From c9892bfd812a92a47ee993569166067fc5359485 Mon Sep 17 00:00:00 2001
From: Thomas <thomas@nappez.com>
Date: Fri, 21 Aug 2026 13:56:06 +0200
Subject: [PATCH] Updated rsync-server

---
 .github/workflows/build.yml                |  2 +-
 rsync-server/Dockerfile                    | 19 ++++++--
 rsync-server/rsync-server.sh               | 56 ----------------------
 rsync-server/rsyncd.conf                   | 12 +++++
 rsync-server/scripts/docker-entrypoint.sh  | 55 +++++++++++++++++++++
 rsync-server/scripts/docker-healthcheck.sh |  3 ++
 6 files changed, 85 insertions(+), 62 deletions(-)
 delete mode 100644 rsync-server/rsync-server.sh
 create mode 100644 rsync-server/rsyncd.conf
 create mode 100755 rsync-server/scripts/docker-entrypoint.sh
 create mode 100755 rsync-server/scripts/docker-healthcheck.sh

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7ed657d..6b33ffb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -10,7 +10,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        repository: [recipe4reader, log-alert, immich-souvenirs, dnsupdater, webhook, restic-auto, shairport-sync]
+        repository: [rsync-server, recipe4reader, log-alert, immich-souvenirs, dnsupdater, webhook, restic-auto, shairport-sync]
 
     steps:
       - name: Checkout
diff --git a/rsync-server/Dockerfile b/rsync-server/Dockerfile
index 419bbf8..80ce56c 100644
--- a/rsync-server/Dockerfile
+++ b/rsync-server/Dockerfile
@@ -1,8 +1,17 @@
-FROM alpine:latest
+FROM debian:stable-slim
 
-ADD rsync-server.sh /usr/bin/rsync-server.sh
+RUN apt update && apt update && apt install rsync -y \
+ && touch /etc/rsyncd.secrets \
+ && chmod 600 /etc/rsyncd.secrets
 
-RUN apk add --no-cache bash rsync \
-	&& chmod +x /usr/bin/rsync-server.sh
+VOLUME ["/shares"]
 
