bore-connect.sh - SSH tunnel via bore.pub (hermes-agent + Val keys)

bore-connect.sh

#!/bin/sh
# bore-connect.sh - SSH tunnel via our self-hosted relay edge.sh.zone
# Usage: curl -sSL <GIST_URL> | sh
#   Optional: BORE_PORT=<local sshd port>   (default 34522)
#             TUNNEL_PORT=<20200-20300>     (default: RANDOM in 20200-20300, public port on edge.sh.zone)
#             INCLUDE_VAL_KEY=1             (also install Val's personal key)
#
# Deploys hermes SSH key by default, exposes the LOCAL sshd through our own
# secret-authed relay edge.sh.zone (49.13.78.204), and cleans up keys on exit.
# Secret is embedded below (HMAC challenge-response, never crosses the wire in clear).

set -e

PORT="${BORE_PORT:-34522}"
# Public tunnel port: random in 20200-20300 when not provided, so concurrent
# tunnels never collide / overwrite each other on the same edge.sh.zone endpoint.
if [ -z "$TUNNEL_PORT" ]; then
  TUNNEL_PORT=$(awk 'BEGIN{srand();print int(20200+rand()*101)}')
fi
RELAY="edge.sh.zone"
SECRET="0ee90ec3b57d3ff02635702a4f7adfdae2ecbc64220639cc"

# Keys
HERMES_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOgmN+oZjWaL97ZbcN1PPoCsQKESAVxRGqTQxD4yJLZj hermes@xo-one-hermes"
VAL_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKMidTQ6KGfZtonNKd1HtNPPDiPtzEmlg5yOduvmZzTA"
INCLUDE_VAL_KEY="${INCLUDE_VAL_KEY:-0}"
SESSION="bore-tunnel"

# tmux required for the persistent session
command -v tmux >/dev/null 2>&1 || { echo "[!] tmux required but not found."; exit 1; }

# --- Locate or install bore: prefer the SYSTEM PACKAGE, fall back to /tmp ---
BORE=""
if command -v bore >/dev/null 2>&1; then
  BORE="bore"
  printf "[*] bore already installed: %s\n" "$(command -v bore)"
elif command -v yay >/dev/null 2>&1; then
  printf "[*] Arch detected (yay) - installing bore-cli from AUR...\n"
  yay -S --noconfirm bore-cli >/dev/null 2>&1 && BORE="bore"
elif command -v paru >/dev/null 2>&1; then
  printf "[*] Arch detected (paru) - installing bore-cli from AUR...\n"
  paru -S --noconfirm bore-cli >/dev/null 2>&1 && BORE="bore"
elif command -v brew >/dev/null 2>&1; then
  printf "[*] macOS/Homebrew detected - installing bore-cli...\n"
  brew install bore-cli >/dev/null 2>&1 && BORE="bore"
elif command -v cargo >/dev/null 2>&1; then
  printf "[*] cargo detected - installing bore-cli...\n"
  cargo install bore-cli >/dev/null 2>&1 && BORE="bore"
fi

# Fallback: static musl binary to /tmp (no install, no root)
if [ -z "$BORE" ] || ! command -v bore >/dev/null 2>&1; then
  if [ ! -f /tmp/bore ]; then
    printf "[*] No system package - downloading static bore to /tmp...\n"
    A=$(uname -m)
    case "$A" in
      x86_64)        A="x86_64";;
      aarch64|arm64) A="aarch64";;
      *) printf "[!] Unsupported arch: %s\n" "$A"; exit 1;;
    esac
    curl -sSL "https://github.com/ekzhang/bore/releases/download/v0.5.2/bore-v0.5.2-${A}-unknown-linux-musl.tar.gz" | tar xz -C /tmp 2>/dev/null || { printf "[!] Download failed\n"; exit 1; }
    chmod +x /tmp/bore
  fi
  BORE="/tmp/bore"
fi

# Kill old session if exists
tmux kill-session -t "$SESSION" 2>/dev/null || true

# Write the worker script to /tmp
cat > /tmp/bore-worker.sh << WORKER
#!/bin/sh
HERMES_KEY="$HERMES_KEY"
VAL_KEY="$VAL_KEY"
INCLUDE_VAL_KEY="$INCLUDE_VAL_KEY"
BORE="$BORE"
PORT="$PORT"
TUNNEL_PORT="$TUNNEL_PORT"
RELAY="$RELAY"
SECRET="$SECRET"

cleanup() {
  printf "\n[*] Cleaning up...\n"
  grep -vF "\$HERMES_KEY" ~/.ssh/authorized_keys > ~/.ssh/authorized_keys.tmp 2>/dev/null || true
  mv ~/.ssh/authorized_keys.tmp ~/.ssh/authorized_keys 2>/dev/null || true
  if [ "\$INCLUDE_VAL_KEY" = "1" ]; then
    grep -vF "\$VAL_KEY" ~/.ssh/authorized_keys > ~/.ssh/authorized_keys.tmp 2>/dev/null || true
    mv ~/.ssh/authorized_keys.tmp ~/.ssh/authorized_keys 2>/dev/null || true
  fi
  rm -f /tmp/bore-worker.sh 2>/dev/null || true
  printf "[*] Keys removed. Done.\n"
  exit 0
}
trap cleanup INT TERM

# Install SSH keys
mkdir -p ~/.ssh && chmod 700 ~/.ssh
touch ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys
grep -qF "\$HERMES_KEY" ~/.ssh/authorized_keys 2>/dev/null || echo "\$HERMES_KEY" >> ~/.ssh/authorized_keys
if [ "\$INCLUDE_VAL_KEY" = "1" ]; then
  grep -qF "\$VAL_KEY" ~/.ssh/authorized_keys 2>/dev/null || echo "\$VAL_KEY" >> ~/.ssh/authorized_keys
  printf "[*] Both hermes and Val keys installed.\n"
else
  printf "[*] hermes key installed (Val key skipped - set INCLUDE_VAL_KEY=1 to include).\n"
fi

printf "\n"
printf "=========================================\n"
printf " bore -> %s:%s  (local sshd :%s)\n" "\$RELAY" "\$TUNNEL_PORT" "\$PORT"
printf " Ctrl+C to close (auto-cleanup)\n"
printf "=========================================\n\n"
"\$BORE" local "\$PORT" --to "\$RELAY" --secret "\$SECRET" --port "\$TUNNEL_PORT"
cleanup
WORKER
chmod +x /tmp/bore-worker.sh

# Launch in tmux
tmux new-session -d -s "$SESSION" "sh /tmp/bore-worker.sh"
sleep 3

# Wait for bore to confirm it is listening (up to 10s)
i=0
while [ $i -lt 10 ]; do
  tmux capture-pane -t "$SESSION" -p 2>/dev/null | grep -q "listening at" && break
  sleep 1; i=$((i+1))
done

# Clean summary block - printed OUTSIDE tmux so bore logs never overwrite it
printf "\n"
printf "==================================================\n"
printf "  BORE TUNNEL UP\n"
printf "  public  : %s:%s\n" "$RELAY" "$TUNNEL_PORT"
printf "  local   : sshd :%s\n" "$PORT"
printf "\n"
printf "  connect : ssh -p %s root@%s\n" "$TUNNEL_PORT" "$RELAY"
printf "  stop    : tmux kill-session -t %s\n" "$SESSION"
printf "==================================================\n\n"