ssh-over-sse 0.1.0__tar.gz

ssh_over_sse-0.1.0/.gitignore

@@ -0,0 +1,10 @@
+.venv/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+dist/
+*.egg-info/
+.runtime/
+.coverage

ssh_over_sse-0.1.0/CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+Release notes for ssh-over-sse.
+
+## 0.1.0 — 2026-11-11
+
+### Features
+
+- Use SSH, SCP, SFTP, and rsync through an HTTPS gateway.
+- Install the client, gateway, or both with pip, or install either command with uv.
+- Use Ed25519, RSA, and ECDSA keys with existing SSH host settings.
+- Check gateway key access with `ssh-sse-cli --url URL check`; select a key with `-i`.
+- Manage gateway access with `authorized_keys` and allowed SSH destinations.
+
+### Fixes
+
+- Keep idle SSH connections alive through OCI gateways.
+- Improve cleanup after interrupted connections and authentication error reporting.

ssh_over_sse-0.1.0/PKG-INFO

@@ -0,0 +1,137 @@
+Metadata-Version: 2.5
+Name: ssh-over-sse
+Version: 0.1.0
+Summary: Use SSH through an HTTPS gateway with a local CLI, a gateway, or both
+Requires-Python: >=3.12
+Provides-Extra: all
+Requires-Dist: ssh-over-sse-cli==0.1.0; extra == 'all'
+Requires-Dist: ssh-over-sse-gateway==0.1.0; extra == 'all'
+Provides-Extra: cli
+Requires-Dist: ssh-over-sse-cli==0.1.0; extra == 'cli'
+Provides-Extra: gateway
+Requires-Dist: ssh-over-sse-gateway==0.1.0; extra == 'gateway'
+Description-Content-Type: text/markdown
+
+# ssh-over-sse
+
+Use your usual SSH commands through an HTTPS gateway. Install **ssh-sse-cli** on
+your computer and **ssh-sse-gateway** on a host that can reach your SSH servers.
+
+## Install
+
+Requires Python 3.12 or newer and OpenSSH. The client supports Linux and macOS.
+The gateway needs `ssh-keygen` available.
+
+Choose the commands you need with pip:
+
+| Install | Commands |
+| --- | --- |
+| `pip install 'ssh-over-sse[cli]'` | `ssh-sse-cli` |
+| `pip install 'ssh-over-sse[gateway]'` | `ssh-sse-gateway` |
+| `pip install 'ssh-over-sse[all]'` | Both |
+
+`ssh-over-sse[cli,gateway]` also installs both. Select an option when installing;
+the base package alone does not install commands.
+
+Or use uv to install either command as a tool:
+
+```sh
+uv tool install --python 3.12 ssh-over-sse-cli
+uv tool install --python 3.12 ssh-over-sse-gateway
+```
+
+Supported keys are Ed25519, RSA (2048–8192 bits), and ECDSA (P-256, P-384, P-521).
+Your private key stays on your computer. Load encrypted keys into `ssh-agent`
+before connecting.
+
+## Connect
+
+Ask your administrator for the gateway URL and an allowed SSH destination.
+Add an entry to your SSH configuration using your own values:
+
+```sshconfig
+Host my-server
+    HostName 192.0.2.20
+    Port 22
+    User alice
+    IdentityFile ~/.ssh/id_ed25519
+    IdentitiesOnly yes
+    StrictHostKeyChecking yes
+    ProxyCommand ssh-sse-cli --url https://gateway.example.com --ssh-host %n
+```
+
+The client reads the destination, port, user, and identity from that host entry.
+Use the gateway's root URL; no additional path is needed.
+
+Connect and transfer files normally:
+
+```sh
+ssh my-server
+scp report.txt my-server:report.txt
+sftp my-server
+rsync -e ssh report.txt my-server:report.txt
+```
+
+Your public key must be authorized by both the gateway and destination server.
+Verify the destination's host key before your first connection.
+
+## Check gateway access
+
+Open the gateway URL in a browser to see its landing page, then check your key:
+
+```sh
+ssh-sse-cli --url https://gateway.example.com check
+```
+
+The default identity is `~/.ssh/id_ed25519`. Select another key with `-i`, or use
+`--ssh-host my-server` to read its identity from your SSH configuration:
+
+```sh
+ssh-sse-cli --url https://gateway.example.com -i ~/.ssh/id_ecdsa check
+ssh-sse-cli --url https://gateway.example.com --ssh-host my-server check
+```
+
+Success prints `Gateway SSH key authentication succeeded.` and exits with status
+0. Failure exits with status 1. This checks gateway access; destination access is
+verified when you connect. Direct backend key checks also accept an HTTP URL.
+SSH connections use HTTPS.
+
+## Run a gateway
+
+Save your public HTTPS URL and allowed destinations in
+`~/.config/ssh-over-sse/gateway.yaml`:
+
+```yaml
+server:
+  audience: https://gateway.example.com
+  listen: 0.0.0.0:7010
+  ingress_network_restricted: true
+targets:
+  - host: 192.0.2.20
+    ports: [22]
+    ssh_users: [alice]
+```
+
+Authorize users' public keys in the gateway account's `~/.ssh/authorized_keys`.
+Restrict the configuration file to its owner. Limit backend access to your trusted
+network before setting `ingress_network_restricted: true`.
+
+Validate the configuration, then start:
+
+```sh
+ssh-sse-gateway --check-config
+ssh-sse-gateway
+```
+
+With OCI providing HTTPS, the gateway uses plain HTTP on port **7010** and needs
+no TLS certificate. The default listener is `127.0.0.1:7010`; the example above
+accepts ingress on all interfaces.
+
+## Help
+
+```sh
+ssh-sse-cli --help
+ssh-sse-gateway --help
+```
+
+Release notes are in `CHANGELOG.md`.

