From 7ebfca90ddfb4f42c44487bc1fa4e7492fc5b39a Mon Sep 17 00:00:00 2001 From: Martyn Date: Sat, 8 Aug 2026 17:19:25 +0200 Subject: [PATCH] temp hold for sshfs2smb --- app-of-apps/sshfs2smb.yaml | 17 ++ apps-kustomized/sshfs2smb/all.yaml | 223 ++++++++++++++++++++++++++ apps-kustomized/sshfs2smb/keyfile.pub | 1 + 3 files changed, 241 insertions(+) create mode 100644 app-of-apps/sshfs2smb.yaml create mode 100644 apps-kustomized/sshfs2smb/all.yaml create mode 100644 apps-kustomized/sshfs2smb/keyfile.pub diff --git a/app-of-apps/sshfs2smb.yaml b/app-of-apps/sshfs2smb.yaml new file mode 100644 index 0000000..188fecd --- /dev/null +++ b/app-of-apps/sshfs2smb.yaml @@ -0,0 +1,17 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: sshfs2smb + namespace: argocd +spec: + destination: + namespace: sshfs2smb + server: https://kubernetes.default.svc + project: apps + source: + path: apps-kustomized/sshfs2smb + repoURL: http://forgejo.git.svc.cluster.local/martyn/infra4talos + targetRevision: HEAD + syncPolicy: + automated: + selfHeal: true diff --git a/apps-kustomized/sshfs2smb/all.yaml b/apps-kustomized/sshfs2smb/all.yaml new file mode 100644 index 0000000..b67c0db --- /dev/null +++ b/apps-kustomized/sshfs2smb/all.yaml @@ -0,0 +1,223 @@ +--- +# Source: samba4/templates/secret.yaml +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: sshfs2smb-samba4-users + labels: + app.kubernetes.io/name: samba4 + helm.sh/chart: samba4-0.1.2 + app.kubernetes.io/instance: sshfs2smb + app.kubernetes.io/managed-by: Helm +data: + create-users: Cm1hcnR5bjo1NjQ2MjgK +--- +# Source: samba4/templates/configmap-smbconf.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: sshfs2smb-samba4-smbconf + labels: + app.kubernetes.io/name: samba4 + helm.sh/chart: samba4-0.1.2 + app.kubernetes.io/instance: sshfs2smb + app.kubernetes.io/managed-by: Helm +data: + smb.conf: |- + [global] + workgroup = WORKGROUP + client min protocol = NT1 + server string = %h server (Samba, Alpine) + security = user + map to guest = Bad User + username map script = /bin/echo + encrypt passwords = yes + load printers = no + printing = bsd + printcap name = /dev/null + disable spoolss = yes + disable netbios = yes + server role = standalone + server services = -dns, -nbt + smb ports = 445 + log level = 3 + + [data] + path = /data + comment = ZFS + browseable = yes + writable = yes + + + + + ;EOF way past actual end of file +--- +# Source: samba4/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: sshfs2smb-samba4 + labels: + app.kubernetes.io/name: samba4 + helm.sh/chart: samba4-0.1.2 + app.kubernetes.io/instance: sshfs2smb + app.kubernetes.io/managed-by: Helm +spec: + type: LoadBalancer + ports: + - port: 445 + targetPort: cifs + protocol: TCP + name: cifs + selector: + app.kubernetes.io/name: samba4 + app.kubernetes.io/instance: sshfs2smb +--- +# Source: samba4/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: sshfs2smb-samba4 + labels: + app.kubernetes.io/name: samba4 + helm.sh/chart: samba4-0.1.2 + app.kubernetes.io/instance: sshfs2smb + app.kubernetes.io/managed-by: Helm + annotations: + checksum/smbconf: 06dca33a92ca86d1fdbe7571c545dda4394b79761c17728fdfece3db66f24ef3 + checksum/users: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: samba4 + app.kubernetes.io/instance: sshfs2smb + template: + metadata: + labels: + app.kubernetes.io/name: samba4 + app.kubernetes.io/instance: sshfs2smb + annotations: + checksum/smbconf: 