Merge pull request #30 from linuxserver/frame-ancestors

Set frame-ancestors in Content-Security-Policy

.github/CONTRIBUTING.md

@@ -0,0 +1,122 @@
+# Contributing to swag
+
+## Gotchas
+
+* While contributing make sure to make all your changes before creating a Pull Request, as our pipeline builds each commit after the PR is open.
+* Read, and fill the Pull Request template
+  * If this is a fix for a typo in code or documentation in the README please file an issue
+  * If the PR is addressing an existing issue include, closes #\<issue number>, in the body of the PR commit message
+* If you want to discuss changes, you can also bring it up in [#dev-talk](https://discordapp.com/channels/354974912613449730/757585807061155840) in our [Discord server](https://discord.gg/YWrKVTn)
+
+## Common files
+
+| File | Use case |
+| :----: | --- |
+| `Dockerfile` | Dockerfile used to build amd64 images |
+| `Dockerfile.aarch64` | Dockerfile used to build 64bit ARM architectures |
+| `Dockerfile.armhf` | Dockerfile used to build 32bit ARM architectures |
+| `Jenkinsfile` | This file is a product of our builder and should not be edited directly. This is used to build the image |
+| `jenkins-vars.yml` | This file is used to generate the `Jenkinsfile` mentioned above, it only affects the build-process |
+| `package_versions.txt` | This file is generated as a part of the build-process and should not be edited directly. It lists all the installed packages and their versions |
+| `README.md` | This file is a product of our builder and should not be edited directly. This displays the readme for the repository and image registries |
+| `readme-vars.yml` | This file is used to generate the `README.md` |
+
+## Readme
+
+If you would like to change our readme, please __**do not**__ directly edit the readme, as it is auto-generated on each commit.
+Instead edit the [readme-vars.yml](https://github.com/linuxserver/docker-swag/edit/master/readme-vars.yml).
+
+These variables are used in a template for our [Jenkins Builder](https://github.com/linuxserver/docker-jenkins-builder) as part of an ansible play.
+Most of these variables are also carried over to [docs.linuxserver.io](https://docs.linuxserver.io/images/docker-swag)
+
+### Fixing typos or clarify the text in the readme
+
+There are variables for multiple parts of the readme, the most common ones are:
+
+| Variable | Description |
+| :----: | --- |
+| `project_blurb` | This is the short excerpt shown above the project logo. |
+| `app_setup_block` | This is the text that shows up under "Application Setup" if enabled |
+
+### Parameters
+
+The compose and run examples are also generated from these variables.
+
+We have a [reference file](https://github.com/linuxserver/docker-jenkins-builder/blob/master/vars/_container-vars-blank) in our Jenkins Builder.
+
+These are prefixed with `param_` for required parameters, or `opt_param` for optional parameters, except for `cap_add`.
+Remember to enable param, if currently disabled. This differs between parameters, and can be seen in the reference file.
+
+Devices, environment variables, ports and volumes expects its variables in a certain way.
+
+### Devices
+
+```yml
+param_devices:
+  - { device_path: "/dev/dri", device_host_path: "/dev/dri", desc: "For hardware transcoding" }
+opt_param_devices:
+  - { device_path: "/dev/dri", device_host_path: "/dev/dri", desc: "For hardware transcoding" }
+```
+
+### Environment variables
+
+```yml
+param_env_vars:
+  - { env_var: "TZ", env_value: "Europe/London", desc: "Specify a timezone to use EG Europe/London." }
+opt_param_env_vars:
+  - { env_var: "VERSION", env_value: "latest", desc: "Supported values are LATEST, PLEXPASS or a specific version number." }
+```
+
+### Ports
+
+```yml
+param_ports:
+  - { external_port: "80", internal_port: "80", port_desc: "Application WebUI" }
+opt_param_ports:
+  - { external_port: "80", internal_port: "80", port_desc: "Application WebUI" }
+```
+
+### Volumes
+
+```yml
+param_volumes:
+  - { vol_path: "/config", vol_host_path: "</path/to/appdata/config>", desc: "Configuration files." }
+opt_param_volumes:
+  - { vol_path: "/config", vol_host_path: "</path/to/appdata/config>", desc: "Configuration files." }
+```
+
+### Testing template changes
+
+After you make any changes to the templates, you can use our [Jenkins Builder](https://github.com/linuxserver/docker-jenkins-builder) to have the files updated from the modified templates. Please use the command found under `Running Locally` [on this page](https://github.com/linuxserver/docker-jenkins-builder/blob/master/README.md) to generate them prior to submitting a PR.
+
+## Dockerfiles
+
+We use multiple Dockerfiles in our repos, this is because sometimes some CPU architectures needs different packages to work.
+If you are proposing additional packages to be added, ensure that you added the packages to all the Dockerfiles in alphabetical order.
+
+### Testing your changes
+
+```
+git clone https://github.com/linuxserver/docker-swag.git
+cd docker-swag
+docker build \
+  --no-cache \
+  --pull \
+  -t linuxserver/swag:latest .
+```
+
+The ARM variants can be built on x86_64 hardware using `multiarch/qemu-user-static`
+```
+docker run --rm --privileged multiarch/qemu-user-static:register --reset
+```
+
+Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64`.
+
+## Update the chagelog
+
+If you are modifying the Dockerfiles or any of the startup scripts in [root](https://github.com/linuxserver/docker-swag/tree/master/root), add an entry to the changelog
+
+```yml
+changelogs:
+  - { date: "DD.MM.YY:", desc: "Added some love to templates" }
+```

.github/ISSUE_TEMPLATE.md

@@ -1,7 +1,10 @@
 [linuxserverurl]: https://linuxserver.io
 [![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]
 
-If you are new to Docker or this application our issue tracker is **ONLY** used for reporting bugs or requesting features. Please use [our discord server](https://discord.gg/YWrKVTn) for general support.
+<!--- If you are new to Docker or this application our issue tracker is **ONLY** used for reporting bugs or requesting features. Please use [our discord server](https://discord.gg/YWrKVTn) for general support. --->
+
+<!--- If this acts as a feature request please ask yourself if this modification is something the whole userbase will benefit from --->
+<!--- If this is a specific change for corner case functionality or plugins please look at making a Docker Mod or local script  https://blog.linuxserver.io/2019/09/14/customizing-our-containers/ -->
 
 <!--- Provide a general summary of the issue in the Title above -->
 
@@ -22,9 +25,10 @@ If you are new to Docker or this application our issue tracker is **ONLY** used
 4.
 
