hmo
47e323c8fc
遵守针对性+完整性原则:
- EasyTier section 的 ?/§ 只显示 EasyTier 内容
- RDP section 的 ?/§ 只显示 RDP 内容
- ai_spec.related_models 互相引用对方
- human_help.related 引用对方入口
dashboard.html:
- EasyTier 按钮调用 showModuleHelp('easytier', ...)
- RDP 按钮调用 showModuleHelp('rdp', ...)
- _renderSpecModal 新增 related_modules 显示, 每个 related 模块可点击跳转
83 lines
5.3 KiB
JSON
83 lines
5.3 KiB
JSON
{
|
||
"module": "rdp",
|
||
"version": "1.0",
|
||
"purpose": "RDP 远程桌面隧道开关。通过 SSH 反向隧道将 Windows 3389 端口暴露到 Aliyun 公网 IP，实现从外网远程桌面到 Windows。",
|
||
"ui_location": "I Tab (Infrastructure) → RDP Remote Desktop section",
|
||
|
||
"human_help": {
|
||
"title": "RDP Remote Desktop",
|
||
"description": [
|
||
"通过 SSH 反向隧道把 Windows 的 RDP 端口(3389)暴露到 Aliyun 公网服务器(47.115.32.206:8080)。",
|
||
"开启后在外网可用 mstsc /v:47.115.32.206:8080 远程桌面到 Windows。",
|
||
"本功能依赖 EasyTier VPN 先连通 — SSH 到 246 的连接走 VPN 内网（10.144.144.1）。",
|
||
"请先确保 EasyTier VPN 已 Connected，再点击 Enable。"
|
||
],
|
||
"usage": [
|
||
"1. 先在 EasyTier VPN section 点击 Turn On，确认 Connected",
|
||
"2. 回到本 section 点击 Enable 启动 SSH 反向隧道",
|
||
"3. 在外网电脑运行 mstsc /v:47.115.32.206:8080 连接远程桌面",
|
||
"4. 不用时点击 Disable 关闭隧道"
|
||
],
|
||
"troubleshooting": [
|
||
"如果 Enable 返回失败：检查 EasyTier VPN 是否 Connected（RDP 依赖 VPN 内网 SSH）",
|
||
"如果隧道状态一直 pending：检查 246 的 /etc/ssh/sshd_config 是否有 GatewayPorts yes",
|
||
"如果 mstsc 连不上：检查 Aliyun 安全组是否放行 8080/TCP",
|
||
"如果 timeout：从外网执行 Test-NetConnection 47.115.32.206 -Port 8080 看端口是否真的 listening"
|
||
],
|
||
"related": "依赖 EasyTier VPN 内网通道，参见 EasyTier VPN section 的帮助"
|
||
},
|
||
|
||
"ai_spec": {
|
||
"apis": [
|
||
{"method": "GET", "path": "/api/rdp", "returns": "rdp_enabled + tunnel_running + public_endpoint(47.115.32.206:8080)", "proxied_to": "xmpp_bot /rdp action=status"},
|
||
{"method": "POST", "path": "/api/rdp/toggle", "body": "{action: start|stop}", "returns": "{ok, message}", "proxied_to": "xmpp_bot /rdp action=start|stop"}
|
||
],
|
||
"dependencies": [
|
||
"xmpp_bot on Windows 192.168.1.16:5802 — /rdp HTTP endpoint",
|
||
"_bridge_post() + _BRIDGE_KEY in dashboard.py — proxy 机制同 EasyTier",
|
||
"port_open() helper in dashboard.py — 检查 SSH 隧道端口 8080 是否监听",
|
||
"EasyTier VPN 必须先 Connected — SSH 到 246 走 VPN 内网 10.144.144.1"
|
||
],
|
||
"architecture": {
|
||
"flow": "Dashboard(246:5803) → _bridge_post() → xmpp_bot(Windows:5802) → 启动 SSH reverse tunnel",
|
||
