diff --git a/README.md b/README.md index b5b618a..eac6955 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ It builds on your Home Assistant machine the first time you install it. It suppo ## For maintainers -The add-on version is the Bamboo release it installs: version `0.1.6` downloads Bamboo `v0.1.6` and checks it against that release's `SHA256SUMS`. To follow a new Bamboo release, change `version` in `bamboo/config.yaml` (and the default of `BUILD_VERSION` in `bamboo/Dockerfile`), and add a line to `bamboo/CHANGELOG.md`. +The add-on version is the Bamboo release it installs: version `0.1.7` downloads Bamboo `v0.1.7` and checks it against that release's `SHA256SUMS`. To follow a new Bamboo release, change `version` in `bamboo/config.yaml` (and the default of `BUILD_VERSION` in `bamboo/Dockerfile`), and add a line to `bamboo/CHANGELOG.md`. ## License diff --git a/bamboo/CHANGELOG.md b/bamboo/CHANGELOG.md index 8c0bfda..5a4671b 100644 --- a/bamboo/CHANGELOG.md +++ b/bamboo/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog +## 0.1.7 + +* Installs Bamboo v0.1.7. +* New, off by default: **SSH server** runs a small SSH server in the add-on, so you can open a shell from anywhere through a Hammerhead port. Only the public keys you list in **SSH public keys** can sign in. + ## 0.1.6 * Installs Bamboo v0.1.6. diff --git a/bamboo/DOCS.md b/bamboo/DOCS.md index 5629556..354779b 100644 --- a/bamboo/DOCS.md +++ b/bamboo/DOCS.md @@ -33,6 +33,12 @@ Without it, the page fails with "400: Bad Request". Home Assistant has its own s The add-on uses host networking, so a resource can also point at any address on your network, such as a camera at `192.168.1.40`. Pick this site as the target and enter that address and port. +## SSH server (optional) + +Turn on **SSH server** and list at least one key under **SSH public keys** (the line from your `id_ed25519.pub`, for example). Bamboo then runs an SSH server on `127.0.0.1:2222` inside the add-on. In Hammerhead, add a TCP port whose target is this site, host `127.0.0.1`, port `2222`, and connect with `ssh -p anyname@`. The user name you give is ignored. + +This is a shell **inside the add-on's container**, as root: you can look around the add-on's own files and `/data`, and reach your network from it, but it is not the Home Assistant operating system or its terminal. Only the listed keys can sign in, with no passwords, and there is no port forwarding or SFTP. The server's host key is kept in `/data`, so it stays the same across restarts, and its fingerprint is in the add-on's log. Changes to the key list apply when the add-on is restarted. + ## Suggest services (optional) Turn on **Suggest services** and Bamboo reports the services listening on Home Assistant's machine to Hammerhead, so you can pick one as a target instead of typing its address. Fill in **Scan subnets** (for example `192.168.1.0/24`) and it also looks for services on those networks, trying the ports in **Scan ports** or a short list of common ones. It is gentle, with a rate limit (**Scan speed**, 50 connection attempts per second by default) and a sweep every 15 minutes, and only private networks are accepted. Nothing is exposed until you pick a target. Only scan networks you are allowed to scan. diff --git a/bamboo/Dockerfile b/bamboo/Dockerfile index bb86ec9..9b16f43 100644 --- a/bamboo/Dockerfile +++ b/bamboo/Dockerfile @@ -1,9 +1,9 @@ ARG BUILD_FROM FROM ${BUILD_FROM} -# The add-on version in config.yaml is the Bamboo release it installs (0.1.6 installs v0.1.6). +# The add-on version in config.yaml is the Bamboo release it installs (0.1.7 installs v0.1.7). ARG BUILD_ARCH -ARG BUILD_VERSION=0.1.6 +ARG BUILD_VERSION=0.1.7 # Download the release for this CPU and check it against the release's SHA256SUMS before installing. RUN set -eu; \ diff --git a/bamboo/config.yaml b/bamboo/config.yaml index 6ecd75b..722a37e 100644 --- a/bamboo/config.yaml +++ b/bamboo/config.yaml @@ -1,5 +1,5 @@ name: Bamboo -version: "0.1.6" +version: "0.1.7" slug: bamboo description: Connects Home Assistant and your home network to a Blacktip edge, so you can reach them from the internet without opening any ports. url: https://git.veillax.com/Veillax/bamboo @@ -16,6 +16,8 @@ host_network: true options: hammerhead_url: "" token: "" + ssh: false + ssh_keys: [] discover: false discover_subnets: "" discover_ports: "" @@ -23,6 +25,9 @@ options: schema: hammerhead_url: url token: password + ssh: bool + ssh_keys: + - str? discover: bool discover_subnets: str? discover_ports: str? diff --git a/bamboo/run.sh b/bamboo/run.sh index 7ecb7bb..a2b7b75 100644 --- a/bamboo/run.sh +++ b/bamboo/run.sh @@ -14,6 +14,19 @@ fi export BAMBOO_HAMMERHEAD="${url%/}" export BAMBOO_TOKEN="${token}" +# The SSH server is opt-in. The keys listed in the configuration are the only ones that may sign in. +if bashio::config.true 'ssh'; then + keys_file=/data/authorized_keys + jq -r '.ssh_keys[]? | select(. != null and . != "")' /data/options.json > "${keys_file}" + if [ ! -s "${keys_file}" ]; then + bashio::log.fatal "SSH is turned on but no public keys are listed. Add at least one in the SSH public keys setting, then start the add-on again." + bashio::exit.nok + fi + export BAMBOO_SSH=1 + export BAMBOO_SSH_KEYS="${keys_file}" + export SHELL=/bin/bash +fi + # Service discovery is opt-in: Bamboo reports what it finds as suggested targets in Hammerhead. if bashio::config.true 'discover'; then export BAMBOO_DISCOVER=1 diff --git a/bamboo/translations/en.yaml b/bamboo/translations/en.yaml index bbbf4ea..dcd33a6 100644 --- a/bamboo/translations/en.yaml +++ b/bamboo/translations/en.yaml @@ -5,6 +5,12 @@ configuration: token: name: Site token description: The token of the site you created for this network. In Hammerhead, open Sites and use Show command to copy it. + ssh: + name: SSH server + description: Run an SSH server inside this add-on. Add a TCP port in Hammerhead whose target is this site, host 127.0.0.1, port 2222, then connect with ssh. Keys only, no passwords. + ssh_keys: + name: SSH public keys + description: The public keys allowed to sign in, one per entry, for example the line from your id_ed25519.pub. At least one is needed when the SSH server is on. discover: name: Suggest services description: Report the services listening on this machine to Hammerhead as suggested targets. Nothing is exposed until you pick one.