mirror of
https://github.com/linuxserver/docker-swag.git
synced 2026-02-09 14:34:14 +09:00
Use standard nginx.conf from lsio alpine nginx base image
This commit is contained in:
Eric Nemchik
@@ -1,52 +0,0 @@
|
||||
## Version 2021/05/28 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/authelia-server.conf
|
||||
# Make sure that your authelia container is in the same user defined bridge network and is named authelia
|
||||
|
||||
location ^~ /authelia {
|
||||
include /config/nginx/proxy.conf;
|
||||
include /config/nginx/resolver.conf;
|
||||
set $upstream_authelia authelia;
|
||||
proxy_pass http://$upstream_authelia:9091;
|
||||
}
|
||||
|
||||
location = /authelia/api/verify {
|
||||
internal;
|
||||
if ($request_uri ~ [^a-zA-Z0-9_+-=\!@$%&*?~.:#'\;\(\)\[\]]) {
|
||||
return 401;
|
||||
}
|
||||
include /config/nginx/resolver.conf;
|
||||
set $upstream_authelia authelia;
|
||||
proxy_pass_request_body off;
|
||||
proxy_pass http://$upstream_authelia:9091;
|
||||
proxy_set_header Content-Length "";
|
||||
|
||||
# Timeout if the real server is dead
|
||||
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
|
||||
|
||||
# [REQUIRED] Needed by Authelia to check authorizations of the resource.
|
||||
# Provide either X-Original-URL and X-Forwarded-Proto or
|
||||
# X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Uri or both.
|
||||
# Those headers will be used by Authelia to deduce the target url of the user.
|
||||
# Basic Proxy Config
|
||||
client_body_buffer_size 128k;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Forwarded-Method $request_method;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host $http_host;
|
||||
proxy_set_header X-Forwarded-Uri $request_uri;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
proxy_redirect http:// $scheme://;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
proxy_cache_bypass $cookie_session;
|
||||
proxy_no_cache $cookie_session;
|
||||
proxy_buffers 4 32k;
|
||||
|
||||
# Advanced Proxy Config
|
||||
send_timeout 5m;
|
||||
proxy_read_timeout 240;
|
||||
proxy_send_timeout 240;
|
||||
proxy_connect_timeout 240;
|
||||
}
|
||||
@@ -1,160 +0,0 @@
|
||||
## Version 2021/04/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/default
|
||||
|
||||
error_page 502 /502.html;
|
||||
|
||||
# redirect all traffic to https
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
server_name _;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
# main server block
|
||||
server {
|
||||
listen 443 ssl http2 default_server;
|
||||
listen [::]:443 ssl http2 default_server;
|
||||
|
||||
root /config/www;
|
||||
index index.html index.htm index.php;
|
||||
|
||||
server_name _;
|
||||
|
||||
# enable subfolder method reverse proxy confs
|
||||
include /config/nginx/proxy-confs/*.subfolder.conf;
|
||||
|
||||
# all ssl related config moved to ssl.conf
|
||||
include /config/nginx/ssl.conf;
|
||||
|
||||
# enable for ldap auth
|
||||
#include /config/nginx/ldap.conf;
|
||||
|
||||
# enable for Authelia
|
||||
#include /config/nginx/authelia-server.conf;
|
||||
|
||||
client_max_body_size 0;
|
||||
|
||||
location / {
|
||||
# enable the next two lines for http auth
|
||||
#auth_basic "Restricted";
|
||||
#auth_basic_user_file /config/nginx/.htpasswd;
|
||||
|
||||
# enable the next two lines for ldap auth
|
||||
#auth_request /auth;
|
||||
#error_page 401 =200 /ldaplogin;
|
||||
|
||||
# enable for Authelia
|
||||
#include /config/nginx/authelia-location.conf;
|
||||
|
||||
try_files $uri $uri/ /index.html /index.php?$args =404;
|
||||
}
|
||||
|
||||
location ~ \.php$ {
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
fastcgi_index index.php;
|
||||
include /etc/nginx/fastcgi_params;
|
||||
}
|
||||
|
||||
# sample reverse proxy config for password protected couchpotato running at IP 192.168.1.50 port 5050 with base url "cp"
|
||||
# notice this is within the same server block as the base
|
||||
# don't forget to generate the .htpasswd file as described on docker hub
|
||||
# location ^~ /cp {
|
||||
# auth_basic "Restricted";
|
||||
# auth_basic_user_file /config/nginx/.htpasswd;
|
||||
# include /config/nginx/proxy.conf;
|
||||
# proxy_pass http://192.168.1.50:5050/cp;
|
||||
# }
|
||||
|
||||
}
|
||||
|
||||
# sample reverse proxy config without url base, but as a subdomain "cp", ip and port same as above
|
||||
# notice this is a new server block, you need a new server block for each subdomain
|
||||
#server {
|
||||
# listen 443 ssl http2;
|
||||
# listen [::]:443 ssl http2;
|
||||
#
|
||||
# root /config/www;
|
||||
# index index.html index.htm index.php;
|
||||
#
|
||||
# server_name cp.*;
|
||||
#
|
||||
# include /config/nginx/ssl.conf;
|
||||
#
|
||||
# client_max_body_size 0;
|
||||
#
|
||||
# location / {
|
||||
# auth_basic "Restricted";
|
||||
# auth_basic_user_file /config/nginx/.htpasswd;
|
||||
# include /config/nginx/proxy.conf;
|
||||
# proxy_pass http://192.168.1.50:5050;
|
||||
# }
|
||||
#}
|
||||
|
||||
# sample reverse proxy config for "heimdall" via subdomain, with ldap authentication
|
||||
# ldap-auth container has to be running and the /config/nginx/ldap.conf file should be filled with ldap info
|
||||
# notice this is a new server block, you need a new server block for each subdomain
|
||||
#server {
|
||||
# listen 443 ssl http2;
|
||||
# listen [::]:443 ssl http2;
|
||||
#
|
||||
# root /config/www;
|
||||
# index index.html index.htm index.php;
|
||||
#
|
||||
# server_name heimdall.*;
|
||||
#
|
||||
# include /config/nginx/ssl.conf;
|
||||
#
|
||||
# include /config/nginx/ldap.conf;
|
||||
#
|
||||
# client_max_body_size 0;
|
||||
#
|
||||
# location / {
|
||||
# # the next two lines will enable ldap auth along with the included ldap.conf in the server block
|
||||
