loopy-iri/ratholeengine

RatholeEngine is a set of shell and Python scripts that manage a reverse tunnel system built on two existing tools, rathole and Nginx. It is designed for a specific setup: one server inside Iran, reachable through a single domain, certificate, and port, that connects out to many separate servers located outside the country. Visitors reach the Iran facing server, and their traffic is routed to the right outside server based on the URL path they request, so only one port needs to be exposed on the Iran side while the outside servers expose no public port at all. The project defines three roles. The Iran side panel runs the rathole server and Nginx, and keeps track of every connected outside node. Each outside node runs a matching client program. A separate hub, written in plain Python with no extra dependencies, gives you one central web dashboard that can manage several of these setups over SSH at once, including rolling out updates to every server one at a time. Traffic between the Iran side and an outside node can travel over several different transport methods without changing anything else about how the tunnel is used: a default option that layers the tunnel over a TLS encrypted web socket, a UDP based mode meant for unreliable connections, a lighter unencrypted option, an alternative encrypted transport that skips certificates entirely, and a mode that passes traffic straight through at a lower network layer. Installing it is meant to be a single command that downloads the latest release and starts an installer, which can run fully interactively or be given all the needed settings, such as domain name and certificate paths, up front. Re-running the installer is safe: it detects an existing setup and either resumes a partial install or offers to wipe and start fresh. A command line tool lets you add and list outside nodes, check the overall status of certificates, ports, and services, and run a built in health check. Before any update is applied, the tool takes a full backup of the current configuration and running setup, checks that everything still works afterward, and automatically rolls back to the backup if anything fails, including a broken Nginx configuration. An uninstall command can remove any of the three roles, and it will not touch TLS certificates when doing so.