feat(service): mv config to docker imagei, better pri/pub git.

29 files changed, 91 insertions, 39 deletions

diff --git a/services/config.template b/services/config.template
index 7cf7162..7b3d1dc 100644
--- a/services/config.template
+++ b/services/config.template
@@ -1,5 +1,5 @@
 CRUPEST_MAIL_SERVER_DOMAIN=mail.@@CRUPEST_DOMAIN@@
-CRUPEST_ROOT_URL=https://@@CRUPEST_DOMAIN@@/
+CRUPEST_ROOT_URL=https://@@CRUPEST_DOMAIN@@
 CRUPEST_DOCKER_DIR=@@CRUPEST_SERVICES_DIR@@/docker
 CRUPEST_SERVICES_STATE_DIR=@@CRUPEST_SERVICES_DIR@@/state
 CRUPEST_DATA_SECRET_DIR=@@CRUPEST_DATA_DIR@@/secret
diff --git a/services/templates/cgit/cgitrc.template b/services/docker/git-server/app/cgit/common
index ed581bd..90dda60 100644
--- a/services/templates/cgit/cgitrc.template
+++ b/services/docker/git-server/app/cgit/common
@@ -13,14 +13,7 @@ enable-log-linecount=1
 enable-git-config=1
 snapshots=tar.gz tar.bz2 zip
 
+readme=:README-repo.md
 readme=:README.md
 readme=:README
-
-clone-prefix=@@CRUPEST_ROOT_URL@@git
 section-from-path=1
-scan-path=/git/repos/public
-
-strict-export=cgit-export
-section-from-path=-1
-project-list=/app/cgit/private-list
-scan-path=/git/repos
diff --git a/services/docker/git-server/app/cgit/private b/services/docker/git-server/app/cgit/private
new file mode 100644
index 0000000..a5710b2
--- /dev/null
+++ b/services/docker/git-server/app/cgit/private
@@ -0,0 +1,5 @@
+cache-root=/var/cache/cgit/private
+include=/app/cgit/common
+strict-export=cgit-export
+clone-url=$CRUPEST_ROOT_URL/git/private$CGIT_REPO_URL
+scan-path=/git/repos/private
diff --git a/services/docker/git-server/app/cgit/public b/services/docker/git-server/app/cgit/public
new file mode 100644
index 0000000..022a333
--- /dev/null
+++ b/services/docker/git-server/app/cgit/public
@@ -0,0 +1,4 @@
+cache-root=/var/cache/cgit/public
+include=/app/cgit/common
+clone-url=$CRUPEST_ROOT_URL/git$CGIT_REPO_URL
+scan-path=/git/repos/public
diff --git a/services/docker/git-server/app/lighttpd-wrapper.bash b/services/docker/git-server/app/lighttpd-wrapper.bash
index 54079ad..70055e7 100755
--- a/services/docker/git-server/app/lighttpd-wrapper.bash
+++ b/services/docker/git-server/app/lighttpd-wrapper.bash
@@ -1,8 +1,14 @@
 #!/usr/bin/bash
 
-set -e
+set -e -o pipefail
 
-[[ -f /git/user-info ]] || touch -a /git/user-info
+die() {
+  echo "$@" >&2
+  exit 1
+}
+
+[[ -n "$CRUPEST_ROOT_URL" ]] || die "CRUPEST_ROOT_URL is not set. It is needed to create clone url of repos."
+[[ -f /git/user-info ]] || touch -a /git/user-info || die "Failed to create /git/user-info to save user accounts. Permission problem?"
 
 exec 3>&1
 exec 4>&1
diff --git a/services/docker/git-server/app/lighttpd/lighttpd.conf b/services/docker/git-server/app/lighttpd/lighttpd.conf
index a96a778..d6c30cd 100644
--- a/services/docker/git-server/app/lighttpd/lighttpd.conf
+++ b/services/docker/git-server/app/lighttpd/lighttpd.conf
@@ -47,11 +47,21 @@ $HTTP["url"] =^ "/git" {
     }
     else {
         alias.url += (
+            "/git/private" => "/usr/lib/cgit/cgit.cgi",
             "/git" => "/usr/lib/cgit/cgit.cgi",
         )
-        setenv.add-environment = (
-            "CGIT_CONFIG" => "/app/cgit/cgitrc"
-        )
+
+        $HTTP["url"] =^ "/git/private" {
+            setenv.add-environment = (
+                "CGIT_CONFIG" => "/app/cgit/private"
+            )
+        }
+        else {
+            setenv.add-environment = (
+                "CGIT_CONFIG" => "/app/cgit/public"
+            )
+        }
+
         cgi.assign = ("" => "")
     }
 }
diff --git a/services/docker/nginx/Dockerfile b/services/docker/nginx/Dockerfile
index 3169e00..77398cd 100644
--- a/services/docker/nginx/Dockerfile
+++ b/services/docker/nginx/Dockerfile
@@ -6,5 +6,6 @@ FROM nginx:mainline
 RUN apt update && apt-get install -y tini certbot && rm -rf /var/lib/apt/lists/*
 ADD mail-robots.txt /srv/mail/robots.txt
 ADD certbot.bash nginx-wrapper.bash /app/
+COPY configs/. /etc/nginx/
 COPY --from=build-www /project/public /srv/www
 CMD ["/usr/bin/tini", "--", "/app/nginx-wrapper.bash"]
diff --git a/services/templates/nginx/common/acme-challenge b/services/docker/nginx/configs/common/acme-challenge
index 26054b8..26054b8 100644
--- a/services/templates/nginx/common/acme-challenge
+++ b/services/docker/nginx/configs/common/acme-challenge
diff --git a/services/templates/nginx/common/http-listen b/services/docker/nginx/configs/common/http-listen
index 76cb18d..76cb18d 100644
--- a/services/templates/nginx/common/http-listen
+++ b/services/docker/nginx/configs/common/http-listen
diff --git a/services/templates/nginx/common/https-listen b/services/docker/nginx/configs/common/https-listen
index db2f68e..db2f68e 100644
--- a/services/templates/nginx/common/https-listen
+++ b/services/docker/nginx/configs/common/https-listen
diff --git a/services/templates/nginx/common/https-redirect b/services/docker/nginx/configs/common/https-redirect
index 56d095d..56d095d 100644
--- a/services/templates/nginx/common/https-redirect
+++ b/services/docker/nginx/configs/common/https-redirect
diff --git a/services/templates/nginx/common/proxy-common b/services/docker/nginx/configs/common/proxy-common
index 4193548..4193548 100644
--- a/services/templates/nginx/common/proxy-common
+++ b/services/docker/nginx/configs/common/proxy-common
diff --git a/services/templates/nginx/conf.d/forbid_unknown_domain.conf b/services/docker/nginx/configs/conf.d/default.conf
index 515942b..515942b 100644
--- a/services/templates/nginx/conf.d/forbid_unknown_domain.conf
+++ b/services/docker/nginx/configs/conf.d/default.conf
diff --git a/services/templates/nginx/conf.d/websocket.conf b/services/docker/nginx/configs/conf.d/websocket.conf
index 32af4c3..32af4c3 100644
--- a/services/templates/nginx/conf.d/websocket.conf
+++ b/services/docker/nginx/configs/conf.d/websocket.conf
diff --git a/services/templates/nginx/conf.d/code.conf.template b/services/docker/nginx/configs/templates/code.conf.template
index 35f74d8..aa70ebc 100644
--- a/services/templates/nginx/conf.d/code.conf.template
+++ b/services/docker/nginx/configs/templates/code.conf.template
@@ -1,5 +1,5 @@
 server {
-    server_name code.@@CRUPEST_DOMAIN@@;
+    server_name code.${CRUPEST_DOMAIN};
     include common/http-listen;
 