# auth_request /auth;
|
||||
# error_page 401 =200 /ldaplogin;
|
||||
#
|
||||
# include /config/nginx/proxy.conf;
|
||||
# resolver 127.0.0.11 valid=30s;
|
||||
# set $upstream_app heimdall;
|
||||
# set $upstream_port 443;
|
||||
# set $upstream_proto https;
|
||||
# proxy_pass $upstream_proto://$upstream_app:$upstream_port;
|
||||
# }
|
||||
#}
|
||||
|
||||
# sample reverse proxy config for "heimdall" via subdomain, with Authelia
|
||||
# Authelia container has to be running in the same user defined bridge network, with container name "authelia", and with 'path: "authelia"' set in its configuration.yml
|
||||
# notice this is a new server block, you need a new server block for each subdomain
|
||||
#server {
|
||||
# listen 443 ssl http2;
|
||||
# listen [::]:443 ssl http2;
|
||||
#
|
||||
# root /config/www;
|
||||
# index index.html index.htm index.php;
|
||||
#
|
||||
# server_name heimdall.*;
|
||||
#
|
||||
# include /config/nginx/ssl.conf;
|
||||
#
|
||||
# include /config/nginx/authelia-server.conf;
|
||||
#
|
||||
# client_max_body_size 0;
|
||||
#
|
||||
# location / {
|
||||
# # the next line will enable Authelia along with the included authelia-server.conf in the server block
|
||||
# include /config/nginx/authelia-location.conf;
|
||||
#
|
||||
# include /config/nginx/proxy.conf;
|
||||
# resolver 127.0.0.11 valid=30s;
|
||||
# set $upstream_app heimdall;
|
||||
# set $upstream_port 443;
|
||||
# set $upstream_proto https;
|
||||
# proxy_pass $upstream_proto://$upstream_app:$upstream_port;
|
||||
# }
|
||||
#}
|
||||
|
||||
# enable subdomain method reverse proxy confs
|
||||
include /config/nginx/proxy-confs/*.subdomain.conf;
|
||||
# enable proxy cache for auth
|
||||
proxy_cache_path cache/ keys_zone=auth_cache:10m;
|
||||
@@ -1,13 +0,0 @@
|
||||
-----BEGIN DH PARAMETERS-----
|
||||
MIICCAKCAgEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
|
||||
+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
|
||||
87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
|
||||
YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
|
||||
7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
|
||||
ssbzSibBsu/6iGtCOGEfz9zeNVs7ZRkDW7w09N75nAI4YbRvydbmyQd62R0mkff3
|
||||
7lmMsPrBhtkcrv4TCYUTknC0EwyTvEN5RPT9RFLi103TZPLiHnH1S/9croKrnJ32
|
||||
nuhtK8UiNjoNq8Uhl5sN6todv5pC1cRITgq80Gv6U93vPBsg7j/VnXwl5B0rZp4e
|
||||
8W5vUsMWTfT7eTDp5OWIV7asfV9C1p9tGHdjzx1VA0AEh/VbpX4xzHpxNciG77Qx
|
||||
iu1qHgEtnmgyqQdgCpGBMMRtx3j5ca0AOAkpmaMzy4t6Gh25PXFAADwqTs6p+Y0K
|
||||
zAqCkc3OyX3Pjsm1Wn+IpGtNtahR9EGC4caKAH5eZV9q//////////8CAQI=
|
||||
-----END DH PARAMETERS-----
|
||||
@@ -1,4 +1,4 @@
|
||||
# Instructions: https://pypi.org/project/certbot-dns-desec/
|
||||
# Replace with your Desec V1 API Token
|
||||
dns_desec_token=YOUR_TOKEN_HERE
|
||||
dns_desec_endpoint=https://desec.io/api/v1/
|
||||
dns_desec_endpoint=https://desec.io/api/v1/
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
# Instructions: https://github.com/bikram990/certbot-dns-dynu#configuration
|
||||
# Replace with your API token from your dynu account.
|
||||
dns_dynu_auth_token = AbCbASsd!@34
|
||||
dns_dynu_auth_token = AbCbASsd!@34
|
||||
|
||||
@@ -2,4 +2,4 @@
|
||||
# Replace with your values
|
||||
dns_ionos_prefix = myapikeyprefix
|
||||
dns_ionos_secret = verysecureapikeysecret
|
||||
dns_ionos_endpoint = https://api.hosting.ionos.com
|
||||
dns_ionos_endpoint = https://api.hosting.ionos.com
|
||||
|
||||
@@ -2,6 +2,6 @@
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = ^(?!.*?(?i)plex)<HOST>.*"(GET|POST|HEAD).*" 401 .*$
|
||||
failregex = ^<HOST>.*"(GET|POST|HEAD).*" (401) .*$
|
||||
|
||||
ignoreregex =
|
||||
ignoreregex = .*(?i)plex.*
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
## Version 2022/01/09 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/jail.local
|
||||
## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/fail2ban/jail.local
|
||||
# This is the custom version of the jail.conf for fail2ban
|
||||
# Feel free to modify this and add additional filters
|
||||
# Then you can drop the new filter conf files into the fail2ban-filters
|
||||
@@ -56,4 +56,4 @@ logpath = /config/log/nginx/error.log
|
||||
enabled = true
|
||||
port = http,https
|
||||
filter = nginx-unauthorized
|
||||
logpath = /config/log/nginx/unauthorized.log
|
||||
logpath = /config/log/nginx/access.log
|
||||
@@ -1,92 +0,0 @@
|
||||
## Version 2020/06/02 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/ldap.conf
|
||||
## this conf is meant to be used in conjunction with our ldap-auth image: https://github.com/linuxserver/docker-ldap-auth
|
||||
## see the heimdall example in the default site config for info on enabling ldap auth
|
||||
## for further instructions on this conf, see https://github.com/nginxinc/nginx-ldap-auth
|
||||
|
||||
location /ldaplogin {
|
||||
resolver 127.0.0.11 valid=30s;
|
||||
set $upstream_auth_app ldap-auth;
|
||||
set $upstream_auth_port 9000;
|
||||
set $upstream_auth_proto http;
|
||||
proxy_pass $upstream_auth_proto://$upstream_auth_app:$upstream_auth_port;
|
||||
proxy_set_header X-Target $request_uri;
|
||||
}
|
||||
|
||||
location = /auth {
|
||||
resolver 127.0.0.11 valid=30s;
|
||||
set $upstream_auth_app ldap-auth;
|
||||
set $upstream_auth_port 8888;
|
||||
set $upstream_auth_proto http;
|
||||
proxy_pass $upstream_auth_proto://$upstream_auth_app:$upstream_auth_port;
|
||||
|
||||
proxy_pass_request_body off;
|
||||
proxy_set_header Content-Length "";
|
||||
|
||||
#Before enabling the below caching options, make sure you have the line "proxy_cache_path cache/ keys_zone=auth_cache:10m;" at the bottom your default site config
|
||||
#proxy_cache auth_cache;
|
||||
#proxy_cache_valid 200 10m;
|
||||
#proxy_cache_key "$http_authorization$cookie_nginxauth";
