remotereach

package

v0.56.4 Latest Latest Go to latest Published: Nov 7, 2026 License: Apache-2.0 Imports: 11 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/kombifyio/stackkits

Links

Open Source Insights

Documentation ¶

Overview ¶

Package remotereach runs the Cloudflare Tunnel connector of a home server (homelab identity target §7, §8, §14 decisions 4 and 10): kombify.me tunnel mode (a remotely managed tunnel under the homelab's base, its token sealed to this node's local custody or delivered through the kombify Wallet), or a tunnel in the Owner's own Cloudflare account (provisioned by Techstack from a token in custody, or a tunnel token the Owner supplies in Standard Mode, whose ingress stays in the Owner's dashboard).

The connector runs the pinned cloudflared image as its own Compose project, joined only to the connector network, where the alias stackkit-remote-listener.internal is the remote router's remote entrypoint; the Home firewall drops everything that bridge sends to the host or a private address. It holds no host port, no capability and no other network. Its token stays in Owner custody, readable only by the connector's account, and is never printed, logged or written to a receipt.

Constants ¶

View Source

const (
	// ComposeProject is the connector's Compose project.
	ComposeProject = "stackkit-remote-reach"
	// ConnectorContainer is the connector's container name.
	ConnectorContainer = "stackkit-remote-reach-connector"
	// ConnectorNetwork is the Basement core's connector network.
	ConnectorNetwork = "stackkit-remote-connector"
	// ListenerAlias is the remote listener's name on the connector network.
	ListenerAlias = "stackkit-remote-listener.internal"
	// ListenerService is the ingress every reach tunnel targets.
	ListenerService = "http://" + ListenerAlias + ":8000"
)

View Source

const (
	// ModeKombifyMe is kombify.me tunnel mode with the homelab's own Me
	// registration; the token is sealed to this node's local custody.
	ModeKombifyMe = "kombify-me"
	// ModeWalletItem takes the token from a Wallet item delivered to this node
	// (a kombify account's kombify.me tunnel, or a tunnel Techstack
	// provisioned in the Owner's Cloudflare account).
	ModeWalletItem = "wallet-item"
	// ModeOwnerToken runs a tunnel token the Owner supplies (Standard Mode).
	ModeOwnerToken = "owner-token"
)

Modes of the reach tunnel.

Variables ¶

This section is empty.

Functions ¶

func ValidToken ¶

func ValidToken(raw []byte) bool

ValidToken reports whether raw has the shape of a tunnel token.

Types ¶

type Host ¶

type Host struct {
	Workspace string
	Image     string
	Run       Runner
	Now       func() time.Time
}

Host binds the connector lifecycle to one workspace.

func (Host) Health ¶

func (h Host) Health(ctx context.Context) string

Health is the connector container's health as the engine reports it.

func (Host) Install ¶

func (h Host) Install(ctx context.Context, state State, token []byte) error

Install writes the token into custody for the connector's account only, writes the connector project and starts it, replacing a running one.

func (Host) Load ¶

func (h Host) Load() (State, error)

Load reads the running reach tunnel's state; os.ErrNotExist when off.

func (Host) Remove ¶

func (h Host) Remove(ctx context.Context) error

Remove stops the connector and deletes its token, project and state; a connector that is already gone is no error.

func (Host) RequireConnectorNetwork ¶

func (h Host) RequireConnectorNetwork(ctx context.Context) error

RequireConnectorNetwork fails unless the connector can run isolated: the applied Basement core's connector network (bridge skremote0, not internal, whose only other member is the remote router) and the Home firewall that drops everything that bridge sends to the host or a private address (homelab identity target §7, §14 decision 10).

type Runner ¶

type Runner func(ctx context.Context, name string, args ...string) ([]byte, error)

Runner runs one host command and answers its combined output.

type State ¶

type State struct {
	APIVersion   string `json:"apiVersion"`
	Mode         string `json:"mode"`
	Base         string `json:"base,omitempty"`
	TunnelID     string `json:"tunnelId,omitempty"`
	WalletTenant string `json:"walletTenant,omitempty"`
	WalletItem   string `json:"walletItem,omitempty"`
	EnabledAt    string `json:"enabledAt"`
}

State is the public record of the running reach tunnel.

Source Files ¶

View all Source files

connector.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL