# SSH relay: expose tunnel-server on sms.taylor-co.com:2222 while the real
# tunnel-server stays on ingress (or another host). Same Pi keys and
# authorized_keys as today — only TUNNEL_SERVER changes.
#
# Usage on the SMS host:
#   export RELAY_UPSTREAM=ingress.nixc.us:2222
#   docker compose -f ssh-relay.compose.yml up -d
#
# Pis: TUNNEL_SERVER=sms.taylor-co.com:2222

services:
  tunnel-ssh-relay:
    image: alpine:3.21
    restart: unless-stopped
    command:
      - /bin/sh
      - -c
      - |
        set -e
        apk add --no-cache socat
        UP="$${RELAY_UPSTREAM:-ingress.nixc.us:2222}"
        echo "relay: 0.0.0.0:2222 -> $$UP"
        exec socat TCP-LISTEN:2222,fork,reuseaddr TCP:$$UP
    ports:
      - "2222:2222"
    environment:
      RELAY_UPSTREAM: ${RELAY_UPSTREAM:-ingress.nixc.us:2222}