fix: replace serveo with bore transparent TCP tunnel — fixes Termius connection

ROOT CAUSE:
serveo.net is an SSH-level proxy. It terminates the SSH connection
at its end and re-originates a new one. PTY allocation requests are
intercepted in this double-SSH hop and silently dropped, causing
Termius to authenticate but never receive a shell or prompt.
Cloudflare free tunnels have the same fundamental problem for raw
TCP SSH — they wrap traffic in HTTPS/WebSocket, so plain SSH
clients cannot connect to them at all (Termius timed out on port 22).

FIX — bore transparent TCP tunnel:
bore local 22 --to bore.pub
bore forwards raw bytes — zero protocol interpretation. Termius
connects directly: bore.pub:PORT → raw TCP → sshd:22. The full SSH
handshake, PTY allocation, and all channel types flow directly
between Termius and sshd with no middleman.

CHANGES:
Dockerfile:
- Add bore v0.6.0 binary (x86_64-unknown-linux-musl, single binary)
- Remove openssh-client (was only needed to ssh into serveo)

entrypoint.sh:
- Remove serveo tunnel block (two-attempt named/random logic)
- Add bore tunnel block:
waits up to 20s for assigned port
logs Termius host/port/user/pass prominently
background auto-restart loop with port detection
saves bore.pub:PORT to /data/logs/tunnel-url.txt

Dockerfile

@@ -3,8 +3,8 @@
 ##   /terminal → ttyd on :7681 (real PTY bash)
 ##   /         → opencode on :8080 (chat UI + API)
 ##
-## SSH access: sshd on :22 (internal) reached via reverse tunnel
-## to a Fly.io jump server. No inbound tunnel services used.
+## SSH access: sshd on :22 (internal) reached via bore transparent TCP tunnel.
+## bore.pub:PORT → raw TCP → sshd:22  (no SSH interception → full PTY support)
 FROM debian:bookworm-slim
 
 ENV DEBIAN_FRONTEND=noninteractive
@@ -20,16 +20,20 @@ ENV PORT=7860
 
 ARG OPENCODE_VERSION=1.18.3
 ARG TTYD_VERSION=1.7.7
+ARG BORE_VERSION=0.6.0
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
       ca-certificates curl git gnupg python3 python3-pip nginx \
-      openssh-server openssh-client \
+      openssh-server \
  && curl -fsSL "https://github.com/anomalyco/opencode/releases/download/v${OPENCODE_VERSION}/opencode-linux-x64.tar.gz" \
       | tar -xz -C /usr/local/bin opencode \
  && chmod +x /usr/local/bin/opencode \
  && curl -fsSL "https://github.com/tsl0922/ttyd/releases/download/${TTYD_VERSION}/ttyd.x86_64" \
       -o /usr/local/bin/ttyd \
  && chmod +x /usr/local/bin/ttyd \
+ && curl -fsSL "https://github.com/ekzhang/bore/releases/download/v${BORE_VERSION}/bore-v${BORE_VERSION}-x86_64-unknown-linux-musl.tar.gz" \
+      | tar -xz -C /usr/local/bin bore \
+ && chmod +x /usr/local/bin/bore \
  && mkdir -p /var/run/sshd \
  && rm -rf /var/lib/apt/lists/*
 

entrypoint.sh

@@ -5,8 +5,9 @@
 #    /terminal  → ttyd  :7681  — real PTY bash, mobile-optimised
 #    /          → opencode :8080 — chat UI + REST API + SSE
 #  sshd     :22   (internal only)
-#    ↑ exposed via reverse SSH tunnel through serveo.net
-#      Termius → opencode-hf.serveo.net:22 → here
+#    ↑ exposed via bore transparent TCP tunnel
+#      Termius → bore.pub:PORT → raw TCP → sshd:22
+#      (no SSH interception = full PTY, arrow keys, Ctrl+C, vim)
 #
 set -u
 
@@ -156,106 +157,80 @@ ssh-keygen -A 2>/dev/null || true
 /usr/sbin/sshd
 echo "[SSH] sshd running on port 22."
 
