cloudron-box/src/sftp.js

'use strict';

exports = module.exports = {
    start,
    rebuild,

    DEFAULT_MEMORY_LIMIT: 256 * 1024 * 1024
};

const apps = require('./apps.js'),
    assert = require('assert'),
    BoxError = require('./boxerror.js'),
    debug = require('debug')('box:sftp'),
    hat = require('./hat.js'),
    infra = require('./infra_version.js'),
    path = require('path'),
    paths = require('./paths.js'),
    safe = require('safetydance'),
    shell = require('./shell.js'),
    system = require('./system.js'),
    volumes = require('./volumes.js');

async function rebuild(serviceConfig, options) {
    assert.strictEqual(typeof serviceConfig, 'object');
    assert.strictEqual(typeof options, 'object');

    debug('rebuilding container');

    const tag = infra.images.sftp.tag;
    const memoryLimit = serviceConfig.memoryLimit || exports.DEFAULT_MEMORY_LIMIT;
    const memory = system.getMemoryAllocation(memoryLimit);
    const cloudronToken = hat(8 * 128);

    const resolvedAppDataDir = safe.fs.realpathSync(paths.APPS_DATA_DIR);
    if (!resolvedAppDataDir) throw new BoxError(BoxError.FS_ERROR, `Could not resolve apps data dir: ${safe.error.message}`);

    const dataDirs = [{ hostDir: resolvedAppDataDir, mountDir: '/mnt/appsdata' }];

    // custom app data directories
    const allApps = await apps.list();
    for (const app of allApps) {
        if (!app.manifest.addons['localstorage'] || !app.dataDir) continue;

        const hostDir = apps.getDataDir(app, app.dataDir), mountDir = `/mnt/${app.id}`;
        if (!safe.fs.existsSync(hostDir)) { // this can fail if external mount does not have permissions for yellowtent user
            // do not create host path when cloudron is restoring. this will then create dir with root perms making restore logic fail
            debug(`Ignoring app data dir ${hostDir} for ${app.id} since it does not exist`);
            continue;
        }

        dataDirs.push({ hostDir, mountDir });
    }

    // volume directories
    dataDirs.push({ hostDir: '/mnt/volumes', mountDir: '/mnt/volumes' });
    const allVolumes = await volumes.list();
    for (const volume of allVolumes) {
        if (volume.hostPath.startsWith('/mnt/volumes/')) continue;

        if (!safe.fs.existsSync(volume.hostPath)) {
            debug(`Ignoring volume host path ${volume.hostPath} since it does not exist`);
            continue;
        }

        dataDirs.push({ hostDir: volume.hostPath, mountDir: `/mnt/${volume.id}` });
    }

    // mail data dir
    const resolvedMailDataDir = safe.fs.realpathSync(paths.MAIL_DATA_DIR);
    if (!resolvedMailDataDir) throw new BoxError(BoxError.FS_ERROR, `Could not resolve mail data dir: ${safe.error.message}`);
    dataDirs.push({ hostDir: resolvedMailDataDir, mountDir: '/mnt/maildata' });

    const mounts = dataDirs.map(v => `-v "${v.hostDir}:${v.mountDir}"`).join(' ');
    const cmd = `docker run --restart=always -d --name="sftp" \
                --hostname sftp \
                --net cloudron \
                --net-alias sftp \
                --log-driver syslog \
                --log-opt syslog-address=udp://127.0.0.1:2514 \
                --log-opt syslog-format=rfc5424 \
                --log-opt tag=sftp \
                -m ${memory} \
                --memory-swap ${memoryLimit} \
                --dns 172.18.0.1 \
                --dns-search=. \
                -p 222:22 \
                ${mounts} \
                -e CLOUDRON_SFTP_TOKEN="${cloudronToken}" \
                -v "${paths.SFTP_KEYS_DIR}:/etc/ssh:ro" \
                --label isCloudronManaged=true \
                --read-only -v /tmp -v /run "${tag}"`;

    // ignore error if container not found (and fail later) so that this code works across restarts
    await shell.promises.exec('stopSftp', 'docker stop sftp || true');
    await shell.promises.exec('removeSftp', 'docker rm -f sftp || true');
    await shell.promises.exec('startSftp', cmd);
}

async function start(existingInfra, serviceConfig) {
    assert.strictEqual(typeof existingInfra, 'object');
    assert.strictEqual(typeof serviceConfig, 'object');

    await rebuild(serviceConfig, { force: true }); // force rebuild when infra changed
}