Add Telebit client wrapper
This commit is contained in:
Elias Renman
21
Dockerfile.client
Normal file
21
Dockerfile.client
Normal file
@@ -0,0 +1,21 @@
|
||||
FROM golang:1.24-alpine AS builder
|
||||
|
||||
ARG TELEBIT_REF=master
|
||||
ARG TARGETOS=linux
|
||||
ARG TARGETARCH=amd64
|
||||
|
||||
RUN apk add --no-cache git
|
||||
|
||||
WORKDIR /src
|
||||
RUN git clone --depth 1 --branch "${TELEBIT_REF}" https://github.com/therootcompany/telebit.git .
|
||||
|
||||
RUN go generate -mod=vendor ./...
|
||||
|
||||
# The upstream vendored x/net revision does not build on current macOS toolchains.
|
||||
RUN go get golang.org/x/net@v0.40.0
|
||||
|
||||
RUN CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" go build -mod=mod -o /out/telebit ./cmd/telebit
|
||||
RUN CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" go build -mod=mod -o /out/signjwt ./cmd/signjwt
|
||||
|
||||
FROM scratch AS export
|
||||
COPY --from=builder /out/ /
|
||||
153
README.md
Normal file
153
README.md
Normal file
@@ -0,0 +1,153 @@
|
||||
# Telebit Relay
|
||||
|
||||
Self-hosted Telebit relay and management API for running behind an external nginx wildcard HTTPS setup.
|
||||
|
||||
## Server Setup
|
||||
|
||||
Create `.env` from `.env.example`:
|
||||
|
||||
```sh
|
||||
cp .env.example .env
|
||||
```
|
||||
|
||||
Set at least:
|
||||
|
||||
```env
|
||||
DOMAIN=t.renman.dev
|
||||
TUNNEL_DOMAIN=t.renman.dev
|
||||
SECRET=change-this-to-a-long-random-secret
|
||||
POSTGRES_PASSWORD=change-this-postgres-password
|
||||
TELEBIT_PORT=8085
|
||||
MGMT_PORT=6468
|
||||
```
|
||||
|
||||
Start the relay:
|
||||
|
||||
```sh
|
||||
docker compose up -d --build
|
||||
```
|
||||
|
||||
The relay listens on `127.0.0.1:8085` through Docker's published port, and management is bound to `127.0.0.1:6468`.
|
||||
|
||||
## Nginx
|
||||
|
||||
Nginx should terminate HTTPS. The relay container is patched to run as a plain HTTP/WebSocket backend and should not handle Let's Encrypt itself.
|
||||
|
||||
Use plain `http://` upstreams:
|
||||
|
||||
```nginx
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name t.example.com *.t.example.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
|
||||
server_name t.example.com *.t.example.com;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/t.example.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/t.example.com/privkey.pem;
|
||||
|
||||
location = /ws {
|
||||
proxy_pass http://127.0.0.1:8085/ws;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header Authorization $http_authorization;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_read_timeout 3600s;
|
||||
proxy_send_timeout 3600s;
|
||||
}
|
||||
|
||||
location /api/ {
|
||||
proxy_pass http://127.0.0.1:6468/api/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8085;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Reload:
|
||||
|
||||
```sh
|
||||
sudo nginx -t
|
||||
sudo systemctl reload nginx
|
||||
```
|
||||
|
||||
## Client Wrapper
|
||||
|
||||
`telebitctl` manages local client keys and runs the Telebit client.
|
||||
|
||||
Build local binaries with Docker:
|
||||
|
||||
```sh
|
||||
./telebitctl build
|
||||
```
|
||||
|
||||
This writes:
|
||||
|
||||
```text
|
||||
bin/telebit
|
||||
bin/signjwt
|
||||
```
|
||||
|
||||
Create a new tunnel key for a subdomain:
|
||||
|
||||
```sh
|
||||
./telebitctl bind test
|
||||
```
|
||||
|
||||
This creates `test.$DOMAIN` and writes `telebit-client.env`.
