Compare commits

..

34 Commits

Author SHA1 Message Date
LinuxServer-CI
5df55cc0c0 Bot Updating Package Versions 2022-05-03 17:59:50 -05:00
LinuxServer-CI
ceabef087f Bot Updating Templated Files 2022-05-04 00:55:45 +02:00
LinuxServer-CI
6f9ed0721d Bot Updating Templated Files 2022-05-04 00:54:37 +02:00
LinuxServer-CI
5319c88dfa Bot Updating Package Versions 2022-04-28 00:43:35 -05:00
LinuxServer-CI
c875b69297 Bot Updating Package Versions 2022-04-21 00:41:17 -05:00
LinuxServer-CI
f8e4eca8d0 Bot Updating Package Versions 2022-04-14 07:20:07 +02:00
LinuxServer-CI
ee6a7d454f Bot Updating Package Versions 2022-04-09 11:21:10 -05:00
LinuxServer-CI
f29ae615d4 Bot Updating Templated Files 2022-04-09 11:15:55 -05:00
Potterer
a9fd11ff77 Add Loopia DNS Support (#226) 2022-04-09 17:14:35 +01:00
LinuxServer-CI
60c0da359b Bot Updating Templated Files 2022-04-05 21:55:48 -05:00
aptalca
bec249ba73 Merge pull request #179 from mhofer117/standalone-dns-validation
Add support for standalone DNS validation
2022-04-05 19:13:42 -04:00
aptalca
eb7df9d9fc Merge branch 'master' into standalone-dns-validation 2022-04-05 19:08:28 -04:00
aptalca
a29f2da10e update changelog date 2022-04-05 19:06:43 -04:00
LinuxServer-CI
a9e53d5fc8 Bot Updating Package Versions 2022-04-05 21:56:51 +02:00
quietsy
f9e05fd86a Merge pull request #219 from EVOTk/patch-1
add nginx unauthorized in Using fail2ban section
2022-03-31 20:59:57 +00:00
LinuxServer-CI
b28eed1263 Bot Updating Package Versions 2022-03-28 16:40:46 -05:00
LinuxServer-CI
7eb8f7999e Bot Updating Templated Files 2022-03-28 16:35:42 -05:00
aptalca
5beb4ffb32 Merge pull request #223 from millerthegorilla/unauthorized-log-patch-1
Update 50-config create fail2ban unauthorized.log
2022-03-28 17:34:11 -04:00
James Stewart Miller
9821740d65 Update readme-vars.yml
added changelog
2022-03-28 21:57:19 +01:00
James Stewart Miller
5501308aed Update 50-config create fail2ban unauthorized.log
added code to test for existence of unauthorized.log and create it if not exists.
/config/log/nginx/unauthorized.log is written to by addition of nginx-unauthorized jail in jail.local at (https://github.com/linuxserver/docker-swag/blob/master/root/defaults/jail.local)
2022-03-26 20:46:39 +00:00
EVOTk
2272c3037a Update readme-vars.yml 2022-03-25 22:51:17 +01:00
LinuxServer-CI
cf8cfd4241 Bot Updating Package Versions 2022-03-24 06:19:17 +01:00
LinuxServer-CI
a5389c3f40 Bot Updating Package Versions 2022-03-16 21:57:12 +01:00
LinuxServer-CI
1fbae23bcf Bot Updating Package Versions 2022-03-10 06:19:39 +01:00
EVOTk
de3b43cb62 add nginx unauthorized in Using fail2ban section 2022-03-09 21:59:49 +01:00
LinuxServer-CI
555b2837cb Bot Updating Package Versions 2022-03-02 00:56:48 +01:00
LinuxServer-CI
7c5005f9ad Bot Updating Package Versions 2022-02-24 06:18:30 +01:00
LinuxServer-CI
7fb7364c96 Bot Updating Package Versions 2022-02-17 06:18:01 +01:00
LinuxServer-CI
274369c4ba Bot Updating Package Versions 2022-02-08 19:58:44 +01:00
Marcel Hofer
1ff4691000 Merge branch 'master' into standalone-dns-validation 2021-12-12 01:06:20 +01:00
Marcel Hofer
2878d84050 Merge remote-tracking branch 'linuxserver/master' into standalone-dns-validation
# Conflicts:
#	readme-vars.yml
#	root/etc/cont-init.d/50-config
2021-11-24 22:02:24 +01:00
Marcel Hofer
85efd12ba4 Merge branch 'master' into standalone-dns-validation 2021-11-20 19:47:43 +01:00
Marcel Hofer
f307dbbfb7 Merge branch 'master' into standalone-dns-validation 2021-11-16 21:12:06 +01:00
Marcel Hofer
0ce2ae551a Add support for standalone DNS validation 2021-11-06 16:07:51 +01:00
10 changed files with 104 additions and 68 deletions

