feat(zhulan): add restricted remote development cell

server-tools/zhulan-remote-cell/deploy/prepare-tunnel-identity.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "$(id -u)" -ne 0 ]]; then
+  echo "INSTALL_REQUIRES_ROOT" >&2
+  exit 1
+fi
+
+EXPECTED_HOST="${ZHULAN_EXPECTED_HOST:-VM-12-12-ubuntu}"
+EXPECTED_DMI="${ZHULAN_EXPECTED_DMI:-7a500f2d-9aed-4b93-b3b8-59c87c65d031}"
+ACTUAL_HOST="$(hostname)"
+ACTUAL_DMI="$(tr '[:upper:]' '[:lower:]' </sys/class/dmi/id/product_uuid)"
+if [[ "$ACTUAL_HOST" != "$EXPECTED_HOST" || "$ACTUAL_DMI" != "$EXPECTED_DMI" ]]; then
+  echo "TARGET_IDENTITY_MISMATCH" >&2
+  exit 1
+fi
+
+CONFIG_ROOT="/etc/guanghu/zhulan-front-tunnel"
+KEY_FILE="$CONFIG_ROOT/id_ed25519"
+
+getent passwd zhulan-tunnel >/dev/null || {
+  echo "TUNNEL_USER_MUST_BE_PRECREATED" >&2
+  exit 1
+}
+install -d -o root -g zhulan-tunnel -m 0750 "$CONFIG_ROOT"
+install -d -o zhulan-tunnel -g zhulan-tunnel -m 0700 /var/lib/guanghu/zhulan-front-tunnel
+
+if [[ ! -f "$KEY_FILE" ]]; then
+  ssh-keygen -q -t ed25519 -N '' -C 'zhulan-sg003-to-gz006-loopback-only' -f "$KEY_FILE"
+fi
+chown root:zhulan-tunnel "$KEY_FILE" "$KEY_FILE.pub"
+chmod 0640 "$KEY_FILE"
+chmod 0644 "$KEY_FILE.pub"
+
+ssh-keygen -lf "$KEY_FILE.pub"
+echo "TUNNEL_PUBLIC_KEY_FILE=$KEY_FILE.pub"