Use host-managed reverse tunnel key

.dockerignore

@@ -6,3 +6,4 @@ tmp
 *.exe~
 node_modules
 deploy/tunnel/data
+secrets

.gitignore

@@ -1,4 +1,5 @@
 rmm.db
+.env
 *.db
 *.db-shm
 *.db-wal
@@ -11,5 +12,6 @@ rmm-server
 rmm-server.exe
 *.exe~
 deploy/tunnel/data/
+secrets/
 router_tunnel_key
 router_tunnel_key.pub

compose.yaml

@@ -27,6 +27,7 @@ services:
       - "${RMM_TUNNEL_BIND_IP:-0.0.0.0}:22000-22099:22000-22099"
     volumes:
       - tunnel-data:/data
+      - ./secrets/router_tunnel_key.pub:/bootstrap/router_tunnel_key.pub:ro
     restart: unless-stopped
 
 volumes:

deploy/tunnel/entrypoint.sh

@@ -15,17 +15,24 @@ if [ ! -f /data/ssh_host_rsa_key ]; then
 	ssh-keygen -q -t rsa -b 3072 -N '' -f /data/ssh_host_rsa_key
 fi
 
-if [ ! -f /data/router_tunnel_key ]; then
-	ssh-keygen -q -t ed25519 -N '' -C 'rmm-router-tunnel' -f /data/router_tunnel_key
+if [ -f /bootstrap/router_tunnel_key.pub ]; then
+	printf 'restrict,port-forwarding %s\n' "$(cat /bootstrap/router_tunnel_key.pub)" > /data/authorized_keys
+else
+	if [ ! -f /data/router_tunnel_key ]; then
+		ssh-keygen -q -t ed25519 -N '' -C 'rmm-router-tunnel' -f /data/router_tunnel_key
+	fi
+	if [ ! -f /data/authorized_keys ]; then
+		printf 'restrict,port-forwarding %s\n' "$(cat /data/router_tunnel_key.pub)" > /data/authorized_keys
+	fi
 fi
 
-if [ ! -f /data/authorized_keys ]; then
-	printf 'restrict,port-forwarding %s\n' "$(cat /data/router_tunnel_key.pub)" > /data/authorized_keys
+chmod 0600 /data/ssh_host_ed25519_key /data/ssh_host_rsa_key /data/authorized_keys
+chmod 0644 /data/ssh_host_ed25519_key.pub /data/ssh_host_rsa_key.pub
+if [ -f /data/router_tunnel_key ]; then
+	chmod 0600 /data/router_tunnel_key
+	chmod 0644 /data/router_tunnel_key.pub
 fi
-
-chmod 0600 /data/ssh_host_ed25519_key /data/ssh_host_rsa_key /data/router_tunnel_key /data/authorized_keys
-chmod 0644 /data/ssh_host_ed25519_key.pub /data/ssh_host_rsa_key.pub /data/router_tunnel_key.pub
 chown rmm-tunnel:rmm-tunnel /data/authorized_keys
 
-echo "Tunnel SSH endpoint ready. Install /data/router_tunnel_key on each approved router."
+echo "Tunnel SSH endpoint ready."
 exec /usr/sbin/sshd -D -e -f /etc/ssh/sshd_config

docs/docker-compose.md

@@ -40,14 +40,18 @@ The SQLite database and SSH keys are stored in named Docker volumes.
 
 For HTTPS and domain-based access, use [npmplus.md](npmplus.md) or the optional Caddy overlay described in [reverse-proxy.md](reverse-proxy.md).
 
-## 3. Install The Tunnel Key On OpenWrt
+## 3. Generate And Install The Tunnel Key
 
-The SSH sidecar generates one persistent router client key on first start. Copy it out:
+Generate the router tunnel key before starting Compose:
 
-```powershell
-docker compose cp tunnel-ssh:/data/router_tunnel_key .\tmp\router_tunnel_key
+```sh
+mkdir -p secrets
+ssh-keygen -t ed25519 -N '' -C rmm-router-tunnel -f secrets/router_tunnel_key
+chmod 600 secrets/router_tunnel_key
 ```
 
+Compose mounts only `secrets/router_tunnel_key.pub` into the SSH sidecar. The private key remains on the deployment host and must be installed on approved routers.
+
 OpenWrt 25 uses `apk`. Install the OpenSSH client:
 
 ```sh
@@ -57,7 +61,7 @@ apk add openssh-client
 Install the key without `scp` or SFTP:
 
 ```powershell
-Get-Content -Raw .\tmp\router_tunnel_key | ssh root@10.10.10.1 "umask 077; mkdir -p /etc/rmm-agent; cat > /etc/rmm-agent/tunnel_key; chmod 600 /etc/rmm-agent/tunnel_key"
+Get-Content -Raw .\secrets\router_tunnel_key | ssh root@10.10.10.1 "umask 077; mkdir -p /etc/rmm-agent; cat > /etc/rmm-agent/tunnel_key; chmod 600 /etc/rmm-agent/tunnel_key"
 ```
 
 Update `/etc/rmm-agent.conf`: