# SSH local-forward tunnel: pve-201 -> webzavod -> flights.test.aeroflot.ru:443.
#
# nginx on pve-201 proxies /api/ and /map/api/ to https://127.0.0.1:8443. This
# unit forwards 8443 over SSH to webzavod (192.168.88.58), which terminates the
# corp VPN (ppp0). The customer WAF whitelists webzavod's egress IP, so requests
# arriving via this tunnel reach the real backend instead of the WAF interstitial.
#
# Webzavod's authorized_keys entry restricts this key to:
#   command="exit 1",no-pty,no-X11-forwarding,no-agent-forwarding,no-user-rc,
#   permitopen="flights.test.aeroflot.ru:443"
#
# Install:
#   sudo cp deployment/systemd/flights-tim-tunnel.service /etc/systemd/system/
#   sudo systemctl daemon-reload
#   sudo systemctl enable --now flights-tim-tunnel.service
#
# Verify:
#   ss -ltn | grep ':8443\b'
#   curl -k --resolve flights.test.aeroflot.ru:8443:127.0.0.1 \
#     -o /dev/null -w '%{http_code}\n' \
#     https://flights.test.aeroflot.ru:8443/swagger/index.html   # expect 401

[Unit]
Description=SSH tunnel pve-201->webzavod for flights.test.aeroflot.ru:443
Documentation=https://git.gnerim.ru/gnezim/Aeroflot.Flights.Web
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=gnezim
ExecStart=/usr/bin/ssh -N \
  -o BatchMode=yes \
  -o ExitOnForwardFailure=yes \
  -o ServerAliveInterval=30 \
  -o ServerAliveCountMax=3 \
  -o StrictHostKeyChecking=accept-new \
  -L 127.0.0.1:8443:flights.test.aeroflot.ru:443 \
  gnezim@192.168.88.58
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target