|
||||
|
||||
# As implemented in nginx-ldap-auth-daemon.py, the ldap-auth daemon
|
||||
# communicates with a LDAP server, passing in the following
|
||||
# parameters to specify which user account to authenticate. To
|
||||
# eliminate the need to modify the Python code, this file contains
|
||||
# 'proxy_set_header' directives that set the values of the
|
||||
# parameters. Set or change them as instructed in the comments.
|
||||
#
|
||||
# Parameter Proxy header
|
||||
# ----------- ----------------
|
||||
# url X-Ldap-URL
|
||||
# starttls X-Ldap-Starttls
|
||||
# basedn X-Ldap-BaseDN
|
||||
# binddn X-Ldap-BindDN
|
||||
# bindpasswd X-Ldap-BindPass
|
||||
# cookiename X-CookieName
|
||||
# realm X-Ldap-Realm
|
||||
# template X-Ldap-Template
|
||||
|
||||
# (Required) Set the URL and port for connecting to the LDAP server,
|
||||
# by replacing 'example.com'.
|
||||
# Do not mix ldaps-style URL and X-Ldap-Starttls as it will not work.
|
||||
proxy_set_header X-Ldap-URL "ldap://example.com";
|
||||
|
||||
# (Optional) Establish a TLS-enabled LDAP session after binding to the
|
||||
# LDAP server.
|
||||
# This is the 'proper' way to establish encrypted TLS connections, see
|
||||
# http://www.openldap.org/faq/data/cache/185.html
|
||||
#proxy_set_header X-Ldap-Starttls "true";
|
||||
|
||||
# (Required) Set the Base DN, by replacing the value enclosed in
|
||||
# double quotes.
|
||||
proxy_set_header X-Ldap-BaseDN "cn=Users,dc=test,dc=local";
|
||||
|
||||
# (Required) Set the Bind DN, by replacing the value enclosed in
|
||||
# double quotes.
|
||||
# If AD, use "root@test.local"
|
||||
proxy_set_header X-Ldap-BindDN "cn=root,dc=test,dc=local";
|
||||
|
||||
# (Required) Set the Bind password, by replacing 'secret'.
|
||||
proxy_set_header X-Ldap-BindPass "secret";
|
||||
|
||||
# (Required) The following directives set the cookie name and pass
|
||||
# it, respectively. They are required for cookie-based
|
||||
# authentication. Comment them out if using HTTP basic
|
||||
# authentication.
|
||||
proxy_set_header X-CookieName "nginxauth";
|
||||
proxy_set_header Cookie nginxauth=$cookie_nginxauth;
|
||||
|
||||
# (Required if using Microsoft Active Directory as the LDAP server)
|
||||
# Set the LDAP template by uncommenting the following directive.
|
||||
#proxy_set_header X-Ldap-Template "(sAMAccountName=%(username)s)";
|
||||
|
||||
# (Optional if using OpenLDAP as the LDAP server) Set the LDAP
|
||||
# template by uncommenting the following directive and replacing
|
||||
# '(cn=%(username)s)' which is the default set in
|
||||
# nginx-ldap-auth-daemon.py.
|
||||
#proxy_set_header X-Ldap-Template "(cn=%(username)s)";
|
||||
|
||||
# (Optional) Set the realm name, by uncommenting the following
|
||||
# directive and replacing 'Restricted' which is the default set
|
||||
# in nginx-ldap-auth-daemon.py.
|
||||
#proxy_set_header X-Ldap-Realm "Restricted";
|
||||
}
|
||||
@@ -1,149 +0,0 @@
|
||||
## Version 2022/01/09 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx.conf
|
||||
|
||||
user abc;
|
||||
|
||||
# Set number of worker processes automatically based on number of CPU cores.
|
||||
include /config/nginx/worker_processes.conf;
|
||||
|
||||
# Enables the use of JIT for regular expressions to speed-up their processing.
|
||||
pcre_jit on;
|
||||
|
||||
# Configures default error logger.
|
||||
error_log /config/log/nginx/error.log;
|
||||
|
||||
# Includes files with directives to load dynamic modules.
|
||||
include /etc/nginx/modules/*.conf;
|
||||
|
||||
events {
|
||||
# The maximum number of simultaneous connections that can be opened by
|
||||
# a worker process.
|
||||
worker_connections 1024;
|
||||
# multi_accept on;
|
||||
}
|
||||
|
||||
http {
|
||||
# Includes mapping of file name extensions to MIME types of responses
|
||||
# and defines the default type.
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
# Name servers used to resolve names of upstream servers into addresses.
|
||||
# It's also needed when using tcpsocket and udpsocket in Lua modules.
|
||||
#resolver 1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001;
|
||||
include /config/nginx/resolver.conf;
|
||||
|
||||
# Don't tell nginx version to the clients. Default is 'on'.
|
||||
server_tokens off;
|
||||
|
||||
# Specifies the maximum accepted body size of a client request, as
|
||||
# indicated by the request header Content-Length. If the stated content
|
||||
# length is greater than this size, then the client receives the HTTP
|
||||
# error code 413. Set to 0 to disable. Default is '1m'.
|
||||
client_max_body_size 0;
|
||||
|
||||
# Sendfile copies data between one FD and other from within the kernel,
|
||||
# which is more efficient than read() + write(). Default is off.
|
||||
sendfile on;
|
||||
|
||||
# Causes nginx to attempt to send its HTTP response head in one packet,
|
||||
# instead of using partial frames. Default is 'off'.
|
||||
tcp_nopush on;
|
||||
|
||||
# Helper variable for proxying websockets.
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
# Saves unauthorized log messages to a separate log file
|
||||
map $status $unauthorized {
|
||||
default 0;
|
||||
~^401 1;
|
||||
}
|
||||
access_log /config/log/nginx/unauthorized.log combined if=$unauthorized;
|
||||
|
||||
# Sets the path, format, and configuration for a buffered log write.
|
||||
access_log /config/log/nginx/access.log;
|
||||
|
||||
# Includes virtual hosts configs.
|
||||
#include /etc/nginx/http.d/*.conf;
