1.0.4

.dockerignore

@@ -0,0 +1 @@
+node_modules/

Dockerfile

@@ -0,0 +1,46 @@
+# gitzone dockerfile_service
+## STAGE 1 // BUILD
+FROM registry.gitlab.com/hosttoday/ht-docker-node:npmci as node1
+COPY ./ /app
+WORKDIR /app
+ARG NPMCI_TOKEN_NPM2
+ENV NPMCI_TOKEN_NPM2 $NPMCI_TOKEN_NPM2
+RUN npmci npm prepare
+RUN pnpm config set store-dir .pnpm-store
+RUN rm -rf node_modules && pnpm install
+RUN pnpm run build
+
+# gitzone dockerfile_service
+## STAGE 2 // install production
+FROM registry.gitlab.com/hosttoday/ht-docker-node:npmci as node2
+WORKDIR /app
+COPY --from=node1 /app /app
+RUN rm -rf .pnpm-store
+ARG NPMCI_TOKEN_NPM2
+ENV NPMCI_TOKEN_NPM2 $NPMCI_TOKEN_NPM2
+RUN npmci npm prepare
+RUN pnpm config set store-dir .pnpm-store
+RUN rm -rf node_modules/ && pnpm install --prod
+
+
+## STAGE 3 // rebuild dependencies for alpine
+FROM registry.gitlab.com/hosttoday/ht-docker-node:alpinenpmci as node3
+WORKDIR /app
+COPY --from=node2 /app /app
+ARG NPMCI_TOKEN_NPM2
+ENV NPMCI_TOKEN_NPM2 $NPMCI_TOKEN_NPM2
+RUN npmci npm prepare
+RUN pnpm config set store-dir .pnpm-store
+RUN pnpm rebuild -r
+
+## STAGE 4 // the final production image with all dependencies in place
+FROM registry.gitlab.com/hosttoday/ht-docker-node:alpine as node4
+WORKDIR /app
+COPY --from=node3 /app /app
+
+### Healthchecks
+RUN pnpm install -g @servezone/healthy
+HEALTHCHECK --interval=30s --timeout=30s --start-period=30s --retries=3 CMD [ "healthy" ]
+
+EXPOSE 80
+CMD ["npm", "start"]

cli.child.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+process.env.CLI_CALL = 'true';
+import * as cliTool from './ts/index.js';
+cliTool.runCli();

cli.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+process.env.CLI_CALL = 'true';
+const cliTool = await import('./dist_ts/index.js');
+cliTool.runCli();

cli.ts.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+process.env.CLI_CALL = 'true';
+
+import * as tsrun from '@git.zone/tsrun';
+tsrun.runPath('./cli.child.js', import.meta.url);

npmextra.json

@@ -5,14 +5,34 @@
       "githost": "code.foss.global",
       "gitscope": "serve.zone",
       "gitrepo": "remoteingress",
-      "description": "a remoteingress service for serve.zone",
+      "description": "Provides a service for creating private tunnels and reaching private clusters from the outside, facilitating secure remote access as part of the @serve.zone stack.",
       "npmPackagename": "@serve.zone/remoteingress",
       "license": "MIT",
-      "projectDomain": "serve.zone"
+      "projectDomain": "serve.zone",
+      "keywords": [
+        "remote access",
+        "private tunnels",
+        "network security",
+        "TLS encryption",
+        "connector",
+        "serve.zone stack",
+        "private clusters access",
+        "public access management",
+        "TypeScript application",
+        "node.js package",
+        "secure communications",
+        "TLS/SSL certificates",
+        "development tools",
+        "software development",
+        "private network integration"
+      ]
     }
   },
   "npmci": {
     "npmGlobalTools": [],
     "npmAccessLevel": "public"
+  },
+  "tsdoc": {
+    "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
   }
 }