06dca33a92ca86d1fdbe7571c545dda4394b79761c17728fdfece3db66f24ef3 + checksum/users: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 + spec: + securityContext: + fsGroup: 1000 + fsGroupChangePolicy: OnRootMismatch + containers: + - name: samba4 + image: "alpine" + command: + - /bin/sh + - -c + - "apk add samba sshfs; mkdir /data; mkdir ~/.ssh; cp /keyfile/keyfile ~/.ssh; ssh-keyscan 75.102.10.189 >~/.ssh/known_hosts ; chmod 600 ~/.ssh/keyfile; sed -i s/'^#user_allow_other'/'user_allow_other'/ /etc/fuse.conf ; sshfs debian-transmission@75.102.10.189:/var/lib/transmission-daemon/downloads /data -o IdentityFile=~/.ssh/keyfile,uid=1000,gid=1000,allow_other && cd /scripts && sh ./k8s.sh" + imagePullPolicy: IfNotPresent + ports: + - name: cifs + containerPort: 445 + protocol: TCP + livenessProbe: + exec: + command: + - /bin/sh + - -c + - "echo | smbclient -L 127.0.0.1" + readinessProbe: + tcpSocket: + port: cifs + resources: + {} + volumeMounts: + - mountPath: /secrets + name: users + - mountPath: /etc/samba/smb.conf + name: smbconf + subPath: smb.conf + - mountPath: /privatepersist + name: private + - mountPath: /dev/fuse + name: fusedev + - mountPath: /keyfile + name: keyfile + - mountPath: /scripts + name: scripts + securityContext: + privileged: true + capabilities: + add: + - SYS_ADMIN + volumes: + - name: smbconf + configMap: + name: sshfs2smb-samba4-smbconf + defaultMode: 0644 + items: + - key: smb.conf + path: smb.conf + - name: users + secret: + secretName: sshfs2smb-samba4-users + defaultMode: 0600 + + - name: private + + emptyDir: {} + - name: fusedev + hostPath: + path: /dev/fuse + - name: keyfile + secret: + secretName: keyfile + defaultMode: 0600 + - name: scripts + configMap: + name: sshfs2smb-samba4-packagescripts + defaultMode: 0555 + items: + - key: k8s.sh + path: k8s.sh +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: sshfs2smb-samba4-packagescripts + labels: + app.kubernetes.io/name: samba4 + helm.sh/chart: samba4-0.1.2 + app.kubernetes.io/instance: sshfs2smb + app.kubernetes.io/managed-by: Helm +data: + k8s.sh: |- + #!/bin/sh + #passwd files need to be stored on the persistent storage + if [ ! -f /privatepersist/etc/passwd ]; then + mkdir -p /privatepersist/etc + cp /etc/passwd /privatepersist/etc/passwd + fi + rm -f /etc/passwd + ln -s /privatepersist/etc/passwd /etc/passwd + #tdb files need to be stored on the persistent storage + if [ ! -f /privatepersist/varlibsamba/private/passdb.tdb ]; then + mkdir /privatepersist/varlibsamba + tar c -C /var/lib/samba . | tar x -C /privatepersist/varlibsamba + fi + rm -rf /var/lib/samba + ln -s /privatepersist/varlibsamba /var/lib/samba + #create required users + if ! md5sum -c /privatepersist/k8s-users-checksum > /dev/null 2>&1; then + rm /var/lib/samba/private/passdb.tdb + if [ -s /secrets/create-users ]; then + for line in $(cat /secrets/create-users); do + USER=$(echo $line | cut -f1 -d:) + PASS=$(echo $line | cut -f2 -d:) + adduser -s /sbin/nologin -h /home/samba -H -D $USER + yes "$PASS" | smbpasswd -a $USER + done + fi + md5sum /secrets/create-users > /privatepersist/k8s-users-checksum + fi + # bug where smbd stops on "end of input" + ionice -c 3 smbd --foreground < /dev/null + diff --git a/apps-kustomized/sshfs2smb/keyfile.pub b/apps-kustomized/sshfs2smb/keyfile.pub new file mode 100644 index 0000000..910ba0c --- /dev/null +++ b/apps-kustomized/sshfs2smb/keyfile.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE3FTfqC9qRhMPO16UBg1O2hhYCO+ixy+iqiE969DD39 martyn@i9top