Repository navigation
Epic: Transport B — Tailscale-SSH-native keyless multi-user gateway #110
Description
Activity
Children (stacked on integration branch `110-transport-b-tailnet-gateway`, cut from #108's branch):
- gateway: login-shell entry + -c dispatch #111 login-shell entry + -c dispatch
- gateway: caller identity via tailscale whois (fail-closed) #112 caller identity via tailscale whois (needs gateway: login-shell entry + -c dispatch #111)
- gateway: owner column + gateway-boundary authz + admin allowlist #113 owner column + gateway-boundary authz (needs gateway: login-shell entry + -c dispatch #111, gateway: caller identity via tailscale whois (fail-closed) #112)
- gateway: lilbox gateway install --user (+ RunSSH doctor check) #114 gateway install --user (needs gateway: owner column + gateway-boundary authz + admin allowlist #113)
- gateway: SFTP/file-transfer hardening + Transport-B docs #115 SFTP hardening + docs (needs gateway: lilbox gateway install --user (+ RunSSH doctor check) #114)
Run order via
/rig-epic run(or one at a time with/rig-epic next).Parked as backlog — the SSH gateway is deprioritized as non-core for now. Not in flight: the started-epic scaffolding (integration branch
110-transport-b-tailnet-gateway+ local state file) was removed so this reads as filed tickets, not active work. Children #111–#115 remain as the captured plan; re-run/rig-epic start #110to re-cut the integration branch when it's picked up. Design/rationale in spike #109; MVP code in #108.
Overview
Make the
lilboxgateway work over Tailscale SSH with the caller's tailnet identity — no SSH keys, one local user, per-VM ownership in-app. End users install nothing: on the tailnet + ACL allows →ssh lilbox@host new --tailscale myboxjust works.De-risked in the spike #109 (findings there). Extends the gateway from #108 (key-based OpenSSH forced-command MVP).
Why an epic (not a sprint)
The children interlock on one runtime contract: the
-centry refactor gates identity resolution, identity gates ownership authz, both gate a meaningfulinstall, and hardening/docs describe the assembled whole. Any one alone onmainwould ship a half-wired gateway — so they stack on a shared integration branch and squash to trunk once.Base: the integration branch is cut from
paulg/gateway-ssh-provisioning(#108's branch), since Transport B extendssrc/commands/gateway.rswhich lives only there. If #108 merges to main mid-epic, the code is a superset — fine.Children (stacked, foundation-first)
-cdispatchtailscale whois(fail-closed)ownercolumn + gateway-boundary authz + admin allowlistlilbox gateway install --user(+RunSSHdoctor check)Key correction from the spike: do not rely on
$SSH_ORIGINAL_COMMAND— Tailscale SSH never sets it; read the command from the shell's own-carg. And a restricted login shell does not block SFTP — close it at the server/ACL layer.