#Use basic debian for git server and git daemon
FROM debian:latest

RUN apt-get -y update && apt-get -y install openssh-server git

# Key generation on the server
RUN ssh-keygen -A

WORKDIR /git-server/

# -D flag avoids password generation
# -s flag changes user's shell
RUN mkdir /git-server/keys \
  && adduser --disabled-password --shell /usr/bin/git-shell git \
  # Set password to '*' to unlock the account for SSH key auth.
  # adduser --disabled-password sets '!' which OpenSSH 10.0 treats as locked,
  # rejecting even valid pubkey logins. '*' means "no password login possible"
  # but the account is not locked.
  && usermod -p '*' git \
  # git-shell must be in /etc/shells or OpenSSH rejects login
  && echo /usr/bin/git-shell >> /etc/shells \
  && mkdir /home/git/.ssh


# This is a login shell for SSH accounts to provide restricted Git access.
# It permits execution only of server-side Git commands implementing the
# pull/push functionality, plus custom commands present in a subdirectory
# named git-shell-commands in the user’s home directory.
# More info: https://git-scm.com/docs/git-shell
COPY git-shell-commands /home/git/git-shell-commands


# sshd_config file is edited for enable access key and disable access password
COPY sshd_config /etc/ssh/sshd_config
COPY start.sh start.sh
#COPY git.service /etc/systemd/git.service

EXPOSE 22
EXPOSE 9418

CMD ["sh", "start.sh"]