81 lines
2.7 KiB
Bash
81 lines
2.7 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
IMAGE=mike-ai/wireguard-gateway:local
|
|
|
|
proxy_names=(
|
|
mike-ai-emergency-openwebui
|
|
mike-ai-emergency-mcp-web
|
|
mike-ai-emergency-mcp-homeassistant
|
|
mike-ai-emergency-mcp-arr
|
|
mike-ai-emergency-mcp-unraid
|
|
)
|
|
|
|
remove_proxies() {
|
|
docker rm -f "${proxy_names[@]}" >/dev/null 2>&1 || true
|
|
}
|
|
|
|
start_proxy() {
|
|
local name=$1 network=$2 host_port=$3 target=$4
|
|
docker container inspect "$target" >/dev/null 2>&1 || {
|
|
printf 'Übersprungen (Ziel fehlt): %s\n' "$target" >&2
|
|
return 0
|
|
}
|
|
docker start "$target" >/dev/null 2>&1 || true
|
|
[ "$(docker inspect -f '{{.State.Running}}' "$target" 2>/dev/null || true)" = true ] || {
|
|
printf 'Übersprungen (Ziel startet nicht): %s\n' "$target" >&2
|
|
return 0
|
|
}
|
|
docker run --detach --rm --pull never \
|
|
--name "$name" \
|
|
--network mike-ai_frontend \
|
|
--publish "127.0.0.1:${host_port}:${host_port}" \
|
|
--read-only --cap-drop ALL --pids-limit 64 --memory 64m \
|
|
--security-opt no-new-privileges:true \
|
|
--entrypoint socat "$IMAGE" \
|
|
"TCP-LISTEN:${host_port},bind=0.0.0.0,reuseaddr,fork" \
|
|
"TCP:${target}:8000" >/dev/null
|
|
# Docker deliberately discards published ports on an internal-only network.
|
|
# The proxy therefore publishes through frontend and receives the tools
|
|
# network as a second, non-egress attachment for target discovery.
|
|
docker network connect "$network" "$name"
|
|
}
|
|
|
|
case "${1:-}" in
|
|
start)
|
|
remove_proxies
|
|
docker image inspect "$IMAGE" >/dev/null
|
|
|
|
docker start mike-ai-router mike-ai-open-webui >/dev/null 2>&1 || true
|
|
docker run --detach --rm --pull never \
|
|
--name mike-ai-emergency-openwebui \
|
|
--network mike-ai_frontend \
|
|
--publish 127.0.0.1:18080:18080 \
|
|
--read-only --cap-drop ALL --pids-limit 64 --memory 64m \
|
|
--security-opt no-new-privileges:true \
|
|
--entrypoint socat "$IMAGE" \
|
|
TCP-LISTEN:18080,bind=0.0.0.0,reuseaddr,fork \
|
|
TCP:mike-ai-open-webui:8080 >/dev/null
|
|
|
|
start_proxy mike-ai-emergency-mcp-web mike-ai-tools 18090 mike-ai-mcp-web
|
|
start_proxy mike-ai-emergency-mcp-homeassistant mike-ai-tools 18091 mike-ai-mcp-homeassistant
|
|
start_proxy mike-ai-emergency-mcp-arr mike-ai-tools 18092 mike-ai-mcp-arr
|
|
start_proxy mike-ai-emergency-mcp-unraid mike-ai-tools 18093 mike-ai-mcp-unraid-official
|
|
|
|
echo 'Notfall-Proxys laufen ausschließlich auf 127.0.0.1.'
|
|
echo 'Jetzt vom Client einen SSH-Tunnel auf die Ports 18080 und 18090-18093 öffnen.'
|
|
;;
|
|
stop)
|
|
remove_proxies
|
|
echo 'Notfall-Proxys entfernt.'
|
|
;;
|
|
status)
|
|
docker ps --filter 'name=mike-ai-emergency-' \
|
|
--format 'table {{.Names}}\t{{.Ports}}\t{{.Status}}'
|
|
;;
|
|
*)
|
|
echo "Aufruf: $0 start|stop|status" >&2
|
|
exit 2
|
|
;;
|
|
esac
|