Initial commit: reverse SSH tunnel server for Traefik
Go binary pair (server + client) that establishes reverse SSH tunnels and dynamically registers Traefik routes by SSHing into the ingress host to write file-provider config. Clients need only a private key, server address, domain, and local port as envvars. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
commit
d5a805853a
SSH Key Fingerprint:
SHA256:nRPCQTeMFLdGytxRQmPVK9VXY3/ePKQ5lGRyJhT5DY8
|
|
@ -0,0 +1,9 @@
|
||||||
|
# Binaries (root level only)
|
||||||
|
/tunnel-server
|
||||||
|
/tunnel-client
|
||||||
|
|
||||||
|
# Keys (never commit secrets)
|
||||||
|
keys/
|
||||||
|
|
||||||
|
# OS
|
||||||
|
.DS_Store
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
# syntax=docker/dockerfile:1
|
||||||
|
FROM golang:1.24-alpine AS builder
|
||||||
|
|
||||||
|
RUN apk add --no-cache git
|
||||||
|
|
||||||
|
WORKDIR /src
|
||||||
|
COPY go.mod go.sum ./
|
||||||
|
RUN go mod download
|
||||||
|
|
||||||
|
COPY . .
|
||||||
|
|
||||||
|
# Build both binaries as static.
|
||||||
|
RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /tunnel-server ./cmd/server/
|
||||||
|
RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /tunnel-client ./cmd/client/
|
||||||
|
|
||||||
|
# --- Server image ---
|
||||||
|
FROM alpine:3.21 AS server
|
||||||
|
|
||||||
|
RUN apk add --no-cache ca-certificates
|
||||||
|
|
||||||
|
COPY --from=builder /tunnel-server /usr/local/bin/tunnel-server
|
||||||
|
|
||||||
|
RUN mkdir -p /keys /etc/traefik/dynamic
|
||||||
|
|
||||||
|
EXPOSE 2222
|
||||||
|
EXPOSE 10000-10100
|
||||||
|
|
||||||
|
ENTRYPOINT ["tunnel-server"]
|
||||||
|
|
||||||
|
# --- Client image ---
|
||||||
|
FROM alpine:3.21 AS client
|
||||||
|
|
||||||
|
RUN apk add --no-cache ca-certificates
|
||||||
|
|
||||||
|
COPY --from=builder /tunnel-client /usr/local/bin/tunnel-client
|
||||||
|
|
||||||
|
RUN mkdir -p /keys
|
||||||
|
|
||||||
|
ENTRYPOINT ["tunnel-client"]
|
||||||
|
|
@ -0,0 +1,169 @@
|
||||||
|
# Reverse SSH Tunnel Server for Traefik
|
||||||
|
|
||||||
|
A lightweight Go system that lets remote Docker hosts expose HTTP services through a central Traefik reverse proxy via SSH tunnels. The server SSHs into the Traefik ingress host to dynamically manage route configuration.
|
||||||
|
|
||||||
|
## Architecture
|
||||||
|
|
||||||
|
```
|
||||||
|
Remote Host Tunnel Server Traefik Host (ingress.nixc.us)
|
||||||
|
+--------------+ +---------------------+ +---------------------+
|
||||||
|
| tunnel-client| ---SSH tunnel---> | tunnel-server | | Traefik |
|
||||||
|
| TUNNEL_KEY | | allocates port, | | watches dynamic/ |
|
||||||
|
| TUNNEL_DOMAIN| | SSHs into Traefik |--->| routes HTTPS to |
|
||||||
|
| TUNNEL_PORT | | host to write config | | tunnel-server ports |
|
||||||
|
+--------------+ +---------------------+ +---------------------+
|
||||||
|
```
|
||||||
|
|
||||||
|
### Flow
|
||||||
|
|
||||||
|
1. Client connects to tunnel-server via SSH using a private key
|
||||||
|
2. Client sends domain metadata (`{"domain":"myapp.example.com"}`) over a custom channel
|
||||||
|
3. Server allocates a port from the pool and sets up a reverse port forward
|
||||||
|
4. Server SSHs into `ingress.nixc.us` and writes a Traefik dynamic config file
|
||||||
|
5. Traefik detects the new config and routes HTTPS traffic to `tunnel-server:<port>`
|
||||||
|
6. Traffic flows: Internet -> Traefik -> tunnel-server:port -> SSH tunnel -> client -> local service
|
||||||
|
7. When the client disconnects, the config file is removed and the port is freed
|
||||||
|
|
||||||
|
## Quick Start
|
||||||
|
|
||||||
|
### 1. Generate SSH Keys
|
||||||
|
|
||||||
|
```bash
|
||||||
|
mkdir -p keys
|
||||||
|
|
||||||
|
# Server host key (for the SSH server that clients connect to)
|
||||||
|
ssh-keygen -t ed25519 -f keys/host_key -N ""
|
||||||
|
|
||||||
|
# Client key (for tunnel clients)
|
||||||
|
ssh-keygen -t ed25519 -f keys/id_ed25519 -N ""
|
||||||
|
|
||||||
|
# Authorize the client
|
||||||
|
cat keys/id_ed25519.pub > keys/authorized_keys
|
||||||
|
|
||||||
|
# Deploy key for SSHing into the Traefik host
|
||||||
|
# (use an existing key that has root access to ingress.nixc.us,
|
||||||
|
# or generate one and add its .pub to the Traefik host's authorized_keys)
|
||||||
|
cp ~/.ssh/ingress_deploy_key keys/traefik_deploy_key
|
||||||
|
```
|
||||||
|
|
||||||
|
### 2. Enable Traefik File Provider
|
||||||
|
|
||||||
|
On `ingress.nixc.us`, ensure Traefik has the file provider enabled.
|
||||||
|
If Traefik is run via Docker stack with CLI args, add:
|
||||||
|
|
||||||
|
```
|
||||||
|
--providers.file.directory=/root/traefik/dynamic
|
||||||
|
--providers.file.watch=true
|
||||||
|
```
|
||||||
|
|
||||||
|
Or via SSH (non-interactive):
|
||||||
|
|
||||||
|
```bash
|
||||||
|
ssh root@ingress.nixc.us "mkdir -p /root/traefik/dynamic"
|
||||||
|
```
|
||||||
|
|
||||||
|
Then update your Traefik stack/service to mount the directory and add the CLI args.
