mirror of
https://github.com/bunkerity/bunkerweb
synced 2026-05-24 09:28:37 +00:00
Squashed 'src/deps/src/headers-more-nginx-module/' changes from bea1be3bbf..576cb81979
576cb81979Merge commit 'c473aa40807f32438ffe34bdfe07f8f0485a6aa4' into devc473aa4080Squashed 'src/deps/src/lua-resty-openssl/' changes from b23c072a4..89195843c456e6a33dbUpdate lua-resty-openssl to v1.0.111c4fde616Merge commit '805e5c9cee2a72af6b6297b2993109511b42d485' into dev805e5c9ceeSquashed 'src/deps/src/libmaxminddb/' changes from ac4d0d248..93a7e0e56afcf420ee4Update libmaxminddb to v1.8.07aa6affe10Merge commit 'e3f305a953ef5dbf6802090c7013f4c38d762449' into deve3f305a953Squashed 'src/deps/src/ngx_devel_kit/' changes from b4642d6ca..91e30eb05cba20187c9Update Nginx devel kit to v0.3.310a58377b8Fix multiple CVEs related to libpq * CVE-2023-5869 * CVE-2023-5868 * CVE-2023-58707c564e4cb0Update pre-commit hooks to latest versionsbff775f006Fix issues with the Linux integration and external databases71db00281dMerge pull request #759 from bunkerity/dependabot/github_actions/dev/ruby/setup-ruby-1.161.0940eecd062deps/gha: bump ruby/setup-ruby from 1.160.0 to 1.161.042f7ef4862Update user interface demo image in README.mdb2a56a82a4Update BunkerWeb UI demo to use thumbnail image0d0bad79bcUpdate Python version in Dockerfilesb539a97ad9Fix CVE CVE-2023-5678 in Dockerfiles05da26f010Update dependencies to latest versionse153c33aaaUpdate maxminddb and other dependencies versions8d024a0996Merge pull request #751 from bunkerity/dependabot/github_actions/dev/rickstaa/action-create-tag-1.7.1ca6271c60aMerge pull request #750 from bunkerity/dependabot/github_actions/dev/ruby/setup-ruby-1.160.0fbbec2f7f7deps/gha: bump rickstaa/action-create-tag from 1.6.6 to 1.7.19c6f5289d1deps/gha: bump ruby/setup-ruby from 1.159.0 to 1.160.0bcded8f7ceAdd refurb as a pre-commit-config hook and apply pre-commit-config966a78da9eUpdate Git attributes to ignore text and end-of-line settings for vendored filesf111124b34Update dependencies versionsd2b82b29d2Fix CVEs CVE-2023-43787, CVE-2023-43785 and CVE-2023-43786dc5a7b8b2aUpdate mmdb filesc32522ae29Update Certbot module to version 2.7.4 + Update python deps hashes54ead4e49cMerge pull request #744 from bunkerity/dependabot/github_actions/dev/rickstaa/action-create-tag-1.6.6d835369699deps/gha: bump rickstaa/action-create-tag from 1.6.4 to 1.6.6b79b6548b3Merge pull request #741 from bunkerity/dependabot/github_actions/dev/hashicorp/setup-terraform-3.0.0b05b981858docs - update plugins to 1.2e8803e346fcache linux test images, fix linux example of proxy protocol and add more logs to k8s tests7565b2df58Merge branch 'dev' into stagingc817f45abdadd ready checks to limit and redis core tests and fix wrong http port for behind reverse proxy linux testf9f616a66fMerge branch 'dev' into staging4871185dc0Update python deps and pin Flask-Login versioncd773b6e80add ready checks to reversecan and sessions tests898ef2eff0deps/gha: bump hashicorp/setup-terraform from 2.0.3 to 3.0.0fa628cb7d6linux - add default API_LISTEN_IP18d682b5a6linux - add missing API_LISTEN_IP initial setting and perform only hot reload4fbd974d2ftests - set trace verbosity for geckodriver logsa7c343369dMerge branch 'dev' of github.com:bunkerity/bunkerweb into dev7d69b91056tests - fix missing geckodriver log file in ui tests29d7d94b2c[#739] Fix potential issue when fetching docker instances in the web UI84eb947206tests - add geckodriver log file for ui tests40e118a712tests - add more logs to ui linux tests0e3d8e59cctests - retry UI access in case of network exception86875f4863tests - fix misc ready check when using https and add ready checks for linux uid4a2ba5fc8tests - add ready checks to customcert and misc3020c5c8e5tests - add ready check for customcert core testc1562bc896Merge pull request #737 from bunkerity/dependabot/github_actions/dev/github/codeql-action-2.22.5322cfd2179deps/gha: bump github/codeql-action from 2.22.4 to 2.22.5caf732be1dMerge pull request #736 from bunkerity/dependabot/github_actions/dev/ruby/setup-ruby-1.159.0667620b521deps/gha: bump ruby/setup-ruby from 1.158.0 to 1.159.0fb21786b8clinux - fixing nginx service not disabled and fix another missing error log path in UI5887b894f0ui - fix wrong error path when starting nginx4e820f6de2linux - remove sudo command when reloading nginx35d16233cdci/cd - ignore ready conf for db tests and fix linux path for ready conf9775cd5bbdci/cd - fix missing string in /ready endpoint and add /ready endpoint to linux tests274a8cdfb9ci/cd - trying to fix race condition for core testsd73a5d0f45Merge pull request #735 from bunkerity/deved0e156bcbUpdate Werkzeug to version 3.0.1 in web UI8ec9a7df40Fix compatibility issue with Docker Compose v2 2.23.0 in examples and docs72d856abe1Update certbot to version 2.7.3 + regenerate hashes for db and schedulerab76c458efMerge pull request #732 from bunkerity/dependabot/github_actions/dev/ruby/setup-ruby-1.158.06edf97a0d7deps/gha: bump ruby/setup-ruby from 1.157.0 to 1.158.058d6b81423use cap in Linux and add openssf badgea83a74cfadMerge pull request #729 from bunkerity/dev0975de1238[#717] Add a pool_recycle database engine arg to avoid losing connection with database762092e5e9Remove no longer necessary retrying module8963cb4d18Update python depsc2252503d0Merge pull request #721 from bunkerity/dependabot/github_actions/dev/ossf/scorecard-action-2.3.1626f10b4c1Merge pull request #722 from bunkerity/dependabot/github_actions/dev/actions/setup-node-4.0.0f2b9fc0f8fMerge pull request #724 from bunkerity/dependabot/docker/src/autoconf/dev/python-a5d1738c8eae49e5bdeps/autoconf: bump python from `dc2e889` to `a5d1738` in /src/autoconfab320794adMerge pull request #723 from bunkerity/dependabot/docker/src/ui/dev/python-a5d1738572436f208Merge pull request #720 from bunkerity/dependabot/docker/src/scheduler/dev/python-a5d17386f366450bcdeps/ui: bump python from `dc2e889` to `a5d1738` in /src/uif6d2e205cfdeps/scheduler: bump python in /src/scheduler50a60382a1Fix CVE CVE-2023-5363989c14ae73Fix CVE CVE-2023-5363a847f77782deps/gha: bump actions/setup-node from 3.8.1 to 4.0.08708ad70c3deps/gha: bump ossf/scorecard-action from 2.3.0 to 2.3.1eeda7a18c3Update python deps + add retrying module to db5193d6cd19Update docker images09ee050833Merge pull request #719 from bunkerity/dependabot/github_actions/dev/ruby/setup-ruby-1.157.00afed0621cMerge pull request #718 from bunkerity/dependabot/github_actions/dev/github/codeql-action-2.22.48919592f54deps/gha: bump ruby/setup-ruby from 1.156.0 to 1.157.0d253b4438fdeps/gha: bump github/codeql-action from 2.22.3 to 2.22.4f798a9ef9aMerge pull request #715 from bunkerity/devcd902eba30prepare for 1.5.3 🚀029217ff4aFix update-version.sh script10db67b871Merge pull request #714 from bunkerity/devc7543df86aAdd an handler when the ui test is reaching an error page due to a connectionFailure1f5a1beac0[#645] Fix web UI not keeping the data when changing the sub server names + Fix custom cert when the server name have multiple domainsff1fc9280b[#712] Fix custom configuration changes not taking effect immediately838dcb17c0Merge branch 'dev' of https://github.com/bunkerity/bunkerweb into devb18dbddcdfMerge pull request #713 from bunkerity/dependabot/pip/src/scheduler/dev/certbot-2.7.2ca6938dfe4Update ConfigFiles to use the correct name regex in web UI643ea7c214deps/scheduler: bump certbot from 2.7.1 to 2.7.2 in /src/schedulere41ce10e35Merge pull request #711 from bunkerity/devb265cbad54ci/cd - trying to fix azure/kubectl action7e3aad9f09[#645] Fix impossible to edit the server_name of an already existing service if the primary one was unchanged in web UI60d43d0ce0Handle service creation and editing more elegantly in web UI2df85b2c93Updated python:3.12.0-alpine image's sha2563a3255e7b8Merge pull request #709 from bunkerity/staging4c273fe849Merge pull request #708 from bunkerity/dev9964f42e66Fix magento k8s testsb2cf8986f5Tweak magento tests to use latest version back7f219bea07Fix CHANGELOG release date for v1.5.2b9f05ad165Downgrade magento versions to working onesbd6065af86Update python deps and pin urllib3 version to 1.26.18 + Update pre-commit-config to format requirements.in files as well + Apply pre-commit619e5644f0Remove pip caching when setting up python in workflows to avoid errors3c36430212Merge pull request #707 from bunkerity/dev7598dbc54bUpdate python depsf3982367a6Update dependabot script to add reviewers and tweak the scheduled4f65903e7Update dependabot config file to include terraform and other python deps paths38429efac9Merge pull request #705 from bunkerity/dependabot/github_actions/dev/actions/checkout-4.1.1d92e9a07a8Fix k8s terraform script6738b95524deps/gha: bump actions/checkout from 4.1.0 to 4.1.10da22f44b0Update k8s terraform file and update scaleway terraform versiond77f6a72c2Fix README.md links and versions7bf8be3246Try to fix magento k8s tests with static versioningb9c5d32778Fix timeout in ui tests and access_page functionb1b1ab8680Fix wrong values in helm chart values file for elasticsearch in k8s magento example530b8a945dFix allow empty values when saving a config in web UI22552c5b85[#694] Optimize certbot renew script to renew all domains in one commanddb0dd5daee[#694] Fix rare bug where database is lockedf89456cd4fMerge pull request #699 from Crazy3lf/master34d68e8b7cUpdate regex for email476d867067Fix magento k8s tests by removing elasticsearch4a10ec8c30Merge pull request #701 from bunkerity/devc4b873e3f2Fix /etc/bunkerweb dir missing in linux core testsbcaa8faa7bReplace deprecated `set-output` command with the new format08944b901cTweak test-core-linux to fix potential bugs13be6a43c9Add more logs when an url file is in cache and gets deleted2737fe7ce2Update python deps2823fa2abbUpdate plugin.json001246b38fMerge pull request #697 from bunkerity/ui1a43380d2eMerge pull request #696 from bunkerity/dependabot/github_actions/dev/github/codeql-action-2.22.30b319d1aa1Merge pull request #695 from bunkerity/dependabot/github_actions/dev/rickstaa/action-create-tag-1.6.47a15f8a654deps/gha: bump github/codeql-action from 2.22.1 to 2.22.3a4a413eecedeps/gha: bump rickstaa/action-create-tag from 1.6.3 to 1.6.47e3dabc5fdUpdate patch commands in deps.json to skip Reversed warning8093c61613Merge commit '29737209b138a1485d55c53acf1a6783b6e60167' into dev29737209b1Squashed 'src/deps/src/luajit/' changes from e598aeb74..492cfdd0d85913d6b26Update luajit to v2.1-2023100615d3180b64move disabled inp msg522527f0a8Merge pull request #690 from bunkerity/dependabot/github_actions/dev/ruby/setup-ruby-1.156.085ef4e4deaMerge pull request #691 from bunkerity/dev46d8acf7b4Update dummy-plugin to new standards77bfe2697fAdd StyLua and luacheck to precommit config file and apply itda2a1eaa5adeps/gha: bump ruby/setup-ruby from 1.155.0 to 1.156.0cd1f87b9a2Update pre-commit config hooks versione25fab28b8fix disabled msg behaviorc125a9bdd2Merge pull request #689 from bunkerity/dev10fd431fbbTweak update python deps script to make it more elegant309689185eUpdate pythons deps7997561766Merge pull request #684 from bunkerity/dependabot/github_actions/dev/github/codeql-action-2.22.1a12e5ca893Merge pull request #683 from bunkerity/dependabot/github_actions/dev/stefanzweifel/git-auto-commit-action-5.0.015ad3a6250Merge pull request #681 from bunkerity/dependabot/github_actions/dev/ossf/scorecard-action-2.3.0c57d725f44Merge pull request #680 from bunkerity/dependabot/github_actions/dev/ruby/setup-ruby-1.155.095389260a6Merge pull request #688 from bunkerity/dev6e5dd55573Fix CVE CVE-2023-44487565f4e3f7cMerge pull request #687 from bunkerity/devf39adcab5bUpdate CHANGELOG.mda3ec85b576Fix often occurring error with ace script in web uib063ac8a32[#652] Fix error when deleting a service that have custom configs on web UIff85f1c2bbUpdate CHANGELOG.md4a9fdba42d[#645] Fix errors when using a server name with multiple values in web UI47a7e16800Fix secure_scheme_headers shenanigans with web ui453108da94Update mmdb files2cbb10b3a3Revert "Test Aqua security vulnerabilities with BW"d4d9f87451Test Aqua security vulnerabilities with BW899484c381deps/gha: bump github/codeql-action from 2.21.9 to 2.22.1d461f3745bdeps/gha: bump stefanzweifel/git-auto-commit-action from 4.16.0 to 5.0.0cd0ceb48bbdeps/gha: bump ossf/scorecard-action from 2.2.0 to 2.3.0dc92ae825ddeps/gha: bump ruby/setup-ruby from 1.154.0 to 1.155.0f5fe685d42Fix children classes of Testf4ce2c68f2Fix bw api not returning the reason of bansd1a0f66c98Merge pull request #677 from bunkerity/dev6935d1cb84Merge pull request #676 from bunkerity/dev7ac66a6c65Update python deps2aa9f46ef4Fix default values in whitelist job8f456722e0Augment delay in WebDriverWait in ui tests8ae7b8f43bFix redirect tests docker-compose file9b4a9277daAdd libpq as a dependency for the Database to be able to connect with postgres172874d1c3Fix redirect tests on dockera518f47b92Update CHANGELOG.md0cee41867f[#656] Fix ACME renewal fails on redirection enabled Servicee956e03ba0Merge branch 'dev' of https://github.com/bunkerity/bunkerweb into devc08fd07a6bUpdate linguist-vendored to add modsecurity files and non patch deps files466c8e584cMerge branch 'dev' of github.com:bunkerity/bunkerweb into dev27d3ca1cdfautoconf - fix wrong types for dynamic settings410557009aAdd .gitattributes to override linguist-vendored pathse7498279cdRevert Docker image update for testsfe87486f97Merge pull request #673 from bunkerity/devc2db157bb5Update python docker image to 3.12.0eb8088164bTweak Dockerfiles to make the build nicer202698f41fFix python deps conflicts and update them0eb18cb31eMerge branch 'dev' of github.com:bunkerity/bunkerweb into devf12a014104autoconf - update settings from db628068e9aeLint files with prettierf3694f0cc4Add prettier as a precommit hookb56cce63f7Fix codespell typos in README.md87ca176633Fix typos raised by codespelleea5dd9b75Add codespell precommit hook8fbe692618Fix mkdocs.yml file duplicate copyright keycf82e73e97Fix swarm postgres ui integration example6b2df35858Tweak py file to respect flake8 rules508c728b65Tweak pre-commit config and pyproject.toml file + Add flake8 as linter in precommit config75e8c83397Update CHANGELOG.md07676a3d0aUse hashes instead of versions in github workflowsf0761eed2cRevert "Add fuzzing tests in CI/CD"4babce9749Add fuzzing tests in CI/CDa263f1f4f1Update cron for dev-update-mmdb31a8399688Merge pull request #666 from bunkerity/devd8b2561675Merge pull request #665 from bunkerity/dev87d2f04eb8Remove no longer necessary temp fix for Flask-loginc006e5088dUpdate python deps + Update Flask-Login