ThatGuyJack/nginx-proxy-manager
1
0
Fork 0
mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2025-08-23 01:10:23 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SSL_CERTS_PATH needs a default - small fixes

Browse Source
This commit is contained in:
baudneo
2022-10-09 15:31:27 -06:00
parent 0de3769298
commit 5ed6f3d995
6 changed files with 183 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

123
README.md
View File

@@ -68,7 +68,7 @@ I won't go in to too much detail here but here are the basics for someone new to
version: '3' version: '3'
services: services:
app: app:
image: 'jc21/nginx-proxy-manager:latest' image: 'baudneo/nginx-proxy-manager:latest'
restart: unless-stopped restart: unless-stopped
ports: ports:
- '80:80' - '80:80'
@@ -100,6 +100,127 @@ Password: changeme
Immediately after logging in with this default user you will be asked to modify your details and change your password. Immediately after logging in with this default user you will be asked to modify your details and change your password.
# Timezone
## Environment Variables
- `TZ` - Set to your timezone. Example: `TZ=America/Chicago`
## Configuration
- Instead of setting `TZ` you can mount `/etc/localtime` into the docker container
-------
# CrowdSec OpenResty Bouncer
## NOTE
- If you don't see the bouncer hitting your local API, send a request to one of the proxied hosts in NPM. I have noticed the bouncer does not start until NPM gets a request once it is all loaded up.
- To check if the bouncer is running, use `docker logs --follow [name of your NPM container]`. There will be a log line like -> `nginx: [alert] [lua] init_by_lua:8: [Crowdsec] Initialisation done`
## Environment Variables
- `CROWDSEC_BOUNCER=1` - Enable CrowdSec OpenResty bouncer, still needs to be configured.
- `CROWDSEC_LAPI=[URL]` - configure CrowdSec local API URL
- `CROWDSEC_KEY=[API KEY]` - configure CrowdSec API key
- `$CROWDSEC_RECAP_SECRET=[SECRET KEY]` - configure reCAPTCHA
- `$CROWDSEC_RECAP_SITE=[SITE KEY]` - configure reCAPTCHA
- `SSL_CERTS_PATH` - CA certificate used to communicate with Google for reCAPTCHA validation
## Configuration
- Config file located at `data/crowdsec/crowdsec-openresty-bouncer.conf`
- HTML templates are located at `/crowdsec/templates/` inside the container
- The first time the container is run, a crowdsec config file is created with ENV vars substituted out. User is responsible for config after first creation of the file.
- Set the URL and API key at a minimum. reCAPTCHA's vars if wanted.
-------
# Admin dashboard logging / OpenResty DEBUG level logging
## Environment Variables
- `ADMIN_DASHBOARD_LOG=1` - Enable admin (Port 81) dashboard logging
- `OPENRESTY_DEBUG=1` - Enable DEBUG level logging for the default OpenResty `ERROR` log
## Configuration
- Admin panel logs are located at `data/logs/admin-panel_access.log` and `data/logs/admin-panel_error.log`
- OpenResty default logs `fallback_access.log` and `fallback_error.log`. `DEBUG` level will be set on the error log, it is set to `WARN` by default.
