From ca2c0ce48ee3a046b0b132d015aed836badf9ed6 Mon Sep 17 00:00:00 2001 From: aptalca Date: Sun, 2 Feb 2020 15:54:30 -0500 Subject: [PATCH 01/47] create template branch --- .dockerignore | 6 ++ .gitattributes | 17 +++++ .gitignore | 43 +++++++++++++ .travis.yml | 25 +++++--- README.md | 166 ++++--------------------------------------------- blacklist.txt | 2 - 6 files changed, 95 insertions(+), 164 deletions(-) create mode 100644 .dockerignore create mode 100644 .gitattributes create mode 100644 .gitignore delete mode 100644 blacklist.txt diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 000000000..cdb1a82fc --- /dev/null +++ b/.dockerignore @@ -0,0 +1,6 @@ +.git +.gitignore +.github +.gitattributes +READMETEMPLATE.md +README.md diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 000000000..bdb0cabc8 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,17 @@ +# Auto detect text files and perform LF normalization +* text=auto + +# Custom for Visual Studio +*.cs diff=csharp + +# Standard to msysgit +*.doc diff=astextplain +*.DOC diff=astextplain +*.docx diff=astextplain +*.DOCX diff=astextplain +*.dot diff=astextplain +*.DOT diff=astextplain +*.pdf diff=astextplain +*.PDF diff=astextplain +*.rtf diff=astextplain +*.RTF diff=astextplain diff --git a/.gitignore b/.gitignore new file mode 100644 index 000000000..96374c4e7 --- /dev/null +++ b/.gitignore @@ -0,0 +1,43 @@ +# Windows image file caches +Thumbs.db +ehthumbs.db + +# Folder config file +Desktop.ini + +# Recycle Bin used on file shares +$RECYCLE.BIN/ + +# Windows Installer files +*.cab +*.msi +*.msm +*.msp + +# Windows shortcuts +*.lnk + +# ========================= +# Operating System Files +# ========================= + +# OSX +# ========================= + +.DS_Store +.AppleDouble +.LSOverride + +# Thumbnails +._* + +# Files that might appear on external disk +.Spotlight-V100 +.Trashes + +# Directories potentially created on remote AFP share +.AppleDB +.AppleDesktop +Network Trash Folder +Temporary Items +.apdisk diff --git a/.travis.yml b/.travis.yml index 388a81b2a..e6e5b1fb6 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,24 +1,35 @@ -sudo: true +os: linux -language: bash +language: shell + +branches: + only: + - - #replace variables, omit brackets services: - docker env: global: - - DOCKERHUB="user/endpoint" + - DOCKERHUB="linuxserver/mods" #don't modify + - BASEIMAGE="baseimagename" #replace + - MODNAME="modname" #replace jobs: include: + - stage: PR-BuildImage + if: (type IN (pull_request)) + script: + # Build image + - docker build --no-cache -t ${DOCKERHUB}:${BASEIMAGE}-${MODNAME}-${TRAVIS_COMMIT} . - stage: BuildImage if: (NOT (type IN (pull_request))) script: # Build image - - docker build --no-cache -t ${DOCKERHUB}:${TRAVIS_COMMIT} . - - docker tag ${DOCKERHUB}:${TRAVIS_COMMIT} ${DOCKERHUB}:latest + - docker build --no-cache -t ${DOCKERHUB}:${BASEIMAGE}-${MODNAME}-${TRAVIS_COMMIT} . + - docker tag ${DOCKERHUB}:${BASEIMAGE}-${MODNAME}-${TRAVIS_COMMIT} ${DOCKERHUB}:${BASEIMAGE}-${MODNAME} # Login to DockerHub - echo $DOCKERPASS | docker login -u $DOCKERUSER --password-stdin # Push all of the tags - - docker push ${DOCKERHUB}:${TRAVIS_COMMIT} - - docker push ${DOCKERHUB}:latest + - docker push ${DOCKERHUB}:${BASEIMAGE}-${MODNAME}-${TRAVIS_COMMIT} + - docker push ${DOCKERHUB}:${BASEIMAGE}-${MODNAME} \ No newline at end of file diff --git a/README.md b/README.md index 413c50059..867a00c1f 100644 --- a/README.md +++ b/README.md @@ -1,159 +1,15 @@ -# Intro +# Docker mod for openssh-server -The purpose of the repository is to provide examples and guidance in creating and storing a user consumable modification layer for the Library of Linuxserver.io Dockerhub Containers. -At it's core a Docker Mod is a tarball of files stored on Dockerhub that is downloaded and extracted on container boot before any init logic is run. -This allows: +This mod adds rsync to openssh-server, to be installed/updated during container start. -* Developers and community users to modify base containers to suit their needs without the need to maintain a fork of the main docker repository -* Mods to be shared with the Linuxserver.io userbase as individual independent projects with their own support channels and development ideologies -* Zero cost hosting and build pipelines for these modifications leveraging Github and Dockerhub -* Full custom configuration management layers for hooking containers into each other using environment variables contained in a compose file +In openssh-server docker arguments, set an environment variable `DOCKER_MODS=linuxserver/mods:openssh-server-rsync` -It is important to note to end users of this system that there are not only extreme security implications to consuming files from souces outside of our control, but by leveraging community Mods you essentially lose direct support from the core LinuxServer team. Our first and foremost troubleshooting step will be to remove the `DOCKER_MODS` environment variable when running into issues and replace the container with a clean LSIO one. +# Mod creation instructions -Again, when pulling in logic from external sources practice caution and trust the sources/community you get them from. - -## Using a Docker Mod - -Before consuming a Docker Mod ensure that the source code for it is publicly posted along with it's build pipeline pushing to Dockerhub. - -Consumption of a Docker Mod is intended to be as user friendly as possible and can be achieved with the following environment variables being passed to the container: - -* DOCKER_MODS- This can be a single endpoint `user/endpoint:tag` or an array of endpoints separated by `|` `user/endpoint:tag|user2/endpoint2:tag` -* RUN_BANNED_MODS- If this is set to any value you will bypass our centralized filter of banned Dockerhub users and run Mods regardless of a ban - -Full example: - -``` -docker create \ - --name=nzbget \ - -e DOCKER_MODS=taisun/nzbget-mod:latest \ - -e PUID=1000 \ - -e PGID=1000 \ - -e TZ=Europe/London \ - -p 6789:6789 \ - -v :/config \ - -v :/downloads \ - --restart unless-stopped \ - linuxserver/nzbget -``` - -This will spinup an nzbget container and apply the custom logic found in the following repository: - -https://github.com/Taisun-Docker/Linuxserver-Mod-Demo - -This basic demo installs Pip and a couple dependencies for plugins some users leverage with nzbget. - -## Creating and maintaining a Docker Mod - -We will always recommend to our users consuming Mods that they leverage ones from active community members or projects so transparency is key here. We understand that image layers can be pushed on the back end behind these pipelines, but every little bit helps. -In this repository we will be going over two basic methods of making a Mod along with an example of the Travis-CI.org build logic to get this into a Dockerhub endpoint. Though we are not officially endorsing Travis-CI here it is one of the most popular Open Source free build pipelines and only requires a Github account to get started. If you prefer others feel free to use them as long as build jobs are transparent. - -One of the core ideas to remember when creating a Mod is that it can only contain a single image layer, the examples below will show you how to add files standardly and how to run complex logic to assemble the files in a build layer to copy them over into this single layer. - -### Docker Mod Simple - just add scripts - -In this repository you will find the `Dockerfile` containing: - -``` -FROM scratch - -# copy local files -COPY root/ / -``` - -For most users this will suffice and anything in the root/ folder of the repository will be added to the end users Docker container / path. - -The most common paths to leverage for Linuxserver images will be: - -* root/etc/cont-init.d/<25-script-name> - Contains init logic scripts that run before the services in the container start these should exit 0 and are ordered by filename -* root/etc/services.d//run - Contains scripts that run in the foreground for persistent services IE NGINX -* root/defaults - Contains base config files that are copied/modified on first spinup - -The example files in this repo contain a script to install sshutil and a service file to run the installed utility. - -### Docker Mod Complex - Sky is the limit - -In this repository you will find the `Dockerfile.complex` containing: - -``` -## Buildstage ## -FROM lsiobase/alpine:3.9 as buildstage - -RUN \ - echo "**** install packages ****" && \ - apk add --no-cache \ - curl && \ - echo "**** grab rclone ****" && \ - mkdir -p /root-layer && \ - curl -o \ - /root-layer/rclone.deb -L \ - "https://downloads.rclone.org/v1.47.0/rclone-v1.47.0-linux-amd64.deb" - -# copy local files -COPY root/ /root-layer/ - -## Single layer deployed image ## -FROM scratch - -# Add files from buildstage -COPY --from=buildstage /root-layer/ / -``` - -Here we are leveraging a multi stage DockerFile to run custom logic and pull down an Rclone deb from the Internet to include in our image layer for distribution. Any amount of logic can be run in this build stage or even multiple build stages as long as the files in the end are combined into a single folder for the COPY command in the final output. - -## Full loop - getting a Mod to Dockerhub - -First and foremost to publish a Mod you will need the following accounts: -* Github- https://github.com/join -* DockerHub- https://hub.docker.com/signup - -We reccomend using this repositroy as a template for your first Mod, so in this section we assume the code is finished and we will only concentrate on plugging into Travis/Dockerhub. - -The only code change you need to make to the build logic file `.travis.yml` will be to modify the DOCKERHUB endpoint to your own image: -``` -env: - global: - - DOCKERHUB="user/endpoint" -``` - -User is your Dockerhub user and endpoint is your own custom name. You do not need to create this endpoint beforehand, the build logic will push it and create it on first run. - -Head over to https://travis-ci.org/ and click on signup: - -![signup](https://s3-us-west-2.amazonaws.com/linuxserver-docs/images/signup.png) - -This will use Github to auth you in. Once in the dashboard click on "Add new Repository": - -![addnew](https://s3-us-west-2.amazonaws.com/linuxserver-docs/images/addnew.png) - -Click on settings for the repo you want to add: - -![settings](https://s3-us-west-2.amazonaws.com/linuxserver-docs/images/settings.png) - -Under the "Environment Variables" section add DOCKERUSER and DOCKERPASS as shown below, these will be your live Dockerhub credentials: - -![env](https://s3-us-west-2.amazonaws.com/linuxserver-docs/images/env.png) - -Once these are set click on the "Current" tab and "Activate repository": - -![activate](https://s3-us-west-2.amazonaws.com/linuxserver-docs/images/activate.png) - -Travis will trigger a build off of your repo and will push to Dockerhub on success. This Dockerhub endpoint is the Mod variable you can use to customize your container now. - - -## Appendix - -### Inspecting mods - -To inspect the file contents of external Mods dive is a great CLI tool: - -https://github.com/wagoodman/dive - -Basic usage: - -``` -docker run --rm -it \ - -v /var/run/docker.sock:/var/run/docker.sock \ - wagoodman/dive:latest -``` +* Ask the team to create a new branch named `-`. Baseimage should be the name of the image the mod will be applied to. The new branch will be based on the `template` branch. +* Fork the repo, checkout the template branch. +* Edit the `Dockerfile` for the mod. `Dockerfile.complex` is only an example and included for reference; it should be deleted when done. +* Inspect the `root` folder contents. Edit, add and remove as necessary. +* Edit this readme with pertinent info, delete thse instructions. +* Finally edit the `travis.yml`. Customize the build branch,and the vars for `BASEIMAGE` and `MODNAME` +* Submit PR against the branch created by the team \ No newline at end of file diff --git a/blacklist.txt b/blacklist.txt deleted file mode 100644 index 9cce7e51a..000000000 --- a/blacklist.txt +++ /dev/null @@ -1,2 +0,0 @@ -evilbitcoinminer -rootkitinc From 5be8b23ea105ad27c9cf986c4945ddef99ece6dd Mon Sep 17 00:00:00 2001 From: aptalca Date: Wed, 1 Apr 2020 17:35:56 -0400 Subject: [PATCH 02/47] readme and template updates --- README.md | 12 +++++++----- .../etc/cont-init.d/{99-vpn-config => 98-vpn-config} | 0 2 files changed, 7 insertions(+), 5 deletions(-) rename root/etc/cont-init.d/{99-vpn-config => 98-vpn-config} (100%) diff --git a/README.md b/README.md index 867a00c1f..2418e5307 100644 --- a/README.md +++ b/README.md @@ -1,15 +1,17 @@ -# Docker mod for openssh-server +# Rsync - Docker mod for openssh-server This mod adds rsync to openssh-server, to be installed/updated during container start. In openssh-server docker arguments, set an environment variable `DOCKER_MODS=linuxserver/mods:openssh-server-rsync` +If adding multiple mods, enter them in an array separated by `|`, such as `DOCKER_MODS=linuxserver/mods:openssh-server-rsync|linuxserver/mods:openssh-server-mod2` + # Mod creation instructions * Ask the team to create a new branch named `-`. Baseimage should be the name of the image the mod will be applied to. The new branch will be based on the `template` branch. -* Fork the repo, checkout the template branch. +* Fork the repo, checkout the newly created branch. * Edit the `Dockerfile` for the mod. `Dockerfile.complex` is only an example and included for reference; it should be deleted when done. * Inspect the `root` folder contents. Edit, add and remove as necessary. -* Edit this readme with pertinent info, delete thse instructions. -* Finally edit the `travis.yml`. Customize the build branch,and the vars for `BASEIMAGE` and `MODNAME` -* Submit PR against the branch created by the team \ No newline at end of file +* Edit this readme with pertinent info, delete these instructions. +* Finally edit the `travis.yml`. Customize the build branch, and the vars for `BASEIMAGE` and `MODNAME`. +* Submit PR against the branch created by the team. \ No newline at end of file diff --git a/root/etc/cont-init.d/99-vpn-config b/root/etc/cont-init.d/98-vpn-config similarity index 100% rename from root/etc/cont-init.d/99-vpn-config rename to root/etc/cont-init.d/98-vpn-config From 66c6ab5c69b64ed8f8065fb5e56588bf08b4ed80 Mon Sep 17 00:00:00 2001 From: aptalca Date: Fri, 2 Oct 2020 16:01:55 -0400 Subject: [PATCH 03/47] update mod creation instructions --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 2418e5307..62f203fab 100644 --- a/README.md +++ b/README.md @@ -8,10 +8,10 @@ If adding multiple mods, enter them in an array separated by `|`, such as `DOCKE # Mod creation instructions -* Ask the team to create a new branch named `-`. Baseimage should be the name of the image the mod will be applied to. The new branch will be based on the `template` branch. -* Fork the repo, checkout the newly created branch. +* Fork the repo, create a new branch based on the branch `template`. * Edit the `Dockerfile` for the mod. `Dockerfile.complex` is only an example and included for reference; it should be deleted when done. * Inspect the `root` folder contents. Edit, add and remove as necessary. * Edit this readme with pertinent info, delete these instructions. * Finally edit the `travis.yml`. Customize the build branch, and the vars for `BASEIMAGE` and `MODNAME`. -* Submit PR against the branch created by the team. \ No newline at end of file +* Ask the team to create a new branch named `-`. Baseimage should be the name of the image the mod will be applied to. The new branch will be based on the `template` branch. +* Submit PR against the branch created by the team. From 69f8a2efb74154fd3b95205cb0ab26e9e8272cf3 Mon Sep 17 00:00:00 2001 From: aptalca Date: Fri, 2 Oct 2020 16:25:28 -0400 Subject: [PATCH 04/47] add maintainer label --- Dockerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Dockerfile b/Dockerfile index 2f24b2092..4ece5e860 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,6 @@ FROM scratch +LABEL maintainer="username" + # copy local files COPY root/ / From ca3be5789434030f34f21764344543ac934b38d9 Mon Sep 17 00:00:00 2001 From: aptalca Date: Thu, 15 Oct 2020 09:30:29 -0400 Subject: [PATCH 05/47] add maintainer to sample Dockerfile.complex --- Dockerfile.complex | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Dockerfile.complex b/Dockerfile.complex index 4463d838a..bc9790250 100644 --- a/Dockerfile.complex +++ b/Dockerfile.complex @@ -1,5 +1,5 @@ ## Buildstage ## -FROM lsiobase/alpine:3.9 as buildstage +FROM lsiobase/alpine:3.12 as buildstage RUN \ echo "**** install packages ****" && \ @@ -17,5 +17,7 @@ COPY root/ /root-layer/ ## Single layer deployed image ## FROM scratch +LABEL maintainer="username" + # Add files from buildstage COPY --from=buildstage /root-layer/ / From afcc5a19aaa585681803520d850bce35473fc52b Mon Sep 17 00:00:00 2001 From: Eric Nemchik Date: Sat, 24 Oct 2020 13:12:50 -0500 Subject: [PATCH 06/47] Replace Travis with GHA --- .github/workflows/BuildImage.yml | 30 +++++++++++++++++++++++++++ .travis.yml | 35 -------------------------------- README.md | 2 +- 3 files changed, 31 insertions(+), 36 deletions(-) create mode 100644 .github/workflows/BuildImage.yml delete mode 100644 .travis.yml diff --git a/.github/workflows/BuildImage.yml b/.github/workflows/BuildImage.yml new file mode 100644 index 000000000..7758aa865 --- /dev/null +++ b/.github/workflows/BuildImage.yml @@ -0,0 +1,30 @@ +name: Build Image + +on: [push, pull_request, workflow_dispatch] + +jobs: + build: + env: + DOCKERHUB: "linuxserver/mods" #don't modify + BASEIMAGE: "baseimagename" #replace + MODNAME: "modname" #replace + + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2.3.3 + + - name: Build image + id: build + run: | + docker build --no-cache -t ${DOCKERHUB}:${BASEIMAGE}-${MODNAME}-${{ github.sha }} . + + - name: Push image + if: ${{ github.ref == format('refs/heads/{0}-{1}', env.BASEIMAGE, env.MODNAME) }} + run: | + # Tag image + docker tag ${DOCKERHUB}:${BASEIMAGE}-${MODNAME}-${{ github.sha }} ${DOCKERHUB}:${BASEIMAGE}-${MODNAME} + # Login to DockerHub + echo ${{ secrets.DOCKERPASS }} | docker login -u ${{ secrets.DOCKERUSER }} --password-stdin + # Push all of the tags + docker push ${DOCKERHUB}:${BASEIMAGE}-${MODNAME}-${{ github.sha }} + docker push ${DOCKERHUB}:${BASEIMAGE}-${MODNAME} diff --git a/.travis.yml b/.travis.yml deleted file mode 100644 index e6e5b1fb6..000000000 --- a/.travis.yml +++ /dev/null @@ -1,35 +0,0 @@ -os: linux - -language: shell - -branches: - only: - - - #replace variables, omit brackets - -services: - - docker - -env: - global: - - DOCKERHUB="linuxserver/mods" #don't modify - - BASEIMAGE="baseimagename" #replace - - MODNAME="modname" #replace - -jobs: - include: - - stage: PR-BuildImage - if: (type IN (pull_request)) - script: - # Build image - - docker build --no-cache -t ${DOCKERHUB}:${BASEIMAGE}-${MODNAME}-${TRAVIS_COMMIT} . - - stage: BuildImage - if: (NOT (type IN (pull_request))) - script: - # Build image - - docker build --no-cache -t ${DOCKERHUB}:${BASEIMAGE}-${MODNAME}-${TRAVIS_COMMIT} . - - docker tag ${DOCKERHUB}:${BASEIMAGE}-${MODNAME}-${TRAVIS_COMMIT} ${DOCKERHUB}:${BASEIMAGE}-${MODNAME} - # Login to DockerHub - - echo $DOCKERPASS | docker login -u $DOCKERUSER --password-stdin - # Push all of the tags - - docker push ${DOCKERHUB}:${BASEIMAGE}-${MODNAME}-${TRAVIS_COMMIT} - - docker push ${DOCKERHUB}:${BASEIMAGE}-${MODNAME} \ No newline at end of file diff --git a/README.md b/README.md index 62f203fab..5636dec3e 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,6 @@ If adding multiple mods, enter them in an array separated by `|`, such as `DOCKE * Edit the `Dockerfile` for the mod. `Dockerfile.complex` is only an example and included for reference; it should be deleted when done. * Inspect the `root` folder contents. Edit, add and remove as necessary. * Edit this readme with pertinent info, delete these instructions. -* Finally edit the `travis.yml`. Customize the build branch, and the vars for `BASEIMAGE` and `MODNAME`. +* Finally edit the `.github/workflows/BuildImage.yml`. Customize the build branch, and the vars for `BASEIMAGE` and `MODNAME`. * Ask the team to create a new branch named `-`. Baseimage should be the name of the image the mod will be applied to. The new branch will be based on the `template` branch. * Submit PR against the branch created by the team. From f20f64178f8e29ffcac0fdaf002627b3f4271b6a Mon Sep 17 00:00:00 2001 From: Eric Nemchik Date: Mon, 2 Nov 2020 20:20:09 -0600 Subject: [PATCH 07/47] Add information about GHCR --- .github/workflows/BuildImage.yml | 60 ++++++++++++++++++++++++-------- Dockerfile.complex | 2 +- 2 files changed, 47 insertions(+), 15 deletions(-) diff --git a/.github/workflows/BuildImage.yml b/.github/workflows/BuildImage.yml index 7758aa865..518b0d81d 100644 --- a/.github/workflows/BuildImage.yml +++ b/.github/workflows/BuildImage.yml @@ -2,29 +2,61 @@ name: Build Image on: [push, pull_request, workflow_dispatch] +env: + ENDPOINT: "linuxserver/mods" #don't modify + BASEIMAGE: "replace_baseimage" #replace + MODNAME: "replace_modname" #replace + jobs: build: - env: - DOCKERHUB: "linuxserver/mods" #don't modify - BASEIMAGE: "baseimagename" #replace - MODNAME: "modname" #replace - runs-on: ubuntu-latest steps: - uses: actions/checkout@v2.3.3 - name: Build image - id: build run: | - docker build --no-cache -t ${DOCKERHUB}:${BASEIMAGE}-${MODNAME}-${{ github.sha }} . + docker build --no-cache -t ${{ github.sha }} . - - name: Push image + - name: Tag image if: ${{ github.ref == format('refs/heads/{0}-{1}', env.BASEIMAGE, env.MODNAME) }} run: | - # Tag image - docker tag ${DOCKERHUB}:${BASEIMAGE}-${MODNAME}-${{ github.sha }} ${DOCKERHUB}:${BASEIMAGE}-${MODNAME} - # Login to DockerHub + docker tag ${{ github.sha }} ${ENDPOINT}:${BASEIMAGE}-${MODNAME} + docker tag ${{ github.sha }} ${ENDPOINT}:${BASEIMAGE}-${MODNAME}-${{ github.sha }} + docker tag ${{ github.sha }} ghcr.io/${ENDPOINT}:${BASEIMAGE}-${MODNAME} + docker tag ${{ github.sha }} ghcr.io/${ENDPOINT}:${BASEIMAGE}-${MODNAME}-${{ github.sha }} + + - name: Credential check + if: ${{ github.ref == format('refs/heads/{0}-{1}', env.BASEIMAGE, env.MODNAME) }} + run: | + echo "CR_USER=${{ secrets.CR_USER }}" >> $GITHUB_ENV + echo "CR_PAT=${{ secrets.CR_PAT }}" >> $GITHUB_ENV + echo "DOCKERUSER=${{ secrets.DOCKERUSER }}" >> $GITHUB_ENV + echo "DOCKERPASS=${{ secrets.DOCKERPASS }}" >> $GITHUB_ENV + if [[ "${{ secrets.CR_USER }}" == "" && "${{ secrets.CR_PAT }}" == "" && "${{ secrets.DOCKERUSER }}" == "" && "${{ secrets.DOCKERPASS }}" == "" ]]; then + echo "::error::Push credential secrets missing." + echo "::error::You must set either CR_USER & CR_PAT or DOCKERUSER & DOCKERPASS as secrets in your repo settings." + echo "::error::See https://github.com/linuxserver/docker-mods/blob/master/README.md for more information/instructions." + exit 1 + fi + + - name: Login to GitHub Container Registry + if: ${{ github.ref == format('refs/heads/{0}-{1}', env.BASEIMAGE, env.MODNAME) && env.CR_USER && env.CR_PAT }} + run: | + echo "${{ secrets.CR_PAT }}" | docker login ghcr.io -u ${{ secrets.CR_USER }} --password-stdin + + - name: Push tags to GitHub Container Registry + if: ${{ github.ref == format('refs/heads/{0}-{1}', env.BASEIMAGE, env.MODNAME) && env.CR_USER && env.CR_PAT }} + run: | + docker push ghcr.io/${ENDPOINT}:${BASEIMAGE}-${MODNAME}-${{ github.sha }} + docker push ghcr.io/${ENDPOINT}:${BASEIMAGE}-${MODNAME} + + - name: Login to DockerHub + if: ${{ github.ref == format('refs/heads/{0}-{1}', env.BASEIMAGE, env.MODNAME) && env.DOCKERUSER && env.DOCKERPASS }} + run: | echo ${{ secrets.DOCKERPASS }} | docker login -u ${{ secrets.DOCKERUSER }} --password-stdin - # Push all of the tags - docker push ${DOCKERHUB}:${BASEIMAGE}-${MODNAME}-${{ github.sha }} - docker push ${DOCKERHUB}:${BASEIMAGE}-${MODNAME} + + - name: Push tags to DockerHub + if: ${{ github.ref == format('refs/heads/{0}-{1}', env.BASEIMAGE, env.MODNAME) && env.DOCKERUSER && env.DOCKERPASS }} + run: | + docker push ${ENDPOINT}:${BASEIMAGE}-${MODNAME}-${{ github.sha }} + docker push ${ENDPOINT}:${BASEIMAGE}-${MODNAME} diff --git a/Dockerfile.complex b/Dockerfile.complex index bc9790250..8eb7e00d2 100644 --- a/Dockerfile.complex +++ b/Dockerfile.complex @@ -1,5 +1,5 @@ ## Buildstage ## -FROM lsiobase/alpine:3.12 as buildstage +FROM ghcr.io/linuxserver/baseimage-alpine::3.12 as buildstage RUN \ echo "**** install packages ****" && \ From 8a48ea51d8833349116871d6f796ad8f5d002824 Mon Sep 17 00:00:00 2001 From: Eric Nemchik Date: Tue, 3 Nov 2020 09:04:40 -0600 Subject: [PATCH 08/47] Update Dockerfile.complex --- Dockerfile.complex | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.complex b/Dockerfile.complex index 8eb7e00d2..db4598e2c 100644 --- a/Dockerfile.complex +++ b/Dockerfile.complex @@ -1,5 +1,5 @@ ## Buildstage ## -FROM ghcr.io/linuxserver/baseimage-alpine::3.12 as buildstage +FROM ghcr.io/linuxserver/baseimage-alpine:3.12 as buildstage RUN \ echo "**** install packages ****" && \ From 413aa5129f288d53509235bf04f4c2a88c9fa95f Mon Sep 17 00:00:00 2001 From: Roxedus Date: Wed, 29 Dec 2021 23:25:33 +0100 Subject: [PATCH 09/47] Document internal "guidelines" --- README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/README.md b/README.md index 5636dec3e..761c79986 100644 --- a/README.md +++ b/README.md @@ -15,3 +15,11 @@ If adding multiple mods, enter them in an array separated by `|`, such as `DOCKE * Finally edit the `.github/workflows/BuildImage.yml`. Customize the build branch, and the vars for `BASEIMAGE` and `MODNAME`. * Ask the team to create a new branch named `-`. Baseimage should be the name of the image the mod will be applied to. The new branch will be based on the `template` branch. * Submit PR against the branch created by the team. + + +## Tips and tricks + +* To decrease startup times when multiple mods are used, we have consolidated `apt-get update` down to one file. As seen in the [nodejs mod](https://github.com/linuxserver/docker-mods/tree/code-server-nodejs/root/etc/cont-init.d) +* Some images has helpers built in, these images are currently: + * [Openvscode-server](https://github.com/linuxserver/docker-openvscode-server/pull/10/files) + * [Code-server](https://github.com/linuxserver/docker-code-server/pull/95) From 5f5d423c50e38dbb22136a4ab46bdbed21d3ba83 Mon Sep 17 00:00:00 2001 From: Adam Date: Mon, 14 Mar 2022 14:50:25 +0000 Subject: [PATCH 10/47] Publish swag-crowdsec mod (#315) --- .github/workflows/BuildImage.yml | 4 +- Dockerfile | 2 +- Dockerfile.complex | 23 ---------- README.md | 37 ++++++++-------- root/etc/cont-init.d/98-crowdsec | 68 ++++++++++++++++++++++++++++++ root/etc/cont-init.d/98-vpn-config | 27 ------------ root/etc/services.d/sshvpn/run | 3 -- 7 files changed, 91 insertions(+), 73 deletions(-) delete mode 100644 Dockerfile.complex create mode 100644 root/etc/cont-init.d/98-crowdsec delete mode 100644 root/etc/cont-init.d/98-vpn-config delete mode 100644 root/etc/services.d/sshvpn/run diff --git a/.github/workflows/BuildImage.yml b/.github/workflows/BuildImage.yml index 518b0d81d..5b957cb21 100644 --- a/.github/workflows/BuildImage.yml +++ b/.github/workflows/BuildImage.yml @@ -4,8 +4,8 @@ on: [push, pull_request, workflow_dispatch] env: ENDPOINT: "linuxserver/mods" #don't modify - BASEIMAGE: "replace_baseimage" #replace - MODNAME: "replace_modname" #replace + BASEIMAGE: "swag" #replace + MODNAME: "crowdsec" #replace jobs: build: diff --git a/Dockerfile b/Dockerfile index 4ece5e860..2a0c3cb46 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ FROM scratch -LABEL maintainer="username" +LABEL maintainer="thespad" # copy local files COPY root/ / diff --git a/Dockerfile.complex b/Dockerfile.complex deleted file mode 100644 index db4598e2c..000000000 --- a/Dockerfile.complex +++ /dev/null @@ -1,23 +0,0 @@ -## Buildstage ## -FROM ghcr.io/linuxserver/baseimage-alpine:3.12 as buildstage - -RUN \ - echo "**** install packages ****" && \ - apk add --no-cache \ - curl && \ - echo "**** grab rclone ****" && \ - mkdir -p /root-layer && \ - curl -o \ - /root-layer/rclone.deb -L \ - "https://downloads.rclone.org/v1.47.0/rclone-v1.47.0-linux-amd64.deb" - -# copy local files -COPY root/ /root-layer/ - -## Single layer deployed image ## -FROM scratch - -LABEL maintainer="username" - -# Add files from buildstage -COPY --from=buildstage /root-layer/ / diff --git a/README.md b/README.md index 761c79986..6c2af228d 100644 --- a/README.md +++ b/README.md @@ -1,25 +1,28 @@ -# Rsync - Docker mod for openssh-server +# CrowdSec - Docker mod for SWAG -This mod adds rsync to openssh-server, to be installed/updated during container start. +This mod adds the [CrowdSec](https://crowdsec.net) [nginx bouncer](https://github.com/crowdsecurity/cs-nginx-bouncer/) to SWAG, to be installed/updated during container start. -In openssh-server docker arguments, set an environment variable `DOCKER_MODS=linuxserver/mods:openssh-server-rsync` +In SWAG docker arguments, set an environment variable `DOCKER_MODS=linuxserver/mods:swag-crowdsec` -If adding multiple mods, enter them in an array separated by `|`, such as `DOCKER_MODS=linuxserver/mods:openssh-server-rsync|linuxserver/mods:openssh-server-mod2` +If adding multiple mods, enter them in an array separated by `|`, such as `DOCKER_MODS=linuxserver/mods:swag-crowdsec|linuxserver/mods:swag-dbip` -# Mod creation instructions +## Mod usage instructions -* Fork the repo, create a new branch based on the branch `template`. -* Edit the `Dockerfile` for the mod. `Dockerfile.complex` is only an example and included for reference; it should be deleted when done. -* Inspect the `root` folder contents. Edit, add and remove as necessary. -* Edit this readme with pertinent info, delete these instructions. -* Finally edit the `.github/workflows/BuildImage.yml`. Customize the build branch, and the vars for `BASEIMAGE` and `MODNAME`. -* Ask the team to create a new branch named `-`. Baseimage should be the name of the image the mod will be applied to. The new branch will be based on the `template` branch. -* Submit PR against the branch created by the team. +If running CrowdSec in a container it must be on a common docker network with SWAG. +Generate an API key for the bouncer with `cscli bouncers add bouncer-swag` or `docker exec -t crowdsec cscli bouncers add bouncer-swag`, if you're running CrowdSec in a container. -## Tips and tricks +Make a note of the API key as you can't retrieve it later without removing and re-adding the bouncer. -* To decrease startup times when multiple mods are used, we have consolidated `apt-get update` down to one file. As seen in the [nodejs mod](https://github.com/linuxserver/docker-mods/tree/code-server-nodejs/root/etc/cont-init.d) -* Some images has helpers built in, these images are currently: - * [Openvscode-server](https://github.com/linuxserver/docker-openvscode-server/pull/10/files) - * [Code-server](https://github.com/linuxserver/docker-code-server/pull/95) +Set the following environment variables on your SWAG container. + +| | | | +| --- | --- | --- | +| `CROWDSEC_API_KEY` | **Required** | Your bouncer API key | +| `CROWDSEC_LAPI_URL` | **Required** | Your local CrowdSec API endpoint, for example `http://crowdsec:8080` | +| `CROWDSEC_SITE_KEY` | **Optional** | reCAPTCHA v2 Site Key | +| `CROWDSEC_SECRET_KEY` | **Optional** | reCAPTCHA v2 Secret Key | +| `CROWDSEC_VERSION` | **Optional** | Specify a version of the bouncer to install instead of using the latest release, for example `v1.0.0`. Must be a valid [release tag](https://github.com/crowdsecurity/cs-nginx-bouncer/tags). **Does not support versions older than v1.0.0**. +| | | | + +The variables need to remain in place while you are using the mod. If you remove **required** variables the bouncer will be disabled the next time you recreate the container, if you remove **optional** variables the associated features will be disabled the next time you recreate the container. diff --git a/root/etc/cont-init.d/98-crowdsec b/root/etc/cont-init.d/98-crowdsec new file mode 100644 index 000000000..44191f30d --- /dev/null +++ b/root/etc/cont-init.d/98-crowdsec @@ -0,0 +1,68 @@ +#!/usr/bin/with-contenv bash + +CONFIG_PATH="/config/crowdsec/" +LIB_PATH="/usr/local/lua/crowdsec/" +DATA_PATH="/var/lib/crowdsec/lua/" + +echo "**** Configuring CrowdSec nginx Bouncer ****" + +# If API keys are missing, disable mod and exit +if [[ -z $CROWDSEC_API_KEY ]] || [[ -z $CROWDSEC_LAPI_URL ]]; then + echo "**** Missing API key or CrowdSec LAPI URL, cannot configure bouncer ****" + exit 1 +fi + +apk add -U --upgrade --no-cache \ + gettext \ + lua5.1 \ + lua5.1-cjson \ + lua-resty-http \ + lua-sec \ + nginx-mod-http-lua + +# Download nginx bouncer +if [ -z ${CROWDSEC_VERSION+x} ]; then \ + CROWDSEC_VERSION=$(curl -sX GET "https://api.github.com/repos/crowdsecurity/cs-nginx-bouncer/releases/latest" | awk '/tag_name/{print $4;exit}' FS='[""]'); +fi + +curl -so \ + /tmp/crowdsec.tar.gz -L \ + "https://github.com/crowdsecurity/cs-nginx-bouncer/releases/download/${CROWDSEC_VERSION}/crowdsec-nginx-bouncer.tgz" + +mkdir -p /tmp/crowdsec + +tar xf \ + /tmp/crowdsec.tar.gz -C \ + /tmp/crowdsec --strip-components=1 + +# Inject API keys into config file +mkdir -p "${CONFIG_PATH}" +API_KEY=${CROWDSEC_API_KEY} CROWDSEC_LAPI_URL=${CROWDSEC_LAPI_URL} envsubst < /tmp/crowdsec/lua-mod/config_example.conf > "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" + +# Change config path +sed -i "s|/etc/crowdsec/bouncers/|${CONFIG_PATH}|" /tmp/crowdsec/nginx/crowdsec_nginx.conf + +# Copy files +mkdir -p ${DATA_PATH}/templates/ +cp -r /tmp/crowdsec/lua-mod/templates/* ${DATA_PATH}/templates/ + +mkdir -p ${LIB_PATH}plugins/crowdsec +cp -r /tmp/crowdsec/lua-mod/lib/* ${LIB_PATH} + +cp /tmp/crowdsec/nginx/crowdsec_nginx.conf /etc/nginx/http.d + +# Sed in ReCaptcha keys +sed -ir "s|SECRET_KEY=.*$|SECRET_KEY=${CROWDSEC_SECRET_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +sed -ir "s|SITE_KEY=.*$|SITE_KEY=${CROWDSEC_SITE_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" + +# Sed in crowdsec include +if grep -q '#include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf'; then + sed -i 's|#include /etc/nginx/http.d/\*.conf;|include /etc/nginx/http.d/\*.conf;|' /config/nginx/nginx.conf +fi + +# Clean up +rm -rf \ + /tmp/crowdsec \ + /tmp/crowdsec.tar.gz + +echo "**** Successfully configured CrowdSec nginx Bouncer ${CROWDSEC_VERSION} ****" diff --git a/root/etc/cont-init.d/98-vpn-config b/root/etc/cont-init.d/98-vpn-config deleted file mode 100644 index a5f91276e..000000000 --- a/root/etc/cont-init.d/98-vpn-config +++ /dev/null @@ -1,27 +0,0 @@ -#!/usr/bin/with-contenv bash - -# Determine if setup is needed -if [ ! -f /usr/local/lib/python***/dist-packages/sshuttle ] && \ -[ -f /usr/bin/apt ]; then - ## Ubuntu - apt-get update - apt-get install --no-install-recommends -y \ - iptables \ - openssh-client \ - python3 \ - python3-pip - pip3 install sshuttle -fi -if [ ! -f /usr/lib/python***/site-packages/sshuttle ] && \ -[ -f /sbin/apk ]; then - # Alpine - apk add --no-cache \ - iptables \ - openssh \ - py3-pip \ - python3 - pip3 install sshuttle -fi - -chown -R root:root /root -chmod -R 600 /root/.ssh diff --git a/root/etc/services.d/sshvpn/run b/root/etc/services.d/sshvpn/run deleted file mode 100644 index 7d49e7969..000000000 --- a/root/etc/services.d/sshvpn/run +++ /dev/null @@ -1,3 +0,0 @@ -#!/usr/bin/with-contenv bash - -sshuttle --dns --remote root@${HOST}:${PORT} 0/0 -x 172.17.0.0/16 From 62ec56d717ba284b2228053653669c14b3eb7798 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Wed, 23 Mar 2022 13:27:26 +0000 Subject: [PATCH 11/47] Handle missing http.d include --- root/etc/cont-init.d/98-crowdsec | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/root/etc/cont-init.d/98-crowdsec b/root/etc/cont-init.d/98-crowdsec index 44191f30d..e480cc9a7 100644 --- a/root/etc/cont-init.d/98-crowdsec +++ b/root/etc/cont-init.d/98-crowdsec @@ -56,8 +56,22 @@ sed -ir "s|SECRET_KEY=.*$|SECRET_KEY=${CROWDSEC_SECRET_KEY}|" "${CONFIG_PATH}cro sed -ir "s|SITE_KEY=.*$|SITE_KEY=${CROWDSEC_SITE_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" # Sed in crowdsec include -if grep -q '#include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf'; then - sed -i 's|#include /etc/nginx/http.d/\*.conf;|include /etc/nginx/http.d/\*.conf;|' /config/nginx/nginx.conf +if ! grep -q '[^#]include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf'; then + if grep -q '#include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf'; then + # Enable http.d include + sed -i 's|#include /etc/nginx/http.d/\*.conf;|include /etc/nginx/http.d/\*.conf;|' /config/nginx/nginx.conf + else + # Warn about missing http.d include + echo " + *************************************************************** + * Warning: Your nginx.conf is missing required settings * + * Please add: * + * include /etc/nginx/http.d/*.conf; * + * to the http{} block and restart the container. * + * * + * The bouncer will not function until this is done. * + ***************************************************************" + fi fi # Clean up From 6d58f64dc4815aa0d3bce0d966568756df101da3 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Wed, 23 Mar 2022 13:32:30 +0000 Subject: [PATCH 12/47] Make message more explicit --- root/etc/cont-init.d/98-crowdsec | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/root/etc/cont-init.d/98-crowdsec b/root/etc/cont-init.d/98-crowdsec index e480cc9a7..4d24842d5 100644 --- a/root/etc/cont-init.d/98-crowdsec +++ b/root/etc/cont-init.d/98-crowdsec @@ -63,14 +63,14 @@ if ! grep -q '[^#]include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf' else # Warn about missing http.d include echo " - *************************************************************** - * Warning: Your nginx.conf is missing required settings * - * Please add: * - * include /etc/nginx/http.d/*.conf; * - * to the http{} block and restart the container. * - * * - * The bouncer will not function until this is done. * - ***************************************************************" + ******************************************************************** + * Warning: Your nginx.conf is missing required settings * + * Please add: * + * include /etc/nginx/http.d/*.conf; * + * to the http{} block and restart the container. * + * * + * The CrowdSec bouncer will not function until this is done. * + ********************************************************************" fi fi From fae38b86785dfad66ed290dcb764db0af87610af Mon Sep 17 00:00:00 2001 From: TheSpad Date: Wed, 23 Mar 2022 22:28:27 +0000 Subject: [PATCH 13/47] Check for conf.d include as well --- root/etc/cont-init.d/98-crowdsec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/root/etc/cont-init.d/98-crowdsec b/root/etc/cont-init.d/98-crowdsec index 4d24842d5..8d2b43c12 100644 --- a/root/etc/cont-init.d/98-crowdsec +++ b/root/etc/cont-init.d/98-crowdsec @@ -56,7 +56,7 @@ sed -ir "s|SECRET_KEY=.*$|SECRET_KEY=${CROWDSEC_SECRET_KEY}|" "${CONFIG_PATH}cro sed -ir "s|SITE_KEY=.*$|SITE_KEY=${CROWDSEC_SITE_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" # Sed in crowdsec include -if ! grep -q '[^#]include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf'; then +if ! grep -q '[^#]include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf' && ! grep -q '[^#]include /etc/nginx/conf.d/\*.conf;' '/config/nginx/nginx.conf'; then if grep -q '#include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf'; then # Enable http.d include sed -i 's|#include /etc/nginx/http.d/\*.conf;|include /etc/nginx/http.d/\*.conf;|' /config/nginx/nginx.conf From b0b6203ef40387920402e8c9b238bc122d841251 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Fri, 25 Mar 2022 21:14:47 +0000 Subject: [PATCH 14/47] Allow disabling f2b service --- README.md | 1 + root/etc/cont-init.d/98-crowdsec | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/README.md b/README.md index 6c2af228d..f9dc482d8 100644 --- a/README.md +++ b/README.md @@ -23,6 +23,7 @@ Set the following environment variables on your SWAG container. | `CROWDSEC_SITE_KEY` | **Optional** | reCAPTCHA v2 Site Key | | `CROWDSEC_SECRET_KEY` | **Optional** | reCAPTCHA v2 Secret Key | | `CROWDSEC_VERSION` | **Optional** | Specify a version of the bouncer to install instead of using the latest release, for example `v1.0.0`. Must be a valid [release tag](https://github.com/crowdsecurity/cs-nginx-bouncer/tags). **Does not support versions older than v1.0.0**. +| `CROWDSEC_F2B_DISABLE` | **Optional** | Set to `true` to disable swag's built-in fail2ban service if you don't need it | | | | | The variables need to remain in place while you are using the mod. If you remove **required** variables the bouncer will be disabled the next time you recreate the container, if you remove **optional** variables the associated features will be disabled the next time you recreate the container. diff --git a/root/etc/cont-init.d/98-crowdsec b/root/etc/cont-init.d/98-crowdsec index 8d2b43c12..9ef169b3a 100644 --- a/root/etc/cont-init.d/98-crowdsec +++ b/root/etc/cont-init.d/98-crowdsec @@ -79,4 +79,10 @@ rm -rf \ /tmp/crowdsec \ /tmp/crowdsec.tar.gz +# Disable f2b if requested +if [[ $CROWDSEC_F2B_DISABLE == "true" ]]; then + echo "**** Disabling fail2ban Service ****" + touch /etc/services.d/fail2ban/down +fi + echo "**** Successfully configured CrowdSec nginx Bouncer ${CROWDSEC_VERSION} ****" From db8793ca5205f773374bee3be0013503cb0dae37 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Sun, 3 Apr 2022 11:07:44 +0100 Subject: [PATCH 15/47] Fix sed error. --- root/etc/cont-init.d/98-crowdsec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/root/etc/cont-init.d/98-crowdsec b/root/etc/cont-init.d/98-crowdsec index 9ef169b3a..45ccda330 100644 --- a/root/etc/cont-init.d/98-crowdsec +++ b/root/etc/cont-init.d/98-crowdsec @@ -52,8 +52,8 @@ cp -r /tmp/crowdsec/lua-mod/lib/* ${LIB_PATH} cp /tmp/crowdsec/nginx/crowdsec_nginx.conf /etc/nginx/http.d # Sed in ReCaptcha keys -sed -ir "s|SECRET_KEY=.*$|SECRET_KEY=${CROWDSEC_SECRET_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" -sed -ir "s|SITE_KEY=.*$|SITE_KEY=${CROWDSEC_SITE_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +sed -i -r "s|SECRET_KEY=.*$|SECRET_KEY=${CROWDSEC_SECRET_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +sed -i -r "s|SITE_KEY=.*$|SITE_KEY=${CROWDSEC_SITE_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" # Sed in crowdsec include if ! grep -q '[^#]include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf' && ! grep -q '[^#]include /etc/nginx/conf.d/\*.conf;' '/config/nginx/nginx.conf'; then From 9bd6d2ceca4a272baa9c3d8353d1b5393936042f Mon Sep 17 00:00:00 2001 From: TheSpad Date: Sun, 3 Apr 2022 14:29:33 +0100 Subject: [PATCH 16/47] Add note about reCAPTCHA in IPv4-only setups --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index f9dc482d8..06146b3b0 100644 --- a/README.md +++ b/README.md @@ -27,3 +27,9 @@ Set the following environment variables on your SWAG container. | | | | The variables need to remain in place while you are using the mod. If you remove **required** variables the bouncer will be disabled the next time you recreate the container, if you remove **optional** variables the associated features will be disabled the next time you recreate the container. + +### reCAPTCHA Support Notes + +If you're using the reCAPTCHA capability and you're running in an IPv4-only environment then you need to edit your `/config/nginx/resolver.conf` and add `ipv6=off` to the end of the `resolver` statement otherwise the bouncer will attempt to contact the reCAPTCHA endpoint over IPv6 and fail. + +e.g. `resolver 127.0.0.11 valid=30s ipv6=off;` From 259d7d70b88b90eded483e519e4541494870cfd7 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Fri, 29 Jul 2022 16:20:20 +0100 Subject: [PATCH 17/47] Support universal package install --- .../dependencies.d/init-mods | 0 .../s6-rc.d/init-mod-swag-crowdsec/run | 88 +++++++++++++++++++ .../s6-rc.d/init-mod-swag-crowdsec/type | 1 + .../s6-rc.d/init-mod-swag-crowdsec/up | 1 + .../dependencies.d/init-mod-swag-crowdsec | 0 5 files changed, 90 insertions(+) create mode 100644 root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/dependencies.d/init-mods create mode 100755 root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run create mode 100644 root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/type create mode 100644 root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/up create mode 100644 root/etc/s6-overlay/s6-rc.d/init-mods-package-install/dependencies.d/init-mod-swag-crowdsec diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/dependencies.d/init-mods b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/dependencies.d/init-mods new file mode 100644 index 000000000..e69de29bb diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run new file mode 100755 index 000000000..f88ceba1c --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run @@ -0,0 +1,88 @@ +#!/usr/bin/with-contenv bash + +CONFIG_PATH="/config/crowdsec/" +LIB_PATH="/usr/local/lua/crowdsec/" +DATA_PATH="/var/lib/crowdsec/lua/" + +echo "**** Configuring CrowdSec nginx Bouncer ****" + +# If API keys are missing, disable mod and exit +if [[ -z $CROWDSEC_API_KEY ]] || [[ -z $CROWDSEC_LAPI_URL ]]; then + echo "**** Missing API key or CrowdSec LAPI URL, cannot configure bouncer ****" + exit 1 +fi + +echo "\ + gettext \ + lua5.1 \ + lua5.1-cjson \ + lua-resty-http \ + lua-sec \ + nginx-mod-http-lua" >> /mod-repo-packages-to-install.list + +# Download nginx bouncer +if [ -z ${CROWDSEC_VERSION+x} ]; then \ + CROWDSEC_VERSION=$(curl -sX GET "https://api.github.com/repos/crowdsecurity/cs-nginx-bouncer/releases/latest" | awk '/tag_name/{print $4;exit}' FS='[""]'); +fi + +curl -so \ + /tmp/crowdsec.tar.gz -L \ + "https://github.com/crowdsecurity/cs-nginx-bouncer/releases/download/${CROWDSEC_VERSION}/crowdsec-nginx-bouncer.tgz" + +mkdir -p /tmp/crowdsec + +tar xf \ + /tmp/crowdsec.tar.gz -C \ + /tmp/crowdsec --strip-components=1 + +# Inject API keys into config file +mkdir -p "${CONFIG_PATH}" +API_KEY=${CROWDSEC_API_KEY} CROWDSEC_LAPI_URL=${CROWDSEC_LAPI_URL} envsubst < /tmp/crowdsec/lua-mod/config_example.conf > "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" + +# Change config path +sed -i "s|/etc/crowdsec/bouncers/|${CONFIG_PATH}|" /tmp/crowdsec/nginx/crowdsec_nginx.conf + +# Copy files +mkdir -p ${DATA_PATH}/templates/ +cp -r /tmp/crowdsec/lua-mod/templates/* ${DATA_PATH}/templates/ + +mkdir -p ${LIB_PATH}plugins/crowdsec +cp -r /tmp/crowdsec/lua-mod/lib/* ${LIB_PATH} + +cp /tmp/crowdsec/nginx/crowdsec_nginx.conf /etc/nginx/http.d + +# Sed in ReCaptcha keys +sed -i -r "s|SECRET_KEY=.*$|SECRET_KEY=${CROWDSEC_SECRET_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +sed -i -r "s|SITE_KEY=.*$|SITE_KEY=${CROWDSEC_SITE_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" + +# Sed in crowdsec include +if ! grep -q '[^#]include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf' && ! grep -q '[^#]include /etc/nginx/conf.d/\*.conf;' '/config/nginx/nginx.conf'; then + if grep -q '#include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf'; then + # Enable http.d include + sed -i 's|#include /etc/nginx/http.d/\*.conf;|include /etc/nginx/http.d/\*.conf;|' /config/nginx/nginx.conf + else + # Warn about missing http.d include + echo " + ******************************************************************** + * Warning: Your nginx.conf is missing required settings * + * Please add: * + * include /etc/nginx/http.d/*.conf; * + * to the http{} block and restart the container. * + * * + * The CrowdSec bouncer will not function until this is done. * + ********************************************************************" + fi +fi + +# Clean up +rm -rf \ + /tmp/crowdsec \ + /tmp/crowdsec.tar.gz + +# Disable f2b if requested +if [[ $CROWDSEC_F2B_DISABLE == "true" ]]; then + echo "**** Disabling fail2ban Service ****" + touch /etc/services.d/fail2ban/down +fi + +echo "**** Successfully configured CrowdSec nginx Bouncer ${CROWDSEC_VERSION} ****" diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/type b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/type new file mode 100644 index 000000000..bdd22a185 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/type @@ -0,0 +1 @@ +oneshot diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/up b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/up new file mode 100644 index 000000000..ed2c4e13a --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/up @@ -0,0 +1 @@ +/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run diff --git a/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/dependencies.d/init-mod-swag-crowdsec b/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/dependencies.d/init-mod-swag-crowdsec new file mode 100644 index 000000000..e69de29bb From 40c642530b23ac9ff11a2f74836788aad41a819d Mon Sep 17 00:00:00 2001 From: TheSpad Date: Fri, 29 Jul 2022 16:23:30 +0100 Subject: [PATCH 18/47] Add to user bundle --- .../dependencies.d/init-mods-swag-crowdsec} | 0 .../dependencies.d/init-mods} | 0 .../{init-mod-swag-crowdsec => init-mods-swag-crowdsec}/run | 0 .../{init-mod-swag-crowdsec => init-mods-swag-crowdsec}/type | 0 .../{init-mod-swag-crowdsec => init-mods-swag-crowdsec}/up | 0 .../s6-overlay/s6-rc.d/user/contents.d/init-mods-swag-crowdsec | 0 6 files changed, 0 insertions(+), 0 deletions(-) rename root/etc/s6-overlay/s6-rc.d/{init-mod-swag-crowdsec/dependencies.d/init-mods => init-mods-package-install/dependencies.d/init-mods-swag-crowdsec} (100%) rename root/etc/s6-overlay/s6-rc.d/{init-mods-package-install/dependencies.d/init-mod-swag-crowdsec => init-mods-swag-crowdsec/dependencies.d/init-mods} (100%) rename root/etc/s6-overlay/s6-rc.d/{init-mod-swag-crowdsec => init-mods-swag-crowdsec}/run (100%) rename root/etc/s6-overlay/s6-rc.d/{init-mod-swag-crowdsec => init-mods-swag-crowdsec}/type (100%) rename root/etc/s6-overlay/s6-rc.d/{init-mod-swag-crowdsec => init-mods-swag-crowdsec}/up (100%) create mode 100644 root/etc/s6-overlay/s6-rc.d/user/contents.d/init-mods-swag-crowdsec diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/dependencies.d/init-mods b/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/dependencies.d/init-mods-swag-crowdsec similarity index 100% rename from root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/dependencies.d/init-mods rename to root/etc/s6-overlay/s6-rc.d/init-mods-package-install/dependencies.d/init-mods-swag-crowdsec diff --git a/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/dependencies.d/init-mod-swag-crowdsec b/root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/dependencies.d/init-mods similarity index 100% rename from root/etc/s6-overlay/s6-rc.d/init-mods-package-install/dependencies.d/init-mod-swag-crowdsec rename to root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/dependencies.d/init-mods diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/run similarity index 100% rename from root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run rename to root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/run diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/type b/root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/type similarity index 100% rename from root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/type rename to root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/type diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/up b/root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/up similarity index 100% rename from root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/up rename to root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/up diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-mods-swag-crowdsec b/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-mods-swag-crowdsec new file mode 100644 index 000000000..e69de29bb From d559049f4569dcbd3c4b86c9099a8a8896d08e33 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Mon, 1 Aug 2022 14:58:28 +0100 Subject: [PATCH 19/47] Fix mod/mods naming --- .../dependencies.d/init-mods | 0 .../{init-mods-swag-crowdsec => init-mod-swag-crowdsec}/run | 0 .../{init-mods-swag-crowdsec => init-mod-swag-crowdsec}/type | 0 .../{init-mods-swag-crowdsec => init-mod-swag-crowdsec}/up | 0 .../dependencies.d/init-mod-swag-crowdsec} | 0 .../dependencies.d/init-mod-swag-crowdsec} | 0 .../etc/s6-overlay/s6-rc.d/user/contents.d/init-mod-swag-crowdsec | 0 7 files changed, 0 insertions(+), 0 deletions(-) rename root/etc/s6-overlay/s6-rc.d/{init-mods-swag-crowdsec => init-mod-swag-crowdsec}/dependencies.d/init-mods (100%) rename root/etc/s6-overlay/s6-rc.d/{init-mods-swag-crowdsec => init-mod-swag-crowdsec}/run (100%) rename root/etc/s6-overlay/s6-rc.d/{init-mods-swag-crowdsec => init-mod-swag-crowdsec}/type (100%) rename root/etc/s6-overlay/s6-rc.d/{init-mods-swag-crowdsec => init-mod-swag-crowdsec}/up (100%) rename root/etc/s6-overlay/s6-rc.d/{init-mods-package-install/dependencies.d/init-mods-swag-crowdsec => init-mods-end/dependencies.d/init-mod-swag-crowdsec} (100%) rename root/etc/s6-overlay/s6-rc.d/{user/contents.d/init-mods-swag-crowdsec => init-mods-package-install/dependencies.d/init-mod-swag-crowdsec} (100%) create mode 100644 root/etc/s6-overlay/s6-rc.d/user/contents.d/init-mod-swag-crowdsec diff --git a/root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/dependencies.d/init-mods b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/dependencies.d/init-mods similarity index 100% rename from root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/dependencies.d/init-mods rename to root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/dependencies.d/init-mods diff --git a/root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run similarity index 100% rename from root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/run rename to root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run diff --git a/root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/type b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/type similarity index 100% rename from root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/type rename to root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/type diff --git a/root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/up b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/up similarity index 100% rename from root/etc/s6-overlay/s6-rc.d/init-mods-swag-crowdsec/up rename to root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/up diff --git a/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/dependencies.d/init-mods-swag-crowdsec b/root/etc/s6-overlay/s6-rc.d/init-mods-end/dependencies.d/init-mod-swag-crowdsec similarity index 100% rename from root/etc/s6-overlay/s6-rc.d/init-mods-package-install/dependencies.d/init-mods-swag-crowdsec rename to root/etc/s6-overlay/s6-rc.d/init-mods-end/dependencies.d/init-mod-swag-crowdsec diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-mods-swag-crowdsec b/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/dependencies.d/init-mod-swag-crowdsec similarity index 100% rename from root/etc/s6-overlay/s6-rc.d/user/contents.d/init-mods-swag-crowdsec rename to root/etc/s6-overlay/s6-rc.d/init-mods-package-install/dependencies.d/init-mod-swag-crowdsec diff --git a/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-mod-swag-crowdsec b/root/etc/s6-overlay/s6-rc.d/user/contents.d/init-mod-swag-crowdsec new file mode 100644 index 000000000..e69de29bb From dc03c94f88fcd659031ce3c9cc804b92976f90d8 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Sun, 21 Aug 2022 20:25:49 +0100 Subject: [PATCH 20/47] Persist user changes to crowdsec conf --- root/etc/cont-init.d/98-crowdsec | 17 +++++++++++------ .../s6-rc.d/init-mod-swag-crowdsec/run | 17 +++++++++++------ 2 files changed, 22 insertions(+), 12 deletions(-) diff --git a/root/etc/cont-init.d/98-crowdsec b/root/etc/cont-init.d/98-crowdsec index 45ccda330..17e008326 100644 --- a/root/etc/cont-init.d/98-crowdsec +++ b/root/etc/cont-init.d/98-crowdsec @@ -35,9 +35,18 @@ tar xf \ /tmp/crowdsec.tar.gz -C \ /tmp/crowdsec --strip-components=1 -# Inject API keys into config file mkdir -p "${CONFIG_PATH}" -API_KEY=${CROWDSEC_API_KEY} CROWDSEC_LAPI_URL=${CROWDSEC_LAPI_URL} envsubst < /tmp/crowdsec/lua-mod/config_example.conf > "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +if [ ! -f "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" ]; then \ + cp /tmp/crowdsec/lua-mod/config_example.conf "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +fi + +# Inject API keys into config file +sed -i -r "s|API_KEY=.*$|API_KEY=${CROWDSEC_API_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +sed -i -r "s|API_URL=.*$|API_URL=${CROWDSEC_LAPI_URL}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" + +# Sed in ReCaptcha keys +sed -i -r "s|SECRET_KEY=.*$|SECRET_KEY=${CROWDSEC_SECRET_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +sed -i -r "s|SITE_KEY=.*$|SITE_KEY=${CROWDSEC_SITE_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" # Change config path sed -i "s|/etc/crowdsec/bouncers/|${CONFIG_PATH}|" /tmp/crowdsec/nginx/crowdsec_nginx.conf @@ -51,10 +60,6 @@ cp -r /tmp/crowdsec/lua-mod/lib/* ${LIB_PATH} cp /tmp/crowdsec/nginx/crowdsec_nginx.conf /etc/nginx/http.d -# Sed in ReCaptcha keys -sed -i -r "s|SECRET_KEY=.*$|SECRET_KEY=${CROWDSEC_SECRET_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" -sed -i -r "s|SITE_KEY=.*$|SITE_KEY=${CROWDSEC_SITE_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" - # Sed in crowdsec include if ! grep -q '[^#]include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf' && ! grep -q '[^#]include /etc/nginx/conf.d/\*.conf;' '/config/nginx/nginx.conf'; then if grep -q '#include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf'; then diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run index f88ceba1c..656415afc 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run @@ -35,9 +35,18 @@ tar xf \ /tmp/crowdsec.tar.gz -C \ /tmp/crowdsec --strip-components=1 -# Inject API keys into config file mkdir -p "${CONFIG_PATH}" -API_KEY=${CROWDSEC_API_KEY} CROWDSEC_LAPI_URL=${CROWDSEC_LAPI_URL} envsubst < /tmp/crowdsec/lua-mod/config_example.conf > "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +if [ ! -f "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" ]; then \ + cp /tmp/crowdsec/lua-mod/config_example.conf "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +fi + +# Inject API keys into config file +sed -i -r "s|API_KEY=.*$|API_KEY=${CROWDSEC_API_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +sed -i -r "s|API_URL=.*$|API_URL=${CROWDSEC_LAPI_URL}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" + +# Sed in ReCaptcha keys +sed -i -r "s|SECRET_KEY=.*$|SECRET_KEY=${CROWDSEC_SECRET_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +sed -i -r "s|SITE_KEY=.*$|SITE_KEY=${CROWDSEC_SITE_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" # Change config path sed -i "s|/etc/crowdsec/bouncers/|${CONFIG_PATH}|" /tmp/crowdsec/nginx/crowdsec_nginx.conf @@ -51,10 +60,6 @@ cp -r /tmp/crowdsec/lua-mod/lib/* ${LIB_PATH} cp /tmp/crowdsec/nginx/crowdsec_nginx.conf /etc/nginx/http.d -# Sed in ReCaptcha keys -sed -i -r "s|SECRET_KEY=.*$|SECRET_KEY=${CROWDSEC_SECRET_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" -sed -i -r "s|SITE_KEY=.*$|SITE_KEY=${CROWDSEC_SITE_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" - # Sed in crowdsec include if ! grep -q '[^#]include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf' && ! grep -q '[^#]include /etc/nginx/conf.d/\*.conf;' '/config/nginx/nginx.conf'; then if grep -q '#include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf'; then From b3ebeb5c7e48fc1f5456a769284d17ded64eabd0 Mon Sep 17 00:00:00 2001 From: SS <23506499+slimshizn@users.noreply.github.com> Date: Thu, 6 Oct 2022 16:37:14 -0400 Subject: [PATCH 21/47] Update README.md --- README.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/README.md b/README.md index 06146b3b0..744a3f2cc 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,12 @@ # CrowdSec - Docker mod for SWAG +## nginx.conf change + +Make sure that the line below under virtual hosts in your nginx.conf, otherwise crowdsec-bouncer will not work. More information here https://info.linuxserver.io/issues/2022-08-20-nginx-base/ + + # Includes virtual hosts configs. + include /etc/nginx/http.d/*.conf; + This mod adds the [CrowdSec](https://crowdsec.net) [nginx bouncer](https://github.com/crowdsecurity/cs-nginx-bouncer/) to SWAG, to be installed/updated during container start. In SWAG docker arguments, set an environment variable `DOCKER_MODS=linuxserver/mods:swag-crowdsec` From e4ea7e0cd8d37d170b43c8d5f1ce86adfd6bee6f Mon Sep 17 00:00:00 2001 From: SS <23506499+slimshizn@users.noreply.github.com> Date: Tue, 18 Oct 2022 17:55:46 -0400 Subject: [PATCH 22/47] Update README.md fix sentence --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 744a3f2cc..04837586e 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ ## nginx.conf change -Make sure that the line below under virtual hosts in your nginx.conf, otherwise crowdsec-bouncer will not work. More information here https://info.linuxserver.io/issues/2022-08-20-nginx-base/ +Make sure that the line below, under virtual hosts, is in your nginx.conf, otherwise crowdsec-bouncer will not work. More information here https://info.linuxserver.io/issues/2022-08-20-nginx-base/ # Includes virtual hosts configs. include /etc/nginx/http.d/*.conf; From c225cff982d3a3fce543c13ce302172b68b3e8fd Mon Sep 17 00:00:00 2001 From: TheSpad Date: Thu, 26 Jan 2023 17:24:31 +0000 Subject: [PATCH 23/47] Update to handle f2b_diable with s6rc init. Include #565. --- .editorconfig | 20 +++++++++++++++++++ README.md | 2 ++ root/etc/cont-init.d/98-crowdsec | 9 +++++++-- .../dependencies.d/legacy-services | 0 .../s6-rc.d/init-mod-swag-crowdsec-f2b/run | 8 ++++++++ .../s6-rc.d/init-mod-swag-crowdsec-f2b/type | 1 + .../s6-rc.d/init-mod-swag-crowdsec-f2b/up | 1 + .../s6-rc.d/init-mod-swag-crowdsec/run | 15 +++++++------- .../contents.d/init-mod-swag-crowdsec-f2b | 0 9 files changed, 46 insertions(+), 10 deletions(-) create mode 100755 .editorconfig create mode 100644 root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/dependencies.d/legacy-services create mode 100755 root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/run create mode 100644 root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/type create mode 100644 root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/up create mode 100644 root/etc/s6-overlay/s6-rc.d/user2/contents.d/init-mod-swag-crowdsec-f2b diff --git a/.editorconfig b/.editorconfig new file mode 100755 index 000000000..a92f7dfd8 --- /dev/null +++ b/.editorconfig @@ -0,0 +1,20 @@ +# This file is globally distributed to all container image projects from +# https://github.com/linuxserver/docker-jenkins-builder/blob/master/.editorconfig + +# top-most EditorConfig file +root = true + +# Unix-style newlines with a newline ending every file +[*] +end_of_line = lf +insert_final_newline = true +# trim_trailing_whitespace may cause unintended issues and should not be globally set true +trim_trailing_whitespace = false + +[{Dockerfile*,**.yml}] +indent_style = space +indent_size = 2 + +[{**.sh,root/etc/cont-init.d/**,root/etc/services.d/**}] +indent_style = space +indent_size = 4 diff --git a/README.md b/README.md index 04837586e..ad470839a 100644 --- a/README.md +++ b/README.md @@ -31,6 +31,8 @@ Set the following environment variables on your SWAG container. | `CROWDSEC_SECRET_KEY` | **Optional** | reCAPTCHA v2 Secret Key | | `CROWDSEC_VERSION` | **Optional** | Specify a version of the bouncer to install instead of using the latest release, for example `v1.0.0`. Must be a valid [release tag](https://github.com/crowdsecurity/cs-nginx-bouncer/tags). **Does not support versions older than v1.0.0**. | `CROWDSEC_F2B_DISABLE` | **Optional** | Set to `true` to disable swag's built-in fail2ban service if you don't need it | +| `CROWDSEC_MODE` | **Optional** | Set to `live` (immediate update) or `stream` to update requests every CROWDSEC_UPDATE_FREQUENCY seconds. Defaults to `live` | +| `CROWDSEC_UPDATE_FREQUENCY` | **Optional** | Set update frequency for use with `stream` mode. Defaults to `10`. | | | | | The variables need to remain in place while you are using the mod. If you remove **required** variables the bouncer will be disabled the next time you recreate the container, if you remove **optional** variables the associated features will be disabled the next time you recreate the container. diff --git a/root/etc/cont-init.d/98-crowdsec b/root/etc/cont-init.d/98-crowdsec index 17e008326..215ed28a1 100644 --- a/root/etc/cont-init.d/98-crowdsec +++ b/root/etc/cont-init.d/98-crowdsec @@ -1,4 +1,5 @@ #!/usr/bin/with-contenv bash +# shellcheck shell=bash CONFIG_PATH="/config/crowdsec/" LIB_PATH="/usr/local/lua/crowdsec/" @@ -21,7 +22,7 @@ apk add -U --upgrade --no-cache \ nginx-mod-http-lua # Download nginx bouncer -if [ -z ${CROWDSEC_VERSION+x} ]; then \ +if [[ -z ${CROWDSEC_VERSION+x} ]]; then \ CROWDSEC_VERSION=$(curl -sX GET "https://api.github.com/repos/crowdsecurity/cs-nginx-bouncer/releases/latest" | awk '/tag_name/{print $4;exit}' FS='[""]'); fi @@ -36,7 +37,7 @@ tar xf \ /tmp/crowdsec --strip-components=1 mkdir -p "${CONFIG_PATH}" -if [ ! -f "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" ]; then \ +if [[ ! -f "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" ]]; then \ cp /tmp/crowdsec/lua-mod/config_example.conf "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" fi @@ -48,6 +49,10 @@ sed -i -r "s|API_URL=.*$|API_URL=${CROWDSEC_LAPI_URL}|" "${CONFIG_PATH}crowdsec- sed -i -r "s|SECRET_KEY=.*$|SECRET_KEY=${CROWDSEC_SECRET_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" sed -i -r "s|SITE_KEY=.*$|SITE_KEY=${CROWDSEC_SITE_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +# Sed in CROWDSEC_MODE and UPDATE_FREQUENCY, if defined in the env, defaults to live and 10s +sed -i -r "s|MODE=.*$|MODE=${CROWDSEC_MODE:-live}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +sed -i -r "s|UPDATE_FREQUENCY=.*$|UPDATE_FREQUENCY=${CROWDSEC_UPDATE_FREQUENCY:-10}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" + # Change config path sed -i "s|/etc/crowdsec/bouncers/|${CONFIG_PATH}|" /tmp/crowdsec/nginx/crowdsec_nginx.conf diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/dependencies.d/legacy-services b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/dependencies.d/legacy-services new file mode 100644 index 000000000..e69de29bb diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/run new file mode 100755 index 000000000..f50ca78eb --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/run @@ -0,0 +1,8 @@ +#!/usr/bin/with-contenv bash +# shellcheck shell=bash + +# Disable f2b if requested +if [[ ${CROWDSEC_F2B_DISABLE,,} == "true" ]]; then + echo "**** Disabling fail2ban Service ****" + s6-svc -d /run/service/svc-fail2ban +fi diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/type b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/type new file mode 100644 index 000000000..bdd22a185 --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/type @@ -0,0 +1 @@ +oneshot diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/up b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/up new file mode 100644 index 000000000..e92164d6a --- /dev/null +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/up @@ -0,0 +1 @@ +/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/run diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run index 656415afc..7453108b9 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run @@ -1,4 +1,5 @@ #!/usr/bin/with-contenv bash +# shellcheck shell=bash CONFIG_PATH="/config/crowdsec/" LIB_PATH="/usr/local/lua/crowdsec/" @@ -21,7 +22,7 @@ echo "\ nginx-mod-http-lua" >> /mod-repo-packages-to-install.list # Download nginx bouncer -if [ -z ${CROWDSEC_VERSION+x} ]; then \ +if [[ -z ${CROWDSEC_VERSION+x} ]]; then \ CROWDSEC_VERSION=$(curl -sX GET "https://api.github.com/repos/crowdsecurity/cs-nginx-bouncer/releases/latest" | awk '/tag_name/{print $4;exit}' FS='[""]'); fi @@ -36,7 +37,7 @@ tar xf \ /tmp/crowdsec --strip-components=1 mkdir -p "${CONFIG_PATH}" -if [ ! -f "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" ]; then \ +if [[ ! -f "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" ]]; then \ cp /tmp/crowdsec/lua-mod/config_example.conf "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" fi @@ -48,6 +49,10 @@ sed -i -r "s|API_URL=.*$|API_URL=${CROWDSEC_LAPI_URL}|" "${CONFIG_PATH}crowdsec- sed -i -r "s|SECRET_KEY=.*$|SECRET_KEY=${CROWDSEC_SECRET_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" sed -i -r "s|SITE_KEY=.*$|SITE_KEY=${CROWDSEC_SITE_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +# Sed in CROWDSEC_MODE and UPDATE_FREQUENCY, if defined in the env, defaults to live and 10s +sed -i -r "s|MODE=.*$|MODE=${CROWDSEC_MODE:-live}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +sed -i -r "s|UPDATE_FREQUENCY=.*$|UPDATE_FREQUENCY=${CROWDSEC_UPDATE_FREQUENCY:-10}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" + # Change config path sed -i "s|/etc/crowdsec/bouncers/|${CONFIG_PATH}|" /tmp/crowdsec/nginx/crowdsec_nginx.conf @@ -84,10 +89,4 @@ rm -rf \ /tmp/crowdsec \ /tmp/crowdsec.tar.gz -# Disable f2b if requested -if [[ $CROWDSEC_F2B_DISABLE == "true" ]]; then - echo "**** Disabling fail2ban Service ****" - touch /etc/services.d/fail2ban/down -fi - echo "**** Successfully configured CrowdSec nginx Bouncer ${CROWDSEC_VERSION} ****" diff --git a/root/etc/s6-overlay/s6-rc.d/user2/contents.d/init-mod-swag-crowdsec-f2b b/root/etc/s6-overlay/s6-rc.d/user2/contents.d/init-mod-swag-crowdsec-f2b new file mode 100644 index 000000000..e69de29bb From 16e1212a1253b8b94bf3cd816456c859d0a6e0c4 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Sat, 28 Jan 2023 15:21:11 +0000 Subject: [PATCH 24/47] Update readme --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index ad470839a..9d69dadc7 100644 --- a/README.md +++ b/README.md @@ -42,3 +42,9 @@ The variables need to remain in place while you are using the mod. If you remove If you're using the reCAPTCHA capability and you're running in an IPv4-only environment then you need to edit your `/config/nginx/resolver.conf` and add `ipv6=off` to the end of the `resolver` statement otherwise the bouncer will attempt to contact the reCAPTCHA endpoint over IPv6 and fail. e.g. `resolver 127.0.0.11 valid=30s ipv6=off;` + +## Versions + +* **28.01.23:** - Support mode selection, handle s6v3 init. +* **25.08.22:** - Make hybrid mod. +* **14.03.22:** - Initial Release. From 5c921503cdcaeea2f66b6d5920cf2f0a5fafed99 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Sun, 12 Feb 2023 12:31:21 +0000 Subject: [PATCH 25/47] Remove f2b logrotate if service is disabled. Sanity check tarball. --- root/etc/cont-init.d/98-crowdsec | 6 ++++++ root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/run | 1 + root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run | 5 +++++ 3 files changed, 12 insertions(+) diff --git a/root/etc/cont-init.d/98-crowdsec b/root/etc/cont-init.d/98-crowdsec index 215ed28a1..b55104d03 100644 --- a/root/etc/cont-init.d/98-crowdsec +++ b/root/etc/cont-init.d/98-crowdsec @@ -32,6 +32,11 @@ curl -so \ mkdir -p /tmp/crowdsec +if ! tar -tzf /crowdsec.tar.gz >/dev/null 2>&1; then + echo "**** Invalid tarball, could not download crowdsec bouncer ****" + exit 1 +fi + tar xf \ /tmp/crowdsec.tar.gz -C \ /tmp/crowdsec --strip-components=1 @@ -93,6 +98,7 @@ rm -rf \ if [[ $CROWDSEC_F2B_DISABLE == "true" ]]; then echo "**** Disabling fail2ban Service ****" touch /etc/services.d/fail2ban/down + rm -rf /etc/logrotate.d/fail2ban fi echo "**** Successfully configured CrowdSec nginx Bouncer ${CROWDSEC_VERSION} ****" diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/run index f50ca78eb..ed373e150 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec-f2b/run @@ -5,4 +5,5 @@ if [[ ${CROWDSEC_F2B_DISABLE,,} == "true" ]]; then echo "**** Disabling fail2ban Service ****" s6-svc -d /run/service/svc-fail2ban + rm -rf /etc/logrotate.d/fail2ban fi diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run index 7453108b9..8b6eb4209 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run @@ -32,6 +32,11 @@ curl -so \ mkdir -p /tmp/crowdsec +if ! tar -tzf /crowdsec.tar.gz >/dev/null 2>&1; then + echo "**** Invalid tarball, could not download crowdsec bouncer ****" + exit 1 +fi + tar xf \ /tmp/crowdsec.tar.gz -C \ /tmp/crowdsec --strip-components=1 From 09d5fccfa93b7556132174956d24895a68a8abf7 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Sun, 12 Feb 2023 16:52:01 +0000 Subject: [PATCH 26/47] Fix tarball path --- root/etc/cont-init.d/98-crowdsec | 2 +- root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/root/etc/cont-init.d/98-crowdsec b/root/etc/cont-init.d/98-crowdsec index b55104d03..0004d0b5b 100644 --- a/root/etc/cont-init.d/98-crowdsec +++ b/root/etc/cont-init.d/98-crowdsec @@ -32,7 +32,7 @@ curl -so \ mkdir -p /tmp/crowdsec -if ! tar -tzf /crowdsec.tar.gz >/dev/null 2>&1; then +if ! tar -tzf /tmp/crowdsec.tar.gz >/dev/null 2>&1; then echo "**** Invalid tarball, could not download crowdsec bouncer ****" exit 1 fi diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run index 8b6eb4209..6c7661313 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run @@ -32,7 +32,7 @@ curl -so \ mkdir -p /tmp/crowdsec -if ! tar -tzf /crowdsec.tar.gz >/dev/null 2>&1; then +if ! tar -tzf /tmp/crowdsec.tar.gz >/dev/null 2>&1; then echo "**** Invalid tarball, could not download crowdsec bouncer ****" exit 1 fi From 3573430b91fc254651efeaf8dd22fc65feb35859 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Sat, 18 Mar 2023 15:58:02 +0000 Subject: [PATCH 27/47] Set checkout action to use major version tag --- .github/workflows/BuildImage.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/BuildImage.yml b/.github/workflows/BuildImage.yml index 5b957cb21..c6fb63c19 100644 --- a/.github/workflows/BuildImage.yml +++ b/.github/workflows/BuildImage.yml @@ -11,7 +11,7 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2.3.3 + - uses: actions/checkout@v3 - name: Build image run: | From 3a6b410e891efd3c527b0ff241e44544bceec378 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Wed, 29 Mar 2023 19:18:30 +0100 Subject: [PATCH 28/47] Add support for multiple captcha providers --- README.md | 6 ++++-- root/etc/cont-init.d/98-crowdsec | 3 ++- root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run | 3 ++- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 9d69dadc7..3ca7a9a9e 100644 --- a/README.md +++ b/README.md @@ -27,8 +27,9 @@ Set the following environment variables on your SWAG container. | --- | --- | --- | | `CROWDSEC_API_KEY` | **Required** | Your bouncer API key | | `CROWDSEC_LAPI_URL` | **Required** | Your local CrowdSec API endpoint, for example `http://crowdsec:8080` | -| `CROWDSEC_SITE_KEY` | **Optional** | reCAPTCHA v2 Site Key | -| `CROWDSEC_SECRET_KEY` | **Optional** | reCAPTCHA v2 Secret Key | +| `CROWDSEC_SITE_KEY` | **Optional** | CAPTCHA Site Key | +| `CROWDSEC_SECRET_KEY` | **Optional** | CAPTCHA Secret Key | +| `CROWDSEC_CAPTCHA_PROVIDER` | **Optional** | CAPTCHA Provider (currently supported providers are `recaptcha`, `hcaptcha`, `turnstile`), requires v1.0.5 or newer. | | `CROWDSEC_VERSION` | **Optional** | Specify a version of the bouncer to install instead of using the latest release, for example `v1.0.0`. Must be a valid [release tag](https://github.com/crowdsecurity/cs-nginx-bouncer/tags). **Does not support versions older than v1.0.0**. | `CROWDSEC_F2B_DISABLE` | **Optional** | Set to `true` to disable swag's built-in fail2ban service if you don't need it | | `CROWDSEC_MODE` | **Optional** | Set to `live` (immediate update) or `stream` to update requests every CROWDSEC_UPDATE_FREQUENCY seconds. Defaults to `live` | @@ -45,6 +46,7 @@ e.g. `resolver 127.0.0.11 valid=30s ipv6=off;` ## Versions +* **29.03.23:** - Support multiple captcha providers from upstream. * **28.01.23:** - Support mode selection, handle s6v3 init. * **25.08.22:** - Make hybrid mod. * **14.03.22:** - Initial Release. diff --git a/root/etc/cont-init.d/98-crowdsec b/root/etc/cont-init.d/98-crowdsec index 0004d0b5b..0b7df917f 100644 --- a/root/etc/cont-init.d/98-crowdsec +++ b/root/etc/cont-init.d/98-crowdsec @@ -50,9 +50,10 @@ fi sed -i -r "s|API_KEY=.*$|API_KEY=${CROWDSEC_API_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" sed -i -r "s|API_URL=.*$|API_URL=${CROWDSEC_LAPI_URL}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" -# Sed in ReCaptcha keys +# Sed in ReCaptcha settings sed -i -r "s|SECRET_KEY=.*$|SECRET_KEY=${CROWDSEC_SECRET_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" sed -i -r "s|SITE_KEY=.*$|SITE_KEY=${CROWDSEC_SITE_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +sed -i -r "s|CAPTCHA_PROVIDER=.*$|CAPTCHA_PROVIDER=${CROWDSEC_CAPTCHA_PROVIDER}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" # Sed in CROWDSEC_MODE and UPDATE_FREQUENCY, if defined in the env, defaults to live and 10s sed -i -r "s|MODE=.*$|MODE=${CROWDSEC_MODE:-live}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run index 6c7661313..eff2bf61f 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run @@ -50,9 +50,10 @@ fi sed -i -r "s|API_KEY=.*$|API_KEY=${CROWDSEC_API_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" sed -i -r "s|API_URL=.*$|API_URL=${CROWDSEC_LAPI_URL}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" -# Sed in ReCaptcha keys +# Sed in ReCaptcha settings sed -i -r "s|SECRET_KEY=.*$|SECRET_KEY=${CROWDSEC_SECRET_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" sed -i -r "s|SITE_KEY=.*$|SITE_KEY=${CROWDSEC_SITE_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +sed -i -r "s|CAPTCHA_PROVIDER=.*$|CAPTCHA_PROVIDER=${CROWDSEC_CAPTCHA_PROVIDER}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" # Sed in CROWDSEC_MODE and UPDATE_FREQUENCY, if defined in the env, defaults to live and 10s sed -i -r "s|MODE=.*$|MODE=${CROWDSEC_MODE:-live}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" From 11408dc5be56a6d5f26ed11950b743e33919bd86 Mon Sep 17 00:00:00 2001 From: aptalca <541623+aptalca@users.noreply.github.com> Date: Thu, 18 May 2023 14:50:37 -0400 Subject: [PATCH 29/47] swag-crowdsec update/add workflows --- .github/workflows/BuildImage.yml | 81 ++++++--------- .github/workflows/call_issue_pr_tracker.yml | 16 +++ .github/workflows/permissions.yml | 10 ++ Dockerfile | 2 + root/etc/cont-init.d/98-crowdsec | 105 -------------------- 5 files changed, 60 insertions(+), 154 deletions(-) create mode 100644 .github/workflows/call_issue_pr_tracker.yml create mode 100644 .github/workflows/permissions.yml delete mode 100644 root/etc/cont-init.d/98-crowdsec diff --git a/.github/workflows/BuildImage.yml b/.github/workflows/BuildImage.yml index c6fb63c19..bc1526585 100644 --- a/.github/workflows/BuildImage.yml +++ b/.github/workflows/BuildImage.yml @@ -1,62 +1,45 @@ name: Build Image -on: [push, pull_request, workflow_dispatch] +on: [push, pull_request_target, workflow_dispatch] env: + GITHUB_REPO: "linuxserver/docker-mods" #don't modify ENDPOINT: "linuxserver/mods" #don't modify BASEIMAGE: "swag" #replace MODNAME: "crowdsec" #replace jobs: - build: + set-vars: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 - - - name: Build image - run: | - docker build --no-cache -t ${{ github.sha }} . - - - name: Tag image - if: ${{ github.ref == format('refs/heads/{0}-{1}', env.BASEIMAGE, env.MODNAME) }} - run: | - docker tag ${{ github.sha }} ${ENDPOINT}:${BASEIMAGE}-${MODNAME} - docker tag ${{ github.sha }} ${ENDPOINT}:${BASEIMAGE}-${MODNAME}-${{ github.sha }} - docker tag ${{ github.sha }} ghcr.io/${ENDPOINT}:${BASEIMAGE}-${MODNAME} - docker tag ${{ github.sha }} ghcr.io/${ENDPOINT}:${BASEIMAGE}-${MODNAME}-${{ github.sha }} - - - name: Credential check - if: ${{ github.ref == format('refs/heads/{0}-{1}', env.BASEIMAGE, env.MODNAME) }} - run: | - echo "CR_USER=${{ secrets.CR_USER }}" >> $GITHUB_ENV - echo "CR_PAT=${{ secrets.CR_PAT }}" >> $GITHUB_ENV - echo "DOCKERUSER=${{ secrets.DOCKERUSER }}" >> $GITHUB_ENV - echo "DOCKERPASS=${{ secrets.DOCKERPASS }}" >> $GITHUB_ENV - if [[ "${{ secrets.CR_USER }}" == "" && "${{ secrets.CR_PAT }}" == "" && "${{ secrets.DOCKERUSER }}" == "" && "${{ secrets.DOCKERPASS }}" == "" ]]; then - echo "::error::Push credential secrets missing." - echo "::error::You must set either CR_USER & CR_PAT or DOCKERUSER & DOCKERPASS as secrets in your repo settings." - echo "::error::See https://github.com/linuxserver/docker-mods/blob/master/README.md for more information/instructions." - exit 1 - fi - - - name: Login to GitHub Container Registry - if: ${{ github.ref == format('refs/heads/{0}-{1}', env.BASEIMAGE, env.MODNAME) && env.CR_USER && env.CR_PAT }} - run: | - echo "${{ secrets.CR_PAT }}" | docker login ghcr.io -u ${{ secrets.CR_USER }} --password-stdin - - - name: Push tags to GitHub Container Registry - if: ${{ github.ref == format('refs/heads/{0}-{1}', env.BASEIMAGE, env.MODNAME) && env.CR_USER && env.CR_PAT }} + - name: Set Vars + id: outputs run: | - docker push ghcr.io/${ENDPOINT}:${BASEIMAGE}-${MODNAME}-${{ github.sha }} - docker push ghcr.io/${ENDPOINT}:${BASEIMAGE}-${MODNAME} + echo "GITHUB_REPO=${{ env.GITHUB_REPO }}" >> $GITHUB_OUTPUT + echo "ENDPOINT=${{ env.ENDPOINT }}" >> $GITHUB_OUTPUT + echo "BASEIMAGE=${{ env.BASEIMAGE }}" >> $GITHUB_OUTPUT + echo "MODNAME=${{ env.MODNAME }}" >> $GITHUB_OUTPUT + # **** If the mod needs to be versioned, set the versioning logic below. Otherwise leave as is. **** + MOD_VERSION="" + echo "MOD_VERSION=${MOD_VERSION}" >> $GITHUB_OUTPUT + outputs: + GITHUB_REPO: ${{ steps.outputs.outputs.GITHUB_REPO }} + ENDPOINT: ${{ steps.outputs.outputs.ENDPOINT }} + BASEIMAGE: ${{ steps.outputs.outputs.BASEIMAGE }} + MODNAME: ${{ steps.outputs.outputs.MODNAME }} + MOD_VERSION: ${{ steps.outputs.outputs.MOD_VERSION }} - - name: Login to DockerHub - if: ${{ github.ref == format('refs/heads/{0}-{1}', env.BASEIMAGE, env.MODNAME) && env.DOCKERUSER && env.DOCKERPASS }} - run: | - echo ${{ secrets.DOCKERPASS }} | docker login -u ${{ secrets.DOCKERUSER }} --password-stdin - - - name: Push tags to DockerHub - if: ${{ github.ref == format('refs/heads/{0}-{1}', env.BASEIMAGE, env.MODNAME) && env.DOCKERUSER && env.DOCKERPASS }} - run: | - docker push ${ENDPOINT}:${BASEIMAGE}-${MODNAME}-${{ github.sha }} - docker push ${ENDPOINT}:${BASEIMAGE}-${MODNAME} + build: + uses: linuxserver/github-workflows/.github/workflows/docker-mod-builder.yml@v1 + needs: set-vars + secrets: + CR_USER: ${{ secrets.CR_USER }} + CR_PAT: ${{ secrets.CR_PAT }} + DOCKERUSER: ${{ secrets.DOCKERUSER }} + DOCKERPASS: ${{ secrets.DOCKERPASS }} + with: + GITHUB_REPO: ${{ needs.set-vars.outputs.GITHUB_REPO }} + ENDPOINT: ${{ needs.set-vars.outputs.ENDPOINT }} + BASEIMAGE: ${{ needs.set-vars.outputs.BASEIMAGE }} + MODNAME: ${{ needs.set-vars.outputs.MODNAME }} + MOD_VERSION: ${{ needs.set-vars.outputs.MOD_VERSION }} diff --git a/.github/workflows/call_issue_pr_tracker.yml b/.github/workflows/call_issue_pr_tracker.yml new file mode 100644 index 000000000..2c3078434 --- /dev/null +++ b/.github/workflows/call_issue_pr_tracker.yml @@ -0,0 +1,16 @@ +name: Issue & PR Tracker + +on: + issues: + types: [opened,reopened,labeled,unlabeled,closed] + pull_request_target: + types: [opened,reopened,review_requested,review_request_removed,labeled,unlabeled,closed] + pull_request_review: + types: [submitted,edited,dismissed] + +jobs: + manage-project: + permissions: + issues: write + uses: linuxserver/github-workflows/.github/workflows/issue-pr-tracker.yml@v1 + secrets: inherit diff --git a/.github/workflows/permissions.yml b/.github/workflows/permissions.yml new file mode 100644 index 000000000..1447bc55a --- /dev/null +++ b/.github/workflows/permissions.yml @@ -0,0 +1,10 @@ +name: Permission check +on: + pull_request_target: + paths: + - '**/run' + - '**/finish' + - '**/check' +jobs: + permission_check: + uses: linuxserver/github-workflows/.github/workflows/init-svc-executable-permissions.yml@v1 diff --git a/Dockerfile b/Dockerfile index 2a0c3cb46..170297667 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,3 +1,5 @@ +# syntax=docker/dockerfile:1 + FROM scratch LABEL maintainer="thespad" diff --git a/root/etc/cont-init.d/98-crowdsec b/root/etc/cont-init.d/98-crowdsec deleted file mode 100644 index 0b7df917f..000000000 --- a/root/etc/cont-init.d/98-crowdsec +++ /dev/null @@ -1,105 +0,0 @@ -#!/usr/bin/with-contenv bash -# shellcheck shell=bash - -CONFIG_PATH="/config/crowdsec/" -LIB_PATH="/usr/local/lua/crowdsec/" -DATA_PATH="/var/lib/crowdsec/lua/" - -echo "**** Configuring CrowdSec nginx Bouncer ****" - -# If API keys are missing, disable mod and exit -if [[ -z $CROWDSEC_API_KEY ]] || [[ -z $CROWDSEC_LAPI_URL ]]; then - echo "**** Missing API key or CrowdSec LAPI URL, cannot configure bouncer ****" - exit 1 -fi - -apk add -U --upgrade --no-cache \ - gettext \ - lua5.1 \ - lua5.1-cjson \ - lua-resty-http \ - lua-sec \ - nginx-mod-http-lua - -# Download nginx bouncer -if [[ -z ${CROWDSEC_VERSION+x} ]]; then \ - CROWDSEC_VERSION=$(curl -sX GET "https://api.github.com/repos/crowdsecurity/cs-nginx-bouncer/releases/latest" | awk '/tag_name/{print $4;exit}' FS='[""]'); -fi - -curl -so \ - /tmp/crowdsec.tar.gz -L \ - "https://github.com/crowdsecurity/cs-nginx-bouncer/releases/download/${CROWDSEC_VERSION}/crowdsec-nginx-bouncer.tgz" - -mkdir -p /tmp/crowdsec - -if ! tar -tzf /tmp/crowdsec.tar.gz >/dev/null 2>&1; then - echo "**** Invalid tarball, could not download crowdsec bouncer ****" - exit 1 -fi - -tar xf \ - /tmp/crowdsec.tar.gz -C \ - /tmp/crowdsec --strip-components=1 - -mkdir -p "${CONFIG_PATH}" -if [[ ! -f "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" ]]; then \ - cp /tmp/crowdsec/lua-mod/config_example.conf "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" -fi - -# Inject API keys into config file -sed -i -r "s|API_KEY=.*$|API_KEY=${CROWDSEC_API_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" -sed -i -r "s|API_URL=.*$|API_URL=${CROWDSEC_LAPI_URL}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" - -# Sed in ReCaptcha settings -sed -i -r "s|SECRET_KEY=.*$|SECRET_KEY=${CROWDSEC_SECRET_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" -sed -i -r "s|SITE_KEY=.*$|SITE_KEY=${CROWDSEC_SITE_KEY}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" -sed -i -r "s|CAPTCHA_PROVIDER=.*$|CAPTCHA_PROVIDER=${CROWDSEC_CAPTCHA_PROVIDER}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" - -# Sed in CROWDSEC_MODE and UPDATE_FREQUENCY, if defined in the env, defaults to live and 10s -sed -i -r "s|MODE=.*$|MODE=${CROWDSEC_MODE:-live}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" -sed -i -r "s|UPDATE_FREQUENCY=.