to include the compatibility with Flask 3.0.0df9bf1f561Merge pull request #664 from bunkerity/dev6b0e623e59Update Dockerfiles to install pip and its deps before the project ones85068bfeeaAdd temp fix to support Werkzeug>=3.0.0 with Flask-login5a7f9147faUpdate python deps and update script3589057703Fix bunkerweb-ui.sh script with variables not being exported correctly5ed595be68Fix shellcheck tests failinge21e0c812bAdd shellcheck and gitleaks to pre-commit-config + tweak excluded paths1b7e1840cdFix blacklist core tests' requirements.txt file1f90d3668cAdd a pre-commit-config file and passed all checksf3fc69110eFix typos in Dockerfile when installing python dependencies073e8575e2Updated Dockerfile, python deps and npm package to use pinned dependenciescd4d529d7eMerge pull request #660 from bunkerity/devb4a320afaaMade ui tests better8ed656068fSmall fixes on linux paths creating unnecessary folders8fa7adb615Small refactor on how the autoconf updates the config4ec754143aHandle changes more elegantly with the scheduler0f7df13df3Optimize save_config script48096d711cOptimize the way the UI handles services creation and editionc0816bb119Fix potential cross-site scripting vulnerability in plugins.js in the UI18e5f7bff6Merge pull request #659 from bunkerity/devece5ce1cdfAdd HTML sanitization when injecting code in pages in the UI4d50026744Extract codeQL workflow to have a separate one + Add scorecards analysis workflow file + Add UI tests for the UI branch1c71572f44Update tsparticles in the UI + remove unused static files685cb9809dUpdate README to fix a few links and add the security scorecard badge65d0aa3a8aMerge pull request #658 from bunkerity/dev6e2db59919Add a sleep before changing from cache page to log page to avoid errors in ui tests1db769c321Remove bugged UI tests check in linuxdb99d16874Update the condition that checks the integration in core tests579c80357fUpdate UI starting script and ui tests script on linuxb901d29710Update python depse23f931bd6Replace gevent with gthread in UI for security reasons15eef6ef57Try to fix python deps issues with linux and try to have more logs in linux ui testscc0167f427Fix ui linux tests when waiting for the ui to be readyfd4c147b89Update how the scripts wait for the UI to get ready before starting the tests95afba8792Change how the ui tests waits for the ui to be readyea5cb0db2dTry to fix ui linux test by adding more sleepscb3250e4e7Fix UI linux test (again)153e9fecf1Fix bunkerweb linux scripts81b5e80da6Try to fix deps permissions with linux ui tests (again)6a162d7250Fix linux permissions with ui testsbe5fe2830eTry to fix ui python deps in ui linux tests380e609abdChange ui linux tests command into development mode93006cf5ceFix Firefox installation in core and ui linux tests39f17bce60Try to fix permission issues with Linux and ui python deps94c7c832e6Fix permissions with python deps in ui linux tests42be334e40Fix permissions with ui tests on linuxcad3012e6dTry to fix python dependencies error with test ui linuxa04282d3f8Fix test core redis with linuxc757f5d49dRe generate requirements.txt file for the UI with python3.9052e060222Fix core and ui workflow file for staging testse71b711466Merge pull request #655 from bunkerity/devb90da0f909Add better health check in linux ui tests5c1fafe518Updated CHANGELOG.mdc964d68f99Add more tries when the dnsbl server isn't found78a29e65eaTweak reversescan core test to avoid false negative0e9f29cc52Revert "Fix UI shenanigans with python deps"70ab9740d9Fix UI shenanigans with python deps0303a8f7b9Update staging workflow file to include core and ui linux tests16d4c1133bOptimize the way errors are being checked in linux core tests2ddc8cec72Update dnsbl list regex to accept an empty one6534a429afFix looking for error in the wrong place in test code linux25eb8de01eTry to fix a few shenanigans with linux core tests2065d688f1Fix ui tests with docker checking the wrong containers if healthy87f84d438eAdd a retry on nginx error in linux core tests99b30af8eaFix reverse scan python script1ff2aed68cFix UI docker tests docker compose file48bcb11983Rearrange imports for blacklist init core testae9450d0dcAdd whitelist and greylist linux core tests9a17e92d62Fix typos in dnsbl core test2244f734faAdd dnsbl linux testa29ac80e4bAdd country linux testscff5c77679Fix sessions core test for linux6ae6764f27Fix blacklist core tests docker compose27959e1aa9Fix sessions permissions issues with python requirements47e8f20f83Fix CVE CVE-2023-380396283ce2dd7Add linux tests for blacklist and bunkernetf3d6f860e0Remove old cached files if urls are empty61c8ef73b0Fix permission issues with sessions core test with linuxbe25ae8e05Fix failing linux core tests + add more logs when an error occur in ui tests33e200f652Fix UI using the wrong database when generating the new config57374ecc2fFix tests ui with linux601f0fde62Fix tests ui linux not starting the ui servicefdb9a7c294Fix errors linux tests permission issuesdf12058824Fix tests ui linux executing the wrong filedb404a62c3Fix ui tests misconfigurationa0aced3e53Fix tests ui linux workflow filee378be9a92Fix typo in tests ui linux file name + add more logs in ui docker tests432d1587c7Add linux ui tests2ad8861788Fix selfsigned job with cryptography not being foundda4390b488Fix python modules version conflict with web ui7bd48203aaFix and update python depsce2fa3d360Fix a few core tests for linuxbca36e2966Update self-signed job to regenerate the cert if the subject or the date has changed06da40bf13Added more linux core tests84a27a3fc3Fix DB core test with docker9e34251824Fix path issues with db core test initc90cd7399aFix permission issues in tests core linux91e5528a3fFix already existing tests core linuxaeee38ad32Fix misc problems related to linuxd97326656dFix Database not clearing old services when not using multisite8a6e14d8c8Added linux tests to a few core plugins0ece8fda00Fix permission issues when starting BunkerWeb in antibot linux testse935132242ci/cd Try to fix permission problems with Firefox in test core linux761c01af6eci/cd Fix test core linux shenanigans with Firefox0d9349611eci/cd Try to fix errors with firefox in test core linux094d5d5dfeci/cd Fix a few things with test core linux + finish antibot linux core testsfdae4549ceci/cd Fix permission issues (again) with test core linuxd59cf1835dci/cd fix permissions issue in test core linux + fix shenanigans with antibot linux core tests43b1a038f9ci/cd clear out firefox before reinstalling it in test core linuxd192fbb829ci/cd Install Firefox manually in test core linux0239ca64b4ci/cd test core linux remove dns resolvers override1dd1caeea4ci/cd Fix Firefox installation for test core linuxa0516f773fci/cd Install firefox from apt instead of snap + fix antibot core tests for linux480c680f19ci/cd Fix timeout in geckodriver download for test core linuxa94dab2087ci/cd fix retry job when downloading the geckodriver in test core linuxd0a1aab15cci/cd Fix perms issues (again) and optimize some things in test core linuxdd0c4c93a6ci/cd Install requirements and deps in test core linux294402dbf2ci/cd fix perms issues with test core linuxcd35d35c25ci/cd Fix perms in variables.env for test core linux4cce8385c5ci/cd fix write in /etc/hosts file in test core linux990b6336e2ci/cd Fix test core linux with dpkg versioningccc5eb304aci/cd Fix version error with ubuntu and test core linux6a38390404ci/cd Fix tee command not being ran as sudo in tests core linux453cfc2dccci/cd Fix BunkerWeb installation job with linux core tests0b14f8a5d0ci/cd Fix install command in linux core tests624f4b5bb5ci/cd Fix path of the .deb file61bc8a3b10ci/cd fix .deb fetching in Linux core testsfa91bf6c60ci/cd change needs and logic in test core linuxb54c7eb61aci/cd test secret inherit for ubuntu private test image30cba0a77dci/cd fix dev.yml80d56fcca6ci/cd start working on linux core tests69307fba6fFix issues with GitHub rejecting the requests7c5177bf43[#643] Fix UI clearing configs folder at startupb5bd17d4daMerge pull request #641 from bunkerity/devad65e01a87Update CHANGELOG.md1259fb67d9Merge pull request #634 from bunkerity/dependabot/github_actions/dev/docker/setup-buildx-action-3b9e752f12fMerge pull request #636 from bunkerity/dependabot/github_actions/dev/docker/login-action-3278eb0c8a4Merge pull request #635 from bunkerity/dependabot/github_actions/dev/docker/build-push-action-5dec97c8c3bMerge pull request #637 from bunkerity/dependabot/github_actions/dev/docker/metadata-action-59222420b7a[#640] Fix shenanigans when executing docker compose restart07fb7cf164[#638] When renaming a service in the UI, migrate the custom configurations as wellf83b2278d0Fix versions conflict between greenlet and gevent with UIe51e178357Update python deps3c95971e3eFix CVE CVE-2023-4863bb7ef35aebMerge commit '35d13d7a097dd094cdbe993f18f29de0b08f1f2b' into dev35d13d7a09Squashed 'src/deps/src/zlib/' changes from 04f42ceca..09155eaa2d962538784Merge commit '4430cf47ddc1f3647b3bc129f46fed2d7a145f8c' into dev4430cf47ddSquashed 'src/deps/src/luasec/' changes from fddde111f..4c062870537a2343e24Merge commit 'd8ee65aa70e9737330c8a83301fd66c7dc8a8d7a' into devd8ee65aa70Squashed 'src/deps/src/lua-resty-session/' changes from 8b5f8752f..5f2aed6166752b36471Merge commit 'd7bde18da2a8a81f2d5f256bc975b1fb5b546107' into devd7bde18da2Squashed 'src/deps/src/lua-ffi-zlib/' changes from 1fb69ca50..61e95cb43af902fc4ecMerge commit 'e0a89a2fcd1d0dd4cc103fc054242e8e8b10b7bf' into deve0a89a2fcdSquashed 'src/deps/src/modsecurity/' changes from 205dac0e8..ccc2d9b535ec7eb53a1Squashed 'src/deps/src/luajit/' changes from 04f33ff0..e598aeb726d3d6c6ceMerge commit '5ec7eb53a1fa30beb59d3358f16716483787b02e' into dev0aaede4d61Update core deps955c7e0630deps/gha: bump docker/metadata-action from 4 to 58ea823e061deps/gha: bump docker/login-action from 2 to 3a6efa52051deps/gha: bump docker/build-push-action from 4 to 5a6b30f6a6bdeps/gha: bump docker/setup-buildx-action from 2 to 31144a73813make logs optional in issues, change assignee for dependabot and edit sitemap URL of the docc364e46663ci/cd - disable redirect when pushing docd4f38cc795ci/cd - fix error when parsing ARM typesb6d49865b7ci/cd - get ARM type availabilityd0a8cc3818ci/cd - use volume id instead of index for arm instance30c952e9e4ci/cd - set boot volume for arm instance2382fdd377ci/cd - start arm server after creation05ecf558cbci/cd - use latest scw cli version2b7ce389b7ci/cd - reflect changes on release tf from refactoringd5d7364b1cMerge pull request #632 from bunkerity/dev3adbd8757e[#628] Fix scheduler generating the wrong configuration with Linuxfd79508633Merge pull request #631 from bunkerity/dev3ae9636d5aFix error with the CSP header override of the antibotf993499007Merge pull request #630 from bunkerity/devea6ae52539Update ANTIBOT_HCAPTCHA_SECRET setting's regex to support new format5811dc549cMerge pull request #629 from bunkerity/dev6404b701c0Update changelog2b5654ba3bUpdate coreruleset to version 3.3.5c948e449a0[#622] Handle configs dir more nicely in Linuxfb5a8dc4fb[#622] Fix permissions with folders in linux integrations5f19b3fdabMerge pull request #627 from bunkerity/dev2fce08b727Upgrade issue templates2ed6584dd7Update python deps hashesd6a14b6716Merge pull request #626 from bunkerity/devb3c398cb56Remove jinja2 from requirements.txt as it creates conflicts6334a3d638Merge pull request #623 from bunkerity/dev8ab4ea2e26Update id of ui.conf rules to avoid conflicts11664cc1d8Fix wrong variable name in limit core tests9535c04142Fix shinanigans with both multiple and global settings not being stored correctly in datastore8cafded894Fix variables that are both multiple and multisite not being stored properly in datastorec6b2199dd3prepare for 1.5.2 🚀c418acdcfaUpdate CHANGELOG.md9d0d72ba02[#576] Add support for ModSecurity JSON LogFormatcbc6259386Update mmdb filesf57fc5d3f6Fix menu.html dark_mode attribute in UIc7e834a0dcUpdate python deps673ee921f6Lint files9fb8dfca45Fix Scheduler running two times for no reason4787400d74[#615] Fix BunkerWeb not being able to start after a restart because of the /var/run/bunkerweb directory missing in Linuxf59476c26dMerge pull request #621 from bunkerity/dev4be53d0cbeMerge pull request #620 from bunkerity/ui55ba29cd54Fix UI error when values are empty947690af8fFix UI workflow5cdf0ecf44Merge pull request #619 from bunkerity/uid1dd1fbae7Fix shinanigans with the /data volume in the doc1b84c62024[#613] Fix logs with web-ui and Linuxa2e0f1fe66Merge branch 'dev' of https://github.com/bunkerity/bunkerweb into dev639eed8d05Deactivate BunkerNet on first start with linux500c3564a2ci/cd - perform staging tests again448efc0ef0Merge branch 'staging' into dev1b660691d5ci/cd - fix typos for docker/packages pushese62b7c9d19Remove unused js files in web-uib87316d7c4Merge pull request #617 from bunkerity/ui4cff39f490Merge pull request #616 from bunkerity/devbceb286026Lint filesd9d6ed9bb0Fix settings regex with web-ui01be5baea5Merge pull request #611 from bunkerity/dev059afec430Update rhel docker imagee564d84079Merge pull request #610 from bunkerity/dev2c15b37461Fix rhel typos "el" instead of "rhel"6f26c42c89Merge pull request #609 from bunkerity/devc5059ab220Update doc to include TLS as well as HTTPS in some sectionsa7a317b5bfMerge pull request #487 from bunkerity/dependabot/github_actions/dev/scaleway/action-scw-c718eca1fcb9fec1fb1433752d61599c6a0ad2e90681cf2c9bUpdate actions/checkout to v43a02c0ca5cAdd more delays in badbehavior core test040d447145Change SQLite config to avoid locking07725356b6Merge branch 'staging' into dev6a995723c0autoconf - fix changes check bug with same variable name47bf7299a1Lint py files656c5008descheduler - ignore changes on first loopc206daf9ddadd basic config lock between autoconf and scheduler + remove reverse-proxy tests for linuxcf55ade15dci/cd - various fixes for k8s testsd28432e5f2Fix API_SERVER_NAME regexb5638aae19ci/cd - move k8s login in staging-tests job4450762b8cci/cd - fix image name in k8s tests6e1660cd00autoconf - fix wrong config updatecb4c99f456ci/cd - fix docker tag command for linux tests64d2ed91ecci/cd - fix secret key0e2420cfffci/cd - add timeout for cleanup jobsfa165522e5ci/cd - use same md for openssl commandsb036803884ci/cd - remove double untar for k8s testsbae27806b2ci/cd - fix tf state upload/download again11794da8c4ci/cd - fix tf artefact commandc52e54b812ci/cd - fix tf files againe5c37a00acci/cd - fix k8s tf9a3c26bf65Merge branch 'dev' into staging56422bca46Update python deps regex for UIee47407dfeMerge pull request #606 from bunkerity/dev936b1e88f0Remove old CVE