|
||||
|
||||
# WARNING: Don't use this directory for virtual hosts anymore.
|
||||
# This include will be moved to the root context in Alpine 3.14.
|
||||
#include /etc/nginx/conf.d/*.conf;
|
||||
|
||||
|
||||
##
|
||||
# Basic Settings
|
||||
##
|
||||
|
||||
client_body_buffer_size 128k;
|
||||
keepalive_timeout 65;
|
||||
large_client_header_buffers 4 16k;
|
||||
send_timeout 5m;
|
||||
tcp_nodelay on;
|
||||
types_hash_max_size 2048;
|
||||
variables_hash_max_size 2048;
|
||||
# server_names_hash_bucket_size 64;
|
||||
# server_name_in_redirect off;
|
||||
|
||||
##
|
||||
# Gzip Settings
|
||||
##
|
||||
|
||||
gzip on;
|
||||
gzip_disable "msie6";
|
||||
# gzip_vary on;
|
||||
# gzip_proxied any;
|
||||
# gzip_comp_level 6;
|
||||
# gzip_buffers 16 8k;
|
||||
# gzip_http_version 1.1;
|
||||
# gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
|
||||
|
||||
##
|
||||
# nginx-naxsi config
|
||||
##
|
||||
# Uncomment it if you installed nginx-naxsi
|
||||
##
|
||||
|
||||
#include /etc/nginx/naxsi_core.rules;
|
||||
|
||||
##
|
||||
# nginx-passenger config
|
||||
##
|
||||
# Uncomment it if you installed nginx-passenger
|
||||
##
|
||||
|
||||
#passenger_root /usr;
|
||||
#passenger_ruby /usr/bin/ruby;
|
||||
|
||||
##
|
||||
# Virtual Host Configs
|
||||
##
|
||||
include /config/nginx/site-confs/*;
|
||||
#Removed lua. Do not remove this comment
|
||||
}
|
||||
|
||||
#mail {
|
||||
# # See sample authentication script at:
|
||||
# # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
|
||||
#
|
||||
# # auth_http localhost/auth.php;
|
||||
# # pop3_capabilities "TOP" "USER";
|
||||
# # imap_capabilities "IMAP4rev1" "UIDPLUS";
|
||||
#
|
||||
# server {
|
||||
# listen localhost:110;
|
||||
# protocol pop3;
|
||||
# proxy on;
|
||||
# }
|
||||
#
|
||||
# server {
|
||||
# listen localhost:143;
|
||||
# protocol imap;
|
||||
# proxy on;
|
||||
# }
|
||||
#}
|
||||
|
||||
daemon off;
|
||||
pid /run/nginx.pid;
|
||||
@@ -1,4 +1,4 @@
|
||||
## Version 2021/04/21 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/authelia-location.conf
|
||||
## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-location.conf.sample
|
||||
# Make sure that your authelia container is in the same user defined bridge network and is named authelia
|
||||
# Make sure that the authelia configuration.yml has 'path: "authelia"' defined
|
||||
|
||||
31
root/defaults/nginx/authelia-server.conf.sample
Normal file
31
root/defaults/nginx/authelia-server.conf.sample
Normal file
@@ -0,0 +1,31 @@
|
||||
## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-server.conf.sample
|
||||
# Make sure that your authelia container is in the same user defined bridge network and is named authelia
|
||||
|
||||
location ^~ /authelia {
|
||||
|
||||
set $upstream_app authelia;
|
||||
set $upstream_port 9091;
|
||||
set $upstream_proto http;
|
||||
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
|
||||
}
|
||||
|
||||
location = /authelia/api/verify {
|
||||
internal;
|
||||
if ($request_uri ~ [^a-zA-Z0-9_+-=\!@$%&*?~.:#'\;\(\)\[\]]) {
|
||||
return 401;
|
||||
}
|
||||
|
||||
set $upstream_app authelia;
|
||||
set $upstream_port 9091;
|
||||
set $upstream_proto http;
|
||||
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
|
||||
|
||||
# Timeout if the real server is dead
|
||||
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
|
||||
|
||||
client_body_buffer_size 128k;
|
||||
proxy_buffers 4 32k;
|
||||
proxy_pass_request_body off;
|
||||
proxy_set_header Content-Length "";
|
||||
send_timeout 5m;
|
||||
}
|
||||
6
root/defaults/nginx/error_pages.conf.sample
Normal file
6
root/defaults/nginx/error_pages.conf.sample
Normal file
@@ -0,0 +1,6 @@
|
||||
## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/error_pages.conf.sample
|
||||
|
||||
error_page 502 = @lsio_error_502;
|
||||
location @lsio_error_502 {
|
||||
alias /config/www/502.html;
|
||||
}
|
||||
4
root/defaults/nginx/ldap-location.conf.sample
Normal file
4
root/defaults/nginx/ldap-location.conf.sample
Normal file
@@ -0,0 +1,4 @@
|
||||
## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/ldap-location.conf.sample
|
||||
|
||||
auth_request /auth;
|
||||
error_page 401 =200 /ldaplogin;
|
||||
90
root/defaults/nginx/ldap-server.conf.sample
Normal file
90
root/defaults/nginx/ldap-server.conf.sample
Normal file
@@ -0,0 +1,90 @@
|
||||
## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/ldap-server.conf.sample
|
||||
## this conf is meant to be used in conjunction with our ldap-auth image: https://github.com/linuxserver/docker-ldap-auth
|
||||
## see the heimdall example in the default site config for info on enabling ldap auth
|
||||
## for further instructions on this conf, see https://github.com/nginxinc/nginx-ldap-auth
|
||||
|
||||
location /ldaplogin {
|
||||
|
||||
set $upstream_auth_app ldap-auth;
|
||||
set $upstream_auth_port 9000;
|
||||
set $upstream_auth_proto http;
|
||||
proxy_pass $upstream_auth_proto://$upstream_auth_app:$upstream_auth_port;
|
||||
proxy_set_header X-Target $request_uri;
|
||||
}
|
||||
|
||||
location = /auth {
|
||||
|
||||
set $upstream_auth_app ldap-auth;
|
||||
set $upstream_auth_port 8888;
|
||||
set $upstream_auth_proto http;
|
||||
proxy_pass $upstream_auth_proto://$upstream_auth_app:$upstream_auth_port;
|
||||
|
||||
proxy_pass_request_body off;
|
||||
proxy_set_header Content-Length "";
|
||||
|
||||
#Before enabling the below caching options, make sure you have the line "proxy_cache_path cache/ keys_zone=auth_cache:10m;" at the bottom your default site config
|
||||
#proxy_cache auth_cache;
|
||||
#proxy_cache_valid 200 10m;
|
||||
#proxy_cache_key "$http_authorization$cookie_nginxauth";
|
||||
|
||||
# As implemented in nginx-ldap-auth-daemon.py, the ldap-auth daemon
|
||||
# communicates with a LDAP server, passing in the following
|
||||
# parameters to specify which user account to authenticate. To
|
||||
# eliminate the need to modify the Python code, this file contains
|
||||
# 'proxy_set_header' directives that set the values of the
|
||||
# parameters. Set or change them as instructed in the comments.
|
||||
#
|
||||
# Parameter Proxy header
|
||||
# ----------- ----------------
|
||||
# url X-Ldap-URL
|
||||
# starttls X-Ldap-Starttls
|
||||
# basedn X-Ldap-BaseDN
|
||||
# binddn X-Ldap-BindDN
|
||||
# bindpasswd X-Ldap-BindPass
|
||||
# cookiename X-CookieName
|
||||
# realm X-Ldap-Realm
|
||||
# template X-Ldap-Template
|
||||
# (Required) Set the URL and port for connecting to the LDAP server,
|
||||
# by replacing 'example.com'.
|
||||
# Do not mix ldaps-style URL and X-Ldap-Starttls as it will not work.
|
||||
proxy_set_header X-Ldap-URL "ldap://example.com";
|
||||
|
||||
# (Optional) Establish a TLS-enabled LDAP session after binding to the
|
||||
# LDAP server.
|
||||
# This is the 'proper' way to establish encrypted TLS connections, see
|
||||
# http://www.openldap.org/faq/data/cache/185.html
|
||||
#proxy_set_header X-Ldap-Starttls "true";
|
||||
|
||||
# (Required) Set the Base DN, by replacing the value enclosed in
|
||||
# double quotes.
|
||||
proxy_set_header X-Ldap-BaseDN "cn=Users,dc=test,dc=local";
