README.md

@@ -1,45 +0,0 @@
-# thealmightydrawingtablet/nfs-krb
-
-it's an NFS server with kerberos integrated out of the box !
-
-## why?
-
-because nobody else has made one for some reason ¯\\\_(ツ)\_/¯
-
-# usage
-
-### sharing directory via env var
-
-```bash
-# works for both ubuntu and alpine images
-docker run -d --privileged -v /path/on/host:/container/srv \
-	-e SHARED_DIRECTORY=/container/srv -e PERMITTED=10.0.0.0/8 \
-	-e NFS_KRB_PRINC=nfs/localhost.local -e NFS_KRB_REALM=LOCALHOST.LOCAL -e NFS_KRB_PWD='unguessable!'
-```
-
-### bring your own `/etc/exports`
-
-```bash
-# ubuntu
-docker run -d --privileged -v /path/on/host:/container/srv -v ./exports:/etc/exports \
-	-e PERMITTED=10.0.0.0/8 \
-	-e NFS_KRB_PRINC=nfs/localhost.local -e NFS_KRB_REALM=LOCALHOST.LOCAL -e NFS_KRB_PWD='unguessable!'
-
-# alpine
-docker run -d --privileged -v /path/on/host:/container/srv/folder-1 -v /another/thing:/container/srv/folder-2 -v ./exports:/etc/exports.mnt \
-	-e PERMITTED=10.0.0.0/8 \
-	-e NFS_KRB_PRINC=nfs/localhost.local -e NFS_KRB_REALM=LOCALHOST.LOCAL -e NFS_KRB_PWD='unguessable!'
-```
-
-## recognized configuration environment variables
-
-| Variable           | Default            | Required | Alpine | Ubuntu | Description                                                                     |
-| ------------------ | ------------------ | -------- | ------ | ------ | ------------------------------------------------------------------------------- |
-| `NFS_KRB_REALM`    | -                  | yes      | ✅     | ✅     | Kerberos realm to authenticate with.                                            |
-| `NFS_KRB_PRINC`    | -                  | yes      | ✅     | ✅     | the service principal which will be added to the keytab.                        |
-| `NFS_KRB_PWD`      | -                  | yes      | ✅     | ✅     | kerberos database master password, as well as the password for `NFS_KRB_PRINC`. |
-| `RW_MODE`          | `rw`               | no       | ✅     | ✅     | controls NFS export read/write mode and the per-share option string.            |
-| `SRV_TZ`           | `America/New_York` | no       | ✅     | ❌     | overrides the system timezone.                                                  |
-| `SHARED_DIRECTORY` | -                  | no       | ✅     | ✅     | determines whether to configure a singular export.                              |
-| `PERMITTED`        | `*`                | no       | ✅     | ✅     | provides the allowed client list for a single exported directory.               |
-

build.sh

@@ -4,7 +4,7 @@ IMAGE=${IMAGE:-"thealmightydrawingtablet/nfs-krb"}
 VERSION=$(git tag --sort=-committerdate | grep -vi debug | head -n 1)
 
 docker build --progress=plain -t "${IMAGE}:ubuntu" -t "${IMAGE}:${VERSION}-ubuntu" -f ./Dockerfile.ubuntu .
-docker build --progress=plain -t "${IMAGE}:alpine" -t "${IMAGE}:${VERSION}-alpine" -t "${IMAGE}:latest" .
+docker build --progress=plain -t "${IMAGE}:alpine" -t "${IMAGE}:${VERSION}-alpine" .
 
 if [ "$1" == "push" ]; then
 	docker push --all-tags "${IMAGE}"

entrypoint.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-set -xo pipefail
+set -xuo pipefail
 trap "stop; exit 0;" SIGTERM SIGINT
 
 stop()
@@ -13,7 +13,7 @@ stop()
 	exit
 }
 
-DEFALUT_TIMEZONE="America/New_York"
+DEFALUT_TIMEZONE="America/New York"
 DEFAULT_PERMITTED="*"
 RW_MODE="rw"
 UID=${NFS_UID:-0}
@@ -39,23 +39,6 @@ if [ -n "${SHARED_DIRECTORY}" ]; then
 EOE
 
 	chmod 777 "${SHARED_DIRECTORY}"
-else
-	cp /etc/exports.mnt /etc/exports
-	grep -vi "^[[:space:]]*#" /etc/exports | while read -r line; do
-			if [ -n "${line}" ]; then
-				trimmed="${line##*([[:space:]])}"
-				# shellcheck disable=SC2001
-				rcdir="$(eval "declare -a str=($( echo "$trimmed" | sed 's/[][`~!@#$%^&*():;<>.,?|{}=+-]/\\&/g' )); echo \${str[0]}")"
-				cdir="${rcdir##*(\")}"
-				echo "${cdir}"
-				mkdir -p "/exports${cdir}"
-				mount --bind -o rw "${cdir}" "/exports${cdir}"
-				chmod 777 "/exports${cdir}"
-			fi
-	done
-	sed -i -r '/^[[:space:]]*#/!s/^("?)/\1\/exports/' /etc/exports
-	# root entry
-	echo -e "\n/exports *(rw,no_root_squash,insecure,no_subtree_check,nohide,fsid=0,sync,sec=krb5p:krb5i:krb5)" >> /etc/exports
 fi
 
 # setup logging
@@ -65,6 +48,9 @@ syslogd
 
 exportfs -rvaf
 
+echo "${NFS_KRB_REALM}" > /etc/hostname
+
+
 export OPTS_RPC_MOUNTD='--debug all -t 8 -N 3'
 cat >> /etc/conf.d/nfs <<EOC
 OPTS_RPC_MOUNTD="${OPTS_RPC_MOUNTD}"