From a81b75ae01196039f8deb4bed88c838c678d84cf Mon Sep 17 00:00:00 2001
From: Ilya Semenov <semenov@inetss.com>
Date: Thu, 16 Jun 2016 18:29:16 +0600
Subject: [PATCH 1/9] readme: guide on reusing docker host SSH server

---
 README.md               |  1 +
 docs/docker_host_ssh.md | 83 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 84 insertions(+)
 create mode 100644 docs/docker_host_ssh.md

diff --git a/README.md b/README.md
index e009e8aa2..8354b0316 100644
--- a/README.md
+++ b/README.md
@@ -49,6 +49,7 @@
         - [Microsoft Azure](#microsoft-azure)
     - [External Issue Trackers](#external-issue-trackers)
     - [Host UID / GID Mapping](#host-uid--gid-mapping)
+    - [Reuse docker host SSH daemon](docs/docker_host_ssh.md)
     - [Piwik](#piwik)
     - [Available Configuration Parameters](#available-configuration-parameters)
 - [Maintenance](#maintenance)
diff --git a/docs/docker_host_ssh.md b/docs/docker_host_ssh.md
new file mode 100644
index 000000000..337b0faf4
--- /dev/null
+++ b/docs/docker_host_ssh.md
@@ -0,0 +1,83 @@
+Reuse docker host SSH daemon
+============================
+
+It is possible to use the SSH daemon that runs on the docker host instead of using a separate SSH port for Gitlab.
+
+## Setup
+
+Create the system `git` user if necessary (make sure it is added to `docker` group and has a working shell):
+
+```bash
+useradd --system git --home-dir /srv/docker/gitlab/data --groups docker
+```
+
+Note that the home directory must point to GitLab data directory, as it takes `.ssh/authorized_keys` from there.
+
+Now create `gitlab-shell` home directory at the same location as in the container:
+
+```bash
+mkdir -p /home/git/gitlab-shell/bin
+```
+
+Create the shell proxy script at `/home/git/gitlab-shell/bin/gitlab-shell`:
+
+```bash
+#!/bin/bash
+# Proxy SSH requests to docker container
+docker exec -i -u git gitlab sh -c "SSH_CONNECTION='$SSH_CONNECTION' SSH_ORIGINAL_COMMAND='$SSH_ORIGINAL_COMMAND' $0 $1"
+```
+
+Make it executable:
+
+```bash
+chmod +x /home/git/gitlab-shell/bin/gitlab-shell
+```
+
+## Run GitLab
+
+Start the container, mapping the `uid` and `gid` of host `git` user:
+
+```bash
+docker run --name gitlab -it --rm [options] \
+    --env "USERMAP_UID=$(id -u git)" --env "USERMAP_GID=$(id -g git)" \
+    sameersbn/gitlab:8.11.3
+```
+
+### (Optional) Use default UID/GID in the container
+
+if you rely on the default `uid` and `git`, for example if you link GitLab to [sameersbn/redmine](https://github.com/sameersbn/docker-redmine) container, you can run the container without UID/GID mapping and use [incron](http://inotify.aiken.cz/?section=incron&page=about&lang=en) to keep `.ssh/authorized_keys` accessible by host `git` user:
+
+```bash
+docker run --name gitlab -it --rm [options] \
+    sameersbn/gitlab:8.11.3
+```
+
+Install incron:
+
+```bash
+apt-get install -y incron
+echo root >> /etc/incron.allow
+```
+
+Open incrontab editor:
+
+```bash
+incrontab -e
+```
+
+and paste this:
+
+```
+/srv/gitlab/data/.ssh IN_ATTRIB,IN_ONLYDIR chmod 755 $@
+/srv/gitlab/data/.ssh/authorized_keys IN_ATTRIB chmod 644 $@
+```
+
+**PLEASE NOTE: keeping `.authorized_keys` world-readable brings a security risk. Use this method with discretion.**
+
+## Access GitLab
+
+Use Docker host to access repositories:
+
+```bash
+git clone git@docker.host:group/project.git
+```

From 73eda1986387a701da011843c629f9c0cdf2bccb Mon Sep 17 00:00:00 2001
From: Ilya Semenov <semenov@inetss.com>
Date: Wed, 31 Aug 2016 15:09:37 +0700
Subject: [PATCH 2/9] readme: don't leave world-readable authorized_keys in
 incron handler