View File

@@ -118,6 +118,7 @@ RUN \
certbot-dns-inwx \
certbot-dns-ionos \
certbot-dns-linode \
certbot-dns-loopia \
certbot-dns-luadns \
certbot-dns-netcup \
certbot-dns-njalla \
@@ -125,6 +126,7 @@ RUN \
certbot-dns-ovh \
certbot-dns-rfc2136 \
certbot-dns-route53 \
certbot-dns-standalone \
certbot-dns-transip \
certbot-dns-vultr \
certbot-dns-desec \

View File

@@ -118,6 +118,7 @@ RUN \
certbot-dns-inwx \
certbot-dns-ionos \
certbot-dns-linode \
certbot-dns-loopia \
certbot-dns-luadns \
certbot-dns-netcup \
certbot-dns-njalla \
@@ -125,6 +126,7 @@ RUN \
certbot-dns-ovh \
certbot-dns-rfc2136 \
certbot-dns-route53 \
certbot-dns-standalone \
certbot-dns-transip \
certbot-dns-vultr \
certbot-dns-desec \

View File

@@ -118,6 +118,7 @@ RUN \
certbot-dns-inwx \
certbot-dns-ionos \
certbot-dns-linode \
certbot-dns-loopia \
certbot-dns-luadns \
certbot-dns-netcup \
certbot-dns-njalla \
@@ -125,6 +126,7 @@ RUN \
certbot-dns-ovh \
certbot-dns-rfc2136 \
certbot-dns-route53 \
certbot-dns-standalone \
certbot-dns-transip \
certbot-dns-vultr \
certbot-plugin-gandi \

8
Jenkinsfile vendored
View File

@@ -343,9 +343,11 @@ pipeline {
if [[ ("${BRANCH_NAME}" == "master") || ("${BRANCH_NAME}" == "main") ]] && [[ (! -f ${TEMPDIR}/unraid/templates/unraid/${CONTAINER_NAME}.xml) || ("$(md5sum ${TEMPDIR}/unraid/templates/unraid/${CONTAINER_NAME}.xml | awk '{ print $1 }')" != "$(md5sum ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml | awk '{ print $1 }')") ]]; then
cd ${TEMPDIR}/unraid/templates/
if grep -wq "${CONTAINER_NAME}" ${TEMPDIR}/unraid/templates/unraid/ignore.list; then
echo "Image is on the ignore list, removing Unraid template"
git rm unraid/${CONTAINER_NAME}.xml || :
git commit -m 'Bot Removing Deprecated Unraid Template' || :
echo "Image is on the ignore list, marking Unraid template as deprecated"
cp ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml ${TEMPDIR}/unraid/templates/unraid/
git add -u unraid/${CONTAINER_NAME}.xml
git mv unraid/${CONTAINER_NAME}.xml unraid/deprecated/${CONTAINER_NAME}.xml || :
git commit -m 'Bot Moving Deprecated Unraid Template' || :
else
cp ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml ${TEMPDIR}/unraid/templates/unraid/
git add unraid/${CONTAINER_NAME}.xml

