docker-compose.ssh.yml

# drydock — optional SSH managed-config overlay.
#
# Auto-included by the drydock CLI when ~/.config/drydock/keys/<PROJECT>_deploy
# exists OR when the project list has at least one RW sibling
# (see DRYDOCK_SSH_CONFIG, set by _maybe_export_ssh_config in lib/compose.sh).
#
# Gives the containerized agent SSH access to git push:
#   - Primary project: via the primary deploy key in the managed SSH config.
#   - RW siblings: via per-sibling deploy keys and Host alias blocks.
#
# The managed SSH config (${DRYDOCK_SSH_CONFIG}) is bind-mounted read-only at
# the same path inside the container. The entire keys directory is also mounted
# read-only, so sibling keys are reachable via the IdentityFile paths baked into
# the managed config. GIT_SSH_COMMAND points git at the managed config (-F flag)
# so OpenSSH uses Host alias routing instead of a single -i key.
#
# github.com's host key is pinned in /etc/ssh/ssh_known_hosts at image build
# time (see the ssh-keyscan RUN in the Dockerfile). The HostName in each alias
# block resolves to github.com, so the pinned key is matched regardless of the
# alias used. Nothing under ~/.ssh/ — the hook/deny rules on ~/.ssh/** stay
# strong and unconditional.
#
# Setup (one-time, per repo) — see docs/links.md:
#   drydock link --rw ~/projects/mysibling   # generates key, prints pubkey + instructions
#   # Then add the pubkey to GitHub as a deploy key on the sibling repo.
#
# For primary project push (no RW siblings), the existing setup still applies:
#   ssh-keygen -t ed25519 -f ~/.config/drydock/keys/<PROJECT>_deploy -N ""
#   gh repo deploy-key add ~/.config/drydock/keys/<PROJECT>_deploy.pub \
#       --repo <owner>/<PROJECT> --title "drydock-<PROJECT>" --allow-write

services:
  drydock:
    volumes:
      - "${HOME}/.config/drydock/keys:${HOME}/.config/drydock/keys:ro"
      - "${DRYDOCK_SSH_CONFIG}:${DRYDOCK_SSH_CONFIG}:ro"
      # Per-project gitconfig (issue #89): contains `[include] path = ~/.gitconfig`
      # for identity passthrough plus one `[url "git@github.com-<alias>:owner/repo"]
      # insteadOf = git@github.com:owner/repo` block per RW sibling. Combined with
      # GIT_CONFIG_GLOBAL below, this lets git inside the container route per-
      # sibling SSH aliases WITHOUT mutating the sibling's .git/config — the host's
      # `git fetch` keeps working because the canonical URL stays in place
      # (INV-1 extended: host gitconfig non-contamination).
      - "${DRYDOCK_GITCONFIG}:${DRYDOCK_GITCONFIG}:ro"
    environment:
      GIT_SSH_COMMAND: "ssh -F ${DRYDOCK_SSH_CONFIG} -o UserKnownHostsFile=/etc/ssh/ssh_known_hosts"
      # When GIT_CONFIG_GLOBAL is set, git uses ONLY that file as its global
      # config — the [include] directive at the top of the managed file pulls in
      # the host's ~/.gitconfig (mounted :ro in docker-compose.yml) for user
      # identity (user.name, user.email, aliases, signingkey, etc.).
      GIT_CONFIG_GLOBAL: "${DRYDOCK_GITCONFIG}"