fossilfranv/nginx_docker-swag
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/master' into standard-base

Browse Source
This commit is contained in:
Eric Nemchik 2021-10-27 10:14:52 -05:00
commit c11f75f4a0
5 changed files with 56 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
README.md
View File

@ -69,7 +69,7 @@ The architectures supported by this image are:
* For `duckdns` validation, either leave the `SUBDOMAINS` variable empty or set it to `wildcard`, and set the `DUCKDNSTOKEN` variable with your duckdns token. Due to a limitation of duckdns, the resulting cert will only cover either main subdomain (ie. `yoursubdomain.duckdns.org`), or sub-subdomains (ie. `*.yoursubdomain.duckdns.org`), but will not both at the same time. You can use our [duckdns image](https://hub.docker.com/r/linuxserver/duckdns/) to update your IP on duckdns.org. * For `duckdns` validation, either leave the `SUBDOMAINS` variable empty or set it to `wildcard`, and set the `DUCKDNSTOKEN` variable with your duckdns token. Due to a limitation of duckdns, the resulting cert will only cover either main subdomain (ie. `yoursubdomain.duckdns.org`), or sub-subdomains (ie. `*.yoursubdomain.duckdns.org`), but will not both at the same time. You can use our [duckdns image](https://hub.docker.com/r/linuxserver/duckdns/) to update your IP on duckdns.org.
* `--cap-add=NET_ADMIN` is required for fail2ban to modify iptables * `--cap-add=NET_ADMIN` is required for fail2ban to modify iptables
* If you need a dynamic dns provider, you can use the free provider duckdns.org where the `URL` will be `yoursubdomain.duckdns.org` and the `SUBDOMAINS` can be `www,ftp,cloud` with http validation, or `wildcard` with dns validation. * If you need a dynamic dns provider, you can use the free provider duckdns.org where the `URL` will be `yoursubdomain.duckdns.org` and the `SUBDOMAINS` can be `www,ftp,cloud` with http validation, or `wildcard` with dns validation.
* After setup, navigate to `https://yourdomain.url` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default`). * After setup, navigate to `https://yourdomain.url` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default.conf`).
* Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from Let's Encrypt in those circumstances. * Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from Let's Encrypt in those circumstances.
### Security and password protection ### Security and password protection
@ -82,7 +82,7 @@ The architectures supported by this image are:
### Site config and reverse proxy ### Site config and reverse proxy
* The default site config resides at `/config/nginx/site-confs/default`. Feel free to modify this file, and you can add other conf files to this directory. However, if you delete the `default` file, a new default will be created on container start. * The default site config resides at `/config/nginx/site-confs/default.conf`. Feel free to modify this file, and you can add other conf files to this directory. However, if you delete the `default` file, a new default will be created on container start.
* Preset reverse proxy config files are added for popular apps. See the `README.md` file under `/config/nginx/proxy_confs` for instructions on how to enable them. The preset confs reside in and get imported from [this repo](https://github.com/linuxserver/reverse-proxy-confs). * Preset reverse proxy config files are added for popular apps. See the `README.md` file under `/config/nginx/proxy_confs` for instructions on how to enable them. The preset confs reside in and get imported from [this repo](https://github.com/linuxserver/reverse-proxy-confs).
* If you wish to hide your site from search engine crawlers, you may find it useful to add this configuration line to your site config, within the server block, above the line where ssl.conf is included * If you wish to hide your site from search engine crawlers, you may find it useful to add this configuration line to your site config, within the server block, above the line where ssl.conf is included
`add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";` `add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";`
@ -332,6 +332,9 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
## Versions ## Versions
* **27.10.21:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Use standard nginx.conf from lsio alpine nginx base image.
* **26.10.21:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) proxy.conf - Mitigate https://httpoxy.org/ vulnerabilities. Ref: https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx#Defeating-the-Attack-using-NGINX-and-NGINX-Plus
* **23.10.21:** - Fix Hurricane Electric (HE) DNS validation.
* **12.10.21:** - Fix deprecated LE root cert check to fix failures when using `STAGING=true`, and failures in revoking. * **12.10.21:** - Fix deprecated LE root cert check to fix failures when using `STAGING=true`, and failures in revoking.
* **06.10.21:** - Added support for Hurricane Electric (HE) DNS validation. Added lxml build deps. * **06.10.21:** - Added support for Hurricane Electric (HE) DNS validation. Added lxml build deps.
* **01.10.21:** - Check if the cert uses the old LE root cert, revoke and regenerate if necessary. [Here's more info](https://twitter.com/letsencrypt/status/1443621997288767491) on LE root cert expiration * **01.10.21:** - Check if the cert uses the old LE root cert, revoke and regenerate if necessary. [Here's more info](https://twitter.com/letsencrypt/status/1443621997288767491) on LE root cert expiration
@ -354,7 +357,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
* **26.01.21:** - Add support for hetzner dns validation. * **26.01.21:** - Add support for hetzner dns validation.
* **20.01.21:** - Add check for ZeroSSL EAB retrieval. * **20.01.21:** - Add check for ZeroSSL EAB retrieval.
* **08.01.21:** - Add support for getting certs from [ZeroSSL](https://zerossl.com/) via optional `CERTPROVIDER` env var. Update aliyun, domeneshop, inwx and transip dns plugins with the new plugin names. Hide `donoteditthisfile.conf` because users were editing it despite its name. Suppress harmless error when no proxy confs are enabled. * **08.01.21:** - Add support for getting certs from [ZeroSSL](https://zerossl.com/) via optional `CERTPROVIDER` env var. Update aliyun, domeneshop, inwx and transip dns plugins with the new plugin names. Hide `donoteditthisfile.conf` because users were editing it despite its name. Suppress harmless error when no proxy confs are enabled.
* **03.01.21:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) /config/nginx/site-confs/default - Add helper pages to aid troubleshooting * **03.01.21:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) /config/nginx/site-confs/default.conf - Add helper pages to aid troubleshooting
* **10.12.20:** - Add support for njalla dns validation * **10.12.20:** - Add support for njalla dns validation
* **09.12.20:** - Check for template/conf updates and notify in the log. Add support for gehirn and sakuracloud dns validation. * **09.12.20:** - Check for template/conf updates and notify in the log. Add support for gehirn and sakuracloud dns validation.
* **01.11.20:** - Add support for netcup dns validation * **01.11.20:** - Add support for netcup dns validation