fixes for nginx imagef9f5b6570dRemove old CVE fixes for python images8e8e042c25Testing CVE on bw1676ebeb7eTest CVE on autoconf637573e591Update docker images and python depsc3a4847de5Update startup and temp env in bash files3db7904d41ci/cd - fix wrong image tag for Linux test images037e1ba566docs - add ghcr.iod6aa6a9b09ci/cd - staging improvements9aba006738Fix oddities with the scheduler and the Databasef7d9af9d69Fix potential infinite loop when waiting for a configuration from the autoconf95c796c1eeci/cd - delete temp compose downgrade423e3b4a39ci/cd - log to ghcr before getting tests containers511597b7e0ci/cd - fix tests image namesbb77dcedf5ci/cd - edit username for ghcr auth3d0f17808cci/cd - add dummy username for ghcr auth5a9836fec5ci/cd - fix nested permissionse1edfe4a7fci/cd - fix missing permissions in wfe81ab4ff9bMerge branch 'dev' of github.com:bunkerity/bunkerweb into dev87b4053402ci/cd - use gh cache for docker cache and pushes to ghcr.io45a81203edUpdate python deps9feb66710bautoconf - force updating first configuration3d13cf345eautoconf - only update data when needed and atomic changed metadata update00cb6c1a8btests - fix regex for geckodriver version898ee7ec87tests - tweak dpkg before installing BW643b30f993tests - ignore wrong testing version in deb packages69e944d56aRevert "Fix LinuxTest package installation commands"2b7f627d86Merge pull request #602 from bunkerity/dev82fb7b277dFix LinuxTest package installation commands1042e546b6Merge pull request #601 from bunkerity/dev6d1d464e16Remove tries limit in wget commands (defaulting to 20 tries)b5de52ead9Add more retries when testing the newly created service in ui tests2675227499Merge pull request #599 from bunkerity/dev4f82856b48Update staging-create-infra to use a static version for monolithprojects.github_actions_runner == 1.18.1d670b409bfMerge pull request #486 from bunkerity/dependabot/github_actions/dev/docker/build-push-action-40b93916a37Merge branch 'dev' into dependabot/github_actions/dev/docker/build-push-action-476408cf04dMerge pull request #598 from bunkerity/devf7cd7d9dafAdd dependency on tests-ui to not fail to push the testing image8632dd3244Fix exit code for ui testsfbf0232d52Update python deps5b6f00dfc6Revert "Remove unused imports in ui tests"681def5f02Remove unused imports in ui testsa844b235b9Remove geckodriver.log73e31ca625Add wget to fix error with testsd82136f040Fix UI tests not exiting if container fails to start55fd177901Fix wget command when downloading the geckodriver sometimes failsd8c95869e8Fix database with multisite variablesf24802b211ci/cd - perform staging tests again758fc13c3dci/cd - replace version string for testing releasecd825cd341ci/cd - fix wrong VERSION path for testing releasec03b1bb20bci/cd - update VERSION file for testing releasea5e50d0f74ci/cd - fix linux package name for staging1a57e0a202ci/cd - remove linux arm64 packages pushesde568f335fci/cd - temp disable staging tests244b912476ci/cd - fix syntax error in push-github wf08ce31bb0fci/cd - prepare for testing releases7f47ac18c0Fix plugins errors when reloading with a select and upgrade checkb6b87fcb03Update python deps8bada2a02dUpdate update-version script and bw version in after-remove scriptsb8778de08buse nightly tag for docker-socket-proxyb42b732d74Merge branch 'staging' into devfc1c81ce20linux - add python3 dev dependency when building packages76d36f3b91v1.5.1 release63355bb887tests - increase radarr delay (again)0ecf478761Merge pull request #592 from bunkerity/staging59dfb728ffFix DNS_RESOLVERS regex to be more open47c560dd30Merge pull request #591 from bunkerity/devff1e6cc28ck8s - use same namespace as ingress for services81c2c3187cFix config synchronization in scheduler + Remove MULTISITE variables being fetched when MULTISITE is set to no7f3f3ac7e3Add delay to radarr automatic tests58d69ec20cMerge pull request #590 from bunkerity/dev012bc3b43dMerge pull request #589 from bunkerity/staging600ea7e168Update python deps18ee159711lint python fileseee26b5d72tests - add delay for reverse-proxy-singlesitec00157ef32fix wrong instances when using docker mode and add delay to docker-configs tests6047a43358set default value for ports in bw entrypoint, fix core db tests and fix missing PYTHONPATH for certbot jobee2aeda13atests - add static delay for linux tests and fix core db testsbb6fd30739linux - force kill nginx if graceful one doesn't work6e6c08a716ui - various edits5df2a74cafimproved LE certificates checks and fix missing full SERVER_NAME when MULTISITE=no843c023707tests - fix wrong command in linux tests8f7833413blinux - fix letsencryt not working and fix permissions on /etc/bunkerweb/configs for tests0ccd757817linux - add missing pip to rheladbed77f74linux - install pip the official wayef7a6ac421linux - fix fedora dockerfile31ca183b1eMerge branch 'dev' into staginga763879c1ddoc - update settings03ba91e968autoconf - fix deadlock with k8s38ab5ea21aredirect - custom status codeee5397df55bw - add HTTP and HTTPS port to temp config9efd7a5a5fsessions - fix infinite loop when session checks fail784ce643f0db - disable connection pooling for one shot tasksf3081e3c34scheduler - fix parent setter call26a1ef6898Update mmdb filese2fe947cb4ci/cd - fix tests UI not showing logsbf9cd367d0fix missing Strict-Transport-Policy header, fix X-Forwarded-Prefix with regex URLs and print logs when UI tests failed26f2852e54scheduler - fix typo in fstringe93b2f65ffcache dev container images, fix CVE-2023-35945 and force scheduler to reload when instances changef3ba16be9dadd instances changes check to scheduler and auto push dev container imagesd9394567efadd missing ctx arg in core plugins, always add X-Forwarded-Prefix header and add doc about timezone in containersd59b305f1efix concepts image in doc, revert clientcache update and refactor headersad45bbb4d7Update python deps and fix error with PyYAML compilationdb03aa9c79Merge pull request #565 from bunkerity/devbb14be8202Update python deps updaterbedcf0c17cFix bug with newer version of PyYAML by downgrading68e9b057d4Merge pull request #564 from bunkerity/dev810340a493[#559] Fix typos for custom-cert's settings in docs and examplesa4db7c2942Fix CVE CVE-2023-2975758901dfc3Fix CVE CVE-2023-29759216becb56Update python depsdb413cc032Merge pull request #555 from bunkerity/deva4f4dfe4e6remove unused imports in save_config.py0d554a5f5dUpdate SERVER_NAME regex to be more openc11b44285bMerge pull request #554 from bunkerity/dev25af02e4a4FIx prevent the `DATABASE_URI` setting from being saved inside the database9eec9e26c9[#552] Fix scheduler not changing databases on linux845364b2b6Update log paths for linux based integrations3dac0aef0etests - temp fix for compose network errors08f9e5f20aFix bad behavior core tests by adding a custom subnet to the bw-docker networkfccb25bee6Add automatic bw-docker network removal between each tryd6407b8186Fix db core tests by making the network bw-docker entirely external1cf281ef83Update core tests to be even more verbose3a714b9a3fUpdate core tests to be more verbose864619542cFix core db tests (again)be46f7a8d8Optimize db core tests559039dfd1Lint .conf files that contains lua code + remove useless commentsaa0769dde7Merge pull request #549 from bunkerity/devae6ccfcffcApply patch to luajit-geoiped234fd63fApply post_install script to lua-resty-openssl09ae6da557Apply patch to lua-resty-ipmatcherb516ca2ea2Apply patch to lua-ffi-zlib1e7f92af80Apply patches to Modsecurity-nginx008dc09a60Stop checking return code of post_install scripts in init_deps.shfcd230192fFix init_deps.shf3809bc698Add -R to pull commands in init_deps.sh96586d4a68Apply post_install script to Modsecuritya75b90f525Squashed 'src/deps/src/modsecurity/' changes from bbccedbdd..205dac0e8948182ffd4Merge commit 'a75b90f525b90bd74c090702034e02fdd6250e0e' into dev544b4040e0Add post_install scripts to init_deps.sh and update install.sh6e146e2a54Squashed 'src/deps/src/modsecurity/' changes from 205dac0e8..bbccedbdd847ff5a3daMerge commit '6e146e2a54cb29eb0ac1bc9d65766fe90d30fa4f' into devbbccedbdd5Change tags into hashes in deps.json14d69fa594Update mmdb filesd5e358b72cMerge pull request #548 from bunkerity/deve0055328afFix add missing deps for core db testsc93d5a2fcdFix CVE CVE-2023-33165631e27378Merge pull request #547 from bunkerity/subtrees3505c0d18fRemove clone.sh file7b566b885eSquashed 'src/deps/src/zlib/' content from commit 04f42cecaffd3100317Merge commit '7b566b885e99301b243c5f61360e65238035e048' as 'src/deps/src/zlib'45dca7b445Merge commit '2ab324a69f219b4051b2e77d211ee1a7fb1462b5' as 'src/deps/src/stream-lua-nginx-module'2ab324a69fSquashed 'src/deps/src/stream-lua-nginx-module/' content from commit 309198abff85f86e46cMerge commit 'c1073460677ba8aa2e325a1c57c3db1458f9fde5' as 'src/deps/src/luasocket'c107346067Squashed 'src/deps/src/luasocket/' content from commit 95b7efa9da7d4cc5bbaSquashed 'src/deps/src/luasec/' content from commit fddde111fbd600e0d0cMerge commit 'a7d4cc5bbaabf8683b3b5cc1f42f9bd145cf1aa8' as 'src/deps/src/luasec'd156626938Merge commit '2d86912af87048b94c2921a60b3a8a5a0953e132' as 'src/deps/src/lualogging'2d86912af8Squashed 'src/deps/src/lualogging/' content from commit 465c994781fb404757dMerge commit 'f3ceeb73a958e774b1e2fa55d2607cdd3eb419ca' as 'src/deps/src/luajit-geoip'f3ceeb73a9Squashed 'src/deps/src/luajit-geoip/' content from commit fde33e045f81788c00cMerge commit '2678b91586e9183b47327fbb0f11ad23020f195f' as 'src/deps/src/lua-resty-upload'2678b91586Squashed 'src/deps/src/lua-resty-upload/' content from commit 03704aee42d06f2d7abMerge commit 'bc06cd71b8896c6e7a1aac4610c9c3f878956238' as 'src/deps/src/lua-resty-template'bc06cd71b8Squashed 'src/deps/src/lua-resty-template/' content from commit c08c6bc9ea6379356eaMerge commit '3038a0b027f09090e1cd8f101d2ee8c52c383070' as 'src/deps/src/lua-resty-string'3038a0b027Squashed 'src/deps/src/lua-resty-string/' content from commit b192878f6fdf0050a91Merge commit 'ee5198ba2810e33e08ff987ede5abe10fc74f6e3' as 'src/deps/src/lua-resty-signal'ee5198ba28Squashed 'src/deps/src/lua-resty-signal/' content from commit d07163e8ca3cd342f3eSquashed 'src/deps/src/lua-resty-session/' content from commit 8b5f8752f6f8ff3f12eMerge commit 'a3cd342f3e1fffd7b16b83a24e03bb9ed501b319' as 'src/deps/src/lua-resty-session'2f1cde0978Merge commit 'eca8662cfe981f66ab92b53bbf83af65da02b2b7' as 'src/deps/src/lua-resty-redis'eca8662cfeSquashed 'src/deps/src/lua-resty-redis/' content from commit d7c25f1b30b94df0879Merge commit 'e59161ec204c7a95e4751b1c0e9a6bead7fcab39' as 'src/deps/src/lua-resty-random'e59161ec20Squashed 'src/deps/src/lua-resty-random/' content from commit 17b604f7fa280059882Squashed 'src/deps/src/lua-resty-openssl/' content from commit b23c072a438fdd39d00Merge commit 'a2800598825bb5a03b577cca2874ff1cfae863f4' as 'src/deps/src/lua-resty-openssl'c2fa53ca17Merge commit '31bf774f63b8b46a3c7b53028853036fff6fa0b8' as 'src/deps/src/lua-resty-mlcache'31bf774f63Squashed 'src/deps/src/lua-resty-mlcache/' content from commit f140f56667b2273aeb8Merge commit 'c82b0bdd27762d2d4a9901a187506d2e5abd74f5' as 'src/deps/src/lua-resty-lrucache'c82b0bdd27Squashed 'src/deps/src/lua-resty-lrucache/' content from commit a79615ec93dc8cc87caMerge commit '746a6e16d027ab3bddfc610c987e5d61ab9b69d0' as 'src/deps/src/lua-resty-lock'746a6e16d0Squashed 'src/deps/src/lua-resty-lock/' content from commit 9dc550e5662e740a0bbMerge commit '19515d9b26f2f4886ca117b91384509087f0ff3a' as 'src/deps/src/lua-resty-ipmatcher'19515d9b26Squashed 'src/deps/src/lua-resty-ipmatcher/' content from commit 7fbb618f7e566b98afcMerge commit '7160fd94e3dc22299ee3c9f8b0e71a5e2c1bb501' as 'src/deps/src/lua-resty-http'7160fd94e3Squashed 'src/deps/src/lua-resty-http/' content from commit 4ab4269cfcdd42bf250Merge commit '1a7d4e58be28238599df3f5c15c56380c3e99732' as 'src/deps/src/lua-resty-env'1a7d4e58beSquashed 'src/deps/src/lua-resty-env/' content from commit adb294def49db9c24d6Merge commit '0f4a0cb0ef514bee6b810f6d6cf982c5ef0abfca' as 'src/deps/src/lua-resty-dns'0f4a0cb0efSquashed 'src/deps/src/lua-resty-dns/' content from commit 869d2fbb0fe76b6830aMerge commit 'fd02afef8ec1ceb8a816dc202d05c6ece9887d31' as 'src/deps/src/lua-resty-core'fd02afef8eSquashed 'src/deps/src/lua-resty-core/' content from commit 31fae862a29d135bdbcMerge commit '36023392a6e3c8fb6aebb46140db759e61da220e' as 'src/deps/src/lua-nginx-module'36023392a6Squashed 'src/deps/src/lua-nginx-module/' content from commit c47084b5db01aa0b15fMerge commit '32485e2860c2ea31fcef5b575f446c7a3036a550' as 'src/deps/src/lua-gd'32485e2860Squashed 'src/deps/src/lua-gd/' content from commit 2ce8e478ac46cd666abSquashed 'src/deps/src/lua-ffi-zlib/' content from commit 1fb69ca50909841ea63Merge commit 'c46cd666ab76bad7bd05c6261d692cda5b380f32' as 'src/deps/src/lua-ffi-zlib'47ee3884fbMerge commit '4f9b885a2e8b7a10653653fee3bb91cf5102b0ef' as 'src/deps/src/lua-cjson'4f9b885a2eSquashed 'src/deps/src/lua-cjson/' content from commit 881accc8fbb450ac965Squashed 'src/deps/src/libmaxminddb/' content from commit ac4d0d248e13868c63bMerge commit 'bb450ac96595432625ac34de8f7f42b3d06a5b30' as 'src/deps/src/libmaxminddb'772e05d372Merge commit '4a7228d2dcb7fe62526016b90a7c497fb6531e76' as 'src/deps/src/libinjection'4a7228d2dcSquashed 'src/deps/src/libinjection/' content from commit 49904c42a209d4a461bMerge commit 'ae8d8b233d52cbfdee68bd3ba21713149f5659c8' as 'src/deps/src/lbase64'ae8d8b233dSquashed 'src/deps/src/lbase64/' content from commit c261320ed9927106501Merge commit '1d1739b4eaa274c25c52b8ceb79ebdc717633ec0' as 'src/deps/src/headers-more-nginx-module'1d1739b4eaSquashed 'src/deps/src/headers-more-nginx-module/' content from commit bea1be3bbe43880b083Squashed 'src/deps/src/ngx_devel_kit/' content from commit b4642d6caa09d5eb2cbMerge commit 'e43880b08395df25663560da3d8154226a167a77' as 'src/deps/src/ngx_devel_kit'8973eb0290Merge commit '26773844e7bd57df1216bd74360a62ec2dc976e3' as 'src/deps/src/nginx_cookie_flag_module'26773844e7Squashed 'src/deps/src/nginx_cookie_flag_module/' content from commit 4e48acf1379d1b44594Merge commit '22e69251d9b5cd2611abf77ef7352abfa4d409d7' as 'src/deps/src/ngx_brotli'22e69251d9Squashed 'src/deps/src/ngx_brotli/' content from commit 6e975bcb04cd57ab8f2Merge commit 'b99663928782619ef854b4bf10a2bf7450d75266' as 'src/deps/src/nginx'b996639287Squashed 'src/deps/src/nginx/' content from commit 84cd72177d7f25398aaMerge commit 'a676d333fda890838d8fc4766720cc3f1d4c5389' as 'src/deps/src/modsecurity-nginx'a676d333fdSquashed 'src/deps/src/modsecurity-nginx/' content from commit d59e4ad127e8f4adc3bSquashed 