|
||||||
|
|
||||||
|
### 3. Start the Tunnel Server
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker compose up -d
|
||||||
|
```
|
||||||
|
|
||||||
|
### 4. Run a Client
|
||||||
|
|
||||||
|
On any remote host where your service is running:
|
||||||
|
|
||||||
|
**Using a mounted key file:**
|
||||||
|
```bash
|
||||||
|
docker run -d \
|
||||||
|
--name tunnel-client \
|
||||||
|
-e TUNNEL_SERVER=ingress.nixc.us:2222 \
|
||||||
|
-e TUNNEL_DOMAIN=myapp.example.com \
|
||||||
|
-e TUNNEL_PORT=8080 \
|
||||||
|
-e TUNNEL_KEY=/keys/id_ed25519 \
|
||||||
|
-v /path/to/keys:/keys:ro \
|
||||||
|
--network host \
|
||||||
|
tunnel-client
|
||||||
|
```
|
||||||
|
|
||||||
|
**Using raw PEM key content in an envvar:**
|
||||||
|
```bash
|
||||||
|
docker run -d \
|
||||||
|
--name tunnel-client \
|
||||||
|
-e TUNNEL_SERVER=ingress.nixc.us:2222 \
|
||||||
|
-e TUNNEL_DOMAIN=myapp.example.com \
|
||||||
|
-e TUNNEL_PORT=8080 \
|
||||||
|
-e "TUNNEL_KEY=$(cat /path/to/id_ed25519)" \
|
||||||
|
--network host \
|
||||||
|
tunnel-client
|
||||||
|
```
|
||||||
|
|
||||||
|
## Environment Variables
|
||||||
|
|
||||||
|
### Server
|
||||||
|
|
||||||
|
| Variable | Description | Default |
|
||||||
|
|---|---|---|
|
||||||
|
| `SSH_PORT` | SSH listen port for tunnel clients | `2222` |
|
||||||
|
| `PORT_RANGE_START` | First allocatable tunnel port | `10000` |
|
||||||
|
| `PORT_RANGE_END` | Last allocatable tunnel port | `10100` |
|
||||||
|
| `SSH_HOST_KEY` | Path to SSH host private key | `/keys/host_key` |
|
||||||
|
| `AUTHORIZED_KEYS` | Path to authorized_keys file | `/keys/authorized_keys` |
|
||||||
|
| `TRAEFIK_SSH_HOST` | Traefik host to SSH into **(required)** | - |
|
||||||
|
| `TRAEFIK_SSH_USER` | SSH user on the Traefik host | `root` |
|
||||||
|
| `TRAEFIK_SSH_KEY` | SSH key for Traefik host (path or PEM) **(required)** | - |
|
||||||
|
| `TRAEFIK_CONFIG_DIR` | Remote path for dynamic configs | `/root/traefik/dynamic` |
|
||||||
|
| `TRAEFIK_ENTRYPOINT` | Traefik entrypoint name | `websecure` |
|
||||||
|
| `TRAEFIK_CERT_RESOLVER` | Traefik TLS cert resolver | `letsencryptresolver` |
|
||||||
|
|
||||||
|
### Client
|
||||||
|
|
||||||
|
| Variable | Description | Default |
|
||||||
|
|---|---|---|
|
||||||
|
| `TUNNEL_SERVER` | Server host:port **(required)** | - |
|
||||||
|
| `TUNNEL_DOMAIN` | Public domain to expose **(required)** | - |
|
||||||
|
| `TUNNEL_PORT` | Local port of your service | `8080` |
|
||||||
|
| `TUNNEL_KEY` | SSH private key — file path or raw PEM **(required)** | `/keys/id_ed25519` |
|
||||||
|
|
||||||
|
## Generated Traefik Config
|
||||||
|
|
||||||
|
When a client connects requesting `myapp.example.com`, the server writes this to the Traefik host:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
# /root/traefik/dynamic/tunnel-myapp-example-com.yml
|
||||||
|
http:
|
||||||
|
routers:
|
||||||
|
tunnel-myapp-example-com-router:
|
||||||
|
rule: "Host(`myapp.example.com`)"
|
||||||
|
entryPoints:
|
||||||
|
- websecure
|
||||||
|
tls:
|
||||||
|
certResolver: letsencryptresolver
|
||||||
|
service: tunnel-myapp-example-com-service
|
||||||
|
services:
|
||||||
|
tunnel-myapp-example-com-service:
|
||||||
|
loadBalancer:
|
||||||
|
servers:
|
||||||
|
- url: "http://tunnel-server:10042"
|
||||||
|
```
|
||||||
|
|
||||||
|
## Building
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Build both binaries locally
|
||||||
|
go build -o tunnel-server ./cmd/server/
|
||||||
|
go build -o tunnel-client ./cmd/client/
|
||||||
|
|
||||||
|
# Build Docker images
|
||||||
|
docker compose build # server image
|
||||||
|
docker build --target client -t tunnel-client . # client image
|
||||||
|
```
|
||||||
|
|
||||||
|
## Security Notes
|
||||||
|
|
||||||
|
- Only clients whose public keys are in `authorized_keys` can connect
|
||||||
|
- The server uses a stable host key for client verification
|
||||||
|
- SSH tunnels encrypt all traffic between client and server
|
||||||
|
- The server authenticates to the Traefik host with a separate deploy key
|
||||||
|
- Traefik handles TLS termination with automatic Let's Encrypt certificates
|
||||||
|
|
@ -0,0 +1,76 @@
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"log"
|
||||||
|
"os"
|
||||||
|
"strconv"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/nixc/reverse-ssh-traefik/internal/client"
|
||||||
|
)
|
||||||
|
|
||||||
|
func envRequired(key string) string {
|
||||||
|
v := os.Getenv(key)
|
||||||
|
if v == "" {
|
||||||
|
log.Fatalf("Required environment variable %s is not set", key)
|
||||||
|
}
|
||||||
|
return v
|
||||||
|
}
|
||||||
|
|
||||||
|
func envOr(key, fallback string) string {
|
||||||
|
if v := os.Getenv(key); v != "" {
|
||||||
|
return v
|
||||||
|
}
|
||||||
|
return fallback
|
||||||
|
}
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
log.SetFlags(log.LstdFlags | log.Lshortfile)
|
||||||
|
log.Println("tunnel-client starting")
|
||||||
|
|
||||||
|
serverAddr := envRequired("TUNNEL_SERVER")
|
||||||
|
domain := envRequired("TUNNEL_DOMAIN")
|
||||||
|
keyPath := envOr("TUNNEL_KEY", "/keys/id_ed25519")
|
||||||
|
|
||||||
|
localPortStr := envOr("TUNNEL_PORT", "8080")
|
||||||
|
localPort, err := strconv.Atoi(localPortStr)
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("Invalid TUNNEL_PORT=%q: %v", localPortStr, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Load the private key.
|
||||||
|
signer, err := client.LoadPrivateKey(keyPath)
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("Failed to load private key: %v", err)
|
||||||
|
}
|
||||||
|
log.Printf("Loaded key from %s", keyPath)
|
||||||
|
|
||||||
|
// Reconnect loop.
