From ac7c3e0ab3b460a5a96df04496e6f310ef9572d0 Mon Sep 17 00:00:00 2001 From: Yuqian Yang Date: Sun, 9 Mar 2025 17:31:21 +0800 Subject: feat(service): mv config to docker imagei, better pri/pub git. --- services/config.template | 2 +- services/docker/git-server/app/cgit/common | 19 +++++++++ services/docker/git-server/app/cgit/private | 5 +++ services/docker/git-server/app/cgit/public | 4 ++ .../docker/git-server/app/lighttpd-wrapper.bash | 10 ++++- .../docker/git-server/app/lighttpd/lighttpd.conf | 16 ++++++-- services/docker/nginx/Dockerfile | 1 + .../docker/nginx/configs/common/acme-challenge | 3 ++ services/docker/nginx/configs/common/http-listen | 2 + services/docker/nginx/configs/common/https-listen | 3 ++ .../docker/nginx/configs/common/https-redirect | 3 ++ services/docker/nginx/configs/common/proxy-common | 7 ++++ services/docker/nginx/configs/conf.d/default.conf | 9 +++++ .../docker/nginx/configs/conf.d/websocket.conf | 4 ++ .../nginx/configs/templates/code.conf.template | 6 +++ .../nginx/configs/templates/mail.conf.template | 29 ++++++++++++++ .../nginx/configs/templates/root.conf.template | 45 ++++++++++++++++++++++ .../nginx/configs/templates/ssl.conf.template | 17 ++++++++ .../nginx/configs/templates/timeline.conf.template | 6 +++ services/docker/nginx/nginx-wrapper.bash | 13 ++++++- services/docker/v2ray/Dockerfile | 6 ++- services/docker/v2ray/config.json.template | 29 ++++++++++++++ services/docker/v2ray/v2ray-wrapper.sh | 17 ++++++++ services/templates/cgit/cgitrc.template | 26 ------------- services/templates/cgit/private-list | 1 - services/templates/docker-compose.yaml.template | 16 ++++---- services/templates/envs/2fauth.env.template | 2 +- services/templates/envs/nginx.env.template | 2 + services/templates/envs/v2ray-common.env.template | 1 + services/templates/envs/v2ray.env.template | 1 + services/templates/nginx/common/acme-challenge | 3 -- services/templates/nginx/common/http-listen | 2 - services/templates/nginx/common/https-listen | 3 -- services/templates/nginx/common/https-redirect | 3 -- services/templates/nginx/common/proxy-common | 7 ---- services/templates/nginx/conf.d/code.conf.template | 6 --- .../nginx/conf.d/forbid_unknown_domain.conf | 9 ----- services/templates/nginx/conf.d/mail.conf.template | 29 -------------- services/templates/nginx/conf.d/root.conf.template | 45 ---------------------- services/templates/nginx/conf.d/ssl.conf.template | 17 -------- .../templates/nginx/conf.d/timeline.conf.template | 6 --- services/templates/nginx/conf.d/websocket.conf | 4 -- services/templates/v2ray-config.json.template | 29 -------------- 43 files changed, 260 insertions(+), 208 deletions(-) create mode 100644 services/docker/git-server/app/cgit/common create mode 100644 services/docker/git-server/app/cgit/private create mode 100644 services/docker/git-server/app/cgit/public create mode 100644 services/docker/nginx/configs/common/acme-challenge create mode 100644 services/docker/nginx/configs/common/http-listen create mode 100644 services/docker/nginx/configs/common/https-listen create mode 100644 services/docker/nginx/configs/common/https-redirect create mode 100644 services/docker/nginx/configs/common/proxy-common create mode 100644 services/docker/nginx/configs/conf.d/default.conf create mode 100644 services/docker/nginx/configs/conf.d/websocket.conf create mode 100644 services/docker/nginx/configs/templates/code.conf.template create mode 100644 services/docker/nginx/configs/templates/mail.conf.template create mode 