 ## Environment
-**OS:**      
-**CPU architecture:** x86_64/arm32/arm64      
-**How docker service was installed:**      
+**OS:**
+**CPU architecture:** x86_64/arm32/arm64
+**How docker service was installed:**
+<!--- ie. from the official docker repo, from the distro repo, nas OS provided, etc. -->
 <!--- Providing context helps us come up with a solution that is most useful in the real world -->
 
 ## Command used to create docker container (run/create/compose/screenshot)

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,11 +2,11 @@
 
 [linuxserverurl]: https://linuxserver.io
 [![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]
-	
+
 
 <!--- Before submitting a pull request please check the following -->
 
-<!---  If this is a fix for a typo in code or documentation in the README please file an issue and let us sort it out we do not need a PR  --> 
+<!---  If this is a fix for a typo in code or documentation in the README please file an issue and let us sort it out we do not need a PR  -->
 <!---  Ask yourself if this modification is something the whole userbase will benefit from, if this is a specific change for corner case functionality or plugins please look at making a Docker Mod or local script  https://blog.linuxserver.io/2019/09/14/customizing-our-containers/ -->
 <!---  That if the PR is addressing an existing issue include, closes #<issue number> , in the body of the PR commit message   -->
 <!---  You have included links to any files / patches etc your PR may be using in the body of the PR commit message -->
@@ -21,7 +21,11 @@
 
 ------------------------------
 
-We welcome all PR’s though this doesn’t guarantee it will be accepted.
+ - [ ] I have read the [contributing](https://github.com/linuxserver/docker-swag/blob/master/.github/CONTRIBUTING.md) guideline and understand that I have made the correct modifications
+
+------------------------------
+
+<!--- We welcome all PR’s though this doesn’t guarantee it will be accepted. -->
 
 ## Description:
 <!--- Describe your changes in detail -->

.github/workflows/greetings.yml

@@ -1,6 +1,6 @@
 name: Greetings
 
-on: [pull_request, issues]
+on: [pull_request_target, issues]
 
 jobs:
   greeting:
@@ -8,6 +8,6 @@ jobs:
     steps:
     - uses: actions/first-interaction@v1
       with:
-        issue-message: 'Thanks for opening your first issue here! Be sure to follow the [issue template](https://github.com/linuxserver/docker-swag/.github/ISSUE_TEMPLATE.md)!'
-        pr-message: 'Thanks for opening this pull request! Be sure to follow the [pull request template](https://github.com/linuxserver/docker-swag/.github/PULL_REQUEST_TEMPLATE.md)!'
+        issue-message: 'Thanks for opening your first issue here! Be sure to follow the [issue template](https://github.com/linuxserver/docker-swag/blob/master/.github/ISSUE_TEMPLATE.md)!'
+        pr-message: 'Thanks for opening this pull request! Be sure to follow the [pull request template](https://github.com/linuxserver/docker-swag/blob/master/.github/PULL_REQUEST_TEMPLATE.md)!'
         repo-token: ${{ secrets.GITHUB_TOKEN }}

Dockerfile

@@ -79,6 +79,7 @@ RUN \
 	php7-xml \
 	php7-xmlreader \
 	php7-xmlrpc \
+	php7-xsl \
 	php7-zip \
 	py3-cryptography \
 	py3-future \

Dockerfile.aarch64

@@ -79,6 +79,7 @@ RUN \
 	php7-xml \
 	php7-xmlreader \
 	php7-xmlrpc \
+	php7-xsl \
 	php7-zip \
 	py3-cryptography \
 	py3-future \

Dockerfile.armhf

@@ -79,6 +79,7 @@ RUN \
 	php7-xml \
 	php7-xmlreader \
 	php7-xmlrpc \
+	php7-xsl \
 	php7-zip \
 	py3-cryptography \
 	py3-future \