-------
# ModSecurity
_ModSecurity WAF is installed and loaded by default, OWASP-CoreRuleSet is installed and used as the default rule set. The user is responsible for configuring modsecurity via config/CLI._
## Environment Variables
- `MODSEC_CREATE=1` - Force recreating the default modsecurity config, _This should never be needed_
- `MODSEC_ADMIN_PANEL=1` - Enable ModSec for the admin panel
- `MODSEC_ENABLE=1` - Enable ModSec for the default.conf server block
## Tips to enable
### The minimum directives that need to be added to enable modsec.
- See all directives -> https://github.com/SpiderLabs/ModSecurity-nginx#usage
```
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/main.conf;
```
- To enable modsec for **ALL HTTP** hosts, add the directives to `data/nginx/custom/http_top.conf`
- To enable for only **certain HTTP** hosts, add the directives to the `Advanced` tab configuration at the root level (not inside a `location` block)
- To enable only for **certain locations** on _certain HTTP_ hosts, place the directives into a `location` block inside the `Advanced` tab
- **Stream hosts are untested and, as far as I know, unsupported**. ModSec directives go in server and HTTP blocks.
## Configuration
- By default, the audit log is enabled and is located at `data/logs/modsec_audit.log`
- The config and rule set are located at `data/modsec` and `data/modsec/ruleset`
- `data/modsec/modsecurity.conf` is the main modsec config file.
- `data/modsec/main.conf` is the main rules file, it has `Include` directives that load the actual rules
- `data/modsec` is symbolically linked to `/etc/nginx/modsec`
-------
# docker-compose.yaml
```
version: "3"
services:
npm:
#image: 'jc21/nginx-proxy-manager:latest'
image: 'baudneo/nginx-proxy-manager:latest'
restart: always
container_name: npm-crowdsec
ports:
# Public HTTP Port:
- '80:80'
# Public HTTPS Port:
- '443:443'
# Admin Web Port:
- '81:81'
environment:
# This is the default cert used to validate reCAPTCHA
SSL_CERTS_PATH: "/etc/ssl/certs/GTS_Root_R1.pem"
TZ: "America/Chicago"
ADMIN_PANEL_LOG: "1"
CROWDSEC_BOUNCER: "1"
OPENRESTY_DEBUG: "0"
CROWDSEC_LAPI: "http://IP TO CROWDSEC LOCAL API:8080"
CROWDSEC_KEY: "xxxxxxxxxxxxxxxxxxxxxxxx"
CROWDSEC_RECAP_SECRET: "XXXX"
CROWDSEC_RECAP_SITE: "XXXX"
# These are the settings to access your db
DB_MYSQL_HOST: "db"
DB_MYSQL_PORT: 3306
DB_MYSQL_USER: "npm-user"
DB_MYSQL_PASSWORD: "db user password"
DB_MYSQL_NAME: "npm"
# If you would rather use Sqlite uncomment this
# and remove all DB_MYSQL_* lines above
# DB_SQLITE_FILE: "/data/database.sqlite"
# Uncomment this if IPv6 is not enabled on your host
# DISABLE_IPV6: 'true'
volumes:
- ./data:/data
- ./letsencrypt:/etc/letsencrypt
depends_on:
- db
db:
image: 'jc21/mariadb-aria:latest'
restart: always
container_name: npm_db
environment:
MYSQL_ROOT_PASSWORD: 'xxXXxxXXXxxxXXX'
MYSQL_DATABASE: 'npm'
MYSQL_USER: 'npm-user'
MYSQL_PASSWORD: "db user password"
volumes:
- ./data/mysql:/var/lib/mysql
```
## Contributors ## Contributors

