mirror of
https://github.com/saphid/frame-control.git
synced 2026-10-06 01:00:18 +02:00
saphidandClaude Opus 5.5
eabf4cd1f9
- Screenshots: list the Frame's Steam screenshots, open them in the viewer, and save new ones to ~/Pictures/SteamFrame. Ids are validated before any shell, and copies land atomically. - Tailscale: scripts/tailscale-on-frame.sh installs a userspace tailscaled as a lingering systemd --user service with no sudo, SHA-256 checked, safe to re-run, with --uninstall. docs/tailscale.md covers setup and warns that in userspace mode every Frame port, including loopback-only DevTools and ADB, is reachable from the tailnet. - push-vr-video.sh: filenames starting with "-" are safe, symlinks are followed, and a real Videos\VR directory triggers a warning. - Tests cover the screenshot routes (19 total). Docs keep placeholder addresses for the headset and tailnet. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
180 lines
8.0 KiB
Bash
Executable File
180 lines
8.0 KiB
Bash
Executable File
#!/usr/bin/env zsh
|
|
# Mac-side: install Tailscale on the Frame in userspace mode, so the `frame` SSH
|
|
# alias (and Frame Control) work from anywhere, not just the home LAN.
|
|
#
|
|
# Everything lives in the steamos user's home, so it needs no sudo and survives
|
|
# SteamOS updates:
|
|
# ~/.local/share/tailscale/<version>/ static binaries (checksum-verified)
|
|
# ~/.local/share/tailscale/state/ node key and state
|
|
# ~/.local/bin/tailscale CLI wrapper that finds the daemon's socket
|
|
# ~/.config/systemd/user/tailscaled.service
|
|
# `tailscaled --tun=userspace-networking` needs no /dev/net/tun or root.
|
|
#
|
|
# Exposure: in userspace mode tailscaled forwards inbound tailnet connections
|
|
# to the Frame's loopback, so EVERY port is reachable from the tailnet,
|
|
# including localhost-only ones (Steam's DevTools on 8080, SteamVR, ADB).
|
|
# `tailscale set --shields-up` blocks all inbound (SSH too). See docs/tailscale.md.
|
|
#
|
|
# Usage: scripts/tailscale-on-frame.sh [--version X.Y.Z] [--hostname NAME]
|
|
# scripts/tailscale-on-frame.sh --uninstall
|
|
# The first run prints a login URL (and opens it on the Mac) to add the Frame
|
|
# to your tailnet. Env: FRAME_ALIAS (default frame).
|
|
set -euo pipefail
|
|
|
|
FRAME=${FRAME_ALIAS:-frame}
|
|
version="" hostname="frame" uninstall=0
|
|
while (( $# )); do
|
|
case "$1" in
|
|
--version) version=${2:?--version needs a value}; shift ;;
|
|
--hostname) hostname=${2:?--hostname needs a value}; shift ;;
|
|
--uninstall) uninstall=1 ;;
|
|
-h|--help) sed -n "2,21p" "$0"; exit 0 ;;
|
|
*) print -u2 "unknown argument: $1"; exit 2 ;;
|
|
esac
|
|
shift
|
|
done
|
|
[[ $hostname =~ '^[A-Za-z0-9-]+$' ]] || { print -u2 "bad hostname: $hostname"; exit 2; }
|
|
|
|
if (( uninstall )); then
|
|
ssh "$FRAME" 'set -e
|
|
systemctl --user disable --now tailscaled.service 2>/dev/null || true
|
|
rm -f ~/.config/systemd/user/tailscaled.service ~/.local/bin/tailscale
|
|
systemctl --user daemon-reload
|
|
echo "Removed the service and the CLI wrapper. Binaries and node state are still in"
|
|
echo "~/.local/share/tailscale; delete that folder and remove the machine in the"
|
|
echo "Tailscale admin console to finish. Linger stays on (loginctl disable-linger to undo)."'