Jenkinsfile

@@ -56,7 +56,7 @@ pipeline {
           env.CODE_URL = 'https://github.com/' + env.LS_USER + '/' + env.LS_REPO + '/commit/' + env.GIT_COMMIT
           env.DOCKERHUB_LINK = 'https://hub.docker.com/r/' + env.DOCKERHUB_IMAGE + '/tags/'
           env.PULL_REQUEST = env.CHANGE_ID
-          env.TEMPLATED_FILES = 'Jenkinsfile README.md LICENSE ./.github/FUNDING.yml ./.github/ISSUE_TEMPLATE.md ./.github/PULL_REQUEST_TEMPLATE.md ./.github/workflows/greetings.yml ./.github/workflows/stale.yml ./root/donate.txt'
+          env.TEMPLATED_FILES = 'Jenkinsfile README.md LICENSE ./.github/CONTRIBUTING.md ./.github/FUNDING.yml ./.github/ISSUE_TEMPLATE.md ./.github/PULL_REQUEST_TEMPLATE.md ./.github/workflows/greetings.yml ./.github/workflows/stale.yml ./root/donate.txt'
         }
         script{
           env.LS_RELEASE_NUMBER = sh(
@@ -136,6 +136,7 @@ pipeline {
             env.CI_TAGS = env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER
           }
           env.META_TAG = env.EXT_RELEASE_CLEAN + '-ls' + env.LS_TAG_NUMBER
+          env.EXT_RELEASE_TAG = 'version-' + env.EXT_RELEASE_CLEAN
         }
       }
     }
@@ -156,6 +157,7 @@ pipeline {
             env.CI_TAGS = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA
           }
           env.META_TAG = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-dev-' + env.COMMIT_SHA
+          env.EXT_RELEASE_TAG = 'version-' + env.EXT_RELEASE_CLEAN
           env.DOCKERHUB_LINK = 'https://hub.docker.com/r/' + env.DEV_DOCKERHUB_IMAGE + '/tags/'
         }
       }
@@ -176,6 +178,7 @@ pipeline {
             env.CI_TAGS = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST
           }
           env.META_TAG = env.EXT_RELEASE_CLEAN + '-pkg-' + env.PACKAGE_TAG + '-pr-' + env.PULL_REQUEST
+          env.EXT_RELEASE_TAG = 'version-' + env.EXT_RELEASE_CLEAN
           env.CODE_URL = 'https://github.com/' + env.LS_USER + '/' + env.LS_REPO + '/pull/' + env.PULL_REQUEST
           env.DOCKERHUB_LINK = 'https://hub.docker.com/r/' + env.PR_DOCKERHUB_IMAGE + '/tags/'
         }
@@ -543,8 +546,10 @@ pipeline {
                   for PUSHIMAGE in "${GITHUBIMAGE}" "${GITLABIMAGE}" "${IMAGE}"; do
                     docker tag ${IMAGE}:${META_TAG} ${PUSHIMAGE}:${META_TAG}
                     docker tag ${PUSHIMAGE}:${META_TAG} ${PUSHIMAGE}:latest
+                    docker tag ${PUSHIMAGE}:${META_TAG} ${PUSHIMAGE}:${EXT_RELEASE_TAG}
                     docker push ${PUSHIMAGE}:latest
                     docker push ${PUSHIMAGE}:${META_TAG}
+                    docker push ${PUSHIMAGE}:${EXT_RELEASE_TAG}
                   done
                '''
           }
@@ -552,6 +557,7 @@ pipeline {
                 for DELETEIMAGE in "${GITHUBIMAGE}" "{GITLABIMAGE}" "${IMAGE}"; do
                   docker rmi \
                   ${DELETEIMAGE}:${META_TAG} \
+                  ${DELETEIMAGE}:${EXT_RELEASE_TAG} \
                   ${DELETEIMAGE}:latest || :
                 done
              '''
@@ -592,12 +598,18 @@ pipeline {
                     docker tag ${MANIFESTIMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:amd64-latest
                     docker tag ${MANIFESTIMAGE}:arm32v7-${META_TAG} ${MANIFESTIMAGE}:arm32v7-latest
                     docker tag ${MANIFESTIMAGE}:arm64v8-${META_TAG} ${MANIFESTIMAGE}:arm64v8-latest
+                    docker tag ${MANIFESTIMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG}
+                    docker tag ${MANIFESTIMAGE}:arm32v7-${META_TAG} ${MANIFESTIMAGE}:arm32v7-${EXT_RELEASE_TAG}
+                    docker tag ${MANIFESTIMAGE}:arm64v8-${META_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG}
                     docker push ${MANIFESTIMAGE}:amd64-${META_TAG}
                     docker push ${MANIFESTIMAGE}:arm32v7-${META_TAG}
                     docker push ${MANIFESTIMAGE}:arm64v8-${META_TAG}
                     docker push ${MANIFESTIMAGE}:amd64-latest
                     docker push ${MANIFESTIMAGE}:arm32v7-latest
                     docker push ${MANIFESTIMAGE}:arm64v8-latest
+                    docker push ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG}
+                    docker push ${MANIFESTIMAGE}:arm32v7-${EXT_RELEASE_TAG}
+                    docker push ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG}
                     docker manifest push --purge ${MANIFESTIMAGE}:latest || :
                     docker manifest create ${MANIFESTIMAGE}:latest ${MANIFESTIMAGE}:amd64-latest ${MANIFESTIMAGE}:arm32v7-latest ${MANIFESTIMAGE}:arm64v8-latest
                     docker manifest annotate ${MANIFESTIMAGE}:latest ${MANIFESTIMAGE}:arm32v7-latest --os linux --arch arm
@@ -606,8 +618,12 @@ pipeline {
                     docker manifest create ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:amd64-${META_TAG} ${MANIFESTIMAGE}:arm32v7-${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG}
                     docker manifest annotate ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:arm32v7-${META_TAG} --os linux --arch arm
                     docker manifest annotate ${MANIFESTIMAGE}:${META_TAG} ${MANIFESTIMAGE}:arm64v8-${META_TAG} --os linux --arch arm64 --variant v8
+                    docker manifest create ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm32v7-${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG}
+                    docker manifest annotate ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm32v7-${EXT_RELEASE_TAG} --os linux --arch arm
+                    docker manifest annotate ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG} --os linux --arch arm64 --variant v8
                     docker manifest push --purge ${MANIFESTIMAGE}:latest
                     docker manifest push --purge ${MANIFESTIMAGE}:${META_TAG} 
+                    docker manifest push --purge ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} 
                   done
                   docker tag ${IMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:amd64-${META_TAG}
                   docker tag ${IMAGE}:arm32v7-${META_TAG} ${GITHUBIMAGE}:arm32v7-${META_TAG}
@@ -616,6 +632,10 @@ pipeline {
                   docker tag ${GITHUBIMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:${META_TAG}
                   docker tag ${GITHUBIMAGE}:arm32v7-${META_TAG} ${GITHUBIMAGE}:arm32v7-latest
                   docker tag ${GITHUBIMAGE}:arm64v8-${META_TAG} ${GITHUBIMAGE}:arm64v8-latest
+                  docker tag ${GITHUBIMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:amd64-${EXT_RELEASE_TAG}
+                  docker tag ${GITHUBIMAGE}:amd64-${META_TAG} ${GITHUBIMAGE}:${EXT_RELEASE_TAG}
+                  docker tag ${GITHUBIMAGE}:arm32v7-${META_TAG} ${GITHUBIMAGE}:arm32v7-${EXT_RELEASE_TAG}
+                  docker tag ${GITHUBIMAGE}:arm64v8-${META_TAG} ${GITHUBIMAGE}:arm64v8-${EXT_RELEASE_TAG}
                   docker push ${GITHUBIMAGE}:amd64-${META_TAG}
                   docker push ${GITHUBIMAGE}:arm32v7-${META_TAG}
                   docker push ${GITHUBIMAGE}:arm64v8-${META_TAG}
@@ -623,6 +643,10 @@ pipeline {
                   docker push ${GITHUBIMAGE}:${META_TAG}
                   docker push ${GITHUBIMAGE}:arm32v7-latest
                   docker push ${GITHUBIMAGE}:arm64v8-latest
+                  docker push ${GITHUBIMAGE}:${EXT_RELEASE_TAG}
+                  docker push ${GITHUBIMAGE}:amd64-${EXT_RELEASE_TAG}
+                  docker push ${GITHUBIMAGE}:arm32v7-${EXT_RELEASE_TAG}
+                  docker push ${GITHUBIMAGE}:arm64v8-${EXT_RELEASE_TAG}
                '''
           }
           sh '''#! /bin/bash
@@ -691,7 +715,7 @@ pipeline {
                 set -e
                 TEMPDIR=$(mktemp -d)
                 docker pull linuxserver/jenkins-builder:latest
-                docker run --rm -e CONTAINER_NAME=${CONTAINER_NAME} -e GITHUB_BRANCH=master -v ${TEMPDIR}:/ansible/jenkins linuxserver/jenkins-builder:latest 
+                docker run --rm -e CONTAINER_NAME=${CONTAINER_NAME} -e GITHUB_BRANCH="${BRANCH_NAME}" -v ${TEMPDIR}:/ansible/jenkins linuxserver/jenkins-builder:latest 
                 docker pull lsiodev/readme-sync
                 docker run --rm=true \
                   -e DOCKERHUB_USERNAME=$DOCKERUSER \

README.md

@@ -1,3 +1,6 @@
+<!-- DO NOT EDIT THIS FILE MANUALLY  -->
+<!-- Please read the CONTRIBUTING.md -->
+
 [![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)](https://linuxserver.io)
 
 [![Blog](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=Blog)](https://blog.linuxserver.io "all the things you can do with our containers including How-To guides, opinions and much more!")
@@ -35,7 +38,7 @@ Find us at:
 [![Jenkins Build](https://img.shields.io/jenkins/build?labelColor=555555&logoColor=ffffff&style=for-the-badge&jobUrl=https%3A%2F%2Fci.linuxserver.io%2Fjob%2FDocker-Pipeline-Builders%2Fjob%2Fdocker-swag%2Fjob%2Fmaster%2F&logo=jenkins)](https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/)
 [![LSIO CI](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=CI&query=CI&url=https%3A%2F%2Flsio-ci.ams3.digitaloceanspaces.com%2Flinuxserver%2Fswag%2Flatest%2Fci-status.yml)](https://lsio-ci.ams3.digitaloceanspaces.com/linuxserver/swag/latest/index.html)
 
-SWAG - Secure Web-server And Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes. It also contains fail2ban for intrusion prevention.
+SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes. It also contains fail2ban for intrusion prevention.
 
 [![swag](https://github.com/linuxserver/docker-templates/raw/master/linuxserver.io/img/swag.gif)](https://linuxserver.io)
 
@@ -58,38 +61,11 @@ The architectures supported by this image are:
 
 Here are some example snippets to help you get started creating a container.
 
