Bot Updating Package Versions

Merge pull request #169 from linuxserver/standard-base
Standard base
2026-03-03 00:43:34 +09:00 · 2022-09-22 17:20:05 +02:00 · 2022-09-22 11:14:11 -04:00 · 2022-09-22 01:11:18 -05:00 · 2022-09-22 01:05:41 -05:00 · 2022-09-08 12:07:12 -05:00
40 changed files with 814 additions and 1087 deletions
--- a/121
+++ b/121
@@ -1,4 +1,4 @@
-FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.14
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.15

 # set version label
 ARG BUILD_DATE
@@ -47,49 +47,51 @@ RUN \
    nginx-mod-stream \
    nginx-mod-stream-geoip2 \
    nginx-vim \
-    php7-bcmath \
-    php7-bz2 \
-    php7-ctype \
-    php7-curl \
-    php7-dom \
-    php7-exif \
-    php7-ftp \
-    php7-gd \
-    php7-gmp \
-    php7-iconv \
-    php7-imap \
-    php7-intl \
-    php7-ldap \
-    php7-mcrypt \
-    php7-memcached \
-    php7-mysqli \
-    php7-mysqlnd \
-    php7-opcache \
-    php7-pdo_mysql \
-    php7-pdo_odbc \
-    php7-pdo_pgsql \
-    php7-pdo_sqlite \
-    php7-pear \
-    php7-pecl-apcu \
-    php7-pecl-mailparse \
-    php7-pecl-redis \
-    php7-pgsql \
-    php7-phar \
-    php7-posix \
-    php7-soap \
-    php7-sockets \
-    php7-sodium \
-    php7-sqlite3 \
-    php7-tokenizer \
-    php7-xml \
-    php7-xmlreader \
-    php7-xmlrpc \
-    php7-xsl \
-    php7-zip \
+    php8-bcmath \
+    php8-bz2 \
+    php8-ctype \
+    php8-curl \
+    php8-dom \
+    php8-exif \
+    php8-ftp \
+    php8-gd \
+    php8-gmp \
+    php8-iconv \
+    php8-imap \
+    php8-intl \
+    php8-ldap \
+    php8-mysqli \
+    php8-mysqlnd \
+    php8-opcache \
+    php8-pdo_mysql \
+    php8-pdo_odbc \
+    php8-pdo_pgsql \
+    php8-pdo_sqlite \
+    php8-pear \
+    php8-pecl-apcu \
+    php8-pecl-mailparse \
+    php8-pecl-mcrypt \
+    php8-pecl-memcached \
+    php8-pecl-redis \
+    php8-pgsql \
+    php8-phar \
+    php8-posix \
+    php8-soap \
+    php8-sockets \
+    php8-sodium \
+    php8-sqlite3 \
+    php8-tokenizer \
+    php8-xml \
+    php8-xmlreader \
+    php8-xsl \
+    php8-zip \
    py3-cryptography \
    py3-future \
    py3-pip \
    whois && \
+  apk add --no-cache \
+    --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing \
+    php8-pecl-xmlrpc && \
  echo "**** install certbot plugins ****" && \
  if [ -z ${CERTBOT_VERSION+x} ]; then \
    CERTBOT="certbot"; \
@@ -97,10 +99,11 @@ RUN \
    CERTBOT="certbot==${CERTBOT_VERSION}"; \
  fi && \
  pip3 install -U \
-    pip && \
-  pip3 install -U --find-links https://wheel-index.linuxserver.io/alpine/ \
+    pip wheel && \
+  pip install -U --find-links https://wheel-index.linuxserver.io/alpine-3.15/ \
    ${CERTBOT} \
    certbot-dns-aliyun \
+    certbot-dns-azure \
    certbot-dns-cloudflare \
    certbot-dns-cloudxns \
    certbot-dns-cpanel \
@@ -111,6 +114,7 @@ RUN \
    certbot-dns-dnsmadeeasy \
    certbot-dns-dnspod \
    certbot-dns-domeneshop \
+    certbot-dns-dynu \
    certbot-dns-google \
    certbot-dns-he \
    certbot-dns-hetzner \
@@ -118,6 +122,7 @@ RUN \
    certbot-dns-inwx \
    certbot-dns-ionos \
    certbot-dns-linode \
+    certbot-dns-loopia \
    certbot-dns-luadns \
    certbot-dns-netcup \
    certbot-dns-njalla \
@@ -125,12 +130,23 @@ RUN \
    certbot-dns-ovh \
    certbot-dns-rfc2136 \
    certbot-dns-route53 \
+    certbot-dns-standalone \
    certbot-dns-transip \
    certbot-dns-vultr \
    certbot-dns-desec \
    certbot-plugin-gandi \
    cryptography \
    requests && \
+  echo "**** enable OCSP stapling from base ****" && \
+  sed -i \
+    's|#ssl_stapling on;|ssl_stapling on;|' \
+    /defaults/nginx/ssl.conf.sample && \
+  sed -i \
+    's|#ssl_stapling_verify on;|ssl_stapling_verify on;|' \
+    /defaults/nginx/ssl.conf.sample && \
+  sed -i \
+    's|#ssl_trusted_certificate /config/keys/cert.crt;|ssl_trusted_certificate /config/keys/cert.crt;|' \
+    /defaults/nginx/ssl.conf.sample && \
  echo "**** correct ip6tables legacy issue ****" && \
  rm \ 
    /sbin/ip6tables && \
@@ -139,20 +155,19 @@ RUN \
  echo "**** remove unnecessary fail2ban filters ****" && \
  rm \
    /etc/fail2ban/jail.d/alpine-ssh.conf && \
-  echo "**** copy fail2ban default action and filter to /default ****" && \
+  echo "**** copy fail2ban default action and filter to /defaults ****" && \
  mkdir -p /defaults/fail2ban && \
  mv /etc/fail2ban/action.d /defaults/fail2ban/ && \
  mv /etc/fail2ban/filter.d /defaults/fail2ban/ && \
-  echo "**** copy proxy confs to /default ****" && \
-  mkdir -p /defaults/proxy-confs && \
+  echo "**** copy proxy confs to /defaults ****" && \
+  mkdir -p \
+    /defaults/nginx/proxy-confs && \
  curl -o \
-    /tmp/proxy.tar.gz -L \
+    /tmp/proxy-confs.tar.gz -L \
    "https://github.com/linuxserver/reverse-proxy-confs/tarball/master" && \
  tar xf \
-    /tmp/proxy.tar.gz -C \
-    /defaults/proxy-confs --strip-components=1 --exclude=linux*/.gitattributes --exclude=linux*/.github --exclude=linux*/.gitignore --exclude=linux*/LICENSE && \
-  echo "**** configure nginx ****" && \
-  rm -f /etc/nginx/http.d/default.conf && \
+    /tmp/proxy-confs.tar.gz -C \
+    /defaults/nginx/proxy-confs --strip-components=1 --exclude=linux*/.editorconfig --exclude=linux*/.gitattributes --exclude=linux*/.github --exclude=linux*/.gitignore --exclude=linux*/LICENSE && \
  echo "**** cleanup ****" && \
  apk del --purge \
    build-dependencies && \
@@ -165,5 +180,9 @@ RUN \
    /root/.cache \
    /root/.cargo

-# add local files
+# copy local files
 COPY root/ /
+
+# ports and volumes
+EXPOSE 80 443
+VOLUME /config
--- a/Dockerfile.aarch64
+++ b/Dockerfile.aarch64
@@ -1,4 +1,4 @@
-FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.14
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.15

 # set version label
 ARG BUILD_DATE
@@ -47,49 +47,51 @@ RUN \
    nginx-mod-stream \
    nginx-mod-stream-geoip2 \
    nginx-vim \
-    php7-bcmath \
-    php7-bz2 \
-    php7-ctype \
-    php7-curl \
-    php7-dom \
-    php7-exif \
-    php7-ftp \
-    php7-gd \
-    php7-gmp \
-    php7-iconv \
-    php7-imap \
-    php7-intl \
-    php7-ldap \
-    php7-mcrypt \
-    php7-memcached \
-    php7-mysqli \
-    php7-mysqlnd \
-    php7-opcache \
-    php7-pdo_mysql \
-    php7-pdo_odbc \
-    php7-pdo_pgsql \
-    php7-pdo_sqlite \
-    php7-pear \
-    php7-pecl-apcu \
-    php7-pecl-mailparse \
-    php7-pecl-redis \
-    php7-pgsql \
-    php7-phar \
-    php7-posix \
-    php7-soap \
-    php7-sockets \
-    php7-sodium \
-    php7-sqlite3 \
-    php7-tokenizer \
-    php7-xml \
-    php7-xmlreader \
-    php7-xmlrpc \
-    php7-xsl \
-    php7-zip \
+    php8-bcmath \
+    php8-bz2 \
+    php8-ctype \
+    php8-curl \
+    php8-dom \
+    php8-exif \
+    php8-ftp \
+    php8-gd \
+    php8-gmp \
+    php8-iconv \
+    php8-imap \
+    php8-intl \
+    php8-ldap \
+    php8-mysqli \
+    php8-mysqlnd \
+    php8-opcache \
+    php8-pdo_mysql \
+    php8-pdo_odbc \
+    php8-pdo_pgsql \
+    php8-pdo_sqlite \
+    php8-pear \
+    php8-pecl-apcu \
+    php8-pecl-mailparse \
+    php8-pecl-mcrypt \
+    php8-pecl-memcached \
+    php8-pecl-redis \
+    php8-pgsql \
+    php8-phar \
+    php8-posix \
+    php8-soap \
+    php8-sockets \
+    php8-sodium \
+    php8-sqlite3 \
+    php8-tokenizer \
+    php8-xml \
+    php8-xmlreader \
+    php8-xsl \
+    php8-zip \
    py3-cryptography \
    py3-future \
    py3-pip \
    whois && \
+  apk add --no-cache \
+    --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing \
+    php8-pecl-xmlrpc && \
  echo "**** install certbot plugins ****" && \
  if [ -z ${CERTBOT_VERSION+x} ]; then \
    CERTBOT="certbot"; \
@@ -97,10 +99,11 @@ RUN \
    CERTBOT="certbot==${CERTBOT_VERSION}"; \
  fi && \
  pip3 install -U \
-    pip && \
-  pip3 install -U --find-links https://wheel-index.linuxserver.io/alpine/ \
+    pip wheel && \
+  pip install -U --find-links https://wheel-index.linuxserver.io/alpine-3.15/ \
    ${CERTBOT} \
    certbot-dns-aliyun \
+    certbot-dns-azure \
    certbot-dns-cloudflare \
    certbot-dns-cloudxns \
    certbot-dns-cpanel \
@@ -111,6 +114,7 @@ RUN \
    certbot-dns-dnsmadeeasy \
    certbot-dns-dnspod \
    certbot-dns-domeneshop \
+    certbot-dns-dynu \
    certbot-dns-google \
    certbot-dns-he \
    certbot-dns-hetzner \
@@ -118,6 +122,7 @@ RUN \
    certbot-dns-inwx \
    certbot-dns-ionos \
    certbot-dns-linode \
+    certbot-dns-loopia \
    certbot-dns-luadns \
    certbot-dns-netcup \
    certbot-dns-njalla \
@@ -125,12 +130,23 @@ RUN \
    certbot-dns-ovh \
    certbot-dns-rfc2136 \
    certbot-dns-route53 \
+    certbot-dns-standalone \
    certbot-dns-transip \
    certbot-dns-vultr \
    certbot-dns-desec \
    certbot-plugin-gandi \
    cryptography \
    requests && \
+  echo "**** enable OCSP stapling from base ****" && \
+  sed -i \
+    's|#ssl_stapling on;|ssl_stapling on;|' \
+    /defaults/nginx/ssl.conf.sample && \
+  sed -i \
+    's|#ssl_stapling_verify on;|ssl_stapling_verify on;|' \
+    /defaults/nginx/ssl.conf.sample && \
+  sed -i \
+    's|#ssl_trusted_certificate /config/keys/cert.crt;|ssl_trusted_certificate /config/keys/cert.crt;|' \
+    /defaults/nginx/ssl.conf.sample && \
  echo "**** correct ip6tables legacy issue ****" && \
  rm \ 
    /sbin/ip6tables && \
@@ -139,20 +155,19 @@ RUN \
  echo "**** remove unnecessary fail2ban filters ****" && \
  rm \
    /etc/fail2ban/jail.d/alpine-ssh.conf && \
-  echo "**** copy fail2ban default action and filter to /default ****" && \
+  echo "**** copy fail2ban default action and filter to /defaults ****" && \
  mkdir -p /defaults/fail2ban && \
  mv /etc/fail2ban/action.d /defaults/fail2ban/ && \
  mv /etc/fail2ban/filter.d /defaults/fail2ban/ && \
-  echo "**** copy proxy confs to /default ****" && \
-  mkdir -p /defaults/proxy-confs && \
+  echo "**** copy proxy confs to /defaults ****" && \
+  mkdir -p \
+    /defaults/nginx/proxy-confs && \
  curl -o \
-    /tmp/proxy.tar.gz -L \
+    /tmp/proxy-confs.tar.gz -L \
    "https://github.com/linuxserver/reverse-proxy-confs/tarball/master" && \
  tar xf \
-    /tmp/proxy.tar.gz -C \
-    /defaults/proxy-confs --strip-components=1 --exclude=linux*/.gitattributes --exclude=linux*/.github --exclude=linux*/.gitignore --exclude=linux*/LICENSE && \
-  echo "**** configure nginx ****" && \
-  rm -f /etc/nginx/http.d/default.conf && \
+    /tmp/proxy-confs.tar.gz -C \
+    /defaults/nginx/proxy-confs --strip-components=1 --exclude=linux*/.editorconfig --exclude=linux*/.gitattributes --exclude=linux*/.github --exclude=linux*/.gitignore --exclude=linux*/LICENSE && \
  echo "**** cleanup ****" && \
  apk del --purge \
    build-dependencies && \
@@ -165,5 +180,9 @@ RUN \
    /root/.cache \
    /root/.cargo

-# add local files
+# copy local files
 COPY root/ /
+
+# ports and volumes
+EXPOSE 80 443
+VOLUME /config
--- a/Dockerfile.armhf
+++ b/Dockerfile.armhf
@@ -1,4 +1,4 @@
-FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm32v7-3.14
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm32v7-3.15

 # set version label
 ARG BUILD_DATE
@@ -47,49 +47,51 @@ RUN \
    nginx-mod-stream \
    nginx-mod-stream-geoip2 \
    nginx-vim \
-    php7-bcmath \
-    php7-bz2 \
-    php7-ctype \
-    php7-curl \
-    php7-dom \
-    php7-exif \
-    php7-ftp \
-    php7-gd \
-    php7-gmp \
-    php7-iconv \
-    php7-imap \
-    php7-intl \
-    php7-ldap \
-    php7-mcrypt \
-    php7-memcached \
-    php7-mysqli \
-    php7-mysqlnd \
-    php7-opcache \
-    php7-pdo_mysql \
-    php7-pdo_odbc \
-    php7-pdo_pgsql \
-    php7-pdo_sqlite \
-    php7-pear \
-    php7-pecl-apcu \
-    php7-pecl-mailparse \
-    php7-pecl-redis \
-    php7-pgsql \
-    php7-phar \
-    php7-posix \
-    php7-soap \
-    php7-sockets \
-    php7-sodium \
-    php7-sqlite3 \
-    php7-tokenizer \
-    php7-xml \
-    php7-xmlreader \
-    php7-xmlrpc \
-    php7-xsl \
-    php7-zip \
+    php8-bcmath \
+    php8-bz2 \
+    php8-ctype \
+    php8-curl \
+    php8-dom \
+    php8-exif \
+    php8-ftp \
+    php8-gd \
+    php8-gmp \
+    php8-iconv \
+    php8-imap \
+    php8-intl \
+    php8-ldap \
+    php8-mysqli \
+    php8-mysqlnd \
+    php8-opcache \
+    php8-pdo_mysql \
+    php8-pdo_odbc \
+    php8-pdo_pgsql \
+    php8-pdo_sqlite \
+    php8-pear \
+    php8-pecl-apcu \
+    php8-pecl-mailparse \
+    php8-pecl-mcrypt \
+    php8-pecl-memcached \
+    php8-pecl-redis \
+    php8-pgsql \
+    php8-phar \
+    php8-posix \
+    php8-soap \
+    php8-sockets \
+    php8-sodium \
+    php8-sqlite3 \
+    php8-tokenizer \
+    php8-xml \
+    php8-xmlreader \
+    php8-xsl \
+    php8-zip \
    py3-cryptography \
    py3-future \
    py3-pip \
    whois && \
+  apk add --no-cache \
+    --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing \
+    php8-pecl-xmlrpc && \
  echo "**** install certbot plugins ****" && \
  if [ -z ${CERTBOT_VERSION+x} ]; then \
    CERTBOT="certbot"; \
@@ -97,10 +99,11 @@ RUN \
    CERTBOT="certbot==${CERTBOT_VERSION}"; \
  fi && \
  pip3 install -U \
-    pip && \
-  pip3 install -U --find-links https://wheel-index.linuxserver.io/alpine/ \
+    pip wheel && \
+  pip install -U --find-links https://wheel-index.linuxserver.io/alpine-3.15/ \
    ${CERTBOT} \
    certbot-dns-aliyun \
+    certbot-dns-azure \
    certbot-dns-cloudflare \
    certbot-dns-cloudxns \
    certbot-dns-cpanel \
@@ -111,6 +114,7 @@ RUN \
    certbot-dns-dnsmadeeasy \
    certbot-dns-dnspod \
    certbot-dns-domeneshop \
+    certbot-dns-dynu \
    certbot-dns-google \
    certbot-dns-he \
    certbot-dns-hetzner \
@@ -118,6 +122,7 @@ RUN \
    certbot-dns-inwx \
    certbot-dns-ionos \
    certbot-dns-linode \
+    certbot-dns-loopia \
    certbot-dns-luadns \
    certbot-dns-netcup \
    certbot-dns-njalla \
@@ -125,11 +130,22 @@ RUN \
    certbot-dns-ovh \
    certbot-dns-rfc2136 \
    certbot-dns-route53 \
+    certbot-dns-standalone \
    certbot-dns-transip \
    certbot-dns-vultr \
    certbot-plugin-gandi \
    cryptography \
    requests && \
+  echo "**** enable OCSP stapling from base ****" && \
+  sed -i \
+    's|#ssl_stapling on;|ssl_stapling on;|' \
+    /defaults/nginx/ssl.conf.sample && \
+  sed -i \
+    's|#ssl_stapling_verify on;|ssl_stapling_verify on;|' \
+    /defaults/nginx/ssl.conf.sample && \
+  sed -i \
+    's|#ssl_trusted_certificate /config/keys/cert.crt;|ssl_trusted_certificate /config/keys/cert.crt;|' \
+    /defaults/nginx/ssl.conf.sample && \
  echo "**** correct ip6tables legacy issue ****" && \
  rm \ 
    /sbin/ip6tables && \
@@ -138,20 +154,19 @@ RUN \
  echo "**** remove unnecessary fail2ban filters ****" && \
  rm \
    /etc/fail2ban/jail.d/alpine-ssh.conf && \
-  echo "**** copy fail2ban default action and filter to /default ****" && \
+  echo "**** copy fail2ban default action and filter to /defaults ****" && \
  mkdir -p /defaults/fail2ban && \
  mv /etc/fail2ban/action.d /defaults/fail2ban/ && \
  mv /etc/fail2ban/filter.d /defaults/fail2ban/ && \
-  echo "**** copy proxy confs to /default ****" && \
-  mkdir -p /defaults/proxy-confs && \
+  echo "**** copy proxy confs to /defaults ****" && \
+  mkdir -p \
+    /defaults/nginx/proxy-confs && \
  curl -o \
-    /tmp/proxy.tar.gz -L \
+    /tmp/proxy-confs.tar.gz -L \
    "https://github.com/linuxserver/reverse-proxy-confs/tarball/master" && \
  tar xf \
-    /tmp/proxy.tar.gz -C \
-    /defaults/proxy-confs --strip-components=1 --exclude=linux*/.gitattributes --exclude=linux*/.github --exclude=linux*/.gitignore --exclude=linux*/LICENSE && \
-  echo "**** configure nginx ****" && \
-  rm -f /etc/nginx/http.d/default.conf && \
+    /tmp/proxy-confs.tar.gz -C \
+    /defaults/nginx/proxy-confs --strip-components=1 --exclude=linux*/.editorconfig --exclude=linux*/.gitattributes --exclude=linux*/.github --exclude=linux*/.gitignore --exclude=linux*/LICENSE && \
  echo "**** cleanup ****" && \
  apk del --purge \
    build-dependencies && \
@@ -164,5 +179,9 @@ RUN \
    /root/.cache \
    /root/.cargo

-# add local files
+# copy local files
 COPY root/ /
+
+# ports and volumes
+EXPOSE 80 443
+VOLUME /config
--- a/10
+++ b/10
@@ -343,9 +343,11 @@ pipeline {
              if [[ ("${BRANCH_NAME}" == "master") || ("${BRANCH_NAME}" == "main") ]] && [[ (! -f ${TEMPDIR}/unraid/templates/unraid/${CONTAINER_NAME}.xml) || ("$(md5sum ${TEMPDIR}/unraid/templates/unraid/${CONTAINER_NAME}.xml | awk '{ print $1 }')" != "$(md5sum ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml | awk '{ print $1 }')") ]]; then
                cd ${TEMPDIR}/unraid/templates/
                if grep -wq "${CONTAINER_NAME}" ${TEMPDIR}/unraid/templates/unraid/ignore.list; then
-                  echo "Image is on the ignore list, removing Unraid template"
-                  git rm unraid/${CONTAINER_NAME}.xml || :
-                  git commit -m 'Bot Removing Deprecated Unraid Template' || :
+                  echo "Image is on the ignore list, marking Unraid template as deprecated"
+                  cp ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml ${TEMPDIR}/unraid/templates/unraid/
+                  git add -u unraid/${CONTAINER_NAME}.xml
+                  git mv unraid/${CONTAINER_NAME}.xml unraid/deprecated/${CONTAINER_NAME}.xml || :
+                  git commit -m 'Bot Moving Deprecated Unraid Template' || :
                else
                  cp ${TEMPDIR}/docker-${CONTAINER_NAME}/.jenkins-external/${CONTAINER_NAME}.xml ${TEMPDIR}/unraid/templates/unraid/
                  git add unraid/${CONTAINER_NAME}.xml
@@ -708,7 +710,7 @@ pipeline {
                -e DO_REGION="ams3" \
                -e DO_BUCKET="lsio-ci" \
                -t ghcr.io/linuxserver/ci:latest \
-                python /ci/ci.py'''
+                python3 test_build.py'''
        }
      }
    }
--- a/README.md
+++ b/README.md
@@ -46,17 +46,17 @@ SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relatio

 ## Supported Architectures

-Our images support multiple architectures such as `x86-64`, `arm64` and `armhf`. We utilise the docker manifest for multi-platform awareness. More information is available from docker [here](https://github.com/docker/distribution/blob/master/docs/spec/manifest-v2-2.md#manifest-list) and our announcement [here](https://blog.linuxserver.io/2019/02/21/the-lsio-pipeline-project/).
+We utilise the docker manifest for multi-platform awareness. More information is available from docker [here](https://github.com/docker/distribution/blob/master/docs/spec/manifest-v2-2.md#manifest-list) and our announcement [here](https://blog.linuxserver.io/2019/02/21/the-lsio-pipeline-project/).

-Simply pulling `lscr.io/linuxserver/swag` should retrieve the correct image for your arch, but you can also pull specific arch images via tags.
+Simply pulling `lscr.io/linuxserver/swag:latest` should retrieve the correct image for your arch, but you can also pull specific arch images via tags.

 The architectures supported by this image are:

-| Architecture | Tag |
-| :----: | --- |
-| x86-64 | amd64-latest |
-| arm64 | arm64v8-latest |
-| armhf | arm32v7-latest |
+| Architecture | Available | Tag |
+| :----: | :----: | ---- |
+| x86-64 | ✅ | amd64-\<version tag\> |
+| arm64 | ✅ | arm64v8-\<version tag\> |
+| armhf| ✅ | arm32v7-\<version tag\> |

 ## Application Setup

@@ -70,7 +70,7 @@ The architectures supported by this image are:
 * For `duckdns` validation, either leave the `SUBDOMAINS` variable empty or set it to `wildcard`, and set the `DUCKDNSTOKEN` variable with your duckdns token. Due to a limitation of duckdns, the resulting cert will only cover either main subdomain (ie. `yoursubdomain.duckdns.org`), or sub-subdomains (ie. `*.yoursubdomain.duckdns.org`), but will not both at the same time. You can use our [duckdns image](https://hub.docker.com/r/linuxserver/duckdns/) to update your IP on duckdns.org.
 * `--cap-add=NET_ADMIN` is required for fail2ban to modify iptables
 * If you need a dynamic dns provider, you can use the free provider duckdns.org where the `URL` will be `yoursubdomain.duckdns.org` and the `SUBDOMAINS` can be `www,ftp,cloud` with http validation, or `wildcard` with dns validation.
-* After setup, navigate to `https://yourdomain.url` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default`).
+* After setup, navigate to `https://yourdomain.url` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default.conf`).
 * Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from Let's Encrypt in those circumstances.

 ### Security and password protection
@@ -83,7 +83,7 @@ The architectures supported by this image are:

 ### Site config and reverse proxy

-* The default site config resides at `/config/nginx/site-confs/default`. Feel free to modify this file, and you can add other conf files to this directory. However, if you delete the `default` file, a new default will be created on container start.
+* The default site config resides at `/config/nginx/site-confs/default.conf`. Feel free to modify this file, and you can add other conf files to this directory. However, if you delete the `default` file, a new default will be created on container start.
 * Preset reverse proxy config files are added for popular apps. See the `README.md` file under `/config/nginx/proxy_confs` for instructions on how to enable them. The preset confs reside in and get imported from [this repo](https://github.com/linuxserver/reverse-proxy-confs).
 * If you wish to hide your site from search engine crawlers, you may find it useful to add this configuration line to your site config, within the server block, above the line where ssl.conf is included
 `add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";`
@@ -94,8 +94,8 @@ This will *ask* Google et al not to index and list your site. Be careful with th

 * This container includes auto-generated pfx and private-fullchain-bundle pem certs that are needed by other apps like Emby and Znc.
  * To use these certs in other containers, do either of the following:
-  1. *(Easier)* Mount the container's config folder in other containers (ie. `-v /path-to-le-config:/le-ssl`) and in the other containers, use the cert location `/le-ssl/keys/letsencrypt/`
-  2. *(More secure)* Mount the SWAG folder `etc` that resides under `/config` in other containers (ie. `-v /path-to-le-config/etc:/le-ssl`) and in the other containers, use the cert location `/le-ssl/letsencrypt/live/<your.domain.url>/` (This is more secure because the first method shares the entire SWAG config folder with other containers, including the www files, whereas the second method only shares the ssl certs)
+  1. *(Easier)* Mount the container's config folder in other containers (ie. `-v /path-to-swag-config:/swag-ssl`) and in the other containers, use the cert location `/swag-ssl/keys/letsencrypt/`
+  2. *(More secure)* Mount the SWAG folder `etc` that resides under `/config` in other containers (ie. `-v /path-to-swag-config/etc:/swag-ssl`) and in the other containers, use the cert location `/swag-ssl/letsencrypt/live/<your.domain.url>/` (This is more secure because the first method shares the entire SWAG config folder with other containers, including the www files, whereas the second method only shares the ssl certs)
  * These certs include:
  1. `cert.pem`, `chain.pem`, `fullchain.pem` and `privkey.pem`, which are generated by Certbot and used by nginx and various other apps
  2. `privkey.pfx`, a format supported by Microsoft and commonly used by dotnet apps such as Emby Server (no password)
@@ -103,11 +103,12 @@ This will *ask* Google et al not to index and list your site. Be careful with th

