# Reverse SSH tunnel: MKS Pi (Klipper/Moonraker) -> godcrm server
# Exposes the printer's local Moonraker (127.0.0.1:7125) on the server's
# localhost:7125, where backend/services/agent-tools/printer-tools.js reads it.
#
# Install ON THE MKS Pi (NOT on the CRM server):
#   sudo cp deploy/printer/moonraker-tunnel.service /etc/systemd/system/
#   sudo cp mkspi_tunnel /home/<user>/.ssh/mkspi_tunnel && chmod 600 ...
#   sudo systemctl daemon-reload && sudo systemctl enable --now moonraker-tunnel
#
# Server target = <PROD_HOST> / <PROD_IP> (single box, June 2026).
# If the CRM box migrates again, change ONLY the IP in ExecStart below.

[Unit]
Description=Reverse SSH tunnel to godcrm (Moonraker 7125)
After=network-online.target
Wants=network-online.target

[Service]
User=pi
Environment=AUTOSSH_GATETIME=0
ExecStart=/usr/bin/autossh -M 0 -N \
  -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" \
  -o "ExitOnForwardFailure yes" -o "StrictHostKeyChecking accept-new" \
  -i /home/pi/.ssh/mkspi_tunnel \
  -R 7125:localhost:7125 \
  printer@<PROD_IP>
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target