|
||||||
|
backoff := time.Second
|
||||||
|
maxBackoff := 30 * time.Second
|
||||||
|
|
||||||
|
for {
|
||||||
|
log.Printf("Connecting to %s (domain=%s, local_port=%d)", serverAddr, domain, localPort)
|
||||||
|
|
||||||
|
sshClient, err := client.Connect(serverAddr, signer)
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("Connection failed: %v (retry in %s)", err, backoff)
|
||||||
|
time.Sleep(backoff)
|
||||||
|
backoff = min(backoff*2, maxBackoff)
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
// Reset backoff on successful connection.
|
||||||
|
backoff = time.Second
|
||||||
|
log.Printf("Connected to %s", serverAddr)
|
||||||
|
|
||||||
|
// Set up the reverse tunnel (blocks until disconnected).
|
||||||
|
if err := client.SetupTunnel(sshClient, domain, localPort); err != nil {
|
||||||
|
log.Printf("Tunnel error: %v (reconnecting in %s)", err, backoff)
|
||||||
|
}
|
||||||
|
|
||||||
|
sshClient.Close()
|
||||||
|
time.Sleep(backoff)
|
||||||
|
backoff = min(backoff*2, maxBackoff)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,101 @@
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"log"
|
||||||
|
"os"
|
||||||
|
"os/signal"
|
||||||
|
"strconv"
|
||||||
|
"syscall"
|
||||||
|
|
||||||
|
"github.com/nixc/reverse-ssh-traefik/internal/server"
|
||||||
|
)
|
||||||
|
|
||||||
|
func envOr(key, fallback string) string {
|
||||||
|
if v := os.Getenv(key); v != "" {
|
||||||
|
return v
|
||||||
|
}
|
||||||
|
return fallback
|
||||||
|
}
|
||||||
|
|
||||||
|
func envRequired(key string) string {
|
||||||
|
v := os.Getenv(key)
|
||||||
|
if v == "" {
|
||||||
|
log.Fatalf("Required environment variable %s is not set", key)
|
||||||
|
}
|
||||||
|
return v
|
||||||
|
}
|
||||||
|
|
||||||
|
func envInt(key string, fallback int) int {
|
||||||
|
v := os.Getenv(key)
|
||||||
|
if v == "" {
|
||||||
|
return fallback
|
||||||
|
}
|
||||||
|
n, err := strconv.Atoi(v)
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("WARN: invalid %s=%q, using default %d", key, v, fallback)
|
||||||
|
return fallback
|
||||||
|
}
|
||||||
|
return n
|
||||||
|
}
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
log.SetFlags(log.LstdFlags | log.Lshortfile)
|
||||||
|
log.Println("tunnel-server starting")
|
||||||
|
|
||||||
|
// SSH server config (for accepting tunnel clients).
|
||||||
|
sshPort := envOr("SSH_PORT", "2222")
|
||||||
|
hostKeyPath := envOr("SSH_HOST_KEY", "/keys/host_key")
|
||||||
|
authKeysPath := envOr("AUTHORIZED_KEYS", "/keys/authorized_keys")
|
||||||
|
portStart := envInt("PORT_RANGE_START", 10000)
|
||||||
|
portEnd := envInt("PORT_RANGE_END", 10100)
|
||||||
|
|
||||||
|
// Remote Traefik host config (SSH into the ingress host to manage routes).
|
||||||
|
traefikHost := envRequired("TRAEFIK_SSH_HOST")
|
||||||
|
traefikUser := envOr("TRAEFIK_SSH_USER", "root")
|
||||||
|
traefikKey := envRequired("TRAEFIK_SSH_KEY")
|
||||||
|
traefikConfigDir := envOr("TRAEFIK_CONFIG_DIR", "/root/traefik/dynamic")
|
||||||
|
entrypoint := envOr("TRAEFIK_ENTRYPOINT", "websecure")
|
||||||
|
certResolver := envOr("TRAEFIK_CERT_RESOLVER", "letsencryptresolver")
|
||||||
|
|
||||||
|
// Load the SSH key for connecting to the Traefik host.
|
||||||
|
traefikSigner, err := server.LoadSigner(traefikKey)
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("Failed to load Traefik SSH key: %v", err)
|
||||||
|
}
|
||||||
|
log.Printf("Loaded Traefik host SSH key")
|
||||||
|
|
||||||
|
// Initialize port pool.
|
||||||
|
pool := server.NewPortPool(portStart, portEnd)
|
||||||
|
log.Printf("Port pool: %d-%d (%d ports)", portStart, portEnd, portEnd-portStart+1)
|
||||||
|
|
||||||
|
// Initialize Traefik label manager (remote SSH).
|
||||||
|
labels, err := server.NewLabelManager(
|
||||||
|
traefikHost, traefikUser, traefikSigner,
|
||||||
|
traefikConfigDir, entrypoint, certResolver,
|
||||||
|
)
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("Failed to init label manager: %v", err)
|
||||||
|
}
|
||||||
|
defer labels.Close()
|
||||||
|
|
||||||
|
// Initialize SSH server for tunnel clients.
|
||||||
|
sshSrv, err := server.NewSSHServer(hostKeyPath, authKeysPath, pool, labels)
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("Failed to init SSH server: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Handle graceful shutdown.
|
||||||
|
sigCh := make(chan os.Signal, 1)
|
||||||
|
signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
|
||||||
|
go func() {
|
||||||
|
sig := <-sigCh
|
||||||
|
log.Printf("Received signal %s, shutting down", sig)
|
||||||
|
os.Exit(0)
|
||||||
|
}()
|
||||||
|
|
||||||
|
// Start SSH server.
|
||||||
|
addr := "0.0.0.0:" + sshPort
|
||||||
|
if err := sshSrv.ListenAndServe(addr); err != nil {
|
||||||
|
log.Fatalf("SSH server error: %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,40 @@
|
||||||
|
services:
|
||||||
|
tunnel-server:
|
||||||
|
build:
|
||||||
|
context: .
|
||||||
|
target: server
|
||||||
|
container_name: tunnel-server
|
||||||
|
restart: unless-stopped
|
||||||
|
environment:
|
||||||
|
# SSH server config (for accepting tunnel clients)
|
||||||
|
SSH_PORT: "2222"
|
||||||
|
PORT_RANGE_START: "10000"
|
||||||
|
PORT_RANGE_END: "10100"
|
||||||
|
SSH_HOST_KEY: "/keys/host_key"
|
||||||
|
AUTHORIZED_KEYS: "/keys/authorized_keys"
|
||||||
|
# Remote Traefik host config (SSH into ingress to manage routes)
|
||||||
|
TRAEFIK_SSH_HOST: "ingress.nixc.us"
|
||||||
|
TRAEFIK_SSH_USER: "root"
|
||||||
|
TRAEFIK_SSH_KEY: "/keys/traefik_deploy_key"
|
||||||
|
TRAEFIK_CONFIG_DIR: "/root/traefik/dynamic"
|
||||||
|
TRAEFIK_ENTRYPOINT: "websecure"
|
||||||
|
TRAEFIK_CERT_RESOLVER: "letsencryptresolver"
|
||||||
|
volumes:
|
||||||
|
- ./keys:/keys:ro
|
||||||
|
ports:
|
||||||
|
- "2222:2222"
|
||||||
|
- "10000-10100:10000-10100"
|
||||||
|
labels:
