Агальцов Антон
1 line
9.5 KiB
JSON
1 line
9.5 KiB
JSON
[{"content":"Настройка SSH туннелей VPS reg.ru (95.163.232.9) # На Mac Studio: создать туннель для каждого сервиса ssh -N -R 8080:localhost:8080 root@95.163.232.9 # leadera-api ssh -N -R 8081:localhost:4096 root@95.163.232.9 # opencode ssh -N -R 8082:localhost:4200 root@95.163.232.9 # leadera-fe ssh -N -R 8083:localhost:8080 root@95.163.232.9 # docs-a2v Настройка launchd plist Файл: ~/Library/LaunchAgents/com.openclaw.sshtunnel.plist\n\u0026lt;?xml version=\u0026#34;1.0\u0026#34; encoding=\u0026#34;UTF-8\u0026#34;?\u0026gt; \u0026lt;!DOCTYPE plist PUBLIC \u0026#34;-//Apple//DTD PLIST 1.0//EN\u0026#34; \u0026#34;http://www.apple.com/DTDs/PropertyList-1.0.dtd\u0026#34;\u0026gt; \u0026lt;plist version=\u0026#34;1.0\u0026#34;\u0026gt; \u0026lt;dict\u0026gt; \u0026lt;key\u0026gt;Label\u0026lt;/key\u0026gt; \u0026lt;string\u0026gt;com.openclaw.sshtunnel\u0026lt;/string\u0026gt; \u0026lt;key\u0026gt;ProgramArguments\u0026lt;/key\u0026gt; \u0026lt;array\u0026gt; \u0026lt;string\u0026gt;ssh\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;-N\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;-R\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;8080:localhost:8080\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;root@95.163.232.9\u0026lt;/string\u0026gt; \u0026lt;/array\u0026gt; \u0026lt;key\u0026gt;RunAtLoad\u0026lt;/key\u0026gt; \u0026lt;true/\u0026gt; \u0026lt;key\u0026gt;KeepAlive\u0026lt;/key\u0026gt; \u0026lt;true/\u0026gt; \u0026lt;/dict\u0026gt; \u0026lt;/plist\u0026gt; Автозапуск # Загрузить plist launchctl load ~/Library/LaunchAgents/com.openclaw.sshtunnel.plist # Проверить статус launchctl list | grep sshtunnel # Удалить (при необходимости) launchctl unload ~/Library/LaunchAgents/com.openclaw.sshtunnel.plist Доступ к сервисам Через reverse proxy на VPS:\ncode.a2v.space: порт 8080 → Mac Studio:4096 claw.a2v.space: порт 8081 → Mac Studio:8080 (leadera-api) sand.a2v.space: порт 8082 → Mac Studio:4200 (leadera-fe) docs.a2v.space: порт 8083 → Mac Studio:8080 (docs-a2v) SSL Все сервисы используют Let\u0026rsquo;s Encrypt сертификаты:\nПуть: /etc/letsencrypt/live/{claw,code,sand}.a2v.space/ Автопродление через certbot ","section":"guides","tags":["ssh","tunnel","vps","reverse-proxy"],"title":"SSH туннели для VPS reverse proxy","url":"/guides/ssh-tunnels-vps/"},{"content":"Общая схема Mac Studio (локальная сеть) → autossh (SSH-туннели) → VPS 95.163.232.9 (Debian) → nginx (HTTPS reverse proxy) → интернет Что нужно на VPS 1. Установленные пакеты apt update apt install nginx certbot python3-certbot-nginx 2. SSH-доступ Авторизация только по ключам Публичный ключ с Mac Studio добавлен в /root/.ssh/authorized_keys 3. nginx Для каждого домена создать server block:\nHTTP → редирект на HTTPS HTTPS с SSL-сертификатом Let\u0026rsquo;s Encrypt proxy_pass на localhost-порт туннеля Пример структуры:\n/etc/nginx/sites-available/ claw.a2v.space.conf code.a2v.space.conf sand.a2v.space.conf 4. SSL-сертификаты certbot certonly --nginx -d \u0026lt;domain\u0026gt; certbot renew --dry-run # проверить автообновление Что нужно на Mac Studio autossh через launchd Plist: ~/Library/LaunchAgents/com.openclaw.sshtunnel.plist\nОдин plist с несколькими -R флагами:\n\u0026lt;key\u0026gt;ProgramArguments\u0026lt;/key\u0026gt; \u0026lt;array\u0026gt; \u0026lt;string\u0026gt;/usr/local/bin/autossh\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;-M\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;0\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;-R\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;8080:localhost:18789\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;-R\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;8081:localhost:4096\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;-R\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;8082:localhost:4200\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;-R\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;8083:localhost:8080\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;root@95.163.232.9\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;-N\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;-i\u0026lt;/string\u0026gt; \u0026lt;string\u0026gt;/Users/\u0026lt;user\u0026gt;/.ssh/id_rsa\u0026lt;/string\u0026gt; \u0026lt;/array\u0026gt; Управление launchd launchctl load ~/Library/LaunchAgents/com.openclaw.sshtunnel.plist launchctl start com.openclaw.sshtunnel launchctl stop com.openclaw.sshtunnel Проверка # На VPS ss -tlnp | grep -E \u0026#39;808[0-3]\u0026#39; # Снаружи curl -I https://claw.a2v.space curl -I https://code.a2v.space curl -I https://sand.a2v.space ","section":"guides","tags":["vps","nginx","ssh","reverse-proxy","devops"],"title":"Настройка VPS как реверс-прокси","url":"/guides/vps-reverse-proxy/"},{"content":"Архитектура Mac Studio (192.168.0.37:18789) → autossh SSH-туннель → VPS 95.163.232.9:8080 → nginx HTTPS → https://claw.a2v.space Шаги настройки 1. DNS A-запись claw.a2v.space → 95.163.232.9\nNS-серверы: ns1.hosting.reg.ru, ns2.hosting.reg.ru\n2. Mac Studio — OpenClaw Порт: 18789 Конфиг: ~/.openclaw/openclaw.json 3. SSH-туннель (launchd) Plist: ~/Library/LaunchAgents/com.openclaw.sshtunnel.plist\nКлючевой флаг: -R 8080:localhost:18789\n4. VPS — nginx конфиг server { listen 80; server_name claw.a2v.space; return 301 https://$server_name$request_uri; } server { listen 443 ssl; server_name claw.a2v.space; ssl_certificate /etc/letsencrypt/live/claw.a2v.space/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/claw.a2v.space/privkey.pem; location / { proxy_pass http://127.0.0.1:8080; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } 5. SSL-сертификат certbot certonly --nginx -d claw.a2v.space 6. OpenClaw config { \u0026#34;allowedOrigins\u0026#34;: [\u0026#34;https://claw.a2v.space\u0026#34;], \u0026#34;trustedProxies\u0026#34;: [\u0026#34;127.0.0.1\u0026#34;] } ","section":"guides","tags":["openclaw","ssh","nginx","vps","reverse-proxy"],"title":"Подключение claw.a2v.space (OpenClaw)","url":"/guides/claw-a2v-space/"},{"content":"Архитектура Mac Studio (localhost:4096) → autossh SSH-туннель (-R 8081:localhost:4096) → VPS 95.163.232.9:8081 → nginx HTTPS → https://code.a2v.space Параметры Параметр Значение Локальный порт 4096 Туннель порт 8081 pm2 процесс opencode SSL сертификат /etc/letsencrypt/live/code.a2v.space/ nginx конфиг server { listen 80; server_name code.a2v.space; return 301 https://$server_name$request_uri; } server { listen 443 ssl; server_name code.a2v.space; ssl_certificate /etc/letsencrypt/live/code.a2v.space/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/code.a2v.space/privkey.pem; location / { proxy_pass http://127.0.0.1:8081; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection \u0026#34;upgrade\u0026#34;; } } SSL-сертификат certbot certonly --nginx -d code.a2v.space ","section":"guides","tags":["opencode","ssh","nginx","vps","reverse-proxy"],"title":"Подключение code.a2v.space (OpenCode)","url":"/guides/code-a2v-space/"},{"content":"Архитектура Mac Studio ├─ Frontend (Angular) :4200 (pm2: leadera-fe) ├─ Backend (Go) :8080 (pm2: leadera-api) └─ PostgreSQL 16 в Docker (Colima, container: app-leadera-db) → autossh SSH-туннель (-R 8082:localhost:4200 -R 8083:localhost:8080) → VPS 95.163.232.9 → nginx HTTPS → https://sand.a2v.space Параметры Компонент Локальный порт Туннель порт pm2 имя Frontend (Angular) 4200 8082 leadera-fe Backend (Go) 8080 8083 leadera-api SSL сертификат: /etc/letsencrypt/live/sand.a2v.space/\nnginx конфиг server { listen 80; server_name sand.a2v.space; return 301 https://$server_name$request_uri; } server { listen 443 ssl; server_name sand.a2v.space; ssl_certificate /etc/letsencrypt/live/sand.a2v.space/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/sand.a2v.space/privkey.pem; location /api { proxy_pass http://127.0.0.1:8083; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location / { proxy_pass http://127.0.0.1:8082; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } База данных PostgreSQL 16 в Docker через Colima:\nContainer: app-leadera-db Port: 5432 SSL-сертификат certbot certonly --nginx -d sand.a2v.space ","section":"guides","tags":["angular","go","docker","nginx","vps","reverse-proxy"],"title":"Подключение sand.a2v.space (Leadera Project)","url":"/guides/sand-a2v-space/"}] |