-### docker
-
-```
-docker create \
-  --name=swag \
-  --cap-add=NET_ADMIN \
-  -e PUID=1000 \
-  -e PGID=1000 \
-  -e TZ=Europe/London \
-  -e URL=yourdomain.url \
-  -e SUBDOMAINS=www, \
-  -e VALIDATION=http \
-  -e DNSPLUGIN=cloudflare `#optional` \
-  -e PROPAGATION= `#optional` \
-  -e DUCKDNSTOKEN= `#optional` \
-  -e EMAIL= `#optional` \
-  -e ONLY_SUBDOMAINS=false `#optional` \
-  -e EXTRA_DOMAINS= `#optional` \
-  -e STAGING=false `#optional` \
-  -p 443:443 \
-  -p 80:80 `#optional` \
-  -v /path/to/appdata/config:/config \
-  --restart unless-stopped \
-  linuxserver/swag
-```
-
-
-### docker-compose
+### docker-compose ([recommended](https://docs.linuxserver.io/general/docker-compose))
 
 Compatible with docker-compose v2 schemas.
 
-```
+```yaml
 ---
 version: "2.1"
 services:
@@ -112,6 +88,7 @@ services:
       - ONLY_SUBDOMAINS=false #optional
       - EXTRA_DOMAINS= #optional
       - STAGING=false #optional
+      - MAXMINDDB_LICENSE_KEY= #optional
     volumes:
       - /path/to/appdata/config:/config
     ports:
@@ -120,6 +97,34 @@ services:
     restart: unless-stopped
 ```
 
+### docker cli
+
+```
+docker run -d \
+  --name=swag \
+  --cap-add=NET_ADMIN \
+  -e PUID=1000 \
+  -e PGID=1000 \
+  -e TZ=Europe/London \
+  -e URL=yourdomain.url \
+  -e SUBDOMAINS=www, \
+  -e VALIDATION=http \
+  -e DNSPLUGIN=cloudflare `#optional` \
+  -e PROPAGATION= `#optional` \
+  -e DUCKDNSTOKEN= `#optional` \
+  -e EMAIL= `#optional` \
+  -e ONLY_SUBDOMAINS=false `#optional` \
+  -e EXTRA_DOMAINS= `#optional` \
+  -e STAGING=false `#optional` \
+  -e MAXMINDDB_LICENSE_KEY= `#optional` \
+  -p 443:443 \
+  -p 80:80 `#optional` \
+  -v /path/to/appdata/config:/config \
+  --restart unless-stopped \
+  linuxserver/swag
+```
+
+
 ## Parameters
 
 Container images are configured using parameters passed at runtime (such as those above). These parameters are separated by a colon and indicate `<external>:<internal>` respectively. For example, `-p 8080:80` would expose port `80` from inside the container to be accessible from the host's IP on port `8080` outside the container.
@@ -141,6 +146,7 @@ Container images are configured using parameters passed at runtime (such as thos
 | `-e ONLY_SUBDOMAINS=false` | If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true` |
 | `-e EXTRA_DOMAINS=` | Additional fully qualified domain names (comma separated, no spaces) ie. `extradomain.com,subdomain.anotherdomain.org,*.anotherdomain.org` |
 | `-e STAGING=false` | Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes. |
+| `-e MAXMINDDB_LICENSE_KEY=` | Add your MaxmindDB license key to automatically download the GeoLite2-City.mmdb database. Download location is /config/geoip2db. The database is updated weekly. |
 | `-v /config` | All the config files including the webroot reside here. |
 
 ## Environment variables from files (Docker secrets)
@@ -177,13 +183,16 @@ In this instance `PUID=1000` and `PGID=1000`, to find yours use `id user` as bel
 &nbsp;
 ## Application Setup
 
-### Migrating from the old `linuxserver/letsencrypt` image
-* If using docker cli:
-  * Stop and remove existing container via `docker stop letsencrypt` and `docker rm letsencrypt`
-  * Create new container using the sample on this page (container name: `swag`, image name: `linuxserver/swag`)
-* If using docker compose:
-  * Edit the compose yaml to change the image to `linuxserver/swag` and change the service and container names to `swag`
-  * Issue `docker-compose up -d --remove-orphans`
+> ### Migrating from the old `linuxserver/letsencrypt` image
+> * If using docker cli:
+>   * Stop and remove existing container via `docker stop letsencrypt` and `docker rm letsencrypt`
+>   * Create new container using the sample on this page (container name: `swag`, image name: `linuxserver/swag`)
+> * If using docker compose:
+>   * Edit the compose yaml to change the image to `linuxserver/swag` and change the service and container names to `swag`
+>   * Issue `docker-compose up -d --remove-orphans`
+>   * If you don't want to or can't use the option `--remove-orphans`, then you can first do `docker-compose down`, then edit the compose yaml as above, and then issue `docker-compose up -d`
+
+> Make sure to also update any references to this container by name. For instance, Nextcloud's `config.php` references this container in its `trusted_proxies` directive, which would have to be updated to `swag`.
 ### Validation and initial setup
 * Before running this container, make sure that the url and subdomains are properly forwarded to this container's host, and that port 443 (and/or 80) is not being used by another service on the host (NAS gui, another webserver, etc.).
 * For `http` validation, port 80 on the internet side of the router should be forwarded to this container's port 80
@@ -228,12 +237,24 @@ This will *ask* Google et al not to index and list your site. Be careful with th
 * You can check the status of a specific jail via `docker exec -it swag fail2ban-client status <jail name>`
 * You can unban an IP via `docker exec -it swag fail2ban-client set <jail name> unbanip <IP>`
 * A list of commands can be found here: https://www.fail2ban.org/wiki/index.php/Commands
+### Updating configs
+* This container creates a number of configs for nginx, proxy samples, etc.
+* Config updates are noted in the changelog but not automatically applied to your files.
+* If you have modified a file with noted changes in the changelog:
+  1. Keep your existing configs as is (not broken, don't fix)
+  2. Review our repository commits and apply the new changes yourself
+  3. Delete the modified config file with listed updates, restart the container, reapply your changes
+* If you have NOT modified a file with noted changes in the changelog:
+  1. Delete the config file with listed updates, restart the container
+* Proxy sample updates are not listed in the changelog. See the changes here: [https://github.com/linuxserver/reverse-proxy-confs/commits/master](https://github.com/linuxserver/reverse-proxy-confs/commits/master)
+* Proxy sample files WILL be updated, however your renamed (enabled) proxy files will not.
+* You can check the new sample and adjust your active config as needed.
 
 
