mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-11-09 05:24:49 +09:00
Juan DenisandClaude Opus 4.8
7cf8d4e18a
Self-hosted tunneled reverse proxy: a service on a NAT'd host (e.g. a home Jellyfin box) gets a public HTTPS hostname with no port-forwarding, by pairing two agents over WireGuard. Implements Phases 0-3 of docs/REMOTE_ACCESS_ROADMAP.md. Agent (Go): - new internal/wireguard package: Manager interface + kernel backend (wg/ip) and a userspace netstack backend (wireguard-go + gVisor) so Windows/macOS peers need no driver/admin; in-process keygen returns only the public key (private keys never leave the host) - wireguard:keygen/interface/peer/status/forward/unforward + firewall :allow_port/:deny_port commands; wireguard + firewall capability probes - TCP forwarder (tnet.ListenTCP / net.Listen -> dial localhost) carries traffic to the real service behind a netstack peer Backend (Python): - Tunnel + ExposedService models; tunnel_netutil (subnet allocator, health); tunnel_broker_service (keygen->up->peer->verify, firewall open, reconcile-on- reconnect); tunnel_publish_service (forward -> nginx -> DNS -> auth -> cert) - nginx remote-upstream vhost (WebSocket + proxy_buffering off) - /api/v1/tunnels CRUD + /<id>/services publish/unpublish - panel-authoritative reconcile hooked into the agent gateway on reconnect Frontend (React): - Remote Access page (tunnels + exposed services, status, teardown) and an "Expose a Local Service" wizard; new services/api/tunnels.js Verified: go build (win/linux) + vet + go tests (forwarder + no-leak parsers); py_compile + pytest (netutil, reconcile, nginx template); create_app boot; eslint + npm run build. Live multi-host run pending. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>