feat!: remove rathole package - superseded by netbird [#650]

Founder ruling: "we will use netbird for all enterprise network access." Package dir deleted (11th package, f918a90, is hereby retired); GitUrlList 41->40; counts 19->18; completed tables renumbered; JOURNAL section retained as history with a superseding addendum. Standing policy recorded: netbird for network access.
2026-09-06 19:54:56 -05:00
parent c77e596ecd
commit 7e054facad
13 changed files with 35 additions and 362 deletions
@@ -1 +0,0 @@
-repo
@@ -1,8 +0,0 @@
-# Rathole Cloudron package — environment knobs
-#
-# Cloudron injects these at runtime (App -> Configure -> Environment);
-# they are not secrets.
-
-# Log level for the rathole server: error | warn | info | debug | trace.
-# Default when unset: info
-RUST_LOG=info
@@ -1,27 +0,0 @@
-# Changelog — Rathole Cloudron Package
-
-## 1.0.0 (2026-09-01)
-
-Initial Cloudron package for Rathole 0.5.0 (server mode).
-
- Pre-compiled-binaries pattern: upstream `x86_64-unknown-linux-gnu`
-  release zip downloaded at build time behind a sha256 pin (musl release
-  builds were dropped upstream in v0.5.0).
- Runtime `cloudron/base:4.0.0` (Ubuntu 22.04): the gnu binary requires
-  glibc >= 2.35, too new for the 3.x (20.04) base used by earlier
-  packages.
- `start.sh` seeds `/app/data/server.toml` on first run with a random
-  `default_token` (openssl) and a placeholder `[server.services.example]`
-  binding :5200 — upstream rejects a server config with zero services —
-  then execs `rathole --server`; the config hot-reloads on save.
- Verified end-to-end at build time: a client container tunneled its own
-  HTTP server through the packaged server (token auth, lazy service bind,
-  hot-reload of added services).
- TCP surface: control channel on 2333 + a 100-port tunnel exit range
-  (5200-5299) declared via `tcpPorts` with `containerPort`/`portCount`.
- No user concept → `httpAuth.type = proxy` gates a small static status
-  page served on the HTTP port (also serves as the platform health
-  check); tunnel access itself is controlled by rathole's mandatory
-  per-service tokens.
- Addons: `localstorage` only (config persistence; no database).
- Logo padded from the upstream wordmark to a 256x256 PNG.
@@ -1,43 +0,0 @@
-{
-  "manifestVersion": 2,
-  "type": "app",
-  "id": "io.cloudron.rathole",
-  "title": "Rathole",
-  "description": "Rathole is a secure, stable and high-performance reverse proxy for NAT traversal, written in Rust. This package runs the server side: clients behind NAT connect to the control port with per-service token authentication (optionally Noise/TLS encrypted) and expose their local services through tunnels on the reserved port range. Configuration lives in /app/data/server.toml and hot-reloads on save. No database required.",
-  "author": "rapiz1 / rathole-org",
-  "website": "https://github.com/rathole-org/rathole",
-  "documentationUrl": "https://github.com/rathole-org/rathole/blob/main/README.md",
-  "contactEmail": "cloudron@tsys.dev",
-  "tagline": "Secure, high-performance reverse-tunnel server for NAT traversal",
-  "version": "0.5.0",
-  "upstreamVersion": "0.5.0",
-  "healthCheckPath": "/",
-  "httpPort": 8000,
-  "httpAuth": {
-    "type": "proxy"
-  },
-  "tcpPorts": {
-    "CONTROL_PORT": {
-      "title": "Control channel port",
-      "description": "TCP port that rathole clients connect to in order to establish tunnels. Change only if it collides with another exposed app on this Cloudron.",
-      "defaultValue": 2333,
-      "containerPort": 2333,
-      "portCount": 1
-    },
-    "SERVICE_PORT": {
-      "title": "Tunnel exit ports",
-      "description": "Start of the sequential port range reserved for tunneled services (100 ports by default: 5200-5299). Each [server.services.*] block in /app/data/server.toml binds one port from this range; the config hot-reloads, so services can be added without a restart.",
-      "defaultValue": 5200,
-      "containerPort": 5200,
-      "portCount": 100
-    }
-  },
-  "memoryLimit": 268435456,
-  "addons": {
-    "localstorage": {}
-  },
-  "postInstallMessage": "Rathole is headless: there is nothing to click through. Open the **file manager** and edit **/app/data/server.toml** to define tunnel services (a random default token was generated on first start). The config hot-reloads on save. The client-side setup is documented in the package README.",
-  "mediaLinks": [],
-  "changelog": "Initial Cloudron package for Rathole 0.5.0 (server mode). Pre-compiled upstream binary with sha256 pin, token-authenticated tunnels on control port 2333 plus a 100-port service range (5200-5299), config with hot reload at /app/data/server.toml, and an auth-proxied status page on the HTTP port.",
-  "icon": "file://logo.png"
-}
@@ -1,48 +0,0 @@
-# Rathole Cloudron Package
-#
-# Rathole is a secure, stable and high-performance reverse proxy for NAT
-# traversal (frp/ngrok class, written in Rust). This package runs the
-# SERVER side: the Cloudron box is the public-IP endpoint, rathole clients
-# behind NAT dial the control port (2333) and expose their local services
-# through token-authenticated tunnels on the 5200+ port range.