*$|UPDATE_FREQUENCY=${CROWDSEC_UPDATE_FREQUENCY:-10}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" - -# Change config path -sed -i "s|/etc/crowdsec/bouncers/|${CONFIG_PATH}|" /tmp/crowdsec/nginx/crowdsec_nginx.conf - -# Copy files -mkdir -p ${DATA_PATH}/templates/ -cp -r /tmp/crowdsec/lua-mod/templates/* ${DATA_PATH}/templates/ - -mkdir -p ${LIB_PATH}plugins/crowdsec -cp -r /tmp/crowdsec/lua-mod/lib/* ${LIB_PATH} - -cp /tmp/crowdsec/nginx/crowdsec_nginx.conf /etc/nginx/http.d - -# Sed in crowdsec include -if ! grep -q '[^#]include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf' && ! grep -q '[^#]include /etc/nginx/conf.d/\*.conf;' '/config/nginx/nginx.conf'; then - if grep -q '#include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf'; then - # Enable http.d include - sed -i 's|#include /etc/nginx/http.d/\*.conf;|include /etc/nginx/http.d/\*.conf;|' /config/nginx/nginx.conf - else - # Warn about missing http.d include - echo " - ******************************************************************** - * Warning: Your nginx.conf is missing required settings * - * Please add: * - * include /etc/nginx/http.d/*.conf; * - * to the http{} block and restart the container. * - * * - * The CrowdSec bouncer will not function until this is done. * - ********************************************************************" - fi -fi - -# Clean up -rm -rf \ - /tmp/crowdsec \ - /tmp/crowdsec.tar.gz - -# Disable f2b if requested -if [[ $CROWDSEC_F2B_DISABLE == "true" ]]; then - echo "**** Disabling fail2ban Service ****" - touch /etc/services.d/fail2ban/down - rm -rf /etc/logrotate.d/fail2ban -fi - -echo "**** Successfully configured CrowdSec nginx Bouncer ${CROWDSEC_VERSION} ****" From d89986c13bdf1dcca3560f82f4f23040ad0a00fe Mon Sep 17 00:00:00 2001 From: TheSpad Date: Thu, 27 Jul 2023 10:22:36 +0100 Subject: [PATCH 30/47] Add mod debug support --- root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run index eff2bf61f..3a7518780 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run @@ -5,6 +5,12 @@ CONFIG_PATH="/config/crowdsec/" LIB_PATH="/usr/local/lua/crowdsec/" DATA_PATH="/var/lib/crowdsec/lua/" +if [[ ${DOCKER_MODS_DEBUG,,} = "true" ]]; then + CURL_NOISE_LEVEL="-v" +else + CURL_NOISE_LEVEL="--silent" +fi + echo "**** Configuring CrowdSec nginx Bouncer ****" # If API keys are missing, disable mod and exit @@ -23,10 +29,10 @@ echo "\ # Download nginx bouncer if [[ -z ${CROWDSEC_VERSION+x} ]]; then \ - CROWDSEC_VERSION=$(curl -sX GET "https://api.github.com/repos/crowdsecurity/cs-nginx-bouncer/releases/latest" | awk '/tag_name/{print $4;exit}' FS='[""]'); + CROWDSEC_VERSION=$(curl -s "https://api.github.com/repos/crowdsecurity/cs-nginx-bouncer/releases/latest" | awk '/tag_name/{print $4;exit}' FS='[""]'); fi -curl -so \ +curl "${CURL_NOISE_LEVEL}" -Lo \ /tmp/crowdsec.tar.gz -L \ "https://github.com/crowdsecurity/cs-nginx-bouncer/releases/download/${CROWDSEC_VERSION}/crowdsec-nginx-bouncer.tgz" From 40662d234e1d01532664ac16d41c7821493c8490 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Tue, 29 Aug 2023 11:20:03 +0100 Subject: [PATCH 31/47] Abort if bouncer version can't be fetched. --- root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run index 3a7518780..91fec8996 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run @@ -32,6 +32,11 @@ if [[ -z ${CROWDSEC_VERSION+x} ]]; then \ CROWDSEC_VERSION=$(curl -s "https://api.github.com/repos/crowdsecurity/cs-nginx-bouncer/releases/latest" | awk '/tag_name/{print $4;exit}' FS='[""]'); fi +if [[ -z ${CROWDSEC_VERSION+x} ]]; then \ + echo "**** Could not fetch current bouncer version from Github ****" + exit 1 +fi + curl "${CURL_NOISE_LEVEL}" -Lo \ /tmp/crowdsec.tar.gz -L \ "https://github.com/crowdsecurity/cs-nginx-bouncer/releases/download/${CROWDSEC_VERSION}/crowdsec-nginx-bouncer.tgz" From 4f31195b3abb9c66f2d1fd1265ebd07a33261cc9 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Tue, 6 Feb 2024 21:43:59 +0000 Subject: [PATCH 32/47] Add support for APPSEC_URL --- root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run index 91fec8996..42a5f3a4b 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run @@ -70,6 +70,12 @@ sed -i -r "s|CAPTCHA_PROVIDER=.*$|CAPTCHA_PROVIDER=${CROWDSEC_CAPTCHA_PROVIDER}| sed -i -r "s|MODE=.*$|MODE=${CROWDSEC_MODE:-live}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" sed -i -r "s|UPDATE_FREQUENCY=.*$|UPDATE_FREQUENCY=${CROWDSEC_UPDATE_FREQUENCY:-10}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +if grep -q "^APPSEC_URL=" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf"; then + sed -i -r "s|APPSEC_URL=.*$|APPSEC_URL=${APPSEC_URL}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +else + echo "APPSEC_URL=${APPSEC_URL}" >> "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" +fi + # Change config path sed -i "s|/etc/crowdsec/bouncers/|${CONFIG_PATH}|" /tmp/crowdsec/nginx/crowdsec_nginx.conf From 9378882c5a98e2f958bde3d998afd3f8353713f7 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Tue, 6 Feb 2024 21:54:12 +0000 Subject: [PATCH 33/47] Update readme and env name --- README.md | 5 +++-- root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 3ca7a9a9e..7baa8557b 100644 --- a/README.md +++ b/README.md @@ -29,11 +29,12 @@ Set the following environment variables on your SWAG container. | `CROWDSEC_LAPI_URL` | **Required** | Your local CrowdSec API endpoint, for example `http://crowdsec:8080` | | `CROWDSEC_SITE_KEY` | **Optional** | CAPTCHA Site Key | | `CROWDSEC_SECRET_KEY` | **Optional** | CAPTCHA Secret Key | -| `CROWDSEC_CAPTCHA_PROVIDER` | **Optional** | CAPTCHA Provider (currently supported providers are `recaptcha`, `hcaptcha`, `turnstile`), requires v1.0.5 or newer. | -| `CROWDSEC_VERSION` | **Optional** | Specify a version of the bouncer to install instead of using the latest release, for example `v1.0.0`. Must be a valid [release tag](https://github.com/crowdsecurity/cs-nginx-bouncer/tags). **Does not support versions older than v1.0.0**. +| `CROWDSEC_CAPTCHA_PROVIDER` | **Optional** | CAPTCHA Provider (currently supported providers are `recaptcha`, `hcaptcha`, `turnstile`), requires bouncer v1.0.5 or newer. | +| `CROWDSEC_VERSION` | **Optional** | Specify a version of the bouncer to install instead of using the latest release, for example `v1.0.0`. Must be a valid [release tag](https://github.com/crowdsecurity/cs-nginx-bouncer/tags). **Does not support versions older than v1.0.0**. | | `CROWDSEC_F2B_DISABLE` | **Optional** | Set to `true` to disable swag's built-in fail2ban service if you don't need it | | `CROWDSEC_MODE` | **Optional** | Set to `live` (immediate update) or `stream` to update requests every CROWDSEC_UPDATE_FREQUENCY seconds. Defaults to `live` | | `CROWDSEC_UPDATE_FREQUENCY` | **Optional** | Set update frequency for use with `stream` mode. Defaults to `10`. | +| `CROWDSEC_APPSEC_URL` | **Optional** | Set URL for AppSec component, requires bouncer v1.0.6 or newer and Crowdsec v1.6.0 or newer. | | | | | The variables need to remain in place while you are using the mod. If you remove **required** variables the bouncer will be disabled the next time you recreate the container, if you remove **optional** variables the associated features will be disabled the next time you recreate the container. diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run index 42a5f3a4b..39ceafc55 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run @@ -71,9 +71,9 @@ sed -i -r "s|MODE=.*$|MODE=${CROWDSEC_MODE:-live}|" "${CONFIG_PATH}crowdsec-ngin sed -i -r "s|UPDATE_FREQUENCY=.*$|UPDATE_FREQUENCY=${CROWDSEC_UPDATE_FREQUENCY:-10}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" if grep -q "^APPSEC_URL=" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf"; then - sed -i -r "s|APPSEC_URL=.*$|APPSEC_URL=${APPSEC_URL}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" + sed -i -r "s|APPSEC_URL=.*$|APPSEC_URL=${CROWDSEC_APPSEC_URL}|" "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" else - echo "APPSEC_URL=${APPSEC_URL}" >> "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" + echo "APPSEC_URL=${CROWDSEC_APPSEC_URL}" >> "${CONFIG_PATH}crowdsec-nginx-bouncer.conf" fi # Change config path From 34b208f2c97d2b2b4868f28ffcf5e83e1a6692e1 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Tue, 6 Feb 2024 22:03:08 +0000 Subject: [PATCH 34/47] Match upstream debug env --- root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run index 39ceafc55..ee6f48edb 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run @@ -5,7 +5,7 @@ CONFIG_PATH="/config/crowdsec/" LIB_PATH="/usr/local/lua/crowdsec/" DATA_PATH="/var/lib/crowdsec/lua/" -if [[ ${DOCKER_MODS_DEBUG,,} = "true" ]]; then +if [[ ${DOCKER_MODS_DEBUG_CURL,,} = "true" ]]; then CURL_NOISE_LEVEL="-v" else CURL_NOISE_LEVEL="--silent" From 98be3e4f4cef1363753078c93e836309521bec86 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Wed, 7 Feb 2024 18:35:43 +0000 Subject: [PATCH 35/47] Update changelog --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 7baa8557b..cc2dd668b 100644 --- a/README.md +++ b/README.md @@ -47,6 +47,7 @@ e.g. `resolver 127.0.0.11 valid=30s ipv6=off;` ## Versions +* **06.02.24:** - Add AppSec support. * **29.03.23:** - Support multiple captcha providers from upstream. * **28.01.23:** - Support mode selection, handle s6v3 init. * **25.08.22:** - Make hybrid mod. From a8aee60836900352126be4a3f1131b84f6f7da61 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Fri, 8 Mar 2024 11:23:38 +0000 Subject: [PATCH 36/47] Update readme with lua/http2 issue notes --- README.md | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index cc2dd668b..847c69090 100644 --- a/README.md +++ b/README.md @@ -4,8 +4,10 @@ Make sure that the line below, under virtual hosts, is in your nginx.conf, otherwise crowdsec-bouncer will not work. More information here https://info.linuxserver.io/issues/2022-08-20-nginx-base/ - # Includes virtual hosts configs. - include /etc/nginx/http.d/*.conf; +```nginx +# Includes virtual hosts configs. +include /etc/nginx/http.d/*.conf; +``` This mod adds the [CrowdSec](https://crowdsec.net) [nginx bouncer](https://github.com/crowdsecurity/cs-nginx-bouncer/) to SWAG, to be installed/updated during container start. @@ -39,6 +41,28 @@ Set the following environment variables on your SWAG container. The variables need to remain in place while you are using the mod. If you remove **required** variables the bouncer will be disabled the next time you recreate the container, if you remove **optional** variables the associated features will be disabled the next time you recreate the container. +### Captcha & AppSec Limitations + +Due to limitations in the nginx Lua module, if you enable Captcha or AppSec support in the bouncer you cannot safely use http/2 for any of your services. By default Swag ships with http/2 enabled, and so this will need to be changed in any and all active proxy confs as well as the default.conf. For example, in the [subdomain template conf](https://github.com/linuxserver/reverse-proxy-confs/blob/master/_template.subdomain.conf.sample#L9-L10) you would replace + +```nginx +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; +``` + +with + +```nginx +server { + listen 443 ssl; + listen [::]:443 ssl; +``` + +You can automate this using something like `find /path/to/swag/config/nginx -name "*.conf" -type f -exec sed -i -E 's/^(\s+listen.*)http2(.*)/\1\2/g' {} \;` + +If you are not using Captcha or AppSec components make sure to omit or leave blank the related environment variables to avoid causing unnecessary issues. + ### reCAPTCHA Support Notes If you're using the reCAPTCHA capability and you're running in an IPv4-only environment then you need to edit your `/config/nginx/resolver.conf` and add `ipv6=off` to the end of the `resolver` statement otherwise the bouncer will attempt to contact the reCAPTCHA endpoint over IPv6 and fail. From 1c461736203620001cd69117469566f4b65c0de1 Mon Sep 17 00:00:00 2001 From: thespad Date: Wed, 5 Jun 2024 16:10:30 +0100 Subject: [PATCH 37/47] Add lua-resty-string package --- README.md | 1 + root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run | 1 + 2 files changed, 2 insertions(+) diff --git a/README.md b/README.md index 847c69090..e4a2e3319 100644 --- a/README.md +++ b/README.md @@ -71,6 +71,7 @@ e.g. `resolver 127.0.0.11 valid=30s ipv6=off;` ## Versions +* **05.06.24:** - Add lua-resty-string. * **06.02.24:** - Add AppSec support. * **29.03.23:** - Support multiple captcha providers from upstream. * **28.01.23:** - Support mode selection, handle s6v3 init. diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run index ee6f48edb..35fa918ea 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run @@ -24,6 +24,7 @@ echo "\ lua5.1 \ lua5.1-cjson \ lua-resty-http \ + lua-resty-string \ lua-sec \ nginx-mod-http-lua" >> /mod-repo-packages-to-install.list From df09bd21607265cda6c908e670d87599f86d4c08 Mon Sep 17 00:00:00 2001 From: thespad Date: Mon, 12 Aug 2024 13:48:55 +0100 Subject: [PATCH 38/47] Update readme http2 instructions --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index e4a2e3319..cc84ba381 100644 --- a/README.md +++ b/README.md @@ -43,7 +43,9 @@ The variables need to remain in place while you are using the mod. If you remove ### Captcha & AppSec Limitations -Due to limitations in the nginx Lua module, if you enable Captcha or AppSec support in the bouncer you cannot safely use http/2 for any of your services. By default Swag ships with http/2 enabled, and so this will need to be changed in any and all active proxy confs as well as the default.conf. For example, in the [subdomain template conf](https://github.com/linuxserver/reverse-proxy-confs/blob/master/_template.subdomain.conf.sample#L9-L10) you would replace +Due to limitations in the nginx Lua module, if you enable Captcha or AppSec support in the bouncer you cannot safely use http/2 for any of your services. By default Swag ships with http/2 enabled, and so this will need to be changed in the `/config/nginx/nginx.conf` file. Simply change `http2 on;` to `http2 off;` and restart the container. + +If you still have old versions of active proxy confs or the `default.conf`, you will need to remove the http2 definitions from them. For example, in the old [subdomain template conf](https://github.com/linuxserver/reverse-proxy-confs/blob/0528b56e12655748834a9314e7b8cd413e6bf7da/_template.subdomain.conf.sample) you would replace: ```nginx server { From 9f1f5909ea9f624cda405e3b2aa8c2b5fc41b8b5 Mon Sep 17 00:00:00 2001 From: thespad Date: Wed, 11 Sep 2024 18:23:53 +0100 Subject: [PATCH 39/47] Bundle bouncer at build time, add versioning, update docs --- .github/workflows/BuildImage.yml | 27 ++++++-- Dockerfile | 28 ++++++++- README.md | 2 +- .../s6-rc.d/init-mod-swag-crowdsec/run | 61 ++++++++----------- 4 files changed, 76 insertions(+), 42 deletions(-) diff --git a/.github/workflows/BuildImage.yml b/.github/workflows/BuildImage.yml index bc1526585..9e1ede9d3 100644 --- a/.github/workflows/BuildImage.yml +++ b/.github/workflows/BuildImage.yml @@ -1,12 +1,21 @@ name: Build Image -on: [push, pull_request_target, workflow_dispatch] +on: + push: + pull_request_target: + workflow_dispatch: + inputs: + mod_version: + type: string + required: false env: GITHUB_REPO: "linuxserver/docker-mods" #don't modify ENDPOINT: "linuxserver/mods" #don't