'src/deps/src/modsecurity/' content from commit 205dac0e8999fb6b8edMerge commit '7e8f4adc3b2b2a655640c73198fb920a5e8441d5' as 'src/deps/src/modsecurity'6c0468f62bSquashed 'src/deps/src/luajit/' content from commit 04f33ff06d05b14eb5Merge commit '6c0468f62b1120497a6fd0d21101dc41f29e7397' as 'src/deps/src/luajit'1141afd203Fix install.sh for nginx dynamic modules97406bff4dAdd libinjection deps backa58ad9b506Remove duplicate lua-ffi-zlib in deps831ae129c4Make init_deps.sh executable451648fa71Remove old deps temporarily except lua185d75076bUpdate how the deps are initialized6a048e68fcUpdate how the deps are managed129e8f7e01Merge pull request #546 from bunkerity/dev265123835fUpdate python depsb0bc9a1bf4Update the documentation2f7ed064fcdocs - Fix typo in webhook link in plugins.md7d6116163cMerge pull request #544 from bunkerity/devdeed39a1fbUpdate lua-resty-openssl to version 0.8.23dd295729bbAdd deps project submodulesb27f38349bUpdate lua-resty-session to version 4.0.4 and remove lua-pack deps as it's no longer neededaeca252d9dBump lua-resty-core version to 0.1.27 and lua-nginx-module version to 0.10.251ec21261c4Revert "Init work with submodules"718a9305d8Revert "Fix .gitmodules file"a253f4a59cRevert "Remove old folders that are now submodules"2e1e9a08cbRevert "Initialize submodules"e2f1aba3ccRevert "Add other projects to submodules"d9a98c6fa9Revert "Update commit SHA for submodule libinjection"5ed3ba1d50Revert "Fix path resolution for modules and remove nginx submodule"b529d85255Revert "Update checkout part of workflow to include submodules"43783edb9dRevert "Add nginx as a submodule"8417ed1324Add nginx as a submoduleded0ec66deMerge pull request #542 from bunkerity/dev6cbbd0d562Update timeout for wordpress tests to 120 secondsd687b228e2Fix PERMISSIONS_POLICY authorizing self and links to be aside without spacesbcc9fdef90[#533] Fix SERVER_NAME regex to limit domains' size individually instead of the whole setting's value524a140d24[#534] [#504] Update ALLOWED_METHODS regex to accept more methodsa197e20d26[#531] Fix typo in documentation about SSL252a5831bfMerge pull request #541 from bunkerity/dev07ed136afaUpdate setup-kubernetes of wordpress example2eb73d15a1Merge pull request #537 from bunkerity/dev30fec8a142Remove python submodule, will add it back in the next major4b4e0f8b3bUpdate checkout part of workflow to include submodulesc2cfd4dd9fRemove checkout from dev.yml642da402bcFix dev workflow4bb6d40a53Update dev workflow to checkout the code and submodules first3bcdd9ca24Merge pull request #536 from bunkerity/submodules28d59221b4Fix path resolution for modules and remove nginx submodulec8e25bcde0Update commit SHA for submodule libinjectione1a5782a3eUpdate how the dependencies are being cleaned up68bea47eddAdd other projects to submodules2cd5c7f451Initialize submodulesd7d3e24297Remove old folders that are now submodulesa747278910Fix .gitmodules fileb5fffc1f38Init work with submodules8c4c99e65dMerge pull request #530 from bunkerity/devddc337394dUpdate log location for nginx and letsencrypt1c362d0783Remove the deletion of let's encrypt lib and log folders after the job is finished95c9bad8e3Remove unused enums in database model7a972274f1Add database schema to concepts.md in the docs5614995364Revert "Update README.md links to use local branch files"4536e328e1Update README.md links to use local branch files89070cfb7dMerge pull request #529 from bunkerity/uid6942a46e7Update where the scheduler copies its config8a98da898bMerge pull request #528 from bunkerity/ui26f831cb4dMerge branch 'dev' into ui81f3914fc8Merge pull request #527 from bunkerity/dev162198bb93Update db core tests to ignore the added value for env custom configs7a524b43e6Revert back to 30 seconds of sleep in tests ui after creating a custom configb007916d6fOptimize the scheduler and gen even more (we love threads)0661916ffcUpdate ui tests to wait more after creating a custom config2105dc0f32Update core db tests to use the right hash for plugins_page files8231198219Fix rare error when hashing dictionaries in the scheduler1e62626ac0Fix KeyError in scheduler57eaedd8e9Merge pull request #526 from bunkerity/dev4d984f6237Update CHANGELOGd0fd6884ceFix shinanigans with the custom configs and plugins jobs8e6de2bdf2Augment authelia timeout3565dd7b37Update CHANGELOG.md145df1df4fMerge pull request #525 from bunkerity/devdf1359e877Add possibility to download lists and plugins from a file path + Update python deps + Plugins now support tar and tar.gz as wellb756b2d7d0Lint py filesf57b6dad13fix cursor gap on ace editor91c33f1d43Merge branch 'dev' into uied2a54d166Merge pull request #524 from bunkerity/dev3e871efed8Update python depsd27edab351Merge pull request #523 from bunkerity/dev9982ec36d4Remove useless import80033642ceAdd reverse proxy headers back0836d4ee9fMerge pull request #522 from bunkerity/dev2a2b7b6f5eMerge pull request #521 from bunkerity/staging78236abe83Check Aqua Securityc5ff63a40cFix CVE CVE-2023-313878ef5c4827Fix problems when creating custom configs or plugins and removing them completely2c190ee969add writeable /var/run/bunkerweb directory to hardened example94867d0d63letsencrypt - use same job name when retrieving data from db9e00b9dd13letsencrypt - use same job_name for both new and renew jobs9adb209a81lua - fix missing multisite variables in LRUfdd3367a65Merge branch 'staging' of github.com:bunkerity/bunkerweb into stagingdcf1561358prepare for 1.5.1 🚀4023e6dc69road to v1.5.1af9e125c86linux - merge change for debian packagerab6025ec91linux - fix missing zope modules7e221eb890debian workingf1435f2312Merge branch 'dev' of github.com:bunkerity/bunkerweb into devb14dba7752bw - fix multiple variables not loaded in LUA81bb9ede14Removing python 3.11 from linux7e66c577f8Removing python 3.11 in linux236572f581ui - remove python 3.11 import for Linux integrations73060e42a1Fix limit core testsdf0c03cef1Fix UI wrong import5d7ef69c9dUpdate limit core tests to avoid false negative855ae89363Update limit core tests to avoid false positive16a1916dbbRemove useless imports in lua code + lint605e237fd5Remove 404 from Bad behavior status codesfc8d76f33dRollback on hcaptcha passive featurec08e8d151aUpdate settings.md44097cad09Move the COEP, COOP and CORP headers to Cors plugin and change default values3446e5f9b1Upgrade antibot to add a custom CSP on each pages + update plugins order70f227feb3Fix error with multisite variables when requesting default serverf81b0bb4daFix multisite variables not being added in helpers9786975004Fix has_variable method of utils5b0b183a4dRemove no longer needed decode for plugin order from datastorea2759e3771Add small tweaks on the datastoreb6d8792575Fix how we fetch plugins_order in the default server94964a910aUpdate how we handle custom configs6a1ff499c1Fix Lets'encrypt plugin api and internal API179a7aa34aFix lua sessions with antibota1385fe9b3fix ctx usage in reverse proxy + remove useless log in limit23f9f14a46Remove old CVEs fixes from Dockerfilef77150bc26Test Aqua Security CVEsec48e66011Fix return value when no plugins have been found in api.lua6ab48d9dd2Update python image to tag 3.11.4-alpinece24a0482aapply changes to current core02d9403937perf - ctx caching and per worker LRU for readonly variablesa7069bd605Update UI to stop using env variables but werkzeug middleware + Send X-Forwarded-Prefix headers to UI servicec39dd78aecUpdate cors plugin tests3b459b0e20Fix shinanigans with API (again)718310312aFix shinanigans with the API5deeacc3d4Fix letsencrypt jobsc18f743d44Fix PosixPath in jobs85a53278e1Add a charset to cors Content-Type headere01c14f11fAdd Cross-Origin-*-Policy headers management and default values0b3c1a8a04Update KEEP_UPSTREAM_HEADERS setting's default value95f673c1d4Update doc about headerscee7672b55Update settings.md in the docd5ea95da92Increase load-balancer example test timeout39e6821a4cLint lua code64aa12b70bUpdate python depsc392a0b5f0Update mmdb filesf93dd34f67Extend KEEP_UPSTREAM_HEADERS setting to clientcache and reverseproxy core pluginsa23d189d3dMerge pull request #516 from bunkerity/devdf47ba0e98Merge pull request #515 from bunkerity/dev0ca7de1de1Add CVEs fixes back84fcfb726dTest Aqua Security 2c20bd05d35Test Aqua Securityc85a4183d8Fix Strict-Transport-Security not being sent654172f436Update headers core plugin lua codeafe6da4cf5Automatically add Content-Security-Policy header to response headers in the UI5c7cd38b51Edit headers core plugins to use lua Code + Add new setting KEEP_UPSTREAM_HEADERS299a0b5c25Remove apk update at beginning of each Dockerfile6cc20efe72Update bad behavior test BAD_BEHAVIOR_COUNT_TIME to 30 secondse2a3bfb106Bad behavior core tests change the ban time to 60 seconds4bbddf7975Merge pull request #509 from bunkerity/dev1eeefead95Core tests sleep between each request9829ef7525Update UI to automatically set SCRIPT_NAME and ABSOLUTE_URIb27958a19cMerge branch 'dev' of github.com:bunkerity/bunkerweb into dev410a64810bcore - patch modsec to use access phase instead of preaccessf7d986d6a5Change the way linux starts and the scheduler95d4f0f87cSmall tweaks on core jobs4f324231d2Fix tmp variables path (again)dc18f98846Edit start.sh3b36965f4aFix tmp_variables_path in schedulerccc051e783Fix /var/run/bunkerweb in fpm args8b2517cdf0Remove ui cache download test - to much unstabled1138855eeFix gunicorn config for Docker and Linux0c8bc97faeFix UI on Linux not using the right usera68fb0c06aRefactor to make more sens and avoid specific errorsfff21746a9Correcting: Dockerfile-ubuntu End of statement block Jinja3ab4a59b6eUpdate debian Dockerfiles to avoid updating apt packages only once760ec3b3b6Add /var/run/bunkerweb removal script when uninstalling BunkerWebbe459d240eUpdate pid files paths to /var/run/bunkerweb8b697d87d1Fix Scheduler errors with the internal apis89a3c8b0b6Update bunkerweb-ui file according to the new gunicorn usage5e237d0d03Update gunicorn to use a config file as well + Fix headers error + Small fixesa424d59b1bAdd apk update at the beginning of each Dockerfile1d14db7e18Update custom cert job to not duplicate certs if the cert is global7efb82a7eeUpdate python depse920cba432Fix CVE CVE-2023-2650413b75b046Fix customcert plugin to accept multisite certs as well87a9545d9aMerge branch 'dev' of github.com:bunkerity/bunkerweb into devc533948452various fixesaca0d6da48Small refactor on the ApiCaller and the Scheduler1bd40a877aRemoving vmware support in doc612333d2adMerge pull request #508 from bunkerity/dev474ecbb41eFix typo in phases list in plugin.lua5fa21b3c89Fix CVE CVE-2023-2949116a459bf75Lint antibot html filesfd06a1e715Add Turnstile antibotd5e64320c4Fix small typo in misc.lua4d6d95037aMerge pull request #507 from bunkerity/devb60657e21fMerge pull request #506 from gin-gitaxias/patch-31f2c973a3bFix docker-compose file for custom cert jobb314f4349cUpdate integrations to add LOG_LEVEL=warning env variable to docker proxy0edfb2db35Update example to add a LOG_LEVEL=warning to the docker proxy83413aef2bRemove open ports from core tests docker compose files334be43462Fix custom-cert core plugin953128be6eUpdate scheduler changes check to reduce CPU usagebb7dcda48dRefactor paths resolutions for core plugins1088279524whitelist - remove unused IPs of duckduckgo crawler665b110c63[#504] Fix ALLOWED_METHODS regex5a2aa20bcdUpdate plugins.md168dfc4390Refactor paths resolutions for UI + optimizations on the plugin upload6e80c7b8deFix variable being ignored instead of saved inside the database when the value is empty8dad7a0b79Starting work on paths resolution refactorb5a78c3aaaTest Acqua Security vulns (2)ed6bee69c7Test Acqua Security vulns3dba058b45Fix custom configs not being cleared out once createdd9b093dab5Fix plugin example in documentation162f1d978aMerge pull request #502 from bunkerity/ui1f2fa95e77Remove useless line in the head.html file + lint HTML files1cd3567814Add multiple plugin upload in one compressed folder support for the UI29673f9182fix font1804936161Fix CVE CVE-2023-19997fe7a997fdMerge pull request #501 from bunkerity/ui5b75894d40Fix UI latest version checking & Fix conditions in quick settings for services1f6b3d59a1Merge pull request #500 from bunkerity/dev548630e3e9Update python depsaa299f0859Update plugin update and add to get only the necessary keysf0126b6d6eFix update-check job8585007bcbdeps/gha: bump scaleway/action-scwa7535c300adocs - fix yt preview in readme340b4a4929change arm server flavore7ea3952b6ui - add missing dep for docker/x86a586b5b6bedeps/gha: bump docker/build-push-action from 3 to 43b7d8b6c11Merge branch 'staging' into dev6666a25fccedit version, update images on docs and fix bug in Linux scriptf84af34025Add error ignoring when using the rmtree function0b082bdab7Add handling of stderr being None in the scheduler1f2b550f60ci/cd - fix swarm examples and init work on release workflowd5fcc69694Merge branch 'dev' into stagingeda275589dMerge pull request #485 from bunkerity/dev7506768c4aMerge branch 'ui' into devbe3d40f18aFix CLIENT_CACHE_CONTROL setting's regex to also work with JS41059fb282Merge pull request #484 from Hado-K3n/patch-1688f85b282cMerge branch 'dev' into patch-16e5e031b6b7Merge pull request #483 from Hado-K3n/patch-152dbadbd29fMerge pull request #482 from Hado-K3n/patch-1495c7b54109Merge pull request #481 from Hado-K3n/patch-1300739a5ab6Merge pull request #480 from Hado-K3n/patch-12a9f4be475eMerge pull request #479 from Hado-K3n/patch-11f85f736785Merge branch 'dev' of github.com:bunkerity/bunkerweb into devf1efe06e99ci/cd - fix /opt/actions-runner perms for self-hosted runnersad71be4608login now use local fontdcb800d2b8Update k8s.postgres.ui.yml5a7f7f3c67Update k8s.postgres.ymle1f60127e2Update k8s.postgres.ui.yml7553ffb632fix client_cache_control regex9324648f21Update k8s.mysql.ymleafe006a6eUpdate k8s.mysql.ui.yml62a8ec9758Update k8s.mysql.ui.ymldfcaba9ad2Merge pull request #478 from bunkerity/dev737b999cdeSet CLIENT_CACHE_CONTROL setting's regex9339af44c9Merge branch 'dev' of https://github.com/bunkerity/bunkerweb into dev78f7570e16core - Fix bwcli condition when checking bans40e30ed441use shared redis connection pool in cachestore when we cand6ca98ed15Merge branch 'dev' of github.com:bunkerity/bunkerweb into dev10a4cefd00update lua-resty-openssl deps and replace nginx -s calls with signals97723185bacore - Add bwcli testsab3b3ea8fdui-tests - update waiting time after creating a custom conf5adec84d5afix redis not contacted in subsequent phases and reflect changes on stream configs1624c4e766Merge branch 'dev' of github.com:bunkerity/bunkerweb into deveea6d32cd3share common objects during the phase