 ### Using fail2ban

-* This container includes fail2ban set up with 4 jails by default:
+* This container includes fail2ban set up with 5 jails by default:
  1. nginx-http-auth
  2. nginx-badbots
  3. nginx-botsearch
  4. nginx-deny
+  5. nginx-unauthorized
 * To enable or disable other jails, modify the file `/config/fail2ban/jail.local`
 * To modify filters and actions, instead of editing the `.conf` files, create `.local` files with the same name and edit those because .conf files get overwritten when the actions and filters are updated. `.local` files will append whatever's in the `.conf` files (ie. `nginx-http-auth.conf` --> `nginx-http-auth.local`)
 * You can check which jails are active via `docker exec -it swag fail2ban-client status`
@@ -143,7 +144,7 @@ Here are some example snippets to help you get started creating a container.
 version: "2.1"
 services:
  swag:
-    image: lscr.io/linuxserver/swag
+    image: lscr.io/linuxserver/swag:latest
    container_name: swag
    cap_add:
      - NET_ADMIN
@@ -194,7 +195,7 @@ docker run -d \
  -p 80:80 `#optional` \
  -v /path/to/appdata/config:/config \
  --restart unless-stopped \
-  lscr.io/linuxserver/swag
+  lscr.io/linuxserver/swag:latest
 ```

 ## Parameters
@@ -212,7 +213,7 @@ Container images are configured using parameters passed at runtime (such as thos
 | `-e VALIDATION=http` | Certbot validation method to use, options are `http`, `dns` or `duckdns` (`dns` method also requires `DNSPLUGIN` variable set) (`duckdns` method requires `DUCKDNSTOKEN` variable set, and the `SUBDOMAINS` variable must be either empty or set to `wildcard`). |
 | `-e SUBDOMAINS=www,` | Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this _exactly_ to `wildcard` (wildcard cert is available via `dns` and `duckdns` validation only) |
 | `-e CERTPROVIDER=` | Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt. |
-| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `domeneshop`, `gandi`, `gehirn`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud`, `transip` and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. |
+| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `azure`, `cloudflare`, `cloudxns`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `domeneshop`, `dynu`, `gandi`, `gehirn`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip` and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. |
 | `-e PROPAGATION=` | Optionally override (in seconds) the default propagation time for the dns plugins. |
 | `-e DUCKDNSTOKEN=` | Required if `VALIDATION` is set to `duckdns`. Retrieve your token from https://www.duckdns.org |
 | `-e EMAIL=` | Optional e-mail address used for cert expiration notifications (Required for ZeroSSL). |
@@ -221,6 +222,10 @@ Container images are configured using parameters passed at runtime (such as thos
 | `-e STAGING=false` | Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes. |
 | `-v /config` | All the config files including the webroot reside here. |

+### Portainer notice
+
+This image utilises `cap_add` or `sysctl` to work properly. This is not implemented properly in some versions of Portainer, thus this image may not work if deployed through Portainer.
+
 ## Environment variables from files (Docker secrets)

 You can set any environment variable from a file by using a special prepend `FILE__`.
@@ -264,7 +269,7 @@ We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to
 * container version number
  * `docker inspect -f '{{ index .Config.Labels "build_version" }}' swag`
 * image version number
-  * `docker inspect -f '{{ index .Config.Labels "build_version" }}' lscr.io/linuxserver/swag`
+  * `docker inspect -f '{{ index .Config.Labels "build_version" }}' lscr.io/linuxserver/swag:latest`

 ## Updating Info

@@ -282,7 +287,7 @@ Below are the instructions for updating containers:

 ### Via Docker Run

-* Update the image: `docker pull lscr.io/linuxserver/swag`
+* Update the image: `docker pull lscr.io/linuxserver/swag:latest`
 * Stop the running container: `docker stop swag`
 * Delete the container: `docker rm swag`
 * Recreate a new container with the same docker run parameters as instructed above (if mapped correctly to a host folder, your `/config` folder and settings will be preserved)
@@ -330,6 +335,12 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64

 ## Versions

+* **20.08.22:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Rebasing to alpine 3.15 with php8. Restructure nginx configs ([see changes announcement](https://info.linuxserver.io/issues/2022-08-20-nginx-base)).
+* **10.08.22:** - Added support for Dynu DNS validation.
+* **18.05.22:** - Added support for Azure DNS validation.
+* **09.04.22:** - Added certbot-dns-loopia for DNS01 validation.
+* **05.04.22:** - Added support for standalone DNS validation.
+* **28.03.22:** - created a logfile for fail2ban nginx-unauthorized in /etc/cont-init.d/50-config
 * **09.01.22:** - Added a fail2ban jail for nginx unauthorized
 * **21.12.21:** - Fixed issue with iptables not working as expected
 * **30.11.21:** - Move maxmind to a [new mod](https://github.com/linuxserver/docker-mods/tree/swag-maxmind)
@@ -360,7 +371,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 * **26.01.21:** - Add support for hetzner dns validation.
 * **20.01.21:** - Add check for ZeroSSL EAB retrieval.
 * **08.01.21:** - Add support for getting certs from [ZeroSSL](https://zerossl.com/) via optional `CERTPROVIDER` env var. Update aliyun, domeneshop, inwx and transip dns plugins with the new plugin names. Hide `donoteditthisfile.conf` because users were editing it despite its name. Suppress harmless error when no proxy confs are enabled.
-* **03.01.21:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) /config/nginx/site-confs/default - Add helper pages to aid troubleshooting
+* **03.01.21:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) /config/nginx/site-confs/default.conf - Add helper pages to aid troubleshooting
 * **10.12.20:** - Add support for njalla dns validation
 * **09.12.20:** - Check for template/conf updates and notify in the log. Add support for gehirn and sakuracloud dns validation.
 * **01.11.20:** - Add support for netcup dns validation
--- a/package_versions.txt
+++ b/package_versions.txt
@@ -1,227 +1,229 @@
-alpine-baselayout-3.2.0-r16
-alpine-keys-2.4-r0
-apache2-utils-2.4.52-r0
-apk-tools-2.12.7-r0
-apr-1.7.0-r0
-apr-util-1.6.1-r7
+alpine-baselayout-3.2.0-r18
+alpine-keys-2.4-r1
+apache2-utils-2.4.54-r0
+apk-tools-2.12.7-r3
+apr-1.7.0-r1
+apr-util-1.6.1-r11
 argon2-libs-20190702-r1
-bash-5.1.4-r0
+bash-5.1.16-r0
 brotli-libs-1.0.9-r5
-busybox-1.33.1-r6
-c-client-2007f-r11
-ca-certificates-20211220-r0
-ca-certificates-bundle-20211220-r0
-coreutils-8.32-r2
-curl-7.79.1-r0
-expat-2.4.6-r0
-fail2ban-0.11.2-r0
-freetype-2.10.4-r1
-gdbm-1.19-r0
-git-2.32.0-r0
-git-perl-2.32.0-r0
-glib-2.68.3-r0
-gmp-6.2.1-r0
-gnupg-2.2.31-r0
-gnutls-3.7.1-r0
-icu-libs-67.1-r2
+busybox-1.34.1-r7
+c-client-2007f-r13
+ca-certificates-20220614-r0
+ca-certificates-bundle-20220614-r0
+coreutils-9.0-r2
+curl-7.80.0-r3
+expat-2.4.9-r0
+fail2ban-0.11.2-r1
+freetype-2.11.1-r2
+gdbm-1.22-r0
+git-2.34.4-r0
+git-perl-2.34.4-r0
+gmp-6.2.1-r1
+gnupg-2.2.31-r2
+gnupg-dirmngr-2.2.31-r2
+gnupg-gpgconf-2.2.31-r2
+gnupg-utils-2.2.31-r2
+gnupg-wks-client-2.2.31-r2
+gnutls-3.7.1-r1
+gpg-2.2.31-r2
+gpg-agent-2.2.31-r2
+gpg-wks-server-2.2.31-r2
+gpgsm-2.2.31-r2
+gpgv-2.2.31-r2
+icu-libs-69.1-r1
 ip6tables-1.8.7-r1
 iptables-1.8.7-r1
 libacl-2.2.53-r0
 libassuan-2.5.5-r0
-libattr-2.5.1-r0
-libblkid-2.37.4-r0
-libbsd-0.11.3-r0
+libattr-2.5.1-r1
+libbsd-0.11.3-r1
 libbz2-1.0.8-r1
 libc-utils-0.7.2-r3
-libcap-2.50-r0
-libcrypto1.1-1.1.1l-r0
-libcurl-7.79.1-r0
-libedit-20210216.3.1-r0
-libevent-2.1.12-r2
-libffi-3.3-r2
-libgcc-10.3.1_git20210424-r2
+libcap-2.61-r0
+libcrypto1.1-1.1.1q-r0
+libcurl-7.80.0-r3
+libedit-20210910.3.1-r0
+libevent-2.1.12-r4
+libffi-3.4.2-r1
+libgcc-10.3.1_git20211027-r0
 libgcrypt-1.9.4-r0
 libgd-2.3.2-r1
-libgpg-error-1.42-r0
+libgpg-error-1.42-r1
 libice-1.0.10-r0
-libidn-1.37-r0
+libidn-1.38-r0
 libintl-0.21-r0
-libjpeg-turbo-2.1.0-r0
-libksba-1.5.1-r0
-libldap-2.4.58-r0
-libmagic-5.40-r1
-libmaxminddb-1.5.2-r0
+libjpeg-turbo-2.1.2-r0
+libksba-1.6.0-r0
+libldap-2.6.2-r0
+libmaxminddb-1.6.0-r0
 libmcrypt-2.5.8-r9
 libmd-1.0.3-r0
 libmemcached-libs-1.0.18-r4
-libmnl-1.0.4-r1
-libmount-2.37.4-r0
-libnftnl-libs-1.2.0-r0
+libmnl-1.0.4-r2
+libnftnl-1.2.1-r0
 libpng-1.6.37-r1
-libpq-13.6-r0
+libpq-14.5-r0
 libproc-3.3.17-r0
-libressl3.3-libcrypto-3.3.3-r0
-libressl3.3-libssl-3.3.3-r0
-libretls-3.3.3p1-r2
-libsasl-2.1.27-r12
-libseccomp-2.5.1-r2
-libsecret-0.20.4-r1
+libretls-3.3.4-r3
+libsasl-2.1.28-r0
+libseccomp-2.5.2-r0
 libsm-1.2.3-r0
 libsodium-1.0.18-r0
-libssl1.1-1.1.1l-r0
-libstdc++-10.3.1_git20210424-r2
-libtasn1-4.17.0-r0
+libssl1.1-1.1.1q-r0
+libstdc++-10.3.1_git20211027-r0
+libtasn1-4.18.0-r0
 libunistring-0.9.10-r1
 libuuid-2.37.4-r0
-libwebp-1.2.0-r2
+libwebp-1.2.2-r0
 libx11-1.7.2-r0
 libxau-1.0.9-r0
 libxcb-1.14-r2
 libxdmcp-1.1.3-r0
 libxext-1.3.4-r0
-libxml2-2.9.12-r1
+libxml2-2.9.14-r1
 libxpm-3.5.13-r0
-libxslt-1.1.34-r1
+libxslt-1.1.35-r0
 libxt-1.2.1-r0
-libzip-1.7.3-r2
-linux-pam-1.5.1-r1
-logrotate-3.18.1-r1
+libzip-1.8.0-r1
+linux-pam-1.5.2-r0
+logrotate-3.18.1-r4
 lz4-libs-1.9.3-r1
-memcached-1.6.9-r0
+memcached-1.6.12-r0
 mpdecimal-2.5.1-r1
-musl-1.2.2-r3
-musl-utils-1.2.2-r3
-nano-5.7-r2
-ncurses-libs-6.2_p20210612-r0
-ncurses-terminfo-base-6.2_p20210612-r0
+musl-1.2.2-r7
+musl-utils-1.2.2-r7
+nano-5.9-r0
+ncurses-libs-6.3_p20211120-r1
+ncurses-terminfo-base-6.3_p20211120-r1
 nettle-3.7.3-r0
-nghttp2-libs-1.43.0-r0
-nginx-1.20.2-r0
-nginx-mod-devel-kit-1.20.2-r0
-nginx-mod-http-brotli-1.20.2-r0
-nginx-mod-http-dav-ext-1.20.2-r0
-nginx-mod-http-echo-1.20.2-r0
-nginx-mod-http-fancyindex-1.20.2-r0
-nginx-mod-http-geoip2-1.20.2-r0
-nginx-mod-http-headers-more-1.20.2-r0
-nginx-mod-http-image-filter-1.20.2-r0
-nginx-mod-http-nchan-1.20.2-r0
-nginx-mod-http-perl-1.20.2-r0
-nginx-mod-http-redis2-1.20.2-r0
-nginx-mod-http-set-misc-1.20.2-r0
-nginx-mod-http-upload-progress-1.20.2-r0
-nginx-mod-http-xslt-filter-1.20.2-r0
-nginx-mod-mail-1.20.2-r0
-nginx-mod-rtmp-1.20.2-r0
-nginx-mod-stream-1.20.2-r0
-nginx-mod-stream-geoip2-1.20.2-r0
-nginx-vim-1.20.2-r0
-npth-1.6-r0
+nghttp2-libs-1.46.0-r0
+nginx-1.20.2-r1
+nginx-mod-devel-kit-1.20.2-r1
+nginx-mod-http-brotli-1.20.2-r1
+nginx-mod-http-dav-ext-1.20.2-r1
+nginx-mod-http-echo-1.20.2-r1
+nginx-mod-http-fancyindex-1.20.2-r1
+nginx-mod-http-geoip2-1.20.2-r1
+nginx-mod-http-headers-more-1.20.2-r1
+nginx-mod-http-image-filter-1.20.2-r1
+nginx-mod-http-nchan-1.20.2-r1
+nginx-mod-http-perl-1.20.2-r1
+nginx-mod-http-redis2-1.20.2-r1
+nginx-mod-http-set-misc-1.20.2-r1
+nginx-mod-http-upload-progress-1.20.2-r1
+nginx-mod-http-xslt-filter-1.20.2-r1
+nginx-mod-mail-1.20.2-r1
+nginx-mod-rtmp-1.20.2-r1
+nginx-mod-stream-1.20.2-r1
+nginx-mod-stream-geoip2-1.20.2-r1
+nginx-vim-1.20.2-r1
+npth-1.6-r1
 oniguruma-6.9.7.1-r0
-openssl-1.1.1l-r0
-p11-kit-0.23.22-r0
-pcre-8.44-r0
-pcre2-10.36-r0
-perl-5.32.1-r0
+openssl-1.1.1q-r0
+p11-kit-0.24.0-r1
+pcre-8.45-r1
+pcre2-10.40-r0
+perl-5.34.0-r1
 perl-error-0.17029-r1
-perl-git-2.32.0-r0
-php7-7.4.26-r0
-php7-bcmath-7.4.26-r0
-php7-bz2-7.4.26-r0
-php7-common-7.4.26-r0
-php7-ctype-7.4.26-r0
-php7-curl-7.4.26-r0
-php7-dom-7.4.26-r0
-php7-exif-7.4.26-r0
-php7-fileinfo-7.4.26-r0
-php7-fpm-7.4.26-r0
-php7-ftp-7.4.26-r0
-php7-gd-7.4.26-r0
-php7-gmp-7.4.26-r0
-php7-iconv-7.4.26-r0
-php7-imap-7.4.26-r0
-php7-intl-7.4.26-r0
-php7-json-7.4.26-r0
-php7-ldap-7.4.26-r0
-php7-mbstring-7.4.26-r0
-php7-mysqli-7.4.26-r0
-php7-mysqlnd-7.4.26-r0
-php7-opcache-7.4.26-r0
-php7-openssl-7.4.26-r0
-php7-pdo-7.4.26-r0
-php7-pdo_mysql-7.4.26-r0
-php7-pdo_odbc-7.4.26-r0
-php7-pdo_pgsql-7.4.26-r0
-php7-pdo_sqlite-7.4.26-r0
-php7-pear-7.4.26-r0
-php7-pecl-apcu-5.1.21-r0
-php7-pecl-igbinary-3.2.6-r0
-php7-pecl-mailparse-3.1.1-r1
-php7-pecl-mcrypt-1.0.4-r0
-php7-pecl-memcached-3.1.5-r2
-php7-pecl-redis-5.3.4-r0
-php7-pgsql-7.4.26-r0
-php7-phar-7.4.26-r0
-php7-posix-7.4.26-r0
-php7-session-7.4.26-r0
-php7-simplexml-7.4.26-r0
-php7-soap-7.4.26-r0
-php7-sockets-7.4.26-r0
-php7-sodium-7.4.26-r0
-php7-sqlite3-7.4.26-r0
-php7-tokenizer-7.4.26-r0
-php7-xml-7.4.26-r0
-php7-xmlreader-7.4.26-r0
-php7-xmlrpc-7.4.26-r0
-php7-xmlwriter-7.4.26-r0
-php7-xsl-7.4.26-r0
-php7-zip-7.4.26-r0
-pinentry-1.1.1-r0
+perl-git-2.34.4-r0
+php8-8.0.18-r0
+php8-bcmath-8.0.18-r0
+php8-bz2-8.0.18-r0
+php8-common-8.0.18-r0
+php8-ctype-8.0.18-r0
+php8-curl-8.0.18-r0
+php8-dom-8.0.18-r0
+php8-exif-8.0.18-r0
+php8-fileinfo-8.0.18-r0
+php8-fpm-8.0.18-r0
+php8-ftp-8.0.18-r0
+php8-gd-8.0.18-r0
+php8-gmp-8.0.18-r0
+php8-iconv-8.0.18-r0
+php8-imap-8.0.18-r0
+php8-intl-8.0.18-r0
+php8-ldap-8.0.18-r0
+php8-mbstring-8.0.18-r0
+php8-mysqli-8.0.18-r0
+php8-mysqlnd-8.0.18-r0
+php8-opcache-8.0.18-r0
+php8-openssl-8.0.18-r0
+php8-pdo-8.0.18-r0
+php8-pdo_mysql-8.0.18-r0
+php8-pdo_odbc-8.0.18-r0
+php8-pdo_pgsql-8.0.18-r0
+php8-pdo_sqlite-8.0.18-r0
+php8-pear-8.0.18-r0
+php8-pecl-apcu-5.1.21-r0
+php8-pecl-igbinary-3.2.6-r0
+php8-pecl-mailparse-3.1.3-r0
+php8-pecl-mcrypt-1.0.4-r0
+php8-pecl-memcached-3.1.5-r1
+php8-pecl-redis-5.3.6-r0
+php8-pecl-xmlrpc-1.0.0_rc3-r0
+php8-pgsql-8.0.18-r0
+php8-phar-8.0.18-r0
+php8-posix-8.0.18-r0
+php8-session-8.0.18-r0
+php8-simplexml-8.0.18-r0
+php8-soap-8.0.18-r0
+php8-sockets-8.0.18-r0
+php8-sodium-8.0.18-r0
+php8-sqlite3-8.0.18-r0
+php8-tokenizer-8.0.18-r0
+php8-xml-8.0.18-r0
+php8-xmlreader-8.0.18-r0
+php8-xmlwriter-8.0.18-r0
+php8-xsl-8.0.18-r0
+php8-zip-8.0.18-r0
+pinentry-1.2.0-r0
 popt-1.18-r0
 procps-3.3.17-r0
 py3-appdirs-1.4.4-r2
 py3-asn1crypto-1.4.0-r1
-py3-cachecontrol-0.12.6-r1
+py3-cachecontrol-0.12.10-r0
 py3-certifi-2020.12.5-r1
-py3-cffi-1.14.5-r1
-py3-chardet-4.0.0-r2
+py3-cffi-1.14.5-r4
+py3-charset-normalizer-2.0.7-r0
 py3-colorama-0.4.4-r1
-py3-contextlib2-0.6.0-r1
+py3-contextlib2-21.6.0-r1
 py3-cparser-2.20-r1
-py3-cryptography-3.3.2-r1
-py3-distlib-0.3.1-r3
-py3-distro-1.5.0-r3
+py3-cryptography-3.3.2-r3
+py3-distlib-0.3.3-r0
+py3-distro-1.6.0-r0
 py3-future-0.18.2-r3
 py3-html5lib-1.1-r1
-py3-idna-3.2-r0
+py3-idna-3.3-r0
 py3-lockfile-0.12.2-r4
 py3-msgpack-1.0.2-r1
-py3-ordered-set-4.0.2-r1
+py3-ordered-set-4.0.2-r2
 py3-packaging-20.9-r1
 py3-parsing-2.4.7-r2
-py3-pep517-0.10.0-r2
+py3-pep517-0.12.0-r0
 py3-pip-20.3.4-r1
-py3-progress-1.5-r2
-py3-requests-2.25.1-r4
-py3-retrying-1.3.3-r1
-py3-setuptools-52.0.0-r3
-py3-six-1.15.0-r1
+py3-progress-1.6-r0
+py3-requests-2.26.0-r1
+py3-retrying-1.3.3-r2
+py3-setuptools-52.0.0-r4
+py3-six-1.16.0-r0
 py3-toml-0.10.2-r2
-py3-urllib3-1.26.5-r0
+py3-tomli-1.2.2-r0
+py3-urllib3-1.26.7-r0
 py3-webencodings-0.5.1-r4
-python3-3.9.5-r2
-readline-8.1.0-r0
-s6-ipcserver-2.10.0.3-r0
-scanelf-1.3.2-r0
-shadow-4.8.1-r0
-skalibs-2.10.0.3-r0
-sqlite-libs-3.35.5-r0
-ssl_client-1.33.1-r6
-tzdata-2021e-r0
+python3-3.9.13-r1
+readline-8.1.1-r0
+s6-ipcserver-2.11.0.0-r0
+scanelf-1.3.3-r0
+shadow-4.8.1-r1
+skalibs-2.11.0.0-r0
+sqlite-libs-3.36.0-r0
+ssl_client-1.34.1-r7
+tzdata-2022c-r0
 unixodbc-2.3.9-r1
-utmps-0.1.0.2-r0
+utmps-0.1.0.3-r0
 whois-5.5.10-r0
-xz-5.2.5-r0
-xz-libs-5.2.5-r0
-zlib-1.2.11-r3
-zstd-libs-1.4.9-r1
+xz-5.2.5-r1
+xz-libs-5.2.5-r1
+zlib-1.2.12-r3
+zstd-libs-1.5.0-r0
--- a/readme-vars.yml
+++ b/readme-vars.yml
@@ -51,7 +51,7 @@ opt_param_usage_include_env: true
 opt_param_env_vars:
  - { env_var: "SUBDOMAINS", env_value: "www,", desc: "Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this _exactly_ to `wildcard` (wildcard cert is available via `dns` and `duckdns` validation only)" }
  - { env_var: "CERTPROVIDER", env_value: "", desc: "Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt." }
-  - { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `cloudflare`, `cloudxns`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `domeneshop`, `gandi`, `gehirn`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud`, `transip` and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
+  - { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `aliyun`, `azure`, `cloudflare`, `cloudxns`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `domeneshop`, `dynu`, `gandi`, `gehirn`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `netcup`, `njalla`, `nsone`, `ovh`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip` and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
  - { env_var: "PROPAGATION", env_value: "", desc: "Optionally override (in seconds) the default propagation time for the dns plugins." }
  - { env_var: "DUCKDNSTOKEN", env_value: "", desc: "Required if `VALIDATION` is set to `duckdns`. Retrieve your token from https://www.duckdns.org" }
  - { env_var: "EMAIL", env_value: "", desc: "Optional e-mail address used for cert expiration notifications (Required for ZeroSSL)." }
@@ -87,7 +87,7 @@ app_setup_block: |
  * For `duckdns` validation, either leave the `SUBDOMAINS` variable empty or set it to `wildcard`, and set the `DUCKDNSTOKEN` variable with your duckdns token. Due to a limitation of duckdns, the resulting cert will only cover either main subdomain (ie. `yoursubdomain.duckdns.org`), or sub-subdomains (ie. `*.yoursubdomain.duckdns.org`), but will not both at the same time. You can use our [duckdns image](https://hub.docker.com/r/linuxserver/duckdns/) to update your IP on duckdns.org.
  * `--cap-add=NET_ADMIN` is required for fail2ban to modify iptables
  * If you need a dynamic dns provider, you can use the free provider duckdns.org where the `URL` will be `yoursubdomain.duckdns.org` and the `SUBDOMAINS` can be `www,ftp,cloud` with http validation, or `wildcard` with dns validation.
-  * After setup, navigate to `https://yourdomain.url` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default`).
+  * After setup, navigate to `https://yourdomain.url` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default.conf`).
  * Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from Let's Encrypt in those circumstances.

  ### Security and password protection
@@ -100,7 +100,7 @@ app_setup_block: |

  ### Site config and reverse proxy

-  * The default site config resides at `/config/nginx/site-confs/default`. Feel free to modify this file, and you can add other conf files to this directory. However, if you delete the `default` file, a new default will be created on container start.
+  * The default site config resides at `/config/nginx/site-confs/default.conf`. Feel free to modify this file, and you can add other conf files to this directory. However, if you delete the `default` file, a new default will be created on container start.
  * Preset reverse proxy config files are added for popular apps. See the `README.md` file under `/config/nginx/proxy_confs` for instructions on how to enable them. The preset confs reside in and get imported from [this repo](https://github.com/linuxserver/reverse-proxy-confs).
  * If you wish to hide your site from search engine crawlers, you may find it useful to add this configuration line to your site config, within the server block, above the line where ssl.conf is included
  `add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";`
@@ -111,8 +111,8 @@ app_setup_block: |

  * This container includes auto-generated pfx and private-fullchain-bundle pem certs that are needed by other apps like Emby and Znc.
    * To use these certs in other containers, do either of the following:
-    1. *(Easier)* Mount the container's config folder in other containers (ie. `-v /path-to-le-config:/le-ssl`) and in the other containers, use the cert location `/le-ssl/keys/letsencrypt/`
-    2. *(More secure)* Mount the SWAG folder `etc` that resides under `/config` in other containers (ie. `-v /path-to-le-config/etc:/le-ssl`) and in the other containers, use the cert location `/le-ssl/letsencrypt/live/<your.domain.url>/` (This is more secure because the first method shares the entire SWAG config folder with other containers, including the www files, whereas the second method only shares the ssl certs)
+    1. *(Easier)* Mount the container's config folder in other containers (ie. `-v /path-to-swag-config:/swag-ssl`) and in the other containers, use the cert location `/swag-ssl/keys/letsencrypt/`
+    2. *(More secure)* Mount the SWAG folder `etc` that resides under `/config` in other containers (ie. `-v /path-to-swag-config/etc:/swag-ssl`) and in the other containers, use the cert location `/swag-ssl/letsencrypt/live/<your.domain.url>/` (This is more secure because the first method shares the entire SWAG config folder with other containers, including the www files, whereas the second method only shares the ssl certs)
    * These certs include:
    1. `cert.pem`, `chain.pem`, `fullchain.pem` and `privkey.pem`, which are generated by Certbot and used by nginx and various other apps
    2. `privkey.pfx`, a format supported by Microsoft and commonly used by dotnet apps such as Emby Server (no password)
@@ -120,11 +120,12 @@ app_setup_block: |

  ### Using fail2ban

-  * This container includes fail2ban set up with 4 jails by default:
+  * This container includes fail2ban set up with 5 jails by default:
    1. nginx-http-auth
    2. nginx-badbots
    3. nginx-botsearch
    4. nginx-deny
+    5. nginx-unauthorized
  * To enable or disable other jails, modify the file `/config/fail2ban/jail.local`
  * To modify filters and actions, instead of editing the `.conf` files, create `.local` files with the same name and edit those because .conf files get overwritten when the actions and filters are updated. `.local` files will append whatever's in the `.conf` files (ie. `nginx-http-auth.conf` --> `nginx-http-auth.local`)
  * You can check which jails are active via `docker exec -it swag fail2ban-client status`
@@ -154,6 +155,12 @@ app_setup_nginx_reverse_proxy_block: ""

 # changelog
 changelogs:
+  - { date: "20.08.22:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Rebasing to alpine 3.15 with php8. Restructure nginx configs ([see changes announcement](https://info.linuxserver.io/issues/2022-08-20-nginx-base))." }
+  - { date: "10.08.22:", desc: "Added support for Dynu DNS validation." }
+  - { date: "18.05.22:", desc: "Added support for Azure DNS validation." }
+  - { date: "09.04.22:", desc: "Added certbot-dns-loopia for DNS01 validation." }
+  - { date: "05.04.22:", desc: "Added support for standalone DNS validation." }
+  - { date: "28.03.22:", desc: "created a logfile for fail2ban nginx-unauthorized in /etc/cont-init.d/50-config" }
  - { date: "09.01.22:", desc: "Added a fail2ban jail for nginx unauthorized" }
  - { date: "21.12.21:", desc: "Fixed issue with iptables not working as expected" }
  - { date: "30.11.21:", desc: "Move maxmind to a [new mod](https://github.com/linuxserver/docker-mods/tree/swag-maxmind)" }
@@ -184,7 +191,7 @@ changelogs:
  - { date: "26.01.21:", desc: "Add support for hetzner dns validation." }
  - { date: "20.01.21:", desc: "Add check for ZeroSSL EAB retrieval." }
  - { date: "08.01.21:", desc: "Add support for getting certs from [ZeroSSL](https://zerossl.com/) via optional `CERTPROVIDER` env var. Update aliyun, domeneshop, inwx and transip dns plugins with the new plugin names. Hide `donoteditthisfile.conf` because users were editing it despite its name. Suppress harmless error when no proxy confs are enabled." }
-  - { date: "03.01.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) /config/nginx/site-confs/default - Add helper pages to aid troubleshooting" }
+  - { date: "03.01.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) /config/nginx/site-confs/default.conf - Add helper pages to aid troubleshooting" }
  - { date: "10.12.20:", desc: "Add support for njalla dns validation" }
  - { date: "09.12.20:", desc: "Check for template/conf updates and notify in the log. Add support for gehirn and sakuracloud dns validation." }
  - { date: "01.11.20:", desc: "Add support for netcup dns validation" }
--- a/root/defaults/502.html
+++ b/root/defaults/502.html
@@ -1,44 +0,0 @@
-<html>
-    <head>
-        <title>502</title>
-        <style>
-        body{
-            font-family: Helvetica, Arial, sans-serif;
-            background-color: #961313;
-        }
-        .message{
-            width:440px;
-            padding:20px 40px;
-            margin:0 auto;
-            background-color:#f9f9f9;
-            border:1px solid #ddd;
-            color: #1e3d62;
-        }
-        center{
-            margin:40px 0;
-        }
-        h1{
-            font-size: 28px;
-            line-height: 26px;
-        }
-        h2{
-            font-size: 18px;
-            line-height: 26px;
-        }
-        p{
-            font-size: 12px;
-        }
-        a{
-            color: rgb(207, 48, 139);
-        }
-        </style>
-    </head>
-    <body>
-        <div class="message">
-            <h1>502</h1>
-            <h2>Nginx can not connect to the application</h2>
-            <p>Some common reasons are listed here: <a target="_blank" href="https://docs.linuxserver.io/general/swag#502">docs.linuxserver.io</a></p>
-            <p>For help and support, please visit: <a target="_blank" href="https://www.linuxserver.io/support">linuxserver.io/support</a></p>
-        </div>
-    </body>
-</html>
--- a/root/defaults/authelia-server.conf
+++ b/root/defaults/authelia-server.conf
@@ -1,52 +0,0 @@
-## Version 2021/05/28 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/authelia-server.conf
-# Make sure that your authelia container is in the same user defined bridge network and is named authelia
-
-location ^~ /authelia {
-    include /config/nginx/proxy.conf;
-    include /config/nginx/resolver.conf;
-    set $upstream_authelia authelia;
-    proxy_pass http://$upstream_authelia:9091;
-}
-
-location = /authelia/api/verify {
-    internal;
-    if ($request_uri ~ [^a-zA-Z0-9_+-=\!@$%&*?~.:#'\;\(\)\[\]]) {
-        return 401;
-    }
-    include /config/nginx/resolver.conf;
-    set $upstream_authelia authelia;
-    proxy_pass_request_body off;
-    proxy_pass http://$upstream_authelia:9091;
-    proxy_set_header Content-Length "";
-
-    # Timeout if the real server is dead
-    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-
-    # [REQUIRED] Needed by Authelia to check authorizations of the resource.
-    # Provide either X-Original-URL and X-Forwarded-Proto or
-    # X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Uri or both.
-    # Those headers will be used by Authelia to deduce the target url of the user.
-    # Basic Proxy Config
-    client_body_buffer_size 128k;
-    proxy_set_header Host $host;
-    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $remote_addr;
-    proxy_set_header X-Forwarded-Method $request_method;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_set_header X-Forwarded-Host $http_host;
-    proxy_set_header X-Forwarded-Uri $request_uri;
-    proxy_set_header X-Forwarded-Ssl on;
-    proxy_redirect  http://  $scheme://;
-    proxy_http_version 1.1;
-    proxy_set_header Connection "";
-    proxy_cache_bypass $cookie_session;
-    proxy_no_cache $cookie_session;
-    proxy_buffers 4 32k;
-
-    # Advanced Proxy Config
-    send_timeout 5m;
-    proxy_read_timeout 240;
-    proxy_send_timeout 240;
-    proxy_connect_timeout 240;
-}
--- a/root/defaults/default
+++ b/root/defaults/default
@@ -1,160 +0,0 @@
-## Version 2021/04/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/default
-
-error_page 502 /502.html;
-
-# redirect all traffic to https
-server {
-    listen 80 default_server;
-    listen [::]:80 default_server;
-    server_name _;
-    return 301 https://$host$request_uri;
-}
-
-# main server block
-server {
-    listen 443 ssl http2 default_server;
-    listen [::]:443 ssl http2 default_server;
-
-    root /config/www;
-    index index.html index.htm index.php;
-
-    server_name _;
-
-    # enable subfolder method reverse proxy confs
-    include /config/nginx/proxy-confs/*.subfolder.conf;
-
-    # all ssl related config moved to ssl.conf
-    include /config/nginx/ssl.conf;
-
-    # enable for ldap auth
-    #include /config/nginx/ldap.conf;
-
-    # enable for Authelia
-    #include /config/nginx/authelia-server.conf;
-
-    client_max_body_size 0;
-
-    location / {
-        # enable the next two lines for http auth
-        #auth_basic "Restricted";
-        #auth_basic_user_file /config/nginx/.htpasswd;
-
-        # enable the next two lines for ldap auth
-        #auth_request /auth;
-        #error_page 401 =200 /ldaplogin;
-
-        # enable for Authelia
-        #include /config/nginx/authelia-location.conf;
-
-        try_files $uri $uri/ /index.html /index.php?$args =404;
-    }
-
-    location ~ \.php$ {
-        fastcgi_split_path_info ^(.+\.php)(/.+)$;
-        fastcgi_pass 127.0.0.1:9000;
-        fastcgi_index index.php;
-        include /etc/nginx/fastcgi_params;
-    }
-
-# sample reverse proxy config for password protected couchpotato running at IP 192.168.1.50 port 5050 with base url "cp"
-# notice this is within the same server block as the base
-# don't forget to generate the .htpasswd file as described on docker hub
-#    location ^~ /cp {
-#        auth_basic "Restricted";
-#        auth_basic_user_file /config/nginx/.htpasswd;
-#        include /config/nginx/proxy.conf;
-#        proxy_pass http://192.168.1.50:5050/cp;
-#    }
-
-}
-
-# sample reverse proxy config without url base, but as a subdomain "cp", ip and port same as above
-# notice this is a new server block, you need a new server block for each subdomain
-#server {
-#    listen 443 ssl http2;
-#    listen [::]:443 ssl http2;
-#
-#    root /config/www;
-#    index index.html index.htm index.php;
-#
-#    server_name cp.*;
-#
-#    include /config/nginx/ssl.conf;
-#
-#    client_max_body_size 0;
-#
-#    location / {
-#        auth_basic "Restricted";
-#        auth_basic_user_file /config/nginx/.htpasswd;
-#        include /config/nginx/proxy.conf;
-#        proxy_pass http://192.168.1.50:5050;
-#    }
-#}
-
-# sample reverse proxy config for "heimdall" via subdomain, with ldap authentication
-# ldap-auth container has to be running and the /config/nginx/ldap.conf file should be filled with ldap info
-# notice this is a new server block, you need a new server block for each subdomain
-#server {
-#    listen 443 ssl http2;
-#    listen [::]:443 ssl http2;
-#
-#    root /config/www;
-#    index index.html index.htm index.php;
-#
-#    server_name heimdall.*;
-#
-#    include /config/nginx/ssl.conf;
-#
-#    include /config/nginx/ldap.conf;
-#
-#    client_max_body_size 0;
-#
-#    location / {
-#        # the next two lines will enable ldap auth along with the included ldap.conf in the server block
-#        auth_request /auth;
-#        error_page 401 =200 /ldaplogin;
-#
-#        include /config/nginx/proxy.conf;
-#        resolver 127.0.0.11 valid=30s;
-#        set $upstream_app heimdall;
-#        set $upstream_port 443;
-#        set $upstream_proto https;
-#        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
-#    }
-#}
-
-# sample reverse proxy config for "heimdall" via subdomain, with Authelia
-# Authelia container has to be running in the same user defined bridge network, with container name "authelia", and with 'path: "authelia"' set in its configuration.yml
-# notice this is a new server block, you need a new server block for each subdomain
-#server {
-#    listen 443 ssl http2;
-#    listen [::]:443 ssl http2;
-#
-#    root /config/www;
-#    index index.html index.htm index.php;
-#
-#    server_name heimdall.*;
-#
-#    include /config/nginx/ssl.conf;
-#
-#    include /config/nginx/authelia-server.conf;
-#
-#    client_max_body_size 0;
-#
-#    location / {
-#        # the next line will enable Authelia along with the included authelia-server.conf in the server block
-#        include /config/nginx/authelia-location.conf;
-#
-#        include /config/nginx/proxy.conf;
-#        resolver 127.0.0.11 valid=30s;
-#        set $upstream_app heimdall;
-#        set $upstream_port 443;
-#        set $upstream_proto https;
-#        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
-#    }
-#}
-
-# enable subdomain method reverse proxy confs
-include /config/nginx/proxy-confs/*.subdomain.conf;
-# enable proxy cache for auth
-proxy_cache_path cache/ keys_zone=auth_cache:10m;
--- a/root/defaults/dhparams.pem
+++ b/root/defaults/dhparams.pem
@@ -1,13 +0,0 @@
-----BEGIN DH PARAMETERS-----
-MIICCAKCAgEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
-+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
-87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
-YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
-7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
-ssbzSibBsu/6iGtCOGEfz9zeNVs7ZRkDW7w09N75nAI4YbRvydbmyQd62R0mkff3
-7lmMsPrBhtkcrv4TCYUTknC0EwyTvEN5RPT9RFLi103TZPLiHnH1S/9croKrnJ32
-nuhtK8UiNjoNq8Uhl5sN6todv5pC1cRITgq80Gv6U93vPBsg7j/VnXwl5B0rZp4e
-8W5vUsMWTfT7eTDp5OWIV7asfV9C1p9tGHdjzx1VA0AEh/VbpX4xzHpxNciG77Qx
-iu1qHgEtnmgyqQdgCpGBMMRtx3j5ca0AOAkpmaMzy4t6Gh25PXFAADwqTs6p+Y0K
-zAqCkc3OyX3Pjsm1Wn+IpGtNtahR9EGC4caKAH5eZV9q//////////8CAQI=
-----END DH PARAMETERS-----
--- a/root/defaults/dns-conf/azure.ini
+++ b/root/defaults/dns-conf/azure.ini
@@ -0,0 +1,26 @@
+# Instructions: https://certbot-dns-azure.readthedocs.io/en/latest/
+# Replace with your values
+# dns_azure_environment can be one of the following: AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud, AzureGermanCloud
+# Service Principal with Client Secret
+dns_azure_sp_client_id = 912ce44a-0156-4669-ae22-c16a17d34ca5
+dns_azure_sp_client_secret = E-xqXU83Y-jzTI6xe9fs2YC~mck3ZzUih9
+dns_azure_tenant_id = ed1090f3-ab18-4b12-816c-599af8a88cf7
+dns_azure_environment = "AzurePublicCloud"
+dns_azure_zone1 = example.com:/subscriptions/c135abce-d87d-48df-936c-15596c6968a5/resourceGroups/dns1
+
+
+# Service Prinicipal with Certificate
+#dns_azure_sp_client_id = 912ce44a-0156-4669-ae22-c16a17d34ca5
+#dns_azure_sp_certificate_path = /path/to/certificate.pem
+#dns_azure_tenant_id = ed1090f3-ab18-4b12-816c-599af8a88cf7
+#dns_azure_environment = "AzurePublicCloud"
+#dns_azure_zone1 = example.com:/subscriptions/c135abce-d87d-48df-936c-15596c6968a5/resourceGroups/dns1
+
+# Azure Managed Identity
+#dns_azure_msi_client_id = 912ce44a-0156-4669-ae22-c16a17d34ca5
+#dns_azure_zone1 = example.com:/subscriptions/c135abce-d87d-48df-936c-15596c6968a5/resourceGroups/dns1
+
+# System Assigned Azure Managed Identity
+#dns_azure_msi_system_assigned = true
+#dns_azure_environment = "AzurePublicCloud"
+#dns_azure_zone1 = example.com:/subscriptions/c135abce-d87d-48df-936c-15596c6968a5/resourceGroups/dns1
--- a/root/defaults/dns-conf/desec.ini
+++ b/root/defaults/dns-conf/desec.ini
@@ -1,4 +1,4 @@
 # Instructions: https://pypi.org/project/certbot-dns-desec/
 # Replace with your Desec V1 API Token
 dns_desec_token=YOUR_TOKEN_HERE
-dns_desec_endpoint=https://desec.io/api/v1/
+dns_desec_endpoint=https://desec.io/api/v1/
--- a/root/defaults/dns-conf/dynu.ini
+++ b/root/defaults/dns-conf/dynu.ini
@@ -0,0 +1,3 @@
+# Instructions: https://github.com/bikram990/certbot-dns-dynu#configuration
+# Replace with your API token from your dynu account.
+dns_dynu_auth_token = AbCbASsd!@34
--- a/root/defaults/dns-conf/ionos.ini
+++ b/root/defaults/dns-conf/ionos.ini
@@ -2,4 +2,4 @@
 # Replace with your values
 dns_ionos_prefix = myapikeyprefix
 dns_ionos_secret = verysecureapikeysecret
-dns_ionos_endpoint = https://api.hosting.ionos.com
+dns_ionos_endpoint = https://api.hosting.ionos.com
--- a/root/defaults/dns-conf/loopia.ini
+++ b/root/defaults/dns-conf/loopia.ini
@@ -0,0 +1,3 @@
+# Replace with your values
+dns_loopia_user = user@loopiaapi
+dns_loopia_password = passwordgoeshere
--- a/root/defaults/dns-conf/standalone.ini
+++ b/root/defaults/dns-conf/standalone.ini
@@ -0,0 +1,8 @@
+# Instructions: https://github.com/siilike/certbot-dns-standalone/blob/master/README.rst
+# Make sure to expose UDP port 53 from your swag container:
+# - for docker cli, add argument: `-p 53:53/udp`
+# - for docker-compose, add the following line under ports: `- 53:53/udp`
+# This file does not need to be changed:
+# - no credentials are required
+# - it's not used and only for informational purpose
+# - prepare the correct DNS records as described in the plugin instructions instead
--- a/root/defaults/fail2ban/filter.d/nginx-unauthorized.conf
+++ b/root/defaults/fail2ban/filter.d/nginx-unauthorized.conf
@@ -2,6 +2,6 @@

 [Definition]

-failregex = ^(?!.*?(?i)plex)<HOST>.*"(GET|POST|HEAD).*" 401 .*$
+failregex = ^<HOST>.*"(GET|POST|HEAD).*" (401) .*$

-ignoreregex = 
+ignoreregex = .*(?i)plex.*
--- a/root/defaults/fail2ban/jail.local
+++ b/root/defaults/fail2ban/jail.local
@@ -1,4 +1,4 @@
-## Version 2022/01/09 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/jail.local
+## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/fail2ban/jail.local
 # This is the custom version of the jail.conf for fail2ban
 # Feel free to modify this and add additional filters
 # Then you can drop the new filter conf files into the fail2ban-filters
@@ -56,4 +56,4 @@ logpath  = /config/log/nginx/error.log
 enabled  = true
 port     = http,https
 filter   = nginx-unauthorized
-logpath  = /config/log/nginx/unauthorized.log
+logpath  = /config/log/nginx/access.log
--- a/root/defaults/ldap.conf
+++ b/root/defaults/ldap.conf
@@ -1,92 +0,0 @@
-## Version 2020/06/02 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/ldap.conf
-## this conf is meant to be used in conjunction with our ldap-auth image: https://github.com/linuxserver/docker-ldap-auth
-## see the heimdall example in the default site config for info on enabling ldap auth
-## for further instructions on this conf, see https://github.com/nginxinc/nginx-ldap-auth
-
-    location /ldaplogin {
-        resolver 127.0.0.11 valid=30s;
-        set $upstream_auth_app ldap-auth;
-        set $upstream_auth_port 9000;
-        set $upstream_auth_proto http;
-        proxy_pass $upstream_auth_proto://$upstream_auth_app:$upstream_auth_port;
-        proxy_set_header X-Target $request_uri;
-    }
-
-    location = /auth {
-        resolver 127.0.0.11 valid=30s;
-        set $upstream_auth_app ldap-auth;
-        set $upstream_auth_port 8888;
-        set $upstream_auth_proto http;
-        proxy_pass $upstream_auth_proto://$upstream_auth_app:$upstream_auth_port;
-
-        proxy_pass_request_body off;
-        proxy_set_header Content-Length "";
-
-        #Before enabling the below caching options, make sure you have the line "proxy_cache_path cache/ keys_zone=auth_cache:10m;" at the bottom your default site config
-        #proxy_cache auth_cache;
-        #proxy_cache_valid 200 10m;
-        #proxy_cache_key "$http_authorization$cookie_nginxauth";
-
-        # As implemented in nginx-ldap-auth-daemon.py, the ldap-auth daemon
-        # communicates with a LDAP server, passing in the following
-        # parameters to specify which user account to authenticate. To
-        # eliminate the need to modify the Python code, this file contains
-        # 'proxy_set_header' directives that set the values of the
-        # parameters. Set or change them as instructed in the comments.
-        #
-        #    Parameter      Proxy header
-        #    -----------    ----------------
-        #    url            X-Ldap-URL
-        #    starttls       X-Ldap-Starttls
-        #    basedn         X-Ldap-BaseDN
-        #    binddn         X-Ldap-BindDN
-        #    bindpasswd     X-Ldap-BindPass
-        #    cookiename     X-CookieName
-        #    realm          X-Ldap-Realm
-        #    template       X-Ldap-Template
-
-        # (Required) Set the URL and port for connecting to the LDAP server,
-        # by replacing 'example.com'.
-        # Do not mix ldaps-style URL and X-Ldap-Starttls as it will not work.
-        proxy_set_header X-Ldap-URL      "ldap://example.com";
-
-        # (Optional) Establish a TLS-enabled LDAP session after binding to the
-        # LDAP server.
-        # This is the 'proper' way to establish encrypted TLS connections, see
-        # http://www.openldap.org/faq/data/cache/185.html
-        #proxy_set_header X-Ldap-Starttls "true";
-
-        # (Required) Set the Base DN, by replacing the value enclosed in
-        # double quotes.
-        proxy_set_header X-Ldap-BaseDN   "cn=Users,dc=test,dc=local";
-
-        # (Required) Set the Bind DN, by replacing the value enclosed in
-        # double quotes.
-        # If AD, use "root@test.local"
-        proxy_set_header X-Ldap-BindDN   "cn=root,dc=test,dc=local";
-
-        # (Required) Set the Bind password, by replacing 'secret'.
-        proxy_set_header X-Ldap-BindPass "secret";
-
-        # (Required) The following directives set the cookie name and pass
-        # it, respectively. They are required for cookie-based
-        # authentication. Comment them out if using HTTP basic
-        # authentication.
-        proxy_set_header X-CookieName "nginxauth";
-        proxy_set_header Cookie nginxauth=$cookie_nginxauth;
-
-        # (Required if using Microsoft Active Directory as the LDAP server)
-        # Set the LDAP template by uncommenting the following directive.
-        #proxy_set_header X-Ldap-Template "(sAMAccountName=%(username)s)";
-
-        # (Optional if using OpenLDAP as the LDAP server) Set the LDAP
-        # template by uncommenting the following directive and replacing
-        # '(cn=%(username)s)' which is the default set in
-        # nginx-ldap-auth-daemon.py.
-        #proxy_set_header X-Ldap-Template "(cn=%(username)s)";
-
-        # (Optional) Set the realm name, by uncommenting the following
-        # directive and replacing 'Restricted' which is the default set
-        # in nginx-ldap-auth-daemon.py.
-        #proxy_set_header X-Ldap-Realm    "Restricted";
-    }
--- a/root/defaults/nginx.conf
+++ b/root/defaults/nginx.conf
@@ -1,149 +0,0 @@
-## Version 2022/01/09 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx.conf
-
-user abc;
-
-# Set number of worker processes automatically based on number of CPU cores.
-include /config/nginx/worker_processes.conf;
-
-# Enables the use of JIT for regular expressions to speed-up their processing.
-pcre_jit on;
-
-# Configures default error logger.
-error_log /config/log/nginx/error.log;
-
-# Includes files with directives to load dynamic modules.
-include /etc/nginx/modules/*.conf;
-
-events {
-    # The maximum number of simultaneous connections that can be opened by
-    # a worker process.
-    worker_connections 1024;
-    # multi_accept on;
-}
-
-http {
-    # Includes mapping of file name extensions to MIME types of responses
-    # and defines the default type.
-    include /etc/nginx/mime.types;
-    default_type application/octet-stream;
-
-    # Name servers used to resolve names of upstream servers into addresses.
-    # It's also needed when using tcpsocket and udpsocket in Lua modules.
-    #resolver 1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001;
-    include /config/nginx/resolver.conf;
-
-    # Don't tell nginx version to the clients. Default is 'on'.
-    server_tokens off;
-
-    # Specifies the maximum accepted body size of a client request, as
-    # indicated by the request header Content-Length. If the stated content
-    # length is greater than this size, then the client receives the HTTP
-    # error code 413. Set to 0 to disable. Default is '1m'.
-    client_max_body_size 0;
-
-    # Sendfile copies data between one FD and other from within the kernel,
-    # which is more efficient than read() + write(). Default is off.
-    sendfile on;
-
-    # Causes nginx to attempt to send its HTTP response head in one packet,
-    # instead of using partial frames. Default is 'off'.
-    tcp_nopush on;
-
-    # Helper variable for proxying websockets.
-    map $http_upgrade $connection_upgrade {
-        default upgrade;
-        '' close;
-    }
-
-    # Saves unauthorized log messages to a separate log file
-    map $status $unauthorized {
-        default 0;
-        ~^401  1;
-    }
-    access_log /config/log/nginx/unauthorized.log combined if=$unauthorized;
-    
-    # Sets the path, format, and configuration for a buffered log write.
-    access_log /config/log/nginx/access.log;
-
-    # Includes virtual hosts configs.
-    #include /etc/nginx/http.d/*.conf;
-
-    # WARNING: Don't use this directory for virtual hosts anymore.
-    # This include will be moved to the root context in Alpine 3.14.
-    #include /etc/nginx/conf.d/*.conf;
-
-
-    ##
-    # Basic Settings
-    ##
-
-    client_body_buffer_size 128k;
-    keepalive_timeout 65;
-    large_client_header_buffers 4 16k;
-    send_timeout 5m;
-    tcp_nodelay on;
-    types_hash_max_size 2048;
-    variables_hash_max_size 2048;
-    # server_names_hash_bucket_size 64;
-    # server_name_in_redirect off;
-
-    ##
-    # Gzip Settings
-    ##
-
-    gzip on;
-    gzip_disable "msie6";
-    # gzip_vary on;
-    # gzip_proxied any;
-    # gzip_comp_level 6;
-    # gzip_buffers 16 8k;
-    # gzip_http_version 1.1;
-    # gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
-
-    ##
-    # nginx-naxsi config
-    ##
-    # Uncomment it if you installed nginx-naxsi
-    ##
-
-    #include /etc/nginx/naxsi_core.rules;
-
-    ##
-    # nginx-passenger config
-    ##
-    # Uncomment it if you installed nginx-passenger
-    ##
-
-    #passenger_root /usr;
-    #passenger_ruby /usr/bin/ruby;
-
-    ##
-    # Virtual Host Configs
-    ##
-    include /config/nginx/site-confs/*;
-    #Removed lua. Do not remove this comment
-}
-
-#mail {
-#    # See sample authentication script at:
-#    # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
-#
-#    # auth_http localhost/auth.php;
-#    # pop3_capabilities "TOP" "USER";
-#    # imap_capabilities "IMAP4rev1" "UIDPLUS";
-#
-#    server {
-#        listen     localhost:110;
-#        protocol   pop3;
-#        proxy      on;
-#    }
-#
-#    server {
-#        listen     localhost:143;
-#        protocol   imap;
-#        proxy      on;
-#    }
-#}
-
-daemon off;
-pid /run/nginx.pid;
--- a/root/defaults/nginx/authelia-location.conf.sample
+++ b/root/defaults/nginx/authelia-location.conf.sample
@@ -1,4 +1,4 @@
-## Version 2021/04/21 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/authelia-location.conf
+## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-location.conf.sample
 # Make sure that your authelia container is in the same user defined bridge network and is named authelia
 # Make sure that the authelia configuration.yml has 'path: "authelia"' defined

--- a/root/defaults/nginx/authelia-server.conf.sample
+++ b/root/defaults/nginx/authelia-server.conf.sample
@@ -0,0 +1,28 @@
+## Version 2022/08/22 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-server.conf.sample
+# Make sure that your authelia container is in the same user defined bridge network and is named authelia
+
+location ^~ /authelia {
+
+    set $upstream_app authelia;
+    set $upstream_port 9091;
+    set $upstream_proto http;
+    proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+}
+
+location = /authelia/api/verify {
+    internal;
+
+    set $upstream_app authelia;
+    set $upstream_port 9091;
+    set $upstream_proto http;
+    proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+
+    # Timeout if the real server is dead
+    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
+
+    client_body_buffer_size 128k;
+    proxy_buffers 4 32k;
+    proxy_pass_request_body off;
+    proxy_set_header Content-Length "";
+    send_timeout 5m;
+}
--- a/root/defaults/nginx/ldap-location.conf.sample
+++ b/root/defaults/nginx/ldap-location.conf.sample
@@ -0,0 +1,4 @@
+## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/ldap-location.conf.sample
+
+auth_request /auth;
+error_page 401 =200 /ldaplogin;
--- a/root/defaults/nginx/ldap-server.conf.sample
+++ b/root/defaults/nginx/ldap-server.conf.sample
@@ -0,0 +1,90 @@
+## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/ldap-server.conf.sample
+## this conf is meant to be used in conjunction with our ldap-auth image: https://github.com/linuxserver/docker-ldap-auth
+## see the heimdall example in the default site config for info on enabling ldap auth
+## for further instructions on this conf, see https://github.com/nginxinc/nginx-ldap-auth
+
+location /ldaplogin {
+
+    set $upstream_auth_app ldap-auth;
+    set $upstream_auth_port 9000;
+    set $upstream_auth_proto http;
+    proxy_pass $upstream_auth_proto://$upstream_auth_app:$upstream_auth_port;
+    proxy_set_header X-Target $request_uri;
+}
+
+location = /auth {
+
+    set $upstream_auth_app ldap-auth;
+    set $upstream_auth_port 8888;
+    set $upstream_auth_proto http;
+    proxy_pass $upstream_auth_proto://$upstream_auth_app:$upstream_auth_port;
+
+    proxy_pass_request_body off;
+    proxy_set_header Content-Length "";
+
+    #Before enabling the below caching options, make sure you have the line "proxy_cache_path cache/ keys_zone=auth_cache:10m;" at the bottom your default site config
+    #proxy_cache auth_cache;
+    #proxy_cache_valid 200 10m;
+    #proxy_cache_key "$http_authorization$cookie_nginxauth";
+
+    # As implemented in nginx-ldap-auth-daemon.py, the ldap-auth daemon
+    # communicates with a LDAP server, passing in the following
+    # parameters to specify which user account to authenticate. To
+    # eliminate the need to modify the Python code, this file contains
+    # 'proxy_set_header' directives that set the values of the
+    # parameters. Set or change them as instructed in the comments.
+    #
+    #    Parameter      Proxy header
+    #    -----------    ----------------
+    #    url            X-Ldap-URL
+    #    starttls       X-Ldap-Starttls
+    #    basedn         X-Ldap-BaseDN
+    #    binddn         X-Ldap-BindDN
+    #    bindpasswd     X-Ldap-BindPass
+    #    cookiename     X-CookieName
+    #    realm          X-Ldap-Realm
+    #    template       X-Ldap-Template
+    # (Required) Set the URL and port for connecting to the LDAP server,
+    # by replacing 'example.com'.
+    # Do not mix ldaps-style URL and X-Ldap-Starttls as it will not work.
+    proxy_set_header X-Ldap-URL "ldap://example.com";
+
+    # (Optional) Establish a TLS-enabled LDAP session after binding to the
+    # LDAP server.
+    # This is the 'proper' way to establish encrypted TLS connections, see
+    # http://www.openldap.org/faq/data/cache/185.html
+    #proxy_set_header X-Ldap-Starttls "true";
+
+    # (Required) Set the Base DN, by replacing the value enclosed in
+    # double quotes.
+    proxy_set_header X-Ldap-BaseDN "cn=Users,dc=test,dc=local";
+
+    # (Required) Set the Bind DN, by replacing the value enclosed in
+    # double quotes.
+    # If AD, use "root@test.local"
+    proxy_set_header X-Ldap-BindDN "cn=root,dc=test,dc=local";
+
+    # (Required) Set the Bind password, by replacing 'secret'.
+    proxy_set_header X-Ldap-BindPass "secret";
+
+    # (Required) The following directives set the cookie name and pass
+    # it, respectively. They are required for cookie-based
+    # authentication. Comment them out if using HTTP basic
+    # authentication.
+    proxy_set_header X-CookieName "nginxauth";
+    proxy_set_header Cookie nginxauth=$cookie_nginxauth;
+
+    # (Required if using Microsoft Active Directory as the LDAP server)
+    # Set the LDAP template by uncommenting the following directive.
+    #proxy_set_header X-Ldap-Template "(sAMAccountName=%(username)s)";
+
+    # (Optional if using OpenLDAP as the LDAP server) Set the LDAP
+    # template by uncommenting the following directive and replacing
+    # '(cn=%(username)s)' which is the default set in
+    # nginx-ldap-auth-daemon.py.
+    #proxy_set_header X-Ldap-Template "(cn=%(username)s)";
+    # (Optional) Set the realm name, by uncommenting the following
+    # directive and replacing 'Restricted' which is the default set
+    # in nginx-ldap-auth-daemon.py.
+    #proxy_set_header X-Ldap-Realm    "Restricted";
+}
--- a/root/defaults/nginx/proxy.conf.sample
+++ b/root/defaults/nginx/proxy.conf.sample
@@ -1,4 +1,4 @@
-## Version 2021/10/26 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/proxy.conf
+## Version 2022/09/01 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/proxy.conf.sample

 # Timeout if the real server is dead
 proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
@@ -10,7 +10,7 @@ proxy_headers_hash_bucket_size 128;
 proxy_headers_hash_max_size 1024;
 proxy_http_version 1.1;
 proxy_read_timeout 240;
-proxy_redirect  http://  $scheme://;
+proxy_redirect http:// $scheme://;
 proxy_send_timeout 240;

 # Proxy Cache and Cookie Settings
@@ -25,7 +25,11 @@ proxy_set_header Host $host;
 proxy_set_header Proxy "";
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-proxy_set_header X-Forwarded-Host $host;
-proxy_set_header X-Forwarded-Proto https;
+proxy_set_header X-Forwarded-Host $host:$server_port;
+proxy_set_header X-Forwarded-Method $request_method;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Forwarded-Server $host;
 proxy_set_header X-Forwarded-Ssl on;
+proxy_set_header X-Forwarded-Uri $request_uri;
+proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
 proxy_set_header X-Real-IP $remote_addr;
--- a/root/defaults/nginx/site-confs/default.conf.sample
+++ b/root/defaults/nginx/site-confs/default.conf.sample
@@ -0,0 +1,62 @@
+## Version 2022/09/01 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/site-confs/default.conf.sample
+
+# redirect all traffic to https
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# main server block
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    server_name _;
+
+    root /config/www;
+    index index.html index.htm index.php;
+
+    # enable subfolder method reverse proxy confs
+    include /config/nginx/proxy-confs/*.subfolder.conf;
+
+    # enable for ldap auth (requires ldap-location.conf in the location block)
+    #include /config/nginx/ldap-server.conf;
+
+    # enable for Authelia (requires authelia-location.conf in the location block)
+    #include /config/nginx/authelia-server.conf;
+
+    location / {
+        # enable for basic auth
+        #auth_basic "Restricted";
+        #auth_basic_user_file /config/nginx/.htpasswd;
+
+        # enable for ldap auth (requires ldap-server.conf in the server block)
+        #include /config/nginx/ldap-location.conf;
+
+        # enable for Authelia (requires authelia-server.conf in the server block)
+        #include /config/nginx/authelia-location.conf;
+
+        try_files $uri $uri/ /index.html /index.php$is_args$args =404;
+    }
+
+    location ~ ^(.+\.php)(.*)$ {
+        fastcgi_split_path_info ^(.+\.php)(.*)$;
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_index index.php;
+        include /etc/nginx/fastcgi_params;
+    }
+
+    # deny access to .htaccess/.htpasswd files
+    location ~ /\.ht {
+        deny all;
+    }
+}
+
+# enable subdomain method reverse proxy confs
+include /config/nginx/proxy-confs/*.subdomain.conf;
+# enable proxy cache for auth
+proxy_cache_path cache/ keys_zone=auth_cache:10m;
--- a/root/defaults/ssl.conf
+++ b/root/defaults/ssl.conf
@@ -1,46 +0,0 @@
-## Version 2021/09/19 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/ssl.conf
-
-### Mozilla Recommendations
-# generated 2020-06-17, Mozilla Guideline v5.4, nginx 1.18.0-r0, OpenSSL 1.1.1g-r0, intermediate configuration
-# https://ssl-config.mozilla.org/#server=nginx&version=1.18.0-r0&config=intermediate&openssl=1.1.1g-r0&guideline=5.4
-
-ssl_session_timeout 1d;
-ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
-ssl_session_tickets off;
-
-# intermediate configuration
-ssl_protocols TLSv1.2 TLSv1.3;
-ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
-ssl_prefer_server_ciphers off;
-
-# OCSP stapling
-ssl_stapling on;
-ssl_stapling_verify on;
-
-
-### Linuxserver.io Defaults
-
-# Certificates
-ssl_certificate /config/keys/letsencrypt/fullchain.pem;
-ssl_certificate_key /config/keys/letsencrypt/privkey.pem;
-# verify chain of trust of OCSP response using Root CA and Intermediate certs
-ssl_trusted_certificate /config/keys/letsencrypt/fullchain.pem;
-
-# Diffie-Hellman Parameters
-ssl_dhparam /config/nginx/dhparams.pem;
-
-# Enable TLS 1.3 early data
-ssl_early_data on;
-
-# HSTS, remove # from the line below to enable HSTS
-#add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
-
-# Optional additional headers
-#add_header Cache-Control "no-transform" always;
-#add_header Content-Security-Policy "upgrade-insecure-requests; frame-ancestors 'self'";
-#add_header Permissions-Policy "interest-cohort=()";
-#add_header Referrer-Policy "same-origin" always;
-#add_header X-Content-Type-Options "nosniff" always;
-#add_header X-Frame-Options "SAMEORIGIN" always;
-#add_header X-UA-Compatible "IE=Edge" always;
-#add_header X-XSS-Protection "1; mode=block" always;
--- a/root/defaults/www/index.html
+++ b/root/defaults/www/index.html
--- a/root/etc/cont-init.d/30-test-run
+++ b/root/etc/cont-init.d/30-test-run
@@ -0,0 +1,6 @@
+#!/usr/bin/with-contenv bash
+
+# Echo init finish for test runs
+if [[ -n "${TEST_RUN}" ]]; then
+    echo '[services.d] done.'
+fi
--- a/root/etc/cont-init.d/31-require-url
+++ b/root/etc/cont-init.d/31-require-url
@@ -0,0 +1,7 @@
+#!/usr/bin/with-contenv bash
+
+# check to make sure that the required variables are set
+if [[ -z "${URL}" ]]; then
+    echo "Please pass your URL as an environment variable in your docker run command. See docker info for more details."
+    sleep infinity
+fi
--- a/root/etc/cont-init.d/40-folders
+++ b/root/etc/cont-init.d/40-folders
@@ -0,0 +1,11 @@
+#!/usr/bin/with-contenv bash
+
+# make our folders and links
+mkdir -p \
+    /config/{fail2ban,crontabs,dns-conf} \
+    /config/etc/letsencrypt \
+    /config/log/{fail2ban,letsencrypt,nginx} \
+    /config/nginx/proxy-confs \
+    /var/run/fail2ban
+rm -rf /etc/letsencrypt
+ln -s /config/etc/letsencrypt /etc/letsencrypt
--- a/root/etc/cont-init.d/41-samples
+++ b/root/etc/cont-init.d/41-samples
@@ -0,0 +1,12 @@
+#!/usr/bin/with-contenv bash
+
+# samples are removed on init by the nginx base
+
+# copy new samples
+if [[ -d /defaults/nginx/proxy-confs/ ]]; then
+    find /defaults/nginx/proxy-confs/ \
+        -maxdepth 1 \
+        -name "*.conf.sample" \
+        -type f \
+        -exec cp "{}" /config/nginx/proxy-confs/ +
+fi
--- a/root/etc/cont-init.d/42-fail2ban
+++ b/root/etc/cont-init.d/42-fail2ban
@@ -0,0 +1,28 @@
+#!/usr/bin/with-contenv bash
+
+# copy/update the fail2ban config defaults to/in /config
+cp -R /defaults/fail2ban/filter.d /config/fail2ban/
+cp -R /defaults/fail2ban/action.d /config/fail2ban/
+# if jail.local is missing in /config, copy default
+if [[ ! -f /config/fail2ban/jail.local ]]; then
+    cp /defaults/fail2ban/jail.local /config/fail2ban/jail.local
+fi
+# Replace fail2ban config with user config
+if [[ -d /etc/fail2ban/filter.d ]]; then
+    rm -rf /etc/fail2ban/filter.d
+fi
+if [[ -d /etc/fail2ban/action.d ]]; then
+    rm -rf /etc/fail2ban/action.d
+fi
+cp -R /config/fail2ban/filter.d /etc/fail2ban/
+cp -R /config/fail2ban/action.d /etc/fail2ban/
+cp /defaults/fail2ban/fail2ban.local /etc/fail2ban/
+cp /config/fail2ban/jail.local /etc/fail2ban/jail.local
+
+# logfiles needed by fail2ban
+if [[ ! -f /config/log/nginx/error.log ]]; then
+    touch /config/log/nginx/error.log
+fi
+if [[ ! -f /config/log/nginx/access.log ]]; then
+    touch /config/log/nginx/access.log
+fi
--- a/root/etc/cont-init.d/43-crontabs
+++ b/root/etc/cont-init.d/43-crontabs
@@ -0,0 +1,10 @@
+#!/usr/bin/with-contenv bash
+
+# copy crontabs if needed
+if [[ ! -f /config/crontabs/root ]]; then
+    cp /etc/crontabs/root /config/crontabs/
+fi
+
+# import user crontabs
+rm /etc/crontabs/*
+cp /config/crontabs/* /etc/crontabs/
--- a/root/etc/cont-init.d/45-nginx
+++ b/root/etc/cont-init.d/45-nginx
@@ -0,0 +1,27 @@
+#!/usr/bin/with-contenv bash
+
+# copy default config files if they don't exist
+if [[ ! -f /config/nginx/proxy.conf ]]; then
+    cp /defaults/nginx/proxy.conf.sample /config/nginx/proxy.conf
+fi
+
+# copy authelia config files if they don't exist
+if [[ ! -f /config/nginx/authelia-location.conf ]]; then
+    cp /defaults/nginx/authelia-location.conf.sample /config/nginx/authelia-location.conf
+fi
+if [[ ! -f /config/nginx/authelia-server.conf ]]; then
+    cp /defaults/nginx/authelia-server.conf.sample /config/nginx/authelia-server.conf
+fi
+
+# copy old ldap config file to new location
+if [[ -f /config/nginx/ldap.conf ]] && [[ ! -f /config/nginx/ldap-server.conf ]]; then
+    cp /config/nginx/ldap.conf /config/nginx/ldap-server.conf
+fi
+
+# copy ldap config files if they don't exist
+if [[ ! -f /config/nginx/ldap-location.conf ]]; then
+    cp /defaults/nginx/ldap-location.conf.sample /config/nginx/ldap-location.conf
+fi
+if [[ ! -f /config/nginx/ldap-server.conf ]]; then
+    cp /defaults/nginx/ldap-server.conf.sample /config/nginx/ldap-server.conf
+fi
--- a/root/etc/cont-init.d/50-certbot
+++ b/root/etc/cont-init.d/50-certbot
@@ -15,11 +15,6 @@ DNSPLUGIN=${DNSPLUGIN}\\n\
 EMAIL=${EMAIL}\\n\
 STAGING=${STAGING}\\n"

-# Echo init finish for test runs
-if [ -n "${TEST_RUN}" ]; then
-    echo '[services.d] done.'
-fi
-
 # Sanitize variables
 SANED_VARS=( DNSPLUGIN EMAIL EXTRA_DOMAINS ONLY_SUBDOMAINS STAGING SUBDOMAINS URL VALIDATION CERTPROVIDER )
 for i in "${SANED_VARS[@]}"
@@ -28,105 +23,15 @@ do
    export echo "$i"="$(echo "${!i}" | tr '[:upper:]' '[:lower:]')"
 done

-# check to make sure that the required variables are set
-[[ -z "$URL" ]] && \
-    echo "Please pass your URL as an environment variable in your docker run command. See docker info for more details." && \
-    sleep infinity
-
-# make our folders and links
-mkdir -p \
-    /config/{log/letsencrypt,log/fail2ban,etc/letsencrypt,fail2ban,crontabs,dns-conf,geoip2db} \
-    /var/run/fail2ban
-rm -rf /etc/letsencrypt
-ln -s /config/etc/letsencrypt /etc/letsencrypt
-
 # copy dns default configs
 cp -n /defaults/dns-conf/* /config/dns-conf/
 chown -R abc:abc /config/dns-conf

-# copy reverse proxy configs
-cp -R /defaults/proxy-confs /config/nginx/
-
-# copy/update the fail2ban config defaults to/in /config
-cp -R /defaults/fail2ban/filter.d /config/fail2ban/
-cp -R /defaults/fail2ban/action.d /config/fail2ban/
-# if jail.local is missing in /config, copy default
-[[ ! -f /config/fail2ban/jail.local ]] && \
-    cp /defaults/jail.local /config/fail2ban/jail.local
-# Replace fail2ban config with user config
-[[ -d /etc/fail2ban/filter.d ]] && \
-    rm -rf /etc/fail2ban/filter.d
-[[ -d /etc/fail2ban/action.d ]] && \
-    rm -rf /etc/fail2ban/action.d
-cp -R /config/fail2ban/filter.d /etc/fail2ban/
-cp -R /config/fail2ban/action.d /etc/fail2ban/
-cp /defaults/fail2ban/fail2ban.local /etc/fail2ban/
-cp /config/fail2ban/jail.local /etc/fail2ban/jail.local
-
-# copy crontab and proxy defaults if needed
-[[ ! -f /config/crontabs/root ]] && \
-    cp /etc/crontabs/root /config/crontabs/
-[[ ! -f /config/nginx/proxy.conf ]] && \
-    cp /defaults/proxy.conf /config/nginx/proxy.conf
-[[ ! -f /config/nginx/ssl.conf ]] && \
-    cp /defaults/ssl.conf /config/nginx/ssl.conf
-[[ ! -f /config/nginx/ldap.conf ]] && \
-    cp /defaults/ldap.conf /config/nginx/ldap.conf
-[[ ! -f /config/nginx/authelia-server.conf ]] && \
-    cp /defaults/authelia-server.conf /config/nginx/authelia-server.conf
-[[ ! -f /config/nginx/authelia-location.conf ]] && \
-    cp /defaults/authelia-location.conf /config/nginx/authelia-location.conf
-[[ ! -f /config/www/502.html ]] &&
-    cp /defaults/502.html /config/www/502.html
-
-# Set resolver, ignore ipv6 addresses
-if ! grep -q 'resolver' /config/nginx/resolver.conf; then
-    RESOLVERRAW=$(awk 'BEGIN{ORS=" "} $1=="nameserver" {print $2}' /etc/resolv.conf)
-    for i in ${RESOLVERRAW}; do
-        if [ $(awk -F ':' '{print NF-1}' <<< ${i}) -le 2 ]; then
-            RESOLVER="${RESOLVER} ${i}"
-        fi
-    done
-    if [ -z "${RESOLVER}" ]; then
-        RESOLVER="127.0.0.11"
-    fi
-    echo "Setting resolver to ${RESOLVER}"
-    echo -e "# This file is auto-generated only on first start, based on the container's /etc/resolv.conf file. Feel free to modify it as you wish.\n\nresolver ${RESOLVER} valid=30s;" > /config/nginx/resolver.conf
-fi
-
-# Set worker_processes
-if ! grep -q 'worker_processes' /config/nginx/worker_processes.conf; then
-    WORKER_PROCESSES=$(nproc)
-    echo "Setting worker_processes to ${WORKER_PROCESSES}"
-    echo -e "# This file is auto-generated only on first start, based on the cpu cores detected. Feel free to change it to any other number or to auto to let nginx handle it automatically.\n\nworker_processes ${WORKER_PROCESSES};" > /config/nginx/worker_processes.conf
-fi
-
-# remove lua bits from nginx.conf if not done before
-if ! grep -q '#Removed lua' /config/nginx/nginx.conf; then
-    echo "Removing lua specific info from nginx.conf"
-    sed -i 's|\tlua_load_resty_core off;|\t#Removed lua. Do not remove this comment|g' /config/nginx/nginx.conf
-fi
-
-# patch authelia-server.conf for CVE-2021-32637
-if ! grep -q 'if ($request_uri ~' /config/nginx/authelia-server.conf; then
-    sed -i '/internal;/a \ \ \ \ if ($request_uri ~ [^a-zA-Z0-9_+-=\\!@$%&*?~.:#'\''\\;\\(\\)\\[\\]]) { return 401; }' /config/nginx/authelia-server.conf
-fi
-
-# copy pre-generated dhparams or generate if needed
-[[ ! -f /config/nginx/dhparams.pem ]] && \
-    cp /defaults/dhparams.pem /config/nginx/dhparams.pem
-if ! grep -q 'PARAMETERS' "/config/nginx/dhparams.pem"; then
-    curl -o /config/nginx/dhparams.pem -L "https://ssl-config.mozilla.org/ffdhe4096.txt"
-fi
-
 # check to make sure DNSPLUGIN is selected if dns validation is used
-[[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(aliyun|cloudflare|cloudxns|cpanel|desec|digitalocean|directadmin|dnsimple|dnsmadeeasy|dnspod|domeneshop|gandi|gehirn|google|he|hetzner|infomaniak|inwx|ionos|linode|luadns|netcup|njalla|nsone|ovh|rfc2136|route53|sakuracloud|transip|vultr)$ ]] && \
-    echo "Please set the DNSPLUGIN variable to a valid plugin name. See docker info for more details." && \
+if [[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(aliyun|azure|cloudflare|cloudxns|cpanel|desec|digitalocean|directadmin|dnsimple|dnsmadeeasy|dnspod|domeneshop|dynu|gandi|gehirn|google|he|hetzner|infomaniak|inwx|ionos|linode|loopia|luadns|netcup|njalla|nsone|ovh|rfc2136|route53|sakuracloud|standalone|transip|vultr)$ ]]; then
+    echo "Please set the DNSPLUGIN variable to a valid plugin name. See docker info for more details."
    sleep infinity
-
-# import user crontabs
-rm /etc/crontabs/*
-cp /config/crontabs/* /etc/crontabs/
+fi

 # create original config file if it doesn't exist, move non-hidden legacy file to hidden
 if [ -f "/config/donoteditthisfile.conf" ]; then
@@ -234,12 +139,18 @@ if [ "$VALIDATION" = "dns" ]; then
    elif [[ "$DNSPLUGIN" =~ ^(google)$ ]]; then
        if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
        PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.json ${PROPAGATIONPARAM}"
-    elif [[ "$DNSPLUGIN" =~ ^(aliyun|desec|dnspod|domeneshop|he|hetzner|infomaniak|inwx|ionos|netcup|njalla|transip|vultr)$ ]]; then
+    elif [[ "$DNSPLUGIN" =~ ^(aliyun|desec|dnspod|domeneshop|dynu|he|hetzner|infomaniak|inwx|ionos|loopia|netcup|njalla|transip|vultr)$ ]]; then
        if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
        PREFCHAL="-a dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
+    elif [[ "$DNSPLUGIN" =~ ^(standalone)$ ]]; then
+        if [ -n "$PROPAGATION" ];then echo "standalone dns plugin does not support setting propagation time"; fi
+        PREFCHAL="-a dns-${DNSPLUGIN}"
    elif [[ "$DNSPLUGIN" =~ ^(directadmin)$ ]]; then
        if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
        PREFCHAL="-a ${DNSPLUGIN} --${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
+    elif [[ "$DNSPLUGIN" =~ ^(azure)$ ]]; then
+        if [ -n "$PROPAGATION" ];then echo "Azure dns plugin does not support setting propagation time"; fi
+        PREFCHAL="-a dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini"
    else
        if [ -n "$PROPAGATION" ];then PROPAGATIONPARAM="--dns-${DNSPLUGIN}-propagation-seconds ${PROPAGATION}"; fi
        PREFCHAL="--dns-${DNSPLUGIN} --dns-${DNSPLUGIN}-credentials /config/dns-conf/${DNSPLUGIN}.ini ${PROPAGATIONPARAM}"
@@ -272,6 +183,10 @@ if [ "$ONLY_SUBDOMAINS" = "true" ] && [ ! "$SUBDOMAINS" = "wildcard" ] ; then
 else
    ln -s ../etc/letsencrypt/live/"$URL" /config/keys/letsencrypt
 fi
+rm -rf /config/keys/cert.crt
+ln -s ./letsencrypt/fullchain.pem /config/keys/cert.crt
+rm -rf /config/keys/cert.key
+ln -s ./letsencrypt/privkey.pem /config/keys/cert.key

 # checking for changes in cert variables, revoking certs if necessary
 if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "$ONLY_SUBDOMAINS" = "$ORIGONLY_SUBDOMAINS" ] || [ ! "$EXTRA_DOMAINS" = "$ORIGEXTRA_DOMAINS" ] || [ ! "$VALIDATION" = "$ORIGVALIDATION" ] || [ ! "$DNSPLUGIN" = "$ORIGDNSPLUGIN" ] || [ ! "$PROPAGATION" = "$ORIGPROPAGATION" ] || [ ! "$STAGING" = "$ORIGSTAGING" ] || [ ! "$DUCKDNSTOKEN" = "$ORIGDUCKDNSTOKEN" ] || [ ! "$CERTPROVIDER" = "$ORIGCERTPROVIDER" ]; then
@@ -295,7 +210,9 @@ if [ ! "$URL" = "$ORIGURL" ] || [ ! "$SUBDOMAINS" = "$ORIGSUBDOMAINS" ] || [ ! "
    else
        REV_ACMESERVER="https://acme-v02.api.letsencrypt.org/directory"
    fi
-    [[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]] && certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem --server $REV_ACMESERVER
+    if [[ -f /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem ]]; then
+        certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"$ORIGDOMAIN"/fullchain.pem --server $REV_ACMESERVER
+    fi
    rm -rf /config/etc/letsencrypt
    mkdir -p /config/etc/letsencrypt
 fi
@@ -354,24 +271,3 @@ if [ ! -f "/config/keys/letsencrypt/fullchain.pem" ]; then
 else
    echo "Certificate exists; parameters unchanged; starting nginx"
 fi
-
-# create GeoIP2 folder symlink
-[[ -d /var/lib/libmaxminddb ]] && [[ ! -L /var/lib/libmaxminddb ]] && \
-    rm -rf /var/lib/libmaxminddb
-[[ ! -d /var/lib/libmaxminddb ]] && \
-    ln -s /config/geoip2db /var/lib/libmaxminddb
-
-# logfiles needed by fail2ban
-[[ ! -f /config/log/nginx/error.log ]] && \
-    touch /config/log/nginx/error.log
-[[ ! -f /config/log/nginx/access.log ]] && \
-    touch /config/log/nginx/access.log
-
-# permissions
-chown -R abc:abc \
-    /config
-chmod -R 0644 /etc/logrotate.d
-chmod -R +r /config/log
-chmod +x /app/le-renew.sh
-chmod 700 /defaults/dns-conf
-chmod 600 /defaults/dns-conf/*
--- a/root/etc/cont-init.d/55-permissions
+++ b/root/etc/cont-init.d/55-permissions
@@ -0,0 +1,8 @@
+#!/usr/bin/with-contenv bash
+
+# permissions
+chown -R abc:abc \
+    /config
+chmod -R 0644 /etc/logrotate.d
+chmod -R +r /config/log
+chmod +x /app/le-renew.sh
--- a/root/etc/cont-init.d/70-outdated
+++ b/root/etc/cont-init.d/70-outdated
@@ -0,0 +1,12 @@
+#!/usr/bin/with-contenv bash
+
+if [[ -f /config/nginx/geoip2.conf ]]; then
+    echo "/config/nginx/geoip2.conf exists.
+        Please migrate to https://github.com/linuxserver/docker-mods/tree/swag-maxmind"
+fi
+if [[ -f /config/nginx/ldap.conf ]]; then
+    echo "/config/nginx/ldap.conf exists.
+        Please apply any customizations to /config/nginx/ldap-server.conf
+        Ensure your configs are updated and remove /config/nginx/ldap.conf
+        If you do not use this config, simply remove it."
+fi
--- a/root/etc/cont-init.d/70-templates
+++ b/root/etc/cont-init.d/70-templates
@@ -1,41 +0,0 @@
-#!/usr/bin/with-contenv bash
-
-nginx_confs=( \
-    authelia-location.conf \
-    authelia-server.conf \
-    ldap.conf \
-    nginx.conf \
-    proxy.conf \
-    site-confs/default \
-    ssl.conf )
-
-for i in ${nginx_confs[@]}; do
-    if [ "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' /config/nginx/${i})" != "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' /defaults/$(basename ${i}))" ]; then
-        nginx_confs_changed="/config/nginx/${i}\n${nginx_confs_changed}"
-    fi
-done
-
-if [ -n "$nginx_confs_changed" ]; then
-    echo "**** The following nginx confs have different version dates than the defaults that are shipped. ****"
-    echo "**** This may be due to user customization or an update to the defaults. ****"
-    echo "**** To update them to the latest defaults shipped within the image, delete these files and restart the container. ****"
-    echo "**** If they are user customized, check the date version at the top and compare to the upstream changelog via the link. ****"
-    echo -e "${nginx_confs_changed}"
-fi
-
-proxy_confs=$(ls /config/nginx/proxy-confs/*.conf 2>/dev/null)
-
-for i in $proxy_confs; do
-    if [ -f "${i}.sample" ]; then
-        if [ "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' ${i})" != "$(sed -nE 's|^## Version ([0-9]{4}\/[0-9]{2}\/[0-9]{2}).*|\1|p' ${i}.sample)" ]; then
-            proxy_confs_changed="${i}\n${proxy_confs_changed}"
-        fi
-    fi
-done
-
-if [ -n "$proxy_confs_changed" ]; then
-    echo "**** The following reverse proxy confs have different version dates than the samples that are shipped. ****"
-    echo "**** This may be due to user customization or an update to the samples. ****"
-    echo "**** You should compare them to the samples in the same folder to make sure you have the latest updates. ****"
-    echo -e "${proxy_confs_changed}"
-fi
Author	SHA1	Message	Date
LinuxServer-CI	58c0c03187	Bot Updating Package Versions	2022-09-22 17:20:05 +02:00
aptalca	1f6ebcacba	Merge pull request #169 from linuxserver/standard-base Standard base	2022-09-22 11:14:11 -04:00
LinuxServer-CI	cef4185e28	Bot Updating Package Versions	2022-09-22 01:11:18 -05:00
LinuxServer-CI	6a32528288	Bot Updating Templated Files	2022-09-22 01:05:41 -05:00
Eric Nemchik	c6c9e02285	Init authelia and ldap configs	2022-09-08 12:07:12 -05:00
Eric Nemchik	f3f295a09e	Update 45-nginx	2022-09-02 12:28:18 -05:00
Eric Nemchik	96f746d5ce	Remove error_pages	2022-09-01 18:34:35 -05:00
LinuxServer-CI	8d5430dada	Bot Updating Package Versions	2022-09-01 07:54:15 +02:00
aptalca	b2e05fe4de	fix wheel repo address	2022-08-31 14:37:11 -04:00
LinuxServer-CI	768aaeaedb	Bot Updating Package Versions	2022-08-25 00:57:12 -05:00
Eric Nemchik	ea2d9b30eb	nginx conf tweaks	2022-08-23 09:30:30 -05:00
aptalca	2f4c1fed51	remove workaround for authelia CVE-2021-32637 fixed upstream a long time ago	2022-08-22 09:31:02 -04:00
Eric Nemchik	c9394cd08f	Keep /config volume consistently	2022-08-21 17:05:56 -05:00
Eric Nemchik	6123952de7	Use standard nginx.conf from lsio alpine nginx base image	2022-08-20 09:40:38 -05:00
LinuxServer-CI	f23d9fbeff	Bot Updating Package Versions	2022-08-18 00:38:25 -05:00
LinuxServer-CI	e6628f05c3	Bot Updating Templated Files	2022-08-12 16:23:18 -05:00
Adam	f8ee44ca8d	Merge pull request #256 from coreyramirezgomez/ft/dynu_dns	2022-08-12 22:21:51 +01:00
LinuxServer-CI	a5d730d298	Bot Updating Package Versions	2022-08-11 07:21:22 +02:00
Corey Ramirez-Gomez	e22a083d7a	Add Dynu DNS Support	2022-08-10 09:27:53 +00:00
LinuxServer-CI	a2371253a7	Bot Updating Package Versions	2022-08-04 00:32:43 -05:00
LinuxServer-CI	4864761b54	Bot Updating Package Versions	2022-07-21 07:32:51 +02:00
LinuxServer-CI	3d70935ecf	Bot Updating Package Versions	2022-07-14 07:34:38 +02:00
LinuxServer-CI	e5b672e52b	Bot Updating Package Versions	2022-07-08 12:46:30 +02:00
Eric Nemchik	1adf35b5df	Merge pull request #246 from linuxserver/minor-readme-update Minor readme update	2022-07-08 05:37:38 -05:00
Eric Nemchik	c279c173b3	Minor readme update	2022-07-07 21:01:12 -05:00
LinuxServer-CI	8ed7c7ee28	Bot Updating Package Versions	2022-07-06 23:02:12 +02:00
LinuxServer-CI	1f42c02a4a	Bot Updating Package Versions	2022-06-23 00:25:18 -05:00
LinuxServer-CI	37b5af4856	Bot Updating Package Versions	2022-06-16 00:22:29 -05:00
LinuxServer-CI	016dc18007	Bot Updating Package Versions	2022-06-07 21:51:48 -05:00
LinuxServer-CI	dd034ef3c1	Bot Updating Package Versions	2022-06-02 07:35:33 +02:00
LinuxServer-CI	0069f887a7	Bot Updating Package Versions	2022-05-26 07:25:29 +02:00
aptalca	623e99c6ab	Merge pull request #234 from linuxserver/azure fix azure dns	2022-05-18 09:48:23 -04:00
aptalca	996d3b26df	fix azure dns	2022-05-18 09:32:44 -04:00
LinuxServer-CI	252d57cf34	Bot Updating Package Versions	2022-05-18 10:54:23 +02:00
LinuxServer-CI	4b486b547c	Bot Updating Templated Files	2022-05-18 10:50:45 +02:00
Roxedus	ef95db397b	Merge pull request #217 from RobinDadswell/azureDNSSupport	2022-05-18 01:49:25 -07:00
LinuxServer-CI	0bb1f55280	Bot Updating Package Versions	2022-05-12 07:29:01 +02:00
LinuxServer-CI	5df55cc0c0	Bot Updating Package Versions	2022-05-03 17:59:50 -05:00
LinuxServer-CI	ceabef087f	Bot Updating Templated Files	2022-05-04 00:55:45 +02:00
LinuxServer-CI	6f9ed0721d	Bot Updating Templated Files	2022-05-04 00:54:37 +02:00
LinuxServer-CI	5319c88dfa	Bot Updating Package Versions	2022-04-28 00:43:35 -05:00
LinuxServer-CI	c875b69297	Bot Updating Package Versions	2022-04-21 00:41:17 -05:00
Robin Dadswell	3893db4077	New: Azure DNS support	2022-04-17 22:09:14 +01:00
LinuxServer-CI	f8e4eca8d0	Bot Updating Package Versions	2022-04-14 07:20:07 +02:00
LinuxServer-CI	ee6a7d454f	Bot Updating Package Versions	2022-04-09 11:21:10 -05:00
LinuxServer-CI	f29ae615d4	Bot Updating Templated Files	2022-04-09 11:15:55 -05:00
Potterer	a9fd11ff77	Add Loopia DNS Support (#226 )	2022-04-09 17:14:35 +01:00
LinuxServer-CI	60c0da359b	Bot Updating Templated Files	2022-04-05 21:55:48 -05:00
aptalca	bec249ba73	Merge pull request #179 from mhofer117/standalone-dns-validation Add support for standalone DNS validation	2022-04-05 19:13:42 -04:00
aptalca	eb7df9d9fc	Merge branch 'master' into standalone-dns-validation	2022-04-05 19:08:28 -04:00
aptalca	a29f2da10e	update changelog date	2022-04-05 19:06:43 -04:00
LinuxServer-CI	a9e53d5fc8	Bot Updating Package Versions	2022-04-05 21:56:51 +02:00
quietsy	f9e05fd86a	Merge pull request #219 from EVOTk/patch-1 add nginx unauthorized in Using fail2ban section	2022-03-31 20:59:57 +00:00
LinuxServer-CI	b28eed1263	Bot Updating Package Versions	2022-03-28 16:40:46 -05:00
LinuxServer-CI	7eb8f7999e	Bot Updating Templated Files	2022-03-28 16:35:42 -05:00
aptalca	5beb4ffb32	Merge pull request #223 from millerthegorilla/unauthorized-log-patch-1 Update 50-config create fail2ban unauthorized.log	2022-03-28 17:34:11 -04:00
James Stewart Miller	9821740d65	Update readme-vars.yml added changelog	2022-03-28 21:57:19 +01:00
James Stewart Miller	5501308aed	Update 50-config create fail2ban unauthorized.log added code to test for existence of unauthorized.log and create it if not exists. /config/log/nginx/unauthorized.log is written to by addition of nginx-unauthorized jail in jail.local at (https://github.com/linuxserver/docker-swag/blob/master/root/defaults/jail.local)	2022-03-26 20:46:39 +00:00
EVOTk	2272c3037a	Update readme-vars.yml	2022-03-25 22:51:17 +01:00
LinuxServer-CI	cf8cfd4241	Bot Updating Package Versions	2022-03-24 06:19:17 +01:00
LinuxServer-CI	a5389c3f40	Bot Updating Package Versions	2022-03-16 21:57:12 +01:00
LinuxServer-CI	1fbae23bcf	Bot Updating Package Versions	2022-03-10 06:19:39 +01:00
EVOTk	de3b43cb62	add nginx unauthorized in Using fail2ban section	2022-03-09 21:59:49 +01:00
Marcel Hofer	1ff4691000	Merge branch 'master' into standalone-dns-validation	2021-12-12 01:06:20 +01:00
Marcel Hofer	2878d84050	Merge remote-tracking branch 'linuxserver/master' into standalone-dns-validation # Conflicts: # readme-vars.yml # root/etc/cont-init.d/50-config	2021-11-24 22:02:24 +01:00
Marcel Hofer	85efd12ba4	Merge branch 'master' into standalone-dns-validation	2021-11-20 19:47:43 +01:00
Marcel Hofer	f307dbbfb7	Merge branch 'master' into standalone-dns-validation	2021-11-16 21:12:06 +01:00
Marcel Hofer	0ce2ae551a	Add support for standalone DNS validation	2021-11-06 16:07:51 +01:00