|
||||
|
||||
# (Required) Set the Bind DN, by replacing the value enclosed in
|
||||
# double quotes.
|
||||
# If AD, use "root@test.local"
|
||||
proxy_set_header X-Ldap-BindDN "cn=root,dc=test,dc=local";
|
||||
|
||||
# (Required) Set the Bind password, by replacing 'secret'.
|
||||
proxy_set_header X-Ldap-BindPass "secret";
|
||||
|
||||
# (Required) The following directives set the cookie name and pass
|
||||
# it, respectively. They are required for cookie-based
|
||||
# authentication. Comment them out if using HTTP basic
|
||||
# authentication.
|
||||
proxy_set_header X-CookieName "nginxauth";
|
||||
proxy_set_header Cookie nginxauth=$cookie_nginxauth;
|
||||
|
||||
# (Required if using Microsoft Active Directory as the LDAP server)
|
||||
# Set the LDAP template by uncommenting the following directive.
|
||||
#proxy_set_header X-Ldap-Template "(sAMAccountName=%(username)s)";
|
||||
|
||||
# (Optional if using OpenLDAP as the LDAP server) Set the LDAP
|
||||
# template by uncommenting the following directive and replacing
|
||||
# '(cn=%(username)s)' which is the default set in
|
||||
# nginx-ldap-auth-daemon.py.
|
||||
#proxy_set_header X-Ldap-Template "(cn=%(username)s)";
|
||||
# (Optional) Set the realm name, by uncommenting the following
|
||||
# directive and replacing 'Restricted' which is the default set
|
||||
# in nginx-ldap-auth-daemon.py.
|
||||
#proxy_set_header X-Ldap-Realm "Restricted";
|
||||
}
|
||||
@@ -1,4 +1,6 @@
|
||||
## Version 2021/10/26 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/proxy.conf
|
||||
## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/proxy.conf.sample
|
||||
|
||||
include /config/nginx/error_pages.conf;
|
||||
|
||||
# Timeout if the real server is dead
|
||||
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
|
||||
@@ -10,7 +12,7 @@ proxy_headers_hash_bucket_size 128;
|
||||
proxy_headers_hash_max_size 1024;
|
||||
proxy_http_version 1.1;
|
||||
proxy_read_timeout 240;
|
||||
proxy_redirect http:// $scheme://;
|
||||
proxy_redirect http:// $scheme://;
|
||||
proxy_send_timeout 240;
|
||||
|
||||
# Proxy Cache and Cookie Settings
|
||||
@@ -25,7 +27,11 @@ proxy_set_header Host $host;
|
||||
proxy_set_header Proxy "";
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header X-Forwarded-Host $host:$server_port;
|
||||
proxy_set_header X-Forwarded-Method $request_method;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Server $host;
|
||||
proxy_set_header X-Forwarded-Ssl on;
|
||||
proxy_set_header X-Forwarded-Uri $request_uri;
|
||||
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
66
root/defaults/nginx/site-confs/default.conf.sample
Normal file
66
root/defaults/nginx/site-confs/default.conf.sample
Normal file
@@ -0,0 +1,66 @@
|
||||
## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/site-confs/default.conf.sample
|
||||
|
||||
include /config/nginx/error_pages.conf;
|
||||
|
||||
# redirect all traffic to https
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
# main server block
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
server_name _;
|
||||
|
||||
root /config/www;
|
||||
index index.html index.htm index.php;
|
||||
|
||||
include /config/nginx/error_pages.conf;
|
||||
|
||||
# enable subfolder method reverse proxy confs
|
||||
include /config/nginx/proxy-confs/*.subfolder.conf;
|
||||
|
||||
# enable for ldap auth (requires ldap-location.conf in the location block)
|
||||
#include /config/nginx/ldap-server.conf;
|
||||
|
||||
# enable for Authelia (requires authelia-location.conf in the location block)
|
||||
#include /config/nginx/authelia-server.conf;
|
||||
|
||||
location / {
|
||||
# enable for basic auth
|
||||
#auth_basic "Restricted";
|
||||
#auth_basic_user_file /config/nginx/.htpasswd;
|
||||
|
||||
# enable for ldap auth (requires ldap-server.conf in the server block)
|
||||
#include /config/nginx/ldap-location.conf;
|
||||
|
||||
# enable for Authelia (requires authelia-server.conf in the server block)
|
||||
#include /config/nginx/authelia-location.conf;
|
||||
|
||||
try_files $uri $uri/ /index.html /index.php?$args =404;
|
||||
}
|
||||
|
||||
location ~ ^(.+\.php)(.*)$ {
|
||||
fastcgi_split_path_info ^(.+\.php)(.*)$;
|
||||
fastcgi_pass 127.0.0.1:9000;
|
||||
fastcgi_index index.php;
|
||||
include /etc/nginx/fastcgi_params;
|
||||
}
|
||||
|
||||
# deny access to .htaccess/.htpasswd files
|
||||
location ~ /\.ht {
|
||||
deny all;
|
||||
}
|
||||
}
|
||||
|
||||
# enable subdomain method reverse proxy confs
|
||||
include /config/nginx/proxy-confs/*.subdomain.conf;
|
||||
# enable proxy cache for auth
|
||||
proxy_cache_path cache/ keys_zone=auth_cache:10m;
|
||||
@@ -1,46 +0,0 @@
|
||||
## Version 2021/09/19 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/ssl.conf
|
||||
|
||||
### Mozilla Recommendations
|
||||
# generated 2020-06-17, Mozilla Guideline v5.4, nginx 1.18.0-r0, OpenSSL 1.1.1g-r0, intermediate configuration
|
||||
# https://ssl-config.mozilla.org/#server=nginx&version=1.18.0-r0&config=intermediate&openssl=1.1.1g-r0&guideline=5.4
|
||||
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
|
||||
ssl_session_tickets off;
|
||||
|
||||
# intermediate configuration
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
# OCSP stapling
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
|
||||
|
||||
### Linuxserver.io Defaults
|
||||
|
||||
# Certificates
|
||||
ssl_certificate /config/keys/letsencrypt/fullchain.pem;
|
||||
ssl_certificate_key /config/keys/letsencrypt/privkey.pem;
|
||||
# verify chain of trust of OCSP response using Root CA and Intermediate certs
|
||||
ssl_trusted_certificate /config/keys/letsencrypt/fullchain.pem;
|
||||
|
||||
# Diffie-Hellman Parameters
|
||||
ssl_dhparam /config/nginx/dhparams.pem;
|
||||
|
||||
# Enable TLS 1.3 early data
|
||||
ssl_early_data on;
|
||||
|
||||
# HSTS, remove # from the line below to enable HSTS
|
||||
#add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
||||
|
||||
# Optional additional headers
|
||||
#add_header Cache-Control "no-transform" always;
|
||||
#add_header Content-Security-Policy "upgrade-insecure-requests; frame-ancestors 'self'";
|
||||
#add_header Permissions-Policy "interest-cohort=()";
|
||||
#add_header Referrer-Policy "same-origin" always;
|
||||
#add_header X-Content-Type-Options "nosniff" always;
|
||||
#add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
#add_header X-UA-Compatible "IE=Edge" always;
|
||||
#add_header X-XSS-Protection "1; mode=block" always;
|
||||
6
root/etc/cont-init.d/30-test-run
Normal file
6
root/etc/cont-init.d/30-test-run
Normal file
@@ -0,0 +1,6 @@
|
||||
#!/usr/bin/with-contenv bash
|
||||
|
||||
# Echo init finish for test runs
|
||||
if [[ -n "${TEST_RUN}" ]]; then
|
||||
echo '[services.d] done.'
