wmantly
36e9d5b0b3
An SSH jump host that authenticates users against the shared LDAP directory, authorizes them from the SSO Manager's inventory graph, and bridges them to downstream hosts — auditing everything. - Username-grammar routing (uid_-_target@jump) + interactive TUI picker - Inbound LDAP auth (publickey / password with off|local|all policy) - Directory-driven access (LDAP groups x /api/discovery/resources?group=) - Per-user key injection into sshPublicKey, connects downstream as the user - Shell / exec / SFTP-subsystem bridging (WinSCP works) - Web UI + HTTP API (:3002) for audit + metrics; LDAP-admin gated - Packaged like proxy: ops/install.sh + systemd, all-in-one Docker, compose - Tests: 23 unit + 3 integration (node --test), all green Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
28 lines
900 B
Bash
28 lines
900 B
Bash
#!/usr/bin/env bash
|
|
# Start the theta42/jump-host all-in-one container: Redis (background) + the
|
|
# Node app (foreground, PID 2 under dumb-init so it gets SIGTERM).
|
|
set -e
|
|
|
|
info() { echo "[INFO] $*"; }
|
|
|
|
# When the unified theta-env stack (or any deployment) bind-mounts
|
|
# ./config/jump-secrets.js at /config, point CONF_SECRETS at it.
|
|
if [[ -f /config/jump-secrets.js ]]; then
|
|
export CONF_SECRETS=/config/jump-secrets.js
|
|
info "Loaded config from /config/jump-secrets.js"
|
|
fi
|
|
|
|
# Redis for audit/metrics/session storage (app connects to 127.0.0.1:6379).
|
|
info "Starting redis..."
|
|
redis-server --daemonize yes --save '' --appendonly no
|
|
|
|
# Wait for redis to answer before starting the app.
|
|
for _ in $(seq 1 20); do
|
|
if redis-cli ping >/dev/null 2>&1; then break; fi
|
|
sleep 0.2
|
|
done
|
|
|
|
export NODE_ENV="${NODE_ENV:-production}"
|
|
info "Starting jump-host (SSH :${JUMP_SSH_PORT:-2222}, web :3002)..."
|
|
exec "$@"
|