-#
-# Upstream: https://github.com/rathole-org/rathole (v0.5.0)
-#   - Ships a prebuilt x86_64-unknown-linux-gnu release binary (musl
-#     release builds were dropped upstream in v0.5.0)
-#   - No database, no user accounts; per-service tokens are mandatory
-#
-# Authentication: Rathole has NO user concept (tunnels are authorized by
-# per-service tokens, optionally Noise/TLS encrypted at the transport
-# layer). The status page on the HTTP port is gated by Cloudron's
-# authentication proxy (httpAuth.type = proxy).
-#
-# Base image: cloudron/base:4.0.0 (Ubuntu 22.04). The upstream gnu binary
-# is built on ubuntu-latest, so the runtime needs glibc >= 2.35 —
-# cloudron/base:3.2.0 (20.04) is too old for it.
-FROM cloudron/base:4.0.0
-
-ARG RATHOLE_VERSION=0.5.0
-ARG RATHOLE_SHA256=3e7d0d0f365120cd3cd351d147d1a12ee960c8068b464d4dd533a3821873b80e
-
-# Pre-compiled-binaries pattern (see JOURNAL.md): download the pinned
-# upstream release, verify the sha256 gate, install the binary.
-RUN curl -fsSL -o /tmp/rathole.zip \
-      "https://github.com/rathole-org/rathole/releases/download/v${RATHOLE_VERSION}/rathole-x86_64-unknown-linux-gnu.zip" \
- && echo "${RATHOLE_SHA256}  /tmp/rathole.zip" | sha256sum -c - \
- && unzip -o /tmp/rathole.zip -d /usr/local/bin \
- && chmod +x /usr/local/bin/rathole \
- && rm -f /tmp/rathole.zip \
- && /usr/local/bin/rathole --version
-
-# Static status page served on the Cloudron HTTP port (platform health
-# check + auth-proxied landing page). start.sh seeds /app/data/server.toml
-# on first run and execs rathole in server mode. start.sh is made
-# executable on the host, not at build time (Cloudron gotcha).
-COPY status.html /app/code/status/index.html
-COPY start.sh /app/start.sh
-
-WORKDIR /app/data
-
-EXPOSE 8000 2333 5200-5299
-
-CMD ["/bin/bash", "/app/start.sh"]
@@ -1,95 +0,0 @@
-# Rathole — Cloudron Package
-
-[Rathole](https://github.com/rathole-org/rathole) is a secure, stable and
-high-performance reverse proxy for NAT traversal (frp/ngrok class, written
-in Rust). This package runs the **server** side: the Cloudron box is the
-public-IP endpoint, rathole clients behind NAT dial the control port, and
-their local services are exposed through token-authenticated tunnels.