"rdp_mechanism": "xmpp_bot receives POST /rdp {action} → 执行 ssh -R 0.0.0.0:8080:localhost:3389 root@47.115.32.206 把 Windows 3389 转发到 Aliyun 公网",
|
||
"public_endpoint": "47.115.32.206:8080 (Aliyun 公网)"
|
||
},
|
||
"constraints": [
|
||
"RDP SSH 反向隧道命令: ssh -R 0.0.0.0:8080:localhost:3389 root@47.115.32.206",
|
||
"GatewayPorts yes 必须配置在 47.115.32.206 (Aliyun) 的 /etc/ssh/sshd_config — 否则只 listen 127.0.0.1 外网连不进来",
|
||
"EasyTier VPN 必须先 Connected — 否则 Windows SSH 到 246 不通，隧道无法建立",
|
||
"xmpp_bot 必须运行在 Windows (pythonw.exe, port 5802) — 它是实际执行 SSH 命令的一方",
|
||
"RDP 端口固定 3389 (Windows 默认)，隧道端口固定 8080"
|
||
],
|
||
"must_not": [
|
||
"不要在 EasyTier VPN 未 Connected 时启 RDP — 会因为 SSH 不通而失败",
|
||
"不要用 SSH 端口转发替代 SSH 反向隧道 — 这是 -R (reverse) 不是 -L (local)",
|
||
"不要把 public_endpoint 从 47.115.32.206:8080 改成其他 — 这是 Aliyun 公网入口",
|
||
"不要把 tunnel_running 判断从 port_open(8080) 改成依赖 xmpp_bot 的 tunnel 字段 — xmpp_bot 不报告隧道状态，只能从 246 主动 probe",
|
||
"不要重写整个 fI() 函数 — 用 create-once/update-state pattern 修改 RDP section"
|
||
],
|
||
"related_modules": [
|
||
{"module": "easytier", "relation": "RDP 隧道依赖 EasyTier VPN 内网通道。启动 RDP 前必须确保 EasyTier Connected"}
|
||
],
|
||
"tests": [
|
||
{"id": "RDP01", "name": "RDP toggle start returns ok", "endpoint": "POST /api/rdp/toggle {action:start}"},
|
||
{"id": "RDP02", "name": "RDP toggle stop returns ok", "endpoint": "POST /api/rdp/toggle {action:stop}"},
|
||
{"id": "RDP03", "name": "RDP status returns public_endpoint 47.115.32.206:8080", "endpoint": "GET /api/rdp"},
|
||
{"id": "RDP04", "name": "After enable, port 8080 on Aliyun is listening (Test-NetConnection)", "endpoint": "external TCP check 47.115.32.206:8080"}
|
||
],
|
||
"known_issues": [
|
||
"如果 Enable 后 status 一直 Tunnel pending：检查 /etc/ssh/sshd_config GatewayPorts yes，检查 Aliyun 安全组 8080/TCP",
|
||
"如果 mstsc 从外网连不上：检查 Aliyun 安全组 — 需要 8080/TCP 入方向放行",
|
||
"如果隧道断了但 status 显示 Connected：这是 stale state — port_open() 会重检 8080 端口下次刷新自动修正"
|
||
],
|
||
"related_files": [
|
||
"gateway/scripts/dashboard.py — /api/rdp*, _bridge_post(), port_open()",
|
||
"gateway/scripts/templates/dashboard.html — fI() function creates RDP section (id=rdp-section)",
|
||
"gateway/scripts/specs/rdp.json — 本 spec 文件",
|
||
"gateway/scripts/specs/easytier.json — 关联模块 EasyTier 的 spec",
|
||
"xmpp_agent_core.py — /rdp HTTP endpoint (line ~794)",
|
||
"/etc/ssh/sshd_config on 47.115.32.206 — GatewayPorts yes 配置"
|
||
]
|
||
}
|
||
} |