public key and docker workflow

.github/workflows/docker.yaml

@@ -0,0 +1,78 @@
+name: Docker
+
+on:
+  push:
+    branches:
+      - develop
+  release:
+    types:
+      - published
+
+jobs:
+  build-and-push:
+    name: Build and Push
+    runs-on: ubuntu-20.04
+    # Always run against a tag, even if the commit into the tag has [docker skip] within the commit message.
+    if: "!contains(github.ref, 'develop') || (!contains(github.event.head_commit.message, 'skip docker') && !contains(github.event.head_commit.message, 'docker skip'))"
+    steps:
+      - name: Code checkout
+        uses: actions/checkout@v3
+
+      - name: Docker metadata
+        id: docker_meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ghcr.io/kubectyl/sftp-server
+          flavor: |
+            latest=false
+          tags: |
+            type=raw,value=latest,enable=${{ github.event_name == 'release' && github.event.action == 'published' && github.event.release.prerelease == false }}
+            type=ref,event=tag
+            type=ref,event=branch
+
+      - name: Setup QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Get Build Information
+        id: build_info
+        run: |
+          echo "version_tag=${GITHUB_REF/refs\/tags\/v/}" >> $GITHUB_OUTPUT
+          echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+
+      - name: Build and Push (tag)
+        uses: docker/build-push-action@v3
+        if: "github.event_name == 'release' && github.event.action == 'published'"
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          build-args: |
+            VERSION=${{ steps.build_info.outputs.version_tag }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+          tags: ${{ steps.docker_meta.outputs.tags }}
+
+      - name: Build and Push (develop)
+        uses: docker/build-push-action@v3
+        if: "github.event_name == 'push' && contains(github.ref, 'develop')"
+        with:
+          context: .
+          file: ./Dockerfile
+          push: ${{ github.event_name != 'pull_request' }}
+          platforms: linux/amd64,linux/arm64
+          build-args: |
+            VERSION=dev-${{ steps.build_info.outputs.short_sha }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

sftp/server.go

@@ -66,13 +66,29 @@ func (c *SFTPServer) Run() error {
 		return err
 	}
 
+	authorizedKeysMap := map[string]bool{}
+	if len(pb) > 0 {
+		authorizedKeysMap[string(private.PublicKey().Marshal())] = true
+	}
+
 	conf := &ssh.ServerConfig{
 		NoClientAuth: false,
 		MaxAuthTries: 6,
 		PasswordCallback: func(conn ssh.ConnMetadata, password []byte) (*ssh.Permissions, error) {
 			return c.makeCredentialsRequest(conn, remote.SftpAuthPassword, string(password))
 		},
 		PublicKeyCallback: func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
+			if authorizedKeysMap[string(key.Marshal())] {
+				return &ssh.Permissions{
+					Extensions: map[string]string{
+						"ip":          conn.RemoteAddr().String(),
+						"uuid":        os.Getenv("P_SERVER_UUID"),
+						"user":        "test",
+						"permissions": "*,admin.websocket.errors,admin.websocket.install,admin.websocket.transfer",
+					},
+				}, nil
+			}
+
 			return c.makeCredentialsRequest(conn, remote.SftpAuthPublicKey, string(ssh.MarshalAuthorizedKey(key)))
 		},
 	}