---
 docs/docker_host_ssh.md | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/docs/docker_host_ssh.md b/docs/docker_host_ssh.md
index 337b0faf4..d3fd1a152 100644
--- a/docs/docker_host_ssh.md
+++ b/docs/docker_host_ssh.md
@@ -52,6 +52,19 @@ docker run --name gitlab -it --rm [options] \
     sameersbn/gitlab:8.11.3
 ```
 
+Create the script at `/srv/gitlab/data/fix_ssh_permissions.incron.sh`:
+
+```bash
+#!/bin/bash
+[ -e "$1" ] && chgrp git "$1" && chmod g+r$([ -d "$1" ] && echo x) "$1"
+```
+
+Make it executable:
+
+```bash
+chmod +x /srv/gitlab/data/fix_ssh_permissions.incron.sh
+```
+
 Install incron:
 
 ```bash
@@ -68,12 +81,9 @@ incrontab -e
 and paste this:
 
 ```
-/srv/gitlab/data/.ssh IN_ATTRIB,IN_ONLYDIR chmod 755 $@
-/srv/gitlab/data/.ssh/authorized_keys IN_ATTRIB chmod 644 $@
+/srv/gitlab/data/.ssh IN_ATTRIB /srv/gitlab/data/fix_ssh_permissions.incron.sh $@/$#
 ```
 
-**PLEASE NOTE: keeping `.authorized_keys` world-readable brings a security risk. Use this method with discretion.**
-
 ## Access GitLab
 
 Use Docker host to access repositories:

From 0f0e571cedad30f82311bb71d7b9c90fe1878b4b Mon Sep 17 00:00:00 2001
From: Ilya Semenov <semenov@inetss.com>
Date: Mon, 19 Sep 2016 16:26:47 +0700
Subject: [PATCH 3/9] readme: changed Gitlab to GitLab

---
 docs/docker_host_ssh.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/docker_host_ssh.md b/docs/docker_host_ssh.md
index d3fd1a152..57d375e5c 100644
--- a/docs/docker_host_ssh.md
+++ b/docs/docker_host_ssh.md
@@ -1,7 +1,7 @@
 Reuse docker host SSH daemon
 ============================
 
-It is possible to use the SSH daemon that runs on the docker host instead of using a separate SSH port for Gitlab.
+It is possible to use the SSH daemon that runs on the docker host instead of using a separate SSH port for GitLab.
 
 ## Setup
 

From 3b376436ed09e6e3ff829fec2f2299c13222cb63 Mon Sep 17 00:00:00 2001
From: Ilya Semenov <semenov@inetss.com>
Date: Wed, 12 Oct 2016 20:56:35 +0700
Subject: [PATCH 4/9] Fixed incron handler dead loop

---
 docs/docker_host_ssh.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/docs/docker_host_ssh.md b/docs/docker_host_ssh.md
index 57d375e5c..982d6f3fd 100644
--- a/docs/docker_host_ssh.md
+++ b/docs/docker_host_ssh.md
@@ -56,7 +56,9 @@ Create the script at `/srv/gitlab/data/fix_ssh_permissions.incron.sh`:
 
 ```bash
 #!/bin/bash
-[ -e "$1" ] && chgrp git "$1" && chmod g+r$([ -d "$1" ] && echo x) "$1"
+[ $(stat -c %G "$1") != "git" ] && chgrp git "$1"
+[ -f "$1" -a $(stat -c %a "$1") != 640 ] && chmod 640 "$1"
+[ -d "$1" -a $(stat -c %a "$1") != 710 ] && chmod 710 "$1"
 ```
 
 Make it executable:

From 00b8f7ee09281e1b5d6bf51ca68270e1b161e7a5 Mon Sep 17 00:00:00 2001
From: Ilya Semenov <semenov@inetss.com>
Date: Thu, 24 Nov 2016 21:15:25 +0700
Subject: [PATCH 5/9] Fixed GitLab data dir path, added commands to finish
 incrond setup

---
 docs/docker_host_ssh.md | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/docs/docker_host_ssh.md b/docs/docker_host_ssh.md
index 982d6f3fd..0f61d969f 100644
--- a/docs/docker_host_ssh.md
+++ b/docs/docker_host_ssh.md
@@ -52,7 +52,7 @@ docker run --name gitlab -it --rm [options] \
     sameersbn/gitlab:8.11.3
 ```
 
-Create the script at `/srv/gitlab/data/fix_ssh_permissions.incron.sh`:
+Create the script at `/srv/docker/gitlab/data/fix_ssh_permissions.incron.sh`:
 