 ## Docker Mods
-[![Docker Mods](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=mods&query=%24.mods%5B%27swag%27%5D.mod_count&url=https%3A%2F%2Fraw.githubusercontent.com%2Flinuxserver%2Fdocker-mods%2Fmaster%2Fmod-list.yml)](https://mods.linuxserver.io/?mod=swag "view available mods for this container.")
+[![Docker Mods](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=swag&query=%24.mods%5B%27swag%27%5D.mod_count&url=https%3A%2F%2Fraw.githubusercontent.com%2Flinuxserver%2Fdocker-mods%2Fmaster%2Fmod-list.yml)](https://mods.linuxserver.io/?mod=swag "view available mods for this container.") [![Docker Universal Mods](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=universal&query=%24.mods%5B%27universal%27%5D.mod_count&url=https%3A%2F%2Fraw.githubusercontent.com%2Flinuxserver%2Fdocker-mods%2Fmaster%2Fmod-list.yml)](https://mods.linuxserver.io/?mod=universal "view available universal mods.")
 
-We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to enable additional functionality within the containers. The list of Mods available for this image (if any) can be accessed via the dynamic badge above.
+We publish various [Docker Mods](https://github.com/linuxserver/docker-mods) to enable additional functionality within the containers. The list of Mods available for this image (if any) as well as universal mods that can be applied to any one of our images can be accessed via the dynamic badges above.
 
 
 ## Support Info
@@ -251,14 +272,6 @@ Most of our images are static, versioned, and require an image update and contai
 
 Below are the instructions for updating containers:
 
-### Via Docker Run/Create
-* Update the image: `docker pull linuxserver/swag`
-* Stop the running container: `docker stop swag`
-* Delete the container: `docker rm swag`
-* Recreate a new container with the same docker create parameters as instructed above (if mapped correctly to a host folder, your `/config` folder and settings will be preserved)
-* Start the new container: `docker start swag`
-* You can also remove the old dangling images: `docker image prune`
-
 ### Via Docker Compose
 * Update all images: `docker-compose pull`
   * or update a single image: `docker-compose pull swag`
@@ -266,7 +279,14 @@ Below are the instructions for updating containers:
   * or update a single container: `docker-compose up -d swag`
 * You can also remove the old dangling images: `docker image prune`
 
-### Via Watchtower auto-updater (especially useful if you don't remember the original parameters)
+### Via Docker Run
+* Update the image: `docker pull linuxserver/swag`
+* Stop the running container: `docker stop swag`
+* Delete the container: `docker rm swag`
+* Recreate a new container with the same docker run parameters as instructed above (if mapped correctly to a host folder, your `/config` folder and settings will be preserved)
+* You can also remove the old dangling images: `docker image prune`
+
+### Via Watchtower auto-updater (only use if you don't remember the original parameters)
 * Pull the latest image at its tag and replace it with the same env variables in one run:
   ```
   docker run --rm \
@@ -274,11 +294,13 @@ Below are the instructions for updating containers:
   containrrr/watchtower \
   --run-once swag
   ```
-
-**Note:** We do not endorse the use of Watchtower as a solution to automated updates of existing Docker containers. In fact we generally discourage automated updates. However, this is a useful tool for one-time manual updates of containers where you have forgotten the original parameters. In the long term, we highly recommend using Docker Compose.
-
 * You can also remove the old dangling images: `docker image prune`
 
+**Note:** We do not endorse the use of Watchtower as a solution to automated updates of existing Docker containers. In fact we generally discourage automated updates. However, this is a useful tool for one-time manual updates of containers where you have forgotten the original parameters. In the long term, we highly recommend using [Docker Compose](https://docs.linuxserver.io/general/docker-compose).
+
+### Image Update Notifications - Diun (Docker Image Update Notifier)
+* We recommend [Diun](https://crazymax.dev/diun/) for update notifications. Other tools that automatically update containers unattended are not recommended or supported.
+
 ## Building locally
 
 If you want to make local modifications to these images for development purposes or just to customize the logic:
@@ -300,4 +322,9 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **29.10.20:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) ssl.conf - Add frame-ancestors to Content-Security-Policy.
+* **04.10.20:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and ssl.conf - Minor cleanups and reordering.
+* **20.09.20:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Added geoip2 configs. Added MAXMINDDB_LICENSE_KEY variable to readme.
+* **08.09.20:** - Add php7-xsl.
+* **01.09.20:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and various proxy samples - Global websockets across all configs.
 * **03.08.20:** - Initial release.

package_versions.txt

@@ -1,32 +1,32 @@
 alpine-baselayout-3.2.0-r7
 alpine-keys-2.2-r0
-apache2-utils-2.4.43-r0
+apache2-utils-2.4.46-r0
 apk-tools-2.10.5-r1
 apr-1.7.0-r0
 apr-util-1.6.1-r6
 argon2-libs-20190702-r1
 bash-5.0.17-r0
-brotli-libs-1.0.7-r5
+brotli-libs-1.0.9-r1
 busybox-1.31.1-r19
 c-client-2007f-r11
 ca-certificates-20191127-r4
 ca-certificates-bundle-20191127-r4
 coreutils-8.32-r0
-curl-7.69.1-r0
+curl-7.69.1-r1
 db-5.3.28-r1
 expat-2.2.9-r1
 fail2ban-0.11.1-r3
-freetype-2.10.2-r0
+freetype-2.10.4-r0
 gdbm-1.13-r1
 git-2.26.2-r0
 git-perl-2.26.2-r0
-glib-2.64.4-r0
+glib-2.64.6-r0
 gmp-6.2.0-r0
-gnupg-2.2.20-r0
-gnutls-3.6.14-r0
+gnupg-2.2.23-r0
+gnutls-3.6.15-r0
 icu-libs-67.1-r0
-ip6tables-1.8.4-r1
-iptables-1.8.4-r1
+ip6tables-1.8.4-r2
+iptables-1.8.4-r2
 libacl-2.2.53-r0
 libassuan-2.5.3-r0
 libattr-2.4.48-r0
@@ -36,7 +36,7 @@ libbz2-1.0.8-r1
 libc-utils-0.7.2-r3
 libcap-2.27-r0
 libcrypto1.1-1.1.1g-r0
-libcurl-7.69.1-r0
+libcurl-7.69.1-r1
 libedit-20191231.3.1-r0
 libevent-2.1.11-r1
 libffi-3.3-r2
@@ -58,7 +58,7 @@ libmnl-1.0.4-r0
 libmount-2.35.2-r0
 libnftnl-libs-1.1.6-r0
 libpng-1.6.37-r1
-libpq-12.3-r2
+libpq-12.4-r0
 libproc-3.3.16-r0
