diff options
Diffstat (limited to 'services/templates')
19 files changed, 196 insertions, 112 deletions
diff --git a/services/templates/disabled/docker-compose.yaml b/services/templates/disabled/docker-compose.yaml index 565ca49..0cd2256 100644 --- a/services/templates/disabled/docker-compose.yaml +++ b/services/templates/disabled/docker-compose.yaml @@ -1,22 +1,4 @@ services: - debian-dev: - pull_policy: build - build: - context: ./docker/debian-dev - dockerfile: Dockerfile - pull: true - args: - - USER=crupest - tags: - - "crupest/debian-dev:latest" - container_name: debian-dev - init: true - command: [ "/bootstrap/start/code-server.bash" ] - volumes: - - ./data/debian-dev:/data - - debian-dev-home:/home/crupest - restart: on-failure:3 - timeline: image: crupest/timeline:latest pull_policy: always @@ -27,6 +9,3 @@ services: - TIMELINE_DisableAutoBackup=true volumes: - ./data/timeline:/root/timeline - -volumes: - debian-dev-home: diff --git a/services/templates/disabled/nginx/code.conf.template b/services/templates/disabled/nginx/code.conf.template deleted file mode 100644 index 0abe042..0000000 --- a/services/templates/disabled/nginx/code.conf.template +++ /dev/null @@ -1,20 +0,0 @@ -server { - server_name code.@@CRUPEST_DOMAIN@@; - include common/https-listen; - - location / { - include common/proxy-common; - proxy_pass http://debian-dev:8080/; - } - - client_max_body_size 5G; -} - - -server { - server_name code.@@CRUPEST_DOMAIN@@; - include common/http-listen; - - include common/https-redirect; - include common/acme-challenge; -} diff --git a/services/templates/disabled/nginx/timeline.conf.template b/services/templates/disabled/nginx/timeline.conf.template index ce7341b..086c1f7 100644 --- a/services/templates/disabled/nginx/timeline.conf.template +++ b/services/templates/disabled/nginx/timeline.conf.template @@ -2,9 +2,9 @@ server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name timeline.@@CRUPEST_DOMAIN@@; - + location / { - include common/reverse-proxy; + include conf.d/common/reverse-proxy; proxy_pass http://timeline:5000/; } @@ -16,6 +16,6 @@ server { listen [::]:80; server_name timeline.@@CRUPEST_DOMAIN@@; - include common/https-redirect; - include common/acme-challenge; + include conf.d/common/https-redirect; + include conf.d/common/acme-challenge; } diff --git a/services/templates/docker-compose.yaml.template b/services/templates/docker-compose.yaml.template index dcbcca0..b81875b 100644 --- a/services/templates/docker-compose.yaml.template +++ b/services/templates/docker-compose.yaml.template @@ -3,9 +3,9 @@ services: nginx: pull_policy: build build: - context: ./@@CRUPEST_DOCKER_DIR@@/nginx + context: "./@@CRUPEST_DOCKER_DIR@@/nginx" additional_contexts: - - www=./www + - "www=./www" dockerfile: Dockerfile pull: true ports: @@ -13,46 +13,24 @@ services: - "443:443" - "443:443/udp" env_file: - - ./@@CRUPEST_GENERATED_DIR@@/envs/nginx.env - - ./@@CRUPEST_GENERATED_DIR@@/envs/v2ray-common.env - - ./@@CRUPEST_GENERATED_DIR@@/envs/mail-server-common.env + - "./@@CRUPEST_GENERATED_DIR@@/envs/v2ray-common.env" + - "./@@CRUPEST_GENERATED_DIR@@/envs/mail-server-common.env" volumes: + - "./@@CRUPEST_GENERATED_DIR@@/nginx:/etc/nginx/conf.d" - "./@@CRUPEST_DATA_CERTBOT_DIR@@/certs:/etc/letsencrypt" - "./@@CRUPEST_DATA_CERTBOT_DIR@@/data:/var/lib/letsencrypt" - - "./@@CRUPEST_DATA_CERTBOT_DIR@@/webroot:/srv/acme:ro" - "./@@CRUPEST_DATA_CERTBOT_DIR@@/webroot:/var/www/certbot" - restart: on-failure:3 - - v2ray: - pull_policy: build - build: - context: ./@@CRUPEST_DOCKER_DIR@@/v2ray - dockerfile: Dockerfile - pull: true - hostname: v2ray - env_file: - - ./@@CRUPEST_GENERATED_DIR@@/envs/v2ray-common.env - - ./@@CRUPEST_GENERATED_DIR@@/envs/v2ray.env - restart: on-failure:3 - - auto-backup: - pull_policy: build - env_file: ./@@CRUPEST_GENERATED_DIR@@/envs/auto-backup.env - build: - context: ./@@CRUPEST_DOCKER_DIR@@/auto-backup - dockerfile: Dockerfile - pull: true - volumes: - - "./data:/data:ro" - - "./data/auto-backup:/data/auto-backup" - restart: on-failure:3 + networks: + default: + ipv4_address: "172.21.5.2" + restart: "on-failure:3" mail-server: pull_policy: build build: - context: ./@@CRUPEST_DOCKER_DIR@@/mail-server + context: "./@@CRUPEST_DOCKER_DIR@@/mail-server" additional_contexts: - - deno=./deno + - "deno=./deno" dockerfile: Dockerfile pull: true container_name: mail-server @@ -72,42 +50,80 @@ services: - "./@@CRUPEST_SSL_FULLCHAIN_FILE@@:/etc/dovecot/ssl/tls.crt" - "./@@CRUPEST_SSL_PRIVATE_KEY_FILE@@:/etc/dovecot/ssl/tls.key" - "/etc/localtime:/etc/localtime:ro" - restart: on-failure:3 + networks: + default: + ipv4_address: "172.21.5.3" + restart: "on-failure:3" stop_grace_period: 1m git-server: pull_policy: build build: - context: ./@@CRUPEST_DOCKER_DIR@@/git-server + context: "./@@CRUPEST_DOCKER_DIR@@/git-server" dockerfile: Dockerfile pull: true hostname: git-server environment: - - CRUPEST_ROOT_URL=@@CRUPEST_ROOT_URL@@ + - "CRUPEST_ROOT_URL=@@CRUPEST_ROOT_URL@@" volumes: - "./@@CRUPEST_DATA_GIT_DIR@@:/git" + networks: + default: + ipv4_address: "172.21.5.4" restart: on-failure:3 roundcubemail: - image: roundcube/roundcubemail:latest + image: "roundcube/roundcubemail" pull_policy: always hostname: roundcubemail - env_file: ./@@CRUPEST_GENERATED_DIR@@/envs/roundcubemail.env + env_file: + - "./@@CRUPEST_GENERATED_DIR@@/envs/roundcubemail.env" volumes: - - ./@@CRUPEST_DATA_SECRET_DIR@@/gnupg:/gnupg - - ./@@CRUPEST_DATA_ROUNDCUBE_DIR@@/www/html:/var/www/html - - ./@@CRUPEST_DATA_ROUNDCUBE_DIR@@/db:/var/roundcube/db - - ./@@CRUPEST_DATA_ROUNDCUBE_DIR@@/config:/var/roundcube/config - - roundcubemail-temp:/tmp/roundcube-temp + - "./@@CRUPEST_GENERATED_DIR@@/my-roundcube.inc.php:/var/roundcube/config/my-roundcube.inc.php" + - "./@@CRUPEST_DATA_SECRET_DIR@@/gnupg:/var/roundcube/enigma" + - "./@@CRUPEST_DATA_ROUNDCUBE_DIR@@/www/html:/var/www/html" + - "./@@CRUPEST_DATA_ROUNDCUBE_DIR@@/db:/var/roundcube/db" + - "roundcubemail-temp:/tmp/roundcube-temp" + networks: + default: + ipv4_address: "172.21.5.5" restart: on-failure:3 - 2fauth: - image: 2fauth/2fauth - pull_policy: always - hostname: 2fauth - env_file: ./@@CRUPEST_GENERATED_DIR@@/envs/2fauth.env + v2ray: + pull_policy: build + build: + context: "./@@CRUPEST_DOCKER_DIR@@/v2ray" + dockerfile: Dockerfile + pull: true + hostname: v2ray + env_file: + - "./@@CRUPEST_GENERATED_DIR@@/envs/v2ray-common.env" + - "./@@CRUPEST_GENERATED_DIR@@/envs/v2ray.env" + networks: + default: + ipv4_address: "172.21.5.6" + restart: "on-failure:3" + + auto-backup: + pull_policy: build + build: + context: "./@@CRUPEST_DOCKER_DIR@@/auto-backup" + dockerfile: Dockerfile + pull: true + env_file: + - "./@@CRUPEST_GENERATED_DIR@@/envs/auto-backup.env" volumes: - - ./data/2fauth:/2fauth + - "./data:/data:ro" + - "./data/auto-backup:/data/auto-backup" + restart: "on-failure:3" volumes: roundcubemail-temp: + +networks: + default: + enable_ipv6: false + ipam: + config: + - subnet: "172.21.5.0/24" + ip_range: "172.21.5.64/26" diff --git a/services/templates/envs/2fauth.env.template b/services/templates/envs/2fauth.env.template deleted file mode 100644 index de2ad3a..0000000 --- a/services/templates/envs/2fauth.env.template +++ /dev/null @@ -1,15 +0,0 @@ -APP_NAME=2FAuth-crupest -APP_TIMEZONE=UTC -SITE_OWNER=@@CRUPEST_EMAIL@@ -APP_KEY=@@CRUPEST_2FAUTH_APP_KEY@@ -APP_URL=@@CRUPEST_ROOT_URL@@/2fa -APP_SUBDIRECTORY=2fa -MAIL_MAILER=smtp -MAIL_HOST=@@CRUPEST_MAIL_SERVER_DOMAIN@@ -MAIL_PORT=465 -MAIL_USERNAME=@@CRUPEST_2FAUTH_MAIL_USERNAME@@ -MAIL_PASSWORD=@@CRUPEST_2FAUTH_MAIL_PASSWORD@@ -MAIL_ENCRYPTION=ssl -MAIL_FROM_NAME=2FAuth-crupest -MAIL_FROM_ADDRESS=@@CRUPEST_2FAUTH_MAIL_USERNAME@@ -TRUSTED_PROXIES=* diff --git a/services/templates/envs/mail-server.env.template b/services/templates/envs/mail-server.env.template index 274037b..9ad1c58 100644 --- a/services/templates/envs/mail-server.env.template +++ b/services/templates/envs/mail-server.env.template @@ -1,5 +1,5 @@ CRUPEST_MAIL_SERVER_MAIL_DOMAIN=@@CRUPEST_DOMAIN@@ -CRUPEST_MAIL_SERVER_DATA_PATH=/data/crupest-relay/ +CRUPEST_MAIL_SERVER_DATA_PATH=/data/crupest-mail/ CRUPEST_MAIL_SERVER_INBOUND_FALLBACK=crupest@crupest.life CRUPEST_MAIL_SERVER_AWS_INBOUND_KEY=@@CRUPEST_MAIL_SERVER_AWS_INBOUND_KEY@@ CRUPEST_MAIL_SERVER_AWS_REGION=@@CRUPEST_MAIL_SERVER_AWS_REGION@@ diff --git a/services/templates/envs/nginx.env.template b/services/templates/envs/nginx.env.template deleted file mode 100644 index 55143ab..0000000 --- a/services/templates/envs/nginx.env.template +++ /dev/null @@ -1,2 +0,0 @@ -CRUPEST_DOMAIN=@@CRUPEST_DOMAIN@@ -CRUPEST_GITHUB=@@CRUPEST_GITHUB@@ diff --git a/services/templates/my-roundcube.inc.php b/services/templates/my-roundcube.inc.php new file mode 100644 index 0000000..c07aff9 --- /dev/null +++ b/services/templates/my-roundcube.inc.php @@ -0,0 +1,3 @@ +<?php + +$config['managesieve_host'] = 'tls://%h'; diff --git a/services/templates/nginx/common/acme-challenge b/services/templates/nginx/common/acme-challenge new file mode 100644 index 0000000..8280cd8 --- /dev/null +++ b/services/templates/nginx/common/acme-challenge @@ -0,0 +1,3 @@ +location /.well-known/acme-challenge { + root /var/www/certbot; +} diff --git a/services/templates/nginx/common/http-listen b/services/templates/nginx/common/http-listen new file mode 100644 index 0000000..76cb18d --- /dev/null +++ b/services/templates/nginx/common/http-listen @@ -0,0 +1,2 @@ +listen 80; +listen [::]:80; diff --git a/services/templates/nginx/common/https-listen b/services/templates/nginx/common/https-listen new file mode 100644 index 0000000..db2f68e --- /dev/null +++ b/services/templates/nginx/common/https-listen @@ -0,0 +1,3 @@ +listen 443 ssl; +listen [::]:443 ssl; +http2 on; diff --git a/services/templates/nginx/common/https-redirect b/services/templates/nginx/common/https-redirect new file mode 100644 index 0000000..56d095d --- /dev/null +++ b/services/templates/nginx/common/https-redirect @@ -0,0 +1,3 @@ +location / { + return 301 https://$host$request_uri; +} diff --git a/services/templates/nginx/common/reverse-proxy b/services/templates/nginx/common/reverse-proxy new file mode 100644 index 0000000..4193548 --- /dev/null +++ b/services/templates/nginx/common/reverse-proxy @@ -0,0 +1,7 @@ +proxy_http_version 1.1; +proxy_set_header Upgrade $http_upgrade; +proxy_set_header Connection $connection_upgrade; +proxy_set_header Host $host; +proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; +proxy_set_header X-Forwarded-Proto $scheme; +proxy_set_header X-Real-IP $remote_addr; diff --git a/services/templates/nginx/default.conf b/services/templates/nginx/default.conf new file mode 100644 index 0000000..515942b --- /dev/null +++ b/services/templates/nginx/default.conf @@ -0,0 +1,9 @@ +server { + listen 80 default_server; + listen [::]:80 default_server; + listen 443 ssl default_server; + listen [::]:443 ssl default_server; + http2 on; + + return 444; +} diff --git a/services/templates/nginx/mail.conf.template b/services/templates/nginx/mail.conf.template new file mode 100644 index 0000000..1c2a2ca --- /dev/null +++ b/services/templates/nginx/mail.conf.template @@ -0,0 +1,29 @@ +server { + server_name mail.