hmo
ac34556588
- http_port 5802→5807: 5802 occupied by wechat-hermes-gateway xmpp_bot, dual-listener caused ~50% request 400s - _rdp_enable(): DETACHED_PROCESS so tunnel survives bot restart/crash - ExitOnForwardFailure=yes so dead forward exits immediately instead of hanging - stderr→rdp_tunnel_ssh.log for diagnosability - -i explicit key path with multi-home search (LocalSystem ~ = systemprofile, not C:\Users\hmo) - env injection HOME/USERPROFILE for ssh subprocess - IdentitiesOnly=yes so -i key is used exclusively - health_service.py: /health port 5802→5807 (was causing 30s restart loop) - easytier.json + rdp.json: all 5802→5807 references updated - rdp.json: add xiaoguo/Mac as RDP participant + architecture participant
98 lines
7.6 KiB
JSON
98 lines
7.6 KiB
JSON
{
|
||
"module": "rdp",
|
||
"version": "1.0",
|
||
"purpose": "RDP 远程桌面隧道开关。通过 SSH 反向隧道将 Windows 3389 端口暴露到 Aliyun 公网 IP，实现从外网远程桌面到 Windows。",
|
||
"ui_location": "I Tab (Infrastructure) → RDP Remote Desktop section",
|
||
|
||
"human_help": {
|
||
"title": "RDP Remote Desktop",
|
||
"description": [
|
||
"通过 SSH 反向隧道把 Windows 的 RDP 端口(3389)暴露到 Aliyun 公网服务器(47.115.32.206:8080)。",
|
||
"开启后在外网可用 mstsc /v:47.115.32.206:8080 远程桌面到 Windows。",
|
||
"本功能依赖 EasyTier VPN 先连通 — SSH 到 246 的连接走 VPN 内网（10.144.144.1）。",
|
||
"请先确保 EasyTier VPN 已 Connected，再点击 Enable。"
|
||
],
|
||
"participants": [
|
||
{"name": "老莫", "device": "Windows 192.168.1.16 (被控端)", "role": "本地操作 + 被远程桌面的目标机", "note": "运行 xmpp_bot 执行 SSH reverse tunnel; 暴露 3389"},
|
||
{"name": "莫荷", "device": "Linux 192.168.1.246", "role": "easytier 节点 + dashboard 服务 5803", "note": "EasyTier VPN 节点 (10.144.144.1) + dashboard 代理 RDP toggle"},
|
||
{"name": "小果", "device": "Mac (外网)", "role": "异地远程桌面发起端", "note": "老莫在办公室外用 Mac 通过 mstsc /v:47.115.32.206:8080 回连 Windows 操作。Mac 上需安装 Microsoft Remote Desktop 客户端"}
|
||
],
|
||
"usage": [
|
||
"1. 先在 EasyTier VPN section 点击 Turn On，确认 Connected",
|
||
"2. 回到本 section 点击 Enable 启动 SSH 反向隧道",
|
||
"3. 老莫在 Mac 外网运行 mstsc /v:47.115.32.206:8080 连接远程桌面到 Windows",
|
||
"4. 不用时点击 Disable 关闭隧道"
|
||
],
|
||
"troubleshooting": [
|
||
"如果 Enable 返回失败：检查 EasyTier VPN 是否 Connected（RDP 依赖 VPN 内网 SSH）",
|
||
"如果隧道状态一直 pending：检查 246 的 /etc/ssh/sshd_config 是否有 GatewayPorts yes",
|
||
"如果 mstsc 连不上：检查 Aliyun 安全组是否放行 8080/TCP",
|
||
"如果 timeout：从外网执行 Test-NetConnection 47.115.32.206 -Port 8080 看端口是否真的 listening",
|
||
"Mac 上无 mstsc：安装 Microsoft Remote Desktop (App Store) 然后以 PC name 47.115.32.206:8080 加入"
|
||
],
|
||
"related": "依赖 EasyTier VPN 内网通道，参见 EasyTier VPN section 的帮助"
|
||
},
|
||
|
||
"ai_spec": {
|
||
"apis": [
|
||
{"method": "GET", "path": "/api/rdp", "returns": "rdp_enabled + tunnel_running + public_endpoint(47.115.32.206:8080)", "proxied_to": "xmpp_bot /rdp action=status"},
|
||
{"method": "POST", "path": "/api/rdp/toggle", "body": "{action: start|stop}", "returns": "{ok, message}", "proxied_to": "xmpp_bot /rdp action=start|stop"}
|
||
],
|
||
"dependencies": [
|
||
"xmpp_bot on Windows 192.168.1.16:5807 — /rdp HTTP endpoint (注: 5807 是为避免与 wechat-hermes-gateway 的 5802 端口冲突, 详见 ai_spec.known_issues.port_conflict)",
|
||
"_bridge_post() + _BRIDGE_KEY in dashboard.py — proxy 机制同 EasyTier",
|
||
"port_open() helper in dashboard.py — 检查 SSH 隧道端口 8080 是否监听",
|
||
"EasyTier VPN 必须先 Connected — SSH 到 246 走 VPN 内网 10.144.144.1",
|
||
"Mac 端需安装 Microsoft Remote Desktop 客户端 (App Store) — 小果作为外网发起端"
|
||
],
|
||
"architecture": {
|
||
"flow": "Dashboard(246:5803) → _bridge_post() → xmpp_bot(Windows:5807) → 启动 SSH reverse tunnel",
|
||
"rdp_mechanism": "xmpp_bot receives POST /rdp {action} → 执行 ssh -R 0.0.0.0:8080:localhost:3389 root@47.115.32.206 把 Windows 3389 转发到 Aliyun 公网",
|
||
"public_endpoint": "47.115.32.206:8080 (Aliyun 公网)",
|
||
"participants": {
|
||
"windows_192_168_1_16": {"role": "RDP 服务端 (3389) + SSH reverse tunnel 客户端; 被 xmpp_bot 控制 (port 5807)", "agent": "xxm + EasyTier 节点 10.144.144.3"},
|
||
"linux_246": {"role": "EasyTier 节点 (10.144.144.1) + dashboard 服务 (5803) 代理 toggle 请求到 Windows xmpp_bot", "agent": "mohe"},
|
||
"aliyun_47_115_32_206": {"role": "公网入口; 接收 ssh -R 反向隧道; GatewayPorts yes 必须配置"},
|
||
"mac_xiaoguo_remote": {"role": "异地远程桌面客户端; 老莫从办公室外用 Microsoft Remote Desktop 客户端连 47.115.32.206:8080 → Windows 桌面", "agent": "xiaoguo (平台上的 Mac 不在 XMPP 群里参与 traffic, 只作为 RDP client)"}
|
||
}
|
||
},
|
||
"constraints": [
|
||
"RDP SSH 反向隧道命令: ssh -R 0.0.0.0:8080:localhost:3389 root@47.115.32.206",
|
||
"GatewayPorts yes 必须配置在 47.115.32.206 (Aliyun) 的 /etc/ssh/sshd_config — 否则只 listen 127.0.0.1 外网连不进来",
|
||
"EasyTier VPN 必须先 Connected — 否则 Windows SSH 到 246 不通，隧道无法建立",
|
||
"xmpp_bot 必须运行在 Windows (pythonw.exe, port 5802) — 它是实际执行 SSH 命令的一方",
|
||
"RDP 端口固定 3389 (Windows 默认)，隧道端口固定 8080"
|
||
],
|
||
"must_not": [
|
||
"不要在 EasyTier VPN 未 Connected 时启 RDP — 会因为 SSH 不通而失败",
|
||
"不要用 SSH 端口转发替代 SSH 反向隧道 — 这是 -R (reverse) 不是 -L (local)",
|
||
"不要把 public_endpoint 从 47.115.32.206:8080 改成其他 — 这是 Aliyun 公网入口",
|
||
"不要把 tunnel_running 判断从 port_open(8080) 改成依赖 xmpp_bot 的 tunnel 字段 — xmpp_bot 不报告隧道状态，只能从 246 主动 probe",
|
||
"不要重写整个 fI() 函数 — 用 create-once/update-state pattern 修改 RDP section"
|
||
],
|
||
"related_modules": [
|
||
{"module": "easytier", "relation": "RDP 隧道依赖 EasyTier VPN 内网通道。启动 RDP 前必须确保 EasyTier Connected"},
|
||
{"module": "wechat-hermes-xmpp-bot-5802", "relation": "RDP 模块历史上曾与 wechat-hermes-gateway 共享 5802 端口, 导致按钮无响应 (详见 known_issues.port_conflict)。当前已通过换端口解决"}
|
||
],
|
||
"tests": [
|
||
{"id": "RDP01", "name": "RDP toggle start returns ok", "endpoint": "POST /api/rdp/toggle {action:start}"},
|
||
{"id": "RDP02", "name": "RDP toggle stop returns ok", "endpoint": "POST /api/rdp/toggle {action:stop}"},
|
||
{"id": "RDP03", "name": "RDP status returns public_endpoint 47.115.32.206:8080", "endpoint": "GET /api/rdp"},
|
||
{"id": "RDP04", "name": "After enable, port 8080 on Aliyun is listening (Test-NetConnection)", "endpoint": "external TCP check 47.115.32.206:8080"}
|
||
],
|
||
"known_issues": [
|
||
"如果 Enable 后 status 一直 Tunnel pending：检查 /etc/ssh/sshd_config GatewayPorts yes，检查 Aliyun 安全组 8080/TCP",
|
||
"如果 mstsc 从外网连不上：检查 Aliyun 安全组 — 需要 8080/TCP 入方向放行",
|
||
"如果隧道断了但 status 显示 Connected：这是 stale state — port_open() 会重检 8080 端口下次刷新自动修正",
|
||
"port_conflict: 历史上 xmpp_bot 用 5802, 但 wechat-hermes-gateway/scripts/xmpp_bot.py 是另一独立服务也绑了 5802 (无 /rdp /easytier 路由); 两个 listener 同时 LISTENING 导致 OS 随机分发请求, 一半命中旧 bot 返回 400 Bad Request, 表现为按钮无反应。解决: AgentsMeeting xmpp_bot(XPID 41892→现 40452) 改用 5807, wechat-hermes 保留 5802; systemd XMPP_BRIDGE_URL 同步改为 :5807"
|
||
],
|
||
"related_files": [
|
||
"gateway/scripts/dashboard.py — /api/rdp*, _bridge_post(), port_open()",
|
||
"gateway/scripts/templates/dashboard.html — fI() function creates RDP section (id=rdp-section)",
|
||
"gateway/scripts/specs/rdp.json — 本 spec 文件",
|
||
"gateway/scripts/specs/easytier.json — 关联模块 EasyTier 的 spec",
|
||
"xmpp_agent_core.py — /rdp HTTP endpoint (line ~794)",
|
||
"/etc/ssh/sshd_config on 47.115.32.206 — GatewayPorts yes 配置"
|
||
]
|
||
}
|
||
} |