98
backend/package-lock.json generated
View File

@@ -17,14 +17,14 @@
"compression": "^1.7.4", "compression": "^1.7.4",
"config": "^3.3.1", "config": "^3.3.1",
"express": "^4.17.1", "express": "^4.17.1",
"express-fileupload": "^1.1.9", "express-fileupload": "^1.1.10",
"gravatar": "^1.8.0", "gravatar": "^1.8.0",
"json-schema-ref-parser": "^8.0.0", "json-schema-ref-parser": "^8.0.0",
"jsonwebtoken": "^8.5.1", "jsonwebtoken": "^8.5.1",
"knex": "^0.20.13", "knex": "^0.20.13",
"liquidjs": "^9.11.10", "liquidjs": "^9.11.10",
"lodash": "^4.17.21", "lodash": "^4.17.21",
"moment": "^2.24.0", "moment": "^2.29.4",
"mysql": "^2.18.1", "mysql": "^2.18.1",
"node-rsa": "^1.0.8", "node-rsa": "^1.0.8",
"nodemon": "^2.0.2", "nodemon": "^2.0.2",
@@ -432,9 +432,9 @@
} }
}, },
"node_modules/async": { "node_modules/async": {
"version": "3.2.1", "version": "3.2.4",
"resolved": "https://registry.npmjs.org/async/-/async-3.2.1.tgz", "resolved": "https://registry.npmjs.org/async/-/async-3.2.4.tgz",
"integrity": "sha512-XdD5lRO/87udXCMC9meWdYiR+Nq6ZjUfXidViUZGu2F1MO4T3XwZ1et0hb2++BgLfhyJwy44BGB/yx80ABx8hg==" "integrity": "sha512-iAB+JbDEGXhyIUavoDl9WP/Jj106Kz9DEn1DPgYw5ruDn0e3Wgi3sKFm55sASdGBNOQB8F59d9qQ7deqrHA8wQ=="
}, },
"node_modules/atob": { "node_modules/atob": {
"version": "2.1.2", "version": "2.1.2",
@@ -736,14 +736,14 @@
"integrity": "sha1-+OcRMvf/5uAaXJaXpMbz5I1cyBk= sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==" "integrity": "sha1-+OcRMvf/5uAaXJaXpMbz5I1cyBk= sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA=="
}, },
"node_modules/busboy": { "node_modules/busboy": {
"version": "0.3.1", "version": "1.6.0",
"resolved": "https://registry.npmjs.org/busboy/-/busboy-0.3.1.tgz", "resolved": "https://registry.npmjs.org/busboy/-/busboy-1.6.0.tgz",
"integrity": "sha512-y7tTxhGKXcyBxRKAni+awqx8uqaJKrSFSNFSeRG5CsWNdmy2BIK+6VGWEW7TZnIO/533mtMEA4rOevQV815YJw==", "integrity": "sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==",
"dependencies": { "dependencies": {
"dicer": "0.3.0" "streamsearch": "^1.1.0"
}, },
"engines": { "engines": {
"node": ">=4.5.0" "node": ">=10.16.0"
} }
}, },
"node_modules/bytes": { "node_modules/bytes": {
@@ -1428,17 +1428,6 @@
"node": ">=0.10" "node": ">=0.10"
} }
}, },
"node_modules/dicer": {
"version": "0.3.0",
"resolved": "https://registry.npmjs.org/dicer/-/dicer-0.3.0.tgz",
"integrity": "sha512-MdceRRWqltEG2dZqO769g27N/3PXfcKl04VhYnBlo2YhH7zPi88VebsjTKclaOyiuMaGU72hTfw3VkUitGcVCA==",
"dependencies": {
"streamsearch": "0.1.2"
},
"engines": {
"node": ">=4.5.0"
}
},
"node_modules/doctrine": { "node_modules/doctrine": {
"version": "3.0.0", "version": "3.0.0",
"resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz", "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz",
@@ -1916,15 +1905,14 @@
} }
}, },
"node_modules/express-fileupload": { "node_modules/express-fileupload": {
"version": "1.1.9", "version": "1.4.0",
"resolved": "https://registry.npmjs.org/express-fileupload/-/express-fileupload-1.1.9.tgz", "resolved": "https://registry.npmjs.org/express-fileupload/-/express-fileupload-1.4.0.tgz",
"integrity": "sha512-f2w0aoe7lj3NeD8a4MXmYQsqir3Z66I08l9AKq04QbFUAjeZNmPwTlR5Lx2NGwSu/PslsAjGC38MWzo5tTjoBg==", "integrity": "sha512-RjzLCHxkv3umDeZKeFeMg8w7qe0V09w3B7oGZprr/oO2H/ISCgNzuqzn7gV3HRWb37GjRk429CCpSLS2KNTqMQ==",
"deprecated": "Please upgrade express-fileupload to version 1.1.10+ due to a security vulnerability with the parseNested option",
"dependencies": { "dependencies": {
"busboy": "^0.3.1" "busboy": "^1.6.0"
}, },
"engines": { "engines": {
"node": ">=8.0.0" "node": ">=12.0.0"
} }
}, },
"node_modules/extend": { "node_modules/extend": {
@@ -3624,9 +3612,9 @@
} }
}, },
"node_modules/moment": { "node_modules/moment": {
"version": "2.27.0", "version": "2.29.4",
"resolved": "https://registry.npmjs.org/moment/-/moment-2.27.0.tgz", "resolved": "https://registry.npmjs.org/moment/-/moment-2.29.4.tgz",
"integrity": "sha512-al0MUK7cpIcglMv3YF13qSgdAIqxHTO7brRtaz3DlSULbqfazqkc5kEjNrLDOM7fsjshoFIihnU8snrP7zUvhQ==", "integrity": "sha512-5LC9SOxjSc2HF6vO2CyuTDNivEdoz2IvyJJGj6X8DJ0eFyfszE0QiEd+iXmBvUP3WHxSjFH/vIsA0EN00cgr8w==",
"engines": { "engines": {
"node": "*" "node": "*"
} }
@@ -5297,11 +5285,11 @@
} }
}, },
"node_modules/streamsearch": { "node_modules/streamsearch": {
"version": "0.1.2", "version": "1.1.0",
"resolved": "https://registry.npmjs.org/streamsearch/-/streamsearch-0.1.2.tgz", "resolved": "https://registry.npmjs.org/streamsearch/-/streamsearch-1.1.0.tgz",
"integrity": "sha1-gIudDlb8Jz2Am6VzOOkpkZoanxo= sha512-jos8u++JKm0ARcSUTAZXOVC0mSox7Bhn6sBgty73P1f3JGf7yG2clTbBNHUdde/kdvP2FESam+vM6l8jBrNxHA==", "integrity": "sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==",
"engines": { "engines": {
"node": ">=0.8.0" "node": ">=10.0.0"
} }
}, },
"node_modules/string_decoder": { "node_modules/string_decoder": {
@@ -6625,9 +6613,9 @@
"dev": true "dev": true
}, },
"async": { "async": {
"version": "3.2.1", "version": "3.2.4",
"resolved": "https://registry.npmjs.org/async/-/async-3.2.1.tgz", "resolved": "https://registry.npmjs.org/async/-/async-3.2.4.tgz",
"integrity": "sha512-XdD5lRO/87udXCMC9meWdYiR+Nq6ZjUfXidViUZGu2F1MO4T3XwZ1et0hb2++BgLfhyJwy44BGB/yx80ABx8hg==" "integrity": "sha512-iAB+JbDEGXhyIUavoDl9WP/Jj106Kz9DEn1DPgYw5ruDn0e3Wgi3sKFm55sASdGBNOQB8F59d9qQ7deqrHA8wQ=="
}, },
"atob": { "atob": {
"version": "2.1.2", "version": "2.1.2",
@@ -6846,11 +6834,11 @@
"integrity": "sha1-+OcRMvf/5uAaXJaXpMbz5I1cyBk= sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==" "integrity": "sha1-+OcRMvf/5uAaXJaXpMbz5I1cyBk= sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA=="
}, },
"busboy": { "busboy": {
"version": "0.3.1", "version": "1.6.0",
"resolved": "https://registry.npmjs.org/busboy/-/busboy-0.3.1.tgz", "resolved": "https://registry.npmjs.org/busboy/-/busboy-1.6.0.tgz",
"integrity": "sha512-y7tTxhGKXcyBxRKAni+awqx8uqaJKrSFSNFSeRG5CsWNdmy2BIK+6VGWEW7TZnIO/533mtMEA4rOevQV815YJw==", "integrity": "sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==",