 libressl3.1-libcrypto-3.1.2-r0
 libressl3.1-libssl-3.1.2-r0
@@ -74,12 +74,12 @@ libtls-standalone-2.9.1-r1
 libunistring-0.9.10-r0
 libuuid-2.35.2-r0
 libwebp-1.1.0-r0
-libx11-1.6.11-r0
+libx11-1.6.12-r0
 libxau-1.0.9-r0
 libxcb-1.14-r1
 libxdmcp-1.1.3-r0
 libxext-1.3.4-r0
-libxml2-2.9.10-r4
+libxml2-2.9.10-r5
 libxpm-3.5.13-r0
 libxslt-1.1.34-r0
 libxt-1.2.0-r0
@@ -95,26 +95,26 @@ ncurses-libs-6.2_p20200523-r0
 ncurses-terminfo-base-6.2_p20200523-r0
 nettle-3.5.1-r1
 nghttp2-libs-1.41.0-r0
-nginx-1.18.0-r0
-nginx-mod-devel-kit-1.18.0-r0
-nginx-mod-http-echo-1.18.0-r0
-nginx-mod-http-fancyindex-1.18.0-r0
-nginx-mod-http-geoip2-1.18.0-r0
-nginx-mod-http-headers-more-1.18.0-r0
-nginx-mod-http-image-filter-1.18.0-r0
-nginx-mod-http-lua-1.18.0-r0
-nginx-mod-http-lua-upstream-1.18.0-r0
-nginx-mod-http-nchan-1.18.0-r0
-nginx-mod-http-perl-1.18.0-r0
-nginx-mod-http-redis2-1.18.0-r0
-nginx-mod-http-set-misc-1.18.0-r0
-nginx-mod-http-upload-progress-1.18.0-r0
-nginx-mod-http-xslt-filter-1.18.0-r0
-nginx-mod-mail-1.18.0-r0
-nginx-mod-rtmp-1.18.0-r0
-nginx-mod-stream-1.18.0-r0
-nginx-mod-stream-geoip2-1.18.0-r0
-nginx-vim-1.18.0-r0
+nginx-1.18.0-r1
+nginx-mod-devel-kit-1.18.0-r1
+nginx-mod-http-echo-1.18.0-r1
+nginx-mod-http-fancyindex-1.18.0-r1
+nginx-mod-http-geoip2-1.18.0-r1
+nginx-mod-http-headers-more-1.18.0-r1
+nginx-mod-http-image-filter-1.18.0-r1
+nginx-mod-http-lua-1.18.0-r1
+nginx-mod-http-lua-upstream-1.18.0-r1
+nginx-mod-http-nchan-1.18.0-r1
+nginx-mod-http-perl-1.18.0-r1
+nginx-mod-http-redis2-1.18.0-r1
+nginx-mod-http-set-misc-1.18.0-r1
+nginx-mod-http-upload-progress-1.18.0-r1
+nginx-mod-http-xslt-filter-1.18.0-r1
+nginx-mod-mail-1.18.0-r1
+nginx-mod-rtmp-1.18.0-r1
+nginx-mod-stream-1.18.0-r1
+nginx-mod-stream-geoip2-1.18.0-r1
+nginx-vim-1.18.0-r1
 npth-1.6-r0
 openssl-1.1.1g-r0
 p11-kit-0.23.20-r5
@@ -123,54 +123,55 @@ pcre2-10.35-r0
 perl-5.30.3-r0
 perl-error-0.17029-r0
 perl-git-2.26.2-r0
-php7-7.3.21-r0
-php7-bcmath-7.3.21-r0
-php7-bz2-7.3.21-r0
-php7-common-7.3.21-r0
-php7-ctype-7.3.21-r0
-php7-curl-7.3.21-r0
-php7-dom-7.3.21-r0
-php7-exif-7.3.21-r0
-php7-fileinfo-7.3.20-r0
-php7-fpm-7.3.20-r0
-php7-ftp-7.3.21-r0
-php7-gd-7.3.21-r0
-php7-iconv-7.3.21-r0
-php7-imap-7.3.21-r0
-php7-intl-7.3.21-r0
-php7-json-7.3.21-r0
-php7-ldap-7.3.21-r0
-php7-mbstring-7.3.21-r0
-php7-mysqli-7.3.21-r0
-php7-mysqlnd-7.3.21-r0
-php7-opcache-7.3.21-r0
-php7-openssl-7.3.21-r0
-php7-pdo-7.3.21-r0
-php7-pdo_mysql-7.3.21-r0
-php7-pdo_odbc-7.3.21-r0
-php7-pdo_pgsql-7.3.21-r0
-php7-pdo_sqlite-7.3.21-r0
-php7-pear-7.3.21-r0
-php7-pecl-apcu-5.1.18-r0
-php7-pecl-igbinary-3.1.4-r0
+php7-7.3.23-r0
+php7-bcmath-7.3.23-r0
+php7-bz2-7.3.23-r0
+php7-common-7.3.23-r0
+php7-ctype-7.3.23-r0
+php7-curl-7.3.23-r0
+php7-dom-7.3.23-r0
+php7-exif-7.3.23-r0
+php7-fileinfo-7.3.23-r0
+php7-fpm-7.3.23-r0
+php7-ftp-7.3.23-r0
+php7-gd-7.3.23-r0
+php7-iconv-7.3.23-r0
+php7-imap-7.3.23-r0
+php7-intl-7.3.23-r0
+php7-json-7.3.23-r0
+php7-ldap-7.3.23-r0
+php7-mbstring-7.3.23-r0
+php7-mysqli-7.3.23-r0
+php7-mysqlnd-7.3.23-r0
+php7-opcache-7.3.23-r0
+php7-openssl-7.3.23-r0
+php7-pdo-7.3.23-r0
+php7-pdo_mysql-7.3.23-r0
+php7-pdo_odbc-7.3.23-r0
+php7-pdo_pgsql-7.3.23-r0
+php7-pdo_sqlite-7.3.23-r0
+php7-pear-7.3.23-r0
+php7-pecl-apcu-5.1.19-r0
+php7-pecl-igbinary-3.1.6-r0
 php7-pecl-mcrypt-1.0.3-r0
 php7-pecl-memcached-3.1.5-r0
 php7-pecl-redis-5.2.2-r1
-php7-pgsql-7.3.21-r0
-php7-phar-7.3.21-r0
-php7-posix-7.3.21-r0
-php7-session-7.3.21-r0
-php7-simplexml-7.3.20-r0
-php7-soap-7.3.21-r0
-php7-sockets-7.3.21-r0
-php7-sodium-7.3.21-r0
-php7-sqlite3-7.3.21-r0
-php7-tokenizer-7.3.21-r0
-php7-xml-7.3.21-r0
-php7-xmlreader-7.3.21-r0
-php7-xmlrpc-7.3.21-r0
-php7-xmlwriter-7.3.20-r0
-php7-zip-7.3.21-r0
+php7-pgsql-7.3.23-r0
+php7-phar-7.3.23-r0
+php7-posix-7.3.23-r0
+php7-session-7.3.23-r0
+php7-simplexml-7.3.23-r0
+php7-soap-7.3.23-r0
+php7-sockets-7.3.23-r0
+php7-sodium-7.3.23-r0
+php7-sqlite3-7.3.23-r0
+php7-tokenizer-7.3.23-r0
+php7-xml-7.3.23-r0
+php7-xmlreader-7.3.23-r0
+php7-xmlrpc-7.3.23-r0
+php7-xmlwriter-7.3.23-r0
+php7-xsl-7.3.23-r0
+php7-zip-7.3.23-r0
 pinentry-1.1.0-r2
 popt-1.16-r7
 procps-3.3.16-r0

readme-vars.yml

@@ -4,7 +4,7 @@
 project_name: swag
 project_url: "https://linuxserver.io"
 project_logo: "https://github.com/linuxserver/docker-templates/raw/master/linuxserver.io/img/swag.gif"
-project_blurb: "SWAG - Secure Web-server And Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes. It also contains fail2ban for intrusion prevention."
+project_blurb: "SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes. It also contains fail2ban for intrusion prevention."
 project_lsio_github_repo_url: "https://github.com/linuxserver/docker-{{ project_name }}"
 
 project_blurb_optional_extras_enabled: false
@@ -57,6 +57,7 @@ opt_param_env_vars:
   - { env_var: "ONLY_SUBDOMAINS", env_value: "false", desc: "If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true`" }
   - { env_var: "EXTRA_DOMAINS", env_value: "", desc: "Additional fully qualified domain names (comma separated, no spaces) ie. `extradomain.com,subdomain.anotherdomain.org,*.anotherdomain.org`" }
   - { env_var: "STAGING", env_value: "false", desc: "Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes." }
+  - { env_var: "MAXMINDDB_LICENSE_KEY", env_value: "", desc: "Add your MaxmindDB license key to automatically download the GeoLite2-City.mmdb database. Download location is /config/geoip2db. The database is updated weekly."}
 opt_param_usage_include_vols: false
 opt_param_volumes:
   - { vol_path: "/config", vol_host_path: "/path/to/appdata/config", desc: "Configuration files." }
@@ -76,13 +77,16 @@ optional_block_1_items: ""
 # application setup block
 app_setup_block_enabled: true
 app_setup_block: |
-  ### Migrating from the old `linuxserver/letsencrypt` image
-  * If using docker cli:
-    * Stop and remove existing container via `docker stop letsencrypt` and `docker rm letsencrypt`
-    * Create new container using the sample on this page (container name: `swag`, image name: `linuxserver/swag`)
-  * If using docker compose:
-    * Edit the compose yaml to change the image to `linuxserver/swag` and change the service and container names to `swag`
-    * Issue `docker-compose up -d --remove-orphans`
