com>
Date: Fri, 11 Nov 2022 15:38:59 +0100
Subject: [PATCH] Initial working sql proxy setup

---
 .gitignore                      |  1 +
 Dockerfile                      |  2 ++
 docker-compose.yml              | 23 ++++++++++++++++++++++-
 etc/ssh/.ssh/authorized_keys    |  0
 etc/ssh/sshd_config             | 13 +++++++++++++
 hostman.sh => script/hostman.sh |  0
 script/sqlproxy.sh              |  8 ++++++++
 sqlproxy_setup.sh               | 18 ++++++++++++++++++
 8 files changed, 64 insertions(+), 1 deletion(-)
 create mode 100644 Dockerfile
 create mode 100644 etc/ssh/.ssh/authorized_keys
 create mode 100644 etc/ssh/sshd_config
 rename hostman.sh => script/hostman.sh (100%)
 create mode 100755 script/sqlproxy.sh
 create mode 100755 sqlproxy_setup.sh

diff --git a/.gitignore b/.gitignore
index e69de29..f7b85c6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1 @@
+/etc/ssh/*key*
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..1e919e0
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,2 @@
+FROM ajoergensen/openssh-server
+RUN useradd -d /etc/ssh sqlproxy && usermod -p '*' sqlproxy
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
index 646b927..4db19b5 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,7 +7,28 @@ services:
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro
       - /etc/hosts:/tmp/hosts:rw
-      - ./hostman.sh:/hostman.sh
+      - ./script/hostman.sh:/hostman.sh:ro
+  sshd:
+    build:
+      context: .
+      dockerfile: ./Dockerfile
+    command: ["./sqlproxy.sh", "&", "wait", "$!" ]
+    ports:
+      - 22:22
+    volumes:
+      - ./etc/ssh:/etc/ssh/
+      - /var/run/docker.sock:/tmp/docker.sock:ro
+      - ./script/hostman.sh:/hostman.sh:ro
+      - ./script/sqlproxy.sh:/sqlproxy.sh:ro
+    environment:
+      DISABLE_KEYGEN: true
+      DISABLE_CONFIG_GEN: true
+      HOST_CONF_PATH: /etc/hosts
+      RESOLVE_DOCKERHOST: true
+      DOCKER_HOSTNAME_VAR: DB_VHOST
+    networks:
+      - proxy
+    restart: unless-stopped
   nginx-proxy:
     image: jwilder/nginx-proxy
     ports:
diff --git a/etc/ssh/.ssh/authorized_keys b/etc/ssh/.ssh/authorized_keys
new file mode 100644
index 0000000..e69de29
diff --git a/etc/ssh/sshd_config b/etc/ssh/sshd_config
new file mode 100644
index 0000000..9b8afcd
--- /dev/null
+++ b/etc/ssh/sshd_config
@@ -0,0 +1,13 @@
+PasswordAuthentication no
+PubkeyAuthentication yes
+Port 22
+X11Forwarding no
+PermitRootLogin no
+GatewayPorts no
+AllowTcpForwarding yes
+PermitOpen any
+
+PidFile /config/sshd.pid
+Subsystem	sftp	/usr/lib/ssh/sftp-server -u 022
+
+AllowUsers sqlproxy
diff --git a/hostman.sh b/script/hostman.sh
similarity index 100%
rename from hostman.sh
rename to script/hostman.sh
diff --git a/script/sqlproxy.sh b/script/sqlproxy.sh
new file mode 100755
index 0000000..90be21b
--- /dev/null
+++ b/script/sqlproxy.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env sh
+# ensure permissions
+chown sqlproxy:sqlproxy /etc/ssh
+chown -R sqlproxy:sqlproxy /etc/ssh/.ssh
+chmod 0700 /etc/ssh/.ssh
+chmod 0600 /etc/ssh/.ssh/authorized_keys
+
+source ./hostman.sh
diff --git a/sqlproxy_setup.sh b/sqlproxy_setup.sh
new file mode 100755
index 0000000..9bdd492
--- /dev/null
+++ b/sqlproxy_setup.sh
@@ -0,0 +1,18 @@
+if [ ! -f ./etc/ssh/ssh_host_ed25519_key ]
+then
+    echo "Generating sqlproxy SSHD keys"
+    ssh-keygen -f ./ -A
+fi
+
+read -r -p "Auto generate client keys+config? [Y/n] " GEN_KEYS
+case $GEN_KEYS in
+    [yY]*)
+        mkdir -p ~/.ssh
+        read -r -p "Key Name (should not already exist in ~/.ssh): " KEY_NAME
+        ssh-keygen -t ed25519 -f ~/.ssh/$KEY_NAME.key
+        read -r -p "Target Host: " HOST_NAME
+        echo -ne "\n\nHost $HOST_NAME\n  User sqlproxy\n  IdentityFile ~/.ssh/$KEY_NAME.key" >> ~/.ssh/config
+        cat ~/.ssh/$KEY_NAME.key.pub >> ./etc/ssh/.ssh/authorized_keys
+        break;;
+       *) echo "Not generating client ssh key.\nPlease put your desired public keys into ./etc/ssh/.ssh/authorized_keys";;
+esac