100644 services/docker/nginx/configs/templates/root.conf.template create mode 100644 services/docker/nginx/configs/templates/ssl.conf.template create mode 100644 services/docker/nginx/configs/templates/timeline.conf.template create mode 100644 services/docker/v2ray/config.json.template create mode 100755 services/docker/v2ray/v2ray-wrapper.sh delete mode 100644 services/templates/cgit/cgitrc.template delete mode 100644 services/templates/cgit/private-list create mode 100644 services/templates/envs/nginx.env.template create mode 100644 services/templates/envs/v2ray-common.env.template create mode 100644 services/templates/envs/v2ray.env.template delete mode 100644 services/templates/nginx/common/acme-challenge delete mode 100644 services/templates/nginx/common/http-listen delete mode 100644 services/templates/nginx/common/https-listen delete mode 100644 services/templates/nginx/common/https-redirect delete mode 100644 services/templates/nginx/common/proxy-common delete mode 100644 services/templates/nginx/conf.d/code.conf.template delete mode 100644 services/templates/nginx/conf.d/forbid_unknown_domain.conf delete mode 100644 services/templates/nginx/conf.d/mail.conf.template delete mode 100644 services/templates/nginx/conf.d/root.conf.template delete mode 100644 services/templates/nginx/conf.d/ssl.conf.template delete mode 100644 services/templates/nginx/conf.d/timeline.conf.template delete mode 100644 services/templates/nginx/conf.d/websocket.conf delete mode 100644 services/templates/v2ray-config.json.template diff --git a/services/config.template b/services/config.template index 7cf7162..7b3d1dc 100644 --- a/services/config.template +++ b/services/config.template @@ -1,5 +1,5 @@ CRUPEST_MAIL_SERVER_DOMAIN=mail.@@CRUPEST_DOMAIN@@ -CRUPEST_ROOT_URL=https://@@CRUPEST_DOMAIN@@/ +CRUPEST_ROOT_URL=https://@@CRUPEST_DOMAIN@@ CRUPEST_DOCKER_DIR=@@CRUPEST_SERVICES_DIR@@/docker CRUPEST_SERVICES_STATE_DIR=@@CRUPEST_SERVICES_DIR@@/state CRUPEST_DATA_SECRET_DIR=@@CRUPEST_DATA_DIR@@/secret diff --git a/services/docker/git-server/app/cgit/common b/services/docker/git-server/app/cgit/common new file mode 100644 index 0000000..90dda60 --- /dev/null +++ b/services/docker/git-server/app/cgit/common @@ -0,0 +1,19 @@ +css=/git/static/cgit.css +logo=/git/static/cgit.png +root-title=crupest Git Repos +source-filter=/usr/lib/cgit/filters/syntax-highlighting.py +about-filter=/usr/lib/cgit/filters/about-formatting.sh + +enable-http-clone=0 +enable-commit-graph=1 +enable-index-links=1 +enable-index-owner=0 +enable-log-filecount=1 +enable-log-linecount=1 +enable-git-config=1 +snapshots=tar.gz tar.bz2 zip + +readme=:README-repo.md +readme=:README.md +readme=:README +section-from-path=1 diff --git a/services/docker/git-server/app/cgit/private b/services/docker/git-server/app/cgit/private new file mode 100644 index 0000000..a5710b2 --- /dev/null +++ b/services/docker/git-server/app/cgit/private @@ -0,0 +1,5 @@ +cache-root=/var/cache/cgit/private +include=/app/cgit/common +strict-export=cgit-export +clone-url=$CRUPEST_ROOT_URL/git/private$CGIT_REPO_URL +scan-path=/git/repos/private diff --git a/services/docker/git-server/app/cgit/public b/services/docker/git-server/app/cgit/public new file mode 100644 index 0000000..022a333 --- /dev/null +++ b/services/docker/git-server/app/cgit/public @@ -0,0 +1,4 @@ +cache-root=/var/cache/cgit/public +include=/app/cgit/common +clone-url=$CRUPEST_ROOT_URL/git$CGIT_REPO_URL +scan-path=/git/repos/public diff --git a/services/docker/git-server/app/lighttpd-wrapper.bash b/services/docker/git-server/app/lighttpd-wrapper.bash index 54079ad..70055e7 100755 --- a/services/docker/git-server/app/lighttpd-wrapper.bash +++ b/services/docker/git-server/app/lighttpd-wrapper.bash @@ -1,8 +1,14 @@ #!