-# ─── Reverse SSH tunnel via serveo.net ───────────────────────────────
-# serveo.net is a free relay — no account, no binary, no tokens.
-# We open an outbound SSH connection (HF allows this) and serveo
-# exposes the tunnel at a public hostname:port.
+# ─── Transparent TCP tunnel via bore ─────────────────────────────────
+# bore forwards raw TCP bytes without touching the SSH protocol.
+# Termius → bore.pub:PORT → raw TCP → sshd:22
+# The SSH handshake happens directly between Termius and sshd — no
+# middleman, so PTY, arrow keys, Ctrl+C, vim all work perfectly.
 #
-# Two attempts:
-#   1. Named subdomain: opencode-hf.serveo.net:22  (fixed, easy to remember)
-#   2. Random port:     serveo.net:NNNNN           (fallback)
-#
-SERVEO_LOG=/data/logs/serveo.log
+BORE_LOG=/data/logs/bore.log
 TUNNEL_HOST=""
 TUNNEL_PORT=""
+BORE_PID=""
 
-echo "[TUNNEL] Starting SSH tunnel via serveo.net..."
-
-# Attempt 1 — named subdomain (opencode-hf.serveo.net:22)
-ssh -o StrictHostKeyChecking=no \
-    -o UserKnownHostsFile=/dev/null \
-    -o ServerAliveInterval=30 \
-    -o ServerAliveCountMax=6 \
-    -o LogLevel=ERROR \
-    -R opencode-hf:22:localhost:22 \
-    serveo.net > "${SERVEO_LOG}" 2>&1 &
-SERVEO_PID=$!
+echo "[TUNNEL] Starting transparent TCP tunnel via bore..."
+> "${BORE_LOG}"
 
-sleep 8
+bore local 22 --to bore.pub > "${BORE_LOG}" 2>&1 &
+BORE_PID=$!
 
-# Check if named subdomain was accepted
-if kill -0 "${SERVEO_PID}" 2>/dev/null; then
-    # Process still running — tunnel likely up
-    TUNNEL_HOST="opencode-hf.serveo.net"
-    TUNNEL_PORT="22"
-else
-    # Named subdomain taken or serveo refused — try random port
-    echo "[TUNNEL] Named subdomain unavailable, trying random port..."
-    ssh -o StrictHostKeyChecking=no \
-        -o UserKnownHostsFile=/dev/null \
-        -o ServerAliveInterval=30 \
-        -o ServerAliveCountMax=6 \
-        -o LogLevel=INFO \
-        -R 0:localhost:22 \
-        serveo.net > "${SERVEO_LOG}" 2>&1 &
-    SERVEO_PID=$!
-    sleep 8
+# Wait up to 20s for bore to print the assigned port
+for _i in $(seq 1 20); do
+    sleep 1
+    TUNNEL_PORT=$(grep -oE 'bore\.pub:[0-9]+' "${BORE_LOG}" 2>/dev/null \
+        | grep -oE '[0-9]+$' | head -1)
+    [ -n "${TUNNEL_PORT}" ] && break
+done
 
-    # Parse assigned port from log
-    TUNNEL_PORT=$(grep -oE 'Allocated port [0-9]+' "${SERVEO_LOG}" 2>/dev/null \
-        | grep -oE '[0-9]+' | head -1)
-    if [ -n "${TUNNEL_PORT}" ]; then
-        TUNNEL_HOST="serveo.net"
-    fi
+if [ -n "${TUNNEL_PORT}" ] && kill -0 "${BORE_PID}" 2>/dev/null; then
+    TUNNEL_HOST="bore.pub"
 fi
 
