create-docker-volume-devices

#!/bin/sh -eu

# create-docker-volume-devices: create Docker volume devices
# Copyright (C) 2021  "Michael G. Morey" <mgmorey@gmail.com>

# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.

# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <https://www.gnu.org/licenses/>.

: ${VOLUME_GID=500}
: ${VOLUME_UID=500}

VOLUME_COMMENT='Docker Volume Account'
VOLUME_FILE=docker-volumes.txt
VOLUME_GROUP=docker-volume
VOLUME_HOME=/local/volumes
VOLUME_SHELL=/sbin/nologin
VOLUME_USER=docker-volume

BSD_AWK_VERSION=20190529
GNU_AWK_VERSION=4.0.0

BSD_AWK_RE='awk version \([1-9][0-9]*\)'
GNU_AWK_RE='GNU Awk \([1-9][0-9]*\(\.[0-9][0-9]*\)*\)'

PATH_ELEMENT_RE='[A-Za-z][0-9A-Z_a-z-]+'
PATH_NAME_ABS_RE="(\\/${PATH_ELEMENT_RE})+"
PATH_NAME_REL_RE="\\.{,2}${PATH_NAME_ABS_RE}"

VOLUME_MODE_RE='(ro|rw)?'
VOLUME_NAME_RE='[a-z][0-9_a-z-]*'
VOLUME_RE="(${PATH_NAME_REL_RE})?:${PATH_NAME_ABS_RE}\
(:${VOLUME_MODE_RE}(:${VOLUME_NAME_RE})?)?"

abort() {
    printf "$@" >&2
    exit 1
}

assert() {
    "$@" || abort '%s: Assertion failed: %s\n' "$script" "$*"
}

compare_string_versions() {
    assert [ $# -eq 3 ]
    assert [ -n "$1" ]
    assert [ -n "$2" ]
    assert [ -n "$3" ]
    compare_versions "$(expr "$1" : "$2")" "$3" "$(get_field_count "$3" '.')"
}

compare_versions() (
    assert [ $# -eq 3 ]
    m=$(printf '%s\n' ${1:-0} | cut -d. -f 1)
    n=$(printf '%s\n' ${2:-0} | cut -d. -f 1)
    delta=$((m - n))
    nfields=${3:-1}

    if [ $nfields -le 1 -o $delta -ne 0 ]; then
	printf '%s\n' $delta
	return 0
    fi

    compare_versions "${1#*.}" "${2#*.}" $((nfields - 1))
)

configure_platform() {
    case "${uname_kernel=$(uname -s)}" in
	(FreeBSD)
	    pw_command=pw
	    pw_mask='*'
	    ;;
	(*)
	    pw_command=
	    pw_mask='x'
	    ;;
    esac
}

create_docker_volume_devices() {
    validate_platform
    configure_platform
    real_user=$(get_real_user)
    volume_file=$(find_file $VOLUME_FILE)

    if [ -d "$volume_home" ]; then
	skip_volumes=true
    fi

    if [ "$skip_volumes" = false ]; then
	if [ ! -f $volume_file ]; then
	    abort '%s: %s: No such volume file\n' "$script" "$volume_file"
	fi

	umask 0022
	create_home_directory

	get_volumes | while IFS=':' read device mount mode name; do
	    create_volume_device "$device"
	done
    fi

    create_volume_group
    create_volume_user

    if [ "$skip_volumes" = false ]; then
	modify_permissions
    fi

    modify_user
}

create_home_directory() {
    mkdir -p "$volume_home"

    if [ ! -d "$volume_home" ]; then
	abort '%s: %s: No such directory\n' "$script" "$volume_home"
    elif [ ! -w "$volume_home" ]; then
	abort '%s: %s: No write permissions\n' "$script" "$volume_home"
    elif [ ! -x "$volume_home" ]; then
	abort '%s: %s: No execute permissions\n' "$script" "$volume_home"
    fi

    if [ -n "$template_dir" -a -d "$template_dir" ]; then
	/bin/cp -R $template_dir/* "$volume_home"
    fi
}

create_volume_device() {
    assert [ $# -eq 1 ]

    if [ -n "$1" ] && expr "$1" : "$volume_home"'/' >/dev/null; then
	mkdir -p $1
    fi
}

create_volume_group() {
    entry=$(get_volume_group_entry $volume_group || true)

    if [ -z "$entry" ]; then
	manage_pw groupadd $(print_volume_groupadd_args "$volume_user")
    elif [ "$entry" != "$(print_volume_group)" ]; then
	manage_pw groupmod $(print_volume_groupmod_args "$volume_user")
    fi
}

create_volume_user() {
    entry=$(get_volume_passwd_entry $volume_user || true)

    if [ -z "$entry" ]; then
	manage_pw useradd $(print_volume_useradd_args "$volume_user")
    elif [ "$entry" != "$(print_volume_passwd)" ]; then
	manage_pw usermod $(print_volume_usermod_args "$volume_user")
    fi
}

find_file() {
    for dir in . .. "$HOME"; do
	file="$dir/$1"

	if [ -f "$file" ]; then
	    printf '%s\n' "$file"
	    return 0
	fi
    done

    printf '%s\n' "$1"
}

get_field_count() {
    printf '%s\n' "${1-}" | awk ${2:+-F$2 }'{print NF}'
}

get_length() {
    printf '%s\n' "${1-}" | wc -c
}

get_real_user() {
    if [ "$(id -u)" -eq 0 -a -n "${SUDO_USER-}" ]; then
	printf '%s\n' "$SUDO_USER"
    elif [ -n "${USER-}" ]; then
	printf '%s\n' "$USER"
    fi
}

get_version_string() {
    assert [ $# -eq 1 ]
    assert [ -n "$1" ]
    "$1" --version 2>/dev/null | head -n 1
}

get_volume_group() {
    if [ -n "${1-}" ]; then
	getent group $1 | cut -d: -f 1
    fi
}

get_volume_group_entry() {
    if [ -n "${1-}" ]; then
	getent group $1 | cut -d: -f 1-3
    fi
}

get_volume_passwd_entry() {
    if [ -n "${1-}" ]; then
	getent passwd $1
    fi
}

get_volumes() {
    if [ -n "$volume_home" ]; then
	sed 's|^~/|'"$volume_home"'/|' $volume_file
    else
	cat $volume_file
    fi | awk -F: -v OFS=':' '/^'"$VOLUME_RE"'$/ {print $1, $2, $3, $4}'
}

is_valid_name() {
    expr "${1-}" : '[a-z][0-9_a-z-]*$' >/dev/null
}

manage_pw() {
    eval ${pw_command:+$pw_command }"$@"
}

modify_permissions() {
    chown -R $VOLUME_UID:$VOLUME_GID "$volume_home"
    find "$volume_home" -type d | xargs chmod a+rx
}

modify_user() {
    args=$(print_usermod_args "$volume_group" "$real_user")

    if [ -n "$args" ]; then
	manage_pw usermod $args
    fi
}

parse_arguments() {
    skip_volumes=false
    template_dir=
    volume_comment=$VOLUME_COMMENT
    volume_group=$VOLUME_GROUP
    volume_home=$VOLUME_HOME
    volume_user=$VOLUME_USER

    while getopts c:d:g:n:st:h opt; do
	case $opt in
	    (c)
		volume_comment=$OPTARG
		;;
	    (d)
		volume_home=$OPTARG
		;;
	    (g)
		parse_volume_group "$OPTARG"
		;;
	    (n)
		parse_volume_user "$OPTARG"
		;;
	    (s)
		skip_volumes=true
		;;
	    (t)
		parse_template_dir "$OPTARG"
		;;
	    (h)
		usage
		exit 0
		;;
	    (\?)
		exit 2
		;;
	esac
    done

    shift $(($OPTIND - 1))

    if [ $# -gt 0 ]; then
	usage_error '%s: Too many arguments\n' "$script"
    fi
}

parse_template_dir() {
    if [ -d "$1" ]; then
	template_dir=$1
    else
	usage_error '%s: %s: No such directory\n' "$script" "$1"
    fi
}

parse_volume_group() {
    if is_valid_name "$1" && [ "$(get_length "$1")" -le 16 ]; then
	volume_group=$1
    else
	usage_error '%s: %s: Invalid group name\n' "$script" "$1"
    fi
}

parse_volume_user() {
    if is_valid_name "$1" && [ "$(get_length "$1")" -le 16 ]; then
	volume_user=$1
    else
	usage_error '%s: %s: Invalid user name\n' "$script" "$1"
    fi
}

print_usermod_args() {
    assert [ $# -eq 2 ]
    assert [ -n "$1" ]
    assert [ -n "$2" ]

    case "${uname_kernel=$(uname -s)}" in
	(FreeBSD)
	    true
	    ;;
	(*)
	    printf '%s\n' \
		   -aG "$1" \
		   "$2"
	    ;;
    esac
}

print_volume_group() {
    printf '%s:%s:%s\n' \
	   "$volume_group" \
	   "$pw_mask" \
	   "$VOLUME_GID"
}

print_volume_groupadd_args() {
    assert [ $# -eq 1 ]
    assert [ -n "$1" ]

    case "${uname_kernel=$(uname -s)}" in
	(FreeBSD)
	    printf '%s\n' \
		   -g $VOLUME_GID \
		   -n "$1"
	    ;;
	(*)
	    printf '%s\n' \
		   -g $VOLUME_GID \
		   "$1"
	    ;;
    esac
}

print_volume_groupmod_args() {
    assert [ $# -eq 1 ]
    assert [ -n "$1" ]

    case "${uname_kernel=$(uname -s)}" in
	(FreeBSD)
	    printf '%s\n' \
		   -g $VOLUME_GID \
		   -n "$1"
	    ;;
	(*)
	    printf '%s\n' \
		   -g $VOLUME_GID \
		   "$1"
	    ;;
    esac
}

print_volume_passwd() {
    printf '%s:%s:%s:%s:%s:%s:%s\n' \
	   "$volume_user" \
	   "$pw_mask" \
	   "$VOLUME_UID" \
	   "$VOLUME_GID" \
	   "$volume_comment" \
	   "$volume_home" \
	   "$VOLUME_SHELL"
}

print_volume_useradd_args() {
    case "${uname_kernel=$(uname -s)}" in
	(FreeBSD)
	    printf '%s\n' \
		   -c '"'"$volume_comment"'"' \
		   -d "$volume_home" \
		   -g $VOLUME_GID \
		   -s $VOLUME_SHELL \
		   -u $VOLUME_UID \
		   -n "$volume_user"
	    ;;
	(*)
	    printf '%s\n' \
		   -Nr \
		   -c '"'"$volume_comment"'"' \
		   -d "$volume_home" \
		   -g $VOLUME_GID \
		   -s $VOLUME_SHELL \
		   -u $VOLUME_UID \
		   "$volume_user"
	    ;;
    esac
}

print_volume_usermod_args() {
    case "${uname_kernel=$(uname -s)}" in
	(FreeBSD)
	    printf '%s\n' \
		   -c '"'"$volume_comment"'"' \
		   -d "$volume_home" \
		   -g $VOLUME_GID \
		   -s $VOLUME_SHELL \
		   -u $VOLUME_UID \
		   -n "$volume_user"
	    ;;
	(*)
	    printf '%s\n' \
		   -c '"'"$volume_comment"'"' \
		   -d "$volume_home" \
		   -g $VOLUME_GID \
		   -s $VOLUME_SHELL \
		   -u $VOLUME_UID \
		   "$volume_user"
	    ;;
    esac
}

usage() {
    cat <<EOF >&2
Usage: $script [-d VOLUME-HOME] [-n VOLUME-GROUP] [-n VOLUME-USER] [-s] \
[-t TEMPLATE-DIR]
       $script -h

Create and populate Docker volume account and device directories.

  -d VOLUME-HOME  use VOLUME-HOME as the account home directory
		  (default value is $VOLUME_HOME)
  -g VOLUME-GROUP use VOLUME-GROUP as the account group
		  (default value is $VOLUME_GROUP)
  -h              print this help text (all other options are ignored)
  -n VOLUME-USER  use VOLUME-USER as the account name
		  (default value is $VOLUME_USER)
  -s              skip creation of volume devices
  -t TEMPLATE-DIR populate home directory from TEMPLATE-DIR
EOF
}

usage_error() {
    if [ $# -gt 0 ]; then
	printf "$@" >&2
    fi

    printf '%s\n' '' >&2
    usage
    exit 2
}

validate_bsd_awk() {
    validate_version "$1" "$BSD_AWK_RE" $BSD_AWK_VERSION 'BSD Awk'
}

validate_gnu_awk() {
    validate_version "$1" "$GNU_AWK_RE" $GNU_AWK_VERSION 'GNU Awk'
}

validate_platform() {
    case "${uname_kernel=$(uname -s)}" in
	(FreeBSD)
	    true
	    ;;
	(Linux)
	    true
	    ;;
	(*)
	    abort '%s: %s: Operating system not supported\n' \
		  "$script" \
		  "$uname_kernel"
	    ;;
    esac

    version_string=$(get_version_string awk)

    if expr "$version_string" : "$GNU_AWK_RE" >/dev/null; then
	validate_gnu_awk "$version_string"
    elif expr "$version_string" : "$BSD_AWK_RE" >/dev/null; then
	validate_bsd_awk "$version_string"
    else
	abort '%s: BSD/GNU Awk is required\n' "$script"
    fi
}

validate_version() {
    assert [ $# -eq 4 ]
    assert [ -n "$1" ]
    assert [ -n "$2" ]
    assert [ -n "$3" ]
    assert [ -n "$4" ]
    delta=$(compare_string_versions "$1" "$2" "$3")

    if [ -n "$delta" -a "$delta" -ge 0 ]; then
	return 0
    fi

    abort '%s: %s version %s or greater is required\n' \
	  "$script" \
	  "$4" \
	  "$3"
}

script=$(basename "$0")
parse_arguments "$@"
create_docker_volume_devices