and add threading to DNSBL and reverse scan99f8f69fa5Merge pull request #477 from bunkerity/ui9b58b397c9Fix ui tests (again)ace88d865dFix plugins fetching for the UI69b35636e3Fix UI tests (once again)5dfe35b7bcUpdate how the plugins are being fetched by the UIb75690fdf0Change the way python deps are installedb19ebbe6a8Merge branch 'dev' of github.com:bunkerity/bunkerweb into devc0c646aae5Merge pull request #476 from bunkerity/devedd6e2ded5improved session management and add IP/UA checksc7ca5a822fFix Database overriding services_settings if a global_value is sete1883a04beMerge pull request #475 from bunkerity/devaf19cc226dcore - Add redis tests0087ae5832Update python deps8133c134e0core - Fix db tests by removing "order" key checkf725d0fe63Update keys name in datastore05c478e834Edit COOKIE_FLAGS regexb5aaf62662add forward reverse DNS to whitelist, disable redis in cachestore when sockets are not enabled, fix typo in cachestore and improve dns/rdns caching8a8dd6fb7adb - remove order from plugin model93c766e564Merge branch 'dev' of github.com:bunkerity/bunkerweb into dev179beea4d7improved core plugin execution order1d126e1d0ecore - fix cors tests with the preflight requestdbb8840992core - Update allowed_methods test method to GET62cb85453acore - Remove cert verification when testing allowed methods in misc tests04919e8a08Fix multiple CVEsb32f318919Merge branch 'dev' of github.com:bunkerity/bunkerweb into dev4962f786bafix wrong env parsing in init phase, bypass modsec/crs when method is not allowed, refactor ALLOWED_METHODS and improve error page management10bdf551aacore - Add misc tests7158e7e9a1core - Optimize cors tests3f51f59bcbAdd check when plugins are configured + Add Semaphore to accelerate jobs execution + Code optimization4c4fa44fbcci/cd - fix core/cors tests84d43c84d2Merge branch 'dev' of https://github.com/bunkerity/bunkerweb into devb58798746dUpdate mmdb download to check the checksum at starta9be973d5fuse PCRE regex instead of LUA pattern and edit cors doc4378f18cc8fix typo in bunkernet.lua, add missing Origin header in cors tests and fix allow origin expected value7d84e03a15fix header plugin phase not called for internal request (fixes CORS), fix bunkernet init_worker bug where ngx.ctx.bw is not available, add CORS_DENY_REQUEST setting and edit values for core/cors tests8386621419Lint Lua code36fdec1058core - fix sessions testsab54b18e05core - fix reverse scan cache retrieval9c6ca6a860cors - various improvements991f7ff8d0Fix tests core reverse scan wasn't using the image9c77f77fa7Fix test core DB9ee74aef4fAdd up back when retrying to up the stack + remove useless print7bf4c11bc5When docker up fails in core tests retry one time82aadfa38cUpdate core db tests to add the settings.json file and optimizations2a78d2c057ci/cd - perform all core tests even if one failede3fc55be9fdeps - add missing hash for python dep async-timeout5f668aecaaci/cd - fix syntax error in test core wfe5e336c4f3Merge branch 'dev' of github.com:bunkerity/bunkerweb into dev9a2e37984dci/cd core tests and antibot refactoring2ac77ee497Fix deps not being synced394f5fe4bdMove back to images in the whitelist testsb06210bdfbRemove unused files in tests coree6bb9fb55fAdd tests for core plugins29f020f15eUpdate python deps051923b6fffix deprecated external network in compose files, various fixes in the documentation and add ipv6 to doc2e1296d9aeshow useful info in BW logs after startup/reload and reduce container images sizea686562f18performance - cache empty rdns resultse36c743c70performance - cache dns responses75f3d6490ainit IPv6 support, add missing healthcheck script in UI and purge local cache on inita258612e43add global data on settings filterbc3ea0ed35change select method checkab71c484eaadd global condition for disabled state5c415afa18various fixes - ttl on /bans api, dnsbl undercover bug, greylist, whitelist and wrong path in realip job5c50f57f1cRevert "regular inp and multiple global=true are enabled"9ceaaa8746regular inp and multiple global=true are enabled3dde3ac0aaFix no longer save SERVER_NAME when MULTISITE is set to "no"c01b493c99Increase compression level of tar files being saved in the database4f4a8b5081Fix default global values being added to database when MULTISITE is set to "no"4088067186Add external plugins being updated at the start of the scheduler402ff16c82Add "global" key to settings when fetching methods as welldcdb43cf05Merge pull request #473 from bunkerity/devca8c56aaa0Remove unused function in UI src.Config905946463dFix scheduler restarting for no reason when having an external database8a308b1a88Fix database not providing the right SERVER_NAME setting valuecf26d7aa22Fix database saving default values to global_values when multisite was set to "no"8bb6f63fa7Merge pull request #472 from bunkerity/dev64789276acUpdate python deps30194f9599Fix Access-Control-Allow-Credentials not being set to the right value when deactivated50ee37db0acors - refactoringb8d89fe79aFix customcert plugin63f4e44c61Fix CORS when sending an OPTIONS requestac2e4dd645Merge branch 'staging' into deve14475de4aci/cd - fix missing version in linux package name136f68cd3bci/cd - fix typo in beta wfd83730cf75ci/cd - fix linux package name in upload/download stepsae042854f0Fix blacklist download jobs where ignore urls were not being downloaded86053d3dc5Update RDNS regex in jobs filesb2e26fc8fcRevert "Revert "Update RDNS regex""48354fb269Revert "Update RDNS regex"a544f18e26Update update-check job to add stars so that the end of line showsc6f304b371Update RDNS regex14ca85cdb6ci/cd - fix package.sh name in linux build wfdc1cb6a6faci/cd - fix scp command in linux build wf73acbe0852ci/cd - fix typo in linux build wf45c90527c4ci/cd - fix linux package generation when arch is ARMf4590749d7linux - fix arch in rhel package image141f5a1d5bci/cd - fix typo in beta wf (again)6e82fde8a1ci/cd - fix typo in beta wf00ba46ebf0prepare for 1.5.0-beta update9a1c09c564Merge branch 'staging' into betadf787c75dclinux - add pcre dep to fedora package93e567bb65linux - fix fedora deps name and add architecture to fpm config8b6d788c2eci/cd - fix bitnami chart values541b646980increase drupal delay time for tests, fix tmp dir not created for realip-download job and fix has_*_variable check when multisite is yes59324526cfspeedup build process for python deps and fix default env value for autoconf/k8sa58e5c60c0deps - upgrade python dependencies27b1dddb0dlinux - pin pip versionfd056102d4fix centos repo command in rhel dockerfiles and fix delete infras order for staging wffb03733433ci/cd - use single quote in linux build wf43cbc79c75ci/cd - move ARM_* to secrets in linux build wf7592e5a84fci/cd - fix typo in staging.yml39ace81755fix load-balancer example and add server_name to cache keys when required48d7e72e54Merge branch 'dev' into ui66921b0075Merge branch 'dev' of github.com:bunkerity/bunkerweb into dev819ad60a48fix hcaptcha antibot and refactor ci/cd for staging20913808c5Add .mypy_cache to .gitignore filea086ff6909Merge branch 'dev' of github.com:bunkerity/bunkerweb into deva286e7bd32fix wrong container in autoconf/k8s, init work on linux arm and ci/cd refactoring5a233ff908Fix Database model types18b3d7148aUpdate db model to use SmallIntegersb36cd924faAdd `bw_` prefix to database table names63ce1afcddHandle errors more gently when API requests failsd4934cfee5Remove test-ui service in the main docker compose file as it's been extracted500d58e508Separate the compose file back21dc67b68dUpdate test.sh for ui-tests an the compose file75d2be7db7Update tests-ui to fix them041b7f71e5Update ui-tests to make a valid password1245b8b01cUpdate regex in ui + Add regex module to requirements913e9a2c2aMerge branch 'dev' of https://github.com/bunkerity/bunkerweb into dev97dc6540ebci/cd - fix typo in dev wfb75ba601b5Merge branch 'staging' into dev573fe8fee2Change UI admin password check to a regex51514df570Remove not needed file in linux scripts9ff64426b7Fix ui tests with the external plugins74fe9d5c16Lint jobs py files97b362bb17Fix let's encrypt error when deactivated964d318939Fix wrong attribute value when checking for external plugins914686e78eFix often occurring bug when testing the web UI58db1352faRevert "Fix often occurring bug when testing UI"987af951d8Fix often occurring bug when testing UI1c74c5d8d5ci/cd - refactoring1cc9f57739prepare for v1.5.0-beta fixesac94e5072afix double .conf suffix in custom conf, migrate /etc/letsencrypt to /var/cache/letsencrypt, fix bunkernet jobs and lua code and fix reload for jobs773874154dmove /etc/letsencrypt to /var/cache/bunkerweb/letsencrypt (wip)75ca603b7dWIP - fix bunkernet and missing reload for scheduled jobs0276054522Fix bunkernet initial message when checking connection + add TODObddfb58a0dMerge branch 'dev' of github.com:bunkerity/bunkerweb into devc7ab002082Merge pull request #462 from bunkerity/testmmdbef551846b9ci/cd Update mmdb - Let only the schedule and change branch to push onf41c096ec5Merge branch 'testmmdb' of https://github.com/bunkerity/bunkerweb into testmmdba7b7c2031dci/cd Update mmdb - Add check for curl commandsfb55295663Monthly mmdb update0afb250b91ci/cd mmdb update - Changed branch to push on019a927b06ci/cd remove secret required for auto mmdb update283a63f160ci/cd try fixing workflow auto download mmdb42707ad46aci/cd test mmdb updatecd57eb423eci/cd - fix automatic push of doc01fbacf0ffci/cd - fix pdf path for draft release + fix missing git fetch before deploying docd693d065f8ci/cd - allow to update release tag, add PDF to release and fix multiline CHANGELOG in releaseaa2ada0a00ci/cd - update git user/mail for push doc wfa47d7df401ci/cd - execute apt install as root for doc to pdf workflowc4093a2d7bci/cd - increase ARM node storage01e5994936ci/cd - concurrent builds for ARM + fix version string for RPM packagesaaa0701659linux - fix VERSION path in package script0b93c6e10fci/cd - add more cores to ARM instance88db3fa344ci/cd - fix build rhel var5c01bd3f74ci/cd - various fixes for push workflows604d4c1a0cMerge pull request #459 from bunkerity/devbed6d742f0Decrease the compression level when sending configs to BunkerWeb57cb6e9c44Update python deps0d1580cffdSmall code refactor of the jobs and the scheduler's function that generates configs766ca0e9ceMerge pull request #458 from bunkerity/dev0ab07678d3Merge pull request #457 from bunkerity/ui5412e6d240fix logs checkboxba7422218dci/cd - fix push workflowsfda2948e0eci/cd - fix typo in push docker wf59e5b1d54fci/cd - fix push workflows7ca7d78470Merge branch 'beta' of github.com:bunkerity/bunkerweb into beta9395456440add missing postgresql-dev build deps for ARM images0b5746aba3ci/cd - add missing inputs for build arm94dc501c17ci/cd - remove load image in buildkit for ARM archs because of docker limitation8ffaa7cf79ci/cd - force shutdown when deleting ARM node6e99e7a981cicd - fix docker buildx arm driver2eef2b8bb7ci/cd - fix variable share for ARM (again)406c686e4fci/cd - fix variable share for ARM6cecc70c32ci/cd - fix ssh command for ARM builder2f992baab3Lint py files with black7befd927d7Update python depsa4ae0d5178Update cached mmdb filesc3d0d7ca70Add workflow that automatically update cached mmdb filesd4ceb7c106Remove dev comments for ui testsb37c86e620Fix ui tests problem with the logs pagea7b07c9599Fix wrong condition when fetching the logs on Docker3b237ed3ccFix UI testsa55a0df5deci/cd - remove useless condition in create ARM workflowae33ca52edci/cd - fix wait-on variable8867eb23beci/cd - fix wrong json keys from scw api1b79e291ebci/cd - various fixes for arm build98ce5041d2ci/cd - use fixed sha1 commit for scw action in rm arm workflow66d7216dc3ci/cd - fix typo in create arm workflow45fa4d1c26ci/cd - ignore /root/.cargo dir for security checks, use fixed sha1 commit for scw actions and add missing deps for ui/arm9cd13990e3ci/cd - pass ARM ID as secret266383abb1ci/cd - dynamic arm build node4e0d2fce5fadd missing dependencies when prebuilt crypto package is not present823c09195aci/cd - add missing var for ARM buildse71dc132ecci/cd - fix typo in container build workflow0db5f7cf0fci/cd - fix typo in beta workflow4bfc5b693fci/cd - fix wrong cache name in container build workflow93d0a991a9ci/cd - fix typo in push doc workflow1c178ed75cci/cd - fix version output for beta/release workflowsab7e1f6244ci/cd - add missing runs-on in beta/release workflows0f499c9d37ci/cd - fix typo in push packagecloud workflowd0f6d59f6froad to v1.5.0-beta 🚀4086628697ci/cd - fix typo in doc-to-pdf312757594cci/cd - fix typo in beta/release (again)11f86ea754ci/cd - fix typo in beta/releasead16067420use proper links in docs, automatic doc push and add pdf to releases08e1d157d7Fix ui-tests by removing no longer present checksc8908695beRemove unnecessary prints641a27f5ecci/cd - remove useless needs for ui branch4684070818ci/cd - fix typo in staging workflow6784bd6914ci/cd - fix wrong condition for container-build workflowef1897de82ci/cd - add missing needs to tests-ui staging9815f22d72ci/cd fix typo in container-build workflow65c6e48e94Merge branch 'dev' of github.com:bunkerity/bunkerweb into dev14a4db8bdbuse current_bw_version for docs, add automatic tests to ui branch and fix letsencrypt permissions for linuxf6b8d23fbaFix ui tests by editing the attributes name to the new ones58fd04430eci/cd - fix typo in staging.yml54a17c7752init work on CI/CD for generic beta releases, remove useless autoconf examples and fix linux postinstall script4f2c58bd7ctemp disable authelia test for k8s and add missing folders for LE on Linux5e4ce45793various fixesfa67c5d7baci/cd - fix missing arg for copytree04db308c93ci/cd - edit staging workflow5d2045803cci/cd - edit staging workflowe7717ba7f9Merge branch 'ui' into devbbaaad8487docs - last polish0658230e26enhance responsivef5c28b27dfMerge branch 'ui' into dev5753123368harmonize all titles dark color2f336be770enhance file manager and jobs svg81a37a3778enhance actions btnsc3119f04eedocs - pluginsffa91933e2docs - add YT demo5741dce6d3Merge branch 'dev' of github.com:bunkerity/bunkerweb into dev7695a839f0docs - web UI5fe0e0bfdaMerge pull request #454 from Hado-K3n/patch-78c71f7d278Merge pull request #455 from Hado-K3n/patch-8124378d7c9Merge pull request #456 from Hado-K3n/patch-9c6a184d90afix ui integrations and fix stream support in dbd8b7db167emerge from uiddd83a8089docs - add stream support info and plugin description to settings page289b58567bdocs - add stream support info on security tuning page4dda54a118enhance style0ca473c690fix style issue between load and page transition1145b798f0fix filter setting