-CMD /usr/bin/rsync-server.sh
+EXPOSE 873
+
+COPY rsyncd.conf /etc/rsyncd.conf
+COPY scripts/ /scripts/
+
+HEALTHCHECK CMD ["/scripts/docker-healthcheck.sh"]
+ENTRYPOINT ["/scripts/docker-entrypoint.sh"]
+
+CMD [ "rsync", "--no-detach", "--daemon", "--config", "/etc/rsyncd.conf" ]
diff --git a/rsync-server/rsync-server.sh b/rsync-server/rsync-server.sh
deleted file mode 100644
index f7f9486..0000000
--- a/rsync-server/rsync-server.sh
+++ /dev/null
@@ -1,56 +0,0 @@
-#!/bin/bash
-set -e
-
-cat > /etc/rsyncd.conf <<EOF
-log file = /dev/stdout
-timeout = 300
-max connections = 10
-port = 873
-EOF
-
-for i in {0..9} ; do
-	testvar=RSYNC_VOLUME_$i
-	if [ "${!testvar}" != "" ] ; then
-		VOLUME=${!testvar}
-		echo "Configuring $VOLUME"
-
-		testvar=RSYNC_PATH_$i
-		DIRECTORY=${!testvar:-/data/$VOLUME}
-		testvar=RSYNC_USERNAME_$i
-		USERNAME=${!testvar:-user}
-		testvar=RSYNC_PASSWORD_$i
-		PASSWORD=${!testvar:-pass}
-		testvar=RSYNC_ALLOW_$i
-		ALLOW=${!testvar:-10.0.0.0/8 192.168.0.0/16 172.16.0.0/12 127.0.0.1/32}
-		testvar=RSYNC_UID_$i
-		USERID=${!testvar:-root}
-		testvar=RSYNC_GID_$i
-		GROUPID=${!testvar:-root}
-		testvar=RSYNC_READONLY_$i
-		READONLY=${!testvar:-false}
-		testvar=RSYNC_USECHROOT_$i
-		USECHROOT=${!testvar:-no}
-
-		echo "$USERNAME:$PASSWORD" >> /etc/rsyncd.secrets
-
-		cat >> /etc/rsyncd.conf <<EOF
-[${VOLUME}]
-	uid = ${USERID}
-	gid = ${GROUPID}
-	hosts deny = *
-	hosts allow = ${ALLOW}
-	read only = ${READONLY}
-	use chroot = ${USECHROOT}
-	path = ${DIRECTORY}
-	comment = ${VOLUME} directory
-	auth users = ${USERNAME}
-	secrets file = /etc/rsyncd.secrets
-EOF
-
-		mkdir -p $VOLUME
-	fi
-done
-
-chmod 0400 /etc/rsyncd.secrets
-
-exec /usr/bin/rsync --no-detach --daemon --config /etc/rsyncd.conf
diff --git a/rsync-server/rsyncd.conf b/rsync-server/rsyncd.conf
new file mode 100644
index 0000000..07d25fb
--- /dev/null
+++ b/rsync-server/rsyncd.conf
@@ -0,0 +1,12 @@
+log file = /dev/stdout
+use chroot = yes
+list = yes
+strict modes = yes
+secrets file = /etc/rsyncd.secrets
+uid = nobody
+gid = nogroup
+transfer logging = no
+timeout = 600
+ignore errors = no
+refuse options = checksum dry-run
+dont compress = *.gz *.tgz *.zip *.z *.rpm *.deb *.iso *.bz2 *.tbz
\ No newline at end of file
diff --git a/rsync-server/scripts/docker-entrypoint.sh b/rsync-server/scripts/docker-entrypoint.sh
new file mode 100755
index 0000000..e202961
--- /dev/null
+++ b/rsync-server/scripts/docker-entrypoint.sh
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+INITALIZED="/.initialized"
+
+if [ ! -f "$INITALIZED" ]; then
+  echo ">> CONTAINER: starting initialisation"
+
+  ##
+  # rsyncd secrets ENVs
+  ##
+  for I_CONF in "$(env | grep '^RSYNC_SECRET_')"
+  do
+    ACCOUNT_NAME=$(echo "$I_CONF" | cut -d'=' -f1 | sed 's/HTACCESS_ACCOUNT_//g' | tr '[:upper:]' '[:lower:]')
+    CONF_CONF_VALUE=$(echo "$I_CONF" | sed 's/^[^=]*=//g')
+
+    echo ">> RSYNC SECRETS: adding account: $ACCOUNT_NAME"
+    echo "$CONF_CONF_VALUE" >> /etc/rsyncd.secrets
+
+    unset $(echo "$I_CONF" | cut -d'=' -f1)
+  done
+
+  ##
+  # rsyncd Global Config ENVs
+  ##
+  echo "" >> /etc/rsyncd.conf
+  for I_CONF in "$(env | grep '^RSYNC_GLOBAL_CONFIG_')"
+  do
+    CONF_CONF_VALUE=$(echo "$I_CONF" | sed 's/^[^=]*=//g')
+
+    echo "$CONF_CONF_VALUE" >> /etc/rsyncd.conf
+  done
+  echo "" >> /etc/rsyncd.conf
+
+  ##
+  # rsyncd Volume Config ENVs
+  ##
+  for I_CONF in "$(env | grep '^RSYNC_VOLUME_CONFIG_')"
+  do
+    CONF_CONF_VALUE=$(echo "$I_CONF" | sed 's/^[^=]*=//g')
+
+    echo "$CONF_CONF_VALUE" | sed 's/;/\n/g' >> /etc/rsyncd.conf
+    echo "" >> /etc/rsyncd.conf
+  done
+
+  touch "$INITALIZED"
+else
+  echo ">> CONTAINER: already initialized - direct start of rsync"
+fi
+
+##
+# CMD
+##
+echo ">> CMD: exec docker CMD"
+echo "$@"
+exec "$@"
diff --git a/rsync-server/scripts/docker-healthcheck.sh b/rsync-server/scripts/docker-healthcheck.sh
new file mode 100755
index 0000000..e073508
--- /dev/null
+++ b/rsync-server/scripts/docker-healthcheck.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+ps aux | grep [r]sync
+exit $?