34
README.md Normal file → Executable file
View File

@@ -46,17 +46,17 @@ SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relatio
## Supported Architectures
Our images support multiple architectures such as `x86-64`, `arm64` and `armhf`. We utilise the docker manifest for multi-platform awareness. More information is available from docker [here](https://github.com/docker/distribution/blob/master/docs/spec/manifest-v2-2.md#manifest-list) and our announcement [here](https://blog.linuxserver.io/2019/02/21/the-lsio-pipeline-project/).
We utilise the docker manifest for multi-platform awareness. More information is available from docker [here](https://github.com/docker/distribution/blob/master/docs/spec/manifest-v2-2.md#manifest-list) and our announcement [here](https://blog.linuxserver.io/2019/02/21/the-lsio-pipeline-project/).
Simply pulling `lscr.io/linuxserver/swag` should retrieve the correct image for your arch, but you can also pull specific arch images via tags.
Simply pulling `lscr.io/linuxserver/swag:latest` should retrieve the correct image for your arch, but you can also pull specific arch images via tags.
The architectures supported by this image are:
| Architecture | Tag |
| :----: | --- |
| x86-64 | amd64-latest |
| arm64 | arm64v8-latest |
| armhf | arm32v7-latest |
| Architecture | Available | Tag |
| :----: | :----: | ---- |
| x86-64 | ✅ | amd64-\<version tag\> |
| arm64 | ✅ | arm64v8-\<version tag\> |
| armhf| ✅ | arm32v7-\<version tag\> |
## Application Setup
@@ -103,11 +103,12 @@ This will *ask* Google et al not to index and list your site. Be careful with th
### Using fail2ban
* This container includes fail2ban set up with 4 jails by default:
* This container includes fail2ban set up with 5 jails by default:
1. nginx-http-auth
2. nginx-badbots
3. nginx-botsearch
4. nginx-deny
5. nginx-unauthorized
* To enable or disable other jails, modify the file `/config/fail2ban/jail.local`
* To modify filters and actions, instead of editing the `.conf` files, create `.local` files with the same name and edit those because .conf files get overwritten when the actions and filters are updated. `.local` files will append whatever's in the `.conf` files (ie. `nginx-http-auth.conf` --> `nginx-http-auth.local`)
* You can check which jails are active via `docker exec -it swag fail2ban-client status`
@@ -143,7 +144,7 @@ Here are some example snippets to help you get started creating a container.
version: "2.1"
services:
swag:
image: lscr.io/linuxserver/swag
image: lscr.io/linuxserver/swag:latest
container_name: swag
cap_add:
- NET_ADMIN
@@ -194,7 +195,7 @@ docker run -d \
-p 80:80 `#optional` \
-v /path/to/appdata/config:/config \
--restart unless-stopped \
lscr.io/linuxserver/swag
lscr.io/linuxserver/swag:latest
```
## Parameters
@@ -212,7 +213,7 @@ Container images are configured using parameters passed at runtime (such as thos
| `-e VALIDATION=http` | Certbot validation method to use, options are `http`, `dns` or `duckdns` (`dns` method also requires `DNSPLUGIN` variable set) (`duckdns` method requires `DUCKDNSTOKEN` variable set, and the `SUBDOMAINS` variable must be either empty or set to `wildcard`). |
| `-e SUBDOMAINS=www,` | Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this _exactly_ to `wildcard` (wildcard cert is available via `dns` and `duckdns` validation only) |
| `-e CERTPROVIDER=` | Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt. |
| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `domeneshop`, `gandi`, `gehirn`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud`, `transip` and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. |
| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `domeneshop`, `gandi`, `gehirn`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip` and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. |