from custom selectors63e7ccf132better centering loading logo with text001a63efc3continue custom selectors + fix script + style4144faa93bfix create service issue + remove stash72bc9e4bb6start creating custom selectors98de3fc2fcdocs - quickstartf118f992f6merge from ui5285a2f4a1force stash1d354c9c6bdocs - quickstart (wip)55a7c8fee8force stash64a9fe4dbafix checkbox + style issues + script duplicatea90d9e6273ui - fix default value for inputs7e1efcbc66Merge branch 'ui' into devb5f0fe856edocks quickstart wip01d8c65c96remove hidden input checkbox + fix scriptb7f63450edadd special method for modebc47f1fa5eMerge branch 'ui' into dev7089e8b4d2fix checked stated4fd4c4733fix checkbox + templatedb5789fcb4Merge branch 'ui' into devab20f83b22Update k8s.postgres.ui.ymlbbea8ba3fcUpdate k8s.mysql.ui.yml9a2005d1a8Update k8s.mariadb.ui.yml9512de630cdocs - quickstart guide (wip)956a7bd234Merge pull request #453 from gin-gitaxias/patch-2f8c5543fd5Update plugins.md667bb30036docs - quickstart guide (wip)6b76596a88Merge branch 'dev' of github.com:bunkerity/bunkerweb into dev78c2e16eadadd missing cluster config for ui/k8s and start quickstart guide doc1e6cfe8b0efix filter disabled issue + reset on modal open574ecbd6b3Lower the environnement variable for the modeaa3ce13a81Merge branch 'dev' of github.com:bunkerity/bunkerweb into dev6f39fce6d6docs - integrations92fc5d981fRemove ascii art showing in UI logsae7e3ddd9fFix how the ApiCaller is initialized for UI instancesdf94bc4af7Merge pull request #452 from bunkerity/devbf29fa2f92Show how many plugins there are correctly in the home page509bd21b06Add log when deleting plugin1530745a7eMerge pull request #451 from bunkerity/uia87abf3ce5update home dark mode + variable8a5836dd95add popup darkmode3a4a6ee5f2new service doesn't force method="default"1321a76c0cupdate service submit name for new or edit action53e145b919show method involved in disabled setting on hoverceec21faa3update web-ui INTERCEPTED_ERROR_CODES63ba001805Fix logic when saving a service in the UI479f18b175Merge pull request #450 from bunkerity/uiab43bf84a1Make it so the UI and the scheduler no longer run as root in Linuxa7849a6e7aFix mic mac with config files and UI9009859aa7Merge pull request #449 from gin-gitaxias/patch-10bf2116c44docs - concepts3616a9f202Update security-tuning.md435aae7cf1docs - index and migratingc0e649d680fix logs + select custom1c3bbf1bc3stream - add example and fix ssl support37ebde3635fix logs and plugins dropdown + marginb64e55f75aAdd bigger timeout to loading.htmlda4bb8dce6Fix condition in helpers.luaab509c2705Fix UI with Linux6916a81c5dbunkerweb is now W3C friendlyc7bc493e35stream - fix various errorsbc1dbe18a8Merge branch 'dev' of github.com:bunkerity/bunkerweb into devbd577cfb2ecountry fix (again) and init work on streama829528c3fAdd bwcli to scheduler and fix it for the autoconf9d829ebca1Finish updating bwcli94b97a6bb9Merge branch 'dev' of github.com:bunkerity/bunkerweb into dev780c0c8c53api - fix errors in calls and use ngx.ctx instead of ngx.var5fb0be70aeMerge pull request #447 from Hado-K3n/patch-66843902db4Merge pull request #446 from Hado-K3n/patch-53419dca980Update k8s.postgres.ui.yml38c71cf942Update k8s.mysql.ui.ymlb7c260561d[WIP] Update bwcli995ff250ffUpdate python deps + add redis for the gena04490b473Replace unnecessary import5112ed46e1Merge pull request #445 from Hado-K3n/patch-48558785b17Update k8s.mariadb.ui.yml95e64d6c87bw - fix black/grey/whitelist rdns check and country check8ea94a2e4dMerge pull request #444 from bunkerity/dev9f1405d69eRemove unnecessary {-raw-} in index.html when loading9a2f7e9ab5Merge branch 'dev' of https://github.com/bunkerity/bunkerweb into dev93b4714447Add marging to antibot files hcaptcha and recaptcha93c0cd437cMerge pull request #443 from bunkerity/uie7d61a67ceupdate antibot and default template5d05eaeae8Merge branch 'dev' of github.com:bunkerity/bunkerweb into deva77d233ecabw - add zlib dependency9a69ca135bMerge pull request #442 from bunkerity/ui823c128233fix SERVER_NAME + fix delete form + enhance52806afe73Merge pull request #441 from bunkerity/dev2ea726c222Merge branch 'ui' into devdffc770a99fix and enhance12f8b8197ebw - add missing lua-ffi-zlib dependency, fix syntax error for white/black/greylist, fix error for dnsbl and fix limit request not working in local mode4871a21040api - add missing ctx fillbcc5e6bb50bw - add missing json decode in api and add missing require in country83428d6ccfbw - fix resolvers nil error when doing dns checks7eefcb8f8dantibot - manage direct access to challenge pagea372ffd521fix invalid session error handling and remove debug log in whiteliste55912b34dMerge branch 'dev' of github.com:bunkerity/bunkerweb into dev5f9f1e54f8load inline multisite values for white/black/grey list core3b4882d82bRevert "Remove no longer present CVEs fix because these are already fix in the images"c2e0e51067limit - use atomic script for redis case4bc0771d95Merge branch 'dev' of github.com:bunkerity/bunkerweb into devedf7e06e07various redis fixes and display ready loga93d9a7d94Remove no longer present CVEs fix because these are already fix in the imagese4465d9a12Fix jobs cache when a database is usedc9af9457e4Fix wrong condition when sending files17a3d933b3Merge branch 'dev' of github.com:bunkerity/bunkerweb into deva60b6f3adabad behavior - fix 500 error and do not pass objects with another lifetime to timersc0e8e93abaFix documentation mistakes when soft merging 1.4 into devf1a868c66bFix when the cache from jobs is saved into DB + sleep 5 seconds when waiting for the database for the UId32102376fMerge branch 'dev' of github.com:bunkerity/bunkerweb into dev510938fc23antibot - fix bugs related to sessioned9605c103Update python script that generates settings.md3dabd42dfcUpdate python deps834fbaf01dremove antibot back btn + update raw95c231515eantibot - various fixes, not fully fixed yet56028b087eupdate antibot / loading / default page502d4fcc08Add back the fact that we don't download the mmdb country if we don't blacklist or whitelist a countryccd56d3b68change antibot and misc template stylec949c02328Update the security tuning's blacklist category according to the settings671543e6e9Add more ignored variables for missing setting name warningdbd5739abdFix wrong setting names under `Custom certificate` category5f26ebc695Fix php-cookie-flags examplebba26b5486Reorder core plugins to stop having the warning at startupdb166c434bAdd small fixes and lint to the error.html page08f3d93ab5Update jobs will now also check and save the cache in the db63b1fb947aFix CVE CVE-2023-1255d5b11b8bb1Merge pull request #440 from Hado-K3n/patch-392744c0913Merge pull request #439 from Hado-K3n/patch-2d46337f606Merge pull request #438 from Hado-K3n/patch-19b52a5c3c5clusterstore - various bug fixes3f9d606e17Update k8s.postgres.ui.yml7e2f53c8c3Update k8s.msql.ui.yml1f5d8bfab4Update k8s.mariadb.ui.yml7a7d83a754various fixes for redis/clusterstore - still WIPa5e08e1c67refactor of session management0fdb108fe9core - do not execute init() if BW is in loading state00b50c1629various fixes for core plugins4ba5d66598use ngx.ctx to store common values860cc1a924Merge branch 'dev' into ui881d3a00d5fix git issue on windows76a2ff6563Merge branch 'dev' of github.com:bunkerity/bunkerweb into dev28ef546a9arefactor - start to use ngx.ctx for per-request dataed495b99ffAdd CODE_OF_CONDUCT.md0bd3e273b7Update compression_level of sent tarfiles to 5 instead of 9348ab7a1e2Add feature that allow the copy of code blocks in markdown + Update copyrightcf2938bf2eUpdate web-ui docs according to the next major version79a46e2cf6Update the logic behind the check for linux os9a325c7a9aAdd new check for integrations in BunkerNet job707256076aAdd now the scheduler will pass his own env as well to jobs9578ace026Remove not used INTEGRATION file in BunkerWeb container8c919c6768Update links in the home page of the web UIad64ce22e9Remove no longer needed packages that were fixing old CVEs29cb6fe161fix header phase and fix error templated3d18e15a6Merge branch 'dev' of github.com:bunkerity/bunkerweb into deva83254bf20fix wrong log in access859343e185Merge pull request #437 from bunkerity/dev50829293c7Merge branch 'ui' into dev8e22b1f219Merge branch 'dev' of github.com:bunkerity/bunkerweb into dev9849ce10cefix wrong error check on phases and add missing ttl for *list cache items3b5c083fc7Soft merge branch "1.4" into "dev" + changing versions4d95e32f18update error page1da4b78f0fMerge branch 'dev' of github.com:bunkerity/bunkerweb into dev915b51c3b9fix error pages for default http server535f1a0552Merge pull request #436 from bunkerity/staging0afe038aa5WIP Ui3b6c3815ebfix default-server-http.confb5fa473ae3Merge branch 'refactor' into staging2fddbd8627refactor - disable asn checks for non global IPs, use resty.template with antibot and various fixes8d63e39740refactor - fix various errors and add missing dependencies23725d4831Update prod shields.io link in README.md303f380c76Update demo.gif file3c375039e9Optimization on the download of mmdb filesa7773dae2fUpdate intro-overview.svg5eb884fe9aFix bug when showing cache files for services in the UI3fac889ff2Remove no longer used modsec rules for the UIc3106e70e3Update README.md and edit the demo GIF + edit the .prettierignore file928ed2d6cerefactoring and road to nginx 1.24.034ab94640fUpdate python image in Dockerfiles + Add gevent to requirements for the UIaa96c8503fupdate css649d29b056change news base url217d1aa502enhance style + menu scripte6ff51e200Refactoring and Linting of py files and json666b7a1bacrefactor - blacklist, errors, greylist, letsencrypt and redis496edb83acAdding thel documentationee83cea7ffAdd ascii art showing randomly when starting6d1914d62dUpdate python deps648f15e42cAdd new core plugin update-check2075a5d4c2refactor - badbehavior, blacklist, bunkernet, cache, cors, country and dnsbl5dd52186baFully adding vagrant in the doc3a03f07f19Changing vagrant integration64997bae8cAdding vagrant integration03ec271e21refactor - improve clusterstore interface and automatically retrieve variables for plugins29c57915cbantibot inherit from plugin840c295684continue work on refactoring1ec83f256drenamed session to sessions8c29081577save workafc0ac1988init work on refactoring4cd3fc6447Merge pull request #434 from syrk4web/stagingbfc872be27change flash logic when login049e9c1ea6Update python depsbf9b94ebf8Avoid Autoconf from running in root92e6984581magento - fix docker example (again)a771bdb187magento - fix docker example7c21b3da2adeps - update lua-resty-session to v4.0.3d4fae4b57bsession - add missing settingsa850442203init work on redis session986f506e7dadd missing API_WHITELIST_IP in mattermost and moodle examples41e8f5c937fix wrong init of counter in badbehavior and fix nextcloud/docker example8e72050625ci/cd - reduce dynamic subdomains for k8s tests because of annotation size limit of 63 chars1bc42204d9ci/cd - use dynamic random subdomains to bypass LE rate limita1e44f6e4bMerge pull request #431 from gin-gitaxias/staging7ccd3ef926fix moodle/swarm example and disable reverse-proxy-websocket test8b54073a7efix missing backslashes in autoconf custom configs and add missing full reload after custom configs update622f2eb2acautoconf - check if service exists before adding config5d14813be4fix typos after basic testing9f70605643autoconf - add missing import and fix double lock release937cd10eebrefactoring and various improvements6af3b985a0fix deadlock in autoconf/swarm and fix missing favicon in default and loading pagesf6ed21b3b7autoconf - fix global custom configs not supported in k8s/swarm modeeee03c4ae1autoconf - fix variable typo in k8s watchecf4e77b32autoconf - fix deadlock in watch loop0b71819d22watch services for autoconf/k8s and support real IP in default http serverd3d0136bf5various redis fixes and improvementse80965ca9alua - fix wrong variable name in access220374db4bci/cd - fix syntax error in jobs9b8606d40efix redis hostname for k8s files and only append tasks with a desired state of running for autoconf/swarmc843be074creverse proxy - allow all chars for URL settings6a65104e7ffix return value of clusterstore.connect and disable auth basic for LE challengesb429201eccadd missing LUA import for clusterstore and fix prestashop docker examplea9ce32c262added a more precise scan response and modified .json like askedf4442b6428ci/cd - fix syntax error in k8s test class1c3c0d63b7ci/cd - fix missing k8s create infra jobe8c6d04aa6ci/cd - various fixes for k8s tests1caa9a1e7dadding reverse-scan5d41a5b985Merge pull request #1 from gin-gitaxias/reverse-scan77fb8c420bAdd files via upload1bb79b155blinux - add geoip deps to rhel rpmcf86446020Merge branch 'staging' of github.com:bunkerity/bunkerweb into stagingea1394b044ci/cd - add linux/rhel tests, fix docker/behind-reverse-proxy, fix missing stream module for linux/fedora and remove placement constraints for swarm87bd26da0dAdd threatmap to READMEb3eb647459ci/cd - temp disable autoconf tests and add missing packages for linux/centos202f21aab8fix syntax error in ApiCaller55a36f7190fix docker/joomla, fix autoconf/nextcloud and fix API calls for swarm tasks1c3f094cd9ci/cd - fix wrong yaml edit for swarm and append LE settings for k8sf07c0e66a3ci/cd - various fixese8ee460efcfix CVE-2023-0464 and CVE-2023-0465dd2c8cbcd1Merge branch 'staging' of github.com:bunkerity/bunkerweb into staging2d11a1c728fix nextcloud modsec rule id, fix k8s pvc definition and remove useless logs from linux/start.sh4f334a577aAdd sleep between BunkerNet registering and ping to the API to avoid being rate limited283828e8f7Fix Now support WebDAV methods in the ALLOWED_METHODS setting's regexe50c92250bvarious fixesb8b50b165cRemove check for messages after creating the service - tests-UIe88406b5d2Fix ui tests with the new UI922b32b2eeMerge pull request #429 from syrk4web/staging671db37f73fix autoconf/cors, fix docker/wordpress, fix wrong image name for k8s/scheduler and upgrade tests instances for swarm/k8sbe71b0781dformat logs instance to avoid error9e1876fea0logs fix + checkbox fix4d245f9fefchange cache/download to jobs/download6d16a766fefix service delete + change style5e598e90c9fix bw-data volume not reused between docker tests, fix wrong bw-data volume path for autoconf tests, add let's encrypt to autoconf tests and fix temp env not generated for linuxdc8b7dbe7efix form inputbf22faddc6remove php-cookie-flags from tests, use HTTP(S)_PORT for temp nginx on linux and fix wrong volume path for autoconf tests6c6845a794enhance some responsive + change api461789aed6ci/cd - fix BW CVEs and