package.json

@@ -1,8 +1,8 @@
 {
   "name": "@serve.zone/remoteingress",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "private": false,
-  "description": "a remoteingress service for serve.zone",
+  "description": "Provides a service for creating private tunnels and reaching private clusters from the outside, facilitating secure remote access as part of the @serve.zone stack.",
   "main": "dist_ts/index.js",
   "typings": "dist_ts/index.d.ts",
   "type": "module",
@@ -21,7 +21,9 @@
     "@push.rocks/tapbundle": "^5.0.15",
     "@types/node": "^20.8.7"
   },
-  "dependencies": {},
+  "dependencies": {
+    "@push.rocks/qenv": "^6.0.5"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://code.foss.global/serve.zone/remoteingress.git"
@@ -44,5 +46,22 @@
     "cli.js",
     "npmextra.json",
     "readme.md"
+  ],
+  "keywords": [
+    "remote access",
+    "private tunnels",
+    "network security",
+    "TLS encryption",
+    "connector",
+    "serve.zone stack",
+    "private clusters access",
+    "public access management",
+    "TypeScript application",
+    "node.js package",
+    "secure communications",
+    "TLS/SSL certificates",
+    "development tools",
+    "software development",
+    "private network integration"
   ]
 }

readme.hints.md

@@ -0,0 +1,3 @@
+* this module is part of the @serve.zone stack
+* it is used to reach private clusters from outside
+* it can be used to create private tunnels to private networks

readme.md

@@ -1,31 +1,107 @@
 # @serve.zone/remoteingress
-a remoteingress service for serve.zone
 
-## Availabililty and Links
-* [npmjs.org (npm package)](https://www.npmjs.com/package/@serve.zone/remoteingress)
-* [gitlab.com (source)](https://code.foss.global/serve.zone/remoteingress)
-* [github.com (source mirror)](https://github.com/serve.zone/remoteingress)
-* [docs (typedoc)](https://serve.zone.gitlab.io/remoteingress/)
+Provides a service for creating private tunnels and reaching private clusters from the outside as part of the @serve.zone stack.
 
-## Status for master
+## Install
 
-Status Category | Status Badge
--- | --
-GitLab Pipelines | [![pipeline status](https://code.foss.global/serve.zone/remoteingress/badges/master/pipeline.svg)](https://lossless.cloud)
-GitLab Pipline Test Coverage | [![coverage report](https://code.foss.global/serve.zone/remoteingress/badges/master/coverage.svg)](https://lossless.cloud)
-npm | [![npm downloads per month](https://badgen.net/npm/dy/@serve.zone/remoteingress)](https://lossless.cloud)
-Snyk | [![Known Vulnerabilities](https://badgen.net/snyk/serve.zone/remoteingress)](https://lossless.cloud)
-TypeScript Support | [![TypeScript](https://badgen.net/badge/TypeScript/>=%203.x/blue?icon=typescript)](https://lossless.cloud)
-node Support | [![node](https://img.shields.io/badge/node->=%2010.x.x-blue.svg)](https://nodejs.org/dist/latest-v10.x/docs/api/)
-Code Style | [![Code Style](https://badgen.net/badge/style/prettier/purple)](https://lossless.cloud)
-PackagePhobia (total standalone install weight) | [![PackagePhobia](https://badgen.net/packagephobia/install/@serve.zone/remoteingress)](https://lossless.cloud)
-PackagePhobia (package size on registry) | [![PackagePhobia](https://badgen.net/packagephobia/publish/@serve.zone/remoteingress)](https://lossless.cloud)
-BundlePhobia (total size when bundled) | [![BundlePhobia](https://badgen.net/bundlephobia/minzip/@serve.zone/remoteingress)](https://lossless.cloud)
+To install `@serve.zone/remoteingress`, run the following command in your terminal:
+
+```sh
+npm install @serve.zone/remoteingress
+```
+
+This command will download and install the remoteingress package and its dependencies into your project.
 
 ## Usage
-Use TypeScript for best in class intellisense
-For further information read the linked docs at the top of this readme.
 