 ```bash
 #!/bin/bash
@@ -64,7 +64,7 @@ Create the script at `/srv/gitlab/data/fix_ssh_permissions.incron.sh`:
 Make it executable:
 
 ```bash
-chmod +x /srv/gitlab/data/fix_ssh_permissions.incron.sh
+chmod +x /srv/docker/gitlab/data/fix_ssh_permissions.incron.sh
 ```
 
 Install incron:
@@ -83,7 +83,15 @@ incrontab -e
 and paste this:
 
 ```
-/srv/gitlab/data/.ssh IN_ATTRIB /srv/gitlab/data/fix_ssh_permissions.incron.sh $@/$#
+/srv/docker/gitlab/data/.ssh IN_ATTRIB /srv/docker/gitlab/data/fix_ssh_permissions.incron.sh $@/$#
+```
+
+Start incrond and touch `authorized_keys` to have the permissions fixed:
+
+```
+/etc/init.d/incrond start
+touch /srv/docker/gitlab/data/.ssh
+touch /srv/docker/gitlab/data/.ssh/authorized_keys
 ```
 
 ## Access GitLab

From ca545137e72c168bd4ea99702cf8d4a8e2e9775b Mon Sep 17 00:00:00 2001
From: Ilya Semenov <semenov@inetss.com>
Date: Thu, 24 Nov 2016 21:20:53 +0700
Subject: [PATCH 6/9] Added command to disable OpenSSH StrictModes

---
 docs/docker_host_ssh.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/docs/docker_host_ssh.md b/docs/docker_host_ssh.md
index 0f61d969f..1d3d56957 100644
--- a/docs/docker_host_ssh.md
+++ b/docs/docker_host_ssh.md
@@ -94,6 +94,13 @@ touch /srv/docker/gitlab/data/.ssh
 touch /srv/docker/gitlab/data/.ssh/authorized_keys
 ```
 
+Ensure that OpenSSH is running without `StrictModes`:
+
+```
+sed -i 's/StrictModes yes/StrictModes no/' /etc/ssh/sshd_config
+/etc/init.d/ssh reload
+```
+
 ## Access GitLab
 
 Use Docker host to access repositories:

From f1e3ef9077bc555ebd03e6643099d25a31589382 Mon Sep 17 00:00:00 2001
From: Ilya Semenov <semenov@inetss.com>
Date: Fri, 11 Aug 2017 12:01:09 +0700
Subject: [PATCH 7/9] Fix security issue in Docker host SSH proxy deployment

---
 docs/docker_host_ssh.md | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/docs/docker_host_ssh.md b/docs/docker_host_ssh.md
index 1d3d56957..52be2089a 100644
--- a/docs/docker_host_ssh.md
+++ b/docs/docker_host_ssh.md
@@ -5,13 +5,13 @@ It is possible to use the SSH daemon that runs on the docker host instead of usi
 
 ## Setup
 
-Create the system `git` user if necessary (make sure it is added to `docker` group and has a working shell):
+Create the system `git` user if necessary (make sure it has a working shell):
 
 ```bash
-useradd --system git --home-dir /srv/docker/gitlab/data --groups docker
+useradd --system git --home-dir /srv/docker/gitlab/data
 ```
 
-Note that the home directory must point to GitLab data directory, as it takes `.ssh/authorized_keys` from there.
+The home directory must point to GitLab data directory, as it takes `.ssh/authorized_keys` from there.
 
 Now create `gitlab-shell` home directory at the same location as in the container:
 
@@ -24,7 +24,7 @@ Create the shell proxy script at `/home/git/gitlab-shell/bin/gitlab-shell`:
 ```bash
 #!/bin/bash
 # Proxy SSH requests to docker container
-docker exec -i -u git gitlab sh -c "SSH_CONNECTION='$SSH_CONNECTION' SSH_ORIGINAL_COMMAND='$SSH_ORIGINAL_COMMAND' $0 $1"
+sudo docker exec -i -u git gitlab sh -c "SSH_CONNECTION='$SSH_CONNECTION' SSH_ORIGINAL_COMMAND='$SSH_ORIGINAL_COMMAND' $0 $1"
 ```
 
 Make it executable:
@@ -33,6 +33,12 @@ Make it executable:
 chmod +x /home/git/gitlab-shell/bin/gitlab-shell
 ```
 
+Allow `git` user limited sudo access to execute a command inside GitLab docker container:
+
+```bash
+echo "git ALL=NOPASSWD: /usr/bin/docker exec -i -u git gitlab *" > /etc/sudoers.d/docker-gitlab
+```
+
 ## Run GitLab
 