fix Linux restart318228e592change and fix service logicfa7c7ac91fci/cd - add www volumes for autoconff88eced330Handle services settings sent to the UI better357dc3e3a4Merge pull request #428 from syrk4web/staging283306a07aRemove CVEs fix, it's no longer needed for now276a96c55dMerge branch 'staging' of github.com:bunkerity/bunkerweb into staging19870f154cvarious fixes for linux and get ui tests exit code from container2485a47b20Update python depsbd88f9743bfix id rename error82d8180d8eMerge branch 'staging' of https://github.com/syrk4web/bunkerweb into staging41f43c46dcfix multiple0f632803ffMerge branch 'staging' of https://github.com/syrk4web/bunkerweb into staging53f480a66eenhance multiple logic + fix conflict1cf4a5665ddisable healthy checks for docker-poryx and dummy app in ui tests, add --no-reload-linux flag to generator and fix missing self arg in autoconf041142a4f3add healthchecks to ui and autoconf docker images4f9748cc2eearlier init autoconf in DB, healthcheck for scheduler and fix syntax error in linux/start.sh54813ecd4dMerge branch 'staging' of github.com:bunkerity/bunkerweb into stagingd97b5e1047various fixes8031c5060fStart handling disabled checkboxes + multiples58ab870b2dincrease cors/k8s/swarms timeout and fix tests/ui container namescceda705b5update flash count on removee91f3dc226Add a log when database is ready in UI + Small refactor of the Configurator1e9a55c240Add small tweaks to the UI and scheduler Dockerfiles7dc26dafaeFix disabled checkboxes no longer always have the value no with the UI7dc25b3a52fix redmine/docker example, remove double AUTOCONF_MODE in integrations, remove useless backslash in start.sh/linux, rename container for ui/tests55d24a8d14Change mmdb-country job to download the file only if needed9e009f7beeMerge branch 'staging' of github.com:bunkerity/bunkerweb into staging73b640bd3bfix cors/docker example, add missing AUTOCONF_MODE=yes to integrations YMLs, proper save_config for Linux and fix image name for UI tests87bccaad6fAdd `AUTOCONF_MODE` setting to scheduler in integrations examplesd331131c09increase timeout for php-multisite, add API_LISTEN_IP setting, edit default variables.env for Linux and add more logs for tests578a1a8c8bAdd more precise logs in the jobs pluginscb808c0ad1Fix bunkernet-ip.list file not being created in case of an error (same as 1.4)c8d39ba6b5Fix scheduler no longer running as root + Fix permission errors with downloaded plugins4a67a5f56eMerge pull request #426 from syrk4web/staging4dea680accenhance style + some fixd810882720Change the category if the user needs to log in in the UIe003b751ddFix when saving plugins with pagesb829e4edf1Fix false positive error with plugin page in web UIfc3ef33466Add UI logs into consolece85bc6b8fFix openssl no longer prints progression in the console2e144bf46eMerge pull request #424 from syrk4web/stagingdefb2c3336Change the way the error page is rendered2ae37ce8d8Fix regex for ANTIBOT_HCAPTCHA_SITEKEY settingf335364fc6Lint antibot.lua16842fef10Fix errors with missing % symbol + fix errors because of the symbol5f5a5a8905Fix css in antibot html filesccde5c74f1fix real ip jobsd3402ff3ffchange loading, error and test filesa02218bc83end examples refactoring5845446b9fRevert "Fix errors regex, authorize same path for multiple errors"be0df41609Fix errors regex, authorize same path for multiple errors89812362a1continue examples refactoring5d214497baFix don't try to add an instance when saving the configuration with the UI808b7b2206Update jobs connect to the database only when neededaa0eff7491Fix regex in redis plugin that was breaking the UI + fix ui.conf missing comma + remove unused variables in templates1ac434a5bcUpdate python deps9c22f1e971Refactor the py filescfe5c6063aexamples refactoringe37e6c3460Fix mixup of swarm and kubernetes when reading env variables + refactoring0356250d9dFix problem with the bunkerweb container and plugins548d157fe3Fix check if the Database is on read-only before trying to write7c5aa48978Update version string size to support new format61b9517a87Fix error when multiple jobs are trying to write in db at the same time8c67d08aeeLint code966f57ceaainit work on examples refactoring0210ddd886Add realip settings values to the initial BunkerWeb settings6f29756dd7ci/cd - pull only interesting images for UI tests2b1dbb1d46fix default cert path again and ignore pull errors for UI tests74a11c2ed8fix wrong cert/key path for default serverb3769b6e3ffix missing then in blacklist.lua, disable site search in redis.init(), remove counter from reverse-proxy/stream config and fix ui tests compose pullc7d8b7dc18update resty core and http lua to support latest version of stream lua and various fixes related to ci/cda62ef9f543add missing init-stream-lua.conf and various fixes for ci/cd65611020d8fix duplicate datastore http/stream, fix missing /var/www/html for linux and various fixes in testsb28668d68aci/cd - revert back to old condition for pulling images706305917aci/cd - fix wrong autoconf local image name, add missing secrets for tests-ui, fix wrong IMAGE_TAG for tests-k8s and try to fix pcre issue on linux2d440d26e1ci/cd - add missing runs-on for reusable tests-ui93945f391fci/cd - add ui tests5e31b6c4aefix CVE-2022-1304 for autoconf, add missing load_module for ngx_stream_lua_module.so and fix missing -lpcre in configure step01fab41620ci/cd - fix CVE-2022-1304 and wrong TEST_DOMAINSaa614b75adci/cd - replace Test.py with latest one, fix yaml paths, print logs when k8s stack is not healthy and fix wrong linux docker image name88a2955173ci/cd - fix log() callb95d1bc6d5ci/cd - add missing log() and fix TYPE for linux tests2604d9a563ci/cd - trying a hack to support dynamic runs-oned4d945293ci/cd - trying to fix runs-on problem53410e831bci/cd - remove steps609210021dci/cd - inherit secrets for tests workflowa168f2bcebci/cd - fix rhel build and runs-on for tests8bf211bc53ci/cd - fix linux package generation (again)9250faa524ci/cd - fix linux package generation139eaa2dd1ci/cd - add missing scripts7149a34cc5ci/cd - add empty .trivyignore and rename redhat to rhel5c5dbcfc72ci/cd - fix type in push-packagecloud workflowe826c619f8ci/cd - fix wrong quotes in delete-infra workflowb24cbf73daci/cd - fix wrong quotes in tests workflow99e27c4300ci/cd - add missing input in tests workflowee0e608de7ci/cd - fix negative conditions10f9658f56ci/cd - fix wrong jobs name in needs27bac0382fci/cd - trying to fix dynamic runs-on97627cf836ci/cd - pass runs-on to reusable workflows8969b1e726ci/cd - remove version from reusable workflows8ca292fb36ci/cd - change reusable workflow paths8e73eb87cfci/cd - fix syntax errors46e3078dd9ci/cd - crash test incoming95c5e2e47fci/cd - move dynamic runs-on from reusable to staging workflow131857a9b3ci/cd - fix wrong indent in staging/delete-infra-*fc1cab1af4ci/cd - remove subfolder and continue work on staging25729fda74ci/cd - init workbb2d868fa9Refactor tests5e3dadbfe3Refactor ui7fe168892cRefactor scheduler36b5c372edRefactor Instance and remove unused method596258559cAccept incoming changes for misc jobsc5a10aaa3cmerge default-server-cert job06acae4057rename *CUSTOM_HTTPS* to *CUSTOM_SSL* and continue work on stream support6bf59b59a2Refactor the plugins jobs7a8a75901fFix multiple CVEs (see comment) (finally)10ec01e7b0Fix wrong env var name in realip plugin947ecf81f1stream - add is_stream variable to check if we are in stream or http mode4f4c8ebf08init work on stream support79036e9751add ngx_devel_kit and lua-resty-env deps, support set_by_lua hook for plugins and init work on whitelisting support with modsecurityc2402b118ffix duplicate root error when bw is starting, add modesec rule to core ui and init work on k8s/swarm integration filesdbd052e9a8Remove unnecessary import and use parent list of supported custom conf insteadfb917960bcRevert changes on the custom conf regex for the autoconf26de0a233aLint files0faa34ac7bAdd a regex to the setting REDIS_HOST1d9459202dmisc - add missing page.conf1b113236a0Merge branch 'dev' of github.com:bunkerity/bunkerweb into dev29b3731487misc - default pages for default server6cb714be03Start adding integrations examples99b85ec8a9Fix Apicaller error with swarm37114ee2f6Merge branch 'dev' of github.com:bunkerity/bunkerweb into dev902fe6ad07bw - init work on redis7bf034fc9fFix being able to delete autoconf services from UI (shouldn't be)916caf2d6aMerge (soft) 1.4 branch into dev branchf8e31f2878Update mattermost to use a static image0f35c05eeeIgnore multiple CVEs due to missing deps in python:3.11-alpine846e26e410Fix multiple CVEs (again)ebc7fbbceeFix multiple CVEs (see comment)f4081ebd3bHandle more errors with Bunkernet job3b01b51445Upgrade the way the jobs run_once are executed8fa94d6a52Edit DockerController regex to handle more custom confs and fix modsec conf mixingc92d4224f2Update python deps + add cryptography for autoconf and MySQL5799758993Fix checkbox not being sent when unchecked + double settings tab in UI9358057211Fix CVE CVE-2023-22490 and CVE-2023-23946c671ccf7a2Add unauthorized_handler to UI5ac64758e3Merge pull request #417 from syrk4web/devfdd0da35d5Merge branch 'dev' of https://github.com/bunkerity/bunkerweb into dev34d12cd552Fix file manager always use the database now + create log file for UI if not exists47ccd9f047Log events back in the UI39b0f3f195fix + show one mult group7828c0225aadd checkbox fallback + DL scripte425eef9a5Fix weird shinanigans when saving services configb75bc0344bAdjusting upgrade on file variables.env79dabf7638Change the way bunkernet check on which instance type it is3f462fb3b3Optimize logger84f3a894feFix cache files not showing on UI93933bde72Fix custom conf MODSEC CRS being interpreted as MODSEC onlyc22bccc763Correcting nginx version for debian installation8bedc9ce67Correcting doc3a60b34638Modifying doc for packagecloud problem9efa217090Correcting fedora packagecloud probleme3410058fbCorrecting Ubuntu/Debian60ac00f5fbfix inp value6b13fbb844change svgc892050162Adding Rhel integrationcb77a70106change logs datepicker8b0d8a9d3dremove log + fix service tabfacb597ee6fix float buttons89930f1a34Remove encoding from Database engine args6122d59d82Update python depsd3a02be59bRhel cannot be supported yeta51aa27e47Add some checks and solutions to rare syntax errorae8e65057bFedora upgrade working Correcting backup during upgrade Database backuped TroubleShooting some errors with OS Centos working77f41a0591Backuping old confs working8fcba30ab0Upgrade Debian/Ubuntu working2e9a0c79e6fix select hover style64961e3955Remove unused importsb662d8453bUpdate python deps and remove oracledbe9d981a56eFix checkbox being disabled every time39418790a7fix popover content3d96fdb344update dashboard580f33e56cnew file el is hidden on nav4f6244e749Lint code1f20767565Update Python depsdcf9e301e4Fix UI not exiting correctly with gunicornf1a28b01b7Merge pull request #408 from syrk4web/dev5739144e3dFix bwcli /bans commanddf7bbb9606Update VERSION to 1.5.0dd0f56bb0cAdd password type for settingsd83d3aa3d9Fedora working Modifying centos systemd Adding %postun to rpm Modifying postun deb Centos workingb85e6ee6b8Updating to Fedora 37ca0d88fcc7Upgrading script: Ubuntu & Debian working835f85d5d8enhance input field stylec4b5ddb950Add setting to intercept specifics error codes86c81a6218Merge pull request #407 from syrk4web/deve6cb5b0b09Made the UI independent + update job download plugins0ce5f216dehandle password inp44ce5381c2Fix CVEs12b4cfa226Merge pull request #406 from syrk4web/devd7ee3ad667fix file manager dropdownefbcfd0e2cBeginning of automation testing for linux packages50b83790a5Merge pull request #405 from syrk4web/devbf1d19f33dremove prefix multiple input4d49f2f4b6Improving and correcting problems on packagesf5d87849a9Fix errors in the UI when a service have multiple domainsd6d1dd1cefMerge pull request #403 from syrk4web/dev0f5a734300add condition for servicesa5256dd80dFix IPv4/Ipv6 CIDR regex591a20cd86Merge branch 'dev' of https://github.com/bunkerity/bunkerweb into devc56fccbf20Adjustements to upgradea3a5c1c740Add ui tests requirements to the updated python depsb1c99e4088Add tests for the UI65f2bf09b4Remove the idea to store logs inside the database7beb400b47Fix stop gathering all the logs every time with the auto updateab163ce134Fix services settings saves and plugins deletion6932f3dedbAdd a new script to update python deps and update python depsd143720750Fix tar error when sending /etc/nginx to BW9edf789ab8Update python deps4b3b9b3268Merge pull request #397 from syrk4web/dev557db479c9refactorise logs script13f1dadf5fMerge pull request #396 from syrk4web/devadf96cadc5remove useless filesd2a634e7f7plugins + global_config fix1aaac2dcf3Add regex for settings.json871807b809Add small fixes and tweaks4c5172eda6Correction of problems331d58324eFixing detailse9c1b0cf8cAdjusting some detailsc220e5997cLinux UI fix13fbbfb67eUpdate job database while locking the threadsea4ceae7b3Fix isPage logic in menu (UI)8ee0ec88f9Remove test files in UId81c526540Lint ui files and change .prettierignore file5cc80d2ba8Merge branch 'dev' of https://github.com/bunkerity/bunkerweb into deva6295248c8Merge pull request #394 from syrk4web/dev38b59954a3Lint yml files146338de63Refactor every .py filefcd8d8746aopen another tab for doc051192791fchange style9c80cdb321add plugin page logic to menu7689dac76dFilter CVEs fixes in Dockerfiles0c8dfaaab1Update bw and autoconf Dockerfiles for let's encryptc5d3e77c17Fix letsencrypt permission error and optimize the ownership commands in scheduler8304116fddSend more variables to the home page front4379e21ea5Show dirs of every services even if they don't have a custom config148d9d2d4dRemove user override in the job scheduler when executing jobsc6498eda7eAdd new php-cookie-flags examplef97e056ff2Update jobs13fe4b6eefEdit core plugins regex + make COOKIE_FLAGS multiple + edit DB model accordingly2b2eadf441Merge pull request #392 from syrk4web/dev342fe956f7change data creating new servicebb7ca889ceenhance darkmode + fix + factorisationcdc3cfc81dadd toggle multiples + style191c88238cMerge pull request #388 from syrk4web/devdbe49bb8f4Update intro image7bdc46057bChange how the edit works in the config (UI)364ef13b52Fix error by calling a method on the wrong variable1142ace55aFix rare error with the jobs return code477e87a2f4news script + multiples groupsa04f983a09Merge pull request #385 from syrk4web/deve5574fbdc6change flash messages styleb1ca472537Small tweaks and handle services variables better98bda4d1e6Remove unused line in Templator0b1be727f5Optimized the storage in the Database47526dc8a0Merge