|
||||
|
||||
Run the tunnel to a local service:
|
||||
|
||||
```sh
|
||||
./telebitctl up test 80
|
||||
```
|
||||
|
||||
That forwards:
|
||||
|
||||
```text
|
||||
https://test.$DOMAIN -> localhost:80
|
||||
```
|
||||
|
||||
`up` also installs the active client config to:
|
||||
|
||||
```text
|
||||
~/.config/telebit/client.env
|
||||
```
|
||||
|
||||
Rotate the client key:
|
||||
|
||||
```sh
|
||||
./telebitctl auth refresh test
|
||||
```
|
||||
|
||||
Release a subdomain:
|
||||
|
||||
```sh
|
||||
./telebitctl release test
|
||||
```
|
||||
|
||||
## Notes
|
||||
|
||||
- `.env`, `telebit-client.env`, and `bin/` are ignored by git.
|
||||
- `SECRET` in `.env` is the management/relay master secret. Do not use it directly as a long-lived client key.
|
||||
- Client keys are one-time registration secrets. Use `bind` or `auth refresh` to create device-specific keys.
|
||||
- If `/ws` returns nginx `502`, nginx is probably still proxying to `https://127.0.0.1:8085`; it must use `http://127.0.0.1:8085`.
|
||||
238
telebitctl
Executable file
238
telebitctl
Executable file
@@ -0,0 +1,238 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
ROOT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
|
||||
SERVER_ENV="${TELEBIT_SERVER_ENV:-$ROOT_DIR/.env}"
|
||||
CLIENT_ENV="${TELEBIT_CLIENT_ENV:-$ROOT_DIR/telebit-client.env}"
|
||||
INSTALLED_CLIENT_ENV="${TELEBIT_INSTALLED_CLIENT_ENV:-$HOME/.config/telebit/client.env}"
|
||||
TELEBIT_BIN="${TELEBIT_BIN:-$ROOT_DIR/bin/telebit}"
|
||||
SIGNJWT_BIN="${SIGNJWT_BIN:-$ROOT_DIR/bin/signjwt}"
|
||||
|
||||
usage() {
|
||||
cat <<'USAGE'
|
||||
Usage:
|
||||
telebitctl build [os] [arch]
|
||||
telebitctl bind <slug>
|
||||
telebitctl release <slug>
|
||||
telebitctl auth refresh [slug]
|
||||
telebitctl up <slug> <local-port>
|
||||
|
||||
Examples:
|
||||
./telebitctl build
|
||||
./telebitctl bind test
|
||||
./telebitctl up test 80
|
||||
./telebitctl auth refresh test
|
||||
./telebitctl release test
|
||||
USAGE
|
||||
}
|
||||
|
||||
die() {
|
||||
printf '%s\n' "$*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
load_server_env() {
|
||||
[ -f "$SERVER_ENV" ] || die "Missing $SERVER_ENV. Copy .env.example to .env and set DOMAIN, TUNNEL_DOMAIN, and SECRET."