 Start the container, mapping the `uid` and `gid` of host `git` user:

From b5fc64a3ddff757f8dfcc13c621d9419cab1e26c Mon Sep 17 00:00:00 2001
From: Ilya Semenov <semenov@inetss.com>
Date: Fri, 11 Aug 2017 12:06:47 +0700
Subject: [PATCH 8/9] Restructure Docker host SSH proxy document

---
 docs/docker_host_ssh.md | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/docs/docker_host_ssh.md b/docs/docker_host_ssh.md
index 52be2089a..6d154e459 100644
--- a/docs/docker_host_ssh.md
+++ b/docs/docker_host_ssh.md
@@ -49,7 +49,15 @@ docker run --name gitlab -it --rm [options] \
     sameersbn/gitlab:8.11.3
 ```
 
-### (Optional) Use default UID/GID in the container
+## Access GitLab
+
+Use Docker host SSH server to access repositories:
+
+```bash
+git clone git@docker.host:group/project.git
+```
+
+## Advanced: Use default UID/GID in the container
 
 if you rely on the default `uid` and `git`, for example if you link GitLab to [sameersbn/redmine](https://github.com/sameersbn/docker-redmine) container, you can run the container without UID/GID mapping and use [incron](http://inotify.aiken.cz/?section=incron&page=about&lang=en) to keep `.ssh/authorized_keys` accessible by host `git` user:
 
@@ -58,7 +66,7 @@ docker run --name gitlab -it --rm [options] \
     sameersbn/gitlab:8.11.3
 ```
 
-Create the script at `/srv/docker/gitlab/data/fix_ssh_permissions.incron.sh`:
+Create the script at `/srv/docker/gitlab/fix_ssh_permissions.incron.sh`:
 
 ```bash
 #!/bin/bash
@@ -70,7 +78,7 @@ Create the script at `/srv/docker/gitlab/data/fix_ssh_permissions.incron.sh`:
 Make it executable:
 
 ```bash
-chmod +x /srv/docker/gitlab/data/fix_ssh_permissions.incron.sh
+chmod +x /srv/docker/gitlab/fix_ssh_permissions.incron.sh
 ```
 
 Install incron:
@@ -89,7 +97,7 @@ incrontab -e
 and paste this:
 
 ```
-/srv/docker/gitlab/data/.ssh IN_ATTRIB /srv/docker/gitlab/data/fix_ssh_permissions.incron.sh $@/$#
+/srv/docker/gitlab/data/.ssh IN_ATTRIB /srv/docker/gitlab/fix_ssh_permissions.incron.sh $@/$#
 ```
 
 Start incrond and touch `authorized_keys` to have the permissions fixed:
@@ -106,11 +114,3 @@ Ensure that OpenSSH is running without `StrictModes`:
 sed -i 's/StrictModes yes/StrictModes no/' /etc/ssh/sshd_config
 /etc/init.d/ssh reload
 ```
-
-## Access GitLab
-
-Use Docker host to access repositories:
-
-```bash
-git clone git@docker.host:group/project.git
-```

From fb42c3a7dcfdccfa9b924062eb3af83174d1825a Mon Sep 17 00:00:00 2001
From: Ilya Semenov <semenov@inetss.com>
Date: Thu, 17 Aug 2017 08:35:48 +0700
Subject: [PATCH 9/9] Fix typos

---
 docs/docker_host_ssh.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/docker_host_ssh.md b/docs/docker_host_ssh.md
index 6d154e459..5a92aad58 100644
--- a/docs/docker_host_ssh.md
+++ b/docs/docker_host_ssh.md
@@ -59,7 +59,7 @@ git clone git@docker.host:group/project.git
 
 ## Advanced: Use default UID/GID in the container
 
-if you rely on the default `uid` and `git`, for example if you link GitLab to [sameersbn/redmine](https://github.com/sameersbn/docker-redmine) container, you can run the container without UID/GID mapping and use [incron](http://inotify.aiken.cz/?section=incron&page=about&lang=en) to keep `.ssh/authorized_keys` accessible by host `git` user:
+If you rely on the default `uid` and `gid`, for example if you link GitLab to [sameersbn/redmine](https://github.com/sameersbn/docker-redmine) container, you can run the container without UID/GID mapping and use [incron](http://inotify.aiken.cz/?section=incron&page=about&lang=en) to keep `.ssh/authorized_keys` accessible by host `git` user:
 
 ```bash
 docker run --name gitlab -it --rm [options] \