/usr/bin/bash -set -e +set -e -o pipefail -[[ -f /git/user-info ]] || touch -a /git/user-info +die() { + echo "$@" >&2 + exit 1 +} + +[[ -n "$CRUPEST_ROOT_URL" ]] || die "CRUPEST_ROOT_URL is not set. It is needed to create clone url of repos." +[[ -f /git/user-info ]] || touch -a /git/user-info || die "Failed to create /git/user-info to save user accounts. Permission problem?" exec 3>&1 exec 4>&1 diff --git a/services/docker/git-server/app/lighttpd/lighttpd.conf b/services/docker/git-server/app/lighttpd/lighttpd.conf index a96a778..d6c30cd 100644 --- a/services/docker/git-server/app/lighttpd/lighttpd.conf +++ b/services/docker/git-server/app/lighttpd/lighttpd.conf @@ -47,11 +47,21 @@ $HTTP["url"] =^ "/git" { } else { alias.url += ( + "/git/private" => "/usr/lib/cgit/cgit.cgi", "/git" => "/usr/lib/cgit/cgit.cgi", ) - setenv.add-environment = ( - "CGIT_CONFIG" => "/app/cgit/cgitrc" - ) + + $HTTP["url"] =^ "/git/private" { + setenv.add-environment = ( + "CGIT_CONFIG" => "/app/cgit/private" + ) + } + else { + setenv.add-environment = ( + "CGIT_CONFIG" => "/app/cgit/public" + ) + } + cgi.assign = ("" => "") } } diff --git a/services/docker/nginx/Dockerfile b/services/docker/nginx/Dockerfile index 3169e00..77398cd 100644 --- a/services/docker/nginx/Dockerfile +++ b/services/docker/nginx/Dockerfile @@ -6,5 +6,6 @@ FROM nginx:mainline RUN apt update && apt-get install -y tini certbot && rm -rf /var/lib/apt/lists/* ADD mail-robots.txt /srv/mail/robots.txt ADD certbot.bash nginx-wrapper.bash /app/ +COPY configs/. /etc/nginx/ COPY --from=build-www /project/public /srv/www CMD ["/usr/bin/tini", "--", "/app/nginx-wrapper.bash"] diff --git a/services/docker/nginx/configs/common/acme-challenge b/services/docker/nginx/configs/common/acme-challenge new file mode 100644 index 0000000..26054b8 --- /dev/null +++ b/services/docker/nginx/configs/common/acme-challenge @@ -0,0 +1,3 @@ +location /.well-known/acme-challenge { + root /srv/acme; +} diff --git a/services/docker/nginx/configs/common/http-listen b/services/docker/nginx/configs/common/http-listen new file mode 100644 index 0000000..76cb18d --- /dev/null +++ b/services/docker/nginx/configs/common/http-listen @@ -0,0 +1,2 @@ +listen 80; +listen [::]:80; diff --git a/services/docker/nginx/configs/common/https-listen b/services/docker/nginx/configs/common/https-listen new file mode 100644 index 0000000..db2f68e --- /dev/null +++ b/services/docker/nginx/configs/common/https-listen @@ -0,0 +1,3 @@ +listen 443 ssl; +listen [::]:443 ssl; +http2 on; diff --git a/services/docker/nginx/configs/common/https-redirect b/services/docker/nginx/configs/common/https-redirect new file mode 100644 index 0000000..56d095d --- /dev/null +++ b/services/docker/nginx/configs/common/https-redirect @@ -0,0 +1,3 @@ +location / { + return 301 https://$host$request_uri; +} diff --git a/services/docker/nginx/configs/common/proxy-common b/services/docker/nginx/configs/common/proxy-common new file mode 100644 index 0000000..4193548 --- /dev/null +++ b/services/docker/nginx/configs/common/proxy-common @@ -0,0 +1,7 @@ +proxy_http_version 1.1; +proxy_set_header Upgrade $http_upgrade; +proxy_set_header Connection $connection_upgrade; +proxy_set_header Host $host; +proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; +proxy_set_header