|
||||
fi
|
||||
7
root/etc/cont-init.d/31-require-url
Normal file
7
root/etc/cont-init.d/31-require-url
Normal file
@@ -0,0 +1,7 @@
|
||||
#!/usr/bin/with-contenv bash
|
||||
|
||||
# check to make sure that the required variables are set
|
||||
if [[ -z "${URL}" ]]; then
|
||||
echo "Please pass your URL as an environment variable in your docker run command. See docker info for more details."
|
||||
sleep infinity
|
||||
fi
|
||||
11
root/etc/cont-init.d/40-folders
Normal file
11
root/etc/cont-init.d/40-folders
Normal file
@@ -0,0 +1,11 @@
|
||||
#!/usr/bin/with-contenv bash
|
||||
|
||||
# make our folders and links
|
||||
mkdir -p \
|
||||
/config/{fail2ban,crontabs,dns-conf} \
|
||||
/config/etc/letsencrypt \
|
||||
/config/log/{fail2ban,letsencrypt,nginx} \
|
||||
/config/nginx/proxy-confs \
|
||||
/var/run/fail2ban
|
||||
rm -rf /etc/letsencrypt
|
||||
ln -s /config/etc/letsencrypt /etc/letsencrypt
|
||||
12
root/etc/cont-init.d/41-samples
Normal file
12
root/etc/cont-init.d/41-samples
Normal file
@@ -0,0 +1,12 @@
|
||||
#!/usr/bin/with-contenv bash
|
||||
|
||||
# samples are removed on init by the nginx base
|
||||
|
||||
# copy new samples
|
||||
if [[ -d /defaults/nginx/proxy-confs/ ]]; then
|
||||
find /defaults/nginx/proxy-confs/ \
|
||||
-maxdepth 1 \
|
||||
-name "*.conf.sample" \
|
||||
-type f \
|
||||
-exec cp "{}" /config/nginx/proxy-confs/ +
|
||||
fi
|
||||
28
root/etc/cont-init.d/42-fail2ban
Normal file
28
root/etc/cont-init.d/42-fail2ban
Normal file
@@ -0,0 +1,28 @@
|
||||
#!/usr/bin/with-contenv bash
|
||||
|
||||
# copy/update the fail2ban config defaults to/in /config
|
||||
cp -R /defaults/fail2ban/filter.d /config/fail2ban/
|
||||
cp -R /defaults/fail2ban/action.d /config/fail2ban/
|
||||
# if jail.local is missing in /config, copy default
|
||||
if [[ ! -f /config/fail2ban/jail.local ]]; then
|
||||
cp /defaults/fail2ban/jail.local /config/fail2ban/jail.local
|
||||
fi
|
||||
# Replace fail2ban config with user config
|
||||
if [[ -d /etc/fail2ban/filter.d ]]; then
|
||||
rm -rf /etc/fail2ban/filter.d
|
||||
fi
|
||||
if [[ -d /etc/fail2ban/action.d ]]; then
|
||||
rm -rf /etc/fail2ban/action.d
|
||||
fi
|
||||
cp -R /config/fail2ban/filter.d /etc/fail2ban/
|
||||
cp -R /config/fail2ban/action.d /etc/fail2ban/
|
||||
cp /defaults/fail2ban/fail2ban.local /etc/fail2ban/
|
||||
cp /config/fail2ban/jail.local /etc/fail2ban/jail.local
|
||||
|
||||
# logfiles needed by fail2ban
|
||||
if [[ ! -f /config/log/nginx/error.log ]]; then
|
||||
touch /config/log/nginx/error.log
|
||||
fi
|
||||
if [[ ! -f /config/log/nginx/access.log ]]; then
|
||||
touch /config/log/nginx/access.log
|
||||
fi
|
||||
10
root/etc/cont-init.d/43-crontabs
Normal file
10
root/etc/cont-init.d/43-crontabs
Normal file
@@ -0,0 +1,10 @@
|
||||
#!/usr/bin/with-contenv bash
|
||||
|
||||
# copy crontabs if needed
|
||||
if [[ ! -f /config/crontabs/root ]]; then
|
||||
cp /etc/crontabs/root /config/crontabs/
|
||||
fi
|
||||
|
||||
# import user crontabs
|
||||
rm /etc/crontabs/*
|
||||
cp /config/crontabs/* /etc/crontabs/
|
||||
12
root/etc/cont-init.d/45-nginx
Normal file
12
root/etc/cont-init.d/45-nginx
Normal file
@@ -0,0 +1,12 @@
|
||||
#!/usr/bin/with-contenv bash
|
||||
|
||||
# copy default config files if they don't exist
|
||||
if [[ ! -f /config/nginx/error_pages.conf ]]; then
|
||||
cp /defaults/nginx/error_pages.conf.sample /config/nginx/error_pages.conf
|
||||
fi
|
||||
if [[ ! -f /config/nginx/proxy.conf ]]; then
|
||||
cp /defaults/nginx/proxy.conf.sample /config/nginx/proxy.conf
|
||||
fi
|
||||
if [[ ! -f /config/www/502.html ]]; then
|
||||
cp /defaults/www/502.html /config/www/502.html
|
||||
fi
|
||||
@@ -15,11 +15,6 @@ DNSPLUGIN=${DNSPLUGIN}\\n\
|
||||
EMAIL=${EMAIL}\\n\
|
||||
STAGING=${STAGING}\\n"
|
||||
|
||||
# Echo init finish for test runs
|
||||
if [ -n "${TEST_RUN}" ]; then
|
||||
echo '[services.d] done.'
|
||||
fi
|
||||
|
||||
# Sanitize variables
|
||||
SANED_VARS=( DNSPLUGIN EMAIL EXTRA_DOMAINS ONLY_SUBDOMAINS STAGING SUBDOMAINS URL VALIDATION CERTPROVIDER )
|
||||
for i in "${SANED_VARS[@]}"
|
||||
@@ -28,105 +23,15 @@ do
|
||||
export echo "$i"="$(echo "${!i}" | tr '[:upper:]' '[:lower:]')"
|
||||
done
|
||||
|
||||
# check to make sure that the required variables are set
|
||||
[[ -z "$URL" ]] && \
|
||||
echo "Please pass your URL as an environment variable in your docker run command. See docker info for more details." && \
|
||||
sleep infinity
|
||||
|
||||
# make our folders and links
|
||||
mkdir -p \
|
||||
/config/{log/letsencrypt,log/fail2ban,etc/letsencrypt,fail2ban,crontabs,dns-conf,geoip2db} \
|
||||
/var/run/fail2ban
|
||||
rm -rf /etc/letsencrypt
|
||||
ln -s /config/etc/letsencrypt /etc/letsencrypt
|
||||
|
||||
# copy dns default configs
|
||||
cp -n /defaults/dns-conf/* /config/dns-conf/
|
||||
chown -R abc:abc /config/dns-conf
|
||||
|
||||
# copy reverse proxy configs
|
||||
cp -R /defaults/proxy-confs /config/nginx/
|
||||
|
||||
# copy/update the fail2ban config defaults to/in /config
|
||||
cp -R /defaults/fail2ban/filter.d /config/fail2ban/
|
||||
cp -R /defaults/fail2ban/action.d /config/fail2ban/
|
||||
# if jail.local is missing in /config, copy default
|
||||
[[ ! -f /config/fail2ban/jail.local ]] && \
|
||||
cp /defaults/jail.local /config/fail2ban/jail.local
|
||||
# Replace fail2ban config with user config
|
||||
[[ -d /etc/fail2ban/filter.d ]] && \
|
||||
rm -rf /etc/fail2ban/filter.d
|
||||
[[ -d /etc/fail2ban/action.d ]] && \
|
||||
rm -rf /etc/fail2ban/action.d
|
||||
cp -R /config/fail2ban/filter.d /etc/fail2ban/
|
||||
cp -R /config/fail2ban/action.d /etc/fail2ban/
|
||||
cp /defaults/fail2ban/fail2ban.local /etc/fail2ban/
|
||||
cp /config/fail2ban/jail.local /etc/fail2ban/jail.local
|
||||
|
||||
# copy crontab and proxy defaults if needed
|
||||
[[ ! -f /config/crontabs/root ]] && \
|
||||
cp /etc/crontabs/root /config/crontabs/
|
||||
[[ ! -f /config/nginx/proxy.conf ]] && \
|
||||
cp /defaults/proxy.conf /config/nginx/proxy.conf
|
||||
[[ ! -f /config/nginx/ssl.conf ]] && \
|
||||
cp /defaults/ssl.conf /config/nginx/ssl.conf
|
||||
[[ ! -f /config/nginx/ldap.conf ]] && \
|
||||
cp /defaults/ldap.conf /config/nginx/ldap.conf
|
||||
[[ ! -f /config/nginx/authelia-server.conf ]] && \
|
||||
cp /defaults/authelia-server.conf /config/nginx/authelia-server.conf
|
||||
[[ ! -f /config/nginx/authelia-location.conf ]] && \
|
||||
cp /defaults/authelia-location.conf /config/nginx/authelia-location.conf
|
||||
[[ ! -f /config/www/502.html ]] &&
|
||||
cp /defaults/502.html /config/www/502.html
|
||||
|
||||
# Set resolver, ignore ipv6 addresses
|
||||
if ! grep -q 'resolver' /config/nginx/resolver.conf; then
|
||||
RESOLVERRAW=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {print $2}' /etc/resolv.conf)
|
||||
for i in ${RESOLVERRAW}; do
|
||||
if [ $(awk -F ':' '{print NF-1}' <<< ${i}) -le 2 ]; then
|
||||
RESOLVER="${RESOLVER} ${i}"
|
||||
fi
|
||||
done
|
||||
if [ -z "${RESOLVER}" ]; then
|
||||
RESOLVER="127.0.0.11"
|
||||
fi
|
||||
echo "Setting resolver to ${RESOLVER}"
|
||||
echo -e "# This file is auto-generated only on first start, based on the container's /etc/resolv.conf file. Feel free to modify it as you wish.\n\nresolver ${RESOLVER} valid=30s;" > /config/nginx/resolver.conf
|
||||
fi
|
||||
|
||||
# Set worker_processes
|
||||
if ! grep -q 'worker_processes' /config/nginx/worker_processes.conf; then
|
||||
WORKER_PROCESSES=$(nproc)
|
||||
echo "Setting worker_processes to ${WORKER_PROCESSES}"
|
||||
echo -e "# This file is auto-generated only on first start, based on the cpu cores detected. Feel free to change it to any other number or to auto to let nginx handle it automatically.\n\nworker_processes ${WORKER_PROCESSES};" > /config/nginx/worker_processes.conf
|
||||
fi
|
||||
|
||||
# remove lua bits from nginx.conf if not done before
|
||||
if ! grep -q '#Removed lua' /config/nginx/nginx.conf; then
|
||||
echo "Removing lua specific info from nginx.conf"
|
||||
sed -i 's|\tlua_load_resty_core off;|\t#Removed lua. Do not remove this comment|g' /config/nginx/nginx.conf
|
||||
fi
|
||||
|
||||
# patch authelia-server.conf for CVE-2021-32637
|
||||
if ! grep -q 'if ($request_uri ~' /config/nginx/authelia-server.conf; then
|
||||
sed -i '/internal;/a \ \ \ \ if ($request_uri ~ [^a-zA-Z0-9_+-=\\!@$%&*?~.:#'\''\\;\\(\\)\\[\\]]) { return 401; }' /config/nginx/authelia-server.conf
|
||||
fi
|
||||
|
||||
# copy pre-generated dhparams or generate if needed
|
||||
[[ ! -f /config/nginx/dhparams.pem ]] && \
|
||||
cp /defaults/dhparams.pem /config/nginx/dhparams.pem
|
||||
if ! grep -q 'PARAMETERS' "/config/nginx/dhparams.pem"; then
|
||||
curl -o /config/nginx/dhparams.pem -L "https://ssl-config.mozilla.org/ffdhe4096.txt"
|
||||
fi
|
||||
|
||||
# check to make sure DNSPLUGIN is selected if dns validation is used
|
||||
[[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(aliyun|azure|cloudflare|cloudxns|cpanel|desec|digitalocean|directadmin|dnsimple|dnsmadeeasy|dnspod|domeneshop|dynu|gandi|gehirn|google|he|hetzner|infomaniak|inwx|ionos|linode|loopia|luadns|netcup|njalla|nsone|ovh|rfc2136|route53|sakuracloud|standalone|transip|vultr)$ ]] && \
|
||||
echo "Please set the DNSPLUGIN variable to a valid plugin name. See docker info for more details." && \
|
||||
if [[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(aliyun|azure|cloudflare|cloudxns|cpanel|desec|digitalocean|directadmin|dnsimple|dnsmadeeasy|dnspod|domeneshop|dynu|gandi|gehirn|google|he|hetzner|infomaniak|inwx|ionos|linode|loopia|luadns|netcup|njalla|nsone|ovh|rfc2136|route53|sakuracloud|standalone|transip|vultr)$ ]]; then
|
||||
echo "Please set the DNSPLUGIN variable to a valid plugin name. See docker info for more details."