88
package_versions.txt
View File

@ -1,6 +1,6 @@
alpine-baselayout-3.2.0-r16 alpine-baselayout-3.2.0-r16
alpine-keys-2.3-r1 alpine-keys-2.4-r0
apache2-utils-2.4.50-r0 apache2-utils-2.4.51-r0
apk-tools-2.12.7-r0 apk-tools-2.12.7-r0
apr-1.7.0-r0 apr-1.7.0-r0
apr-util-1.6.1-r7 apr-util-1.6.1-r7
@ -125,57 +125,57 @@ pcre2-10.36-r0
perl-5.32.1-r0 perl-5.32.1-r0
perl-error-0.17029-r1 perl-error-0.17029-r1
perl-git-2.32.0-r0 perl-git-2.32.0-r0
php7-7.4.24-r0 php7-7.4.25-r0
php7-bcmath-7.4.24-r0 php7-bcmath-7.4.25-r0
php7-bz2-7.4.24-r0 php7-bz2-7.4.25-r0
php7-common-7.4.24-r0 php7-common-7.4.25-r0
php7-ctype-7.4.24-r0 php7-ctype-7.4.25-r0
php7-curl-7.4.24-r0 php7-curl-7.4.25-r0
php7-dom-7.4.24-r0 php7-dom-7.4.25-r0
php7-exif-7.4.24-r0 php7-exif-7.4.25-r0
php7-fileinfo-7.4.24-r0 php7-fileinfo-7.4.24-r0
php7-fpm-7.4.24-r0 php7-fpm-7.4.24-r0
php7-ftp-7.4.24-r0 php7-ftp-7.4.25-r0
php7-gd-7.4.24-r0 php7-gd-7.4.25-r0
php7-gmp-7.4.24-r0 php7-gmp-7.4.25-r0
php7-iconv-7.4.24-r0 php7-iconv-7.4.25-r0
php7-imap-7.4.24-r0 php7-imap-7.4.25-r0
php7-intl-7.4.24-r0 php7-intl-7.4.25-r0
php7-json-7.4.24-r0 php7-json-7.4.25-r0
php7-ldap-7.4.24-r0 php7-ldap-7.4.25-r0
php7-mbstring-7.4.24-r0 php7-mbstring-7.4.25-r0
php7-mysqli-7.4.24-r0 php7-mysqli-7.4.25-r0
php7-mysqlnd-7.4.24-r0 php7-mysqlnd-7.4.25-r0
php7-opcache-7.4.24-r0 php7-opcache-7.4.25-r0
php7-openssl-7.4.24-r0 php7-openssl-7.4.25-r0
php7-pdo-7.4.24-r0 php7-pdo-7.4.25-r0
php7-pdo_mysql-7.4.24-r0 php7-pdo_mysql-7.4.25-r0
php7-pdo_odbc-7.4.24-r0 php7-pdo_odbc-7.4.25-r0
php7-pdo_pgsql-7.4.24-r0 php7-pdo_pgsql-7.4.25-r0
php7-pdo_sqlite-7.4.24-r0 php7-pdo_sqlite-7.4.25-r0
php7-pear-7.4.24-r0 php7-pear-7.4.25-r0
php7-pecl-apcu-5.1.21-r0 php7-pecl-apcu-5.1.21-r0
php7-pecl-igbinary-3.2.6-r0 php7-pecl-igbinary-3.2.6-r0
php7-pecl-mailparse-3.1.1-r1 php7-pecl-mailparse-3.1.1-r1
php7-pecl-mcrypt-1.0.4-r0 php7-pecl-mcrypt-1.0.4-r0
php7-pecl-memcached-3.1.5-r2 php7-pecl-memcached-3.1.5-r2
php7-pecl-redis-5.3.4-r0 php7-pecl-redis-5.3.4-r0
php7-pgsql-7.4.24-r0 php7-pgsql-7.4.25-r0
php7-phar-7.4.24-r0 php7-phar-7.4.25-r0
php7-posix-7.4.24-r0 php7-posix-7.4.25-r0
php7-session-7.4.24-r0 php7-session-7.4.25-r0
php7-simplexml-7.4.24-r0 php7-simplexml-7.4.24-r0
php7-soap-7.4.24-r0 php7-soap-7.4.25-r0
php7-sockets-7.4.24-r0 php7-sockets-7.4.25-r0
php7-sodium-7.4.24-r0 php7-sodium-7.4.25-r0
php7-sqlite3-7.4.24-r0 php7-sqlite3-7.4.25-r0
php7-tokenizer-7.4.24-r0 php7-tokenizer-7.4.25-r0
php7-xml-7.4.24-r0 php7-xml-7.4.25-r0
php7-xmlreader-7.4.24-r0 php7-xmlreader-7.4.25-r0
php7-xmlrpc-7.4.24-r0 php7-xmlrpc-7.4.25-r0
php7-xmlwriter-7.4.24-r0 php7-xmlwriter-7.4.24-r0
php7-xsl-7.4.24-r0 php7-xsl-7.4.25-r0
php7-zip-7.4.24-r0 php7-zip-7.4.25-r0
pinentry-1.1.1-r0 pinentry-1.1.1-r0
popt-1.18-r0 popt-1.18-r0
procps-3.3.17-r0 procps-3.3.17-r0
@ -217,7 +217,7 @@ shadow-4.8.1-r0
skalibs-2.10.0.3-r0 skalibs-2.10.0.3-r0
sqlite-libs-3.35.5-r0 sqlite-libs-3.35.5-r0
ssl_client-1.33.1-r3 ssl_client-1.33.1-r3
tzdata-2021c-r0 tzdata-2021d-r0
unixodbc-2.3.9-r1 unixodbc-2.3.9-r1
utmps-0.1.0.2-r0 utmps-0.1.0.2-r0
whois-5.5.10-r0 whois-5.5.10-r0

