godcrm/deploy/printer

3D Printer reverse-tunnel — recovery after server migration

The CRM reaches the printer's Moonraker API at http://localhost:7125 (backend/services/agent-tools/printer-tools.js). That port is fed by a reverse SSH tunnel initiated from the MKS Pi — the printer dials out to the CRM box and forwards its local Moonraker. The CRM box cannot reach the printer directly, so the tunnel always starts on the printer side.

Slicing uses the prusa-slicer CLI on the CRM box (profile: backend/services/agent-tools/printer/slicer-profile.ini).

What broke

The CRM migrated to v881099.hosted-by-vdsina.com / <PROD_IP>. The MKS Pi's autossh still dials the old (dead) address, so 7125 is empty and every printer_* MCP tool returns fetch failed.

Server side — DONE (this box)

• prusa-slicer 2.7.2 installed; headless slice verified against our profile.
• Locked-down ingress user printer created. Its authorized_keys is restricted to reverse-forward of localhost:7125 only — no shell, no other ports (restrict,port-forwarding,permitlisten="localhost:7125",command=...).
• Keypair mkspi_tunnel generated at /home/printer/.ssh/. Validated end-to-end with a stub Moonraker.

Printer side — TODO (run on the MKS Pi)

1. Install autossh: sudo apt-get install -y autossh
2. Drop the private key (provided separately — never committed) at /home/pi/.ssh/mkspi_tunnel, chmod 600.
3. Install the unit and start it:

   sudo cp moonraker-tunnel.service /etc/systemd/system/
   sudo systemctl daemon-reload
   sudo systemctl enable --now moonraker-tunnel
   

4. If the MKS Pi user is not pi, edit User= and the key path in the unit.

Verify (on the CRM box, after the printer is up)

ss -tlnp | grep 7125                       # tunnel bound
curl -s http://localhost:7125/printer/info # Moonraker answers

Then printer_status MCP tool should return live state.

Future migrations

Change ONLY the IP in moonraker-tunnel.service ExecStart and restart the unit on the MKS Pi. Server-side ingress + slicer survive untouched.