{"id":16813113,"url":"https://github.com/ivanvc/boombox","last_synced_at":"2025-03-17T11:24:01.523Z","repository":{"id":176478923,"uuid":"654761759","full_name":"ivanvc/boombox","owner":"ivanvc","description":"Boombox, the shell on-demand service that runs on Kubernetes","archived":false,"fork":false,"pushed_at":"2023-08-04T21:04:59.000Z","size":82,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-23T20:52:34.395Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ivanvc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-06-16T22:25:55.000Z","updated_at":"2023-06-17T04:49:59.000Z","dependencies_parsed_at":null,"dependency_job_id":"a23b67ef-356b-4f03-b348-881ed3a6e2e5","html_url":"https://github.com/ivanvc/boombox","commit_stats":null,"previous_names":["ivanvc/boombox"],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ivanvc%2Fboombox","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ivanvc%2Fboombox/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ivanvc%2Fboombox/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ivanvc%2Fboombox/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ivanvc","download_url":"https://codeload.github.com/ivanvc/boombox/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244022637,"owners_count":20385133,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-13T10:24:45.904Z","updated_at":"2025-03-17T11:24:01.478Z","avatar_url":"https://github.com/ivanvc.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Boombox\n\n\u003cp\u003e\u003cimg src=\"https://ivan.vc/boombox/images/logo.png\" alt=\"Boombox\" title=\"Boombox\" align=\"right\" width=\"25%\" style=\"padding-left: 10px\"\u003e\u003c/p\u003e\n\nBoombox is a shell on-demand service that runs on Kubernetes. It listens on SSH\nand creates a Pod in the cluster where the terminal will be attached.\n\n* The first time a user logs in, it creates a Persistent Volume Claim, which will\n  be mounted on `/home`. This ensures that there's persistence in the user's\n  home.\n* The user doesn't have sudo access, so the container is stateless.\n* It uses [Homebrew](https://brew.sh), so the user can install new applications,\n  which are persisted in `/home/linuxbrew`.\n\n## Why?\n\nWhy don't you create a Pod and attach to it? I wanted to keep persistence for\nthe users while limiting access to the cluster. As this runs on SSH, they just\nneed to start a new terminal without requiring access to the Kubernetes\ncluster. Still, they can access internal Kubernetes services.\n\n## Deploying\n\nUse the provided helm chart `ivanvc/boombox`.\n\nCreating a private key for the server is strongly suggested. You can do it with\n`ssh-keygen -t ed25519`. Then, provide it to the chart when deploying to your\ncluster by setting it with `secrets.hostKey`.\n\n### Configuration options\n\nThe following options can be set as environment variables (upper snake case and\nwith the `BOOMBOX_` prefix), or as arguments to the application. They are also\nexposed in the Helm chart.\n\n* `listen`: The `host:port` where to start the SSH daemon (default: `:2828`)\n* `host-key-path`: The location for the host key path (default:\n  `.ssh/boombox_ed25519`)\n* `namespace`: The namespace where Boombox will create the PVCs and Pods\n  (default: `default`, with Helm it defaults to the deployment namespace)\n* `container-image`: The image for the Pod container (default: `ubuntu`)\n* `pvc-size`: The size for the PVC that is mounted at `/home` (default: `10Gi`)\n* `log-level`: The log level (default: `INFO`)\n\n#### Setting the user shell\n\nTo set the user shell, create a file `~/.boombox_shell` with the content of the\nshell to execute (i.e., `/bin/bash` or `/home/linuxbrew/.linuxbrew/bin/zsh`).\n\n### Expose with an ingress\n\nAs Kubernetes ingresses don't have support for TCP, you need to follow the\nfollowing guide: [Exposing TCP and UDP services].\n\n1. In your TCP services config map, add 2828 (assuming the default port)\n   pointing to the Boombox service (assuming it's deployed in the boombox\n   namespace).\n  ```yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: tcp-services\n  namespace: ingress-nginx\ndata:\n  2828: \"boombox/boombox:2828\"\n  ```\n\n2. Modify the ingress controller service, by adding Boombox's port.\n  ```yaml\napiVersion: v1\nkind: Service\nmetadata:\n  name: ingress-nginx\n  namespace: ingress-nginx\n  labels:\n    app.kubernetes.io/name: ingress-nginx\n    app.kubernetes.io/part-of: ingress-nginx\nspec:\n  type: LoadBalancer\n  ports:\n    - name: http\n      port: 80\n      targetPort: 80\n      protocol: TCP\n    - name: https\n      port: 443\n      targetPort: 443\n      protocol: TCP\n    - name: proxied-tcp-2828\n      port: 2828\n      targetPort: 2828\n      protocol: TCP\n  selector:\n    app.kubernetes.io/name: ingress-nginx\n    app.kubernetes.io/part-of: ingress-nginx\n  ```\n\n3. Ensure that the config map is in the ingress controller deployment args.\n  ```\n...\nargs:\n  - /nginx-ingress-controller\n  - --tcp-services-configmap=ingress-nginx/tcp-services\n  ```\n\nBy following these steps, Boombox can be now reached by SSHing into the ingress\ncontroller's host on port 2828.\n\n## TODO\n\n- [ ] Authentication\n- [ ] Allow overriding Pod configuration scripts\n- [ ] Allow to expose Pod ports, will need a service with defined ports, and\n      an ingress\n- [ ] Handle termination state of the Pod (`metadata.DeletionTimestamp`)\n\n## License\n\nSee [LICENSE](LICENSE) © [Ivan Valdes](https://github.com/ivanvc/)\n\n[Exposing TCP and UDP services]: https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fivanvc%2Fboombox","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fivanvc%2Fboombox","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fivanvc%2Fboombox/lists"}