v0.2.0

internal/keymgr/clientconfig.go

@@ -3,42 +3,37 @@ package keymgr
 import (
 	"fmt"
 	"strings"
-
-	"ssh-access-tui/internal/model"
 )
 
 // RenderClientConfig produces an OpenSSH client config (works identically on
-// Windows' built-in OpenSSH client, macOS, and Linux) that gives the user a
-// "jump" alias plus one alias per host they're allowed to reach.
+// Windows' built-in OpenSSH client, macOS, and Linux). It defines exactly
+// one connection, "jump", carrying one LocalForward per allowed service —
+// the user opens it once (see INSTRUCTIONS.txt) and every service becomes
+// reachable at once on the listed local ports, for as long as that one
+// connection stays open.
 //
 // This file is convenience only, not a security boundary: nothing stops a
 // user from editing it or invoking ssh by hand. The actual restriction to
-// these hosts is enforced server-side via authorized_keys permitopen=
-// (see internal/sysadm/authorizedkeys.go) independent of what this file says.
-func RenderClientConfig(jumpHost string, jumpPort int, username, keyFileName string, hosts []model.Host) string {
+// these destinations is enforced server-side via authorized_keys
+// permitopen= (see internal/sysadm/authorizedkeys.go) independent of what
+// this file says.
+func RenderClientConfig(jumpHost string, jumpPort int, username, keyFileName string, forwards []AllocatedForward) string {
 	var b strings.Builder
 	fmt.Fprintf(&b, "# ssh-access-tui client config for %s\n", username)
-	fmt.Fprintf(&b, "# Generated %s. Regenerated whenever your allowed host list changes.\n\n", genTimestamp())
+	fmt.Fprintf(&b, "# Generated %s. Regenerated whenever your allowed services change.\n\n", genTimestamp())
 
 	fmt.Fprintf(&b, "Host jump\n")
 	fmt.Fprintf(&b, "    HostName %s\n", jumpHost)
 	fmt.Fprintf(&b, "    Port %d\n", jumpPort)
 	fmt.Fprintf(&b, "    User %s\n", username)
 	fmt.Fprintf(&b, "    IdentityFile ~/.ssh/%s\n", keyFileName)
-	fmt.Fprintf(&b, "    IdentitiesOnly yes\n\n")
-
-	for _, h := range hosts {
-		fmt.Fprintf(&b, "Host %s\n", h.Name)
-		fmt.Fprintf(&b, "    HostName %s\n", h.Address)
-		fmt.Fprintf(&b, "    Port %d\n", h.Port)
-		fmt.Fprintf(&b, "    User %s\n", username)
-		fmt.Fprintf(&b, "    ProxyJump jump\n")
-		fmt.Fprintf(&b, "    IdentityFile ~/.ssh/%s\n", keyFileName)
-		fmt.Fprintf(&b, "    IdentitiesOnly yes\n")
-		if h.Description != "" {
-			fmt.Fprintf(&b, "    # %s\n", h.Description)
+	fmt.Fprintf(&b, "    IdentitiesOnly yes\n")
+	for _, f := range forwards {
+		comment := f.HostName + "/" + f.ServiceName
+		if f.Description != "" {
+			comment += ": " + f.Description
 		}
-		b.WriteString("\n")
+		fmt.Fprintf(&b, "    LocalForward %d %s:%d  # %s\n", f.LocalPort, f.Address, f.Port, comment)
 	}
 	return b.String()
 }