From 89a82f64ce332c4155f1e13e037c133a079bcdbc Mon Sep 17 00:00:00 2001
From: benya <benya@git.daemonlord.ru>
Date: Thu, 4 Jun 2026 15:31:36 +0300
Subject: [PATCH] Use host-managed reverse tunnel key

---
 .dockerignore               |  1 +
 .gitignore                  |  2 ++
 compose.yaml                |  1 +
 deploy/tunnel/entrypoint.sh | 23 +++++++++++++++--------
 docs/docker-compose.md      | 14 +++++++++-----
 5 files changed, 28 insertions(+), 13 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index 9967758..68fc6b1 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -6,3 +6,4 @@ tmp
 *.exe~
 node_modules
 deploy/tunnel/data
+secrets
diff --git a/.gitignore b/.gitignore
index 1570702..bdf5c13 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 rmm.db
+.env
 *.db
 *.db-shm
 *.db-wal
@@ -11,5 +12,6 @@ rmm-server
 rmm-server.exe
 *.exe~
 deploy/tunnel/data/
+secrets/
 router_tunnel_key
 router_tunnel_key.pub
diff --git a/compose.yaml b/compose.yaml
index 32f94fe..7c435bf 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -27,6 +27,7 @@ services:
       - "${RMM_TUNNEL_BIND_IP:-0.0.0.0}:22000-22099:22000-22099"
     volumes:
       - tunnel-data:/data
+      - ./secrets/router_tunnel_key.pub:/bootstrap/router_tunnel_key.pub:ro
     restart: unless-stopped
 
 volumes:
diff --git a/deploy/tunnel/entrypoint.sh b/deploy/tunnel/entrypoint.sh
index 2117ff3..fdd1c86 100644
--- a/deploy/tunnel/entrypoint.sh
+++ b/deploy/tunnel/entrypoint.sh
@@ -15,17 +15,24 @@ if [ ! -f /data/ssh_host_rsa_key ]; then
 	ssh-keygen -q -t rsa -b 3072 -N '' -f /data/ssh_host_rsa_key
 fi
 
-if [ ! -f /data/router_tunnel_key ]; then
-	ssh-keygen -q -t ed25519 -N '' -C 'rmm-router-tunnel' -f /data/router_tunnel_key
+if [ -f /bootstrap/router_tunnel_key.pub ]; then
+	printf 'restrict,port-forwarding %s\n' "$(cat /bootstrap/router_tunnel_key.pub)" > /data/authorized_keys
+else
+	if [ ! -f /data/router_tunnel_key ]; then
+		ssh-keygen -q -t ed25519 -N '' -C 'rmm-router-tunnel' -f /data/router_tunnel_key
+	fi
+	if [ ! -f /data/authorized_keys ]; then
+		printf 'restrict,port-forwarding %s\n' "$(cat /data/router_tunnel_key.pub)" > /data/authorized_keys
+	fi
 fi
 
-if [ ! -f /data/authorized_keys ]; then
-	printf 'restrict,port-forwarding %s\n' "$(cat /data/router_tunnel_key.pub)" > /data/authorized_keys
+chmod 0600 /data/ssh_host_ed25519_key /data/ssh_host_rsa_key /data/authorized_keys
+chmod 0644 /data/ssh_host_ed25519_key.pub /data/ssh_host_rsa_key.pub
+if [ -f /data/router_tunnel_key ]; then
+	chmod 0600 /data/router_tunnel_key
+	chmod 0644 /data/router_tunnel_key.pub
 fi
-
-chmod 0600 /data/ssh_host_ed25519_key /data/ssh_host_rsa_key /data/router_tunnel_key /data/authorized_keys
-chmod 0644 /data/ssh_host_ed25519_key.pub /data/ssh_host_rsa_key.pub /data/router_tunnel_key.pub
 chown rmm-tunnel:rmm-tunnel /data/authorized_keys
 
-echo "Tunnel SSH endpoint ready. Install /data/router_tunnel_key on each approved router."
+echo "Tunnel SSH endpoint ready."
 exec /usr/sbin/sshd -D -e -f /etc/ssh/sshd_config
diff --git a/docs/docker-compose.md b/docs/docker-compose.md
index 1f671d5..e75fe13 100644
--- a/docs/docker-compose.md
+++ b/docs/docker-compose.md
@@ -40,14 +40,18 @@ The SQLite database and SSH keys are stored in named Docker volumes.
 
 For HTTPS and domain-based access, use [npmplus.md](npmplus.md) or the optional Caddy overlay described in [reverse-proxy.md](reverse-proxy.md).
 
-## 3. Install The Tunnel Key On OpenWrt
+## 3. Generate And Install The Tunnel Key
 
-The SSH sidecar generates one persistent router client key on first start. Copy it out:
+Generate the router tunnel key before starting Compose:
 
-```powershell
-docker compose cp tunnel-ssh:/data/router_tunnel_key .\tmp\router_tunnel_key
+```sh
+mkdir -p secrets
+ssh-keygen -t ed25519 -N '' -C rmm-router-tunnel -f secrets/router_tunnel_key
+chmod 600 secrets/router_tunnel_key
 ```
 
+Compose mounts only `secrets/router_tunnel_key.pub` into the SSH sidecar. The private key remains on the deployment host and must be installed on approved routers.
+
 OpenWrt 25 uses `apk`. Install the OpenSSH client:
 
 ```sh
@@ -57,7 +61,7 @@ apk add openssh-client
 Install the key without `scp` or SFTP:
 
 ```powershell
-Get-Content -Raw .\tmp\router_tunnel_key | ssh root@10.10.10.1 "umask 077; mkdir -p /etc/rmm-agent; cat > /etc/rmm-agent/tunnel_key; chmod 600 /etc/rmm-agent/tunnel_key"
+Get-Content -Raw .\secrets\router_tunnel_key | ssh root@10.10.10.1 "umask 077; mkdir -p /etc/rmm-agent; cat > /etc/rmm-agent/tunnel_key; chmod 600 /etc/rmm-agent/tunnel_key"
 ```
 
 Update `/etc/rmm-agent.conf`: