feat: add ssh tunnels and preserved stop flow

Author: gitlayzer

Dockerfile

@@ -1,6 +1,8 @@
 FROM golang:1.25.10-alpine AS builder
 
 WORKDIR /app
+ENV GOPROXY=https://proxy.golang.org|direct
+RUN apk add --no-cache ca-certificates git
 COPY go.mod go.sum* ./
 RUN go mod download
 
@@ -10,5 +12,6 @@ RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s -X github.com/labring/seal
 
 FROM scratch
 
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=builder /app/sealtun /sealtun
 ENTRYPOINT ["/sealtun"]

README.md

@@ -182,14 +182,41 @@ export SEALTUN_TEMP_TOKEN='review-link-secret'
 sealtun expose 3000 --temporary-access-token-env SEALTUN_TEMP_TOKEN --temporary-access-ttl 1h
 ```
 
-Bearer Token 和临时链接 token 至少需要 8 个字符，只保存 SHA-256 hash，不会写入 Deployment 参数；临时链接使用 `?_sealtun_token=...` 访问，Sealtun 会在转发到本地服务前移除该查询参数。IP 规则优先使用 Ingress/代理传入的 `X-Real-IP`，再回退到最近一跳 `X-Forwarded-For`。Basic Auth 与 Bearer/临时链接同时配置时，任一认证方式通过即可访问。
+Bearer Token 和临时链接 token 至少需要 8 个字符，只保存 SHA-256 hash，不会写入 Deployment 参数；临时链接使用 `?_sealtun_token=...` 访问，Sealtun 会在转发到本地服务前移除该查询参数。IP 规则优先使用 Ingress/代理传入的 `X-Real-IP`，再回退到 `X-Forwarded-For` 中最后一个有效的代理确认客户端 IP。Basic Auth 与 Bearer/临时链接同时配置时，任一认证方式通过即可访问。
 
 Sealtun 会自动执行以下操作：
 1. 在你的 Sealos Namespace 中启动一个隧道代理 Pod。
 2. 配置 Ingress 路由规则。
 3. 建立加密 WebSocket 隧道，并将所有流量转发至 `localhost:3000`。
 
-### 3. 使用自定义域名
+### 3. SSH 公网访问
+如果 Sealos Region 支持公网 TCP NodePort，可以用四层 SSH 模式直接连接公网域名和端口：
+
+```bash
+# macOS/Linux 常见 SSH 端口是 22；也可以换成本机 sshd 监听的其他端口
+sealtun expose 22 --protocol ssh
+```
+
+命令会输出公网 SSH 入口：
+```bash
+ssh <user>@<public-host> -p <node-port>
+```
+
+也可以写进 `~/.ssh/config`，之后直接 `ssh sealtun-dev`：
+```sshconfig
+Host sealtun-dev
+  HostName <public-host>
+  User <user>
+  Port <node-port>
+```
+
+`--protocol ssh` 的公网业务入口只有 TCP NodePort，不会提供默认 HTTPS 业务 URL。Sealtun 仍会保留内部控制通道供本地 daemon 连接远端 Pod，但它不作为 SSH 隧道的用户访问入口。Basic Auth、Bearer Token、临时链接、IP 规则和自定义域名只适用于 HTTPS 隧道，不适用于 SSH 四层入口。旧的 WebSocket ProxyCommand 备用方式仍可用：
+
+```bash
+ssh -o ProxyCommand='sealtun ssh connect <tunnel-id>' <user>@sealtun
+```
+
+### 4. 使用自定义域名
 新建隧道时先生成官方 Sealos 域名和 CNAME 目标：
 ```bash
 sealtun expose 3000 --domain app.example.com
@@ -311,7 +338,8 @@ basicAuth:
 
 ## 🛠️ 架构详情
 
-- **底层协议**：基于 WebSocket 的 Yamux 多路复用。
+- **HTTPS 隧道协议**：基于 WebSocket 的 Yamux 多路复用。
+- **SSH 四层入口**：`--protocol ssh` 只提供公网 TCP NodePort 直连本地 SSH；HTTPS 只作为内部控制通道，不提供默认业务 URL。
 - **Sealos 资源**：触发 `sealtun expose` 时，会在集群中创建以 `sealtun-*` 命名的 `Deployment`、`Service` 和 `Ingress`。
 - **镜像来源**：依赖于 `ghcr.io/gitlayzer/sealtun` 的原生镜像。
 
@@ -331,12 +359,13 @@ basicAuth:
 - 声明式配置支持 `sealtun diff -f`、多 tunnel 批量 apply 和 `ttl` 自动过期清理。
 - `logs` 读取远端 tunnel Pod 日志；`metrics` 聚合本地、远端和 server counters，其中 server counters 需要新版本远端镜像支持。
 - `dashboard` 是本地只读 Web 控制台，不需要额外服务端组件。
-- `apply -f sealtun.yaml` 是声明式配置 MVP，当前覆盖 HTTPS 隧道、稳定 tunnel name、自定义域名指引和 daemon 托管。
-- 提供 `status`、`list`、`inspect`、`doctor`、`stop`、`cleanup`、`logout` 等本地控制命令。
+- `apply -f sealtun.yaml` 支持 HTTPS 隧道、SSH 四层隧道、稳定 tunnel name、自定义域名指引和 daemon 托管。
+- 提供 `status`、`list`、`inspect`、`doctor`、`stop`、`start/resume`、`cleanup`、`logout` 等本地控制命令。
+- `stop` 只会把远端 tunnel Pod 副本缩容为 0，保留域名、Service、Ingress、Secret 与本地 session；可用 `sealtun start <tunnel-id>` 恢复。`cleanup` 默认删除 stopped/expired/stale 隧道，`cleanup --all` 才会强制删除所有本地跟踪的隧道资源。
 - `list` 默认只读取本地 session；需要探测本地端口健康时可使用 `list --check`。
 - `inspect` 默认展示本地状态；需要远端 Kubernetes 诊断时可使用 `inspect --remote`。
 - `logout` 会先回收本地记录中的隧道资源再删除凭据；如果只想强制清除本地凭据，可使用 `logout --force`。
-- 当前 `--protocol` 只接受 `https`。TCP、UDP 和 gRPC 泛化暂不支持，后续如果需要会以单独能力设计，而不是继续复用当前 HTTP Ingress 路径。
+- 当前 `--protocol` 支持 `https` 和专用 `ssh` 模式。`ssh` 不支持 Basic Auth、Bearer Token、临时链接、IP 规则和自定义域名。通用 TCP、UDP 和 gRPC 泛化暂不支持，后续如果需要会以单独能力设计，而不是继续复用当前 HTTP Ingress 路径。
 - `doctor` 会汇总本地 daemon、登录、session、端口健康和远端 Deployment、Service、Ingress、Pod 与 Event 状态，用于定位镜像拉取、Pod 未就绪、Ingress 缺失等问题。
 
 ## 📄 许可证

README_EN.md

@@ -182,14 +182,41 @@ export SEALTUN_TEMP_TOKEN='review-link-secret'
 sealtun expose 3000 --temporary-access-token-env SEALTUN_TEMP_TOKEN --temporary-access-ttl 1h
 ```
 
-Bearer and temporary-link tokens must be at least 8 characters. They are stored only as SHA-256 hashes and are not written into Deployment args. Temporary links use `?_sealtun_token=...`; Sealtun strips that query parameter before forwarding the request to your local service. IP rules prefer the `X-Real-IP` value set by the Ingress/proxy and fall back to the nearest `X-Forwarded-For` hop. When Basic Auth and Bearer/temporary tokens are both configured, either authentication method can grant access.
+Bearer and temporary-link tokens must be at least 8 characters. They are stored only as SHA-256 hashes and are not written into Deployment args. Temporary links use `?_sealtun_token=...`; Sealtun strips that query parameter before forwarding the request to your local service. IP rules prefer the `X-Real-IP` value set by the Ingress/proxy and fall back to the last valid proxy-confirmed client IP in `X-Forwarded-For`. When Basic Auth and Bearer/temporary tokens are both configured, either authentication method can grant access.
 
 Sealtun will:
 1. Spin up a tunnel proxy Pod in your Sealos namespace.
 2. Establish the Ingress routes.
 3. Automatically connect via WebSockets and proxy all L7 connections back to `localhost:3000`.
 
-### 3. Use a custom domain
+### 3. Public SSH access
+If the Sealos region supports public TCP NodePort, use the L4 SSH mode to connect directly to the public host and port:
+
+```bash
+# macOS/Linux commonly use port 22; replace it if your local sshd listens elsewhere
+sealtun expose 22 --protocol ssh
+```
+
+The command prints a public SSH endpoint:
+```bash
+ssh <user>@<public-host> -p <node-port>
+```
+
+Or add an SSH config entry and then run `ssh sealtun-dev`:
+```sshconfig
+Host sealtun-dev
+  HostName <public-host>
+  User <user>
+  Port <node-port>
+```
+
+`--protocol ssh` exposes only a public TCP NodePort for user traffic and does not provide a default HTTPS application URL. Sealtun still keeps an internal control channel so the local daemon can connect to the remote pod, but that channel is not a user-facing SSH entry. Basic Auth, Bearer tokens, temporary links, IP policies, and custom domains apply only to HTTPS tunnels, not to the L4 SSH entry. The older WebSocket ProxyCommand fallback remains available:
+
+```bash
+ssh -o ProxyCommand='sealtun ssh connect <tunnel-id>' <user>@sealtun
+```
+
+### 4. Use a custom domain
 Create the tunnel first and print the Sealos-managed CNAME target:
 ```bash
 sealtun expose 3000 --domain app.example.com
@@ -311,14 +338,15 @@ basicAuth:
 
 ## Architecture Details
 
-- **Protocol**: Yamux over Websocket.
+- **HTTPS tunnel protocol**: Yamux over WebSocket.
+- **SSH L4 entry**: `--protocol ssh` exposes only a public TCP NodePort that connects directly to local SSH; HTTPS is kept only as an internal control channel, not as a default application URL.
 - **Sealos Resources**: When you trigger `sealtun expose`, it creates `sealtun-*` variants of `Deployment`, `Service`, and `Ingress` in the active cluster context.
 - **Images**: Relies on a single Docker image built natively targeting `ghcr.io/gitlayzer/sealtun`.
 
 ## Hardening Notes
 
 - `expose` now validates port and protocol inputs before provisioning remote resources.
-- `--protocol` currently supports only `https`. TCP, UDP, and gRPC are intentionally out of scope until there is a dedicated transport design for them.
+- `--protocol` currently supports `https` and the dedicated `ssh` mode. `ssh` does not support Basic Auth, Bearer tokens, temporary links, IP policies, or custom domains. Generic TCP, UDP, and gRPC are intentionally out of scope until there is a dedicated transport design for them.
 - `profile` supports named login bundles for multiple accounts, regions, and workspaces; `profile use` switches the active kubeconfig used by later `expose`, `status`, and `region current` commands.
 - Ingress host generation prefers the `SEALOS_DOMAIN` returned by Sealos Launchpad instead of guessing from the region host.
 - Custom domains must pass CNAME ownership verification before Sealtun writes the custom host to Ingress, preventing unverified host preemption on shared Ingress controllers.
@@ -329,7 +357,9 @@ basicAuth:
 - Declarative config supports `sealtun diff -f`, multi-tunnel batch apply, and `ttl` automatic expiry cleanup.
 - `logs` reads remote tunnel pod logs; `metrics` aggregates local state, remote readiness, and server counters when the remote image supports them.
 - `dashboard` is a local read-only web console and does not require any additional hosted backend.
-- `apply -f sealtun.yaml` is the declarative config MVP for HTTPS tunnels, stable tunnel names, custom domain guidance, and daemon-managed sessions.
+- `apply -f sealtun.yaml` supports HTTPS tunnels, SSH L4 tunnels, stable tunnel names, custom domain guidance, and daemon-managed sessions.
+- Local controls include `status`, `list`, `inspect`, `doctor`, `stop`, `start/resume`, `cleanup`, and `logout`.
+- `stop` only scales the remote tunnel pod Deployment to zero, preserving the domain, Service, Ingress, secrets, and local session. Use `sealtun start <tunnel-id>` to reopen it. `cleanup` deletes stopped, expired, or stale tunnels by default; `cleanup --all` is the force path for deleting every locally tracked tunnel.
 - `list` reads local session records by default; use `list --check` to probe local target ports and report degraded sessions.
 - `inspect` shows local session state by default; use `inspect --remote` to include best-effort Kubernetes diagnostics.
 - `doctor` summarizes daemon, login, session, local port, and remote Deployment, Service, Ingress, Pod, and Event diagnostics.

cmd/apply.go

@@ -67,9 +67,11 @@ type diffResult struct {
 type applyResult struct {
 	Name          string                 `json:"name"`
 	TunnelID      string                 `json:"tunnelId"`
+	Protocol      string                 `json:"protocol"`
 	Host          string                 `json:"host"`
 	SealosHost    string                 `json:"sealosHost,omitempty"`
 	CustomDomain  string                 `json:"customDomain,omitempty"`
+	PublicPort    int32                  `json:"publicPort,omitempty"`
 	LocalPort     string                 `json:"localPort"`
 	BasicAuth     bool                   `json:"basicAuth"`
 	BasicAuthUser string                 `json:"basicAuthUser,omitempty"`
@@ -183,6 +185,7 @@ func runApply(ctx context.Context, path string, dryRun bool) ([]applyResult, err
 			results = append(results, applyResult{
 				Name:          normalized.Name,
 				TunnelID:      normalized.TunnelID,
+				Protocol:      normalized.Protocol,
 				LocalPort:     normalized.LocalPort,
 				BasicAuth:     normalized.BasicAuth != nil && normalized.BasicAuth.Enabled,
 				BasicAuthUser: basicAuthUsername(normalized.BasicAuth),
@@ -296,6 +299,7 @@ func applyOneTunnel(ctx context.Context, item applyTunnel, authData *auth.AuthDa
 	result = applyResult{
 		Name:          normalized.Name,
 		TunnelID:      normalized.TunnelID,
+		Protocol:      normalized.Protocol,
 		LocalPort:     normalized.LocalPort,
 		BasicAuth:     normalized.BasicAuth != nil && normalized.BasicAuth.Enabled,
 		BasicAuthUser: basicAuthUsername(normalized.BasicAuth),
@@ -439,6 +443,7 @@ func applyOneTunnel(ctx context.Context, item applyTunnel, authData *auth.AuthDa
 	result.Host = hosts.PublicHost
 	result.SealosHost = hosts.SealosHost
 	result.CustomDomain = hosts.CustomDomain
+	result.PublicPort = hosts.PublicPort
 	result.BasicAuth = normalized.BasicAuth != nil && normalized.BasicAuth.Enabled
 	result.BasicAuthUser = basicAuthUsername(normalized.BasicAuth)
 	result.AccessPolicy = normalized.AccessPolicy != nil
@@ -463,6 +468,7 @@ func buildApplySessionRecord(normalized normalizedApplyTunnel, authData *auth.Au
 		Host:            hosts.PublicHost,
 		SealosHost:      hosts.SealosHost,
 		CustomDomain:    hosts.CustomDomain,
+		PublicPort:      hosts.PublicPort,
 		LocalPort:       normalized.LocalPort,
 		Secret:          secret,
 		BasicAuth:       normalized.BasicAuth,
@@ -576,6 +582,7 @@ func normalizeApplyTunnel(item applyTunnel) (normalizedApplyTunnel, error) {
 	if err := validateProtocol(protocol); err != nil {
 		return normalizedApplyTunnel{}, fmt.Errorf("tunnel %s: %w", tunnelID, err)
 	}
+	protocol = tunnelprotocol.Normalize(protocol)
 	customDomain, err := validateCustomDomain(item.Domain)
 	if err != nil {
 		return normalizedApplyTunnel{}, fmt.Errorf("tunnel %s: %w", tunnelID, err)
@@ -597,6 +604,17 @@ func normalizeApplyTunnel(item applyTunnel) (normalizedApplyTunnel, error) {
 	if err != nil {
 		return normalizedApplyTunnel{}, fmt.Errorf("tunnel %s accessPolicy: %w", tunnelID, err)
 	}
+	if protocol == tunnelprotocol.SSH {
+		if customDomain != "" || item.WaitDomain {
+			return normalizedApplyTunnel{}, fmt.Errorf("tunnel %s: domain and waitDomain are only supported for https tunnels", tunnelID)
+		}
+		if basicAuth != nil {
+			return normalizedApplyTunnel{}, fmt.Errorf("tunnel %s: basicAuth is only supported for https tunnels", tunnelID)
+		}
+		if accessPolicy != nil {
+			return normalizedApplyTunnel{}, fmt.Errorf("tunnel %s: accessPolicy is only supported for https tunnels", tunnelID)
+		}
+	}
 	ttl := strings.TrimSpace(item.TTL)
 	expiresAt, err := resolveApplyTunnelExpiresAt(ttl, now)
 	if err != nil {
@@ -606,7 +624,7 @@ func normalizeApplyTunnel(item applyTunnel) (normalizedApplyTunnel, error) {
 		Name:          item.Name,
 		TunnelID:      tunnelID,
 		LocalPort:     localPort,
-		Protocol:      tunnelprotocol.Normalize(protocol),
+		Protocol:      protocol,
 		CustomDomain:  customDomain,
 		BasicAuth:     basicAuth,
 		BasicAuthPass: basicAuthPass,
@@ -752,17 +770,36 @@ func printApplyResults(cmd *cobra.Command, results []applyResult, dryRun bool) {
 		fmt.Fprintln(out, "Sealtun Apply Results")
 	}
 	for _, result := range results {
+		endpoint := endpointDisplay(result.Protocol, result.Host, result.SealosHost, result.PublicPort)
 		fmt.Fprintf(out, "  - %s (%s): %s localhost:%s", result.Name, result.TunnelID, result.Status, result.LocalPort)
-		if result.Host != "" {
-			fmt.Fprintf(out, " -> https://%s", result.Host)
+		if result.Protocol == tunnelprotocol.SSH && endpoint.Command != "" {
+			fmt.Fprintf(out, " -> %s", endpoint.Command)
+		} else if endpoint.URL != "" {
+			fmt.Fprintf(out, " -> %s", endpoint.URL)
 		}
 		fmt.Fprintln(out)
+		if result.Protocol != "" {
+			fmt.Fprintf(out, "    Protocol: %s\n", result.Protocol)
+		}
 		if result.SealosHost != "" {
 			fmt.Fprintf(out, "    Sealos host: %s\n", result.SealosHost)
 		}
 		if result.CustomDomain != "" {
 			fmt.Fprintf(out, "    Custom domain: %s\n", result.CustomDomain)
 		}
+		if result.Protocol == tunnelprotocol.SSH {
+			if endpoint.Host != "" {
+				fmt.Fprintf(out, "    Public SSH host: %s\n", endpoint.Host)
+			}
+			if endpoint.Port != 0 {
+				fmt.Fprintf(out, "    Public SSH port: %d\n", endpoint.Port)
+			}
+			if endpoint.Command != "" {
+				fmt.Fprintf(out, "    SSH command: %s\n", endpoint.Command)
+			}
+		} else if endpoint.URL != "" {
+			fmt.Fprintf(out, "    Public URL: %s\n", endpoint.URL)
+		}
 		if result.BasicAuth {
 			fmt.Fprintf(out, "    Basic Auth: enabled")
 			if result.BasicAuthUser != "" {

