2 ms·
Show HN: SSH sidecar debugging with stunnel, sslh and traefik over port 443
- hardwaresofton 6y agoThis was interesting to me because ever since that fly.io post[0][1] about how they enable ssh I've wondered if some of the harebrained ways I'd also thought about doing it were possible. I was wrong about thinking they used Kubernetes (fly.io runs on nomad) but I took some time to shave this particular yak and found it wasn't too hard to do with Kubernetes. I don't have any of the fun wireguard stuff in here but I didn't really think it was necessary -- this is definitely not a solution that should just be rolled out to production anywhere either so experiment with caution. It's a bit hard to see the whole picture from just this blog post but what I essentially have is: - Automated TLS (powered by LetsEncrypt, either DN01 or HTTP01) for the theoretical `ssh.<environment>.<project>.<org>.paas.tld` endpoint - SSH access to a separate pod in the same container namespace as the original workload (which can be dynamically controlled, turned on/off, etc) - The usual SSH security - Traffic all over the HTTPS ports (443), so it opens something that I haven't seen yet -- completely-in-the-browser SSH (as in compile SSH with emscripten, pair that with a browser-side terminal emulator, and maybe speak SSH from the browser directly to the container someday +/- some websocket shenanigans). [0]: https://fly.io/blog/ssh-and-user-mode-ip-wireguard https://fly.io/blog/ssh-and-user-mode-ip-wireguard [1]: https://news.ycombinator.com/item?id=26315695 https://news.ycombinator.com/item?id=26315695