docker: implement --auth-proxy option

Dockerfile

@@ -1,41 +1,32 @@
-FROM golang AS builder
+FROM rclone/rclone:latest AS binaries
 
-WORKDIR /rclone/
-COPY go.mod /rclone/
-RUN go mod download
-
-COPY . /rclone/
-
-RUN \
-  CGO_ENABLED=0 \
-  make && \
-  ./rclone version
-
-
-# Begin final image
+# final image
 FROM alpine:latest
 
-COPY --from=builder /rclone/rclone /usr/local/bin/
+# copy the rclone binary from the official image
+COPY --from=binaries /usr/local/bin/rclone /usr/local/bin/rclone
 
+# copy startup and auth proxy scripts
 COPY ["./docker/startup", "/startup"]
+COPY ["./docker/auth-proxy.py", "/usr/local/bin/auth-proxy.py"]
 
+# add python for the auth proxy script
 RUN apk --no-cache add \
+  python3 \
   ca-certificates \
   fuse3 \
   tzdata \
   && apk cache clean
 
+# make scripts executable
 RUN echo "user_allow_other" >> /etc/fuse.conf && \
-  addgroup -g 1009 rclone && \
-  adduser -u 1009 -Ds /bin/sh -G rclone rclone && \
-  chmod +x /startup
+  chmod +x /startup /usr/local/bin/auth-proxy.py
 
 WORKDIR /data
 
 ENV XDG_CONFIG_HOME=/config
 
-# remote configs
-ENV REMOTE_NAME=""
+# remote configs (used by auth-proxy.py)
 ENV REMOTE_URL=""
 ENV REMOTE_VENDOR=""
 

docker/auth-proxy.py

@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+"""
+A proxy for rclone serve s3
+"""
+
+import sys
+import json
+import os
+
+
+def main():
+    i = json.load(sys.stdin)
+    o = {
+        "type": "webdav",  # type of backend
+        "_root": "",  # root of the fs
+        "bearer_token": i["pass"],
+        "url": os.getenv("REMOTE_URL", "https://localhost:9200/remote.php/webdav"),
+        "vendor":  os.getenv("REMOTE_VENDOR", "owncloud"),
+    }
+    json.dump(o, sys.stdout, indent="\t")
+
+
+if __name__ == "__main__":
+    main()

docker/startup

@@ -25,16 +25,13 @@ vendor = $REMOTE_VENDOR
 nextcloud_chunk_size = 0
 EOF
 
-# parse args
-ifsBak=$IFS
-IFS=' '
-
-ARGS="$REMOTE_NAME:"
-for arg in $PROXY_ARGS; do
-    ARGS="$ARGS $arg"
-done
-
-IFS=$ifsBak
-
-# DO NOT QUOTE ARGS
-rclone serve s3 ${ARGS}
+# Check if --auth-proxy is part of PROXY_ARGS
+if echo " $PROXY_ARGS " | grep -q ' --auth-proxy '; then
+  # Auth-proxy mode for per-user access.
+  # Do not pass the remote name as an argument.
+  exec rclone serve s3 $PROXY_ARGS
+else
+  # Anonymous or single-user mode.
+  # Pass the remote name as an argument.
+  exec rclone serve s3 $PROXY_ARGS "$REMOTE_NAME:"
+fi