mrcharles
f918a90c3b
Server-mode Rathole 0.5.0 as the 11th package: pinned upstream binary (sha256 gate) on cloudron/base:4.0.0, control port 2333 plus a 100-port tunnel exit range, hot-reloading config in /app/data, auth-proxy verdict (no user concept). Verified end-to-end with a live client tunnel. Docs gardened (STATUS/README/JOURNAL to 11 packages). Ticket: https://projects.knownelement.com/issues/650
49 lines
2.1 KiB
Docker
49 lines
2.1 KiB
Docker
# Rathole Cloudron Package
|
|
#
|
|
# Rathole is a secure, stable and high-performance reverse proxy for NAT
|
|
# traversal (frp/ngrok class, written in Rust). This package runs the
|
|
# SERVER side: the Cloudron box is the public-IP endpoint, rathole clients
|
|
# behind NAT dial the control port (2333) and expose their local services
|
|
# through token-authenticated tunnels on the 5200+ port range.
|
|
#
|
|
# Upstream: https://github.com/rathole-org/rathole (v0.5.0)
|
|
# - Ships a prebuilt x86_64-unknown-linux-gnu release binary (musl
|
|
# release builds were dropped upstream in v0.5.0)
|
|
# - No database, no user accounts; per-service tokens are mandatory
|
|
#
|
|
# Authentication: Rathole has NO user concept (tunnels are authorized by
|
|
# per-service tokens, optionally Noise/TLS encrypted at the transport
|
|
# layer). The status page on the HTTP port is gated by Cloudron's
|
|
# authentication proxy (httpAuth.type = proxy).
|
|
#
|
|
# Base image: cloudron/base:4.0.0 (Ubuntu 22.04). The upstream gnu binary
|
|
# is built on ubuntu-latest, so the runtime needs glibc >= 2.35 —
|
|
# cloudron/base:3.2.0 (20.04) is too old for it.
|
|
FROM cloudron/base:4.0.0
|
|
|
|
ARG RATHOLE_VERSION=0.5.0
|
|
ARG RATHOLE_SHA256=3e7d0d0f365120cd3cd351d147d1a12ee960c8068b464d4dd533a3821873b80e
|
|
|
|
# Pre-compiled-binaries pattern (see JOURNAL.md): download the pinned
|
|
# upstream release, verify the sha256 gate, install the binary.
|
|
RUN curl -fsSL -o /tmp/rathole.zip \
|
|
"https://github.com/rathole-org/rathole/releases/download/v${RATHOLE_VERSION}/rathole-x86_64-unknown-linux-gnu.zip" \
|
|
&& echo "${RATHOLE_SHA256} /tmp/rathole.zip" | sha256sum -c - \
|
|
&& unzip -o /tmp/rathole.zip -d /usr/local/bin \
|
|
&& chmod +x /usr/local/bin/rathole \
|
|
&& rm -f /tmp/rathole.zip \
|
|
&& /usr/local/bin/rathole --version
|
|
|
|
# Static status page served on the Cloudron HTTP port (platform health
|
|
# check + auth-proxied landing page). start.sh seeds /app/data/server.toml
|
|
# on first run and execs rathole in server mode. start.sh is made
|
|
# executable on the host, not at build time (Cloudron gotcha).
|
|
COPY status.html /app/code/status/index.html
|
|
COPY start.sh /app/start.sh
|
|
|
|
WORKDIR /app/data
|
|
|
|
EXPOSE 8000 2333 5200-5299
|
|
|
|
CMD ["/bin/bash", "/app/start.sh"]
|