ssh_over_sse-0.1.0/README.md

@@ -0,0 +1,123 @@
+# ssh-over-sse
+
+Use your usual SSH commands through an HTTPS gateway. Install **ssh-sse-cli** on
+your computer and **ssh-sse-gateway** on a host that can reach your SSH servers.
+
+## Install
+
+Requires Python 3.12 or newer and OpenSSH. The client supports Linux and macOS.
+The gateway needs `ssh-keygen` available.
+
+Choose the commands you need with pip:
+
+| Install | Commands |
+| --- | --- |
+| `pip install 'ssh-over-sse[cli]'` | `ssh-sse-cli` |
+| `pip install 'ssh-over-sse[gateway]'` | `ssh-sse-gateway` |
+| `pip install 'ssh-over-sse[all]'` | Both |
+
+`ssh-over-sse[cli,gateway]` also installs both. Select an option when installing;
+the base package alone does not install commands.
+
+Or use uv to install either command as a tool:
+
+```sh
+uv tool install --python 3.12 ssh-over-sse-cli
+uv tool install --python 3.12 ssh-over-sse-gateway
+```
+
+Supported keys are Ed25519, RSA (2048–8192 bits), and ECDSA (P-256, P-384, P-521).
+Your private key stays on your computer. Load encrypted keys into `ssh-agent`
+before connecting.
+
+## Connect
+
+Ask your administrator for the gateway URL and an allowed SSH destination.
+Add an entry to your SSH configuration using your own values:
+
+```sshconfig
+Host my-server
+    HostName 192.0.2.20
+    Port 22
+    User alice
+    IdentityFile ~/.ssh/id_ed25519
+    IdentitiesOnly yes
+    StrictHostKeyChecking yes
+    ProxyCommand ssh-sse-cli --url https://gateway.example.com --ssh-host %n
+```
+
+The client reads the destination, port, user, and identity from that host entry.
+Use the gateway's root URL; no additional path is needed.
+
+Connect and transfer files normally:
+
+```sh
+ssh my-server
+scp report.txt my-server:report.txt
+sftp my-server
+rsync -e ssh report.txt my-server:report.txt
+```
+
+Your public key must be authorized by both the gateway and destination server.
+Verify the destination's host key before your first connection.
+
+## Check gateway access
+
+Open the gateway URL in a browser to see its landing page, then check your key:
+
+```sh
+ssh-sse-cli --url https://gateway.example.com check
+```
+
+The default identity is `~/.ssh/id_ed25519`. Select another key with `-i`, or use
+`--ssh-host my-server` to read its identity from your SSH configuration:
+
+```sh
+ssh-sse-cli --url https://gateway.example.com -i ~/.ssh/id_ecdsa check
+ssh-sse-cli --url https://gateway.example.com --ssh-host my-server check
+```
+
+Success prints `Gateway SSH key authentication succeeded.` and exits with status
+0. Failure exits with status 1. This checks gateway access; destination access is
+verified when you connect. Direct backend key checks also accept an HTTP URL.
+SSH connections use HTTPS.
+
+## Run a gateway
+
+Save your public HTTPS URL and allowed destinations in
+`~/.config/ssh-over-sse/gateway.yaml`:
+
+```yaml
+server:
+  audience: https://gateway.example.com
+  listen: 0.0.0.0:7010
+  ingress_network_restricted: true
+targets:
+  - host: 192.0.2.20
+    ports: [22]
+    ssh_users: [alice]
+```
+
+Authorize users' public keys in the gateway account's `~/.ssh/authorized_keys`.
+Restrict the configuration file to its owner. Limit backend access to your trusted
+network before setting `ingress_network_restricted: true`.
+
+Validate the configuration, then start:
+
+```sh
+ssh-sse-gateway --check-config
+ssh-sse-gateway
+```
+
+With OCI providing HTTPS, the gateway uses plain HTTP on port **7010** and needs
+no TLS certificate. The default listener is `127.0.0.1:7010`; the example above
+accepts ingress on all interfaces.
+
+## Help
+
+```sh
+ssh-sse-cli --help
+ssh-sse-gateway --help
+```
+
+Release notes are in `CHANGELOG.md`.

ssh_over_sse-0.1.0/pyproject.toml

@@ -0,0 +1,30 @@
+[project]
+name = "ssh-over-sse"
+version = "0.1.0"
+description = "Use SSH through an HTTPS gateway with a local CLI, a gateway, or both"
+readme = "README.md"
+requires-python = ">=3.12"
+dependencies = []
+
+[project.optional-dependencies]
+cli = ["ssh-over-sse-cli==0.1.0"]
+gateway = ["ssh-over-sse-gateway==0.1.0"]
+all = ["ssh-over-sse-cli==0.1.0", "ssh-over-sse-gateway==0.1.0"]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.uv.sources]
+ssh-over-sse-cli = { path = "ssh-sse-tool" }
+ssh-over-sse-gateway = { path = "ssh-sse-gateway" }
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/ssh_over_sse"]
+
+[tool.hatch.build.targets.sdist]
+include = [
+    "/pyproject.toml", "/README.md", "/CHANGELOG.md", "/src/ssh_over_sse",
+    "/ssh-sse-tool/pyproject.toml", "/ssh-sse-tool/README.md", "/ssh-sse-tool/src",
+    "/ssh-sse-gateway/pyproject.toml", "/ssh-sse-gateway/README.md", "/ssh-sse-gateway/src",
+]

ssh_over_sse-0.1.0/src/ssh_over_sse/__init__.py

@@ -0,0 +1,3 @@
+"""SSH over HTTPS/SSE. Install the cli, gateway, or all extra to select commands."""
+
+__version__ = "0.1.0"

ssh_over_sse-0.1.0/ssh-sse-gateway/README.md

@@ -0,0 +1,109 @@
+# ssh-sse-gateway
+
+Provide authorized SSH access through an HTTPS endpoint. Run the gateway on a
+host that can reach your approved SSH destinations.
+
+## Install
+
+Requires Python 3.12 or newer and OpenSSH's `ssh-keygen`.
+
+With uv:
+
+```sh
+uv tool install --python 3.12 ssh-over-sse-gateway
+```
+
+Or with pip:
+
+```sh
+pip install 'ssh-over-sse[gateway]'
+```
+
+Use `ssh-over-sse[all]` with pip to install the client command too.
+
+## Configure
+
+Save your configuration as `~/.config/ssh-over-sse/gateway.yaml`. Use your public
+HTTPS root URL and allow each SSH destination and login username:
+
+```yaml
+server:
+  audience: https://gateway.example.com
+  listen: 0.0.0.0:7010
+  ingress_network_restricted: true
+targets:
+  - host: 192.0.2.20
+    ports: [22]
+    ssh_users: [alice]
+```
+
+Replace the example values and restrict the file to its owner. Limit backend
+access to your trusted network before setting `ingress_network_restricted: true`;
+this setting acknowledges your network restrictions and does not create them.
+
+The default listener is `127.0.0.1:7010`. With OCI providing HTTPS, the gateway
+runs plain HTTP on port **7010** and needs no backend certificate. The example
+above accepts ingress on all interfaces.
+
+## Authorize users
+
+The gateway reads public keys from its account's `~/.ssh/authorized_keys` by
+default. Set `server.authorized_keys_file` if the file is elsewhere.
+
+Supported entries are unrestricted Ed25519, RSA (2048–8192 bits), and ECDSA
+(P-256, P-384, P-521) public keys. Entries with SSH restrictions such as `from=` or
+`command=` are skipped. Use only keys intended to have gateway access.
+
+All eligible keys authenticate to the gateway account. The requested destination
+and SSH username must also be allowed in your configuration. The destination
+server separately authorizes the user's SSH login. Private user keys stay on
+users' computers.
+
+Removing a key denies new access and ends its active connections. Restart the
+gateway after changing destination permissions; restarting ends active sessions.
+
+## Start
+
+Validate the configuration, then start:
+
+```sh
+ssh-sse-gateway --check-config
+ssh-sse-gateway
+```
+
+To use another configuration file:
+
+```sh
+ssh-sse-gateway --config /path/to/gateway.yaml --check-config
+ssh-sse-gateway --config /path/to/gateway.yaml
+```
+
+Configure HTTPS ingress to forward requests to the gateway. It must pass
+authorization headers and support streaming without buffering or compression.
+The root URL shows a landing page in a browser. Users pass that same root URL to
+`ssh-sse-cli`.
+
+For direct HTTPS without an ingress, set `server.tls_mode: direct` and provide
+`--tls-cert /path/to/cert.pem` and `--tls-key /path/to/key.pem` when starting.
+Restrict the server's private certificate key to its owner.
+
+## Check access
+
+From a user's computer:
+
+```sh
+ssh-sse-cli --url https://gateway.example.com -i ~/.ssh/id_ecdsa check
+```
+
+Success confirms gateway key access. Users still need destination permission and
+an authorized SSH login. A landing page alone does not confirm SSH access.
+
+## Troubleshooting
+
+If startup fails, run `--check-config` and check required values, file ownership,
+and permissions. If users cannot connect, check the HTTPS route, public-key
+access, destination permissions, and network reachability.
+
+```sh
+ssh-sse-gateway --help
+```

ssh_over_sse-0.1.0/ssh-sse-gateway/pyproject.toml

@@ -0,0 +1,29 @@
+[project]
+name = "ssh-over-sse-gateway"
+version = "0.1.0"
+readme = "README.md"
+description = "Policy-restricted SSH TCP relay over HTTPS POST and SSE"
+requires-python = ">=3.12"
+dependencies = ["starlette>=1.3.1,<2", "uvicorn>=0.35,<1", "pyyaml>=6,<7", "cryptography>=45"]
+[project.scripts]
+ssh-sse-gateway = "ssh_sse_gateway.cli:main"
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+[dependency-groups]
+dev = ["pytest>=8", "pytest-asyncio>=1", "httpx>=0.28", "ruff>=0.12", "mypy>=1.16", "types-PyYAML"]
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "function"
+[tool.ruff]
+line-length = 100
+[tool.ruff.lint]
+select = ["E4", "E7", "E9", "F", "I"]
+[tool.mypy]
+check_untyped_defs = true
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/ssh_sse_gateway"]
+
+[tool.hatch.build.targets.sdist]
+include = ["/pyproject.toml", "/README.md", "/uv.lock", "/src"]

ssh_over_sse-0.1.0/ssh-sse-gateway/src/ssh_sse_gateway/__init__.py

@@ -0,0 +1 @@
+"""SSH-over-SSE gateway."""