-
-## Packaging overview
-
-| Aspect | Choice |
-|--------|--------|
-| Pattern | Pre-compiled binaries (JOURNAL pattern #5) |
-| Base image | `cloudron/base:4.0.0` (Ubuntu 22.04) |
-| Upstream binary | `rathole-x86_64-unknown-linux-gnu.zip`, v0.5.0, sha256-pinned in Dockerfile |
-| Addons | `localstorage` only (config persistence; no database) |
-| Auth | No user concept → `httpAuth.type = proxy` (see below) |
-| Runtime | `start.sh` seeds config, serves status page, execs rathole `--server` |
-
-Why pre-compiled: upstream ships release binaries and **dropped the musl
-builds in v0.5.0** (only `x86_64-unknown-linux-gnu` remains for Linux
-amd64). The gnu binary is built on ubuntu-latest, so the runtime needs
-glibc >= 2.35 — hence `cloudron/base:4.0.0` (22.04) instead of the 3.x
-series (20.04). Compiling from source would need a full Rust toolchain
-build stage for no benefit.
-
-## Authentication (auth gate verdict: proxy)
-
- Rathole has **no user concept**: no web UI, no accounts, no SSO hooks.
- Tunnels are authorized by **mandatory per-service tokens** (a random
-  `default_token` is generated into `/app/data/server.toml` on first
-  start). Transport can additionally be encrypted via Noise or TLS.
- The manifest declares `httpAuth: {"type": "proxy"}`: Cloudron's auth
-  proxy gates the HTTP status page, which is the only HTTP surface this
-  app has. The raw TCP tunnel ports cannot be HTTP-gated by design; the
-  token layer is their access control.
-
-## Ports
-
-| Port | Type | Purpose |
-|------|------|---------|
-| 8000 | `httpPort` | Status/health page (behind Cloudron auth proxy) |
-| 2333 | `tcpPorts` | Control channel — rathole clients connect here |
-| 5200–5299 | `tcpPorts` (100-port range) | Tunnel exit ports — one per `[server.services.*]` |
-
-With default install settings Cloudron bridges these 1:1 (external
-5200-5299 → container 5200-5299). If the admin picks a different
-`SERVICE_PORT` start value, the *container* ports stay 5200+ and only the
-external numbering shifts — `server.toml` never needs editing for that.
-
-## Configuration
-
-`/app/data/server.toml`, seeded on first run, **hot-reloaded on save**
-(add/remove services without restarting the app). The seed contains a
-placeholder `[server.services.example]` on :5200 — rathole rejects a
-server config with zero services, so keep at least one block. Example
-service:
-
-```toml
-[server.services.my_nas_ssh]
-token = "<copy from default_token or set your own>"
-bind_addr = "0.0.0.0:5200"
-```
-
-Client side (machine behind NAT):
-
-```toml
-[client]
-remote_addr = "your-cloudron.example.com:2333"
-
-[client.services.my_nas_ssh]
-token = "<same token as the server>"
-local_addr = "127.0.0.1:22"
-```
-
-Then `ssh -p 5200 user@your-cloudron.example.com` reaches the NAS.
-
-Knob: `RUST_LOG` (error|warn|info|debug|trace, default `info`) via
-Cloudron environment settings — see `.env.example`.
-
-## Build & test
-
-```bash
-docker build --cgroup-parent ukrrs-batch.slice -t rathole-cloudron:test Package-Workspace/Infrastructure/rathole/
-docker run --rm --entrypoint /usr/local/bin/rathole rathole-cloudron:test --version
-```
-
-## Files
-
- `Dockerfile` — pinned release download + sha256 gate on cloudron/base:4.0.0
- `CloudronManifest.json` — manifestVersion 2, httpAuth proxy, tcpPorts (control + 100-port service range)
- `start.sh` — config seeding, status page, exec rathole server mode
- `status.html` — auth-proxied landing/health page
- `.env.example` — runtime knobs
- `logo.png` — 256x256, padded from upstream wordmark
@@ -1,54 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-# Rathole runs in SERVER mode on Cloudron: the box has the public IP and
-# rathole clients behind NAT dial in on the control port (container port
-# 2333, bridged 1:1 by default). Tunneled services bind container ports
-# 5200-5299, which Cloudron exposes in sequence from the SERVICE_PORT
-# value chosen at install time.
-#
-# Rathole has no HTTP interface of its own, so a tiny static status page
-# is served on the Cloudron HTTP port. That gives the platform a health
-# check endpoint and gives the admin an auth-proxied landing page
-# (httpAuth.type = proxy gates it at the platform edge).
-
-export RATHOLE_CONFIG="/app/data/server.toml"
-
-if [[ ! -f "${RATHOLE_CONFIG}" ]]; then
-  default_token="$(openssl rand -hex 24)"
-  cat > "${RATHOLE_CONFIG}" <<EOF
-# rathole server configuration — hot-reloaded on save, no restart needed.