|
|
exit 0
|
|
fi
|
|
|
|
# BackendState of the Frame's tailscaled (Running, NeedsLogin, Stopped, …), or
|
|
# Unreachable when the probe itself fails (SSH down, daemon restarting).
|
|
ts_state() {
|
|
ssh -o ConnectTimeout=10 "$FRAME" '~/.local/bin/tailscale status --json 2>/dev/null |
|
|
python3 -c "import json,sys; print(json.load(sys.stdin)[\"BackendState\"])"' 2>/dev/null || print Unreachable
|
|
}
|
|
|
|
if [[ -z $version ]]; then
|
|
version=$(curl -fsS "https://pkgs.tailscale.com/stable/?mode=json" |
|
|
python3 -c 'import json,sys; print(json.load(sys.stdin)["TarballsVersion"])')
|
|
fi
|
|
[[ $version =~ '^[0-9]+\.[0-9]+\.[0-9]+$' ]] || { print -u2 "bad version: $version"; exit 2; }
|
|
print "==> Installing Tailscale $version on $FRAME (userspace networking)"
|
|
|
|
remote_out=$(ssh "$FRAME" "VERSION=$version sh -s" <<'REMOTE'
|
|
set -eu
|
|
base="$HOME/.local/share/tailscale"
|
|
dir="$base/$VERSION"
|
|
tgz="tailscale_${VERSION}_arm64.tgz"
|
|
unit="$HOME/.config/systemd/user/tailscaled.service"
|
|
sock="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/tailscale/tailscaled.sock"
|
|
mkdir -p "$base/state" "$HOME/.local/bin" "$HOME/.config/systemd/user"
|
|
|
|
if [ ! -x "$dir/tailscaled" ]; then
|
|
tmp=$(mktemp -d)
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
curl -fsSL -o "$tmp/$tgz" "https://pkgs.tailscale.com/stable/$tgz"
|
|
want=$(curl -fsSL "https://pkgs.tailscale.com/stable/$tgz.sha256" | cut -d' ' -f1)
|
|
[ -n "$want" ] || { echo "couldn't fetch $tgz.sha256" >&2; exit 1; }
|
|
got=$(sha256sum "$tmp/$tgz" | cut -d' ' -f1)
|
|
[ "$want" = "$got" ] || { echo "checksum mismatch for $tgz" >&2; exit 1; }
|
|
tar -xzf "$tmp/$tgz" -C "$tmp"
|
|
mkdir -p "$dir"
|
|
mv "$tmp/tailscale_${VERSION}_arm64/tailscale" "$tmp/tailscale_${VERSION}_arm64/tailscaled" "$dir/"
|
|
fi
|
|
# Neither exists on a first install; don't let that trip set -e.
|
|
before=$({ readlink "$base/current"; cat "$unit"; } 2>/dev/null || true)
|
|
ln -sfn "$dir" "$base/current"
|
|
|
|
# The CLI looks for the daemon at /var/run/tailscale by default; point it at ours.
|
|
cat > "$HOME/.local/bin/tailscale" <<'EOF'
|
|
#!/bin/sh
|
|
exec "$HOME/.local/share/tailscale/current/tailscale" --socket="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/tailscale/tailscaled.sock" "$@"
|
|
EOF
|
|
chmod +x "$HOME/.local/bin/tailscale"
|
|
|
|
cat > "$unit" <<'EOF'
|
|
[Unit]
|
|
Description=Tailscale (userspace networking, no root)
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
RuntimeDirectory=tailscale
|
|
ExecStart=%h/.local/share/tailscale/current/tailscaled --tun=userspace-networking --statedir=%h/.local/share/tailscale/state --socket=%t/tailscale/tailscaled.sock --port=41641
