Initial project upload

Dockerfile

@@ -0,0 +1,23 @@
+# Base image
+FROM alpine:latest
+
+# Install packages - only stunnel and openssh-client are needed
+RUN apk add --no-cache stunnel openssh-client iperf3
+
+# Create a non-root user with UID 1000
+RUN addgroup -g 1000 user && adduser -u 1000 -G user -h /home/user -s /bin/sh -D user
+
+# Copy configs
+COPY stunnel.conf /etc/stunnel/stunnel.conf
+
+# Copy entrypoint and make it executable
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+# Switch to the new user
+WORKDIR /home/user
+
+# Expose the port that will be mapped by Hugging Face
+EXPOSE 2222
+
+ENTRYPOINT ["/entrypoint.sh"]

Help.md

@@ -0,0 +1,70 @@
+# Help: Architecture of the Advanced Tunnel
+
+This document describes the components, configurations, and data flow of the advanced tunneling solution.
+
+## 1. Overview
+
+The primary goal of this setup is to create a stable, secure, and multi-purpose connection between a sandboxed environment (like Google Cloud Shell or a Hugging Face Space, referred to as **cs**) and a publicly accessible Virtual Dedicated Server (**vds1**).
+
+This is achieved by running a specialized Docker container within **cs** that initiates a persistent, reverse SSH tunnel to **vds1**.
+
+## 2. Participating Hosts (Nodes)
+
+There are three main components in this architecture:
+
+1.  **Cloud Shell (cs) / Hugging Face Space**
+    *   **Role**: The host environment where the Docker container runs.
+    *   **Characteristics**: Can have a dynamic IP address, may have restricted inbound traffic.
+
+2.  **Docker Container (tunnel-container)**
+    *   **Role**: The core of the solution. It runs all the necessary software to establish and maintain the tunnels.
+    *   **Runs On**: **cs**
+
+3.  **VDS1 (vds1.iri1968.dpdns.org)**
+    *   **Role**: The public-facing anchor point and remote server.
+    *   **Characteristics**: Has a static IP address and open ports. It runs a service on port `143` that `stunnel` from the container connects to.
+
+## 3. Container Configuration
+
+The container is built from the `Dockerfile` and runs the following key software:
+
+*   **`stunnel`**: Runs as a client. It connects to **vds1** on port `143` and creates a secure TLS tunnel, which is then exposed locally within the container on `127.0.0.1:2222`.
+*   **`ssh` (client)**: This is the final and most critical piece. It connects to the local `stunnel` endpoint (`127.0.0.1:2222`) and authenticates on **vds1** as the `root` user. Once connected, it establishes several **reverse tunnels** (`-R`) back to **vds1**.
+*   **`iperf3`**: A network performance testing tool.
+
+## 4. Data Flow and Relationships
+
+The connection is established in a "reverse" direction, from the inside (**cs**) to the outside (**vds1**).
+
+```mermaid
+graph TD
+    subgraph "Cloud Shell (cs) / Hugging Face Space"
+        A[Container: ssh client] -- "connects to" --> B[local stunnel endpoint: 127.0.0.1:2222]
+    end
+
+    subgraph "Internet"
+        C(vds1.iri1968.dpdns.org)
+    end
+
+    B -- "TLS Tunnel" --> C[:143]
+    C -- "Reverse Tunnels Established" --> A
+
+```
+
+**Step-by-step flow:**
+
+1.  The `entrypoint.sh` script starts inside the container.
+2.  `stunnel` connects to `vds1:143`, creating a secure link. This link is presented as `localhost:2222` inside the container.
+3.  The `ssh` client inside the container connects to `localhost:2222`, using the private key for **vds1** (`id_rsa_vds1`) and authenticating as `root`. The traffic is routed through the `stunnel` tunnel to the `stunnel` server on `vds1`, which in turn forwards it to the main `sshd` server on `vds1`.
+4.  Once this SSH session is active, the `-R` flags create the pathways back from `vds1` to the container. For example, `-R 0.0.0.0:2222:localhost:22` on `vds1` would forward traffic to port 22 inside the container's network.
+
+This architecture effectively makes services running inside the sandboxed **cs** container accessible from the public **vds1** server.
+
+## 5. Hugging Face Deployment
+
+To deploy this container on a Hugging Face Space, you must configure one **Space Secret**:
+
+*   **Name**: `ID_RSA_VDS1`
+*   **Value**: The entire content of your private SSH key file (`id_rsa_vds1`), including the `-----BEGIN OPENSSH PRIVATE KEY-----` and `-----END OPENSSH PRIVATE KEY-----` lines.
+
+The `entrypoint.sh` script will read this secret and create the necessary key file for the SSH connection to work.

README.md

@@ -1,10 +1,21 @@
 ---
-title: Tunnel Vds1
-emoji: 🐠
-colorFrom: indigo
-colorTo: red
+license: mit
+title: Advanced Tunnel Container
 sdk: docker
-pinned: false
+emoji: 🚀
+colorFrom: gray
+colorTo: indigo
+pinned: true
+app_port: 2222
+persistent_storage: true
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# Advanced Tunnel Container
+
+## Overview
+
+This container provides a multi-purpose tunneling and network testing environment designed to establish a secure and robust connection between a local environment (like Google Cloud Shell) and a remote server (VDS).
+
+It uses a combination of `stunnel` and `SSH` to create a primary tunnel and then establishes multiple reverse tunnels for various services.
+
+See **Help.md** for a detailed description of the architecture, setup, and data flow.

docker-entrypoint.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# This wrapper script runs as root.
+
+set -e
+
+# 1. Generate SSH host keys
+/usr/bin/ssh-keygen -A
+
+# 2. Switch to the "user" and execute the main entrypoint script.
+# su-exec is a lightweight sudo/gosu alternative common in Alpine.
+exec su-exec user /entrypoint.sh

entrypoint.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+
+# 1. Create private key from secret in the user's home directory
+if [ -z "$ID_RSA_VDS1" ]; then
+  echo "Error: ID_RSA_VDS1 secret is not set."
+  exit 1
+fi
+mkdir -p /home/user/.ssh
+echo "$ID_RSA_VDS1" > /home/user/.ssh/id_rsa_vds1
+chmod 600 /home/user/.ssh/id_rsa_vds1
+chown -R user:user /home/user/.ssh
+
+# 2. Start stunnel client in the background
+stunnel /etc/stunnel/stunnel.conf &
+
+# Give stunnel a moment to connect
+sleep 3
+
+# 3. Execute the reverse SSH tunnel command in the foreground
+# This will keep the container alive
+ssh -v -N -g \
+    -o "StrictHostKeyChecking=no" \
+    -o "UserKnownHostsFile=/dev/null" \
+    -R 0.0.0.0:1080:localhost:1080 \
+    -R 0.0.0.0:2222:localhost:22 \
+    -R 0.0.0.0:5201:localhost:5201 \
+    -p 2222 root@127.0.0.1 \
+    -i /home/user/.ssh/id_rsa_vds1

sshd_config

@@ -0,0 +1,4 @@
+Port 22
+PermitRootLogin yes
+PubkeyAuthentication yes
+AuthorizedKeysFile /home/user/.ssh/authorized_keys

stunnel.conf

@@ -0,0 +1,6 @@
+foreground = yes
+client = yes
+
+[imaps-ssh]
+accept = 127.0.0.1:2222
+connect = vds1.iri1968.dpdns.org:143