| `-e PROPAGATION=` | Optionally override (in seconds) the default propagation time for the dns plugins. |
| `-e DUCKDNSTOKEN=` | Required if `VALIDATION` is set to `duckdns`. Retrieve your token from https://www.duckdns.org |
| `-e EMAIL=` | Optional e-mail address used for cert expiration notifications (Required for ZeroSSL). |
@@ -221,6 +222,10 @@ Container images are configured using parameters passed at runtime (such as thos
| `-e STAGING=false` | Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes. |
| `-v /config` | All the config files including the webroot reside here. |
### Portainer notice
This image utilises `cap_add` or `sysctl` to work properly. This is not implemented properly in some versions of Portainer, thus this image may not work if deployed through Portainer.
## Environment variables from files (Docker secrets)
You can set any environment variable from a file by using a special prepend `FILE__`.
@@ -264,7 +269,7 @@ We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to
* container version number
* `docker inspect -f '{{ index .Config.Labels "build_version" }}' swag`
* image version number
* `docker inspect -f '{{ index .Config.Labels "build_version" }}' lscr.io/linuxserver/swag`
* `docker inspect -f '{{ index .Config.Labels "build_version" }}' lscr.io/linuxserver/swag:latest`
## Updating Info
@@ -282,7 +287,7 @@ Below are the instructions for updating containers:
### Via Docker Run
* Update the image: `docker pull lscr.io/linuxserver/swag`
* Update the image: `docker pull lscr.io/linuxserver/swag:latest`
* Stop the running container: `docker stop swag`
* Delete the container: `docker rm swag`
* Recreate a new container with the same docker run parameters as instructed above (if mapped correctly to a host folder, your `/config` folder and settings will be preserved)
@@ -330,6 +335,9 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
## Versions
* **09.04.22:** - Added certbot-dns-loopia for DNS01 validation.
* **05.04.22:** - Added support for standalone DNS validation.
* **28.03.22:** - created a logfile for fail2ban nginx-unauthorized in /etc/cont-init.d/50-config
* **09.01.22:** - Added a fail2ban jail for nginx unauthorized
* **21.12.21:** - Fixed issue with iptables not working as expected
* **30.11.21:** - Move maxmind to a [new mod](https://github.com/linuxserver/docker-mods/tree/swag-maxmind)

View File

@@ -1,26 +1,26 @@
alpine-baselayout-3.2.0-r16
alpine-keys-2.4-r0
apache2-utils-2.4.52-r0
apache2-utils-2.4.53-r0
apk-tools-2.12.7-r0
apr-1.7.0-r0
apr-util-1.6.1-r7
argon2-libs-20190702-r1
bash-5.1.4-r0
bash-5.1.16-r0
brotli-libs-1.0.9-r5
busybox-1.33.1-r6
busybox-1.33.1-r7
c-client-2007f-r11
ca-certificates-20211220-r0
ca-certificates-bundle-20211220-r0
coreutils-8.32-r2
curl-7.79.1-r0
expat-2.4.3-r0
curl-7.79.1-r1
expat-2.4.7-r0
fail2ban-0.11.2-r0
freetype-2.10.4-r1
gdbm-1.19-r0
git-2.32.0-r0
git-perl-2.32.0-r0
git-2.32.1-r0
git-perl-2.32.1-r0
glib-2.68.3-r0
gmp-6.2.1-r0
gmp-6.2.1-r1
gnupg-2.2.31-r0
gnutls-3.7.1-r0
icu-libs-67.1-r2
@@ -29,13 +29,13 @@ iptables-1.8.7-r1
libacl-2.2.53-r0
libassuan-2.5.5-r0
libattr-2.5.1-r0
libblkid-2.37.2-r0
libblkid-2.37.4-r0
libbsd-0.11.3-r0
libbz2-1.0.8-r1
libc-utils-0.7.2-r3
libcap-2.50-r0
libcrypto1.1-1.1.1l-r0
libcurl-7.79.1-r0
libcrypto1.1-1.1.1n-r0
libcurl-7.79.1-r1
libedit-20210216.3.1-r0
libevent-2.1.12-r2
libffi-3.3-r2
@@ -55,33 +55,33 @@ libmcrypt-2.5.8-r9
libmd-1.0.3-r0
libmemcached-libs-1.0.18-r4
libmnl-1.0.4-r1
libmount-2.37.2-r0
libmount-2.37.4-r0
libnftnl-libs-1.2.0-r0
libpng-1.6.37-r1
libpq-13.5-r0
libpq-13.6-r0
libproc-3.3.17-r0
libressl3.3-libcrypto-3.3.3-r0
libressl3.3-libssl-3.3.3-r0
libretls-3.3.3p1-r2
libsasl-2.1.27-r12
libressl3.3-libcrypto-3.3.6-r0
libressl3.3-libssl-3.3.6-r0
libretls-3.3.3p1-r3
libsasl-2.1.28-r0
libseccomp-2.5.1-r2
libsecret-0.20.4-r1
libsm-1.2.3-r0
libsodium-1.0.18-r0
libssl1.1-1.1.1l-r0
libssl1.1-1.1.1n-r0
libstdc++-10.3.1_git20210424-r2
libtasn1-4.17.0-r0
libunistring-0.9.10-r1
libuuid-2.37.2-r0
libuuid-2.37.4-r0
libwebp-1.2.0-r2
libx11-1.7.2-r0
libxau-1.0.9-r0
libxcb-1.14-r2
libxdmcp-1.1.3-r0
libxext-1.3.4-r0
libxml2-2.9.12-r1
libxml2-2.9.13-r0
libxpm-3.5.13-r0
libxslt-1.1.34-r1
libxslt-1.1.35-r0
libxt-1.2.1-r0
libzip-1.7.3-r2
linux-pam-1.5.1-r1
@@ -96,35 +96,35 @@ ncurses-libs-6.2_p20210612-r0
ncurses-terminfo-base-6.2_p20210612-r0
nettle-3.7.3-r0
nghttp2-libs-1.43.0-r0
nginx-1.20.2-r0
nginx-mod-devel-kit-1.20.2-r0
nginx-mod-http-brotli-1.20.2-r0
nginx-mod-http-dav-ext-1.20.2-r0
nginx-mod-http-echo-1.20.2-r0
nginx-mod-http-fancyindex-1.20.2-r0
nginx-mod-http-geoip2-1.20.2-r0
nginx-mod-http-headers-more-1.20.2-r0
nginx-mod-http-image-filter-1.20.2-r0
nginx-mod-http-nchan-1.20.2-r0
nginx-mod-http-perl-1.20.2-r0
nginx-mod-http-redis2-1.20.2-r0
nginx-mod-http-set-misc-1.20.2-r0
nginx-mod-http-upload-progress-1.20.2-r0
nginx-mod-http-xslt-filter-1.20.2-r0
nginx-mod-mail-1.20.2-r0
nginx-mod-rtmp-1.20.2-r0
nginx-mod-stream-1.20.2-r0
nginx-mod-stream-geoip2-1.20.2-r0
nginx-vim-1.20.2-r0
nginx-1.20.2-r1
nginx-mod-devel-kit-1.20.2-r1
nginx-mod-http-brotli-1.20.2-r1
nginx-mod-http-dav-ext-1.20.2-r1
nginx-mod-http-echo-1.20.2-r1
nginx-mod-http-fancyindex-1.20.2-r1
nginx-mod-http-geoip2-1.20.2-r1
nginx-mod-http-headers-more-1.20.2-r1
nginx-mod-http-image-filter-1.20.2-r1
nginx-mod-http-nchan-1.20.2-r1
nginx-mod-http-perl-1.20.2-r1
nginx-mod-http-redis2-1.20.2-r1
nginx-mod-http-set-misc-1.20.2-r1
nginx-mod-http-upload-progress-1.20.2-r1
nginx-mod-http-xslt-filter-1.20.2-r1
nginx-mod-mail-1.20.2-r1
nginx-mod-rtmp-1.20.2-r1
nginx-mod-stream-1.20.2-r1
nginx-mod-stream-geoip2-1.20.2-r1
nginx-vim-1.20.2-r1
npth-1.6-r0
oniguruma-6.9.7.1-r0
openssl-1.1.1l-r0
openssl-1.1.1n-r0
p11-kit-0.23.22-r0
pcre-8.44-r0
pcre2-10.36-r0
perl-5.32.1-r0
perl-error-0.17029-r1
perl-git-2.32.0-r0
perl-git-2.32.1-r0
php7-7.4.26-r0
php7-bcmath-7.4.26-r0
php7-bz2-7.4.26-r0
@@ -216,12 +216,12 @@ scanelf-1.3.2-r0
shadow-4.8.1-r0
skalibs-2.10.0.3-r0
sqlite-libs-3.35.5-r0
ssl_client-1.33.1-r6
tzdata-2021e-r0
ssl_client-1.33.1-r7
tzdata-2022a-r0
unixodbc-2.3.9-r1
utmps-0.1.0.2-r0
whois-5.5.10-r0
xz-5.2.5-r0
xz-libs-5.2.5-r0
zlib-1.2.11-r3
xz-5.2.5-r1
xz-libs-5.2.5-r1
zlib-1.2.12-r0
zstd-libs-1.4.9-r1

View File

@@ -51,7 +51,7 @@ opt_param_usage_include_env: true
opt_param_env_vars:
- { env_var: "SUBDOMAINS", env_value: "www,", desc: "Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this _exactly_ to `wildcard` (wildcard cert is available via `dns` and `duckdns` validation only)" }
- { env_var: "CERTPROVIDER", env_value: "", desc: "Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt." }
- { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `domeneshop`, `gandi`, `gehirn`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud`, `transip` and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
- { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `domeneshop`, `gandi`, `gehirn`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip` and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
- { env_var: "PROPAGATION", env_value: "", desc: "Optionally override (in seconds) the default propagation time for the dns plugins." }
- { env_var: "DUCKDNSTOKEN", env_value: "", desc: "Required if `VALIDATION` is set to `duckdns`. Retrieve your token from https://www.duckdns.org" }
- { env_var: "EMAIL", env_value: "", desc: "Optional e-mail address used for cert expiration notifications (Required for ZeroSSL)." }
@@ -120,11 +120,12 @@ app_setup_block: |
### Using fail2ban
* This container includes fail2ban set up with 4 jails by default:
* This container includes fail2ban set up with 5 jails by default:
1. nginx-http-auth
2. nginx-badbots
3. nginx-botsearch
4. nginx-deny
5. nginx-unauthorized
* To enable or disable other jails, modify the file `/config/fail2ban/jail.local`
* To modify filters and actions, instead of editing the `.conf` files, create `.local` files with the same name and edit those because .conf files get overwritten when the actions and filters are updated. `.local` files will append whatever's in the `.conf` files (ie. `nginx-http-auth.conf` --> `nginx-http-auth.local`)
* You can check which jails are active via `docker exec -it swag fail2ban-client status`
@@ -154,6 +155,9 @@ app_setup_nginx_reverse_proxy_block: ""
# changelog
changelogs:
- { date: "09.04.22:", desc: "Added certbot-dns-loopia for DNS01 validation." }
- { date: "05.04.22:", desc: "Added support for standalone DNS validation." }
- { date: "28.03.22:", desc: "created a logfile for fail2ban nginx-unauthorized in /etc/cont-init.d/50-config" }
- { date: "09.01.22:", desc: "Added a fail2ban jail for nginx unauthorized" }
- { date: "21.12.21:", desc: "Fixed issue with iptables not working as expected" }
- { date: "30.11.21:", desc: "Move maxmind to a [new mod](https://github.com/linuxserver/docker-mods/tree/swag-maxmind)" }

View File

@@ -0,0 +1,3 @@
# Replace with your values
dns_loopia_user = user@loopiaapi
dns_loopia_password = passwordgoeshere

View File

@@ -0,0 +1,8 @@
# Instructions: https://github.com/siilike/certbot-dns-standalone/blob/master/README.rst
# Make sure to expose UDP port 53 from your swag container:
# - for docker cli, add argument: `-p 53:53/udp`
# - for docker-compose, add the following line under ports: `- 53:53/udp`
# This file does not need to be changed:
# - no credentials are required
# - it's not used and only for informational purpose
# - prepare the correct DNS records as described in the plugin instructions instead

View File

@@ -120,7 +120,7 @@ if ! grep -q 'PARAMETERS' "/config/nginx/dhparams.pem"; then
fi
# check to make sure DNSPLUGIN is selected if dns validation is used
[[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(aliyun|cloudflare|cloudxns|cpanel|desec|digitalocean|directadmin|dnsimple|dnsmadeeasy|dnspod|domeneshop|gandi|gehirn|google|he|hetzner|infomaniak|inwx|ionos|linode|luadns|netcup|njalla|nsone|ovh|rfc2136|route53|sakuracloud|transip|vultr)$ ]] && \
[[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(aliyun|cloudflare|cloudxns|cpanel|desec|digitalocean|directadmin|dnsimple|dnsmadeeasy|dnspod|domeneshop|gandi|gehirn|google|he|hetzner|infomaniak|inwx|ionos|linode|loopia|luadns|netcup|njalla|nsone|ovh|rfc2136|route53|sakuracloud|standalone|transip|vultr)$ ]] && \
echo "Please set the DNSPLUGIN variable to a valid plugin name. See docker info for more details." && \
sleep infinity
@@ -234,9 +234,12 @@ if [ "$VALIDATION" = "dns" ]; then
elif [[ "$DNSPLUGIN" =~ ^(google)$ ]]; then
if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.json ${PROPAGATIONPARAM}"
elif [[ "$DNSPLUGIN" =~ ^(aliyun|desec|dnspod|domeneshop|he|hetzner|infomaniak|inwx|ionos|netcup|njalla|transip|vultr)$ ]]; then
elif [[ "$DNSPLUGIN" =~ ^(aliyun|desec|dnspod|domeneshop|he|hetzner|infomaniak|inwx|ionos|loopia|netcup|njalla|transip|vultr)$ ]]; then
if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
PREFCHAL="-a dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
elif [[ "$DNSPLUGIN" =~ ^(standalone)$ ]]; then
if [ -n "$PROPAGATION" ];then echo "standalone dns plugin does not support setting propagation time"; fi
PREFCHAL="-a dns-${DNSPLUGIN}"
elif [[ "$DNSPLUGIN" =~ ^(directadmin)$ ]]; then
if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
PREFCHAL="-a ${DNSPLUGIN} --${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
@@ -366,6 +369,8 @@ fi
touch /config/log/nginx/error.log
[[ ! -f /config/log/nginx/access.log ]] && \
touch /config/log/nginx/access.log
[[ ! -f /config/log/nginx/unauthorized.log ]] && \
touch /config/log/nginx/unauthorized.log
# permissions
chown -R abc:abc \