"requires": { "requires": {
"dicer": "0.3.0" "streamsearch": "^1.1.0"
} }
}, },
"bytes": { "bytes": {
@@ -7387,14 +7375,6 @@
"resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-1.0.3.tgz", "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-1.0.3.tgz",
"integrity": "sha1-+hN8S9aY7fVc1c0CrFWfkaTEups= sha512-pGjwhsmsp4kL2RTz08wcOlGN83otlqHeD/Z5T8GXZB+/YcpQ/dgo+lbU8ZsGxV0HIvqqxo9l7mqYwyYMD9bKDg==" "integrity": "sha1-+hN8S9aY7fVc1c0CrFWfkaTEups= sha512-pGjwhsmsp4kL2RTz08wcOlGN83otlqHeD/Z5T8GXZB+/YcpQ/dgo+lbU8ZsGxV0HIvqqxo9l7mqYwyYMD9bKDg=="
}, },
"dicer": {
"version": "0.3.0",
"resolved": "https://registry.npmjs.org/dicer/-/dicer-0.3.0.tgz",
"integrity": "sha512-MdceRRWqltEG2dZqO769g27N/3PXfcKl04VhYnBlo2YhH7zPi88VebsjTKclaOyiuMaGU72hTfw3VkUitGcVCA==",
"requires": {
"streamsearch": "0.1.2"
}
},
"doctrine": { "doctrine": {
"version": "3.0.0", "version": "3.0.0",
"resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz", "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz",
@@ -7773,11 +7753,11 @@
} }
}, },
"express-fileupload": { "express-fileupload": {
"version": "1.1.9", "version": "1.4.0",
"resolved": "https://registry.npmjs.org/express-fileupload/-/express-fileupload-1.1.9.tgz", "resolved": "https://registry.npmjs.org/express-fileupload/-/express-fileupload-1.4.0.tgz",
"integrity": "sha512-f2w0aoe7lj3NeD8a4MXmYQsqir3Z66I08l9AKq04QbFUAjeZNmPwTlR5Lx2NGwSu/PslsAjGC38MWzo5tTjoBg==", "integrity": "sha512-RjzLCHxkv3umDeZKeFeMg8w7qe0V09w3B7oGZprr/oO2H/ISCgNzuqzn7gV3HRWb37GjRk429CCpSLS2KNTqMQ==",
"requires": { "requires": {
"busboy": "^0.3.1" "busboy": "^1.6.0"
} }
}, },
"extend": { "extend": {
@@ -9075,9 +9055,9 @@
} }
}, },
"moment": { "moment": {
"version": "2.27.0", "version": "2.29.4",
"resolved": "https://registry.npmjs.org/moment/-/moment-2.27.0.tgz", "resolved": "https://registry.npmjs.org/moment/-/moment-2.29.4.tgz",
"integrity": "sha512-al0MUK7cpIcglMv3YF13qSgdAIqxHTO7brRtaz3DlSULbqfazqkc5kEjNrLDOM7fsjshoFIihnU8snrP7zUvhQ==" "integrity": "sha512-5LC9SOxjSc2HF6vO2CyuTDNivEdoz2IvyJJGj6X8DJ0eFyfszE0QiEd+iXmBvUP3WHxSjFH/vIsA0EN00cgr8w=="
}, },
"ms": { "ms": {
"version": "2.0.0", "version": "2.0.0",
@@ -10375,9 +10355,9 @@
"integrity": "sha1-Fhx9rBd2Wf2YEfQ3cfqZOBR4Yow= sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA==" "integrity": "sha1-Fhx9rBd2Wf2YEfQ3cfqZOBR4Yow= sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA=="
}, },
"streamsearch": { "streamsearch": {
"version": "0.1.2", "version": "1.1.0",
"resolved": "https://registry.npmjs.org/streamsearch/-/streamsearch-0.1.2.tgz", "resolved": "https://registry.npmjs.org/streamsearch/-/streamsearch-1.1.0.tgz",
"integrity": "sha1-gIudDlb8Jz2Am6VzOOkpkZoanxo= sha512-jos8u++JKm0ARcSUTAZXOVC0mSox7Bhn6sBgty73P1f3JGf7yG2clTbBNHUdde/kdvP2FESam+vM6l8jBrNxHA==" "integrity": "sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg=="
}, },
"string_decoder": { "string_decoder": {
"version": "1.3.0", "version": "1.3.0",

8
docker/Dockerfile
View File

@@ -10,6 +10,7 @@ ARG BUILD_VERSION
ARG BUILD_COMMIT ARG BUILD_COMMIT
ARG BUILD_DATE ARG BUILD_DATE
ARG BASE_TAG ARG BASE_TAG
ARG SSL_CERTS_PATH
ENV SUPPRESS_NO_CONFIG_WARNING=1 \ ENV SUPPRESS_NO_CONFIG_WARNING=1 \
S6_FIX_ATTRS_HIDDEN=1 \ S6_FIX_ATTRS_HIDDEN=1 \
@@ -21,7 +22,12 @@ ENV SUPPRESS_NO_CONFIG_WARNING=1 \
OPENRESTY_DEBUG="0" \ OPENRESTY_DEBUG="0" \
MODSEC_CREATE="0" \ MODSEC_CREATE="0" \
MODSEC_ENABLE="0" \ MODSEC_ENABLE="0" \
MODSEC_ADMIN_PANEL="0" MODSEC_ADMIN_PANEL="0" \
CROWDSEC_UPDATE_DIR='/cs-update' \
GEOLITE_DB_GRAB="0" \
GEOLITE2_DB_GRAB="0" \
GEOIP_DIR="/geoip_db" \
SSL_CERTS_PATH="${SSL_CERTS_PATH:-'/etc/ssl/certs/GTS_Root_R1.pem'}"
RUN echo "fs.file-max = 65535" > /etc/sysctl.conf \ RUN echo "fs.file-max = 65535" > /etc/sysctl.conf \
&& apt-get update \ && apt-get update \

16
docker/rootfs/etc/cont-init.d/90_mmdb.sh
View File

@@ -8,13 +8,15 @@ log() {
if [[ -n "${GEOLITE2_DB_GRAB}" ]]; then if [[ -n "${GEOLITE2_DB_GRAB}" ]]; then
if [[ "${GEOLITE2_DB_GRAB}" == "1" ]] || [[ "${GEOLITE2_DB_GRAB}" -eq 1 ]]; then if [[ "${GEOLITE2_DB_GRAB}" == "1" ]] || [[ "${GEOLITE2_DB_GRAB}" -eq 1 ]]; then
log "GeoLite2 DB Grab configured, installing/updating GeoLite2 Database's" log "GeoLite2 DB Grab configured, installing/updating GeoLite2 Database's"
geo2="${GEOIP_DIR:-/geoip}/2" geo2="${GEOIP_DIR:/geoip_db}/2"
mkdir -p "$geo2/tmp" mkdir -p "$geo2/tmp"
GEOIP2_DB_URLS=( if [ -z "$GEOIP2_DB_URLS" ]; then
"https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-City.mmdb" GEOIP2_DB_URLS=(
"https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-Country.mmdb" "https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-City.mmdb"
"https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-ASN.mmdb" "https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-Country.mmdb"
) "https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-ASN.mmdb"
)
fi
# download new dbs and diff them, update if different # download new dbs and diff them, update if different
for db in "${GEOIP2_DB_URLS[@]}"; do for db in "${GEOIP2_DB_URLS[@]}"; do
log "Downloading ${db##*/} from ${db%/*}..." log "Downloading ${db##*/} from ${db%/*}..."
@@ -46,7 +48,7 @@ if [[ -n "${GEOLITE_DB_GRAB}" ]]; then
if [ "${GEOLITE_DB_GRAB}" == "1" ] || [ "${GEOLITE2_DB_GRAB}" -eq 1 ]; then if [ "${GEOLITE_DB_GRAB}" == "1" ] || [ "${GEOLITE2_DB_GRAB}" -eq 1 ]; then
log "GeoLite LEGACY DB Grab configured, downloading GeoLite LEGACY Database's" log "GeoLite LEGACY DB Grab configured, downloading GeoLite LEGACY Database's"
geo1="${GEOIP_DIR:-/geoip}/1" geo1="${GEOIP_DIR:/geoip_db}/1"
mkdir -p "$geo1" mkdir -p "$geo1"

