#!/bin/sh
# Gitea's git-over-SSH passthrough shim — {{ shim_path }}
# Managed by Ansible (gitea/roles/ssh). Do not edit by hand.
#
# The host's sshd runs this, as the `{{ git_user }}` login user, whenever a
# client presents a key whose authorized_keys line is a forced command. Gitea
# writes those lines itself, from inside its container, and each one looks like
# this:
#
#   command="/usr/local/bin/gitea --config=/data/gitea/conf/app.ini serv key-5",...
#
# So $@ here is `--config=/data/gitea/conf/app.ini serv key-5`, and $0 is the
# path of Gitea's own binary *inside the container*, which the wrapper resolves
# in there. The path is a contract, not a knob: it is already baked into every
# line of the authorized_keys file copied from monoco.
#
# `{{ git_user }}` cannot reach rootless containers that belong to
# {{ podman_user }}, so the command is handed to {{ podman_exec_wrapper }}, which
# sudo runs as {{ podman_user }}. SSH_ORIGINAL_COMMAND — the client's own
# git-upload-pack / git-receive-pack request — crosses as an argument, because
# sudo strips the environment.
#
# `sudo -n` on purpose: there is no TTY on this path, so a password prompt would
# hang a git push instead of failing it.
exec sudo -n -u {{ podman_user }} {{ podman_exec_wrapper }} "$SSH_ORIGINAL_COMMAND" "$@"