     include common/acme-challenge;
diff --git a/services/templates/nginx/conf.d/mail.conf.template b/services/docker/nginx/configs/templates/mail.conf.template
index c115c2e..7f5f215 100644
--- a/services/templates/nginx/conf.d/mail.conf.template
+++ b/services/docker/nginx/configs/templates/mail.conf.template
@@ -1,7 +1,7 @@
 server {
-    server_name mail.@@CRUPEST_DOMAIN@@;
+    server_name mail.${CRUPEST_DOMAIN};
     include common/https-listen;
-    
+
     location = /robots.txt {
         root /srv/mail;
     }
@@ -21,7 +21,7 @@ server {
 
 
 server {
-    server_name mail.@@CRUPEST_DOMAIN@@;
+    server_name mail.${CRUPEST_DOMAIN};
     include common/http-listen;
 
     include common/https-redirect;
diff --git a/services/templates/nginx/conf.d/root.conf.template b/services/docker/nginx/configs/templates/root.conf.template
index 28c2fea..e3e93ad 100644
--- a/services/templates/nginx/conf.d/root.conf.template
+++ b/services/docker/nginx/configs/templates/root.conf.template
@@ -1,5 +1,5 @@
 server {
-    server_name @@CRUPEST_DOMAIN@@;
+    server_name ${CRUPEST_DOMAIN};
     include common/https-listen;
 
     location / {
@@ -18,14 +18,14 @@ server {
     }
 
     location = /github {
-        return 301 @@CRUPEST_GITHUB@@;
+        return 301 ${CRUPEST_GITHUB};
     }
 
     location = /github/ {
-        return 301 @@CRUPEST_GITHUB@@;
+        return 301 ${CRUPEST_GITHUB};
     }
 
-    location /_@@CRUPEST_V2RAY_PATH@@ {
+    location /_${CRUPEST_V2RAY_PATH} {
         if ($http_upgrade != "websocket") {
             return 404;
         }
@@ -37,7 +37,7 @@ server {
 }
 
 server {
-    server_name @@CRUPEST_DOMAIN@@;
+    server_name ${CRUPEST_DOMAIN};
     include common/http-listen;
 
     include common/https-redirect;
diff --git a/services/templates/nginx/conf.d/ssl.conf.template b/services/docker/nginx/configs/templates/ssl.conf.template
index 181a1af..54205f1 100644
--- a/services/templates/nginx/conf.d/ssl.conf.template
+++ b/services/docker/nginx/configs/templates/ssl.conf.template
@@ -4,8 +4,8 @@
 # the up-to-date file that you will need to refer to when manually updating
 # this file. Contents are based on https://ssl-config.mozilla.org
 
-ssl_certificate /etc/letsencrypt/live/@@CRUPEST_DOMAIN@@/fullchain.pem;
-ssl_certificate_key /etc/letsencrypt/live/@@CRUPEST_DOMAIN@@/privkey.pem;
+ssl_certificate /etc/letsencrypt/live/${CRUPEST_DOMAIN}/fullchain.pem;
+ssl_certificate_key /etc/letsencrypt/live/${CRUPEST_DOMAIN}/privkey.pem;
 
 ssl_session_cache shared:le_nginx_SSL:10m;
 ssl_session_timeout 1440m;
diff --git a/services/templates/nginx/conf.d/timeline.conf.template b/services/docker/nginx/configs/templates/timeline.conf.template
index df4edf8..a467594 100644
--- a/services/templates/nginx/conf.d/timeline.conf.template
+++ b/services/docker/nginx/configs/templates/timeline.conf.template
@@ -1,5 +1,5 @@
 server {
-    server_name timeline.@@CRUPEST_DOMAIN@@;
+    server_name timeline.${CRUPEST_DOMAIN};
     include common/http-listen;
 
     include common/acme-challenge;
diff --git a/services/docker/nginx/nginx-wrapper.bash b/services/docker/nginx/nginx-wrapper.bash
index bd566aa..c848287 100755
--- a/services/docker/nginx/nginx-wrapper.bash
+++ b/services/docker/nginx/nginx-wrapper.bash
@@ -1,7 +1,16 @@
 #!/usr/bin/bash
 
-set -e
+set -e -o pipefail
+
+die() {
+  echo "$@" >&2
+  exit 1
+}
+
+[[ -n "$CRUPEST_DOMAIN" ]] || die "CRUPEST_DOMAIN is not set. It is used as root domain."
+[[ -n "$CRUPEST_GITHUB" ]] || die "CRUPEST_GITHUB is not set. It is used as GitHub redirection."
+[[ -n "$CRUPEST_V2RAY_PATH" ]] || die "CRUPEST_V2RAY_PATH is not set. It is used as v2ray tunnel endpoint."
 
 /app/certbot.bash &
 
-nginx "-g" "daemon off;"
+/docker-entrypoint.sh nginx "-g" "daemon off;"
diff --git a/services/docker/v2ray/Dockerfile b/services/docker/v2ray/Dockerfile
index 250a6b8..9d11474 100644
--- a/services/docker/v2ray/Dockerfile
+++ b/services/docker/v2ray/Dockerfile
@@ -1,5 +1,7 @@
 FROM alpine:edge
 
-RUN apk add --no-cache v2ray
+RUN apk add --no-cache tini v2ray
 
-ENTRYPOINT [ "/usr/bin/v2ray" ]
+ADD config.json.template v2ray-wrapper.sh /app/
+
+CMD [ "tini", "--", "/app/v2ray-wrapper.sh" ]
diff --git a/services/templates/v2ray-config.json.template b/services/docker/v2ray/config.json.template
index c10eac2..c10eac2 100644
--- a/services/templates/v2ray-config.json.template
+++ b/services/docker/v2ray/config.json.template
diff --git a/services/docker/v2ray/v2ray-wrapper.sh b/services/docker/v2ray/v2ray-wrapper.sh
new file mode 100755
index 0000000..3887a0e
--- /dev/null
+++ b/services/docker/v2ray/v2ray-wrapper.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+set -e
+
+die() {
+  echo "$@" >&2
+  exit 1
+}
+
+[ -n "$CRUPEST_V2RAY_TOKEN" ] || die "CRUPEST_V2RAY_TOKEN is not set. It is used as password of v2ray tunnel."
+[ -n "$CRUPEST_V2RAY_PATH" ] || die "CRUPEST_V2RAY_PATH is not set. It is used as the http endpoint."
+
+sed -e "s|@@CRUPEST_V2RAY_TOKEN@@|$CRUPEST_V2RAY_TOKEN|" \
+    -e "s|@@CRUPEST_V2RAY_PATH@@|$CRUPEST_V2RAY_PATH|" \
+    "/app/config.json.template" > /app/config.json
+
+exec /usr/bin/v2ray run -c /app/config.json
diff --git a/services/templates/cgit/private-list b/services/templates/cgit/private-list
deleted file mode 100644
index c8c6761..0000000
--- a/services/templates/cgit/private-list
+++ /dev/null
@@ -1 +0,0 @@
-private
\ No newline at end of file
diff --git a/services/templates/docker-compose.yaml.template b/services/templates/docker-compose.yaml.template
index 842037b..e133462 100644
--- a/services/templates/docker-compose.yaml.template
+++ b/services/templates/docker-compose.yaml.template
@@ -12,12 +12,13 @@ services:
       - "80:80"
       - "443:443"
       - "443:443/udp"
+    env_file:
+      - ./@@CRUPEST_GENERATED_DIR@@/envs/nginx.env
+      - ./@@CRUPEST_GENERATED_DIR@@/envs/v2ray-common.env
     volumes:
-      - "./@@CRUPEST_GENERATED_NGINX_DIR@@/conf.d:/etc/nginx/conf.d:ro"
-      - "./@@CRUPEST_GENERATED_NGINX_DIR@@/common:/etc/nginx/common:ro"
       - "./@@CRUPEST_DATA_CERTBOT_DIR@@/certs:/etc/letsencrypt"
-      - "./@@CRUPEST_DATA_CERTBOT_DIR@@/webroot:/srv/acme:ro"
       - "./@@CRUPEST_DATA_CERTBOT_DIR@@/data:/var/lib/letsencrypt"
+      - "./@@CRUPEST_DATA_CERTBOT_DIR@@/webroot:/srv/acme:ro"
       - "./@@CRUPEST_DATA_CERTBOT_DIR@@/webroot:/var/www/certbot"
     restart: on-failure:3
 