|
||||||
|
# Traefik labels for the SSH endpoint itself.
|
||||||
|
# This lets Traefik TCP-route SSH traffic to the tunnel server.
|
||||||
|
traefik.enable: "true"
|
||||||
|
traefik.tcp.routers.tunnel-ssh-router.rule: "HostSNI(`*`)"
|
||||||
|
traefik.tcp.routers.tunnel-ssh-router.entrypoints: "ssh"
|
||||||
|
traefik.tcp.services.tunnel-ssh-service.loadbalancer.server.port: "2222"
|
||||||
|
traefik.docker.network: "traefik"
|
||||||
|
networks:
|
||||||
|
- traefik
|
||||||
|
|
||||||
|
networks:
|
||||||
|
traefik:
|
||||||
|
external: true
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
module github.com/nixc/reverse-ssh-traefik
|
||||||
|
|
||||||
|
go 1.24.0
|
||||||
|
|
||||||
|
toolchain go1.24.13
|
||||||
|
|
||||||
|
require golang.org/x/crypto v0.47.0
|
||||||
|
|
||||||
|
require golang.org/x/sys v0.40.0 // indirect
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
|
||||||
|
golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
|
||||||
|
golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
|
||||||
|
golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
|
||||||
|
golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
|
||||||
|
golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
|
||||||
|
|
@ -0,0 +1,67 @@
|
||||||
|
package client
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"golang.org/x/crypto/ssh"
|
||||||
|
)
|
||||||
|
|
||||||
|
// LoadPrivateKey loads an SSH private key from either:
|
||||||
|
// - A file path (if the value starts with "/" or "./")
|
||||||
|
// - Raw PEM content (if the value looks like a PEM key)
|
||||||
|
//
|
||||||
|
// This allows TUNNEL_KEY to be set as a file path or pasted PEM content.
|
||||||
|
func LoadPrivateKey(keyOrPath string) (ssh.Signer, error) {
|
||||||
|
var keyBytes []byte
|
||||||
|
|
||||||
|
if isFilePath(keyOrPath) {
|
||||||
|
data, err := os.ReadFile(keyOrPath)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read key file %s: %w", keyOrPath, err)
|
||||||
|
}
|
||||||
|
keyBytes = data
|
||||||
|
} else {
|
||||||
|
// Treat as raw PEM content.
|
||||||
|
keyBytes = []byte(keyOrPath)
|
||||||
|
}
|
||||||
|
|
||||||
|
signer, err := ssh.ParsePrivateKey(keyBytes)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("parse private key: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return signer, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// isFilePath returns true if the value looks like a filesystem path
|
||||||
|
// rather than raw PEM key content.
|
||||||
|
func isFilePath(v string) bool {
|
||||||
|
if strings.HasPrefix(v, "/") || strings.HasPrefix(v, "./") || strings.HasPrefix(v, "~") {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
// If it doesn't look like PEM, assume it's a path.
|
||||||
|
if !strings.Contains(v, "-----BEGIN") {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
// Connect establishes an SSH connection to the tunnel server.
|
||||||
|
func Connect(addr string, signer ssh.Signer) (*ssh.Client, error) {
|
||||||
|
config := &ssh.ClientConfig{
|
||||||
|
User: "tunnel",
|
||||||
|
Auth: []ssh.AuthMethod{
|
||||||
|
ssh.PublicKeys(signer),
|
||||||
|
},
|
||||||
|
HostKeyCallback: ssh.InsecureIgnoreHostKey(),
|
||||||
|
}
|
||||||
|
|
||||||
|
client, err := ssh.Dial("tcp", addr, config)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("SSH dial %s: %w", addr, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return client, nil
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,102 @@
|
||||||
|
package client
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"log"
|
||||||
|
"net"
|
||||||
|
"sync"
|
||||||
|
|
||||||
|
"golang.org/x/crypto/ssh"
|
||||||
|
)
|
||||||
|
|
||||||
|
// TunnelRequest is the metadata sent to the server on the tunnel-request channel.
|
||||||
|
type TunnelRequest struct {
|
||||||
|
Domain string `json:"domain"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// SetupTunnel sends domain metadata and establishes a reverse port forward.
|
||||||
|
// The server will allocate a port and register Traefik routes for the domain.
|
||||||
|
// localPort is the port of the service running on the client side.
|
||||||
|
func SetupTunnel(client *ssh.Client, domain string, localPort int) error {
|
||||||
|
// Step 1: Open custom channel to send domain metadata.
|
||||||
|
if err := sendMetadata(client, domain); err != nil {
|
||||||
|
return fmt.Errorf("send metadata: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Step 2: Request reverse port forward.
|
||||||
|
// We use the domain as the bind address so the server can associate it.
|
||||||
|
listener, err := client.Listen("tcp", fmt.Sprintf("%s:0", domain))
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("reverse listen: %w", err)
|
||||||
|
}
|
||||||
|
defer listener.Close()
|
||||||
|
|
||||||
|
log.Printf("Reverse tunnel established: %s -> localhost:%d", domain, localPort)
|
||||||
|
|
||||||
|
// Step 3: Accept connections from the server and forward to local service.
|
||||||
|
for {
|
||||||
|
conn, err := listener.Accept()
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("tunnel accept: %w", err)
|
||||||
|
}
|
||||||
|
go forwardToLocal(conn, localPort)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// sendMetadata opens a custom channel and sends the tunnel request JSON.
|
||||||
|
func sendMetadata(client *ssh.Client, domain string) error {
|
||||||
|
ch, _, err := client.OpenChannel("tunnel-request", nil)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("open tunnel-request channel: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
req := TunnelRequest{Domain: domain}
|
||||||
|
data, err := json.Marshal(req)
|
||||||
|
if err != nil {
|
||||||
|
ch.Close()
|
||||||
|
return fmt.Errorf("marshal metadata: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if _, err := ch.Write(data); err != nil {
|
||||||
|
ch.Close()
|
||||||
|
return fmt.Errorf("write metadata: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
log.Printf("Sent tunnel metadata: domain=%s", domain)
|
||||||
|
|
||||||
|
// Keep the channel open in a goroutine for disconnect detection.
|
||||||
|
go func() {
|
||||||
|
io.Copy(io.Discard, ch)
|
||||||
|
log.Printf("Metadata channel closed for %s", domain)
|
||||||
|
}()
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// forwardToLocal connects an incoming tunnel connection to the local service.