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=default.target
|
|
EOF
|
|
# Linger starts user services at boot, before anyone logs in; polkit allows it without sudo.
|
|
loginctl enable-linger 2>/dev/null || echo "note: couldn't enable linger; tailscaled starts when the session does" >&2
|
|
systemctl --user daemon-reload
|
|
systemctl --user enable tailscaled.service >/dev/null 2>&1
|
|
after=$(readlink "$base/current"; cat "$unit")
|
|
restart=0
|
|
if systemctl --user is-active --quiet tailscaled.service; then
|
|
[ "$before" = "$after" ] || restart=1
|
|
else
|
|
systemctl --user start tailscaled.service
|
|
fi
|
|
for i in $(seq 1 50); do
|
|
[ -S "$sock" ] && break
|
|
sleep 0.2
|
|
done
|
|
[ -S "$sock" ] || { echo "tailscaled didn't open $sock; see: journalctl --user -u tailscaled" >&2; exit 1; }
|
|
v=$("$HOME/.local/bin/tailscale" version)
|
|
printf 'Tailscale %s\n' "$(printf '%s\n' "$v" | head -n 1)"
|
|
if [ "$restart" = 1 ]; then
|
|
# This SSH session may itself run over Tailscale, so restart detached, after
|
|
# it has ended; the Mac waits and reconnects.
|
|
systemd-run --user --quiet --on-active=3 --timer-property=AccuracySec=100ms --unit=tailscaled-restart --collect \
|
|
systemctl --user restart tailscaled.service >/dev/null
|
|
echo "RESTART_SCHEDULED"
|
|
fi
|
|
REMOTE
|
|
)
|
|
print -r -- "${remote_out//RESTART_SCHEDULED/Restarting tailscaled for the new version or unit…}"
|
|
|
|
# Wait out a scheduled restart, then read a definite state.
|
|
[[ $remote_out == *RESTART_SCHEDULED* ]] && sleep 6
|
|
state=""
|
|
for i in {1..30}; do
|
|
state=$(ts_state)
|
|
[[ $state == (Running|NeedsLogin|NeedsMachineAuth|Stopped|NoState) ]] && break
|
|
sleep 2
|
|
done
|
|
|
|
case $state in
|
|
Running) ;;
|
|
NeedsLogin|Stopped|NoState)
|
|
# `up` blocks until the login is approved, so run it as its own transient
|
|
# unit (it outlives this SSH session) and fetch the URL from its log.
|
|
ssh "$FRAME" "rm -f /tmp/tailscale-up.log; systemd-run --user --quiet --collect --unit=tailscale-up-\$\$ \
|
|
sh -c '~/.local/bin/tailscale up --hostname=$hostname --timeout=10m > /tmp/tailscale-up.log 2>&1' >/dev/null"
|
|
url=""
|
|
for i in {1..40}; do
|
|
url=$(ssh "$FRAME" 'grep -Eo "https://login\.tailscale\.com/[A-Za-z0-9/_-]+" /tmp/tailscale-up.log 2>/dev/null | head -n 1' || true)
|
|
[[ -n $url ]] && break
|
|
sleep 0.5
|
|
done
|
|
[[ -n $url ]] || { print -u2 "No login URL after 20 s; see /tmp/tailscale-up.log on the Frame."; exit 1; }
|
|
print "==> Approve the Frame in your tailnet: $url"
|
|
open "$url" 2>/dev/null || true
|
|
print " Waiting for approval (up to 10 minutes)…"
|
|
for i in {1..300}; do
|
|
state=$(ts_state)
|
|
[[ $state == Running ]] && break
|
|
sleep 2
|
|
done
|
|
[[ $state == Running ]] || { print -u2 "Not approved yet (state: $state). Re-run to get a new URL."; exit 1; }
|
|
;;
|
|
NeedsMachineAuth) print -u2 "Logged in; approve the device in the Tailscale admin console, then re-run."; exit 1 ;;
|
|
*) print -u2 "Couldn't read tailscaled's state (last: $state). Check: ssh $FRAME 'journalctl --user -u tailscaled'"; exit 1 ;;
|
|
esac
|
|
|
|
ssh "$FRAME" '~/.local/bin/tailscale status --self --peers=false; printf "Tailscale IP: "; ~/.local/bin/tailscale ip -4'
|
|
name=$(ssh "$FRAME" '~/.local/bin/tailscale status --json' | python3 -c 'import json,sys; print(json.load(sys.stdin)["Self"]["DNSName"].rstrip("."))')
|
|
print "==> To use the Frame from anywhere, point the alias at Tailscale:"
|
|
print " ssh-keyscan -t ed25519 $name >> ~/.ssh/known_hosts # after checking it matches"
|
|
print " scripts/connect.sh $name"
|