feat(service): mv config to docker imagei, better pri/pub git.

22 files changed, 245 insertions, 9 deletions

diff --git a/services/docker/git-server/app/cgit/common b/services/docker/git-server/app/cgit/common
new file mode 100644
index 0000000..90dda60
--- /dev/null
+++ b/services/docker/git-server/app/cgit/common
@@ -0,0 +1,19 @@
+css=/git/static/cgit.css
+logo=/git/static/cgit.png
+root-title=crupest Git Repos
+source-filter=/usr/lib/cgit/filters/syntax-highlighting.py
+about-filter=/usr/lib/cgit/filters/about-formatting.sh
+
+enable-http-clone=0
+enable-commit-graph=1
+enable-index-links=1
+enable-index-owner=0
+enable-log-filecount=1
+enable-log-linecount=1
+enable-git-config=1
+snapshots=tar.gz tar.bz2 zip
+
+readme=:README-repo.md
+readme=:README.md
+readme=:README
+section-from-path=1
diff --git a/services/docker/git-server/app/cgit/private b/services/docker/git-server/app/cgit/private
new file mode 100644
index 0000000..a5710b2
--- /dev/null
+++ b/services/docker/git-server/app/cgit/private
@@ -0,0 +1,5 @@
+cache-root=/var/cache/cgit/private
+include=/app/cgit/common
+strict-export=cgit-export
+clone-url=$CRUPEST_ROOT_URL/git/private$CGIT_REPO_URL
+scan-path=/git/repos/private
diff --git a/services/docker/git-server/app/cgit/public b/services/docker/git-server/app/cgit/public
new file mode 100644
index 0000000..022a333
--- /dev/null
+++ b/services/docker/git-server/app/cgit/public
@@ -0,0 +1,4 @@
+cache-root=/var/cache/cgit/public
+include=/app/cgit/common
+clone-url=$CRUPEST_ROOT_URL/git$CGIT_REPO_URL
+scan-path=/git/repos/public
diff --git a/services/docker/git-server/app/lighttpd-wrapper.bash b/services/docker/git-server/app/lighttpd-wrapper.bash
index 54079ad..70055e7 100755
--- a/services/docker/git-server/app/lighttpd-wrapper.bash
+++ b/services/docker/git-server/app/lighttpd-wrapper.bash
@@ -1,8 +1,14 @@
 #!/usr/bin/bash
 
-set -e
+set -e -o pipefail
 
-[[ -f /git/user-info ]] || touch -a /git/user-info
+die() {
+  echo "$@" >&2
+  exit 1
+}
+
+[[ -n "$CRUPEST_ROOT_URL" ]] || die "CRUPEST_ROOT_URL is not set. It is needed to create clone url of repos."
+[[ -f /git/user-info ]] || touch -a /git/user-info || die "Failed to create /git/user-info to save user accounts. Permission problem?"
 