+  > ### Migrating from the old `linuxserver/letsencrypt` image
+  > * If using docker cli:
+  >   * Stop and remove existing container via `docker stop letsencrypt` and `docker rm letsencrypt`
+  >   * Create new container using the sample on this page (container name: `swag`, image name: `linuxserver/swag`)
+  > * If using docker compose:
+  >   * Edit the compose yaml to change the image to `linuxserver/swag` and change the service and container names to `swag`
+  >   * Issue `docker-compose up -d --remove-orphans`
+  >   * If you don't want to or can't use the option `--remove-orphans`, then you can first do `docker-compose down`, then edit the compose yaml as above, and then issue `docker-compose up -d`
+
+  > Make sure to also update any references to this container by name. For instance, Nextcloud's `config.php` references this container in its `trusted_proxies` directive, which would have to be updated to `swag`.
   ### Validation and initial setup
   * Before running this container, make sure that the url and subdomains are properly forwarded to this container's host, and that port 443 (and/or 80) is not being used by another service on the host (NAS gui, another webserver, etc.).
   * For `http` validation, port 80 on the internet side of the router should be forwarded to this container's port 80
@@ -127,10 +131,27 @@ app_setup_block: |
   * You can check the status of a specific jail via `docker exec -it swag fail2ban-client status <jail name>`
   * You can unban an IP via `docker exec -it swag fail2ban-client set <jail name> unbanip <IP>`
   * A list of commands can be found here: https://www.fail2ban.org/wiki/index.php/Commands
+  ### Updating configs
+  * This container creates a number of configs for nginx, proxy samples, etc.
+  * Config updates are noted in the changelog but not automatically applied to your files.
+  * If you have modified a file with noted changes in the changelog:
+    1. Keep your existing configs as is (not broken, don't fix)
+    2. Review our repository commits and apply the new changes yourself
+    3. Delete the modified config file with listed updates, restart the container, reapply your changes
+  * If you have NOT modified a file with noted changes in the changelog:
+    1. Delete the config file with listed updates, restart the container
+  * Proxy sample updates are not listed in the changelog. See the changes here: [https://github.com/linuxserver/reverse-proxy-confs/commits/master](https://github.com/linuxserver/reverse-proxy-confs/commits/master)
+  * Proxy sample files WILL be updated, however your renamed (enabled) proxy files will not.
+  * You can check the new sample and adjust your active config as needed.
 
 app_setup_nginx_reverse_proxy_snippet: false
 app_setup_nginx_reverse_proxy_block: ""
 
 # changelog
 changelogs:
-  - { date: "03.08.20:", desc: "Initial release." }
+  - { date: "29.10.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) ssl.conf - Add frame-ancestors to Content-Security-Policy." }
+  - { date: "04.10.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and ssl.conf - Minor cleanups and reordering." }
+  - { date: "20.09.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Added geoip2 configs. Added MAXMINDDB_LICENSE_KEY variable to readme."}
+  - { date: "08.09.20:", desc: "Add php7-xsl." }
+  - { date: "01.09.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and various proxy samples - Global websockets across all configs." }
+  - { date: "03.08.20:", desc: "Initial release." }

root/defaults/default

@@ -30,6 +30,12 @@ server {
 	# enable for Authelia
 	#include /config/nginx/authelia-server.conf;
 
+	# enable for geo blocking
+	# See /config/nginx/geoip2.conf for more information.
+	#if ($allowed_country = no) {
+	#return 444;
+	#}
+
 	client_max_body_size 0;
 
 	location / {

root/defaults/geoip2.conf

@@ -0,0 +1,123 @@
+## Version 2020/10/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/geoip2.conf
+# To enable, uncommment the Geoip2 config line in nginx.conf
+# Add the -e MAXMINDDB_LICENSE_KEY=<licensekey> to automatically download the Geolite2 database.
+# A Maxmind license key can be acquired here: https://www.maxmind.com/en/geolite2/signup
+
+geoip2 /config/geoip2db/GeoLite2-City.mmdb {
+    auto_reload 1w;
+    $geoip2_data_city_name   city names en;
+    $geoip2_data_postal_code postal code;
+    $geoip2_data_latitude    location latitude;
+    $geoip2_data_longitude   location longitude;
+    $geoip2_data_state_name  subdivisions 0 names en;
+    $geoip2_data_state_code  subdivisions 0 iso_code;
+    $geoip2_data_continent_code   continent code;
+    $geoip2_data_country_iso_code country iso_code;
+}
+
+# GEOIP2 COUNTRY CONFIG
+map $geoip2_data_country_iso_code $allowed_country {
+    # default must be yes or no
+    # If default is set to "no" you will need to add the local ip ranges that you want to allow access in the $allow_list variable below.
+    default yes;
+
+    # Below you will setup conditions with yes or no
+    # ex: <condition> <yes/no>;
+
+    # allow United Kingdom.
+    #GB yes;
+}
+
+# GEOIP2 CITY CONFIG
+map $geoip2_data_city_name $allowed_city {
+    # default must be yes or no
+    # If default is set to "no" you will need to add the local ip ranges that you want to allow access in the $allow_list variable below.
+    default yes;
+
+    # Below you will setup conditions with yes or no
+    # ex: <condition> <yes/no>;
+
+    # allow Inverness.
+    #Inverness yes;
+}
+
+# ALLOW LOCAL ACCESS
+geo $allow_list {
+    default yes; # Set this to no if $allowed_country or $allowed_city default is no. 
+    # IP/CIDR yes; # e.g. 192.168.1.0/24 yes;
+}
+
+# Server config example:
+# Add the following if statements inside any server context where you want to geo block countries.
+
+########################################
+#   if ($allow_list = yes) {
+#   set $allowed_country yes;
+#   }
+#	if ($allowed_country = no) {
+#	return 444;
+#	}
+#########################################
+
+# Add the following if statements inside any server context where you want to geo block cities.
+########################################
+#   if ($allow_list = yes) {
+#   set $allowed_country yes;
+#   }
+#	if ($allowed_city = no) {
+#	return 444;
+#	}