-## Legal
-> MIT licensed | **©** [Task Venture Capital GmbH](https://task.vc)
-| By using this npm module you agree to our [privacy policy](https://lossless.gmbH/privacy)
+`@serve.zone/remoteingress` is designed to facilitate the creation of secure private tunnels and enable access to private clusters from external sources, offering an integral part of the @serve.zone stack infrastructure. Below, we illustrate how to employ this package within your project, leveraging TypeScript and ESM syntax for modern, type-safe, and modular code.
+
+### Prerequisites
+
+Ensure that you have Node.js and TypeScript installed in your environment. Your project should be set up with TypeScript support, and you might want to familiarize yourself with basic networking concepts and TLS/SSL for secure communication.
+
+### Importing and Initializing Connectors
+
+`@serve.zone/remoteingress` offers two primary components: `ConnectorPublic` and `ConnectorPrivate`. Here's how to use them:
+
+#### Setup ConnectorPublic
+
+`ConnectorPublic` acts as a gateway, accepting incoming tunnel connections from `ConnectorPrivate` instances and facilitating secure communication between the internet and your private network.
+
+```typescript
+import { ConnectorPublic } from '@serve.zone/remoteingress';
+
+// Initialize ConnectorPublic
+const publicConnector = new ConnectorPublic({
+  tlsOptions: {
+    key: fs.readFileSync("<path-to-your-tls/key.pem>"),
+    cert: fs.readFileSync("<path-to-your-cert/cert.pem>"),
+    // Consider including 'ca' and 'passphrase' if required for your setup
+  },
+  listenPort: 443 // Example listen port; adjust based on your needs
+});
+```
+
+#### Setup ConnectorPrivate
+
+`ConnectorPrivate` establishes a secure tunnel to `ConnectorPublic`, effectively bridging your internal services with the external point of access.
+
+```typescript
+import { ConnectorPrivate } from '@serve.zone/remoteingress';
+
+// Initialize ConnectorPrivate pointing to your ConnectorPublic instance
+const privateConnector = new ConnectorPrivate({
+  publicHost: 'your.public.domain.tld',
+  publicPort: 443, // Ensure this matches the listening port of ConnectorPublic
+  tlsOptions: {
+    // You might want to specify TLS options here, similar to ConnectorPublic
+  }
+});
+```
+
+### Secure Communication
+
+It's imperative to ensure that the communication between `ConnectorPublic` and `ConnectorPrivate` is secure:
+
+- Always use valid TLS certificates.
+- Prefer using certificates issued by recognized Certificate Authorities (CA).
+- Optionally, configure mutual TLS (mTLS) by requiring client certificates for an added layer of security.
+
+### Advanced Usage
+
+Both connectors can be finely tuned:
+
+- **Logging and Monitoring:** Integrate with your existing logging and monitoring systems to keep tabs on tunnel activity, performance metrics, and potential security anomalies.
+
+- **Custom Handlers:** Implement custom traffic handling logic for specialized routing, filtering, or protocol-specific processing.
+
+- **Automation:** Automate the deployment and scaling of both `ConnectorPublic` and `ConnectorPrivate` instances using infrastructure-as-code (IAC) tools and practices, ensuring that your tunneling infrastructure can dynamically adapt to the ever-changing needs of your services.
+
+### Example Scenarios
+
+1. **Securing Application APIs:** Use `@serve.zone/remoteingress` to expose private APIs to your frontend deployed on a public cloud, ensuring that only your infrastructure can access these endpoints.
+
+2. **Remote Database Access:** Securely access databases within a private VPC from your local development machine without opening direct access to the internet.
+
+3. **Service Mesh Integration:** Integrate `@serve.zone/remoteingress` as part of a service mesh setup to securely connect services across multiple clusters with robust identity and encryption at the tunnel level.
+
+For detailed documentation, API references, and additional use cases, please refer to the inline documentation and source code within the package. Always prioritize security and robustness when dealing with network ingress to protect your infrastructure and data from unauthorized access and threats.
+
+## License and Legal Information
+
+This repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license) file within this repository. 
+
+**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
+
+### Trademarks
+
+This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.
+
+### Company Information
+
+Task Venture Capital GmbH  
+Registered at District court Bremen HRB 35230 HB, Germany
+
+For any legal inquiries or if you require further information, please contact us via email at hello@task.vc.
+
+By using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/remoteingress',
-  version: '1.0.2',
-  description: 'a remoteingress service for serve.zone'
+  version: '1.0.4',
+  description: 'Provides a service for creating private tunnels and reaching private clusters from the outside, facilitating secure remote access as part of the @serve.zone stack.'
 }

ts/connector.private.ts

@@ -1,10 +1,10 @@
-import * as tls from 'tls';
+import * as plugins from './plugins.js';
 
 export class ConnectorPrivate {
   private targetHost: string;
   private targetPort: number;
 
