antoniomika

Joined 11 years ago

Karma

314

Submissions

Member since

Aug 18

https://antonio.cx

[ my public key: https://keybase.io/antoniomika; my proof: https://keybase.io/antoniomika/sigs/LlYvMqpjWk7dbyijNgU-BLt6pqbTGLzewD_mmwAWr9E ]

View on Hacker News

Recent submissions

Comment · 24 days ago

Was looking for something like this but stumbled upon herdr-web-ui [0] first. They seem to do the same thing, but herdr-web-ui is completely free and self hosted and sets up as a PWA with webpush support. Seems to work decently well and it’s under heavy development. Will have to try this too!

[0] https://github.com/devswha/herdr-web-ui

Comment · 28 days ago

A number of years ago, I created a fully open source (MIT) project called sish [0] that does just this.

sish is a SSH server written specifically for tunneling. You get all of the benefits of SSH, but also automatic TLS, a web console of requests a tunnel has received, and various other features. You can also tunnel more than just HTTP(S). You can tunnel websockets, TCP connections, and even have internal alias connections for using ProxyJump within the tunnel. All stateless and all protected with SSH auth.

If you’re not interested in self hosting, there’s a hosted version at tuns.sh [1] that has multi region support and a few other cool features (including UDP tunneling) as part of the pico.sh [2] membership ($2/mo). Happy to answer any questions in this space!

[0] https://github.com/antoniomika/sish

[1] https://tuns.sh

[2] https://pico.sh

Comment · 7 months ago

We added SSH certificates support to pico.sh [1] and it's been great. Utilizing principals gave us the ability to implement a RBAC like system for specific parts of the pico.sh ecosystem. Users get the flexibility they want with limited complexity.

[1] https://pico.sh/access-control#ssh-certificates

Comment · 1 year ago

Currently, you can either provide the `BORG_REPO_PERMISSIONS` env var to borg [0] or `--permissions` flag to `borg serve` [1]. You can then enforce this as part of your `authorized_keys` command, for example.

[0] https://github.com/borgbackup/borg/blob/3cf8d7cf2f36246ded75...

[1] https://github.com/borgbackup/borg/blob/3cf8d7cf2f36246ded75...

Comment · 1 year ago

This has been replaced with a permissions feature that still provides both delete and overwrite protections. The difference is the underlying store needs to implement it rather than running a server that understands the permission differences. You can read more about this change here: https://github.com/borgbackup/borg/issues/8823#issuecomment-...

Comment · 1 year ago

Check out sysbox[0], it's a runc based runtime that allows you to run "system" containers without privilege.

[0]: https://github.com/nestybox/sysbox

Comment · 1 year ago

Yep! tuns would be the service you want since it can support forwarding arbitrary backends: https://pico.sh/tuns#custom-domains

Comment · 1 year ago

We’re actually using Unix sockets as the underlying transport layer for this. We’re also not using sshd, we custom wrote our own daemon that’s entire job is tunneling. If you’re curious about this, you can find the project here: https://github.com/antoniomika/sish

sish was actually my first foray into SSH apps. It was a lot of fun to write and pretty much implements tunnels with a routing system on top. It manages connectivity, routing, and reverse proxying all within user space. No namespaces required!

tuns can actually even tunnel UDP traffic over SSH, also entirely in user space. Docs for that can be found here: https://pico.sh/tuns#udp-tunneling

Comment · 1 year ago

We're actually fully open source and all development occurs in the open! Here's the repo https://github.com/picosh/pico and you can find us on Libera IRC

Comment · 1 year ago

Hrm that's odd! Just tested and everything looks fine. Any logs or errors you can share?

Comment · 1 year ago

Our host keys are published here and are durable: https://pico.sh/host-keys

Comment · 1 year ago

Ashburn, VA and Nuremberg, DE!

Comment · 1 year ago

Woops! Delete is supported, will update that as well

Comment · 1 year ago

Correct! The tunnels are protected using ssh auth as well, so you can ensure that only the users you want to access it can.

Comment · 1 year ago

I'd actually highly recommend taking a look at vaxis (https://github.com/rockorager/vaxis). We've moved away from wish/bubbletea and have really enjoyed working with vaxis!