Update the add-on to Bamboo v0.1.7 and add the SSH server options

README.md

@@ -12,7 +12,7 @@ It builds on your Home Assistant machine the first time you install it. It suppo
 
 ## For maintainers
 
-The add-on version is the Bamboo release it installs: version `0.1.6` downloads Bamboo `v0.1.6` and checks it against that release's `SHA256SUMS`. To follow a new Bamboo release, change `version` in `bamboo/config.yaml` (and the default of `BUILD_VERSION` in `bamboo/Dockerfile`), and add a line to `bamboo/CHANGELOG.md`.
+The add-on version is the Bamboo release it installs: version `0.1.7` downloads Bamboo `v0.1.7` and checks it against that release's `SHA256SUMS`. To follow a new Bamboo release, change `version` in `bamboo/config.yaml` (and the default of `BUILD_VERSION` in `bamboo/Dockerfile`), and add a line to `bamboo/CHANGELOG.md`.
 
 ## License
 

bamboo/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.7
+
+* Installs Bamboo v0.1.7.
+* New, off by default: **SSH server** runs a small SSH server in the add-on, so you can open a shell from anywhere through a Hammerhead port. Only the public keys you list in **SSH public keys** can sign in.
+
 ## 0.1.6
 
 * Installs Bamboo v0.1.6.

bamboo/DOCS.md

@@ -33,6 +33,12 @@ Without it, the page fails with "400: Bad Request". Home Assistant has its own s
 
 The add-on uses host networking, so a resource can also point at any address on your network, such as a camera at `192.168.1.40`. Pick this site as the target and enter that address and port.
 
+## SSH server (optional)
+
+Turn on **SSH server** and list at least one key under **SSH public keys** (the line from your `id_ed25519.pub`, for example). Bamboo then runs an SSH server on `127.0.0.1:2222` inside the add-on. In Hammerhead, add a TCP port whose target is this site, host `127.0.0.1`, port `2222`, and connect with `ssh -p <port> anyname@<your edge address>`. The user name you give is ignored.
+
+This is a shell **inside the add-on's container**, as root: you can look around the add-on's own files and `/data`, and reach your network from it, but it is not the Home Assistant operating system or its terminal. Only the listed keys can sign in, with no passwords, and there is no port forwarding or SFTP. The server's host key is kept in `/data`, so it stays the same across restarts, and its fingerprint is in the add-on's log. Changes to the key list apply when the add-on is restarted.
+
 ## Suggest services (optional)
 
 Turn on **Suggest services** and Bamboo reports the services listening on Home Assistant's machine to Hammerhead, so you can pick one as a target instead of typing its address. Fill in **Scan subnets** (for example `192.168.1.0/24`) and it also looks for services on those networks, trying the ports in **Scan ports** or a short list of common ones. It is gentle, with a rate limit (**Scan speed**, 50 connection attempts per second by default) and a sweep every 15 minutes, and only private networks are accepted. Nothing is exposed until you pick a target. Only scan networks you are allowed to scan.

bamboo/Dockerfile

@@ -1,9 +1,9 @@
 ARG BUILD_FROM
 FROM ${BUILD_FROM}
 
-# The add-on version in config.yaml is the Bamboo release it installs (0.1.6 installs v0.1.6).
+# The add-on version in config.yaml is the Bamboo release it installs (0.1.7 installs v0.1.7).
 ARG BUILD_ARCH
-ARG BUILD_VERSION=0.1.6
+ARG BUILD_VERSION=0.1.7
 
 # Download the release for this CPU and check it against the release's SHA256SUMS before installing.
 RUN set -eu; \

bamboo/config.yaml

@@ -1,5 +1,5 @@
 name: Bamboo
-version: "0.1.6"
+version: "0.1.7"
 slug: bamboo
 description: Connects Home Assistant and your home network to a Blacktip edge, so you can reach them from the internet without opening any ports.
 url: https://git.veillax.com/Veillax/bamboo
@@ -16,6 +16,8 @@ host_network: true
 options:
   hammerhead_url: ""
   token: ""
+  ssh: false
+  ssh_keys: []
   discover: false
   discover_subnets: ""
   discover_ports: ""
@@ -23,6 +25,9 @@ options:
 schema:
   hammerhead_url: url
   token: password
+  ssh: bool
+  ssh_keys:
+    - str?
   discover: bool
   discover_subnets: str?
   discover_ports: str?

bamboo/run.sh

@@ -14,6 +14,19 @@ fi
 export BAMBOO_HAMMERHEAD="${url%/}"
 export BAMBOO_TOKEN="${token}"
 
+# The SSH server is opt-in. The keys listed in the configuration are the only ones that may sign in.
+if bashio::config.true 'ssh'; then
+  keys_file=/data/authorized_keys
+  jq -r '.ssh_keys[]? | select(. != null and . != "")' /data/options.json > "${keys_file}"
+  if [ ! -s "${keys_file}" ]; then
+    bashio::log.fatal "SSH is turned on but no public keys are listed. Add at least one in the SSH public keys setting, then start the add-on again."
+    bashio::exit.nok
+  fi
+  export BAMBOO_SSH=1
+  export BAMBOO_SSH_KEYS="${keys_file}"
+  export SHELL=/bin/bash
+fi
+
 # Service discovery is opt-in: Bamboo reports what it finds as suggested targets in Hammerhead.
 if bashio::config.true 'discover'; then
   export BAMBOO_DISCOVER=1

bamboo/translations/en.yaml

@@ -5,6 +5,12 @@ configuration:
   token:
     name: Site token
     description: The token of the site you created for this network. In Hammerhead, open Sites and use Show command to copy it.
+  ssh:
+    name: SSH server
+    description: Run an SSH server inside this add-on. Add a TCP port in Hammerhead whose target is this site, host 127.0.0.1, port 2222, then connect with ssh. Keys only, no passwords.
+  ssh_keys:
+    name: SSH public keys
+    description: The public keys allowed to sign in, one per entry, for example the line from your id_ed25519.pub. At least one is needed when the SSH server is on.
   discover:
     name: Suggest services
     description: Report the services listening on this machine to Hammerhead as suggested targets. Nothing is exposed until you pick one.