X-Forwarded-Proto $scheme; +proxy_set_header X-Real-IP $remote_addr; diff --git a/services/docker/nginx/configs/conf.d/default.conf b/services/docker/nginx/configs/conf.d/default.conf new file mode 100644 index 0000000..515942b --- /dev/null +++ b/services/docker/nginx/configs/conf.d/default.conf @@ -0,0 +1,9 @@ +server { + listen 80 default_server; + listen [::]:80 default_server; + listen 443 ssl default_server; + listen [::]:443 ssl default_server; + http2 on; + + return 444; +} diff --git a/services/docker/nginx/configs/conf.d/websocket.conf b/services/docker/nginx/configs/conf.d/websocket.conf new file mode 100644 index 0000000..32af4c3 --- /dev/null +++ b/services/docker/nginx/configs/conf.d/websocket.conf @@ -0,0 +1,4 @@ +map $http_upgrade $connection_upgrade { + default upgrade; + '' close; +} diff --git a/services/docker/nginx/configs/templates/code.conf.template b/services/docker/nginx/configs/templates/code.conf.template new file mode 100644 index 0000000..aa70ebc --- /dev/null +++ b/services/docker/nginx/configs/templates/code.conf.template @@ -0,0 +1,6 @@ +server { + server_name code.${CRUPEST_DOMAIN}; + include common/http-listen; + + include common/acme-challenge; +} diff --git a/services/docker/nginx/configs/templates/mail.conf.template b/services/docker/nginx/configs/templates/mail.conf.template new file mode 100644 index 0000000..7f5f215 --- /dev/null +++ b/services/docker/nginx/configs/templates/mail.conf.template @@ -0,0 +1,29 @@ +server { + server_name mail.${CRUPEST_DOMAIN}; + include common/https-listen; + + location = /robots.txt { + root /srv/mail; + } + + location / { + include common/proxy-common; + proxy_pass http://roundcubemail:80/; + } + + location /rspamd/ { + include common/proxy-common; + proxy_pass http://mailserver:11334/; + } + + client_max_body_size 5G; +} + + +server { + server_name mail.${CRUPEST_DOMAIN}; + include common/http-listen; + + include common/https-redirect; + include common/acme-challenge; +} diff --git a/services/docker/nginx/configs/templates/root.conf.template b/services/docker/nginx/configs/templates/root.conf.template new file mode 100644 index 0000000..e3e93ad --- /dev/null +++ b/services/docker/nginx/configs/templates/root.conf.template @@ -0,0 +1,45 @@ +server { + server_name ${CRUPEST_DOMAIN}; + include common/https-listen; + + location / { + root /srv/www; + } + + location /2fa/ { + include common/proxy-common; + proxy_pass http://2fauth:8000/; + } + + location /git/ { + include common/proxy-common; + client_max_body_size 5G; + proxy_pass http://git-server:3636; + } + + location = /github { + return 301 ${CRUPEST_GITHUB}; + } + + location = /github/ { + return 301 ${CRUPEST_GITHUB}; + } + + location /_${CRUPEST_V2RAY_PATH} { + if ($http_upgrade != "websocket") { + return 404; + } + + proxy_redirect off; + include common/proxy-common; + proxy_pass http://v2ray:10000; + } +} + +server { + server_name ${CRUPEST_DOMAIN}; + include common/http-listen; + + include common/https-redirect; + include common/acme-challenge; +} diff --git a/services/docker/nginx/configs/templates/ssl.conf.template b/services/docker/nginx/configs/templates/ssl.conf.template new file mode 100644 index 0000000..54205f1 --- /dev/null +++ b/services/docker/nginx/configs/templates/ssl.conf.template @@ -0,0 +1,17 @@ +# This file contains important security parameters. If you modify this file +# manually, Certbot will be unable to automatically provide future security +# updates. Instead, Certbot