modify BASEIMAGE: "swag" #replace MODNAME: "crowdsec" #replace + MOD_VERSION: ${{ inputs.mod_version }} #don't modify + MULTI_ARCH: "false" #set to false if not needed jobs: set-vars: @@ -19,18 +28,26 @@ jobs: echo "ENDPOINT=${{ env.ENDPOINT }}" >> $GITHUB_OUTPUT echo "BASEIMAGE=${{ env.BASEIMAGE }}" >> $GITHUB_OUTPUT echo "MODNAME=${{ env.MODNAME }}" >> $GITHUB_OUTPUT - # **** If the mod needs to be versioned, set the versioning logic below. Otherwise leave as is. **** - MOD_VERSION="" + echo "MULTI_ARCH=${{ env.MULTI_ARCH }}" >> $GITHUB_OUTPUT + if [[ -z "${{ env.MOD_VERSION }}" ]]; then + # **** If the mod needs to be versioned, set the versioning logic below. Otherwise leave as is. **** + MOD_VERSION=$(curl -sX GET "https://api.github.com/repos/crowdsecurity/cs-nginx-bouncer/releases/latest" | jq -r '.tag_name') + else + MOD_VERSION=${{ env.MOD_VERSION }} + echo "MOD_VERSION_OVERRIDE=true" >> $GITHUB_OUTPUT + fi echo "MOD_VERSION=${MOD_VERSION}" >> $GITHUB_OUTPUT outputs: GITHUB_REPO: ${{ steps.outputs.outputs.GITHUB_REPO }} ENDPOINT: ${{ steps.outputs.outputs.ENDPOINT }} BASEIMAGE: ${{ steps.outputs.outputs.BASEIMAGE }} MODNAME: ${{ steps.outputs.outputs.MODNAME }} + MULTI_ARCH: ${{ steps.outputs.outputs.MULTI_ARCH }} MOD_VERSION: ${{ steps.outputs.outputs.MOD_VERSION }} + MOD_VERSION_OVERRIDE: ${{ steps.outputs.outputs.MOD_VERSION_OVERRIDE }} build: - uses: linuxserver/github-workflows/.github/workflows/docker-mod-builder.yml@v1 + uses: linuxserver/github-workflows/.github/workflows/docker-mod-builder.yml@v2 needs: set-vars secrets: CR_USER: ${{ secrets.CR_USER }} @@ -42,4 +59,6 @@ jobs: ENDPOINT: ${{ needs.set-vars.outputs.ENDPOINT }} BASEIMAGE: ${{ needs.set-vars.outputs.BASEIMAGE }} MODNAME: ${{ needs.set-vars.outputs.MODNAME }} + MULTI_ARCH: ${{ needs.set-vars.outputs.MULTI_ARCH }} MOD_VERSION: ${{ needs.set-vars.outputs.MOD_VERSION }} + MOD_VERSION_OVERRIDE: ${{ needs.set-vars.outputs.MOD_VERSION_OVERRIDE }} diff --git a/Dockerfile b/Dockerfile index 170297667..a883e7855 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,8 +1,32 @@ # syntax=docker/dockerfile:1 +FROM ghcr.io/linuxserver/baseimage-alpine:3.20 AS buildstage + +ARG MOD_VERSION + +RUN \ + mkdir -p /root-layer && \ + if [[ -z "${MOD_VERSION}" ]]; then \ + MOD_VERSION=$(curl -sX GET "https://api.github.com/repos/crowdsecurity/cs-nginx-bouncer/releases/latest" \ + | jq -r '.tag_name'); \ + fi && \ + if [[ -z ${MOD_VERSION+x} ]]; then \ + echo "**** Could not fetch current bouncer version from Github ****" \ + exit 1; \ + fi && \ + curl -sLo \ + /root-layer/crowdsec-nginx-bouncer.tgz -L \ + "https://github.com/crowdsecurity/cs-nginx-bouncer/releases/download/${MOD_VERSION}/crowdsec-nginx-bouncer.tgz" && \ + if ! tar -tzf /root-layer/crowdsec-nginx-bouncer.tgz >/dev/null 2>&1; then \ + echo "**** Invalid tarball, could not download crowdsec bouncer ****" \ + exit 1; \ + fi + +COPY root/ /root-layer/ + FROM scratch LABEL maintainer="thespad" -# copy local files -COPY root/ / +# Add files from buildstage +COPY --from=buildstage /root-layer/ / diff --git a/README.md b/README.md index cc84ba381..e23b8d021 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,6 @@ Set the following environment variables on your SWAG container. | `CROWDSEC_SITE_KEY` | **Optional** | CAPTCHA Site Key | | `CROWDSEC_SECRET_KEY` | **Optional** | CAPTCHA Secret Key | | `CROWDSEC_CAPTCHA_PROVIDER` | **Optional** | CAPTCHA Provider (currently supported providers are `recaptcha`, `hcaptcha`, `turnstile`), requires bouncer v1.0.5 or newer. | -| `CROWDSEC_VERSION` | **Optional** | Specify a version of the bouncer to install instead of using the latest release, for example `v1.0.0`. Must be a valid [release tag](https://github.com/crowdsecurity/cs-nginx-bouncer/tags). **Does not support versions older than v1.0.0**. | | `CROWDSEC_F2B_DISABLE` | **Optional** | Set to `true` to disable swag's built-in fail2ban service if you don't need it | | `CROWDSEC_MODE` | **Optional** | Set to `live` (immediate update) or `stream` to update requests every CROWDSEC_UPDATE_FREQUENCY seconds. Defaults to `live` | | `CROWDSEC_UPDATE_FREQUENCY` | **Optional** | Set update frequency for use with `stream` mode. Defaults to `10`. | @@ -73,6 +72,7 @@ e.g. `resolver 127.0.0.11 valid=30s ipv6=off;` ## Versions +* **11.09.24:** - Move versioning to mod tags. Bundle tarball at build time. * **05.06.24:** - Add lua-resty-string. * **06.02.24:** - Add AppSec support. * **29.03.23:** - Support multiple captcha providers from upstream. diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run index 35fa918ea..510955654 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run @@ -5,12 +5,6 @@ CONFIG_PATH="/config/crowdsec/" LIB_PATH="/usr/local/lua/crowdsec/" DATA_PATH="/var/lib/crowdsec/lua/" -if [[ ${DOCKER_MODS_DEBUG_CURL,,} = "true" ]]; then - CURL_NOISE_LEVEL="-v" -else - CURL_NOISE_LEVEL="--silent" -fi - echo "**** Configuring CrowdSec nginx Bouncer ****" # If API keys are missing, disable mod and exit @@ -28,29 +22,11 @@ echo "\ lua-sec \ nginx-mod-http-lua" >> /mod-repo-packages-to-install.list -# Download nginx bouncer -if [[ -z ${CROWDSEC_VERSION+x} ]]; then \ - CROWDSEC_VERSION=$(curl -s "https://api.github.com/repos/crowdsecurity/cs-nginx-bouncer/releases/latest" | awk '/tag_name/{print $4;exit}' FS='[""]'); -fi - -if [[ -z ${CROWDSEC_VERSION+x} ]]; then \ - echo "**** Could not fetch current bouncer version from Github ****" - exit 1 -fi - -curl "${CURL_NOISE_LEVEL}" -Lo \ - /tmp/crowdsec.tar.gz -L \ - "https://github.com/crowdsecurity/cs-nginx-bouncer/releases/download/${CROWDSEC_VERSION}/crowdsec-nginx-bouncer.tgz" - +# Extract nginx bouncer mkdir -p /tmp/crowdsec -if ! tar -tzf /tmp/crowdsec.tar.gz >/dev/null 2>&1; then - echo "**** Invalid tarball, could not download crowdsec bouncer ****" - exit 1 -fi - tar xf \ - /tmp/crowdsec.tar.gz -C \ + /crowdsec-nginx-bouncer.tgz -C \ /tmp/crowdsec --strip-components=1 mkdir -p "${CONFIG_PATH}" @@ -97,20 +73,35 @@ if ! grep -q '[^#]include /etc/nginx/http.d/\*.conf;' '/config/nginx/nginx.conf' else # Warn about missing http.d include echo " - ******************************************************************** - * Warning: Your nginx.conf is missing required settings * - * Please add: * - * include /etc/nginx/http.d/*.conf; * - * to the http{} block and restart the container. * - * * - * The CrowdSec bouncer will not function until this is done. * - ********************************************************************" + ┌──────────────────────────────────────────────────────────────────┐ + │ Warning: Your nginx.conf is missing required settings │ + │ Please add: │ + │ include /etc/nginx/http.d/*.conf; │ + │ to the http{} block and restart the container. │ + │ │ + │ The CrowdSec bouncer will not function until this is done. │ + └──────────────────────────────────────────────────────────────────┘ + " fi fi # Clean up rm -rf \ /tmp/crowdsec \ - /tmp/crowdsec.tar.gz + /crowdsec-nginx-bouncer.tgz + +if [[ -n ${CROWDSEC_VERSION} ]]; then + echo " + ┌─────────────────────────────────────────────────────────────────────────┐ + │ !! ATTENTION !! │ + │ │ + │ This mod will ignore the │ + │ CROWDSEC_VERSION environment variable │ + │ │ + │ Versioning is now handled by mod tags │ + │ See https://hub.docker.com/r/linuxserver/mods/tags?name=swag-crowdsec-v │ + │ For a list of all available tags │ + └─────────────────────────────────────────────────────────────────────────┘" +fi echo "**** Successfully configured CrowdSec nginx Bouncer ${CROWDSEC_VERSION} ****" From b18f1cc120445518966c57cee8e66dd67ddff50c Mon Sep 17 00:00:00 2001 From: thespad Date: Wed, 11 Sep 2024 19:25:38 +0100 Subject: [PATCH 40/47] Update workflow version --- .github/workflows/BuildImage.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/BuildImage.yml b/.github/workflows/BuildImage.yml index 9e1ede9d3..dc1a5f9e6 100644 --- a/.github/workflows/BuildImage.yml +++ b/.github/workflows/BuildImage.yml @@ -47,7 +47,7 @@ jobs: MOD_VERSION_OVERRIDE: ${{ steps.outputs.outputs.MOD_VERSION_OVERRIDE }} build: - uses: linuxserver/github-workflows/.github/workflows/docker-mod-builder.yml@v2 + uses: linuxserver/github-workflows/.github/workflows/docker-mod-builder.yml@v1 needs: set-vars secrets: CR_USER: ${{ secrets.CR_USER }} From 3fe3f420f697801701bb681455d930e665c8a93c Mon Sep 17 00:00:00 2001 From: thespad Date: Wed, 11 Sep 2024 19:59:09 +0100 Subject: [PATCH 41/47] Don't run through mod setup on restart --- root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run index 510955654..9c61ad460 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run @@ -5,6 +5,11 @@ CONFIG_PATH="/config/crowdsec/" LIB_PATH="/usr/local/lua/crowdsec/" DATA_PATH="/var/lib/crowdsec/lua/" +if [[ ! -e "/crowdsec-nginx-bouncer.tgz" ]]; then + # Crowdsec bouncer already configured + exit 0 +fi + echo "**** Configuring CrowdSec nginx Bouncer ****" # If API keys are missing, disable mod and exit From f8f7401a61403ef6cc666d694b94c75cb51e9aae Mon Sep 17 00:00:00 2001 From: thespad Date: Wed, 11 Sep 2024 20:08:06 +0100 Subject: [PATCH 42/47] Fix comparison --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index a883e7855..dabf65346 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,11 +6,11 @@ ARG MOD_VERSION RUN \ mkdir -p /root-layer && \ - if [[ -z "${MOD_VERSION}" ]]; then \ + if [ -z "${MOD_VERSION}" ]; then \ MOD_VERSION=$(curl -sX GET "https://api.github.com/repos/crowdsecurity/cs-nginx-bouncer/releases/latest" \ | jq -r '.tag_name'); \ fi && \ - if [[ -z ${MOD_VERSION+x} ]]; then \ + if [ -z ${MOD_VERSION+x} ]; then \ echo "**** Could not fetch current bouncer version from Github ****" \ exit 1; \ fi && \ From 78c1192dfedb85a397d898b700512a66375617ba Mon Sep 17 00:00:00 2001 From: paul-arthurthiery Date: Mon, 7 Oct 2024 14:59:05 -0400 Subject: [PATCH 43/47] update readme to mirror easier api key setup --- README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index e23b8d021..868ad5a3b 100644 --- a/README.md +++ b/README.md @@ -19,9 +19,10 @@ If adding multiple mods, enter them in an array separated by `|`, such as `DOCKE If running CrowdSec in a container it must be on a common docker network with SWAG. -Generate an API key for the bouncer with `cscli bouncers add bouncer-swag` or `docker exec -t crowdsec cscli bouncers add bouncer-swag`, if you're running CrowdSec in a container. +You have 2 options to generate a Crowdsec API key: -Make a note of the API key as you can't retrieve it later without removing and re-adding the bouncer. +1. Create an arbitrary string and pass it as the `BOUNCER_KEY_swag` environment variable in your crowdsec image +2. Generate an API key for the bouncer with `cscli bouncers add bouncer-swag` or `docker exec -t crowdsec cscli bouncers add bouncer-swag`, if you're running CrowdSec in a container. Make a note of the API key as you can't retrieve it later without removing and re-adding the bouncer. Set the following environment variables on your SWAG container. From 9156249068e358e5c73389f5cab7c29efc8ca20d Mon Sep 17 00:00:00 2001 From: thespad Date: Fri, 23 May 2025 19:55:20 +0100 Subject: [PATCH 44/47] Fix failures not failing --- Dockerfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index dabf65346..f6bfccbea 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -FROM ghcr.io/linuxserver/baseimage-alpine:3.20 AS buildstage +FROM ghcr.io/linuxserver/baseimage-alpine:3.21 AS buildstage ARG MOD_VERSION @@ -11,14 +11,14 @@ RUN \ | jq -r '.tag_name'); \ fi && \ if [ -z ${MOD_VERSION+x} ]; then \ - echo "**** Could not fetch current bouncer version from Github ****" \ + echo "**** Could not fetch current bouncer version from Github ****"; \ exit 1; \ fi && \ curl -sLo \ /root-layer/crowdsec-nginx-bouncer.tgz -L \ "https://github.com/crowdsecurity/cs-nginx-bouncer/releases/download/${MOD_VERSION}/crowdsec-nginx-bouncer.tgz" && \ if ! tar -tzf /root-layer/crowdsec-nginx-bouncer.tgz >/dev/null 2>&1; then \ - echo "**** Invalid tarball, could not download crowdsec bouncer ****" \ + echo "**** Invalid tarball, could not download crowdsec bouncer ****"; \ exit 1; \ fi From 3e6080eb6d821dce84e708c07412cf62aa314856 Mon Sep 17 00:00:00 2001 From: thespad Date: Sun, 16 Aug 2026 20:35:33 +0000 Subject: [PATCH 45/47] Bundle lua-resty-string with mod due to broken Alpine deps in 3.24 --- Dockerfile | 10 +++++++++- root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run | 1 - 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index f6bfccbea..a9aa15e42 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -FROM ghcr.io/linuxserver/baseimage-alpine:3.21 AS buildstage +FROM ghcr.io/linuxserver/baseimage-alpine:3.24 AS buildstage ARG MOD_VERSION @@ -21,6 +21,14 @@ RUN \ echo "**** Invalid tarball, could not download crowdsec bouncer ****"; \ exit 1; \ fi + apk add --no-cache build-base + curl -sLo \ + /tmp/resty.tar.gz -L \ + "https://github.com/openresty/lua-resty-string/archive/refs/tags/v0.15.tar.gz" && \ + cd /tmp && \ + tar -xzf ./resty.tar.gz && \ + cd lua-resty-string-0.15 && \ + make DESTDIR=/root-layer LUA_LIB_DIR="/usr/share/lua/common" install COPY root/ /root-layer/ diff --git a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run index 9c61ad460..7e596778a 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mod-swag-crowdsec/run @@ -23,7 +23,6 @@ echo "\ lua5.1 \ lua5.1-cjson \ lua-resty-http \ - lua-resty-string \ lua-sec \ nginx-mod-http-lua" >> /mod-repo-packages-to-install.list From 6ae6d783f45b61fecbe2d3a03381fe8e5b818535 Mon Sep 17 00:00:00 2001 From: thespad Date: Sun, 16 Aug 2026 20:39:16 +0000 Subject: [PATCH 46/47] Missing line continuation --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index a9aa15e42..d4c770682 100644 --- a/Dockerfile +++ b/Dockerfile @@ -20,7 +20,7 @@ RUN \ if ! tar -tzf /root-layer/crowdsec-nginx-bouncer.tgz >/dev/null 2>&1; then \ echo "**** Invalid tarball, could not download crowdsec bouncer ****"; \ exit 1; \ - fi + fi && \ apk add --no-cache build-base curl -sLo \ /tmp/resty.tar.gz -L \ From f7ea10c918aa6cc8b8b4d49def89463653792578 Mon Sep 17 00:00:00 2001 From: thespad Date: Sun, 16 Aug 2026 20:40:10 +0000 Subject: [PATCH 47/47] All the line continuations --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index d4c770682..7d9541d1c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -21,7 +21,7 @@ RUN \ echo "**** Invalid tarball, could not download crowdsec bouncer ****"; \ exit 1; \ fi && \ - apk add --no-cache build-base + apk add --no-cache build-base && \ curl -sLo \ /tmp/resty.tar.gz -L \ "https://github.com/openresty/lua-resty-string/archive/refs/tags/v0.15.tar.gz" && \