mrcharles
f918a90c3b
Server-mode Rathole 0.5.0 as the 11th package: pinned upstream binary (sha256 gate) on cloudron/base:4.0.0, control port 2333 plus a 100-port tunnel exit range, hot-reloading config in /app/data, auth-proxy verdict (no user concept). Verified end-to-end with a live client tunnel. Docs gardened (STATUS/README/JOURNAL to 11 packages). Ticket: https://projects.knownelement.com/issues/650
55 lines
2.0 KiB
Bash
Executable File
55 lines
2.0 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
# Rathole runs in SERVER mode on Cloudron: the box has the public IP and
|
|
# rathole clients behind NAT dial in on the control port (container port
|
|
# 2333, bridged 1:1 by default). Tunneled services bind container ports
|
|
# 5200-5299, which Cloudron exposes in sequence from the SERVICE_PORT
|
|
# value chosen at install time.
|
|
#
|
|
# Rathole has no HTTP interface of its own, so a tiny static status page
|
|
# is served on the Cloudron HTTP port. That gives the platform a health
|
|
# check endpoint and gives the admin an auth-proxied landing page
|
|
# (httpAuth.type = proxy gates it at the platform edge).
|
|
|
|
export RATHOLE_CONFIG="/app/data/server.toml"
|
|
|
|
if [[ ! -f "${RATHOLE_CONFIG}" ]]; then
|
|
default_token="$(openssl rand -hex 24)"
|
|
cat > "${RATHOLE_CONFIG}" <<EOF
|
|
# rathole server configuration — hot-reloaded on save, no restart needed.
|
|
# Full reference: https://github.com/rathole-org/rathole#configuration
|
|
|
|
[server]
|
|
bind_addr = "0.0.0.0:2333"
|
|
default_token = "${default_token}"
|
|
heartbeat_interval = 30
|
|
|
|
[server.transport]
|
|
type = "tcp"
|
|
|
|
[server.transport.tcp]
|
|
nodelay = true
|
|
|
|
# At least one service block must exist — rathole rejects a server config
|
|
# with no services. This placeholder listens on the first tunnel port and
|
|
# forwards whatever the matching client sends. Rename it or add more
|
|
# blocks; each bind_addr must use a distinct port from the reserved range
|
|
# (5200-5299 with default install settings). Hot-reloads on save.
|
|
[server.services.example]
|
|
token = "${default_token}"
|
|
bind_addr = "0.0.0.0:5200"
|
|
|
|
#[server.services.my_web_app]
|
|
#token = "another_secret"
|
|
#bind_addr = "0.0.0.0:5201"
|
|
EOF
|
|
echo "Seeded default config at ${RATHOLE_CONFIG} (random default_token generated)"
|
|
fi
|
|
|
|
# Status page (health check + auth-proxied landing page) in the background;
|
|
# rathole stays in the foreground as PID-friendly main process.
|
|
python3 -m http.server "${CLOUDRON_HTTP_PORT:-8000}" --directory /app/code/status &
|
|
|
|
exec /usr/local/bin/rathole --server "${RATHOLE_CONFIG}"
|