GWR Viewer Setup — Runnable

Runnable version of delayrepay/viewer-setup. Run this ON the machine you want to view from (Mac / pomelo) — the cells shell out locally. Needs: stunnel, openssl, curl, SSH access to kelp, and WebDAV auth (~/.netrc for webdav.critchley.biz, or set WEBDAV_USER/WEBDAV_PASS in the first cell).

Setup

Defines the paths + a shell helper. Set your WebDAV creds here if you don't have a ~/.netrc entry.

import subprocess, os
BASE = 'https://webdav.critchley.biz'
DIR  = os.path.expanduser('~/.gwr-viewer')
os.makedirs(DIR, exist_ok=True)
WEBDAV_USER = ''   # leave blank to use ~/.netrc; else set user
WEBDAV_PASS = ''
H = subprocess.run(['hostname','-s'], capture_output=True, text=True).stdout.strip()
CURL_AUTH = f'-u {WEBDAV_USER}:{WEBDAV_PASS}' if WEBDAV_USER else '-n'

def sh(cmd):
    r = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    if r.stdout: print(r.stdout, end='')
    if r.stderr: print(r.stderr, end='')
    return r.returncode

print('hostname =', H)
print('certs dir =', DIR)
print('stunnel installed:', subprocess.run('command -v stunnel', shell=True, capture_output=True).returncode == 0)

Enrol (once per machine)

Generates your key + CSR (CN and SAN = short hostname) if absent, then registers the CSR on kelp. The private key never leaves this machine. Skips generation if the key already exists. Install stunnel first if the setup cell reported it missing (macOS: brew install stunnel; Debian: sudo apt install stunnel4).

key = f'{DIR}/{H}.key'; csr = f'{DIR}/{H}.csr'
if not os.path.exists(key):
    sh(f'openssl req -newkey rsa:2048 -nodes -keyout "{key}" -out "{csr}" '
       f'-subj "/CN={H}" -addext "subjectAltName=DNS:{H}"')
    os.chmod(key, 0o600)
    print('generated key + CSR')
else:
    print('key already exists - skipping generation')
rc = sh(f'scp "{DIR}/{H}.csr" john@kelp.critchley.biz:/home/john/aws/viewer-csrs/')
print('CSR registered on kelp' if rc == 0 else 'scp failed - check SSH access to kelp')

Connect (each time a host is provisioned)

Downloads gwr-view, which fetches your per-host cert + CA from WebDAV, writes an stunnel client config, and starts stunnel on a free local port (prefers 5902). Then open RealVNC Viewer at localhost:5902 (no password — NOT macOS Screen Sharing, which prompts on no-auth servers).

sh(f'curl {CURL_AUTH} -fsS -o "{DIR}/gwr-view" {BASE}/delayrepay/gwr-view && chmod +x "{DIR}/gwr-view"')
env = f'WEBDAV_USER={WEBDAV_USER} WEBDAV_PASS={WEBDAV_PASS} ' if WEBDAV_USER else ''
sh(f'{env}"{DIR}/gwr-view"')
print('\n>>> Now open RealVNC Viewer -> localhost:5902 (no password)')