|
||||
sleep infinity
|
||||
|
||||
# import user crontabs
|
||||
rm /etc/crontabs/*
|
||||
cp /config/crontabs/* /etc/crontabs/
|
||||
fi
|
||||
|
||||
# create original config file if it doesn't exist, move non-hidden legacy file to hidden
|
||||
if [ -f "/config/donoteditthisfile.conf" ]; then
|
||||
@@ -278,6 +183,10 @@ if [ "$ONLY_SUBDOMAINS" = "true" ] && [ ! "$SUBDOMAINS" = "wildcard" ] ; then
|
||||
else
|
||||
ln -s ../etc/letsencrypt/live/"$URL" /config/keys/letsencrypt
|
||||
fi
|
||||
rm -rf /config/keys/cert.crt
|
||||
ln -s ./letsencrypt/fullchain.pem /config/keys/cert.crt
|
||||
rm -rf /config/keys/cert.key
|
||||
ln -s ./letsencrypt/privkey.pem /config/keys/cert.key
|
||||
|
||||
# checking for changes in cert variables, revoking certs if necessary
|
||||
if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "$ONLY_SUBDOMAINS" = "$ORIGONLY_SUBDOMAINS" ] || [ ! "$EXTRA_DOMAINS" = "$ORIGEXTRA_DOMAINS" ] || [ ! "$VALIDATION" = "$ORIGVALIDATION" ] || [ ! "$DNSPLUGIN" = "$ORIGDNSPLUGIN" ] || [ ! "$PROPAGATION" = "$ORIGPROPAGATION" ] || [ ! "$STAGING" = "$ORIGSTAGING" ] || [ ! "$DUCKDNSTOKEN" = "$ORIGDUCKDNSTOKEN" ] || [ ! "$CERTPROVIDER" = "$ORIGCERTPROVIDER" ]; then
|
||||
@@ -301,7 +210,9 @@ if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "
|
||||
else
|
||||
REV_ACMESERVER="https://acme-v02.api.letsencrypt.org/directory"
|
||||
fi
|
||||
[[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]] && certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem --server $REV_ACMESERVER
|
||||
if [[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]]; then
|
||||
certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem --server $REV_ACMESERVER
|
||||
fi
|
||||
rm -rf /config/etc/letsencrypt
|
||||
mkdir -p /config/etc/letsencrypt
|
||||
fi
|
||||
@@ -360,26 +271,3 @@ if [ ! -f "/config/keys/letsencrypt/fullchain.pem" ]; then
|
||||
else
|
||||
echo "Certificate exists; parameters unchanged; starting nginx"
|
||||
fi
|
||||
|
||||
# create GeoIP2 folder symlink
|
||||
[[ -d /var/lib/libmaxminddb ]] && [[ ! -L /var/lib/libmaxminddb ]] && \
|
||||
rm -rf /var/lib/libmaxminddb
|
||||
[[ ! -d /var/lib/libmaxminddb ]] && \
|
||||
ln -s /config/geoip2db /var/lib/libmaxminddb
|
||||
|
||||
# logfiles needed by fail2ban
|
||||
[[ ! -f /config/log/nginx/error.log ]] && \
|
||||
touch /config/log/nginx/error.log
|
||||
[[ ! -f /config/log/nginx/access.log ]] && \
|
||||
touch /config/log/nginx/access.log
|
||||
[[ ! -f /config/log/nginx/unauthorized.log ]] && \
|
||||
touch /config/log/nginx/unauthorized.log
|
||||
|
||||
# permissions
|
||||
chown -R abc:abc \
|
||||
/config
|
||||
chmod -R 0644 /etc/logrotate.d
|
||||
chmod -R +r /config/log
|
||||
chmod +x /app/le-renew.sh
|
||||
chmod 700 /defaults/dns-conf
|
||||
chmod 600 /defaults/dns-conf/*
|
||||
8
root/etc/cont-init.d/55-permissions
Normal file
8
root/etc/cont-init.d/55-permissions
Normal file
@@ -0,0 +1,8 @@
|
||||
#!/usr/bin/with-contenv bash
|
||||
|
||||
# permissions
|
||||
chown -R abc:abc \
|
||||
/config
|
||||
chmod -R 0644 /etc/logrotate.d
|
||||
chmod -R +r /config/log
|
||||
chmod +x /app/le-renew.sh
|
||||
16
root/etc/cont-init.d/70-outdated
Normal file
16
root/etc/cont-init.d/70-outdated
Normal file
@@ -0,0 +1,16 @@
|
||||
#!/usr/bin/with-contenv bash
|
||||
|
||||
if [[ -f /config/nginx/502.conf ]]; then
|
||||
echo "/config/nginx/502.conf exists.
|
||||
Please migrate to error_pages.conf"
|
||||
fi
|
||||
if [[ -f /config/nginx/geoip2.conf ]]; then
|
||||
echo "/config/nginx/geoip2.conf exists.
|
||||
Please migrate to https://github.com/linuxserver/docker-mods/tree/swag-maxmind"
|
||||
fi
|
||||
if [[ -f /config/nginx/ldap.conf ]]; then
|
||||
echo "/config/nginx/ldap.conf exists.
|
||||
Please apply any customizations to /config/nginx/ldap-server.conf
|
||||
Ensure your nginx.conf is updated and remove /config/nginx/ldap.conf
|
||||
If you do not use this config, simply remove it."
|
||||
fi
|
||||
@@ -1,41 +0,0 @@
|
||||
#!/usr/bin/with-contenv bash
|
||||
|
||||
nginx_confs=( \
|
||||
authelia-location.conf \
|
||||
authelia-server.conf \
|
||||
ldap.conf \
|
||||
nginx.conf \
|
||||
proxy.conf \
|
||||
site-confs/default \
|
||||
ssl.conf )
|
||||
|
||||
for i in ${nginx_confs[@]}; do
|
||||
if [ "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' /config/nginx/${i})" != "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' /defaults/$(basename ${i}))" ]; then
|
||||
nginx_confs_changed="/config/nginx/${i}\n${nginx_confs_changed}"
|
||||
fi
|
||||
done
|
||||
|
||||
if [ -n "$nginx_confs_changed" ]; then
|
||||
echo "**** The following nginx confs have different version dates than the defaults that are shipped. ****"
|
||||
echo "**** This may be due to user customization or an update to the defaults. ****"
|
||||
echo "**** To update them to the latest defaults shipped within the image, delete these files and restart the container. ****"
|
||||
echo "**** If they are user customized, check the date version at the top and compare to the upstream changelog via the link. ****"
|
||||
echo -e "${nginx_confs_changed}"
|
||||
fi
|
||||
|
||||
proxy_confs=$(ls /config/nginx/proxy-confs/*.conf 2>/dev/null)
|
||||
|
||||
for i in $proxy_confs; do
|
||||
if [ -f "${i}.sample" ]; then
|
||||
if [ "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' ${i})" != "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' ${i}.sample)" ]; then
|
||||
proxy_confs_changed="${i}\n${proxy_confs_changed}"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
if [ -n "$proxy_confs_changed" ]; then
|
||||
echo "**** The following reverse proxy confs have different version dates than the samples that are shipped. ****"
|
||||
echo "**** This may be due to user customization or an update to the samples. ****"
|
||||
echo "**** You should compare them to the samples in the same folder to make sure you have the latest updates. ****"
|
||||
echo -e "${proxy_confs_changed}"
|
||||
fi
|
||||
Reference in New Issue
Block a user