@@ -28,9 +29,9 @@ services:
       dockerfile: Dockerfile
       pull: true
     hostname: v2ray
-    command: [ "run", "-c", "/etc/v2fly/config.json" ]
-    volumes:
-      - "./@@CRUPEST_GENERATED_DIR@@/v2ray-config.json:/etc/v2fly/config.json:ro"
+    env_file:
+      - ./@@CRUPEST_GENERATED_DIR@@/envs/v2ray-common.env
+      - ./@@CRUPEST_GENERATED_DIR@@/envs/v2ray.env
     restart: on-failure:3
 
   auto-backup:
@@ -82,9 +83,10 @@ services:
       dockerfile: Dockerfile
       pull: true
     hostname: git-server
+    environment:
+      - CRUPEST_ROOT_URL=@@CRUPEST_ROOT_URL@@
     volumes:
       - "./@@CRUPEST_DATA_GIT_DIR@@:/git"
-      - "./@@CRUPEST_GENERATED_DIR@@/cgit:/app/cgit"
     restart: on-failure:3
 
   roundcubemail:
diff --git a/services/templates/envs/2fauth.env.template b/services/templates/envs/2fauth.env.template
index cd084b5..de2ad3a 100644
--- a/services/templates/envs/2fauth.env.template
+++ b/services/templates/envs/2fauth.env.template
@@ -2,7 +2,7 @@ APP_NAME=2FAuth-crupest
 APP_TIMEZONE=UTC
 SITE_OWNER=@@CRUPEST_EMAIL@@
 APP_KEY=@@CRUPEST_2FAUTH_APP_KEY@@
-APP_URL=@@CRUPEST_ROOT_URL@@2fa
+APP_URL=@@CRUPEST_ROOT_URL@@/2fa
 APP_SUBDIRECTORY=2fa
 MAIL_MAILER=smtp
 MAIL_HOST=@@CRUPEST_MAIL_SERVER_DOMAIN@@
diff --git a/services/templates/envs/nginx.env.template b/services/templates/envs/nginx.env.template
new file mode 100644
index 0000000..55143ab
--- /dev/null
+++ b/services/templates/envs/nginx.env.template
@@ -0,0 +1,2 @@
+CRUPEST_DOMAIN=@@CRUPEST_DOMAIN@@
+CRUPEST_GITHUB=@@CRUPEST_GITHUB@@
diff --git a/services/templates/envs/v2ray-common.env.template b/services/templates/envs/v2ray-common.env.template
new file mode 100644
index 0000000..5e7dc77
--- /dev/null
+++ b/services/templates/envs/v2ray-common.env.template
@@ -0,0 +1 @@
+CRUPEST_V2RAY_PATH=@@CRUPEST_V2RAY_PATH@@
diff --git a/services/templates/envs/v2ray.env.template b/services/templates/envs/v2ray.env.template
new file mode 100644
index 0000000..b5791c8
--- /dev/null
+++ b/services/templates/envs/v2ray.env.template
@@ -0,0 +1 @@
+CRUPEST_V2RAY_TOKEN=@@CRUPEST_V2RAY_TOKEN@@