will print and log an error message with a path to +# the up-to-date file that you will need to refer to when manually updating +# this file. Contents are based on https://ssl-config.mozilla.org + +ssl_certificate /etc/letsencrypt/live/${CRUPEST_DOMAIN}/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/${CRUPEST_DOMAIN}/privkey.pem; + +ssl_session_cache shared:le_nginx_SSL:10m; +ssl_session_timeout 1440m; +ssl_session_tickets off; + +ssl_protocols TLSv1.2 TLSv1.3; +ssl_prefer_server_ciphers off; + +ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"; diff --git a/services/docker/nginx/configs/templates/timeline.conf.template b/services/docker/nginx/configs/templates/timeline.conf.template new file mode 100644 index 0000000..a467594 --- /dev/null +++ b/services/docker/nginx/configs/templates/timeline.conf.template @@ -0,0 +1,6 @@ +server { + server_name timeline.${CRUPEST_DOMAIN}; + include common/http-listen; + + include common/acme-challenge; +} diff --git a/services/docker/nginx/nginx-wrapper.bash b/services/docker/nginx/nginx-wrapper.bash index bd566aa..c848287 100755 --- a/services/docker/nginx/nginx-wrapper.bash +++ b/services/docker/nginx/nginx-wrapper.bash @@ -1,7 +1,16 @@ #!/usr/bin/bash -set -e +set -e -o pipefail + +die() { + echo "$@" >&2 + exit 1 +} + +[[ -n "$CRUPEST_DOMAIN" ]] || die "CRUPEST_DOMAIN is not set. It is used as root domain." +[[ -n "$CRUPEST_GITHUB" ]] || die "CRUPEST_GITHUB is not set. It is used as GitHub redirection." +[[ -n "$CRUPEST_V2RAY_PATH" ]] || die "CRUPEST_V2RAY_PATH is not set. It is used as v2ray tunnel endpoint." /app/certbot.bash & -nginx "-g" "daemon off;" +/docker-entrypoint.sh nginx "-g" "daemon off;" diff --git a/services/docker/v2ray/Dockerfile b/services/docker/v2ray/Dockerfile index 250a6b8..9d11474 100644 --- a/services/docker/v2ray/Dockerfile +++ b/services/docker/v2ray/Dockerfile @@ -1,5 +1,7 @@ FROM alpine:edge -RUN apk add --no-cache v2ray +RUN apk add --no-cache tini v2ray -ENTRYPOINT [ "/usr/bin/v2ray" ] +ADD config.json.template v2ray-wrapper.sh /app/ + +CMD [ "tini", "--", "/app/v2ray-wrapper.sh" ] diff --git a/services/docker/v2ray/config.json.template b/services/docker/v2ray/config.json.template new file mode 100644 index 0000000..c10eac2 --- /dev/null +++ b/services/docker/v2ray/config.json.template @@ -0,0 +1,29 @@ +{ + "inbounds": [ + { + "port": 10000, + "listen": "0.0.0.0", + "protocol": "vmess", + "settings": { + "clients": [ + { + "id": "@@CRUPEST_V2RAY_TOKEN@@", + "alterId": 0 + } + ] + }, + "streamSettings": { + "network": "ws", + "wsSettings": { + "path": "/_@@CRUPEST_V2RAY_PATH@@" + } + } + } + ], + "outbounds": [ + { + "protocol": "freedom", + "settings": {} + } + ] +} \ No newline at end of file diff --git a/services/docker/v2ray/v2ray-wrapper.sh b/services/docker/v2ray/v2ray-wrapper.sh new file mode 100755 index 0000000..3887a0e --- /dev/null +++ b/services/docker/v2ray/v2ray-wrapper.sh @@ -0,0 +1,17 @@ +#!/bin/sh + +set -e + +die() { + echo "$@" >&2 + exit 1 +} + +[ -n "$CRUPEST_V2RAY_TOKEN" ] || die "CRUPEST_V2RAY_TOKEN is not set. It is used as password of v2ray tunnel." +[ -n "$CRUPEST_V2RAY_PATH" ] || die "CRUPEST_V2RAY_PATH is not set. It is used as the http endpoint." + +sed -e "s|@@CRUPEST_V2RAY_TOKEN@@|$CRUPEST_V2RAY_TOKEN|" \ + -e "s|@@CRUPEST_V2RAY_PATH@@|$CRUPEST_V2RAY_PATH|" \ + "/app/config.json.template" > /app/config.json + +exec /usr/bin/v2ray run -c /app/config.json diff --git a/services/templates/cgit/cgitrc.template b/services/templates/cgit/cgitrc.template