@@CRUPEST_DOMAIN@@; + include conf.d/common/https-listen; + + location = /robots.txt { + root /srv/mail; + } + + location = /@@CRUPEST_MAIL_SERVER_AWS_INBOUND_PATH@@ { + include conf.d/common/reverse-proxy; + proxy_pass http://mail-server:2345/@@CRUPEST_MAIL_SERVER_AWS_INBOUND_PATH@@; + } + + location / { + include conf.d/common/reverse-proxy; + proxy_pass http://roundcubemail:80/; + } + + client_max_body_size 5G; +} + + +server { + server_name mail.@@CRUPEST_DOMAIN@@; + include conf.d/common/http-listen; + + include conf.d/common/https-redirect; + include conf.d/common/acme-challenge; +} diff --git a/services/templates/nginx/root.conf.template b/services/templates/nginx/root.conf.template new file mode 100644 index 0000000..db28f00 --- /dev/null +++ b/services/templates/nginx/root.conf.template @@ -0,0 +1,40 @@ +server { + server_name @@CRUPEST_DOMAIN@@; + include conf.d/common/https-listen; + + location / { + root /srv/www; + } + + location /git/ { + include conf.d/common/reverse-proxy; + client_max_body_size 5G; + proxy_pass http://git-server:3636; + } + + location = /github { + return 301 @@CRUPEST_GITHUB@@; + } + + location = /github/ { + return 301 @@CRUPEST_GITHUB@@; + } + + location /_@@CRUPEST_V2RAY_PATH@@ { + if ($http_upgrade != "websocket") { + return 404; + } + + proxy_redirect off; + include conf.d/common/reverse-proxy; + proxy_pass http://v2ray:10000; + } +} + +server { + server_name @@CRUPEST_DOMAIN@@; + include conf.d/common/http-listen; + + include conf.d/common/https-redirect; + include conf.d/common/acme-challenge; +} diff --git a/services/templates/nginx/ssl.conf.template b/services/templates/nginx/ssl.conf.template new file mode 100644 index 0000000..181a1af --- /dev/null +++ b/services/templates/nginx/ssl.conf.template @@ -0,0 +1,17 @@ +# This file contains important security parameters. If you modify this file +# manually, Certbot will be unable to automatically provide future security +# updates. Instead, Certbot will print and log an error message with a path to +# the up-to-date file that you will need to refer to when manually updating +# this file. Contents are based on https://ssl-config.mozilla.org + +ssl_certificate /etc/letsencrypt/live/@@CRUPEST_DOMAIN@@/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/@@CRUPEST_DOMAIN@@/privkey.pem; + +ssl_session_cache shared:le_nginx_SSL:10m; +ssl_session_timeout 1440m; +ssl_session_tickets off; + +ssl_protocols TLSv1.2 TLSv1.3; +ssl_prefer_server_ciphers off; + +ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"; diff --git a/services/templates/nginx/timeline.conf.template b/services/templates/nginx/timeline.conf.template new file mode 100644 index 0000000..3414510 --- /dev/null +++ b/services/templates/nginx/timeline.conf.template @@ -0,0 +1,6 @@ +server { + server_name timeline.@@CRUPEST_DOMAIN@@; + include conf.d/common/http-listen; + + include conf.d/common/acme-challenge; +} diff --git a/services/templates/nginx/websocket.conf b/services/templates/nginx/websocket.conf new file mode 100644 index 0000000..32af4c3 --- /dev/null +++ b/services/templates/nginx/websocket.conf @@ -0,0 +1,4 @@ +map $http_upgrade $connection_upgrade { + default upgrade; + '' close; +} |