|
||||||
|
func forwardToLocal(remoteConn net.Conn, localPort int) {
|
||||||
|
defer remoteConn.Close()
|
||||||
|
|
||||||
|
localAddr := fmt.Sprintf("127.0.0.1:%d", localPort)
|
||||||
|
localConn, err := net.Dial("tcp", localAddr)
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("failed to connect to local service at %s: %v", localAddr, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
defer localConn.Close()
|
||||||
|
|
||||||
|
// Bidirectional copy.
|
||||||
|
var wg sync.WaitGroup
|
||||||
|
wg.Add(2)
|
||||||
|
go func() {
|
||||||
|
defer wg.Done()
|
||||||
|
io.Copy(localConn, remoteConn)
|
||||||
|
}()
|
||||||
|
go func() {
|
||||||
|
defer wg.Done()
|
||||||
|
io.Copy(remoteConn, localConn)
|
||||||
|
}()
|
||||||
|
wg.Wait()
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,44 @@
|
||||||
|
package server
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"golang.org/x/crypto/ssh"
|
||||||
|
)
|
||||||
|
|
||||||
|
// LoadSigner loads an SSH private key from either a file path or raw PEM content.
|
||||||
|
// If the value starts with "/" or "./" or "~", it's treated as a file path.
|
||||||
|
// If it contains "-----BEGIN", it's treated as raw PEM content.
|
||||||
|
func LoadSigner(keyOrPath string) (ssh.Signer, error) {
|
||||||
|
var keyBytes []byte
|
||||||
|
|
||||||
|
if isFilePath(keyOrPath) {
|
||||||
|
data, err := os.ReadFile(keyOrPath)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read key file %s: %w", keyOrPath, err)
|
||||||
|
}
|
||||||
|
keyBytes = data
|
||||||
|
} else {
|
||||||
|
keyBytes = []byte(keyOrPath)
|
||||||
|
}
|
||||||
|
|
||||||
|
signer, err := ssh.ParsePrivateKey(keyBytes)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("parse private key: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return signer, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// isFilePath heuristic: paths start with / ./ ~ or don't contain PEM markers.
|
||||||
|
func isFilePath(v string) bool {
|
||||||
|
if strings.HasPrefix(v, "/") || strings.HasPrefix(v, "./") || strings.HasPrefix(v, "~") {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
if !strings.Contains(v, "-----BEGIN") {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,161 @@
|
||||||
|
package server
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"log"
|
||||||
|
"strings"
|
||||||
|
"sync"
|
||||||
|
|
||||||
|
"golang.org/x/crypto/ssh"
|
||||||
|
)
|
||||||
|
|
||||||
|
// LabelManager manages Traefik dynamic config on a remote host via SSH.
|
||||||
|
// It SSHs into the Traefik host and writes per-tunnel YAML config files
|
||||||
|
// into the Traefik file provider directory.
|
||||||
|
type LabelManager struct {
|
||||||
|
mu sync.Mutex
|
||||||
|
remoteHost string // e.g. "ingress.nixc.us" or "ingress.nixc.us:22"
|
||||||
|
remoteUser string // SSH user on the Traefik host
|
||||||
|
signer ssh.Signer
|
||||||
|
configDir string // remote path where Traefik watches for file provider
|
||||||
|
entrypoint string // e.g. "websecure"
|
||||||
|
certResolver string // e.g. "letsencryptresolver"
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewLabelManager creates a label manager that writes Traefik config via SSH.
|
||||||
|
func NewLabelManager(
|
||||||
|
remoteHost, remoteUser string,
|
||||||
|
signer ssh.Signer,
|
||||||
|
configDir, entrypoint, certResolver string,
|
||||||
|
) (*LabelManager, error) {
|
||||||
|
|
||||||
|
lm := &LabelManager{
|
||||||
|
remoteHost: remoteHost,
|
||||||
|
remoteUser: remoteUser,
|
||||||
|
signer: signer,
|
||||||
|
configDir: configDir,
|
||||||
|
entrypoint: entrypoint,
|
||||||
|
certResolver: certResolver,
|
||||||
|
}
|
||||||
|
|
||||||
|
// Ensure the remote config directory exists.
|
||||||
|
if err := lm.runRemote(fmt.Sprintf("mkdir -p %s", configDir)); err != nil {
|
||||||
|
return nil, fmt.Errorf("ensure remote config dir: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
log.Printf("Label manager ready (host=%s, dir=%s, ep=%s, resolver=%s)",
|
||||||
|
remoteHost, configDir, entrypoint, certResolver)
|
||||||
|
|
||||||
|
return lm, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Add writes a Traefik dynamic config file on the remote host for a tunnel.
|
||||||
|
func (lm *LabelManager) Add(tunKey, domain string, port int) error {
|
||||||
|
lm.mu.Lock()
|
||||||
|
defer lm.mu.Unlock()
|
||||||
|
|
||||||
|
routerName := fmt.Sprintf("tunnel-%s-router", tunKey)
|
||||||
|
serviceName := fmt.Sprintf("tunnel-%s-service", tunKey)
|
||||||
|
cfg := buildRouteConfig(routerName, serviceName, domain, port, lm.entrypoint, lm.certResolver)
|
||||||
|
|
||||||
|
remotePath := fmt.Sprintf("%s/tunnel-%s.yml", lm.configDir, tunKey)
|
||||||
|
|
||||||
|
// Write the config file via SSH using cat heredoc.
|
||||||
|
cmd := fmt.Sprintf("cat > %s << 'TRAEFIKEOF'\n%sTRAEFIKEOF", remotePath, cfg)
|
||||||
|
|
||||||
|
if err := lm.runRemote(cmd); err != nil {
|
||||||
|
return fmt.Errorf("write remote config %s: %w", remotePath, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
log.Printf("Wrote remote Traefik config: %s (domain=%s port=%d)", remotePath, domain, port)
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Remove deletes the Traefik dynamic config file on the remote host.
|
||||||
|
func (lm *LabelManager) Remove(tunKey string) error {
|
||||||
|
lm.mu.Lock()
|
||||||
|
defer lm.mu.Unlock()
|
||||||
|
|
||||||
|
remotePath := fmt.Sprintf("%s/tunnel-%s.yml", lm.configDir, tunKey)
|
||||||
|
cmd := fmt.Sprintf("rm -f %s", remotePath)
|
||||||
|
|
||||||
|
if err := lm.runRemote(cmd); err != nil {
|
||||||
|
return fmt.Errorf("remove remote config %s: %w", remotePath, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
log.Printf("Removed remote Traefik config: %s", remotePath)
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// runRemote executes a command on the remote Traefik host via SSH.
