diff --git a/.github/workflows/beta.yml b/.github/workflows/beta.yml index b44cc473c..54084ea3f 100644 --- a/.github/workflows/beta.yml +++ b/.github/workflows/beta.yml @@ -133,7 +133,7 @@ jobs: versionrpm: ${{ steps.getversionrpm.outputs.versionrpm }} steps: - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - name: Get VERSION id: getversion run: echo "version=$(cat src/VERSION | tr -d '\n')" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f8470b5e0..12091b2cf 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -19,7 +19,7 @@ jobs: language: ["python", "javascript"] steps: - name: Checkout repository - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - name: Set up Python 3.9 uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 if: matrix.language == 'python' @@ -35,12 +35,12 @@ jobs: python -m pip install --no-cache-dir --require-hashes -r src/common/db/requirements.txt echo "CODEQL_PYTHON=$(which python)" >> $GITHUB_ENV - name: Initialize CodeQL - uses: github/codeql-action/init@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 # v3.24.6 + uses: github/codeql-action/init@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7 with: languages: ${{ matrix.language }} config-file: ./.github/codeql.yml setup-python-dependencies: false - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 # v3.24.6 + uses: github/codeql-action/analyze@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/container-build.yml b/.github/workflows/container-build.yml index 86055215a..3b97efc47 100644 --- a/.github/workflows/container-build.yml +++ b/.github/workflows/container-build.yml @@ -45,7 +45,7 @@ jobs: steps: # Prepare - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - name: Replace VERSION if: inputs.RELEASE == 'testing' run: ./misc/update-version.sh testing @@ -63,22 +63,22 @@ jobs: SSH_IP: ${{ secrets.ARM_SSH_IP }} SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }} - name: Setup Buildx - uses: docker/setup-buildx-action@0d103c3126aa41d772a8362f6aa67afac040f80c # v3.1.0 + uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0 if: inputs.CACHE_SUFFIX != 'arm' - name: Setup Buildx (ARM) - uses: docker/setup-buildx-action@0d103c3126aa41d772a8362f6aa67afac040f80c # v3.1.0 + uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0 if: inputs.CACHE_SUFFIX == 'arm' with: endpoint: ssh://root@arm platforms: linux/arm64,linux/arm/v7,linux/arm/v6 - name: Login to Docker Hub - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_TOKEN }} - name: Login to ghcr if: inputs.PUSH == true - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -92,7 +92,7 @@ jobs: # Build cached image - name: Build image if: inputs.CACHE == true - uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0 + uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0 with: context: . file: ${{ inputs.DOCKERFILE }} @@ -105,7 +105,7 @@ jobs: # Build non-cached image - name: Build image if: inputs.CACHE != true - uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0 + uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0 with: context: . file: ${{ inputs.DOCKERFILE }} diff --git a/.github/workflows/create-arm.yml b/.github/workflows/create-arm.yml index 9bb50ff84..9e138e61c 100644 --- a/.github/workflows/create-arm.yml +++ b/.github/workflows/create-arm.yml @@ -33,7 +33,7 @@ jobs: steps: # Prepare - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - name: Get ARM availabilities id: availabilities uses: scaleway/action-scw@c718eca1fcb9fec1fb1433752d61599c6a0ad2e9 diff --git a/.github/workflows/dev-update-mmdb.yml b/.github/workflows/dev-update-mmdb.yml index 9e7341b03..e0ef40795 100644 --- a/.github/workflows/dev-update-mmdb.yml +++ b/.github/workflows/dev-update-mmdb.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 with: fetch-depth: 0 token: ${{ secrets.BUNKERBOT_TOKEN }} diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml index ac0342806..32b554298 100644 --- a/.github/workflows/dev.yml +++ b/.github/workflows/dev.yml @@ -78,7 +78,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - id: set-matrix run: | tests=$(find ./tests/ui/ -name "*_page.py" -type f -printf "%f\n" | jq -c --raw-input --slurp 'split("\n")| .[0:-1]') @@ -111,7 +111,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - id: set-matrix run: | tests=$(find ./tests/core/ -maxdepth 1 -mindepth 1 -type d -printf "%f\n" | jq -c --raw-input --slurp 'split("\n")| .[0:-1]') @@ -149,12 +149,12 @@ jobs: packages: write steps: - name: Login to Docker Hub - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_TOKEN }} - name: Login to ghcr - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/doc-to-pdf.yml b/.github/workflows/doc-to-pdf.yml index 6da3076e9..acf4cc96b 100644 --- a/.github/workflows/doc-to-pdf.yml +++ b/.github/workflows/doc-to-pdf.yml @@ -13,7 +13,7 @@ jobs: steps: # Prepare - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - name: Install Python uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 with: diff --git a/.github/workflows/linux-build.yml b/.github/workflows/linux-build.yml index 9ef4b67ec..decf6b4fa 100644 --- a/.github/workflows/linux-build.yml +++ b/.github/workflows/linux-build.yml @@ -37,7 +37,7 @@ jobs: steps: # Prepare - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - name: Replace VERSION if: inputs.RELEASE == 'testing' || inputs.RELEASE == 'dev' || inputs.RELEASE == 'ui' run: ./misc/update-version.sh ${{ inputs.RELEASE }} @@ -72,21 +72,21 @@ jobs: SSH_IP: ${{ secrets.ARM_SSH_IP }} SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }} - name: Setup Buildx - uses: docker/setup-buildx-action@0d103c3126aa41d772a8362f6aa67afac040f80c # v3.1.0 + uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0 if: startsWith(env.ARCH, 'arm') == false - name: Setup Buildx (ARM) - uses: docker/setup-buildx-action@0d103c3126aa41d772a8362f6aa67afac040f80c # v3.1.0 + uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0 if: startsWith(env.ARCH, 'arm') == true with: endpoint: ssh://root@arm platforms: linux/arm64,linux/arm/v7,linux/arm/v6 - name: Login to Docker Hub - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_TOKEN }} - name: Login to ghcr - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -94,7 +94,7 @@ jobs: # Build testing package image - name: Build package image if: inputs.RELEASE == 'testing' || inputs.RELEASE == 'dev' || inputs.RELEASE == 'ui' - uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0 + uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0 with: context: . load: true @@ -106,7 +106,7 @@ jobs: # Build non-testing package image - name: Build package image if: inputs.RELEASE != 'testing' && inputs.RELEASE != 'dev' - uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0 + uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0 with: context: . load: true @@ -142,7 +142,7 @@ jobs: images: ghcr.io/bunkerity/${{ inputs.LINUX }}-tests:${{ inputs.RELEASE }} - name: Build test image if: inputs.TEST == true - uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0 + uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0 with: context: . file: tests/linux/Dockerfile-${{ inputs.LINUX }} diff --git a/.github/workflows/push-doc.yml b/.github/workflows/push-doc.yml index 319a11d3e..3f3e2dd0f 100644 --- a/.github/workflows/push-doc.yml +++ b/.github/workflows/push-doc.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 with: fetch-depth: 0 token: ${{ secrets.BUNKERBOT_TOKEN }} diff --git a/.github/workflows/push-docker.yml b/.github/workflows/push-docker.yml index bf46fbfbf..364729dc1 100644 --- a/.github/workflows/push-docker.yml +++ b/.github/workflows/push-docker.yml @@ -33,14 +33,14 @@ jobs: steps: # Prepare - name: Check out repository code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - name: Login to Docker Hub - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_TOKEN }} - name: Login to ghcr - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -58,7 +58,7 @@ jobs: SSH_IP: ${{ secrets.ARM_SSH_IP }} SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }} - name: Setup Buildx (ARM) - uses: docker/setup-buildx-action@0d103c3126aa41d772a8362f6aa67afac040f80c # v3.1.0 + uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0 with: endpoint: ssh://root@arm platforms: linux/arm64,linux/arm/v7,linux/arm/v6 @@ -70,7 +70,7 @@ jobs: images: bunkerity/${{ inputs.IMAGE }} # Build and push - name: Build and push - uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0 + uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0 with: context: . file: ${{ inputs.DOCKERFILE }} diff --git a/.github/workflows/push-github.yml b/.github/workflows/push-github.yml index 3c5e2cb19..ad8088ed1 100644 --- a/.github/workflows/push-github.yml +++ b/.github/workflows/push-github.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: # Checkout - - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 # Get PDF doc - name: Get documentation if: inputs.VERSION != 'testing' @@ -51,7 +51,7 @@ jobs: # Create release - name: Create release if: inputs.VERSION != 'testing' - uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1 + uses: softprops/action-gh-release@9d7c94cfd0a1f3ed45544c887983e9fa900f0564 # v2.0.4 with: body: | Documentation : https://docs.bunkerweb.io/${{ inputs.VERSION }}/ @@ -75,7 +75,7 @@ jobs: # Create release - name: Create release if: inputs.VERSION == 'testing' - uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1 + uses: softprops/action-gh-release@9d7c94cfd0a1f3ed45544c887983e9fa900f0564 # v2.0.4 with: body: | **The testing version of BunkerWeb should not be used in production, please use the latest stable version instead.** diff --git a/.github/workflows/push-packagecloud.yml b/.github/workflows/push-packagecloud.yml index 5ddc9f81a..4b2a718d4 100644 --- a/.github/workflows/push-packagecloud.yml +++ b/.github/workflows/push-packagecloud.yml @@ -40,7 +40,7 @@ jobs: steps: # Prepare - name: Check out repository code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - name: Install ruby uses: ruby/setup-ruby@d4526a55538b775af234ba4af27118ed6f8f6677 # v1.172.0 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1413fa908..75da5963a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -141,7 +141,7 @@ jobs: versionrpm: ${{ steps.getversionrpm.outputs.versionrpm }} steps: - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - name: Get VERSION id: getversion run: echo "version=$(cat src/VERSION | tr -d '\n')" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/rm-arm.yml b/.github/workflows/rm-arm.yml index cceb09a7a..2d0c61ce0 100644 --- a/.github/workflows/rm-arm.yml +++ b/.github/workflows/rm-arm.yml @@ -21,7 +21,7 @@ jobs: steps: # Prepare - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - name: Delete ARM VM uses: scaleway/action-scw@c718eca1fcb9fec1fb1433752d61599c6a0ad2e9 with: diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml index b80c0a64e..ecf5b8c35 100644 --- a/.github/workflows/scorecards-analysis.yml +++ b/.github/workflows/scorecards-analysis.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: - name: "Checkout code" - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 with: persist-credentials: false - name: "Run analysis" @@ -25,6 +25,6 @@ jobs: results_format: sarif publish_results: true - name: "Upload SARIF results to code scanning" - uses: github/codeql-action/upload-sarif@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 # v3.24.6 + uses: github/codeql-action/upload-sarif@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7 with: sarif_file: results.sarif diff --git a/.github/workflows/staging-create-infra.yml b/.github/workflows/staging-create-infra.yml index d78d168ca..de328cd66 100644 --- a/.github/workflows/staging-create-infra.yml +++ b/.github/workflows/staging-create-infra.yml @@ -21,7 +21,7 @@ jobs: run: ssh-keygen -b 2048 -t rsa -f ~/.ssh/id_rsa -q -N "" && ssh-keygen -f ~/.ssh/id_rsa -y > ~/.ssh/id_rsa.pub && echo -e "Host *\n StrictHostKeyChecking no" > ~/.ssh/ssh_config if: inputs.TYPE != 'k8s' - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - name: Install terraform uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0 - name: Install kubectl diff --git a/.github/workflows/staging-delete-infra.yml b/.github/workflows/staging-delete-infra.yml index bb18e9d60..07949134f 100644 --- a/.github/workflows/staging-delete-infra.yml +++ b/.github/workflows/staging-delete-infra.yml @@ -20,7 +20,7 @@ jobs: steps: # Prepare - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - name: Install terraform uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0 - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4 diff --git a/.github/workflows/staging-tests.yml b/.github/workflows/staging-tests.yml index 385841250..edb8ee3f2 100644 --- a/.github/workflows/staging-tests.yml +++ b/.github/workflows/staging-tests.yml @@ -25,9 +25,9 @@ jobs: steps: # Prepare - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - name: Login to ghcr - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml index 2ba114648..fcff770c9 100644 --- a/.github/workflows/staging.yml +++ b/.github/workflows/staging.yml @@ -89,7 +89,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - id: set-matrix run: | tests=$(find ./tests/core/ -maxdepth 1 -mindepth 1 -type d -printf "%f\n" | jq -c --raw-input --slurp 'split("\n")| .[0:-1]') @@ -100,7 +100,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - id: set-matrix run: | tests=$(find ./tests/ui/ -name "*_page.py" -type f -printf "%f\n" | jq -c --raw-input --slurp 'split("\n")| .[0:-1]') @@ -197,12 +197,12 @@ jobs: packages: write steps: - name: Login to Docker Hub - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_TOKEN }} - name: Login to ghcr - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/test-core-linux.yml b/.github/workflows/test-core-linux.yml index 8f42a28a6..3cd29fe4a 100644 --- a/.github/workflows/test-core-linux.yml +++ b/.github/workflows/test-core-linux.yml @@ -16,11 +16,11 @@ jobs: steps: # Prepare - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - - name: Set up Python 3.12 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 + - name: Set up Python 3.9 uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 with: - python-version: "3.12" + python-version: "3.9" - name: Install Firefox manually and dependencies run: | sudo add-apt-repository ppa:mozillateam/ppa -y @@ -47,7 +47,7 @@ jobs: sudo chmod +x /usr/local/bin/geckodriver rm -f geckodriver.tar.gz - name: Login to ghcr - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/test-core.yml b/.github/workflows/test-core.yml index 3329d0197..9b01b87d6 100644 --- a/.github/workflows/test-core.yml +++ b/.github/workflows/test-core.yml @@ -16,9 +16,9 @@ jobs: steps: # Prepare - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - name: Login to ghcr - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/tests-ui-linux.yml b/.github/workflows/tests-ui-linux.yml index 1772d7d31..2d08116b5 100644 --- a/.github/workflows/tests-ui-linux.yml +++ b/.github/workflows/tests-ui-linux.yml @@ -16,11 +16,11 @@ jobs: steps: # Prepare - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - - name: Set up Python 3.12 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 + - name: Set up Python 3.9 uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 with: - python-version: "3.12" + python-version: "3.9" - name: Install Firefox manually and dependencies run: | sudo add-apt-repository ppa:mozillateam/ppa -y @@ -47,7 +47,7 @@ jobs: sudo chmod +x /usr/local/bin/geckodriver rm -f geckodriver.tar.gz - name: Login to ghcr - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/tests-ui.yml b/.github/workflows/tests-ui.yml index 6af6dbd68..d55320043 100644 --- a/.github/workflows/tests-ui.yml +++ b/.github/workflows/tests-ui.yml @@ -15,9 +15,9 @@ jobs: steps: # Prepare - name: Checkout source code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 - name: Login to ghcr - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.gitleaksignore b/.gitleaksignore index 08813ecec..29a398d23 100644 --- a/.gitleaksignore +++ b/.gitleaksignore @@ -7,3 +7,4 @@ src/ui/templates/account.html:hashicorp-tf-password:417 src/ui/templates/account.html:hashicorp-tf-password:470 src/ui/templates/settings_plugins.html:hashicorp-tf-password:87 src/ui/templates/settings_plugins.html:hashicorp-tf-password:297 +src/ui/templates/settings_plugins.html:hashicorp-tf-password:106 diff --git a/CHANGELOG.md b/CHANGELOG.md index 5a2baae09..62e932f5b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,17 +11,20 @@ - [BUGFIX] Database update with external plugins reupload - [LINUX] Add logrotate support for the logs - [UI] New : add bans management page in the web UI +- [UI] New : add blocked requests page in the web UI - [UI] New : some core plugins pages in the web UI - [UI] General : enhance the Content-Security-Policy header in the web UI - [UI] General : dark mode enhancement - [UI] General : add visual feedback when filtering is matching nothing -- [UI] Add blocked requests page in the web UI -- [UI] Global config / service page : remove tabs for select and enhance filtering (plugin name includes) +- [UI] General : blog news working and add dynamic banner news +- [UI] Global config page : Add multisite edit, add context filter +- [UI] Global config / Service page : remove tabs for select and enhance filtering (plugin name, multiple settings and context now includes) - [UI] Service page : add the possibility to clone a service in the web UI - [UI] Service page : add the possibility to set a service as draft in the web UI - [UI] Service page : add services filter when at least 4 services - [UI] Configs page : add path filtering related to config presence -- [UI] Pro license : add home card, show pro plugis on menu and plugins page, resume in account page, alert in case issue with license usage +- [UI] Pro license : add home card, show pro plugins on menu and plugins page, resume in account page, alert in case issue with license usage +- [UI] Log page : enhance UX - [FEATURE] Add setting REDIS_SSL_VERIFY to activate/disable the SSL certificate verification when using Redis - [FEATURE] Add Redis Sentinel fallback to master automatically if no slaves are available - [FEATURE] Add Redis Sentinel support for bwcli @@ -39,8 +42,11 @@ - [MISC] BunkerWeb will now load the default loading page even on 404 errors when generating the configuration - [MISC] Update database schema to support the new pro version and optimize it - [MISC] Refactor SSL/TLS logics to make it more consistent -- [MISC] Use ed5519 key instead of RSA for default/fallback certificates +- [MISC] Use ECDSA key instead of RSA for selfsigned/default/fallback certificates - [MISC] Refactor certbot-new job to optimize the certbot requests +- [MISC] Refactor jobs utils to make it more consistent +- [MISC] Review jobs and utils to make it more consistent and better in general +- [MISC] Change BunkerWeb base Docker image to nginx:1.24.0-alpine-slim - [DOCUMENTATION] Update web UI's setup wizard instructions in the documentation - [DOCUMENTATION] Update plugins documentation to reflect the new plugin system - [DOCUMENTATION] Update ModSecurity documentation to reflect the new changes in the Security Tuning section diff --git a/docs/assets/img/demo.gif b/docs/assets/img/demo.gif deleted file mode 100644 index 9c238a36a..000000000 Binary files a/docs/assets/img/demo.gif and /dev/null differ diff --git a/docs/assets/img/pro-icon.svg b/docs/assets/img/pro-icon.svg new file mode 100644 index 000000000..56ac61d0d --- /dev/null +++ b/docs/assets/img/pro-icon.svg @@ -0,0 +1,7 @@ + + + + \ No newline at end of file diff --git a/docs/json2md.py b/docs/json2md.py index cca38729a..fc799637a 100755 --- a/docs/json2md.py +++ b/docs/json2md.py @@ -5,6 +5,10 @@ from json import loads from glob import glob from pathlib import Path from pytablewriter import MarkdownTableWriter +import requests +import zipfile +import shutil +from contextlib import suppress def print_md_table(settings) -> MarkdownTableWriter: @@ -71,9 +75,10 @@ print("## Core settings\n", file=doc) core_settings = {} for core in glob("src/common/core/*/plugin.json"): with open(core, "r") as f: - core_plugin = loads(f.read()) - if len(core_plugin["settings"]) > 0: - core_settings[core_plugin["name"]] = core_plugin + with suppress(Exception): + core_plugin = loads(f.read()) + if len(core_plugin["settings"]) > 0: + core_settings[core_plugin["name"]] = core_plugin for name, data in dict(sorted(core_settings.items())).items(): print(f"### {data['name']}\n", file=doc) @@ -81,6 +86,63 @@ for name, data in dict(sorted(core_settings.items())).items(): print(f"{data['description']}\n", file=doc) print(print_md_table(data["settings"]), file=doc) + +def pro_title(head_num: str, title: str) -> str: + markdown_header = "##" if head_num == "2" else "###" + return f""" +{markdown_header} {title} + +
+ {title} + + + + + +
+ """ + + +# Read VERSION as file with permissions to read from src/ +with open("src/VERSION", "r") as f: + version = f.read().strip() + +# Get zip file from https://assets.bunkerity.com/bw-pro/preview/v{version} +url = f"https://assets.bunkerity.com/bw-pro/preview/v{version}.zip" + +# Download zip +response = requests.get(url) +response.raise_for_status() +Path(f"v{version}.zip").write_bytes(response.content) + +# Unzip file +with zipfile.ZipFile(f"v{version}.zip", "r") as zip_ref: + zip_ref.extractall(f"v{version}") + +# Print pro settings +print("## Pro plugins", file=doc) +pro_settings = {} +for pro in glob(f"v{version}/*/plugin.json"): + with open(pro, "r") as f: + with suppress(Exception): + pro_plugin = loads(f.read()) + if len(pro_plugin["settings"]) > 0: + pro_settings[pro_plugin["name"]] = pro_plugin + +for name, data in dict(sorted(pro_settings.items())).items(): + print(pro_title("3", data["name"]), file=doc) + print(f"{stream_support(data['stream'])}\n", file=doc) + print(f"{data['description']}\n", file=doc) + print(print_md_table(data["settings"]), file=doc) + +# Remove zip file +Path(f"v{version}.zip").unlink() +# Remove folder using shutil +shutil.rmtree(f"v{version}") + doc.seek(0) content = doc.read() doc = StringIO(content.replace("\\|", "|")) diff --git a/docs/overrides/main.html b/docs/overrides/main.html index 3fb75065b..34117decf 100644 --- a/docs/overrides/main.html +++ b/docs/overrides/main.html @@ -7,8 +7,7 @@ {% endblock %} {% block announce %} - πŸ“’ Looking for technical support, tailored - consulting or custom development for BunkerWeb ? Visit the + πŸ“’ Looking for BunkerWeb PRO version, technical support or tailored services ? Visit the BunkerWeb Panel @@ -19,6 +18,21 @@ defer data-domain="docs.bunkerweb.io" src="https://data.bunkerity.com/js/script.js"> + + + + + +
{{ pre_render }}
``` - -**This class will send a POST request, and will try to match the dict key to a JSON key and update your template**. - - -Here it will look for a `name` key in the JSON response, and will set the `data` on the defined `el`. -In case there is no `data` matching, this will keep or set the `value` key data. - -This class has two arguments `SetupPlugin(setup, url)` : - -- `url`(optional) : current endpoint by default. You can define another url or add arguments. - -- `setup` : a dict of dict with needed data to update properly the template with the incoming data. - -**setup details** - -| key | Type | Description | -| :--------: | :--------: | :------------------------------------------------------------------------------------------- | -| `dict name` | string | Replace `dict name` by the JSON key to extract the related value. | -| `el` | DOM element| Select element you want the value to be updated. | -| `value` | any | Default value on template load or in case retrieving JSON failed. | -| `type` | string | Define the script behavior with the incoming value. Available : `text`, `list` and `status`. | -| `textEl` | DOM element| Optional additional text content when type is `status`. | -| `listNames`| string | List of data keys when type is `list`. | diff --git a/docs/requirements.in b/docs/requirements.in index eebcd5b50..bc3c8b9ab 100644 --- a/docs/requirements.in +++ b/docs/requirements.in @@ -1,5 +1,5 @@ mike==2.0.0 mkdocs==1.5.3 -mkdocs-material[imaging]==9.5.12 +mkdocs-material[imaging]==9.5.13 mkdocs-print-site-plugin==2.3.6 pytablewriter==1.2.0 diff --git a/docs/requirements.txt b/docs/requirements.txt index 4700d8736..b35856239 100644 --- a/docs/requirements.txt +++ b/docs/requirements.txt @@ -200,16 +200,16 @@ idna==3.6 \ --hash=sha256:9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca \ --hash=sha256:c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f # via requests -importlib-metadata==7.0.1 \ - --hash=sha256:4805911c3a4ec7c3966410053e9ec6a1fecd629117df5adee56dfc9432a1081e \ - --hash=sha256:f238736bb06590ae52ac1fab06a3a9ef1d8dce2b7a35b5ab329371d6c8f5d2cc +importlib-metadata==7.0.2 \ + --hash=sha256:198f568f3230878cb1b44fbd7975f87906c22336dba2e4a7f05278c281fbd792 \ + --hash=sha256:f4bc4c0c070c490abf4ce96d715f68e95923320370efb66143df00199bb6c100 # via # markdown # mike # mkdocs -importlib-resources==6.1.2 \ - --hash=sha256:308abf8474e2dba5f867d279237cd4076482c3de7104a40b41426370e891549b \ - --hash=sha256:9a0a862501dc38b68adebc82970140c9e4209fc99601782925178f8386339938 +importlib-resources==6.3.0 \ + --hash=sha256:166072a97e86917a9025876f34286f549b9caf1d10b35a1b372bffa1600c6569 \ + --hash=sha256:783407aa1cd05550e3aa123e8f7cfaebee35ffa9cb0242919e2d1e4172222705 # via mike jinja2==3.1.3 \ --hash=sha256:7d6d50dd97d52cbc355597bd845fabfbac3f551e1f99619e39a35ce8c370b5fa \ @@ -218,9 +218,9 @@ jinja2==3.1.3 \ # mike # mkdocs # mkdocs-material -markdown==3.5.2 \ - --hash=sha256:d43323865d89fc0cb9b20c75fc8ad313af307cc087e84b657d9eec768eddeadd \ - --hash=sha256:e1ac7b3dc550ee80e602e71c1d168002f062e49f1b11e26a36264dafd4df2ef8 +markdown==3.6 \ + --hash=sha256:48f276f4d8cfb8ce6527c8f79e2ee29708508bf4d40aa410fbc3b4ee832c850f \ + --hash=sha256:ed4f41f6daecbeeb96e576ce414c41d2d876daa9a16cb35fa8ed8c2ddfad0224 # via # mkdocs # mkdocs-material @@ -311,9 +311,9 @@ mkdocs==1.5.3 \ # -r requirements.in # mike # mkdocs-material -mkdocs-material==9.5.12 \ - --hash=sha256:5f69cef6a8aaa4050b812f72b1094fda3d079b9a51cf27a247244c03ec455e97 \ - --hash=sha256:d6f0c269f015e48c76291cdc79efb70f7b33bbbf42d649cfe475522ebee61b1f +mkdocs-material==9.5.13 \ + --hash=sha256:5cbe17fee4e3b4980c8420a04cc762d8dc052ef1e10532abd4fce88e5ea9ce6a \ + --hash=sha256:d8e4caae576312a88fd2609b81cf43d233cdbe36860d67a68702b018b425bd87 # via # -r requirements.in # mkdocs-print-site-plugin @@ -325,9 +325,9 @@ mkdocs-print-site-plugin==2.3.6 \ --hash=sha256:01ccb1ceccc87f29e1612bebb77c3bf9980809fbce750fc2113f9d6acea589d4 \ --hash=sha256:82e5cabcfb7fe3074daecea018f28ccb4bff086f965e3103fe91019a76752f22 # via -r requirements.in -packaging==23.2 \ - --hash=sha256:048fb0e9405036518eaaf48a55953c750c11e1a1b68e0dd1a9d62ed0c092cfc5 \ - --hash=sha256:8c491190033a9af7e1d931d0b5dacc2ef47509b34dd0de67ed209b5203fc88c7 +packaging==24.0 \ + --hash=sha256:2ddfb553fdf02fb784c234c7ba6ccc288296ceabec964ad2eae3777778130bc5 \ + --hash=sha256:eb82c5e3e56209074766e6885bb04b8c38a0c015d0a30036ebe7ece34c9989e9 # via # mkdocs # typepy @@ -430,9 +430,9 @@ pymdown-extensions==10.7.1 \ --hash=sha256:c70e146bdd83c744ffc766b4671999796aba18842b268510a329f7f64700d584 \ --hash=sha256:f5cc7000d7ff0d1ce9395d216017fa4df3dde800afb1fb72d1c7d3fd35e710f4 # via mkdocs-material -pyparsing==3.1.1 \ - --hash=sha256:32c7c0b711493c72ff18a981d24f28aaf9c1fb7ed5e9667c9e84e3db623bdbfb \ - --hash=sha256:ede28a1a32462f5a9705e07aea48001a08f7cf81a021585011deba701581a0db +pyparsing==3.1.2 \ + --hash=sha256:a1bac0ce561155ecc3ed78ca94d3c9378656ad4c94c1270de543f621420f94ad \ + --hash=sha256:f9db75911801ed778fe61bb643079ff86601aca99fcae6345aa67292038fb742 # via mike pytablewriter==1.2.0 \ --hash=sha256:0204a4bb684a22140d640f2599f09e137bcdc18b3dd49426f4a555016e246b46 \ @@ -612,9 +612,9 @@ requests==2.31.0 \ # importlib-resources # The following packages are considered to be unsafe in a requirements file: -setuptools==69.1.1 \ - --hash=sha256:02fa291a0471b3a18b2b2481ed902af520c69e8ae0919c13da936542754b4c56 \ - --hash=sha256:5c0806c7d9af348e6dd3777b4f4dbb42c7ad85b190104837488eab9a7c945cf8 +setuptools==69.2.0 \ + --hash=sha256:0ff4183f8f42cd8fa3acea16c45205521a4ef28f73c6391d8a25e92893134f2e \ + --hash=sha256:c21c49fb1042386df081cb5d86759792ab89efca84cf114889191cd09aacc80c # via mkdocs-material six==1.16.0 \ --hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \ @@ -686,7 +686,7 @@ webencodings==0.5.1 \ # via # cssselect2 # tinycss2 -zipp==3.17.0 \ - --hash=sha256:0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31 \ - --hash=sha256:84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0 +zipp==3.18.1 \ + --hash=sha256:206f5a15f2af3dbaee80769fb7dc6f249695e940acca08dfb2a4769fe61e538b \ + --hash=sha256:2884ed22e7d8961de1c9a05142eb69a247f120291bc0206a00a7642f09b5b715 # via pytablewriter diff --git a/docs/security-tuning.md b/docs/security-tuning.md index d3a3d6440..541fbb26d 100644 --- a/docs/security-tuning.md +++ b/docs/security-tuning.md @@ -502,3 +502,99 @@ You can deploy complex authentication (e.g. SSO), by using the auth request sett | `REVERSE_PROXY_AUTH_REQUEST` | | multisite | yes | Enable authentication using an external provider (value of auth_request directive). | | `REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL` | | multisite | yes | Redirect clients to sign-in URL when using REVERSE_PROXY_AUTH_REQUEST (used when auth_request call returned 401). | | `REVERSE_PROXY_AUTH_REQUEST_SET` | | multisite | yes | List of variables to set from the authentication provider, separated with ; (values of auth_request_set directives). | + +## Monitoring and reporting + +Monitoring and reporting means that you are kept informed of the slightest problem and can react as quickly as possible. + +### Reporting + +
+ +

Reporting

+ + + + + +
+ +!!! warning "Used of cache data" + + A comparison is made every hour with the cached data. If BunkerWeb no longer has access to the cache, the data to be compared will be reset. + +#### Types of reporting + +Pro reporting plugin gives you two types of reports : + + - **regular report**: you can define a period of time, and you'll get a regular report showing the percentage change in data between the previous report and this one, and also key points about your BunkerWeb state. + + - **alerts**: every hour, an analysis of the metrics will be carried out, and you can set a threshold for the percentage change in the data. If this threshold is reached, you will receive an alert. + +!!! info "Example" + + After one hour, if I go from 300 requests blocked to more than 600 after one hour : in case I have set a threshold of +100%, I'll be alerted. + +#### Get reporting + +To receive alerts or regular reports, you can use : + +**1) webhook** + +We are supporting multiple webhooks : + + - **API** : we will send a JSON of type `{"message" : markdownReport }`. + - **Discord** + - **Slack** + +!!! info "Specific webhook" + + We listen to our customers, so if you need to make the plugin compatible with a particular webhook, don't hesitate to contact us to discuss it together. + +**2) SMTP** + +You can also use the SMTP protocol. You will need to set the various parameters (user auth, password auth, host...). + +You need to **pay attention** using SMTP: + + - Make sure that the address used to send the **message does not end up in the spam folder**. + + - The address used must **not have double authentication** to work. + + +### Prometheus exporter + +
+ +

Prometheus exporter

+ + + + + +
+ +TO DO + +### Pro metrics + +
+ +

Pro metrics

+ + + + + +
+ +TO DO diff --git a/docs/settings.md b/docs/settings.md index 771a97d61..a7a2c7e13 100644 --- a/docs/settings.md +++ b/docs/settings.md @@ -315,27 +315,17 @@ Manage HTTP headers sent to clients. |`X_CONTENT_TYPE_OPTIONS` |`nosniff` |multisite|no |Value for the X-Content-Type-Options header. | |`X_XSS_PROTECTION` |`1; mode=block` |multisite|no |Value for the X-XSS-Protection header. | -### Jobs - -STREAM support :white_check_mark: - -Fake core plugin for internal jobs. - -| Setting |Default|Context|Multiple| Description | -|-----------------------|-------|-------|--------|-----------------------------------------------| -|`SEND_ANONYMOUS_REPORT`|`yes` |global |no |Send anonymous report to BunkerWeb maintainers.| - ### Let's Encrypt STREAM support :white_check_mark: Automatic creation, renewal and configuration of Let's Encrypt certificates. -| Setting |Default| Context |Multiple| Description | -|--------------------------|-------|---------|--------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -|`AUTO_LETS_ENCRYPT` |`no` |multisite|no |Activate automatic Let's Encrypt mode. | -|`EMAIL_LETS_ENCRYPT` | |multisite|no |Email used for Let's Encrypt notification and in certificate. | -|`USE_LETS_ENCRYPT_STAGING`|`no` |multisite|no |Use the staging environment for Let’s Encrypt certificate generation. Useful when you are testing your deployments to avoid being rate limited in the production environment.| +| Setting |Default| Context |Multiple| Description | +|--------------------------|-------|---------|--------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +|`AUTO_LETS_ENCRYPT` |`no` |multisite|no |Activate automatic Let's Encrypt mode. | +|`EMAIL_LETS_ENCRYPT` | |multisite|no |Email used for Let's Encrypt notification and in certificate. | +|`USE_LETS_ENCRYPT_STAGING`|`no` |multisite|no |Use the staging environment for LetÒ€ℒs Encrypt certificate generation. Useful when you are testing your deployments to avoid being rate limited in the production environment.| ### Limit @@ -390,6 +380,7 @@ Miscellaneous settings. |`OPEN_FILE_CACHE_VALID` |`30s` |multisite|no |Open file cache valid time | |`EXTERNAL_PLUGIN_URLS` | |global |no |List of external plugins URLs (direct download to .zip or .tar file) to download and install (URLs are separated with space).| |`DENY_HTTP_STATUS` |`403` |global |no |HTTP status code to send when the request is denied (403 or 444). When using 444, BunkerWeb will close the connection. | +|`SEND_ANONYMOUS_REPORT` |`yes` |global |no |Send anonymous report to BunkerWeb maintainers. | ### ModSecurity @@ -587,3 +578,32 @@ Allow access based on internal and external IP/network/rDNS/ASN whitelists. |`WHITELIST_USER_AGENT_URLS`| |global |no |List of URLs, separated with spaces, containing good User-Agent to whitelist. | |`WHITELIST_URI` | |multisite|no |List of URI (PCRE regex), separated with spaces, to whitelist. | |`WHITELIST_URI_URLS` | |global |no |List of URLs, separated with spaces, containing bad URI to whitelist. | + +## Pro plugins + +### Prometheus exporter + +
+

Prometheus exporter

+ + + + + +
+ +STREAM support :x: + +Prometheus export for BunkerWeb + +| Setting | Default |Context|Multiple| Description | +|-------------------------------|-----------------------------------------------------|-------|--------|------------------------------------------------------------------------| +|`USE_PROMETHEUS_EXPORTER` |`no` |global |no |Enable the Prometheus export. | +|`PROMETHEUS_EXPORTER_IP` |`0.0.0.0` |global |no |Listening IP of the Prometheus exporter. | +|`PROMETHEUS_EXPORTER_PORT` |`9113` |global |no |Listening port of the Prometheus exporter. | +|`PROMETHEUS_EXPORTER_DICT_SIZE`|`10M` |global |no |Size of the dict to store Prometheus metrics. | +|`PROMETHEUS_EXPORTER_ALLOW_IP` |`127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16`|global |no |List of IP/networks allowed to contact the Prometheus exporter endpoint.| +|`PROMETHEUS_EXPORTER_URL` |`/metrics` |global |no |HTTP URL of the Prometheus exporter. | diff --git a/docs/web-ui.md b/docs/web-ui.md index 960a59285..b7a39d052 100644 --- a/docs/web-ui.md +++ b/docs/web-ui.md @@ -1738,11 +1738,9 @@ In case you have buy a (pro version)[https://panel.bunkerweb.io/?utm_campaign=se - fill the **setting Pro License Key** - **save** your changes +!!! warning "Download" -
- ![Overview](assets/img/pro-from-ui.webp){ align=center, width="1000" } -
Upgrade to PRO from UI
-
+ The pro version is downloaded in the background by the scheduler. It may take some time before you see the changes to the UI. If your license key is valid, the upgrade to the pro version will take place automatically in the background. diff --git a/src/autoconf/Dockerfile b/src/autoconf/Dockerfile index d3a29ce9d..53d51dc13 100644 --- a/src/autoconf/Dockerfile +++ b/src/autoconf/Dockerfile @@ -1,27 +1,19 @@ FROM python:3.12.2-alpine3.19@sha256:1a0501213b470de000d8432b3caab9d8de5489e9443c2cc7ccaa6b0aa5c3148e as builder +# Install python dependencies +RUN apk add --no-cache build-base postgresql-dev + # Copy python requirements COPY src/deps/requirements.txt /tmp/requirements-deps.txt -COPY src/common/gen/requirements.txt /tmp/req/requirements.txt -COPY src/common/db/requirements.txt /tmp/req/requirements.txt.1 +COPY src/common/gen/requirements.txt /tmp/req/requirements-gen.txt +COPY src/common/db/requirements.txt /tmp/req/requirements-db.txt WORKDIR /usr/share/bunkerweb -RUN mkdir -p deps/python && \ - cat /tmp/req/requirements.txt* > deps/requirements.txt && \ - rm -rf /tmp/req - -# Install python dependencies -RUN apk add --no-cache --virtual .build-deps g++ gcc musl-dev jpeg-dev zlib-dev libffi-dev cairo-dev pango-dev gdk-pixbuf-dev openssl-dev cargo postgresql-dev - # Install python requirements RUN export MAKEFLAGS="-j$(nproc)" && \ - pip install --no-cache-dir --ignore-installed --require-hashes -r /tmp/requirements-deps.txt && \ - pip install --no-cache-dir --require-hashes --target deps/python -r deps/requirements.txt - -# Remove build dependencies -RUN apk del .build-deps && \ - rm -rf /var/cache/apk/* + pip install --no-cache-dir --require-hashes --break-system-packages -r /tmp/requirements-deps.txt && \ + pip install --no-cache-dir --require-hashes --target deps/python $(for file in $(ls /tmp/req/requirements*.txt) ; do echo "-r ${file}" ; done | xargs) # Copy files # can't exclude specific files/dir from . so we are copying everything by hand @@ -49,9 +41,8 @@ RUN apk add --no-cache bash && \ addgroup -g 101 autoconf && \ adduser -h /var/cache/autoconf -g autoconf -s /bin/sh -G autoconf -D -H -u 101 autoconf && \ cp helpers/bwcli /usr/bin/ && \ - mkdir -p /var/tmp/bunkerweb && \ - mkdir -p /var/www && \ - mkdir -p /etc/bunkerweb && \ + echo "Docker" > INTEGRATION && \ + mkdir -p /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb /var/www && \ mkdir -p /data/cache && ln -s /data/cache /var/cache/bunkerweb && \ mkdir -p /data/lib && ln -s /data/lib /var/lib/bunkerweb && \ mkdir -p /data/www && ln -s /data/www /var/www/html && \ @@ -59,14 +50,15 @@ RUN apk add --no-cache bash && \ for dir in $(echo "configs/http configs/stream