-# Report result
 echo "[TUNNEL] ============================================"
 if [ -n "${TUNNEL_HOST}" ]; then
-    echo "[TUNNEL] SSH tunnel is UP via serveo.net"
+    echo "[TUNNEL] Tunnel type  : bore (transparent TCP — no SSH interception)"
+    echo "[TUNNEL] Status       : UP"
     echo "[TUNNEL] ----"
-    echo "[TUNNEL] Termius host     : ${TUNNEL_HOST}"
-    echo "[TUNNEL] Termius port     : ${TUNNEL_PORT}"
-    echo "[TUNNEL] Termius username : root"
-    echo "[TUNNEL] Termius password : your SSH_PASSWORD secret"
+    echo "[TUNNEL] Termius host : ${TUNNEL_HOST}"
+    echo "[TUNNEL] Termius port : ${TUNNEL_PORT}"
+    echo "[TUNNEL] Termius user : root"
+    echo "[TUNNEL] Termius pass : (your SSH_PASSWORD secret)"
     echo "[TUNNEL] ----"
-    echo "[TUNNEL] Tunnel log : ${SERVEO_LOG}"
+    echo "[TUNNEL] PTY support  : FULL (arrow keys, Ctrl+C, vim, tab completion)"
+    echo "[TUNNEL] Tunnel log   : ${BORE_LOG}"
+    echo "[TUNNEL] ============================================"
+    echo "bore.pub:${TUNNEL_PORT}" > /data/logs/tunnel-url.txt
 
-    # Auto-restart loop in background if tunnel drops
+    # Auto-restart: if bore dies, reconnect and log the new port
     (
+        _bore_pid="${BORE_PID}"
         while true; do
-            sleep 15
-            if ! kill -0 "${SERVEO_PID}" 2>/dev/null; then
-                echo "[TUNNEL] Tunnel dropped — reconnecting..." >> "${SERVEO_LOG}"
-                if [ "${TUNNEL_HOST}" = "opencode-hf.serveo.net" ]; then
-                    ssh -o StrictHostKeyChecking=no \
-                        -o UserKnownHostsFile=/dev/null \
-                        -o ServerAliveInterval=30 \
-                        -o ServerAliveCountMax=6 \
-                        -o LogLevel=ERROR \
-                        -R opencode-hf:22:localhost:22 \
-                        serveo.net >> "${SERVEO_LOG}" 2>&1 &
-                    SERVEO_PID=$!
-                else
-                    ssh -o StrictHostKeyChecking=no \
-                        -o UserKnownHostsFile=/dev/null \
-                        -o ServerAliveInterval=30 \
-                        -o ServerAliveCountMax=6 \
-                        -o LogLevel=ERROR \
-                        -R 0:localhost:22 \
-                        serveo.net >> "${SERVEO_LOG}" 2>&1 &
-                    SERVEO_PID=$!
+            sleep 10
+            if ! kill -0 "${_bore_pid}" 2>/dev/null; then
+                _ts="$(date -u '+%H:%M:%S')"
+                echo "[TUNNEL][${_ts}] bore dropped — reconnecting..." >> "${BORE_LOG}"
+                bore local 22 --to bore.pub >> "${BORE_LOG}" 2>&1 &
+                _bore_pid=$!
+                for _w in $(seq 1 15); do
+                    sleep 1
+                    _new_port=$(grep -oE 'bore\.pub:[0-9]+' "${BORE_LOG}" 2>/dev/null \
+                        | grep -oE '[0-9]+$' | tail -1)
+                    [ -n "${_new_port}" ] && break
+                done
+                if [ -n "${_new_port}" ]; then
+                    echo "[TUNNEL][$(date -u '+%H:%M:%S')] Reconnected: bore.pub:${_new_port}" >> "${BORE_LOG}"
+                    echo "bore.pub:${_new_port}" > /data/logs/tunnel-url.txt
                 fi
             fi
         done
     ) &
 else
-    echo "[TUNNEL] WARNING: Could not establish tunnel via serveo.net."
-    echo "[TUNNEL] serveo.net may be temporarily down."
-    echo "[TUNNEL] Check ${SERVEO_LOG} for details."
-    echo "[TUNNEL] Terminal at /terminal still works without it."
+    echo "[TUNNEL] FAILED — bore could not connect to bore.pub"
+    echo "[TUNNEL] Bore output:"
+    cat "${BORE_LOG}" 2>/dev/null | sed 's/^/[TUNNEL]   /'
+    echo "[TUNNEL] Terminal at /terminal still works."
+    echo "[TUNNEL] ============================================"
 fi
-echo "[TUNNEL] ============================================"
 
 # ─── Start DB self-healing daemon ────────────────────────────────────
 echo "[CLEANER] Starting self-healing daemon..."