fabric-vpn

name	fabric-vpn
description	Set up Tailscale mesh VPN and SSH tunnels for secure access to FABRIC nodes
allowed-tools	["Read","Grep","Glob","Write","Edit","Bash"]

Instructions

When invoked, generate code for VPN and tunneling on FABRIC. Two main capabilities:

1. Tailscale — Zero-trust mesh VPN for direct access to FABRIC nodes from your laptop
2. SSH Tunnels — Port forwarding through FABRIC's bastion host for accessing services

Help the user choose the right approach and generate complete setup code.

Patterns

Tailscale Mesh VPN

from fabrictestbed_extensions.fablib.fablib import FablibManager

fablib = FablibManager()

slice = fablib.new_slice(name="tailscale-experiment")

node1 = slice.add_node(name="node1", site="TACC", cores=4, ram=16, disk=50)
node1.add_fabnet()

node2 = slice.add_node(name="node2", site="UCSD", cores=4, ram=16, disk=50)
node2.add_fabnet()

slice.submit()

# Tailscale auth key from https://login.tailscale.com/admin/settings/keys
ts_key = "tskey-auth-XXXXXXXX"

# Install and start Tailscale on all nodes
for node in slice.get_nodes():
    node.execute(
        f"curl -fsSL https://tailscale.com/install.sh | sh && "
        f"sudo tailscale up --authkey {ts_key}"
    )

# Verify Tailscale status
for node in slice.get_nodes():
    stdout, _ = node.execute("tailscale status")
    print(f"{node.get_name()}:\n{stdout}")

# Access services directly from your laptop via Tailscale hostname
# Example: Start a file browser on node1
node1 = slice.get_node(name="node1")
node1.execute(
    "docker run -d --name filebrowser -p 8989:8989 "
    f"-v /home/{node1.get_username()}:/data "
    "-e FB_ROOT=/data -e FB_PORT=8989 -e FB_NOAUTH=noauth "
    "filebrowser/filebrowser"
)

# From your laptop (connected to same Tailscale network):
# http://node1:8989

# IMPORTANT: Logout before deleting slice
for node in slice.get_nodes():
    node.execute("sudo tailscale logout")

slice.delete()

SSH Tunnels for Service Access

slice = fablib.new_slice(name="tunnel-experiment")

node = slice.add_node(
    name="service-node",
    site=fablib.get_random_site(),
    cores=4,
    ram=16,
    disk=100,
    image="docker_rocky_8",
)

# Enable Docker
node.add_post_boot_upload_directory('node_tools', '.')
node.add_post_boot_execute('node_tools/enable_docker.sh {{ _self_.image }}')

slice.submit()

# Start a service bound to localhost
node = slice.get_node(name="service-node")
node.execute(
    "docker run -d --name filebrowser -p 127.0.0.1:5555:5555 "
    f"-v /home/{node.get_username()}/data:/data "
    "-e FB_BASEURL=/filebrowser -e FB_ROOT=/data "
    "-e FB_PORT=5555 -e FB_NOAUTH=noauth "
    "filebrowser/filebrowser"
)

# Generate SSH tunnel config
fablib.create_ssh_tunnel_config(overwrite=True)

# Print tunnel command
import os

local_port = "5555"
target_host = f"{node.get_username()}@{node.get_management_ip()}"
key_file = os.path.basename(fablib.get_default_slice_public_key_file())[:-4]

print(
    f"ssh -L 127.0.0.1:{local_port}:127.0.0.1:{local_port} "
    f"-i {key_file} -F ssh_config {target_host}"
)
print(f"\nThen browse: http://127.0.0.1:{local_port}/filebrowser")

SSH Tunnel to Jupyter/Grafana

# For any web service running on a FABRIC node:
node = slice.get_node(name="monitor-node")

# Get management IP for tunnel
mgmt_ip = node.get_management_ip()
username = node.get_username()

# Generic tunnel pattern
service_port = "3000"  # e.g., Grafana
print(f"Run on your laptop:")
print(
    f"ssh -L 127.0.0.1:{service_port}:127.0.0.1:{service_port} "
    f"-i <slice_key> -F ssh_config {username}@{mgmt_ip}"
)
print(f"Then browse: http://127.0.0.1:{service_port}")

Multiple Tunnels

# Forward multiple ports in a single SSH command
ports = {"Grafana": 3000, "Prometheus": 9090, "App": 8080}

tunnel_flags = " ".join(
    f"-L 127.0.0.1:{port}:127.0.0.1:{port}" for port in ports.values()
)

print(f"ssh {tunnel_flags} -i <key> -F ssh_config {username}@{mgmt_ip}")

for name, port in ports.items():
    print(f"  {name}: http://127.0.0.1:{port}")

Important Notes

• Tailscale auth key: Generate at https://login.tailscale.com/admin/settings/keys
• Tailscale logout: Always run tailscale logout before deleting slices to clean up devices
• SSH tunnels: Use fablib.create_ssh_tunnel_config() for bastion-aware SSH config
• Bind to localhost: Always bind services to 127.0.0.1 for security, not 0.0.0.0
• ssh_config: Generated config handles FABRIC bastion host automatically