deleted file mode 100644 index ed581bd..0000000 --- a/services/templates/cgit/cgitrc.template +++ /dev/null @@ -1,26 +0,0 @@ -css=/git/static/cgit.css -logo=/git/static/cgit.png -root-title=crupest Git Repos -source-filter=/usr/lib/cgit/filters/syntax-highlighting.py -about-filter=/usr/lib/cgit/filters/about-formatting.sh - -enable-http-clone=0 -enable-commit-graph=1 -enable-index-links=1 -enable-index-owner=0 -enable-log-filecount=1 -enable-log-linecount=1 -enable-git-config=1 -snapshots=tar.gz tar.bz2 zip - -readme=:README.md -readme=:README - -clone-prefix=@@CRUPEST_ROOT_URL@@git -section-from-path=1 -scan-path=/git/repos/public - -strict-export=cgit-export -section-from-path=-1 -project-list=/app/cgit/private-list -scan-path=/git/repos diff --git a/services/templates/cgit/private-list b/services/templates/cgit/private-list deleted file mode 100644 index c8c6761..0000000 --- a/services/templates/cgit/private-list +++ /dev/null @@ -1 +0,0 @@ -private \ No newline at end of file diff --git a/services/templates/docker-compose.yaml.template b/services/templates/docker-compose.yaml.template index 842037b..e133462 100644 --- a/services/templates/docker-compose.yaml.template +++ b/services/templates/docker-compose.yaml.template @@ -12,12 +12,13 @@ services: - "80:80" - "443:443" - "443:443/udp" + env_file: + - ./@@CRUPEST_GENERATED_DIR@@/envs/nginx.env + - ./@@CRUPEST_GENERATED_DIR@@/envs/v2ray-common.env volumes: - - "./@@CRUPEST_GENERATED_NGINX_DIR@@/conf.d:/etc/nginx/conf.d:ro" - - "./@@CRUPEST_GENERATED_NGINX_DIR@@/common:/etc/nginx/common:ro" - "./@@CRUPEST_DATA_CERTBOT_DIR@@/certs:/etc/letsencrypt" - - "./@@CRUPEST_DATA_CERTBOT_DIR@@/webroot:/srv/acme:ro" - "./@@CRUPEST_DATA_CERTBOT_DIR@@/data:/var/lib/letsencrypt" + - "./@@CRUPEST_DATA_CERTBOT_DIR@@/webroot:/srv/acme:ro" - "./@@CRUPEST_DATA_CERTBOT_DIR@@/webroot:/var/www/certbot" restart: on-failure:3 @@ -28,9 +29,9 @@ services: dockerfile: Dockerfile pull: true hostname: v2ray - command: [ "run", "-c", "/etc/v2fly/config.json" ] - volumes: - - "./@@CRUPEST_GENERATED_DIR@@/v2ray-config.json:/etc/v2fly/config.json:ro" + env_file: + - ./@@CRUPEST_GENERATED_DIR@@/envs/v2ray-common.env + - ./@@CRUPEST_GENERATED_DIR@@/envs/v2ray.env restart: on-failure:3 auto-backup: @@ -82,9 +83,10 @@ services: dockerfile: Dockerfile pull: true hostname: git-server + environment: + - CRUPEST_ROOT_URL=@@CRUPEST_ROOT_URL@@ volumes: - "./@@CRUPEST_DATA_GIT_DIR@@:/git" - - "./@@CRUPEST_GENERATED_DIR@@/cgit:/app/cgit" restart: on-failure:3 roundcubemail: diff --git a/services/templates/envs/2fauth.env.template b/services/templates/envs/2fauth.env.template index cd084b5..de2ad3a 100644 --- a/services/templates/envs/2fauth.env.template +++ b/services/templates/envs/2fauth.env.template @@ -2,7 +2,7 @@ APP_NAME=2FAuth-crupest APP_TIMEZONE=UTC SITE_OWNER=@@CRUPEST_EMAIL@@ APP_KEY=@@CRUPEST_2FAUTH_APP_KEY@@ -APP_URL=@@CRUPEST_ROOT_URL@@2fa +APP_URL=@@CRUPEST_ROOT_URL@@/2fa APP_SUBDIRECTORY=2fa MAIL_MAILER=smtp MAIL_HOST=@@CRUPEST_MAIL_SERVER_DOMAIN@@ diff --git a/services/templates/envs/nginx.env.template b/services/templates/envs/nginx.env.template new file mode 100644 index 0000000..55143ab --- /dev/null +++ b/services/templates/envs/nginx.env.template @@ -0,0 +1,2 @@ +CRUPEST_DOMAIN=@@CRUPEST_DOMAIN@@ +CRUPEST_GITHUB=@@CRUPEST_GITHUB@@ diff --git a/services/templates/envs/v2ray-common.env.template b/services/templates/envs/v2ray-common.env.template new file mode 100644 index 0000000..5e7dc77 --- /dev/null +++ b/services/templates/envs/v2ray-common.env.template @@ -0,0 +1 @@ +CRUPEST_V2RAY_PATH=@@CRUPEST_V2RAY_PATH@@ diff --git a/services/templates/envs/v2ray.env.template b/services/templates/envs/v2ray.env.template new file mode 100644 index 0000000..b5791c8 --- /dev/null +++ b/services/templates/envs/v2ray.env.template @@ -0,0 +1 @@ +CRUPEST_V2RAY_TOKEN=@@CRUPEST_V2RAY_TOKEN@@ diff --git a/services/templates/nginx/common/acme-challenge b/services/templates/nginx/common/acme-challenge deleted file mode 100644 index 26054b8..0000000 --- a/services/templates/nginx/common/acme-challenge +++ /dev/null @@ -1,3 +0,0 @@ -location /.well-known/acme-challenge { - root /srv/acme; -} diff --git a/services/templates/nginx/common/http-listen b/services/templates/nginx/common/http-listen deleted file mode 100644 index 76cb18d..0000000 --- a/services/templates/nginx/common/http-listen +++ /dev/null @@ -1,2 +0,0 @@ -listen 80; -listen [::]:80; diff --git a/services/templates/nginx/common/https-listen b/services/templates/nginx/common/https-listen deleted file mode 100644 index db2f68e..0000000 --- a/services/templates/nginx/common/https-listen +++ /dev/null @@ -1,3 +0,0 @@ -listen 443 ssl; -listen [::]:443 ssl; -http2 on; diff --git a/services/templates/nginx/common/https-redirect b/services/templates/nginx/common/https-redirect deleted file mode 100644 index 56d095d..0000000 --- a/services/templates/nginx/common/https-redirect +++ /dev/null @@ -1,3 +0,0 @@ -location / { - return 301 https://$host$request_uri; -} diff --git a/services/templates/nginx/common/proxy-common b/services/templates/nginx/common/proxy-common deleted file mode 100644 index 4193548..0000000 --- a/services/templates/nginx/common/proxy-common +++ /dev/null @@ -1,7 +0,0 @@ -proxy_http_version 1.1; -proxy_set_header Upgrade $http_upgrade; -proxy_set_header Connection $connection_upgrade; -proxy_set_header Host $host; -proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; -proxy_set_header X-Forwarded-Proto $scheme; -proxy_set_header X-Real-IP $remote_addr; diff --git a/services/templates/nginx/conf.d/code.conf.template b/services/templates/nginx/conf.d/code.conf.template deleted file mode 100644 index 35f74d8..0000000 --- a/services/templates/nginx/conf.d/code.conf.template +++ /dev/null @@ -1,6 +0,0 @@ -server { - server_name code.@@CRUPEST_DOMAIN@@; - include common/http-listen; - - include common/acme-challenge; -} diff --git a/services/templates/nginx/conf.d/forbid_unknown_domain.conf b/services/templates/nginx/conf.d/forbid_unknown_domain.conf deleted file mode 100644 index 515942b..0000000 --- a/services/templates/nginx/conf.d/forbid_unknown_domain.conf +++ /dev/null @@ -1,9 +0,0 @@ -server { - listen 80 default_server; - listen [::]:80 default_server; - listen 443 ssl default_server; - listen [::]:443 ssl default_server; - http2 on; - - return 444; -} diff --git a/services/templates/nginx/conf.d/mail.conf.template b/services/templates/nginx/conf.d/mail.conf.template deleted file mode 100644 index c115c2e..0000000 --- a/services/templates/nginx/conf.d/mail.conf.template +++ /dev/null @@ -1,29 +0,0 @@ -server { - server_name mail.@@CRUPEST_DOMAIN@@; - include common/https-listen; - - location = /robots.txt { - root /srv/mail; - } - - location / { - include common/proxy-common; - proxy_pass http://roundcubemail:80/; - } - - location /rspamd/ { - include common/proxy-common; - proxy_pass http://mailserver:11334/; - } - - client_max_body_size 5G; -} - - -server { - server_name mail.