# 1. Clone repository
git clone https://github.com/InvGate/pytun.git
cd pytun

# 2. Install dependencies
pip install -r requirements.txt

# 3. Create connector.ini (see Configuration section)
# Edit connector.ini with your settings (no example file - create from scratch)

# 4. Create tunnel configuration
mkdir -p configs
# Create configs/my-tunnel.ini (see example below)

# 5. Run connector
python pytun.py

# Standard run (uses ./connector.ini)
python pytun.py

# Custom configuration file
python pytun.py --config_ini /path/to/connector.ini

# Show version
python pytun.py --version

# Test service connectivity (checks if local services are reachable)
python pytun.py --test_connections

# Test SSH tunnel establishment (verifies SSH connection to bastion)
python pytun.py --test_tunnels

# Test SMTP email alerts
python pytun.py --test_smtp

# Test HTTP POST alerts
python pytun.py --test_http

# Run all tests (comprehensive diagnostic)
python pytun.py --test_all

# View logs (real-time)
tail -f logs/main_connector.log       # Main connector log
tail -f logs/my-tunnel-name.log       # Per-tunnel logs

# HTTP Status API (while connector is running)
curl http://localhost:9999/                # Health check
curl http://localhost:9999/status          # Tunnel status + service health
curl http://localhost:9999/configs -o configs.zip   # Download configs
curl http://localhost:9999/logs -o logs.zip         # Download logs

# Generate 4096-bit RSA key (no passphrase)
ssh-keygen -t rsa -b 4096 -f ~/.ssh/pytun_key -N ""

# Two files created:
#   ~/.ssh/pytun_key      (private key - keep secure!)
#   ~/.ssh/pytun_key.pub  (public key)

# Copy public key to SSH server's authorized_keys
ssh-copy-id -i ~/.ssh/pytun_key.pub [email protected]

# Or manually:
cat ~/.ssh/pytun_key.pub | ssh [email protected] \
  "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

# Verify passwordless authentication works
ssh -i ~/.ssh/pytun_key [email protected]

# If prompted for password, key setup failed

# Add server to known_hosts
ssh-keyscan bastion.example.com >> ~/.ssh/known_hosts

# Use this file as server_key in tunnel config

# Install PyInstaller (if not already installed)
pip install pyinstaller

# Build executable
pyinstaller pytun.spec

# Output: dist/pytun.exe

# Using Shawl (Windows service wrapper)
# Download: https://github.com/mtkennerly/shawl

shawl add --name InvGateTunnel -- \
  "C:\path\to\pytun.exe" --config_ini "C:\path\to\connector.ini"

# Start service
sc start InvGateTunnel

# Stop service
sc stop InvGateTunnel

# Remove service
shawl remove --name InvGateTunnel

# Check logs for specific error
tail -f logs/main_connector.log

# Common errors and solutions:
PasswordRequiredException        → SSH key has password (must be passwordless)
BadHostKeyException             → Server key mismatch (update known_hosts)
AuthenticationException         → SSH key not authorized (check authorized_keys)
FileNotFoundError: keyfile      → Path to SSH key incorrect
Missing keyfile argument        → keyfile not set in tunnel config

# 1. Test SSH connection manually
ssh -i /path/to/keyfile username@server_host -p server_port

# 2. Test tunnel establishment
python pytun.py --test_tunnels

# 3. Test service connectivity
python pytun.py --test_connections

# Test service connectivity from connector host
nc -zv remote_host remote_port

# Or use telnet
telnet remote_host remote_port

# Check connector logs for pattern
tail -f logs/tunnel-name.log | grep -E "error|exception|down"

# Test SMTP configuration
python pytun.py --test_smtp

# Check rate limiting (10-minute window)
# If alert sent recently, may be suppressed

# Verify SMTP settings in connector.ini

# Test HTTP POST configuration
python pytun.py --test_http

# Test webhook endpoint manually
curl -X POST -u http_user:http_password \
  -H "Content-Type: application/json" \
  -d '{"test": "alert"}' \
  http_url

# Fix config file permissions
chmod 600 connector.ini
chmod 600 configs/*.ini
chmod 400 ~/.ssh/pytun_key
chmod 755 logs/

# Check ownership
ls -la connector.ini