#!/bin/sh
# Runs one authorized_keys command inside Gitea's rootless container.
# Managed by Ansible (gitea/roles/ssh). Do not edit by hand.
#
# This runs as {{ podman_user }} — the user whose rootless Podman owns the
# container, which is the entire reason the wrapper exists. The `{{ git_user }}`
# login user cannot enter another user's rootless container, and there is no
# sshd inside the container to hop through any more (see readme.md, "How git
# over SSH works now"), so the forced command sshd runs for a git client ends up
# here.
#
#   $1   SSH_ORIGINAL_COMMAND — the client's original request, passed through so
#        Gitea can serve it.
#   $@   the rest of the authorized_keys line, i.e.
#        /usr/local/bin/gitea --config=/data/gitea/conf/app.ini serv key-N —
#        the *container's* Gitea binary, not the host's shim at the same path.
#
# --user, HOME and GITEA_CUSTOM are what sshd used to supply: it ran the command
# as the container's git account, with HOME from /etc/passwd and GITEA_CUSTOM
# from /data/git/.ssh/environment. GITEA_CUSTOM and USER are image defaults and
# come through `podman exec` on their own; HOME does not, and git looks there for
# /data/git/.gitconfig, so it is set explicitly.
#
# XDG_RUNTIME_DIR is set explicitly because `sudo -u` creates no PAM session, so
# Podman would not otherwise find this user's runtime directory — the same reason
# caddy/readme.md shows the `sudo -u … systemctl --user` form with it.
original_command="$1"
shift
exec env XDG_RUNTIME_DIR="/run/user/$(id -u)" \
    podman exec --interactive \
        --user {{ gitea_uid }}:{{ gitea_gid }} \
        --env "HOME=/data/git" \
        --env "SSH_ORIGINAL_COMMAND=$original_command" \
        {{ container_name }} "$@"