3
docker/rootfs/etc/cont-init.d/99_crowdsec-openresty-bouncer.sh
View File

@@ -17,10 +17,13 @@ if [ "${CROWDSEC_BOUNCER}" == "1" ] || [ "${CROWDSEC_BOUNCER}" -eq 1 ]; then
log "Crowdsec OpenResty Bouncer Config copied to /data/crowdsec/crowdsec-openresty-bouncer.conf" log "Crowdsec OpenResty Bouncer Config copied to /data/crowdsec/crowdsec-openresty-bouncer.conf"
fi fi
# Create lualib plugin directory for crowdsec and move crowdsec lua libs into it # Create lualib plugin directory for crowdsec and move crowdsec lua libs into it
log "Creating CrowdSec lualib directories in /etc/nginx"
mkdir -p /etc/nginx/lualib/plugins/crowdsec/ mkdir -p /etc/nginx/lualib/plugins/crowdsec/
log "Copying CrowdSec Lua libraries to /etc/nginx/lualib/plugins/crowdsec/"
cp -r /crowdsec/lua/lib/* /etc/nginx/lualib/ cp -r /crowdsec/lua/lib/* /etc/nginx/lualib/
# This initilizes crowdsec as /etc/nginx/conf.d/* is included in nginx.conf # This initilizes crowdsec as /etc/nginx/conf.d/* is included in nginx.conf
# Fixes -> SSL_CTX_load_verify_locations("/etc/nginx/${SSL_CERTS_PATH}") failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/nginx/${SSL_CERTS_PATH}','r') error:2006D080:BIO routines:BIO_new_file:no such file error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib) # Fixes -> SSL_CTX_load_verify_locations("/etc/nginx/${SSL_CERTS_PATH}") failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/nginx/${SSL_CERTS_PATH}','r') error:2006D080:BIO routines:BIO_new_file:no such file error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib)
log "envsubst \${SSL_CERTS_PATH} (${SSL_CERTS_PATH}) in crowdsec_openresty.conf"
SSL_CERTS_PATH=${SSL_CERTS_PATH} envsubst < /crowdsec/crowdsec_openresty.conf > /etc/nginx/conf.d/crowdsec_openresty.conf SSL_CERTS_PATH=${SSL_CERTS_PATH} envsubst < /crowdsec/crowdsec_openresty.conf > /etc/nginx/conf.d/crowdsec_openresty.conf
# cp /crowdsec/crowdsec_openresty.conf /etc/nginx/conf.d/ # cp /crowdsec/crowdsec_openresty.conf /etc/nginx/conf.d/
else else

6
local-build.sh
View File

@@ -12,15 +12,15 @@ cd "${DIR}"
export DOCKER_IMAGE=baudneo/nginx-proxy-manager export DOCKER_IMAGE=baudneo/nginx-proxy-manager
export MAINTAINER="baudneo <baudneo@protonmail.com>" export MAINTAINER="baudneo <baudneo@protonmail.com>"
export REPO_OWNER="baudneo" export REPO_OWNER="baudneo"
export BASE_TAG='latest' export BASE_TAG='local_latest'
export TARGETPLATFORM=amd64 export TARGETPLATFORM=amd64
export BUILD_VERSION=dev export BUILD_VERSION=dev
export BUILD_COMMIT= export BUILD_COMMIT=
export BUILD_DATE="$(date '+%Y-%m-%d %T %Z')" export BUILD_DATE="$(date '+%Y-%m-%d %T %Z')"
export SSL_CERTS_PATH="/etc/ssl/certs/GTS_Root_R1.pem" export SSL_CERTS_PATH="/etc/ssl/certs/GTS_Root_R1.pem"
echo -e "${YELLOW}❯❯❯ ${CYAN}Running ${RED}'scripts/frontend-build'${RESET}" #echo -e "${YELLOW}❯❯❯ ${CYAN}Running ${RED}'scripts/frontend-build'${RESET}"
bash ./scripts/frontend-build #bash ./scripts/frontend-build
# Build # Build
echo -e "${BLUE}❯ ${CYAN}Building Image [${DOCKER_IMAGE}] with tag: ${YELLOW}${BASE_TAG}${CYAN}...${RESET}" echo -e "${BLUE}❯ ${CYAN}Building Image [${DOCKER_IMAGE}] with tag: ${YELLOW}${BASE_TAG}${CYAN}...${RESET}"
docker build \ docker build \