-  constructor(targetHost: string, targetPort: number) {
+  constructor(targetHost: string, targetPort: number = 4000) {
     this.targetHost = targetHost;
     this.targetPort = targetPort;
     this.connectToPublicRemoteConnector();
@@ -12,15 +12,27 @@ export class ConnectorPrivate {
 
   private connectToPublicRemoteConnector(): void {
     const options = {
-      // If your server requires client certificate authentication, you can specify key and cert here as well
+      // Include CA certificate if necessary, for example:
+      // ca: fs.readFileSync('path/to/ca.pem'),
+      rejectUnauthorized: true // Only set this to true if you are sure about the server's certificate
     };
 
-    const tunnel = tls.connect({ port: 4000, ...options }, () => {
+    const tunnel = plugins.tls.connect(this.targetPort, options, () => {
       console.log('Connected to PublicRemoteConnector on port 4000');
     });
 
     tunnel.on('data', (data: Buffer) => {
-      // Similar logic for forwarding data to and from the target
+      const targetConnection = plugins.tls.connect({
+        host: this.targetHost,
+        port: this.targetPort,
+        // Include necessary options for the target connection
+      }, () => {
+        targetConnection.write(data);
+      });
+
+      targetConnection.on('data', (backData: Buffer) => {
+        tunnel.write(backData); // Send data back through the tunnel
+      });
     });
   }
 }

ts/connector.public.ts

@@ -1,8 +1,7 @@
-import * as tls from 'tls';
-import * as fs from 'fs';
+import * as plugins from './plugins.js';
 
 export class ConnectorPublic {
-  private tunnel: tls.TLSSocket | null = null;
+  private tunnel: plugins.tls.TLSSocket | null = null;
 
   constructor() {
     this.createTunnel();
@@ -11,11 +10,11 @@ export class ConnectorPublic {
 
   private createTunnel(): void {
     const options = {
-      key: fs.readFileSync('path/to/key.pem'),
-      cert: fs.readFileSync('path/to/cert.pem')
+      key: plugins.fs.readFileSync('path/to/key.pem'),
+      cert: plugins.fs.readFileSync('path/to/cert.pem'),
     };
 
-    const server = tls.createServer(options, (socket: tls.TLSSocket) => {
+    const server = plugins.tls.createServer(options, (socket: plugins.tls.TLSSocket) => {
       this.tunnel = socket;
       console.log('Tunnel established with LocalConnector');
     });
@@ -26,7 +25,21 @@ export class ConnectorPublic {
   }
 
   private listenOnPorts(): void {
-    // Implement similar logic for listening on ports 80 and 443
-    // Keep in mind you may need to adjust how you handle secure and non-secure traffic
+    // Example for port 80, adapt for port 443 similarly
+    // Note: TLS for the initial connection might not apply directly for HTTP/HTTPS traffic without additional setup
+    const options = {
+      key: plugins.fs.readFileSync('path/to/key.pem'),
+      cert: plugins.fs.readFileSync('path/to/cert.pem'),
+    };
+
+    plugins.tls.createServer(options, (socket: plugins.tls.TLSSocket) => {
+      console.log('Received connection, tunneling to LocalConnector');
+      if (this.tunnel) {
+        socket.pipe(this.tunnel).pipe(socket);
+      } else {
+        console.log('Tunnel to LocalConnector not established');
+        socket.end();
+      }
+    }).listen(80); // Repeat this block for any other ports you wish to listen on
   }
 }

ts/index.ts

@@ -1,3 +1,14 @@
-import * as plugins from './remoteingress.plugins.js';
+import * as plugins from './plugins.js';
 
-export let demoExport = 'Hi there! :) This is an exported string';
+import { ConnectorPublic } from './connector.public.js';
+import { ConnectorPrivate } from './connector.private.js';
+
+export {
+  ConnectorPublic,
+  ConnectorPrivate
+}
+
+export const runCli = async () => {
+  const qenv = new plugins.qenv.Qenv();
+  const mode = await qenv.getEnvVarOnDemand('MODE');
+}

ts/plugins.ts

@@ -0,0 +1,15 @@
+// node native scope
+import * as tls from 'tls';
+import * as fs from 'fs';
+
+export {
+  tls,
+  fs,
+}
+
+// @push.rocks scope
+import * as qenv from '@push.rocks/qenv';
+
+export {
+  qenv,
+}

ts/remoteingress.plugins.ts

@@ -1,4 +0,0 @@
-const removeme = {};
-export {
-  removeme
-}