-# Full reference: https://github.com/rathole-org/rathole#configuration
-
-[server]
-bind_addr = "0.0.0.0:2333"
-default_token = "${default_token}"
-heartbeat_interval = 30
-
-[server.transport]
-type = "tcp"
-
-[server.transport.tcp]
-nodelay = true
-
-# At least one service block must exist — rathole rejects a server config
-# with no services. This placeholder listens on the first tunnel port and
-# forwards whatever the matching client sends. Rename it or add more
-# blocks; each bind_addr must use a distinct port from the reserved range
-# (5200-5299 with default install settings). Hot-reloads on save.
-[server.services.example]
-token = "${default_token}"
-bind_addr = "0.0.0.0:5200"
-
-#[server.services.my_web_app]
-#token = "another_secret"
-#bind_addr = "0.0.0.0:5201"
-EOF
-  echo "Seeded default config at ${RATHOLE_CONFIG} (random default_token generated)"
-fi
-
-# Status page (health check + auth-proxied landing page) in the background;
-# rathole stays in the foreground as PID-friendly main process.
-python3 -m http.server "${CLOUDRON_HTTP_PORT:-8000}" --directory /app/code/status &
-
-exec /usr/local/bin/rathole --server "${RATHOLE_CONFIG}"
@@ -1,51 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Rathole (server)</title>
-<style>
-  body { font-family: -apple-system, "Segoe UI", Roboto, sans-serif; background: #14171c; color: #d8dee6; margin: 0; display: flex; min-height: 100vh; align-items: center; justify-content: center; }
-  main { max-width: 640px; padding: 2rem; }
-  h1 { color: #ffffff; font-size: 1.6rem; margin-bottom: 0.25rem; }
-  p.tagline { color: #7f8c9b; margin-top: 0; }
-  code { background: #1f242c; border: 1px solid #2d3440; border-radius: 4px; padding: 0.1rem 0.35rem; font-size: 0.85rem; color: #9ecbff; }
-  table { border-collapse: collapse; width: 100%; margin: 1rem 0; font-size: 0.9rem; }
-  th, td { text-align: left; padding: 0.5rem 0.75rem; border-bottom: 1px solid #2d3440; }
-  th { color: #7f8c9b; font-weight: 600; }
-  pre { background: #1f242c; border: 1px solid #2d3440; border-radius: 6px; padding: 1rem; overflow-x: auto; font-size: 0.8rem; line-height: 1.5; }
-  .ok { color: #6bc46d; }
-</style>
-</head>
-<body>
-<main>
-  <h1>Rathole <span class="ok">&#9650; server running</span></h1>
-  <p class="tagline">Secure, high-performance reverse-tunnel server for NAT traversal</p>
-
-  <p>Rathole is headless &mdash; this page exists so Cloudron has a health
-  endpoint and you have a landing spot. Configuration is file-based and
-  <strong>hot-reloads on save</strong>: edit
-  <code>/app/data/server.toml</code> with the Cloudron file manager to add
-  or remove tunnel services. A random <code>default_token</code> was
-  generated on first start; copy it from that file.</p>
-
-  <table>
-    <tr><th>Port</th><th>Purpose</th></tr>
-    <tr><td>2333</td><td>Control channel &mdash; rathole clients connect here</td></tr>
-    <tr><td>5200&ndash;5299</td><td>Tunnel exit ports &mdash; one per <code>[server.services.*]</code> block</td></tr>
-    <tr><td>HTTP (this page)</td><td>Status/health only, gated by the Cloudron auth proxy</td></tr>
-  </table>
-
-  <p>Client side (on the machine behind NAT), with a matching service block on the server:</p>
-  <pre>[client]
-remote_addr = "your-cloudron.example.com:2333"
-
-[client.services.my_nas_ssh]
-token = "&lt;same token as the server&gt;"
-local_addr = "127.0.0.1:22"</pre>
-
-  <p style="color:#7f8c9b;font-size:0.85rem;">Upstream docs:
-  <a style="color:#9ecbff" href="https://github.com/rathole-org/rathole">github.com/rathole-org/rathole</a></p>
-</main>
-</body>
-</html>