|
||||
set -a
|
||||
# shellcheck disable=SC1090
|
||||
. "$SERVER_ENV"
|
||||
set +a
|
||||
|
||||
: "${DOMAIN:?DOMAIN is required in $SERVER_ENV}"
|
||||
: "${TUNNEL_DOMAIN:?TUNNEL_DOMAIN is required in $SERVER_ENV}"
|
||||
: "${SECRET:?SECRET is required in $SERVER_ENV}"
|
||||
|
||||
VENDOR_ID="${VENDOR_ID:-renman-dev}"
|
||||
MGMT_URL="${MGMT_URL:-https://$TUNNEL_DOMAIN/api}"
|
||||
}
|
||||
|
||||
need_bin() {
|
||||
[ -x "$1" ] || die "Missing executable $1. Run: ./telebitctl build"
|
||||
}
|
||||
|
||||
admin_token() {
|
||||
need_bin "$SIGNJWT_BIN"
|
||||
"$SIGNJWT_BIN" \
|
||||
--expires-in 5m \
|
||||
--vendor-id "$VENDOR_ID" \
|
||||
--secret "$SECRET" \
|
||||
--machine-ppid "$SECRET" | awk '/^eyJ/ {print; exit}'
|
||||
}
|
||||
|
||||
current_slug() {
|
||||
[ -f "$CLIENT_ENV" ] || return 1
|
||||
sed -n "s#^LOCALS=https:\\([^:]*\\):.*#\\1#p" "$CLIENT_ENV" | sed "s#\\.$DOMAIN\$##" | sed -n '1p'
|
||||
}
|
||||
|
||||
current_port() {
|
||||
[ -f "$CLIENT_ENV" ] || return 1
|
||||
sed -n 's#^LOCALS=https:[^:]*:\([0-9][0-9]*\).*#\1#p' "$CLIENT_ENV" | sed -n '1p'
|
||||
}
|
||||
|
||||
write_client_env() {
|
||||
slug="$1"
|
||||
shared_key="$2"
|
||||
port="${3:-$(current_port || true)}"
|
||||
install="${4:-false}"
|
||||
port="${port:-80}"
|
||||
|
||||
cat > "$CLIENT_ENV" <<EOF
|
||||
TUNNEL_RELAY_URL=wss://$TUNNEL_DOMAIN/ws
|
||||
AUTH_URL=https://$TUNNEL_DOMAIN/api
|
||||
ACME_HTTP_01_RELAY_URL=https://$TUNNEL_DOMAIN/api/acme-relay
|
||||
ACME_RELAY_URL=https://$TUNNEL_DOMAIN/api/acme-relay
|
||||
ACME_AGREE=true
|
||||
|
||||
VENDOR_ID=$VENDOR_ID
|
||||
SECRET=$shared_key
|
||||
|
||||
LOCALS=https:$slug.$DOMAIN:$port
|
||||
EOF
|
||||
|
||||
if [ "$install" = "true" ]; then
|
||||
mkdir -p "$(dirname "$INSTALLED_CLIENT_ENV")"
|
||||
cp "$CLIENT_ENV" "$INSTALLED_CLIENT_ENV"
|
||||
printf 'Updated %s and %s\n' "$CLIENT_ENV" "$INSTALLED_CLIENT_ENV"
|
||||
else
|
||||
printf 'Updated %s\n' "$CLIENT_ENV"
|
||||
fi
|
||||
}
|
||||
|
||||
client_key() {
|
||||
[ -f "$CLIENT_ENV" ] || return 1
|
||||
sed -n 's/^SECRET=//p' "$CLIENT_ENV" | sed -n '1p'
|
||||
}
|
||||
|
||||
bind_slug() {
|
||||
load_server_env
|
||||
slug="${1:?bind requires a slug}"
|
||||
token=$(admin_token)
|
||||
response=$(curl -fsS -X POST "$MGMT_URL/devices" \
|
||||
-H "Authorization: Bearer $token" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{ \"slug\": \"$slug\" }")
|
||||
|
||||
shared_key=$(printf '%s\n' "$response" | sed -n 's/.*"shared_key":"\([^"]*\)".*/\1/p')
|
||||
[ -n "$shared_key" ] || die "Could not parse shared_key from response: $response"
|
||||
|
||||
write_client_env "$slug" "$shared_key" "$(current_port || true)" false
|
||||
printf 'Bound %s.%s\n' "$slug" "$DOMAIN"
|
||||
}
|
||||
|
||||
release_slug() {
|
||||
load_server_env
|
||||
slug="${1:?release requires a slug}"
|
||||
token=$(admin_token)
|
||||
delete_device "$slug" "$token" true
|
||||
}
|
||||
|
||||
delete_device() {
|
||||
