Fix git-server: security, volume path, startup robustness

- Remove hardcoded password for git user (chpasswd line)
- Fix comment: ubuntu -> debian
- Fix volume path: /var/git -> /var/git/repos to match host layout
- Remove deprecated compose version field
- start.sh: check for .pub files directly instead of any file in keys/
- start.sh: always set repos ownership/permissions, not only when
  directory is non-empty (fixes fresh start with empty repos dir)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

3 files changed, 12 insertions, 15 deletions

diff --git a/git-server/Dockerfile b/git-server/Dockerfile
index b8a905f..4f14a5a 100644
--- a/git-server/Dockerfile
+++ b/git-server/Dockerfile
@@ -1,4 +1,4 @@
-#Use basic ubuntu to git server and git daemon
+#Use basic debian for git server and git daemon
 FROM debian:latest
 
 RUN apt-get -y update && apt-get -y install openssh-server git
@@ -12,7 +12,6 @@ WORKDIR /git-server/
 # -s flag changes user's shell
 RUN mkdir /git-server/keys \
   && adduser --disabled-password --shell /usr/bin/git-shell git \
-  && echo git:12345 | chpasswd \
   && mkdir /home/git/.ssh
 
 
diff --git a/git-server/server.yaml b/git-server/server.yaml
index af6b381..2e32183 100644
--- a/git-server/server.yaml
+++ b/git-server/server.yaml
@@ -1,4 +1,4 @@
-version: '2'
+---
 
 services:
 
@@ -11,7 +11,7 @@ services:
       - "9418:9418"
     volumes:
     - /var/git_ssh_keys:/git-server/keys
-    - /var/git:/repos
+    - /var/git/repos:/repos
     networks:
       git-network:
         ipv4_address: 172.22.0.2
diff --git a/git-server/start.sh b/git-server/start.sh
index dcfb471..5fbbd58 100644
--- a/git-server/start.sh
+++ b/git-server/start.sh
@@ -1,8 +1,8 @@
 #!/bin/sh
 
-# If there is some public key in keys folder
-# then it copies its contain in authorized_keys file
-if [ "$(ls -A /git-server/keys/)" ]; then
+# If there are .pub key files in keys folder
+# then copy their contents into authorized_keys
+if ls /git-server/keys/*.pub 1>/dev/null 2>&1; then
   cd /home/git
   cat /git-server/keys/*.pub > .ssh/authorized_keys
   chown -R git:git .ssh
@@ -10,14 +10,12 @@ if [ "$(ls -A /git-server/keys/)" ]; then
   chmod -R 600 .ssh/*
 fi
 
-# Checking permissions and fixing SGID bit in repos folder
-# More info: https://github.com/jkarlosb/git-server-docker/issues/1
-if [ "$(ls -A /repos/)" ]; then
-  cd /repos
-  chown -R git:git .
-  chmod -R ug+rwX .
-  find . -type d -exec chmod g+s '{}' +
-fi
+# Always set correct ownership and permissions on repos folder
+# so that git user can read/write repos (including freshly created ones)
+cd /repos
+chown -R git:git .
+chmod -R ug+rwX .
+find . -type d -exec chmod g+s '{}' +
 
 # Run git daemon
 #systemctl enable --now git.service