cmd/apply_test.go

@@ -37,6 +37,35 @@ tunnels:
 	if results[0].TunnelID != "web" || results[0].LocalPort != "3000" || results[0].Status != "planned" {
 		t.Fatalf("unexpected dry-run result: %+v", results[0])
 	}
+	if results[0].Protocol != "https" {
+		t.Fatalf("expected dry-run protocol to be reported, got %q", results[0].Protocol)
+	}
+}
+
+func TestRunApplyDryRunReportsSSHProtocol(t *testing.T) {
+	t.Parallel()
+
+	path := filepath.Join(t.TempDir(), "sealtun.yaml")
+	data := []byte(`version: v1
+tunnels:
+  - name: ssh-dev
+    localPort: 22
+    protocol: ssh
+`)
+	if err := os.WriteFile(path, data, 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	results, err := runApply(context.Background(), path, true)
+	if err != nil {
+		t.Fatalf("dry-run apply should accept ssh tunnels: %v", err)
+	}
+	if len(results) != 1 {
+		t.Fatalf("expected one result, got %d", len(results))
+	}
+	if results[0].Protocol != "ssh" {
+		t.Fatalf("expected ssh protocol to be reported, got %+v", results[0])
+	}
 }
 
 func TestBuildApplySessionRecordPersistsCustomDomain(t *testing.T) {
@@ -95,6 +124,39 @@ func TestNormalizeApplyTunnelDefaultsProtocol(t *testing.T) {
 	}
 }
 
+func TestNormalizeApplyTunnelRejectsHTTPOnlyOptionsForSSH(t *testing.T) {
+	t.Setenv("SEALTUN_TEST_BEARER", "secret-token")
+
+	tests := []struct {
+		name string
+		item applyTunnel
+	}{
+		{
+			name: "domain",
+			item: applyTunnel{Name: "ssh", LocalPort: 22, Protocol: "ssh", Domain: "dev.example.com"},
+		},
+		{
+			name: "wait domain",
+			item: applyTunnel{Name: "ssh", LocalPort: 22, Protocol: "ssh", WaitDomain: true},
+		},
+		{
+			name: "basic auth",
+			item: applyTunnel{Name: "ssh", LocalPort: 22, Protocol: "ssh", BasicAuth: &applyBasicAuth{Credential: "admin:secret"}},
+		},
+		{
+			name: "access policy",
+			item: applyTunnel{Name: "ssh", LocalPort: 22, Protocol: "ssh", AccessPolicy: &applyAccessPolicy{BearerTokenEnv: "SEALTUN_TEST_BEARER"}},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if _, err := normalizeApplyTunnel(tt.item); err == nil {
+				t.Fatal("expected ssh tunnel with HTTP-only option to fail")
+			}
+		})
+	}
+}
+
 func TestNormalizeApplyTunnelResolvesBasicAuthPasswordEnv(t *testing.T) {
 	t.Setenv("SEALTUN_TEST_BASIC_AUTH_PASSWORD", "secret")