+#########################################
+
+# Example using a config from proxy-confs
+
+#server {
+#    listen 443 ssl;
+#    listen [::]:443 ssl;
+#
+#    server_name unifi.*;
+#
+#    include /config/nginx/ssl.conf;
+#
+#    client_max_body_size 0;
+#
+#    # enable for ldap auth, fill in ldap details in ldap.conf
+#    #include /config/nginx/ldap.conf;
+#
+#    # enable for Authelia
+#    #include /config/nginx/authelia-server.conf;
+
+
+#   # Allow lan access if default is set to no
+#   if ($allow_list = yes) {
+#   set $allowed_country yes;
+#   }
+#    # Country geo block
+#    if ($allowed_country = no) {
+#       return 444;
+#    }
+
+
+#
+#    location / {
+#        # enable the next two lines for http auth
+#        #auth_basic "Restricted";
+#        #auth_basic_user_file /config/nginx/.htpasswd;
+#
+#        # enable the next two lines for ldap auth
+#        #auth_request /auth;
+#        #error_page 401 =200 /ldaplogin;
+#
+#        # enable for Authelia
+#        #include /config/nginx/authelia-location.conf;
+#
+#        include /config/nginx/proxy.conf;
+#        resolver 127.0.0.11 valid=30s;
+#        set $upstream_app unifi-controller;
+#        set $upstream_port 8443;
+#        set $upstream_proto https;
+#        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+#
+#        proxy_buffering off;
+#    }
+#}

root/defaults/nginx.conf

@@ -1,4 +1,4 @@
-## Version 2019/12/19 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx.conf
+## Version 2020/10/04 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx.conf
 
 user abc;
 worker_processes 4;
@@ -16,21 +16,21 @@ http {
 	# Basic Settings
 	##
 
-	sendfile on;
-	tcp_nopush on;
-	tcp_nodelay on;
+	client_body_buffer_size 128k;
+	client_max_body_size 0;
 	keepalive_timeout 65;
+	large_client_header_buffers 4 16k;
+	send_timeout 5m;
+	sendfile on;
+	tcp_nodelay on;
+	tcp_nopush on;
 	types_hash_max_size 2048;
 	variables_hash_max_size 2048;
-	large_client_header_buffers 4 16k;
-	
-	# server_tokens off;
 
+	# server_tokens off;
 	# server_names_hash_bucket_size 64;
 	# server_name_in_redirect off;
 
-	client_max_body_size 0;
-
 	include /etc/nginx/mime.types;
 	default_type application/octet-stream;
 
@@ -72,6 +72,14 @@ http {
 	#passenger_root /usr;
 	#passenger_ruby /usr/bin/ruby;
 
+	##
+	# WebSocket proxying
+	##
+	map $http_upgrade $connection_upgrade {
+		default upgrade;
+		''      close;
+	}
+
 	##
 	# Virtual Host Configs
 	##
@@ -79,6 +87,13 @@ http {
 	include /config/nginx/site-confs/*;
 	lua_load_resty_core off;
 
+	##
+	# Geoip2 config
+	##
+	# Uncomment to add the Geoip2 configs needed to geo block countries/cities.
+	##
+
+	#include /config/nginx/geoip2.conf;
 }
 
 

root/defaults/proxy.conf

@@ -1,32 +1,30 @@
-## Version 2019/10/23 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/proxy.conf
+## Version 2020/10/04 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/proxy.conf
 
-client_body_buffer_size 128k;
-
-#Timeout if the real server is dead
+# Timeout if the real server is dead
 proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
 
-# Advanced Proxy Config
-send_timeout 5m;
-proxy_read_timeout 240;
-proxy_send_timeout 240;
-proxy_connect_timeout 240;
-
-# TLS 1.3 early data
-proxy_set_header Early-Data $ssl_early_data;
-
-# Basic Proxy Config
-proxy_set_header Host $host;
-proxy_set_header X-Real-IP $remote_addr;
-proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-proxy_set_header X-Forwarded-Proto https;
-proxy_set_header X-Forwarded-Host $host;
-proxy_set_header X-Forwarded-Ssl on;
-proxy_redirect  http://  $scheme://;
-proxy_http_version 1.1;
-proxy_set_header Connection "";
-#proxy_cookie_path / "/; HTTPOnly; Secure"; # enable at your own risk, may break certain apps
-proxy_cache_bypass $cookie_session;
-proxy_no_cache $cookie_session;
+# Proxy Connection Settings
 proxy_buffers 32 4k;
+proxy_connect_timeout 240;
 proxy_headers_hash_bucket_size 128;
 proxy_headers_hash_max_size 1024;
+proxy_http_version 1.1;
+proxy_read_timeout 240;
+proxy_redirect  http://  $scheme://;
+proxy_send_timeout 240;
+
+# Proxy Cache and Cookie Settings
+proxy_cache_bypass $cookie_session;
+#proxy_cookie_path / "/; Secure"; # enable at your own risk, may break certain apps
+proxy_no_cache $cookie_session;
+
+# Proxy Header Settings
+proxy_set_header Connection $connection_upgrade;
+proxy_set_header Early-Data $ssl_early_data;
+proxy_set_header Host $host;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Host $host;
+proxy_set_header X-Forwarded-Proto https;
+proxy_set_header X-Forwarded-Ssl on;
+proxy_set_header X-Real-IP $remote_addr;

root/defaults/ssl.conf

@@ -1,4 +1,4 @@
-## Version 2020/06/17 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/ssl.conf
+## Version 2020/10/29 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/ssl.conf
 
 ### Mozilla Recommendations
 # generated 2020-06-17, Mozilla Guideline v5.4, nginx 1.18.0-r0, OpenSSL 1.1.1g-r0, intermediate configuration
@@ -39,10 +39,10 @@ ssl_early_data on;
 #add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
 
 # Optional additional headers
-#add_header Content-Security-Policy "upgrade-insecure-requests";
-#add_header X-Frame-Options "SAMEORIGIN" always;
-#add_header X-XSS-Protection "1; mode=block" always;
-#add_header X-Content-Type-Options "nosniff" always;
-#add_header X-UA-Compatible "IE=Edge" always;
 #add_header Cache-Control "no-transform" always;
+#add_header Content-Security-Policy "upgrade-insecure-requests; frame-ancestors 'self'";
 #add_header Referrer-Policy "same-origin" always;
+#add_header X-Content-Type-Options "nosniff" always;
+#add_header X-Frame-Options "SAMEORIGIN" always;
+#add_header X-UA-Compatible "IE=Edge" always;
+#add_header X-XSS-Protection "1; mode=block" always;

root/etc/cont-init.d/50-config

@@ -77,6 +77,8 @@ cp /config/fail2ban/jail.local /etc/fail2ban/jail.local
 	cp /defaults/authelia-server.conf /config/nginx/authelia-server.conf
 [[ ! -f /config/nginx/authelia-location.conf ]] && \
 	cp /defaults/authelia-location.conf /config/nginx/authelia-location.conf
+[[ ! -f /config/nginx/geoip2.conf ]] && \
+	cp /defaults/geoip2.conf /config/nginx/geoip2.conf
 
 # copy pre-generated dhparams or generate if needed
 [[ ! -f /config/nginx/dhparams.pem ]] && \