4
readme-vars.yml
View File

@ -155,7 +155,9 @@ app_setup_nginx_reverse_proxy_block: ""
# changelog # changelog
changelogs: changelogs:
- { date: "14.10.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Use standard nginx.conf from lsio alpine nginx base image." } - { date: "27.10.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Use standard nginx.conf from lsio alpine nginx base image." }
- { date: "26.10.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) proxy.conf - Mitigate https://httpoxy.org/ vulnerabilities. Ref: https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx#Defeating-the-Attack-using-NGINX-and-NGINX-Plus" }
- { date: "23.10.21:", desc: "Fix Hurricane Electric (HE) DNS validation." }
- { date: "12.10.21:", desc: "Fix deprecated LE root cert check to fix failures when using `STAGING=true`, and failures in revoking." } - { date: "12.10.21:", desc: "Fix deprecated LE root cert check to fix failures when using `STAGING=true`, and failures in revoking." }
- { date: "06.10.21:", desc: "Added support for Hurricane Electric (HE) DNS validation. Added lxml build deps." } - { date: "06.10.21:", desc: "Added support for Hurricane Electric (HE) DNS validation. Added lxml build deps." }
- { date: "01.10.21:", desc: "Check if the cert uses the old LE root cert, revoke and regenerate if necessary. [Here's more info](https://twitter.com/letsencrypt/status/1443621997288767491) on LE root cert expiration" } - { date: "01.10.21:", desc: "Check if the cert uses the old LE root cert, revoke and regenerate if necessary. [Here's more info](https://twitter.com/letsencrypt/status/1443621997288767491) on LE root cert expiration" }

3
root/defaults/proxy.conf
View File

@ -1,4 +1,4 @@
## Version 2021/04/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/proxy.conf ## Version 2021/10/26 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/proxy.conf
# Timeout if the real server is dead # Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
@ -22,6 +22,7 @@ proxy_no_cache $cookie_session;
proxy_set_header Connection $connection_upgrade; proxy_set_header Connection $connection_upgrade;
proxy_set_header Early-Data $ssl_early_data; proxy_set_header Early-Data $ssl_early_data;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header Proxy "";
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Host $host;

2
root/etc/cont-init.d/50-config
View File

@ -91,7 +91,7 @@ if ! grep -q 'if ($request_uri ~' /config/nginx/authelia-server.conf; then
fi fi
# check to make sure DNSPLUGIN is selected if dns validation is used # check to make sure DNSPLUGIN is selected if dns validation is used
[[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(aliyun|cloudflare|cloudxns|cpanel|digitalocean|directadmin|dnsimple|dnsmadeeasy|domeneshop|gandi|gehirn|google|hetzner|inwx|ionos|linode|luadns|netcup|njalla|nsone|ovh|rfc2136|route53|sakuracloud|transip|vultr)$ ]] && \ [[ "$VALIDATION" = "dns" ]] && [[ ! "$DNSPLUGIN" =~ ^(aliyun|cloudflare|cloudxns|cpanel|digitalocean|directadmin|dnsimple|dnsmadeeasy|domeneshop|gandi|gehirn|google|he|hetzner|inwx|ionos|linode|luadns|netcup|njalla|nsone|ovh|rfc2136|route53|sakuracloud|transip|vultr)$ ]] && \
echo "Please set the DNSPLUGIN variable to a valid plugin name. See docker info for more details." && \ echo "Please set the DNSPLUGIN variable to a valid plugin name. See docker info for more details." && \
sleep infinity sleep infinity