feat: harden data access and simplify user management

deploy/dbeaver-gateway/Dockerfile

@@ -0,0 +1,16 @@
+FROM alpine:3.22
+
+RUN apk add --no-cache openssh-server socat \
+    && addgroup -g 10001 dbeaver \
+    && adduser -D -u 10001 -G dbeaver -s /bin/sh dbeaver \
+    && sed -i 's/^dbeaver:[^:]*/dbeaver:NP/' /etc/shadow
+
+COPY sshd_config /etc/ssh/sshd_config
+COPY entrypoint.sh /usr/local/bin/dbeaver-gateway-entrypoint
+COPY tunnel-only.sh /usr/local/bin/tunnel-only
+
+RUN chmod 0755 /usr/local/bin/dbeaver-gateway-entrypoint /usr/local/bin/tunnel-only
+
+EXPOSE 22
+
+ENTRYPOINT ["/usr/local/bin/dbeaver-gateway-entrypoint"]

deploy/dbeaver-gateway/entrypoint.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+set -eu
+
+access_dir=/var/lib/travel-kg/dbeaver-access
+host_key_dir=/etc/ssh/host-keys
+
+mkdir -p "${access_dir}" "${host_key_dir}" /run/sshd
+touch "${access_dir}/authorized_keys"
+chown -R 10001:10001 "${access_dir}"
+chmod 0700 "${access_dir}"
+chmod 0600 "${access_dir}/authorized_keys"
+
+if [ ! -s "${host_key_dir}/ssh_host_ed25519_key" ]; then
+  ssh-keygen -q -t ed25519 -N '' -f "${host_key_dir}/ssh_host_ed25519_key"
+fi
+if [ ! -s "${host_key_dir}/ssh_host_rsa_key" ]; then
+  ssh-keygen -q -t rsa -b 3072 -N '' -f "${host_key_dir}/ssh_host_rsa_key"
+fi
+chmod 0600 "${host_key_dir}"/ssh_host_*_key
+ssh-keygen -y -f "${host_key_dir}/ssh_host_ed25519_key" > "${access_dir}/ssh_host_ed25519_key.pub"
+chown 10001:10001 "${access_dir}/ssh_host_ed25519_key.pub"
+chmod 0644 "${access_dir}/ssh_host_ed25519_key.pub"
+
+socat TCP-LISTEN:3307,bind=127.0.0.1,reuseaddr,fork TCP:mysql:3306 &
+socat_pid=$!
+/usr/sbin/sshd -D -e -f /etc/ssh/sshd_config &
+sshd_pid=$!
+
+shutdown() {
+  kill "${socat_pid}" "${sshd_pid}" 2>/dev/null || true
+  wait "${socat_pid}" "${sshd_pid}" 2>/dev/null || true
+  exit 0
+}
+trap shutdown HUP INT TERM
+
+while kill -0 "${socat_pid}" 2>/dev/null && kill -0 "${sshd_pid}" 2>/dev/null; do
+  sleep 2
+done
+
+kill "${socat_pid}" "${sshd_pid}" 2>/dev/null || true
+wait "${socat_pid}" "${sshd_pid}" 2>/dev/null || true
+exit 1

deploy/dbeaver-gateway/sshd_config

@@ -0,0 +1,35 @@
+Port 22
+ListenAddress 0.0.0.0
+HostKey /etc/ssh/host-keys/ssh_host_ed25519_key
+HostKey /etc/ssh/host-keys/ssh_host_rsa_key
+PidFile /run/sshd.pid
+
+PermitRootLogin no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PubkeyAuthentication yes
+AuthenticationMethods publickey
+AuthorizedKeysFile /var/lib/travel-kg/dbeaver-access/authorized_keys
+AllowUsers dbeaver
+LoginGraceTime 30
+MaxAuthTries 3
+MaxSessions 1
+MaxStartups 10:30:30
+StrictModes yes
+
+AllowTcpForwarding local
+AllowStreamLocalForwarding no
+GatewayPorts no
+PermitOpen 127.0.0.1:3307
+AllowAgentForwarding no
+X11Forwarding no
+PermitTTY no
+PermitTunnel no
+PermitUserRC no
+PermitUserEnvironment no
+ForceCommand /usr/local/bin/tunnel-only
+
+UsePAM no
+PrintMotd no
+LogLevel VERBOSE
+Subsystem sftp internal-sftp

deploy/dbeaver-gateway/tunnel-only.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+trap 'exit 0' HUP INT TERM
+while :; do
+  sleep 3600 &
+  wait "$!"
+done