|
||||||
|
func (lm *LabelManager) runRemote(cmd string) error {
|
||||||
|
addr := lm.remoteHost
|
||||||
|
if !strings.Contains(addr, ":") {
|
||||||
|
addr = addr + ":22"
|
||||||
|
}
|
||||||
|
|
||||||
|
config := &ssh.ClientConfig{
|
||||||
|
User: lm.remoteUser,
|
||||||
|
Auth: []ssh.AuthMethod{
|
||||||
|
ssh.PublicKeys(lm.signer),
|
||||||
|
},
|
||||||
|
HostKeyCallback: ssh.InsecureIgnoreHostKey(),
|
||||||
|
}
|
||||||
|
|
||||||
|
client, err := ssh.Dial("tcp", addr, config)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("SSH dial %s: %w", addr, err)
|
||||||
|
}
|
||||||
|
defer client.Close()
|
||||||
|
|
||||||
|
session, err := client.NewSession()
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("SSH session: %w", err)
|
||||||
|
}
|
||||||
|
defer session.Close()
|
||||||
|
|
||||||
|
output, err := session.CombinedOutput(cmd)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("remote cmd failed: %w (output: %s)", err, string(output))
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// buildRouteConfig generates Traefik dynamic config YAML for one tunnel.
|
||||||
|
func buildRouteConfig(
|
||||||
|
routerName, serviceName, domain string,
|
||||||
|
port int,
|
||||||
|
entrypoint, certResolver string,
|
||||||
|
) string {
|
||||||
|
var b strings.Builder
|
||||||
|
|
||||||
|
b.WriteString("# Auto-generated by tunnel-server. Do not edit.\n")
|
||||||
|
b.WriteString("http:\n")
|
||||||
|
|
||||||
|
// Router
|
||||||
|
b.WriteString(" routers:\n")
|
||||||
|
b.WriteString(fmt.Sprintf(" %s:\n", routerName))
|
||||||
|
b.WriteString(fmt.Sprintf(" rule: \"Host(`%s`)\"\n", domain))
|
||||||
|
b.WriteString(" entryPoints:\n")
|
||||||
|
b.WriteString(fmt.Sprintf(" - %s\n", entrypoint))
|
||||||
|
b.WriteString(" tls:\n")
|
||||||
|
b.WriteString(fmt.Sprintf(" certResolver: %s\n", certResolver))
|
||||||
|
b.WriteString(fmt.Sprintf(" service: %s\n", serviceName))
|
||||||
|
|
||||||
|
// Service — points to the tunnel-server's allocated port.
|
||||||
|
// The tunnel-server container is on the same network as Traefik,
|
||||||
|
// so Traefik can reach it by container name or IP.
|
||||||
|
b.WriteString(" services:\n")
|
||||||
|
b.WriteString(fmt.Sprintf(" %s:\n", serviceName))
|
||||||
|
b.WriteString(" loadBalancer:\n")
|
||||||
|
b.WriteString(" servers:\n")
|
||||||
|
b.WriteString(fmt.Sprintf(" - url: \"http://tunnel-server:%d\"\n", port))
|
||||||
|
|
||||||
|
return b.String()
|
||||||
|
}
|
||||||
|
|
||||||
|
// Close is a no-op — SSH connections are opened/closed per operation.
|
||||||
|
func (lm *LabelManager) Close() error {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,204 @@
|
||||||
|
package server
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"log"
|
||||||
|
"net"
|
||||||
|
"os"
|
||||||
|
"strings"
|
||||||
|
"sync"
|
||||||
|
|
||||||
|
"golang.org/x/crypto/ssh"
|
||||||
|
)
|
||||||
|
|
||||||
|
// TunnelRequest is the metadata a client sends when opening a tunnel channel.
|
||||||
|
type TunnelRequest struct {
|
||||||
|
Domain string `json:"domain"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// SSHServer handles incoming SSH connections and sets up reverse tunnels.
|
||||||
|
type SSHServer struct {
|
||||||
|
config *ssh.ServerConfig
|
||||||
|
pool *PortPool
|
||||||
|
labels *LabelManager
|
||||||
|
mu sync.Mutex
|
||||||
|
activeTuns map[string]*activeTunnel // keyed by sanitized domain
|
||||||
|
}
|
||||||
|
|
||||||
|
type activeTunnel struct {
|
||||||
|
domain string
|
||||||
|
port int
|
||||||
|
listener net.Listener
|
||||||
|
done chan struct{}
|
||||||
|
connKey string // tracks which SSH connection owns this tunnel
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewSSHServer creates a new SSH server with host key and authorized keys.
|
||||||
|
func NewSSHServer(
|
||||||
|
hostKeyPath, authorizedKeysPath string,
|
||||||
|
pool *PortPool,
|
||||||
|
labels *LabelManager,
|
||||||
|
) (*SSHServer, error) {
|
||||||
|
s := &SSHServer{
|
||||||
|
pool: pool,
|
||||||
|
labels: labels,
|
||||||
|
activeTuns: make(map[string]*activeTunnel),
|
||||||
|
}
|
||||||
|
|
||||||
|
config := &ssh.ServerConfig{
|
||||||
|
PublicKeyCallback: s.buildAuthCallback(authorizedKeysPath),
|
||||||
|
}
|
||||||
|
|
||||||
|
hostKeyBytes, err := os.ReadFile(hostKeyPath)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("read host key: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
hostKey, err := ssh.ParsePrivateKey(hostKeyBytes)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("parse host key: %w", err)
|
||||||
|
}
|
||||||
|
config.AddHostKey(hostKey)
|
||||||
|
|
||||||
|
s.config = config
|
||||||
|
return s, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// buildAuthCallback loads authorized keys and returns a public key callback.
|
||||||
|
func (s *SSHServer) buildAuthCallback(
|
||||||
|
path string,
|
||||||
|
) func(ssh.ConnMetadata, ssh.PublicKey) (*ssh.Permissions, error) {
|
||||||
|
allowed := make(map[string]bool)
|
||||||
|
|
||||||
|
data, err := os.ReadFile(path)
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("WARN: cannot read authorized_keys at %s: %v", path, err)
|
||||||
|
return func(_ ssh.ConnMetadata, _ ssh.PublicKey) (*ssh.Permissions, error) {
|
||||||
|
return nil, fmt.Errorf("no authorized keys configured")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, line := range strings.Split(string(data), "\n") {
|
||||||
|
line = strings.TrimSpace(line)
|
||||||
|
if line == "" || strings.HasPrefix(line, "#") {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
pubKey, _, _, _, parseErr := ssh.ParseAuthorizedKey([]byte(line))
|
||||||
|
if parseErr != nil {
|
||||||
|
log.Printf("WARN: skipping bad authorized key: %v", parseErr)
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
allowed[string(pubKey.Marshal())] = true
|
||||||
|
}
|
||||||
|
|
||||||
|
log.Printf("Loaded %d authorized key(s)", len(allowed))
|
||||||
|
|
||||||
|
return func(_ ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
|
||||||
|
if allowed[string(key.Marshal())] {
|
||||||
|
return &ssh.Permissions{}, nil
|
||||||
|
}
|
||||||
|
return nil, fmt.Errorf("unknown public key")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ListenAndServe starts the SSH server on the given address.
|
||||||
|
func (s *SSHServer) ListenAndServe(addr string) error {
|
||||||
|
listener, err := net.Listen("tcp", addr)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("listen on %s: %w", addr, err)
|
||||||
|
}
|
||||||
|
defer listener.Close()
|
||||||
|
|
||||||
|
log.Printf("SSH server listening on %s", addr)
|
||||||
|
|
||||||
|
for {
|
||||||
|
conn, err := listener.Accept()
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("accept error: %v", err)
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
go s.handleConn(conn)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// handleConn performs the SSH handshake and processes channels.
|
||||||
|
func (s *SSHServer) handleConn(netConn net.Conn) {
|
||||||
|
sshConn, chans, reqs, err := ssh.NewServerConn(netConn, s.config)
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("SSH handshake failed from %s: %v", netConn.RemoteAddr(), err)
|
||||||
|
netConn.Close()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
connKey := sshConn.RemoteAddr().String()
|
||||||
|
log.Printf("SSH connection from %s (%s)", connKey, sshConn.User())
|
||||||
|
|
||||||
|
go s.handleGlobalRequests(reqs, sshConn, connKey)
|
||||||
|
|
||||||
|
for newChan := range chans {
|
||||||
|
switch newChan.ChannelType() {
|
||||||
|
case "tunnel-request":
|
||||||
|
go s.handleTunnelChannel(newChan, connKey)
|
||||||
|
case "session":
|
||||||
|
ch, _, chErr := newChan.Accept()
|
||||||
|
if chErr == nil {
|
||||||
|
ch.Close()
|
||||||
|
}
|
||||||
|
default:
|
||||||
|
newChan.Reject(ssh.UnknownChannelType, "unsupported channel type")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
s.cleanupConnection(connKey)
|
||||||
|
log.Printf("SSH connection closed from %s", connKey)
|
||||||
|
}
|
||||||
|
|
||||||
|
// handleTunnelChannel reads tunnel metadata from the custom channel.
|
||||||
|
func (s *SSHServer) handleTunnelChannel(newChan ssh.NewChannel, connKey string) {
|
||||||
|
ch, _, err := newChan.Accept()
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("failed to accept tunnel channel: %v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
buf := make([]byte, 4096)
|
||||||
|
n, err := ch.Read(buf)
|
||||||
|
if err != nil && err != io.EOF {
|
||||||
|
log.Printf("failed to read tunnel metadata: %v", err)
|
||||||
|
ch.Close()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var req TunnelRequest
|
||||||
|
if err := json.Unmarshal(buf[:n], &req); err != nil {
|
||||||
|
log.Printf("invalid tunnel metadata: %v", err)
|
||||||
|
ch.Close()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if req.Domain == "" {
|
||||||
|
ch.Close()
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
log.Printf("Tunnel metadata received: domain=%s (conn=%s)", req.Domain, connKey)
|
||||||
|
|
||||||
|
// Store domain mapping for this connection so forward handler can use it.
|
||||||
|
s.mu.Lock()
|
||||||
|
s.activeTuns[connKey+"-meta"] = &activeTunnel{
|
||||||
|
domain: req.Domain,
|
||||||
|
connKey: connKey,
|
||||||
|
}
|
||||||
|
s.mu.Unlock()
|
||||||
|
|
||||||
|
// Keep channel open as heartbeat / disconnect signal.
|
||||||
|
io.Copy(io.Discard, ch)
|
||||||
|
}
|
||||||
|
|
||||||
|
// SanitizeDomain converts a domain name into a safe label key.
|
||||||
|
func SanitizeDomain(domain string) string {
|
||||||
|
r := strings.NewReplacer(".", "-", ":", "-", "/", "-")
|
||||||
|
return strings.ToLower(r.Replace(strings.TrimSpace(domain)))
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,251 @@
|
||||||
|
package server
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"log"
|
||||||
|
"net"
|
||||||
|
"sync"
|
||||||
|
|
||||||
|
"golang.org/x/crypto/ssh"
|
||||||
|
)
|
||||||
|
|
||||||
|
// PortPool manages a pool of available ports for reverse tunnels.
|
||||||
|
type PortPool struct {
|
||||||
|
mu sync.Mutex
|
||||||
|
available map[int]bool
|
||||||
|
start int
|
||||||
|
end int
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewPortPool creates a port pool for the given range [start, end].
|
||||||
|
func NewPortPool(start, end int) *PortPool {
|
||||||
|
available := make(map[int]bool, end-start+1)
|
||||||
|
for p := start; p <= end; p++ {
|
||||||
|
available[p] = true
|
||||||
|
}
|
||||||
|
return &PortPool{
|
||||||
|
available: available,
|
||||||
|
start: start,
|
||||||
|
end: end,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Allocate claims an available port from the pool.
|
||||||
|
func (pp *PortPool) Allocate() (int, error) {
|
||||||
|
pp.mu.Lock()
|
||||||
|
defer pp.mu.Unlock()
|
||||||
|
|
||||||
|
for port, free := range pp.available {
|
||||||
|
if free {
|
||||||
|
pp.available[port] = false
|
||||||
|
return port, nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return 0, fmt.Errorf("no ports available in range %d-%d", pp.start, pp.end)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Release returns a port to the pool.
|
||||||
|
func (pp *PortPool) Release(port int) {
|
||||||
|
pp.mu.Lock()
|
||||||
|
defer pp.mu.Unlock()
|
||||||
|
pp.available[port] = true
|
||||||
|
}
|
||||||
|
|
||||||
|
// tcpipForwardRequest matches the SSH tcpip-forward request payload.
|
||||||
|
type tcpipForwardRequest struct {
|
||||||
|
BindAddr string
|
||||||
|
BindPort uint32
|
||||||
|
}
|
||||||
|
|
||||||
|
// tcpipForwardResponse matches the SSH tcpip-forward response payload.
|
||||||
|
type tcpipForwardResponse struct {
|
||||||
|
BoundPort uint32
|
||||||
|
}
|
||||||
|
|
||||||
|
// forwardedTCPPayload matches the SSH forwarded-tcpip channel data.
|
||||||
|
type forwardedTCPPayload struct {
|
||||||
|
Addr string
|
||||||
|
Port uint32
|
||||||
|
OriginAddr string
|
||||||
|
OriginPort uint32
|
||||||
|
}
|
||||||
|
|
||||||
|
// handleGlobalRequests processes SSH global requests (tcpip-forward).
|
||||||
|
func (s *SSHServer) handleGlobalRequests(
|
||||||
|
reqs <-chan *ssh.Request,
|
||||||
|
sshConn *ssh.ServerConn,
|
||||||
|
connKey string,
|
||||||
|
) {
|
||||||
|
for req := range reqs {
|
||||||
|
switch req.Type {
|
||||||
|
case "tcpip-forward":
|
||||||
|
s.handleForwardRequest(req, sshConn, connKey)
|
||||||
|
default:
|
||||||
|
if req.WantReply {
|
||||||
|
req.Reply(false, nil)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// handleForwardRequest handles a tcpip-forward global request.