 exec 3>&1
 exec 4>&1
diff --git a/services/docker/git-server/app/lighttpd/lighttpd.conf b/services/docker/git-server/app/lighttpd/lighttpd.conf
index a96a778..d6c30cd 100644
--- a/services/docker/git-server/app/lighttpd/lighttpd.conf
+++ b/services/docker/git-server/app/lighttpd/lighttpd.conf
@@ -47,11 +47,21 @@ $HTTP["url"] =^ "/git" {
     }
     else {
         alias.url += (
+            "/git/private" => "/usr/lib/cgit/cgit.cgi",
             "/git" => "/usr/lib/cgit/cgit.cgi",
         )
-        setenv.add-environment = (
-            "CGIT_CONFIG" => "/app/cgit/cgitrc"
-        )
+
+        $HTTP["url"] =^ "/git/private" {
+            setenv.add-environment = (
+                "CGIT_CONFIG" => "/app/cgit/private"
+            )
+        }
+        else {
+            setenv.add-environment = (
+                "CGIT_CONFIG" => "/app/cgit/public"
+            )
+        }
+
         cgi.assign = ("" => "")
     }
 }
diff --git a/services/docker/nginx/Dockerfile b/services/docker/nginx/Dockerfile
index 3169e00..77398cd 100644
--- a/services/docker/nginx/Dockerfile
+++ b/services/docker/nginx/Dockerfile
@@ -6,5 +6,6 @@ FROM nginx:mainline
 RUN apt update && apt-get install -y tini certbot && rm -rf /var/lib/apt/lists/*
 ADD mail-robots.txt /srv/mail/robots.txt
 ADD certbot.bash nginx-wrapper.bash /app/
+COPY configs/. /etc/nginx/
 COPY --from=build-www /project/public /srv/www
 CMD ["/usr/bin/tini", "--", "/app/nginx-wrapper.bash"]
diff --git a/services/docker/nginx/configs/common/acme-challenge b/services/docker/nginx/configs/common/acme-challenge
new file mode 100644
index 0000000..26054b8
--- /dev/null
+++ b/services/docker/nginx/configs/common/acme-challenge
@@ -0,0 +1,3 @@
+location /.well-known/acme-challenge {
+    root /srv/acme;
+}
diff --git a/services/docker/nginx/configs/common/http-listen b/services/docker/nginx/configs/common/http-listen
new file mode 100644
index 0000000..76cb18d
--- /dev/null
+++ b/services/docker/nginx/configs/common/http-listen
@@ -0,0 +1,2 @@
+listen 80;
+listen [::]:80;
diff --git a/services/docker/nginx/configs/common/https-listen b/services/docker/nginx/configs/common/https-listen
new file mode 100644
index 0000000..db2f68e
--- /dev/null
+++ b/services/docker/nginx/configs/common/https-listen
@@ -0,0 +1,3 @@
+listen 443 ssl;
+listen [::]:443 ssl;
+http2 on;
diff --git a/services/docker/nginx/configs/common/https-redirect b/services/docker/nginx/configs/common/https-redirect
new file mode 100644
index 0000000..56d095d
--- /dev/null
+++ b/services/docker/nginx/configs/common/https-redirect
@@ -0,0 +1,3 @@
+location / {
+    return 301 https://$host$request_uri;
+}
diff --git a/services/docker/nginx/configs/common/proxy-common b/services/docker/nginx/configs/common/proxy-common
new file mode 100644
index 0000000..4193548
--- /dev/null
+++ b/services/docker/nginx/configs/common/proxy-common
@@ -0,0 +1,7 @@
+proxy_http_version 1.1;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection $connection_upgrade;
+proxy_set_header Host $host;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Real-IP $remote_addr;
diff --git a/services/docker/nginx/configs/conf.d/default.conf b/services/docker/nginx/configs/conf.d/default.conf
new file mode 100644
index 0000000..515942b
--- /dev/null
+++ b/services/docker/nginx/configs/conf.d/default.conf
@@ -0,0 +1,9 @@
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    http2 on;
+
+    return 444;
+}
diff --git a/services/docker/nginx/configs/conf.d/websocket.conf b/services/docker/nginx/configs/conf.d/websocket.conf
new file mode 100644
index 0000000..32af4c3
--- /dev/null
+++ b/services/docker/nginx/configs/conf.d/websocket.conf
@@ -0,0 +1,4 @@
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
diff --git a/services/docker/nginx/configs/templates/code.conf.template b/services/docker/nginx/configs/templates/code.conf.template
new file mode 100644
index 0000000..aa70ebc
--- /dev/null
+++ b/services/docker/nginx/configs/templates/code.conf.template
@@ -0,0 +1,6 @@
+server {
+    server_name code.${CRUPEST_DOMAIN};
+    include common/http-listen;
+
+    include common/acme-challenge;
+}
diff --git a/services/docker/nginx/configs/templates/mail.conf.template b/services/docker/nginx/configs/templates/mail.conf.template
new file mode 100644
index 0000000..7f5f215
--- /dev/null
+++ b/services/docker/nginx/configs/templates/mail.conf.template
@@ -0,0 +1,29 @@
+server {
+    server_name mail.${CRUPEST_DOMAIN};
+    include common/https-listen;
+
+    location = /robots.txt {
+        root /srv/mail;
+    }
+
+    location / {
+        include common/proxy-common;
+        proxy_pass http://roundcubemail:80/;
+    }
+
+    location /rspamd/ {
+        include common/proxy-common;
+        proxy_pass http://mailserver:11334/;
+    }
+
+    client_max_body_size 5G;
+}
+
+
+server {
+    server_name mail.${CRUPEST_DOMAIN};
+    include common/http-listen;
+
+    include common/https-redirect;
+    include common/acme-challenge;
+}
diff --git a/services/docker/nginx/configs/templates/root.conf.template b/services/docker/nginx/configs/templates/root.conf.template
new file mode 100644
index 0000000..e3e93ad
--- /dev/null
+++ b/services/docker/nginx/configs/templates/root.conf.template
@@ -0,0 +1,45 @@
+server {
+    server_name ${CRUPEST_DOMAIN};
+    include common/https-listen;
+
+    location / {
+        root /srv/www;
+    }
+
+    location /2fa/ {
+        include common/proxy-common;
+        proxy_pass http://2fauth:8000/;
+    }
+
+    location /git/ {
+        include common/proxy-common;
+        client_max_body_size 5G;
+        proxy_pass http://git-server:3636;
+    }
+
+    location = /github {
+        return 301 ${CRUPEST_GITHUB};
+    }
+
+    location = /github/ {
+        return 301 ${CRUPEST_GITHUB};
+    }
+
+    location /_${CRUPEST_V2RAY_PATH} {
+        if ($http_upgrade != "websocket") {
+            return 404;
+        }
+
+        proxy_redirect off;
+        include common/proxy-common;
+        proxy_pass http://v2ray:10000;
+    }
+}
+
+server {
+    server_name ${CRUPEST_DOMAIN};
+    include common/http-listen;
+
+    include common/https-redirect;
+    include common/acme-challenge;
+}
diff --git a/services/docker/nginx/configs/templates/ssl.conf.template b/services/docker/nginx/configs/templates/ssl.conf.template
new file mode 100644
index 0000000..54205f1
--- /dev/null
+++ b/services/docker/nginx/configs/templates/ssl.conf.template
@@ -0,0 +1,17 @@
+# This file contains important security parameters. If you modify this file
+# manually, Certbot will be unable to automatically provide future security
+# updates. Instead, Certbot will print and log an error message with a path to
+# the up-to-date file that you will need to refer to when manually updating
+# this file. Contents are based on https://ssl-config.mozilla.org
+
+ssl_certificate /etc/letsencrypt/live/${CRUPEST_DOMAIN}/fullchain.pem;
+ssl_certificate_key /etc/letsencrypt/live/${CRUPEST_DOMAIN}/privkey.pem;
+
+ssl_session_cache shared:le_nginx_SSL:10m;
+ssl_session_timeout 1440m;
+ssl_session_tickets off;
+
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_prefer_server_ciphers off;
+
+ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
diff --git a/services/docker/nginx/configs/templates/timeline.conf.template b/services/docker/nginx/configs/templates/timeline.conf.template
new file mode 100644
index 0000000..a467594
--- /dev/null
+++ b/services/docker/nginx/configs/templates/timeline.conf.template
@@ -0,0 +1,6 @@
+server {
+    server_name timeline.${CRUPEST_DOMAIN};
+    include common/http-listen;
+
+    include common/acme-challenge;
+}
diff --git a/services/docker/nginx/nginx-wrapper.bash b/services/docker/nginx/nginx-wrapper.bash
index bd566aa..c848287 100755
--- a/services/docker/nginx/nginx-wrapper.bash
+++ b/services/docker/nginx/nginx-wrapper.bash
@@ -1,7 +1,16 @@
 #!/usr/bin/bash
 