slug="$1"
|
||||
token="$2"
|
||||
strict="${3:-false}"
|
||||
tmp=$(mktemp)
|
||||
code=$(curl -sS -o "$tmp" -w '%{http_code}' -X DELETE "$MGMT_URL/devices/$slug" \
|
||||
-H "Authorization: Bearer $token")
|
||||
body=$(cat "$tmp")
|
||||
rm -f "$tmp"
|
||||
|
||||
case "$code:$body" in
|
||||
200:*|500:*E_NOT_FOUND*)
|
||||
printf 'Released %s.%s\n' "$slug" "$DOMAIN"
|
||||
;;
|
||||
*)
|
||||
[ "$strict" = "true" ] || return 0
|
||||
printf '%s\n' "$body" >&2
|
||||
die "Release failed with HTTP $code"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
refresh_auth() {
|
||||
load_server_env
|
||||
slug="${1:-$(current_slug || true)}"
|
||||
slug="${slug:-test}"
|
||||
token=$(admin_token)
|
||||
delete_device "$slug" "$token" false >/dev/null 2>&1 || true
|
||||
bind_slug "$slug"
|
||||
}
|
||||
|
||||
up_client() {
|
||||
load_server_env
|
||||
need_bin "$TELEBIT_BIN"
|
||||
slug="${1:?up requires a slug}"
|
||||
port="${2:?up requires a local port}"
|
||||
key="$(client_key || true)"
|
||||
[ -n "$key" ] || die "No client key found. Run: ./telebitctl bind $slug"
|
||||
write_client_env "$slug" "$key" "$port" true >/dev/null
|
||||
unset SECRET DOMAIN TUNNEL_DOMAIN MGMT_URL POSTGRES_PASSWORD TELEBIT_PORT MGMT_PORT VENDOR_ID
|
||||
cd "$HOME"
|
||||
exec "$TELEBIT_BIN" --env "$INSTALLED_CLIENT_ENV"
|
||||
}
|
||||
|
||||
build_client() {
|
||||
os="${1:-}"
|
||||
arch="${2:-}"
|
||||
|
||||
if [ -z "$os" ]; then
|
||||
case "$(uname -s)" in
|
||||
Darwin) os=darwin ;;
|
||||
Linux) os=linux ;;
|
||||
*) die "Unsupported OS. Pass os and arch explicitly." ;;
|
||||
esac
|
||||
fi
|
||||
|
||||
if [ -z "$arch" ]; then
|
||||
case "$(uname -m)" in
|
||||
arm64|aarch64) arch=arm64 ;;
|
||||
x86_64|amd64) arch=amd64 ;;
|
||||
*) die "Unsupported arch. Pass os and arch explicitly." ;;
|
||||
esac
|
||||
fi
|
||||
|
||||
mkdir -p "$ROOT_DIR/bin"
|
||||
docker build \
|
||||
-f "$ROOT_DIR/Dockerfile.client" \
|
||||
--build-arg "TELEBIT_REF=${TELEBIT_REF:-master}" \
|
||||
--build-arg "TARGETOS=$os" \
|
||||
--build-arg "TARGETARCH=$arch" \
|
||||
--output "type=local,dest=$ROOT_DIR/bin" \
|
||||
"$ROOT_DIR"
|
||||
|
||||
chmod +x "$ROOT_DIR/bin/telebit" "$ROOT_DIR/bin/signjwt"
|
||||
printf 'Built bin/telebit and bin/signjwt for %s/%s\n' "$os" "$arch"
|
||||
}
|
||||
|
||||
cmd="${1:-}"
|
||||
case "$cmd" in
|
||||
build)
|
||||
shift
|
||||
build_client "$@"
|
||||
;;
|
||||
bind)
|
||||
shift
|
||||
bind_slug "$@"
|
||||
;;
|
||||
release)
|
||||
shift
|
||||
release_slug "$@"
|
||||
;;
|
||||
auth)
|
||||
shift
|
||||
sub="${1:-}"
|
||||
[ "$sub" = "refresh" ] || die "Unknown auth command: ${sub:-}. Expected: auth refresh [slug]"
|
||||
shift || true
|
||||
refresh_auth "$@"
|
||||
;;
|
||||
up)
|
||||
shift
|
||||
up_client "$@"
|
||||
;;
|
||||
-h|--help|help|"")
|
||||
usage
|
||||
;;
|
||||
*)
|
||||
usage
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
Reference in New Issue
Block a user