Add SSH-only emergency access fallback

2026-08-22 21:08:58 +02:00
parent e7b6739d85
commit af6abf54ae
4 changed files with 166 additions and 0 deletions
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+IMAGE=mike-ai/wireguard-gateway:local
+
+proxy_names=(
+  mike-ai-emergency-openwebui
+  mike-ai-emergency-mcp-web
+  mike-ai-emergency-mcp-homeassistant
+  mike-ai-emergency-mcp-arr
+  mike-ai-emergency-mcp-unraid
+)
+
+remove_proxies() {
+  docker rm -f "${proxy_names[@]}" >/dev/null 2>&1 || true
+}
+
+start_proxy() {
+  local name=$1 network=$2 host_port=$3 target=$4
+  docker container inspect "$target" >/dev/null 2>&1 || {
+    printf 'Übersprungen (Ziel fehlt): %s\n' "$target" >&2
+    return 0
+  }
+  docker start "$target" >/dev/null 2>&1 || true
+  [ "$(docker inspect -f '{{.State.Running}}' "$target" 2>/dev/null || true)" = true ] || {
+    printf 'Übersprungen (Ziel startet nicht): %s\n' "$target" >&2
+    return 0
+  }
+  docker run --detach --rm --pull never \
+    --name "$name" \
+    --network mike-ai_frontend \
+    --publish "127.0.0.1:${host_port}:${host_port}" \
+    --read-only --cap-drop ALL --pids-limit 64 --memory 64m \
+    --security-opt no-new-privileges:true \
+    --entrypoint socat "$IMAGE" \
+    "TCP-LISTEN:${host_port},bind=0.0.0.0,reuseaddr,fork" \
+    "TCP:${target}:8000" >/dev/null
+  # Docker deliberately discards published ports on an internal-only network.
+  # The proxy therefore publishes through frontend and receives the tools
+  # network as a second, non-egress attachment for target discovery.
+  docker network connect "$network" "$name"
+}
+
+case "${1:-}" in
+  start)
+    remove_proxies
+    docker image inspect "$IMAGE" >/dev/null
+
+    docker start mike-ai-router mike-ai-open-webui >/dev/null 2>&1 || true
+    docker run --detach --rm --pull never \
+      --name mike-ai-emergency-openwebui \
+      --network mike-ai_frontend \
+      --publish 127.0.0.1:18080:18080 \
+      --read-only --cap-drop ALL --pids-limit 64 --memory 64m \
+      --security-opt no-new-privileges:true \
+      --entrypoint socat "$IMAGE" \
+      TCP-LISTEN:18080,bind=0.0.0.0,reuseaddr,fork \
+      TCP:mike-ai-open-webui:8080 >/dev/null
+
+    start_proxy mike-ai-emergency-mcp-web mike-ai-tools 18090 mike-ai-mcp-web
+    start_proxy mike-ai-emergency-mcp-homeassistant mike-ai-tools 18091 mike-ai-mcp-homeassistant
+    start_proxy mike-ai-emergency-mcp-arr mike-ai-tools 18092 mike-ai-mcp-arr
+    start_proxy mike-ai-emergency-mcp-unraid mike-ai-tools 18093 mike-ai-mcp-unraid-official
+
+    echo 'Notfall-Proxys laufen ausschließlich auf 127.0.0.1.'
+    echo 'Jetzt vom Client einen SSH-Tunnel auf die Ports 18080 und 18090-18093 öffnen.'
+    ;;
+  stop)
+    remove_proxies
+    echo 'Notfall-Proxys entfernt.'
+    ;;
+  status)
+    docker ps --filter 'name=mike-ai-emergency-' \
+      --format 'table {{.Names}}\t{{.Ports}}\t{{.Status}}'
+    ;;
+  *)
+    echo "Aufruf: $0 start|stop|status" >&2
+    exit 2
+    ;;
+esac