configs/server-http configs/server-stream configs/default-server-http configs/default-server-stream configs/modsec configs/modsec-crs") ; do mkdir "/data/${dir}" ; done && \ chown -R root:autoconf /data && \ chmod -R 770 /data && \ - chown -R root:autoconf /var/cache/bunkerweb /var/lib/bunkerweb /etc/bunkerweb /var/tmp/bunkerweb /usr/bin/bwcli && \ + chown -R root:autoconf INTEGRATION /var/cache/bunkerweb /var/lib/bunkerweb /etc/bunkerweb /var/tmp/bunkerweb /usr/bin/bwcli && \ chmod -R 770 /var/cache/bunkerweb /var/lib/bunkerweb /etc/bunkerweb /var/tmp/bunkerweb && \ - chmod 750 cli/main.py helpers/*.sh /usr/bin/bwcli autoconf/main.py deps/python/bin/* + chmod 750 cli/main.py helpers/*.sh /usr/bin/bwcli autoconf/main.py deps/python/bin/* && \ + chmod 660 INTEGRATION # Fix CVEs RUN apk add --no-cache "libexpat>=2.6.0-r0" -VOLUME /data /etc/nginx +VOLUME /data WORKDIR /usr/share/bunkerweb/autoconf diff --git a/src/bw/Dockerfile b/src/bw/Dockerfile index c773f5a2a..da0901547 100644 --- a/src/bw/Dockerfile +++ b/src/bw/Dockerfile @@ -1,7 +1,7 @@ -FROM nginx:1.24.0-alpine@sha256:6845649eadc1f0a5dacaf5bb3f01b480ce200ae1249114be11fef9d389196eaf AS builder +FROM nginx:1.24.0-alpine-slim@sha256:9cec4fd40a4e5156b4f4f555ee44a597491b6e8b91380c32b63ed45a4053a763 AS builder # Install temporary requirements for the dependencies -RUN apk add --no-cache --virtual .build-deps bash autoconf libtool automake geoip-dev g++ gcc curl-dev libxml2-dev pcre-dev make linux-headers musl-dev gd-dev gnupg brotli-dev openssl-dev patch readline-dev yajl yajl-dev yajl-tools py3-pip +RUN apk add --no-cache bash autoconf libtool automake geoip-dev g++ gcc curl-dev libxml2-dev pcre-dev make linux-headers musl-dev gd-dev gnupg brotli-dev openssl-dev patch readline-dev yajl yajl-dev yajl-tools py3-pip WORKDIR /tmp/bunkerweb/deps @@ -9,27 +9,21 @@ WORKDIR /tmp/bunkerweb/deps COPY src/deps/misc misc COPY src/deps/src src COPY src/deps/deps.json deps.json -COPY src/deps/install.sh install.sh +COPY --chmod=644 src/deps/install.sh install.sh # Compile and install dependencies -RUN mkdir -p /usr/share/bunkerweb/deps/python && \ - chmod +x install.sh && \ - bash install.sh +RUN bash install.sh WORKDIR /usr/share/bunkerweb # Copy python requirements COPY src/deps/requirements.txt /tmp/requirements-deps.txt -COPY src/common/gen/requirements.txt deps/requirements.txt +COPY src/common/gen/requirements.txt deps/requirements-gen.txt # Install python requirements RUN export MAKEFLAGS="-j$(nproc)" && \ - pip install --no-cache-dir --ignore-installed --require-hashes -r /tmp/requirements-deps.txt && \ - pip install --no-cache-dir --require-hashes --target deps/python -r deps/requirements.txt - -# Clean up temporary dependencies -RUN apk del .build-deps && \ - rm -rf /var/cache/apk/* + pip install --no-cache-dir --require-hashes --ignore-installed -r /tmp/requirements-deps.txt && \ + pip install --no-cache-dir --require-hashes --target deps/python -r deps/requirements-gen.txt # Copy files # can't exclude deps from . so we are copying everything by hand @@ -48,7 +42,7 @@ COPY src/common/utils utils COPY src/VERSION VERSION COPY misc/*.ascii misc/ -FROM nginx:1.24.0-alpine@sha256:76ca7f6bfe01c3e22e3af85fd37c30149ece3ac2a444973687cab1765abca115 +FROM nginx:1.24.0-alpine-slim@sha256:9cec4fd40a4e5156b4f4f555ee44a597491b6e8b91380c32b63ed45a4053a763 # Set default umask to prevent huge recursive chmod increasing the final image size RUN umask 027 @@ -59,18 +53,14 @@ COPY --from=builder --chown=0:101 /usr/share/bunkerweb /usr/share/bunkerweb WORKDIR /usr/share/bunkerweb # Install runtime dependencies, pypi packages, move bwcli, create data folders and set permissions -RUN apk add --no-cache pcre bash python3 yajl && \ +RUN apk add --no-cache openssl pcre bash python3 yajl geoip libxml2 libgd && \ cp helpers/bwcli /usr/bin/ && \ - mkdir -p /var/tmp/bunkerweb && \ - mkdir -p /var/run/bunkerweb && \ - mkdir -p /var/log/bunkerweb && \ - mkdir -p /var/www/html && \ - mkdir -p /etc/bunkerweb && \ + mkdir -p /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb /var/www/html && \ mkdir -p /data/cache && ln -s /data/cache /var/cache/bunkerweb && \ for dir in $(echo "pro configs plugins") ; do mkdir -p "/data/${dir}" && ln -s "/data/${dir}" "/etc/bunkerweb/${dir}" ; done && \ for dir in $(echo "pro/plugins configs/http configs/stream configs/server-http configs/server-stream configs/default-server-http configs/default-server-stream configs/modsec configs/modsec-crs") ; do mkdir "/data/${dir}" ; done && \ chown -R root:nginx /data /etc/nginx /var/cache/bunkerweb /etc/bunkerweb /var/tmp/bunkerweb /var/run/bunkerweb /var/log/bunkerweb /usr/bin/bwcli && \ - chmod -R 770 /data /etc/nginx /var/cache/bunkerweb /var/tmp/bunkerweb /var/log/bunkerweb /var/run/bunkerweb && \ + chmod -R 770 /data /etc/nginx /var/cache/bunkerweb /etc/bunkerweb /var/tmp/bunkerweb /var/log/bunkerweb /var/run/bunkerweb && \ chmod 750 cli/main.py gen/main.py helpers/*.sh entrypoint.sh /usr/bin/bwcli deps/python/bin/* && \ rm -f /var/log/bunkerweb/* && \ ln -s /proc/1/fd/2 /var/log/bunkerweb/error.log && \ diff --git a/src/bw/lua/bunkerweb/api.lua b/src/bw/lua/bunkerweb/api.lua index 59df14b3b..cca063003 100644 --- a/src/bw/lua/bunkerweb/api.lua +++ b/src/bw/lua/bunkerweb/api.lua @@ -94,10 +94,12 @@ end api.global.POST["^/reload$"] = function(self) -- Check config + logger:log(NOTICE, "Checking Nginx configuration") local status = execute("nginx -t") if status ~= 0 then return self:response(HTTP_INTERNAL_SERVER_ERROR, "error", "config check failed") end + logger:log(NOTICE, "Nginx configuration is valid, reloading Nginx") -- Send HUP signal to master process local ok, err = kill(get_master_pid(), "HUP") if not ok then diff --git a/src/bw/lua/bunkerweb/mmdb.lua b/src/bw/lua/bunkerweb/mmdb.lua index 23105eccd..3bcb5200a 100644 --- a/src/bw/lua/bunkerweb/mmdb.lua +++ b/src/bw/lua/bunkerweb/mmdb.lua @@ -1,6 +1,6 @@ local geoip = require "geoip.mmdb" return { - country_db = geoip.load_database "/var/cache/bunkerweb/country.mmdb", - asn_db = geoip.load_database "/var/cache/bunkerweb/asn.mmdb", + country_db = geoip.load_database "/var/cache/bunkerweb/jobs/country.mmdb", + asn_db = geoip.load_database "/var/cache/bunkerweb/jobs/asn.mmdb", } diff --git a/src/common/confs/default-server-http.conf b/src/common/confs/default-server-http.conf index d340d6651..126d61c19 100644 --- a/src/common/confs/default-server-http.conf +++ b/src/common/confs/default-server-http.conf @@ -17,7 +17,7 @@ server { # HTTPS listen {% set os = import("os") %} -{% if os.path.isfile("/var/cache/bunkerweb/default-server-cert/cert.pem") +%} +{% if os.path.isfile("/var/cache/bunkerweb/misc/default-server-cert.pem") +%} ssl_protocols {{ SSL_PROTOCOLS }}; ssl_prefer_server_ciphers on; ssl_session_tickets off; @@ -27,8 +27,8 @@ server { ssl_dhparam /etc/nginx/dhparam; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; {% endif %} - ssl_certificate /var/cache/bunkerweb/default-server-cert/cert.pem; - ssl_certificate_key /var/cache/bunkerweb/default-server-cert/cert.key; + ssl_certificate /var/cache/bunkerweb/misc/default-server-cert.pem; + ssl_certificate_key /var/cache/bunkerweb/misc/default-server-cert.key; listen 0.0.0.0:{{ HTTPS_PORT }} ssl {% if HTTP2 == "yes" %}http2{% endif %} default_server {% if USE_PROXY_PROTOCOL == "yes" %}proxy_protocol{% endif %}; {% if USE_IPV6 == "yes" +%} listen [::]:{{ HTTPS_PORT }} ssl {% if HTTP2 == "yes" %}http2{% endif %} default_server {% if USE_PROXY_PROTOCOL == "yes" %}proxy_protocol{% endif %}; @@ -38,6 +38,9 @@ server { {% if IS_LOADING == "yes" +%} root /usr/share/bunkerweb/loading; try_files /index.html =404; + etag off; + add_header Last-Modified ""; + server_tokens off; {% endif %} # include core and plugins default-server configurations diff --git a/src/common/confs/server-http/ssl-certificate-lua.conf b/src/common/confs/server-http/ssl-certificate-lua.conf index 3e6ffc94d..79e1c4d9e 100644 --- a/src/common/confs/server-http/ssl-certificate-lua.conf +++ b/src/common/confs/server-http/ssl-certificate-lua.conf @@ -1,5 +1,5 @@ -ssl_certificate /var/cache/bunkerweb/default-server-cert/cert.pem; -ssl_certificate_key /var/cache/bunkerweb/default-server-cert/cert.key; +ssl_certificate /var/cache/bunkerweb/misc/default-server-cert.pem; +ssl_certificate_key /var/cache/bunkerweb/misc/default-server-cert.key; ssl_protocols {{ SSL_PROTOCOLS }}; ssl_prefer_server_ciphers on; ssl_session_tickets off; diff --git a/src/common/confs/server-stream/ssl-certificate-stream-lua.conf b/src/common/confs/server-stream/ssl-certificate-stream-lua.conf index 0ae726279..5009aa897 100644 --- a/src/common/confs/server-stream/ssl-certificate-stream-lua.conf +++ b/src/common/confs/server-stream/ssl-certificate-stream-lua.conf @@ -1,5 +1,5 @@ -ssl_certificate /var/cache/bunkerweb/default-server-cert/cert.pem; -ssl_certificate_key /var/cache/bunkerweb/default-server-cert/cert.key; +ssl_certificate /var/cache/bunkerweb/misc/default-server-cert.pem; +ssl_certificate_key /var/cache/bunkerweb/misc/default-server-cert.key; ssl_protocols {{ SSL_PROTOCOLS }}; ssl_prefer_server_ciphers on; ssl_session_tickets off; diff --git a/src/common/core/antibot/ui/actions.py b/src/common/core/antibot/ui/actions.py index 52b4f80f6..b3ce80b44 100644 --- a/src/common/core/antibot/ui/actions.py +++ b/src/common/core/antibot/ui/actions.py @@ -1,11 +1,18 @@ -def antibot(**kwargs): +def pre_render(**kwargs): try: data = kwargs["app"].config["INSTANCES"].get_metrics("antibot") - - if data.get("counter_failed_challenges") is None: - data["counter_failed_challenges"] = 0 - - return data - + return { + "counter_failed_challenges": { + "value": data.get("counter_failed_challenges", 0), + "title": "Challenge", + "subtitle": "Failed", + "subtitle_color": "info", + "svg_color": "blue", + } + } except: - return {"counter_failed_challenges": 0} + return {"counter_failed_challenges": {"value": "unknown", "title": "Challenge", "subtitle": "Failed", "subtitle_color": "info", "svg_color": "blue"}} + + +def antibot(**kwargs): + pass diff --git a/src/common/core/antibot/ui/template.html b/src/common/core/antibot/ui/template.html index 27f30c3e6..bb9aba233 100644 --- a/src/common/core/antibot/ui/template.html +++ b/src/common/core/antibot/ui/template.html @@ -7,52 +7,111 @@ hidden />
{% if is_used and is_metrics %} - -
-
INFO
-
-

-
+
+
INFO
+
+

{{plugin.get('description')}}

- -
- -
-

Challenges

-
"unknown"
-

- total failed -

+
+
+ + {% if pre_render["status"] and pre_render["status"] == "ko" or "error" in pre_render["data"] %} +
+

Error during pre rendering

+
+ + + +
+
+ {% endif %} + + {% if pre_render["status"] and pre_render["status"] == "ok" and "error" not in pre_render["data"] %} + + + {% for key, value in pre_render["data"].items() %} + + {% if key.startswith("ping_") %} +
+
+
{{ pre_render['data'][key].get('title', 'STATUS')}}
+ + + +
+

{{ 'Active' if pre_render['data'][key].get('value') in ('up', 'yes', 'success', 'true') else 'Inactive' }}

- - - - + {% endif %} + + + {% if (key.startswith("top_") and pre_render['data'][key]|length > 0) or (key.startswith("list_") and pre_render['data'][key]|length > 0) %} +
+
+
{{ key.replace('_', ' ').upper()}}
+
+
+ +
+ + {% for val_key, val_value in pre_render['data'][key][0].items() %} + + +

{{ val_key }}

+ {% endfor%} + + +
    + {% for item in pre_render['data'][key] %} +
  • + {% for top_key, top_value in item.items() %} +

    {{ top_value }}

    + {% endfor %} +
  • + {% endfor %} +
+ + +
+ +
+
+ {% endif %} + + + {% endfor %} + {% endif %} {% else %}
@@ -71,7 +130,7 @@
-

This plugin need to be activated to get metrics.

+

This plugin need to be activated to access page.

diff --git a/src/common/core/badbehavior/ui/actions.py b/src/common/core/badbehavior/ui/actions.py index 3371a092f..56b29e64d 100644 --- a/src/common/core/badbehavior/ui/actions.py +++ b/src/common/core/badbehavior/ui/actions.py @@ -1,13 +1,17 @@ from operator import itemgetter -def badbehavior(**kwargs): +def pre_render(**kwargs): try: # Here we will have a list { 'counter_403': X, 'counter_401': Y ... } data = kwargs["app"].config["INSTANCES"].get_metrics("badbehavior") # Format to fit [{code: 403, count: X}, {code: 401, count: Y} ...] format_data = [{"code": int(key.split("_")[1]), "count": int(value)} for key, value in data.items()] format_data.sort(key=itemgetter("count"), reverse=True) - return {"items": format_data} + return {"top_bad_behavior": format_data} except: - return {"items": []} + return {"top_bad_behavior": "unknown"} + + +def badbehavior(**kwargs): + pass diff --git a/src/common/core/badbehavior/ui/template.html b/src/common/core/badbehavior/ui/template.html index 9493b8163..a85140a46 100644 --- a/src/common/core/badbehavior/ui/template.html +++ b/src/common/core/badbehavior/ui/template.html @@ -7,53 +7,111 @@ hidden />
{% if is_used and is_metrics %} - -
-
INFO
-
-

-
+
+
INFO
+
+

{{plugin.get('description')}}

- -