kitadmin
14d46d96a4
SPK daemon fixes (x5925 testing feedback): - register_with_hub: added --max-time 15 to prevent indefinite hang - Removed bash 'local' keyword for busybox ash compatibility - postinst: mkdir -p /usr/local/bin before copying Tailscale binaries - postinst: chmod +x all bin/*.sh (fixes 644 execute bit bug) - Added x5925-boot.sh for reboot persistence (stopgap until daemon fixed) Hub security hardening: - Added POST /api/authorize-key endpoint with device_id + pubkey - Keys auto-authorized with restrict,port-forwarding,permitlisten="<port>" - No shell access allowed — only tunnel forwarding to assigned port - Server.py updated with input validation on key format - register.sh --authorize-key subcommand for secure key management GL daemon: same --max-time fix applied for curl timeout Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
87 lines
3.0 KiB
Bash
Executable File
87 lines
3.0 KiB
Bash
Executable File
#!/bin/sh
|
|
# x5925-boot.sh — Boot persistence stopgap for x5925
|
|
# Brings up Tailscale + reverse SSH tunnel on reboot.
|
|
# Runs as a Synology scheduled trigger-on-boot task.
|
|
# Once the SPK daemon is fixed, this script becomes redundant.
|
|
|
|
LOG_TAG="kit-connect-boot"
|
|
log() { logger -t "$LOG_TAG" -p local0.warn "$*"; }
|
|
|
|
log "=== Boot persistence for x5925 ==="
|
|
log "device=x5925 hub=162.243.83.36 port=2230"
|
|
|
|
# ── 1. Tailscale ────────────────────────────────────────────────
|
|
TAILSCALE_BIN="/usr/local/bin/tailscale"
|
|
TAILSCALED_BIN="/usr/local/bin/tailscaled"
|
|
TAILSCALE_STATEDIR="/var/packages/Tailscale/var/state"
|
|
TAILSCALE_SOCKET="/var/packages/Tailscale/var/run/tailscaled.sock"
|
|
AUTH_KEY="tskey-auth-kJz8wqNVo211CNTRL-GNL5EFjp5aWQcaWPSVn2aW9TNworKUNBV"
|
|
|
|
if [ -x "$TAILSCALED_BIN" ]; then
|
|
mkdir -p "$TAILSCALE_STATEDIR" "$(dirname "$TAILSCALE_SOCKET")"
|
|
|
|
# Check if already running
|
|
if "$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" status >/dev/null 2>&1; then
|
|
log "tailscale: already connected — $("$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" ip -4 2>/dev/null || echo no-ip)"
|
|
else
|
|
log "tailscale: starting tailscaled..."
|
|
/usr/bin/setsid "$TAILSCALED_BIN" \
|
|
--statedir="$TAILSCALE_STATEDIR" \
|
|
--tun=userspace-networking \
|
|
--socket="$TAILSCALE_SOCKET" \
|
|
>/dev/null 2>&1 &
|
|
sleep 4
|
|
|
|
log "tailscale: authenticating..."
|
|
"$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" up \
|
|
--auth-key "$AUTH_KEY" \
|
|
--hostname x5925 \
|
|
--accept-routes=false \
|
|
--accept-dns=false 2>&1 | while read -r line; do log "tailscale: $line"; done
|
|
|
|
ts_ip=$("$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" ip -4 2>/dev/null || echo "unknown")
|
|
log "tailscale: connected — IP=${ts_ip}"
|
|
fi
|
|
else
|
|
log "tailscale: binaries not found at $TAILSCALED_BIN"
|
|
fi
|
|
|
|
# ── 2. Reverse SSH tunnel ───────────────────────────────────────
|
|
TUNNEL_KEY="/var/packages/kit-connect/target/bin/connect_id_ed25519"
|
|
TUNNEL_HOST="162.243.83.36"
|
|
TUNNEL_USER="node"
|
|
TUNNEL_PORT="2230"
|
|
LOCAL_SSH_PORT="2223"
|
|
|
|
if [ -f "$TUNNEL_KEY" ]; then
|
|
chmod 600 "$TUNNEL_KEY"
|
|
|
|
# Check if tunnel already exists
|
|
if pgrep -f "ssh.*-R.*${TUNNEL_PORT}" >/dev/null 2>&1; then
|
|
log "tunnel: already active on port ${TUNNEL_PORT}"
|
|
else
|
|
log "tunnel: opening R:0.0.0.0:${TUNNEL_PORT} -> 127.0.0.1:${LOCAL_SSH_PORT}"
|
|
|
|
ssh \
|
|
-o StrictHostKeyChecking=no \
|
|
-o UserKnownHostsFile=/dev/null \
|
|
-o ServerAliveInterval=15 \
|
|
-o ServerAliveCountMax=3 \
|
|
-o ExitOnForwardFailure=yes \
|
|
-o BatchMode=yes \
|
|
-p 22 -N \
|
|
-R "0.0.0.0:${TUNNEL_PORT}:127.0.0.1:${LOCAL_SSH_PORT}" \
|
|
-i "$TUNNEL_KEY" \
|
|
"${TUNNEL_USER}@${TUNNEL_HOST}" \
|
|
2>/var/packages/kit-connect/target/var/boot-tunnel.err &
|
|
|
|
TUNNEL_PID=$!
|
|
log "tunnel: SSH PID=${TUNNEL_PID}"
|
|
echo "$TUNNEL_PID" > /var/packages/kit-connect/target/var/boot-tunnel.pid
|
|
fi
|
|
else
|
|
log "tunnel: key not found at $TUNNEL_KEY"
|
|
fi
|
|
|
|
log "=== Boot persistence complete ==="
|