Node.jsのssh2で踏み台サーバー経由のダブルホップSSHトンネルを構築する（自動再接続付き）

import { Client, ConnectConfig } from "ssh2";

class Remote {
  private jumpTunnel?: Client;
  private remoteTunnel?: Client;

  private async connectJumpServer(): Promise<void> {
    return new Promise((resolve, reject) => {
      const jumpTunnel = new Client();
      jumpTunnel
        .on("ready", () => {
          this.jumpTunnel = jumpTunnel;

          // 切断時のハンドラを登録
          jumpTunnel.on("error", (err) => {
            console.error(`JumpTunnel Error: ${err.message}`);
            this.handleJumpTunnelDisconnection();
          });

          jumpTunnel.on("close", () => {
            console.warn("JumpTunnel Closed");
            this.handleJumpTunnelDisconnection();
          });

          resolve();
        })
        .on("error", (err) => reject(err))
        .connect({
          host: "127.0.0.1",
          port: 2222,              // Pomerium等で転送されたポート
          username: "your-user",
          password: "your-password",
          readyTimeout: 60000,
          keepaliveInterval: 30000,  // 30秒ごとにキープアライブ
          keepaliveCountMax: 3,      // 3回失敗で切断とみなす
        });
    });
  }
}

public async forwardToRemote(): Promise<void> {
  if (!this.jumpTunnel) await this.initJumpTunnel();

  return new Promise((resolve, reject) => {
    if (!this.jumpTunnel) throw new Error("Jump tunnel not initialized");

    this.jumpTunnel.forwardOut(
      "127.0.0.1",     // ソースアドレス（形式上の指定）
      8000,            // ソースポート（形式上の指定）
      "REMOTE_HOST",   // 転送先ホスト
      22,              // 転送先ポート（SSH）
      (err, stream) => {
        if (err) return reject(err);

        // stream を sock として新しい SSH Client を作成
        const remoteTunnel = new Client();
        remoteTunnel
          .on("ready", () => {
            this.remoteTunnel = remoteTunnel;

            // 切断時のハンドラを登録
            remoteTunnel.on("error", (err) => {
              console.error(`RemoteTunnel Error: ${err.message}`);
              this.handleRemoteTunnelDisconnection();
            });

            remoteTunnel.on("close", () => {
              console.warn("RemoteTunnel Closed");
              this.handleRemoteTunnelDisconnection();
            });

            resolve();
          })
          .on("error", (err) => {
            console.error(`RemoteTunnel connect error: ${err}`);
            this.handleRemoteTunnelDisconnection();
          })
          .connect({
            sock: stream,   // ← ここがダブルホップの核心
            username: "your-user",
            password: "your-password",
            readyTimeout: 60000,
          } as ConnectConfig);
      }
    );
  });
}

// ストリーム → TCP → ソケット → SSH という無駄な経路
const server = net.createServer((localSock) => {
  jumpTunnel.forwardOut("127.0.0.1", 0, "REMOTE_HOST", 22, (err, stream) => {
    localSock.pipe(stream).pipe(localSock);
  });
});
server.listen(0);
remoteTunnel.connect({ host: "127.0.0.1", port: server.address().port, ... });

// 結局 sock: stream は必要
jumpTunnel.exec("nc REMOTE_HOST 22", (err, stream) => {
  remoteTunnel.connect({ sock: stream, ... });
});

public async execRemote(
  cmd: string,
  debug: boolean = false
): Promise<string> {
  // 遅延初期化: トンネルがなければ自動的に接続
  if (!this.remoteTunnel) await this.initRemoteTunnel();

  return new Promise((resolve, reject) => {
    if (!this.remoteTunnel) throw new Error("Remote tunnel not initialized");

    this.remoteTunnel.exec(cmd, (err, stream) => {
      if (err) return reject(err);

      let data = "";
      let meta = "";
      stream.on("data", (chunk: Buffer) => (data += chunk.toString()));
      stream.stderr.on("data", (chunk: Buffer) => (meta += chunk.toString()));
      stream.on("end", () => {
        if (debug) console.log(meta);
        resolve(data);
      });
    });
  });
}

// Jumpサーバーでのコマンド実行も同じパターン
public async execJump(cmd: string): Promise<string> {
  if (!this.jumpTunnel) await this.initJumpTunnel();

  return new Promise((resolve, reject) => {
    this.jumpTunnel!.exec(cmd, (err, stream) => {
      if (err) return reject(err);
      let data = "";
      stream.on("data", (chunk: Buffer) => (data += chunk.toString()));
      stream.on("end", () => resolve(data));
    });
  });
}

public async getRemoteSftp() {
  if (!this.remoteSFTP) await this.initRemoteSFTP();
  if (!this.remoteSFTP) throw new Error();
  return this.remoteSFTP;
}

private async initRemoteSFTP() {
  if (!this.remoteTunnel) await this.initRemoteTunnel();
  if (!this.remoteTunnel) throw new Error();
  this.remoteSFTP = new SFTP(this.remoteTunnel);
}

private handleJumpTunnelDisconnection() {
  console.warn("Attempting to re-establish JumpTunnel...");
  this.jumpTunnel = undefined;
  this.initJumpTunnel().catch((err) => {
    console.error(`Failed to re-establish JumpTunnel: ${err}`);
  });
}

private handleRemoteTunnelDisconnection() {
  console.warn("Attempting to re-establish RemoteTunnel...");
  this.remoteTunnel = undefined;
  this.initRemoteTunnel().catch((err) => {
    console.error(`Failed to re-establish RemoteTunnel: ${err}`);
  });
}

private async initJumpTunnel() {
  await this.connectJumpServer();
}

private async initRemoteTunnel() {
  await this.forwardToRemote();  // 内部で initJumpTunnel() を呼ぶ
}

execRemote() / getRemoteSftp() 呼び出し
    └─ remoteTunnel? → initRemoteTunnel()
         └─ jumpTunnel? → initJumpTunnel()
              └─ connectJumpServer()
                   └─ forwardToRemote()

.connect({
  // ...
  keepaliveInterval: 30000,  // 30秒ごとにキープアライブ
  keepaliveCountMax: 3,      // 3回失敗で切断とみなす
});