-set -e
+set -e -o pipefail
+
+die() {
+  echo "$@" >&2
+  exit 1
+}
+
+[[ -n "$CRUPEST_DOMAIN" ]] || die "CRUPEST_DOMAIN is not set. It is used as root domain."
+[[ -n "$CRUPEST_GITHUB" ]] || die "CRUPEST_GITHUB is not set. It is used as GitHub redirection."
+[[ -n "$CRUPEST_V2RAY_PATH" ]] || die "CRUPEST_V2RAY_PATH is not set. It is used as v2ray tunnel endpoint."
 
 /app/certbot.bash &
 
-nginx "-g" "daemon off;"
+/docker-entrypoint.sh nginx "-g" "daemon off;"
diff --git a/services/docker/v2ray/Dockerfile b/services/docker/v2ray/Dockerfile
index 250a6b8..9d11474 100644
--- a/services/docker/v2ray/Dockerfile
+++ b/services/docker/v2ray/Dockerfile
@@ -1,5 +1,7 @@
 FROM alpine:edge
 
-RUN apk add --no-cache v2ray
+RUN apk add --no-cache tini v2ray
 
-ENTRYPOINT [ "/usr/bin/v2ray" ]
+ADD config.json.template v2ray-wrapper.sh /app/
+
+CMD [ "tini", "--", "/app/v2ray-wrapper.sh" ]
diff --git a/services/docker/v2ray/config.json.template b/services/docker/v2ray/config.json.template
new file mode 100644
index 0000000..c10eac2
--- /dev/null
+++ b/services/docker/v2ray/config.json.template
@@ -0,0 +1,29 @@
+{
+    "inbounds": [
+        {
+            "port": 10000,
+            "listen": "0.0.0.0",
+            "protocol": "vmess",
+            "settings": {
+                "clients": [
+                    {
+                        "id": "@@CRUPEST_V2RAY_TOKEN@@",
+                        "alterId": 0
+                    }
+                ]
+            },
+            "streamSettings": {
+                "network": "ws",
+                "wsSettings": {
+                    "path": "/_@@CRUPEST_V2RAY_PATH@@"
+                }
+            }
+        }
+    ],
+    "outbounds": [
+        {
+            "protocol": "freedom",
+            "settings": {}
+        }
+    ]
+}
\ No newline at end of file
diff --git a/services/docker/v2ray/v2ray-wrapper.sh b/services/docker/v2ray/v2ray-wrapper.sh
new file mode 100755
index 0000000..3887a0e
--- /dev/null
+++ b/services/docker/v2ray/v2ray-wrapper.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+set -e
+
+die() {
+  echo "$@" >&2
+  exit 1
+}
+
+[ -n "$CRUPEST_V2RAY_TOKEN" ] || die "CRUPEST_V2RAY_TOKEN is not set. It is used as password of v2ray tunnel."
+[ -n "$CRUPEST_V2RAY_PATH" ] || die "CRUPEST_V2RAY_PATH is not set. It is used as the http endpoint."
+
+sed -e "s|@@CRUPEST_V2RAY_TOKEN@@|$CRUPEST_V2RAY_TOKEN|" \
+    -e "s|@@CRUPEST_V2RAY_PATH@@|$CRUPEST_V2RAY_PATH|" \
+    "/app/config.json.template" > /app/config.json
+
+exec /usr/bin/v2ray run -c /app/config.json