Add -ssh: an opt-in built-in SSH server (public keys only, sessions only)

cmd/bamboo/main.go

@@ -7,11 +7,13 @@ import (
 	"log"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"strconv"
 	"strings"
 
 	"git.veillax.com/Veillax/bamboo"
 	"git.veillax.com/Veillax/bamboo/discover"
+	"git.veillax.com/Veillax/bamboo/sshd"
 	"git.veillax.com/Veillax/reef/dotenv"
 	"git.veillax.com/Veillax/reef/selfupdate"
 )
@@ -47,6 +49,9 @@ func main() {
 	discoverSubnets := flag.String("discover-subnets", os.Getenv("BAMBOO_DISCOVER_SUBNETS"), "comma-separated private subnets to scan for services, e.g. 192.168.1.0/24 (at most /22 each; off by default)")
 	discoverPorts := flag.String("discover-ports", os.Getenv("BAMBOO_DISCOVER_PORTS"), "TCP ports to try on scanned addresses, e.g. 22,80,443,8000-8010 (default: a short list of common ones)")
 	discoverRate := flag.Float64("discover-rate", envFloat("BAMBOO_DISCOVER_RATE", discover.DefaultRate), "most connection attempts per second discovery may make")
+	sshOn := flag.Bool("ssh", os.Getenv("BAMBOO_SSH") == "1", "run a built-in SSH server (public keys only) so this machine can be reached through a tunnelled port")
+	sshListen := flag.String("ssh-listen", env("BAMBOO_SSH_LISTEN", sshd.DefaultListen), "address the SSH server listens on; point a Hammerhead port at it from this site")
+	sshKeys := flag.String("ssh-keys", os.Getenv("BAMBOO_SSH_KEYS"), "authorized_keys file listing who may sign in (default: authorized_keys in the data folder)")
 	flag.String("env", ".env", "file to read secrets and settings from")
 	autoUpdate := flag.Bool("auto-update", os.Getenv("BAMBOO_AUTO_UPDATE") == "1", "check for new releases every few hours and update and restart by itself (Linux and macOS)")
 	showVersion := flag.Bool("version", false, "print the version and exit")
@@ -74,6 +79,25 @@ func main() {
 	if dc.Ports, err = discover.ParsePorts(*discoverPorts); err != nil {
 		log.Fatalf("-discover-ports: %v", err)
 	}
+	if *sshOn {
+		if !sshd.Supported {
+			log.Fatal("-ssh: the SSH server is not available on this platform")
+		}
+		keys := *sshKeys
+		if keys == "" {
+			keys = filepath.Join(*data, "authorized_keys")
+		}
+		srv, err := sshd.New(sshd.Config{Listen: *sshListen, AuthorizedKeys: keys, HostKey: filepath.Join(*data, "ssh_host_ed25519_key"), Logf: log.Printf})
+		if err != nil {
+			log.Fatalf("-ssh: %v", err)
+		}
+		log.Printf("ssh: listening on %s, host key %s", *sshListen, srv.Fingerprint())
+		go func() {
+			if err := srv.Run(ctx); err != nil {
+				log.Printf("ssh: stopped: %v", err)
+			}
+		}()
+	}
 	b, err := bamboo.New(bamboo.Config{Hammerhead: strings.TrimRight(*hh, "/"), Token: *token, DataDir: *data, Docker: *dockerOn, Discover: dc,
 		Version: version, AutoUpdate: *autoUpdate,
 		UpdateNow: func(ctx context.Context, progress func(string, int, string)) (string, error) {