@@CRUPEST_DOMAIN@@; - include common/http-listen; - - include common/https-redirect; - include common/acme-challenge; -} diff --git a/services/templates/nginx/conf.d/root.conf.template b/services/templates/nginx/conf.d/root.conf.template deleted file mode 100644 index 28c2fea..0000000 --- a/services/templates/nginx/conf.d/root.conf.template +++ /dev/null @@ -1,45 +0,0 @@ -server { - server_name @@CRUPEST_DOMAIN@@; - include common/https-listen; - - location / { - root /srv/www; - } - - location /2fa/ { - include common/proxy-common; - proxy_pass http://2fauth:8000/; - } - - location /git/ { - include common/proxy-common; - client_max_body_size 5G; - proxy_pass http://git-server:3636; - } - - location = /github { - return 301 @@CRUPEST_GITHUB@@; - } - - location = /github/ { - return 301 @@CRUPEST_GITHUB@@; - } - - location /_@@CRUPEST_V2RAY_PATH@@ { - if ($http_upgrade != "websocket") { - return 404; - } - - proxy_redirect off; - include common/proxy-common; - proxy_pass http://v2ray:10000; - } -} - -server { - server_name @@CRUPEST_DOMAIN@@; - include common/http-listen; - - include common/https-redirect; - include common/acme-challenge; -} diff --git a/services/templates/nginx/conf.d/ssl.conf.template b/services/templates/nginx/conf.d/ssl.conf.template deleted file mode 100644 index 181a1af..0000000 --- a/services/templates/nginx/conf.d/ssl.conf.template +++ /dev/null @@ -1,17 +0,0 @@ -# This file contains important security parameters. If you modify this file -# manually, Certbot will be unable to automatically provide future security -# updates. Instead, Certbot will print and log an error message with a path to -# the up-to-date file that you will need to refer to when manually updating -# this file. Contents are based on https://ssl-config.mozilla.org - -ssl_certificate /etc/letsencrypt/live/@@CRUPEST_DOMAIN@@/fullchain.pem; -ssl_certificate_key /etc/letsencrypt/live/@@CRUPEST_DOMAIN@@/privkey.pem; - -ssl_session_cache shared:le_nginx_SSL:10m; -ssl_session_timeout 1440m; -ssl_session_tickets off; - -ssl_protocols TLSv1.2 TLSv1.3; -ssl_prefer_server_ciphers off; - -ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"; diff --git a/services/templates/nginx/conf.d/timeline.conf.template b/services/templates/nginx/conf.d/timeline.conf.template deleted file mode 100644 index df4edf8..0000000 --- a/services/templates/nginx/conf.d/timeline.conf.template +++ /dev/null @@ -1,6 +0,0 @@ -server { - server_name timeline.@@CRUPEST_DOMAIN@@; - include common/http-listen; - - include common/acme-challenge; -} diff --git a/services/templates/nginx/conf.d/websocket.conf b/services/templates/nginx/conf.d/websocket.conf deleted file mode 100644 index 32af4c3..0000000 --- a/services/templates/nginx/conf.d/websocket.conf +++ /dev/null @@ -1,4 +0,0 @@ -map $http_upgrade $connection_upgrade { - default upgrade; - '' close; -} diff --git a/services/templates/v2ray-config.json.template b/services/templates/v2ray-config.json.template deleted file mode 100644 index c10eac2..0000000 --- a/services/templates/v2ray-config.json.template +++ /dev/null @@ -1,29 +0,0 @@ -{ - "inbounds": [ - { - "port": 10000, - "listen": "0.0.0.0", - "protocol": "vmess", - "settings": { - "clients": [ - { - "id": "@@CRUPEST_V2RAY_TOKEN@@", - "alterId": 0 - } - ] - }, - "streamSettings": { - "network": "ws", - "wsSettings": { - "path": "/_@@CRUPEST_V2RAY_PATH@@" - } - } - } - ], - "outbounds": [ - { - "protocol": "freedom", - "settings": {} - } - ] -} \ No newline at end of file -- cgit v1.2.3