feat: add Rathole Cloudron package (Infrastructure) [#650]

Server-mode Rathole 0.5.0 as the 11th package: pinned upstream binary (sha256 gate) on cloudron/base:4.0.0, control port 2333 plus a 100-port tunnel exit range, hot-reloading config in /app/data, auth-proxy verdict (no user concept). Verified end-to-end with a live client tunnel. Docs gardened (STATUS/README/JOURNAL to 11 packages). Ticket: https://projects.knownelement.com/issues/650
2026-09-01 19:02:51 -05:00
parent 8d0b0f42f6
commit f918a90c3b
12 changed files with 415 additions and 13 deletions
@@ -0,0 +1,54 @@
+#!/bin/bash
+set -euo pipefail
+
+# Rathole runs in SERVER mode on Cloudron: the box has the public IP and
+# rathole clients behind NAT dial in on the control port (container port
+# 2333, bridged 1:1 by default). Tunneled services bind container ports
+# 5200-5299, which Cloudron exposes in sequence from the SERVICE_PORT
+# value chosen at install time.
+#
+# Rathole has no HTTP interface of its own, so a tiny static status page
+# is served on the Cloudron HTTP port. That gives the platform a health
+# check endpoint and gives the admin an auth-proxied landing page
+# (httpAuth.type = proxy gates it at the platform edge).
+
+export RATHOLE_CONFIG="/app/data/server.toml"
+
+if [[ ! -f "${RATHOLE_CONFIG}" ]]; then
+  default_token="$(openssl rand -hex 24)"
+  cat > "${RATHOLE_CONFIG}" <<EOF
+# rathole server configuration — hot-reloaded on save, no restart needed.
+# Full reference: https://github.com/rathole-org/rathole#configuration
+
+[server]
+bind_addr = "0.0.0.0:2333"
+default_token = "${default_token}"
+heartbeat_interval = 30
+
+[server.transport]
+type = "tcp"
+
+[server.transport.tcp]
+nodelay = true
+
+# At least one service block must exist — rathole rejects a server config
+# with no services. This placeholder listens on the first tunnel port and
+# forwards whatever the matching client sends. Rename it or add more
+# blocks; each bind_addr must use a distinct port from the reserved range
+# (5200-5299 with default install settings). Hot-reloads on save.
+[server.services.example]
+token = "${default_token}"
+bind_addr = "0.0.0.0:5200"
+
+#[server.services.my_web_app]
+#token = "another_secret"
+#bind_addr = "0.0.0.0:5201"
+EOF
+  echo "Seeded default config at ${RATHOLE_CONFIG} (random default_token generated)"
+fi
+
+# Status page (health check + auth-proxied landing page) in the background;
+# rathole stays in the foreground as PID-friendly main process.
+python3 -m http.server "${CLOUDRON_HTTP_PORT:-8000}" --directory /app/code/status &
+
+exec /usr/local/bin/rathole --server "${RATHOLE_CONFIG}"