feat: add Rathole Cloudron package (Infrastructure) [#650]

Server-mode Rathole 0.5.0 as the 11th package: pinned upstream binary (sha256 gate) on cloudron/base:4.0.0, control port 2333 plus a 100-port tunnel exit range, hot-reloading config in /app/data, auth-proxy verdict (no user concept). Verified end-to-end with a live client tunnel. Docs gardened (STATUS/README/JOURNAL to 11 packages). Ticket: https://projects.knownelement.com/issues/650
2026-09-01 19:02:51 -05:00
parent 8d0b0f42f6
commit f918a90c3b
12 changed files with 415 additions and 13 deletions
@@ -0,0 +1,48 @@
+# Rathole Cloudron Package
+#
+# Rathole is a secure, stable and high-performance reverse proxy for NAT
+# traversal (frp/ngrok class, written in Rust). This package runs the
+# SERVER side: the Cloudron box is the public-IP endpoint, rathole clients
+# behind NAT dial the control port (2333) and expose their local services
+# through token-authenticated tunnels on the 5200+ port range.
+#
+# Upstream: https://github.com/rathole-org/rathole (v0.5.0)
+#   - Ships a prebuilt x86_64-unknown-linux-gnu release binary (musl
+#     release builds were dropped upstream in v0.5.0)
+#   - No database, no user accounts; per-service tokens are mandatory
+#
+# Authentication: Rathole has NO user concept (tunnels are authorized by
+# per-service tokens, optionally Noise/TLS encrypted at the transport
+# layer). The status page on the HTTP port is gated by Cloudron's
+# authentication proxy (httpAuth.type = proxy).
+#
+# Base image: cloudron/base:4.0.0 (Ubuntu 22.04). The upstream gnu binary
+# is built on ubuntu-latest, so the runtime needs glibc >= 2.35 —
+# cloudron/base:3.2.0 (20.04) is too old for it.
+FROM cloudron/base:4.0.0
+
+ARG RATHOLE_VERSION=0.5.0
+ARG RATHOLE_SHA256=3e7d0d0f365120cd3cd351d147d1a12ee960c8068b464d4dd533a3821873b80e
+
+# Pre-compiled-binaries pattern (see JOURNAL.md): download the pinned
+# upstream release, verify the sha256 gate, install the binary.
+RUN curl -fsSL -o /tmp/rathole.zip \
+      "https://github.com/rathole-org/rathole/releases/download/v${RATHOLE_VERSION}/rathole-x86_64-unknown-linux-gnu.zip" \
+ && echo "${RATHOLE_SHA256}  /tmp/rathole.zip" | sha256sum -c - \
+ && unzip -o /tmp/rathole.zip -d /usr/local/bin \
+ && chmod +x /usr/local/bin/rathole \
+ && rm -f /tmp/rathole.zip \
+ && /usr/local/bin/rathole --version
+
+# Static status page served on the Cloudron HTTP port (platform health
+# check + auth-proxied landing page). start.sh seeds /app/data/server.toml
+# on first run and execs rathole in server mode. start.sh is made
+# executable on the host, not at build time (Cloudron gotcha).
+COPY status.html /app/code/status/index.html
+COPY start.sh /app/start.sh
+
+WORKDIR /app/data
+
+EXPOSE 8000 2333 5200-5299
+
+CMD ["/bin/bash", "/app/start.sh"]