|
||||||
|
func (s *SSHServer) handleForwardRequest(
|
||||||
|
req *ssh.Request,
|
||||||
|
sshConn *ssh.ServerConn,
|
||||||
|
connKey string,
|
||||||
|
) {
|
||||||
|
var fwdReq tcpipForwardRequest
|
||||||
|
if err := ssh.Unmarshal(req.Payload, &fwdReq); err != nil {
|
||||||
|
log.Printf("invalid tcpip-forward payload: %v", err)
|
||||||
|
req.Reply(false, nil)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
log.Printf("tcpip-forward request: bind=%s:%d from %s", fwdReq.BindAddr, fwdReq.BindPort, connKey)
|
||||||
|
|
||||||
|
// Allocate a port from the pool.
|
||||||
|
port, err := s.pool.Allocate()
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("port allocation failed: %v", err)
|
||||||
|
req.Reply(false, nil)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// Start a listener on the allocated port.
|
||||||
|
listenAddr := fmt.Sprintf("0.0.0.0:%d", port)
|
||||||
|
listener, err := net.Listen("tcp", listenAddr)
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("failed to listen on %s: %v", listenAddr, err)
|
||||||
|
s.pool.Release(port)
|
||||||
|
req.Reply(false, nil)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// Reply with the bound port.
|
||||||
|
resp := tcpipForwardResponse{BoundPort: uint32(port)}
|
||||||
|
req.Reply(true, ssh.Marshal(&resp))
|
||||||
|
log.Printf("Allocated port %d for forwarding (conn=%s)", port, connKey)
|
||||||
|
|
||||||
|
// Accept connections on the allocated port and forward through SSH.
|
||||||
|
done := make(chan struct{})
|
||||||
|
go func() {
|
||||||
|
defer close(done)
|
||||||
|
acceptForwardedConnections(listener, sshConn, fwdReq.BindAddr, uint32(port))
|
||||||
|
}()
|
||||||
|
|
||||||
|
// Determine the domain for Traefik label registration.
|
||||||
|
// Look up the metadata channel first, fall back to bind address.
|
||||||
|
domain := fwdReq.BindAddr
|
||||||
|
s.mu.Lock()
|
||||||
|
if meta, ok := s.activeTuns[connKey+"-meta"]; ok {
|
||||||
|
domain = meta.domain
|
||||||
|
}
|
||||||
|
s.mu.Unlock()
|
||||||
|
|
||||||
|
tunKey := SanitizeDomain(domain)
|
||||||
|
if tunKey == "" {
|
||||||
|
tunKey = fmt.Sprintf("port-%d", port)
|
||||||
|
}
|
||||||
|
|
||||||
|
tun := &activeTunnel{
|
||||||
|
domain: domain,
|
||||||
|
port: port,
|
||||||
|
listener: listener,
|
||||||
|
done: done,
|
||||||
|
connKey: connKey,
|
||||||
|
}
|
||||||
|
|
||||||
|
s.mu.Lock()
|
||||||
|
s.activeTuns[tunKey] = tun
|
||||||
|
s.mu.Unlock()
|
||||||
|
|
||||||
|
// Register Traefik labels.
|
||||||
|
if err := s.labels.Add(tunKey, domain, port); err != nil {
|
||||||
|
log.Printf("WARN: failed to add Traefik labels for %s: %v", domain, err)
|
||||||
|
} else {
|
||||||
|
log.Printf("Traefik labels added for %s -> port %d", domain, port)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// acceptForwardedConnections accepts TCP connections and opens SSH channels.
|
||||||
|
func acceptForwardedConnections(
|
||||||
|
listener net.Listener,
|
||||||
|
sshConn *ssh.ServerConn,
|
||||||
|
bindAddr string,
|
||||||
|
bindPort uint32,
|
||||||
|
) {
|
||||||
|
for {
|
||||||
|
conn, err := listener.Accept()
|
||||||
|
if err != nil {
|
||||||
|
return // listener closed
|
||||||
|
}
|
||||||
|
go forwardConnection(conn, sshConn, bindAddr, bindPort)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// forwardConnection forwards a single TCP connection through the SSH channel.
|
||||||
|
func forwardConnection(
|
||||||
|
conn net.Conn,
|
||||||
|
sshConn *ssh.ServerConn,
|
||||||
|
bindAddr string,
|
||||||
|
bindPort uint32,
|
||||||
|
) {
|
||||||
|
defer conn.Close()
|
||||||
|
|
||||||
|
originAddr, originPortStr, _ := net.SplitHostPort(conn.RemoteAddr().String())
|
||||||
|
var originPort int
|
||||||
|
fmt.Sscanf(originPortStr, "%d", &originPort)
|
||||||
|
|
||||||
|
payload := forwardedTCPPayload{
|
||||||
|
Addr: bindAddr,
|
||||||
|
Port: bindPort,
|
||||||
|
OriginAddr: originAddr,
|
||||||
|
OriginPort: uint32(originPort),
|
||||||
|
}
|
||||||
|
|
||||||
|
ch, reqs, err := sshConn.OpenChannel("forwarded-tcpip", ssh.Marshal(&payload))
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("failed to open forwarded-tcpip channel: %v", err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
go ssh.DiscardRequests(reqs)
|
||||||
|
|
||||||
|
// Bidirectional copy.
|
||||||
|
var wg sync.WaitGroup
|
||||||
|
wg.Add(2)
|
||||||
|
go func() {
|
||||||
|
defer wg.Done()
|
||||||
|
io.Copy(ch, conn)
|
||||||
|
ch.CloseWrite()
|
||||||
|
}()
|
||||||
|
go func() {
|
||||||
|
defer wg.Done()
|
||||||
|
io.Copy(conn, ch)
|
||||||
|
}()
|
||||||
|
wg.Wait()
|
||||||
|
}
|
||||||
|
|
||||||
|
// cleanupConnection removes all tunnels associated with a closed SSH connection.
|
||||||
|
func (s *SSHServer) cleanupConnection(connKey string) {
|
||||||
|
s.mu.Lock()
|
||||||
|
defer s.mu.Unlock()
|
||||||
|
|
||||||
|
for key, tun := range s.activeTuns {
|
||||||
|
if tun.connKey != connKey {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
if tun.listener != nil {
|
||||||
|
tun.listener.Close()
|
||||||
|
s.pool.Release(tun.port)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := s.labels.Remove(key); err != nil {
|
||||||
|
log.Printf("WARN: failed to remove labels for %s: %v", key, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
log.Printf("Cleaned up tunnel %s (port %d, conn=%s)", key, tun.port, connKey)
|
||||||
|
delete(s.activeTuns, key)
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue