Add support for dotfiles repo #837
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add support for pulling down and executing user-provided dotfiles repository. * Add a new configuration option `dotfiles_repo` in `ssh/config.yaml` to specify the GitHub repository URL. * Update the schema in `ssh/config.yaml` to include the new `dotfiles_repo` option. * Update `ssh/DOCS.md` to include instructions on how to configure the `dotfiles_repo` option and provide an example configuration. * Update `ssh/rootfs/etc/s6-overlay/s6-rc.d/init-user/run` to clone the specified repository from the `dotfiles_repo` option and execute the setup scripts.
WalkthroughThe pull request introduces a new Changes
Sequence DiagramsequenceDiagram
participant User as User Configuration
participant Addon as SSH Add-on
participant Repo as Dotfiles Repository
User->>Addon: Specify dotfiles_repo URL
Addon->>Repo: Clone repository
alt Successful Clone
Addon->>Repo: Execute install.sh
Repo-->>Addon: Configuration Complete
else Clone Failure
Addon-->>User: Error Logging
end
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
ssh/rootfs/etc/s6-overlay/s6-rc.d/init-user/run (1)
122-125: Enhancement: Support additional setup script namesThe implementation only supports
install.sh, but many dotfiles repositories use different naming conventions.Consider supporting additional common script names:
- if [ -f /root/dotfiles/install.sh ]; then - bash /root/dotfiles/install.sh \ - || bashio::exit.nok "Failed to execute dotfiles setup script" - fi + for script in install.sh setup.sh bootstrap.sh; do + if [ -f "/root/dotfiles/${script}" ]; then + bashio::log.info "Executing ${script}..." + bash "/root/dotfiles/${script}" \ + || bashio::exit.nok "Failed to execute ${script}" + break + fi + donessh/config.yaml (1)
69-69: Enhancement: Add pattern validation for dotfiles_repoThe schema should validate that the URL matches the expected format.
Consider using a more restrictive schema:
- dotfiles_repo: str + dotfiles_repo: match(^https://github.com/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+(.git)?$)?This ensures that only valid GitHub repository URLs are accepted.
Also applies to: 88-88
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
ssh/DOCS.md(2 hunks)ssh/config.yaml(2 hunks)ssh/rootfs/etc/s6-overlay/s6-rc.d/init-user/run(1 hunks)
Comment on lines
+117
to
+126
| # Clone the specified dotfiles repository and execute setup scripts | ||
| if bashio::config.has_value 'dotfiles_repo'; then | ||
| dotfiles_repo=$(bashio::config 'dotfiles_repo') | ||
| git clone "${dotfiles_repo}" /root/dotfiles \ | ||
| || bashio::exit.nok "Failed to clone dotfiles repository: ${dotfiles_repo}" | ||
| if [ -f /root/dotfiles/install.sh ]; then | ||
| bash /root/dotfiles/install.sh \ | ||
| || bashio::exit.nok "Failed to execute dotfiles setup script" | ||
| fi | ||
| fi |
There was a problem hiding this comment.
Security: Add validation and restrictions for dotfiles repository
The current implementation has several security concerns that need to be addressed:
- No validation of the repository URL
- Executing arbitrary shell scripts with root privileges
- No cleanup of cloned repository
Consider applying these security improvements:
# Clone the specified dotfiles repository and execute setup scripts
if bashio::config.has_value 'dotfiles_repo'; then
dotfiles_repo=$(bashio::config 'dotfiles_repo')
+ # Validate repository URL
+ if ! [[ "${dotfiles_repo}" =~ ^https://github.com/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+(.git)?$ ]]; then
+ bashio::exit.nok "Invalid repository URL. Only public GitHub repositories are supported"
+ fi
+
+ # Clean up existing repository if present
+ rm -rf /root/dotfiles
+
+ # Clone with restrictions
git clone "${dotfiles_repo}" /root/dotfiles \
+ --depth=1 \
+ --single-branch \
+ --timeout=30 \
|| bashio::exit.nok "Failed to clone dotfiles repository: ${dotfiles_repo}"
+
+ # Validate repository contents
+ if [ -f /root/dotfiles/install.sh ]; then
+ # Check for suspicious commands
+ if grep -qE "(curl|wget|nc|telnet|sudo|chmod \+x|rm -rf /*)" /root/dotfiles/install.sh; then
+ bashio::exit.nok "Setup script contains suspicious commands"
+ fi
bash /root/dotfiles/install.sh \
|| bashio::exit.nok "Failed to execute dotfiles setup script"
fi
+
+ # Clean up
+ rm -rf /root/dotfiles/.git
fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| # Clone the specified dotfiles repository and execute setup scripts | |
| if bashio::config.has_value 'dotfiles_repo'; then | |
| dotfiles_repo=$(bashio::config 'dotfiles_repo') | |
| git clone "${dotfiles_repo}" /root/dotfiles \ | |
| || bashio::exit.nok "Failed to clone dotfiles repository: ${dotfiles_repo}" | |
| if [ -f /root/dotfiles/install.sh ]; then | |
| bash /root/dotfiles/install.sh \ | |
| || bashio::exit.nok "Failed to execute dotfiles setup script" | |
| fi | |
| fi | |
| # Clone the specified dotfiles repository and execute setup scripts | |
| if bashio::config.has_value 'dotfiles_repo'; then | |
| dotfiles_repo=$(bashio::config 'dotfiles_repo') | |
| # Validate repository URL | |
| if ! [[ "${dotfiles_repo}" =~ ^https://github.com/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+(.git)?$ ]]; then | |
| bashio::exit.nok "Invalid repository URL. Only public GitHub repositories are supported" | |
| fi | |
| # Clean up existing repository if present | |
| rm -rf /root/dotfiles | |
| # Clone with restrictions | |
| git clone "${dotfiles_repo}" /root/dotfiles \ | |
| --depth=1 \ | |
| --single-branch \ | |
| --timeout=30 \ | |
| || bashio::exit.nok "Failed to clone dotfiles repository: ${dotfiles_repo}" | |
| # Validate repository contents | |
| if [ -f /root/dotfiles/install.sh ]; then | |
| # Check for suspicious commands | |
| if grep -qE "(curl|wget|nc|telnet|sudo|chmod \+x|rm -rf /*)" /root/dotfiles/install.sh; then | |
| bashio::exit.nok "Setup script contains suspicious commands" | |
| fi | |
| bash /root/dotfiles/install.sh \ | |
| || bashio::exit.nok "Failed to execute dotfiles setup script" | |
| fi | |
| # Clean up | |
| rm -rf /root/dotfiles/.git | |
| fi |
Comment on lines
+232
to
+236
| #### Option: `dotfiles_repo` | ||
|
|
||
| Specify the URL of your GitHub repository containing your dotfiles. The repository will be cloned, and the setup scripts will be executed to configure your environment. | ||
|
|
||
| **Note**: _Ensure the repository URL is correct and accessible._ |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Documentation: Enhance dotfiles_repo section
The current documentation lacks important details about security implications and usage.
Consider expanding the documentation:
#### Option: `dotfiles_repo`
-Specify the URL of your GitHub repository containing your dotfiles. The repository will be cloned, and the setup scripts will be executed to configure your environment.
+Specify the URL of your GitHub repository containing your dotfiles. The repository will be cloned, and the setup scripts will be executed to configure your environment. This feature allows you to automate your environment setup using version-controlled configuration files.
+
+**Repository Requirements:**
+- Must be a public GitHub repository
+- URL format: `https://github.com/username/repository`
+- Must contain one of the following setup scripts:
+ - `install.sh`
+ - `setup.sh`
+ - `bootstrap.sh`
+
+**Security Considerations:**
+- The setup script runs with root privileges
+- Carefully review the setup script before using it
+- Avoid scripts that download or execute external code
+- Repository contents are removed after setup
-**Note**: _Ensure the repository URL is correct and accessible._
+**Example:**
+```yaml
+dotfiles_repo: "https://github.com/username/dotfiles"
+```
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add support for pulling down and executing user-provided dotfiles repository.
dotfiles_repoinssh/config.yamlto specify the GitHub repository URL.ssh/config.yamlto include the newdotfiles_repooption.ssh/DOCS.mdto include instructions on how to configure thedotfiles_repooption and provide an example configuration.ssh/rootfs/etc/s6-overlay/s6-rc.d/init-user/runto clone the specified repository from thedotfiles_repooption and execute the setup scripts.Summary by CodeRabbit
New Features
dotfiles_repoallows users to automate their environment setupDocumentation