58 lines
2.9 KiB
YAML
58 lines
2.9 KiB
YAML
|
# ===========================================================================
|
||
|
|
# OSM taxiway bastion — broker mode, self-contained OSM export box
|
||
|
|
# ===========================================================================
|
||
|
|
# Deploy on the host that holds your osm-maps directory (region/planet PBF +
|
||
|
|
# export-icao-geojson.sh). A backend connects over SSH as `agent` and may run
|
||
|
|
# ONLY the three whitelisted taxiway commands (see allowed-commands.list); every
|
||
|
|
# request is validated and exec'd shell-free by bastion-broker.
|
||
|
|
#
|
||
|
|
# Backend side (its own .env / config):
|
||
|
|
# host = agent@<osm-host>
|
||
|
|
# port = 6770 (whatever you publish below)
|
||
|
|
# auth = a private key whose *.pub is dropped in docker-data/bastion/users.d/
|
||
|
|
#
|
||
|
|
# Setup:
|
||
|
|
# 1. Drop the backend's agent public key:
|
||
|
|
# mkdir -p docker-data/bastion/users.d
|
||
|
|
# cp /path/to/agent.pub docker-data/bastion/users.d/backend.pub
|
||
|
|
# 2. Make the osm-maps dir writable by the bastion's `agent` user (export writes
|
||
|
|
# <ICAO>-taxiways.geojson + work/ intermediates there):
|
||
|
|
# AGENT_UID=$(docker run --rm blaxsoftware/bastion:latest id -u agent)
|
||
|
|
# chown -R "$AGENT_UID" /srv/osm-maps
|
||
|
|
# 3. Ensure the osm-maps dir contains export-icao-geojson.sh + the region PBF.
|
||
|
|
# 4. docker compose up -d --build
|
||
|
|
# 5. Test from a host holding the agent key:
|
||
|
|
# ssh -p 6770 agent@<osm-host> taxiways-list
|
||
|
|
# ssh -p 6770 agent@<osm-host> taxiways-export EDDF # minutes
|
||
|
|
# ssh -p 6770 agent@<osm-host> taxiways-cat EDDF | base64 -d | head
|
||
|
|
# ssh -p 6770 agent@<osm-host> 'rm -rf /' # → refused (exit 126)
|
||
|
|
# ===========================================================================
|
||
|
|
|
||
|
|
services:
|
||
|
|
osm-taxiways-bastion:
|
||
|
|
build: .
|
||
|
|
image: blaxsoftware/bastion-osm-taxiways:latest
|
||
|
|
container_name: osm-taxiways-bastion
|
||
|
|
restart: unless-stopped
|
||
|
|
volumes:
|
||
|
|
# THE osm-maps dir — the only real host data reachable. Must contain the
|
||
|
|
# region PBF + export-icao-geojson.sh, and be writable by the agent user.
|
||
|
|
# Mount at exactly /osm-maps (the wrappers hardcode that path — sshd does
|
||
|
|
# not propagate container env into a ForceCommand session). Point the LEFT
|
||
|
|
# side at wherever your osm-maps dir actually lives.
|
||
|
|
- /srv/osm-maps:/osm-maps
|
||
|
|
|
||
|
|
# Broker allowlist — re-read every request (live edits, no restart).
|
||
|
|
- ./allowed-commands.list:/etc/bastion/allowed-commands.list:ro
|
||
|
|
|
||
|
|
# Authorized clients — one *.pub per identity (read live).
|
||
|
|
- ./docker-data/bastion/users.d:/etc/bastion/users.d
|
||
|
|
|
||
|
|
# Persist the SSH host identity across rebuilds (bind mount, never a named
|
||
|
|
# volume — `down -v` would change the host key and clients would refuse it).
|
||
|
|
- ./docker-data/bastion/keys:/etc/ssh/keys
|
||
|
|
ports:
|
||
|
|
# Bind to an internal interface / front with a VPN if you don't want the
|
||
|
|
# taxiway bastion on the public internet.
|
||
|
|
- "6770:22"
|