pull request #384 from syrk4web/dev00d3073b08get custom method and check disabled state02d10f619aFix datepicker.js not being found because of the capsda634af4a3Accelerate send_files methodbe0ee60cddhandle stop signals with the web-ui064f9eef94Remove lines that will never be use in save_configec15a4e88aHandle stop signals from Docker in the schedulerc49f50da2aMove BunkerWeb entrypoint to the correct dir48bbb5e39bMerge pull request #382 from syrk4web/devb944de9e88change service multiple script07ab3deb03Remove unused lines in selfsigned joba4e863f09cUpdate authentik and migrate the example to the 1.5eeb810546aMigrate authelia example to the 1.5e2b2505d83Fix saving config for multiple settingsa0c2db7a09Fix how the config is get from the database4595295bd8fix tab focus style + dark mode style0bd6d56551add flash script to login + enhance style6f5aab11d4fix footer padding37380b977efix get multiple settings only3f6432f4b7Merge pull request #381 from TheophileDiot/devff84656cd6Update examples + add static versions0e29d9f1f7enhance and fixc195ffc864Fix autoconf not working properly with the shared volume291d64e29dUpdate community example + linting4346322f74fix services settings on modal openf2daf7368eMerge pull request #380 from TheophileDiot/devba9c16a5d7Merge branch 'dev' into dev0db1550f2fChanged the way jobs' cache files are downloadedfa54ebd491Made a few tweaks + change the plugins for the services modals0290f509e0add plugin_name (change values)77931b623fadd plugin_name6560ca0869test0d0f1aa95dMerge pull request #378 from TheophileDiot/dev03e98985eaMigrate more examples and lint016a8cd6d7changes5263be27d5Change the way jobs are downloaded + folder created in configs7813b51db4Merge pull request #377 from TheophileDiot/devc4bd535accAdd autogen back for docker and the autoconf243c4ca78dMerge pull request #376 from TheophileDiot/deve9687a5b13Remove unnecessary comments8537eea89dMerge pull request #375 from TheophileDiot/dev3c9574dae7Linux: Updating nginx to 1.229f84e02d8erefactoring services modal logicb105896b28add rename formff83b342defix issues8e31672ac5Merge pull request #374 from TheophileDiot/devb3d80d7a66Generate requirements with python3.9 + use new resolver6bbbe70eeaMerge pull request #373 from TheophileDiot/deve33bad4b9aFix comments + updated passbolt to support the 1.537f21c5d41Temporarily comment the post fetching343d9d09e8Show plugin pages even if there are none0a4f0eb57dFix error with jobs wrapper1d4998356dFix darkmode + Add new variables to pass to the front547021e7b0Fix job fetching for never ran jobs0954e82f48Fixes some bugs in the UI related to the plugins3c5f6002d6filter script + manage files + fix css + enhancee988aacf38Merge pull request #371 from TheophileDiot/devcce181a295Update customcert job9ba06b64d5Update README7f2eadacc9Update python version for the scheduler and requirements8d6c3d0b85Fix db get_configcc748a0480enhance responsive + add loader3bafe137d2refactorisatione9dfb59f31handle settings type multiple (fetch, add, remove) on services8e5dda5209Changed the way the config is get from db368122181astart multiple add and delete logicfee59a51e9separate multiple from others inputs50ba229146upload plugins + jobs template + global enhance94b0e6a0d5Changes on the flashed messages2e0a733cdcMerge pull request #370 from TheophileDiot/dev103e4a0ae9Update modsec CRS to v3.3.4f0f9d7dcf3Merge pull request #369 from TheophileDiot/dev4dabe6dae6Advancements in the examples migration to 1.5115bfbdc13Merge pull request #368 from TheophileDiot/dev81ad9e9ac0Update examples and add docker-proxy82ab6c7c43Revert "Remove unsafe deps in the requirements and install setuptools manually"b578823a19Remove unsafe deps in the requirements and install setuptools manually7fb61b5ef1No longer dump the jobs to the front37ece3de10Merge pull request #367 from TheophileDiot/dev719d779e01Start updating the examples to the 1.52889b2638fMerge pull request #366 from TheophileDiot/dev3c3bb7f200Fix the way we fetch the config from the database (with suffixes)f0d0dac914Add the variables back instead of the "_" so it doesn't create an error62ab9944ccFix scheduler errors with sqlite in autoconf7391900513Make the bunkernet not run in a thread to avoid errors840ef8cf89Fix typo in selfsigned job5a95e67030Edit the way the UI updates the config34b5aba1cbMerge pull request #364 from TheophileDiot/devb7f60dbdc7Update deps and requirementsa0634b5736Merge pull request #363 from TheophileDiot/devc0efdf9c00Replace /usr/sbin/nginx with nginxdb35e575e3Rename variables so they make more sensb22cc44d82Change the way jobs are sent from the database4e96e57e05Make certbot compatible with 1.5aaeda53002Change the jobs logic + add support for arm6577229226enhance templates844b06e286Fix how the jobs are sent to the front3a0727b5cdlogin template done0f5756cfb4enhance logs + prepare jinja variables08e7c2104bplugins done + add name to settings6b5d6e07eeRevert changes on the check_settings function3ccc12d789add dropdown + responsive3ed3fbe991Autotonf now update the instances tooe56f96d04bUpdate database model + Save instances to database + add the option to add logs into the databasec87c3637dbstart plugins template3a5d14952dMade few tweaks with the home page + remove useless functions55e76b2803Fix path for dropzone's scripts64d261acc0Change the way logs are parsedf13455d11bsend timestamp with ms7aac0c352efix msfb2e41c11elogs params2967ed98cdfix fetch4f9b2120e0testf1e614fae6change ternary operator for fetchfa5719db7ffetch logs + liveUpdate filter2a2f2f1e9bFix scheduler error2087167228Merge pull request #361 from TheophileDiot/devfa98003f22Thread the jobs run_once89e8839bbbOptimize the regex for the core lists51c5836ae1change logs script/template + continue jobsf61b4428b5Merge pull request #360 from TheophileDiot/1.5a96771881eChange the logs date format + start editing the logs endpointd30adf6709Changing rhelbf19cfe3dbMigrating Linux to 1.5. Still some details to adjust to be perfect0cd6ed1af2When downloading new plugins, update the database properly + update job every time now8f75af3d60edit the .dockerignore4f4beeef99Create the database variable even when passing the variables, just in case7347fe9bc8update jobs only onceb509ce16e3Copy the files after installing the requirements64601ebf58Remove useless warningsc9238f9930Merge custom configs generation to avoid repetition192c6755c3Update db for the jobs that are ran only oncec14765c6c6Change the way jobs are sent and how we update external plugins888bedd510Change how jobs are send from the databasebabb1c72cdRevert "indentation"44c74f9be4Revert "indentation"984b6c5f05ci/cd - speedup codeql by ignoring some folders not containing python files355c947a4astart jobs template + enhance menu272de0b8beci/cd - fix codeql config pathd9fc713c4dci/cd - move codeql config to filec2503d63d3ci/cd - add codeqlb098478bddenhance service + darkmode scriptfa1739439dci/cd - init work on dependabot82df3f17f7ci/cd - init workf02adf3001indentationc1031cb2c6indentatione8581ecb48enhance news/menu/base + logs scriptseb99d00daaRevert "enhance news, menu + end logs scripts"a7d3d04522enhance news, menu + end logs scriptsc7556a39afMerge pull request #358 from TheophileDiot/1.5e02e9c9ec5Edit how plugins work with the UIf1d7add739Merge pull request #357 from TheophileDiot/1.51252d1651eAdd the jobs feature and add the link when using sqlite2154c7f544Update database default DATABASE_URI7957f63b80Merge pull request #356 from TheophileDiot/1.573668b476fOptimize plugin gatheringb3cfc1f01cRemove unnecessary lines and add plugins_errors endpointb57e50db2dSend needed settings with the services in uia0e66ab30eChange Database default path for the sqlite filefdd393826fadd ui work in progress6b9a6a7e3fMerge branch '1.5' of https://github.com/TheophileDiot/bunkerweb into 1.5277e37bce4Revert "add ui"05d4b77bbdMerge branch '1.5' of https://github.com/TheophileDiot/bunkerweb into 1.5e7e43e64ddAdd dark_mode to uid40a93cb72Revert "add ui"d102f027f2add uib70d976719add ui7db7aee7c2Merge pull request #355 from TheophileDiot/1.570844ca604Fix database with autoconf1a7d8978b1Merge pull request #353 from TheophileDiot/1.593c74154abfix fedora python deps bugf2eabc0df6fix centos python dep bugd199f124b8remove exits in ingress controller3ec15eb4b0Update the docs from dev5a8f812560Merge branch 'dev' (softly)d214352b7bMerge pull request #352 from TheophileDiot/1.5891757dab5Add support for arm + change scheduler python version8dd377562fMerge pull request #351 from TheophileDiot/1.5630cf8b885Change the way services are sent to the UIb0c09b4defMerge pull request #350 from TheophileDiot/1.5fa655e6f06Remove no longer used install.sh and uninstall.shc8fbcbeaeaMerge pull request #349 from TheophileDiot/1.532101c3dc7Move UI deps, Make the DB compatible with PostgreSQL, MySQL and Oracle035eed8f6cui - add custom PYTHONPATH in Dockerfile2a3e24bd28Merge pull request #348 from TheophileDiot/1.53984c4b0daSeparate deps and change prettierignore file and pyproject47afdc88e1Merge pull request #347 from TheophileDiot/1.501bb6f5e65Stop converting the files content to base64 when sending them to frontc358747973Return dumps of settings instead of the dicta8f27ccb1cMerge pull request #346 from TheophileDiot/1.5edce79936aUpdate the structure and the paths04578aab3fChanging path Linux folder5ae714fc70Merge pull request #344 from TheophileDiot/1.5f65a4cdd65SMall tweaks on the UI + edit the ConfigFiles edits06aa73fcfeMerge pull request #343 from TheophileDiot/1.50811aad7f5Edit scheduler and change DB858f6e00f4Change python versionb279d02403Fix BunkerWeb gen on startef7fa5b4f5Merge pull request #342 from TheophileDiot/1.511bcd98243Merge branch '1.5' into 1.5bacef768c7Add integration manually in bunkerweb5ec179affdThe UI get the custom configs from the database0e6a5f3f96Merge pull request #341 from TheophileDiot/1.5eec00ba2bfUpdate the Database and make it easier to gen479b556fb5Merge pull request #340 from TheophileDiot/1.5375776e7deFix UI path_to_dict with the cache filesdf62fd410bMerge pull request #339 from TheophileDiot/1.51f58d0c517Edit dockerfiles6c07f99674Merge pull request #338 from TheophileDiot/1.5069b45f37bAdd some tweaks850530cd0eMerge pull request #337 from TheophileDiot/1.501b4145524Make the Database support every feature + updatesa12d013fc3Merge pull request #334 from TheophileDiot/1.55f8353c114Adapt everything so that the UI can work with every integration (some more tests are needed)fe89625921Merge pull request #333 from TheophileDiot/1.566fb266f8eCentralize Database and optimize requests7a03ed33f1Update pip in Dockerfiles every timeb09c05d3baUpdate BunkerWeb deps9c02d5f9e7Merge pull request #330 from TheophileDiot/1.57d743e1981Update the database and the core plugins accordinglyce6f01cf03Merge pull request #329 from TheophileDiot/1.59140dc3244Optimize Database connection and ApiCaller81307c82c2Merge pull request #328 from TheophileDiot/1.50edef7c520Use Python 3.11 where we canfe774e0009temp nginx is dead, long live to the IS_LOADING setting0bf402fd7aMerge pull request #327 from TheophileDiot/1.548242b9a3cGet all config with generator0b73ea856cMerge pull request #326 from TheophileDiot/1.509378458dddb.get_config() get entire config and doesn't filter anymore1008490234Merge pull request #325 from TheophileDiot/1.58b54762fc3Fix db init with autoconfcfaeb10133Merge pull request #324 from TheophileDiot/1.57e53bfe553Fix gen for Docker integration54530d535dMerge pull request #323 from TheophileDiot/1.579eea0e998Linting + starting to migrate bunkerweb to the 1.5316b84ad3fMerge pull request #318 from TheophileDiot/Feature-specific-order-for-pluginsba56c9f55cMerge pull request #317 from TheophileDiot/Fix-scheduler-error-reload-nginx-linuxa8f79e58f3Merge pull request #303 from TheophileDiot/Fix-custom-conf-disappearingb2a7e053bbMerge pull request #314 from TheophileDiot/Feature-blacklist-ignore96e6562732fix indent01cecf14e5Merge pull request #313 from TheophileDiot/Feature-max-client-size-edit-modsec873ccad9b2Add MODSECURITY_SEC_RULE_ENGINE and MODSECURITY_SEC_AUDIT_LOG_PARTS (#292)97bf473e1adeps - add update checker for deps (#293)5af2fb7783Complex example using autoconf (#271)bd4c94e834Add specific order for core plugins and check thema96a8a8c2fFix incorrect message while reloading nginx + more details on error446ff93a49Add ignore blacklist feature5fdcc9e583add g/G to the available file measurement unitsd207aa4bf5Variable MAX_CLIENT_SIZE change the SecRequestBodyLimit value57ad9d7ee0Fix old custom configs where never deleted7860aeab94Merge pull request #312 from TheophileDiot/devcac220023eFix small typo in autoconf integration5d9dc88cc5Merge pull request #307 from TheophileDiot/Restrict-access-IP-NET40863f28a5Merge branch 'dev' into Restrict-access-IP-NET67d514b53bMerge branch 'master' into dev51e96416d9Merge pull request #304 from TheophileDiot/Fix-Endless-loading-after-update-serviceace1dfca25Merge pull request #308 from TheophileDiot/Fix-docb9e5badd94Fix last typosa9865f8502Fix typo in plugins.mde3d0120a0cFix minor typos in the doc9214bb9392Merge pull request #309 from TheophileDiot/Fix-flask-dev80c1b225bdReplace flask development server with gunicornde0954fac3Fix typos in the docs27b4ff330cAdd the greylisting feature06f65ffe27Change the exposed port to 7000b0a887a155Fix errors and warnings when editing a service803ff8cb56Fix CUSTOM_CONF_SERVER_HTTP disappearing after 60 minutes (autoconf)94ce249d74[#290] Fix typos in docs478e980189ci/cd - temp disable k8s test8f44e108bbci/cd - add docker system prune72caf907a0ci/cd - temp disable swarm tests01acb1cf30ci/cd - temp disable nextcloud/swarmfc3c7892daci/cd - add missing prepare for prod tests2a04a56428ci/cd - update ruby version for CentOS builder6afdb298falua - fix pcall for asn/country mmdb lookup04019a617atests - fix nextcloud/swarm34649bf33adocs - add Ansible to README469a5343ecci/cd - remove old linux packages before building4244399eb1road to v1.4.3 🚀66029a316ctests - edit prod workflowd0c245ba83tests - fix bug when testing if a swarm stack is healthy5633d5ff5ftests - remove mongo-express/swarm61d57b4ebbtests - fix mongo-express/swarm76f035e21dfix wrong DENY_HTTP_STATUS setting in docs, fix autoconf ghost/prestashop tests and some UI warns/errorsb35dbdffc0tests - fix ghost/docker7e226301d4tests - fix prestashop/docker8f273a929dci/cd - fix missing comment chars45f4e06aceroad to v1.4.37fe58ddd57tests - disable systemd start limit561e64a890tests - road to debian29933fdebbtests - add unzip package to linux container7915da6dfbdocker - fix CVE-2022-3209d8f6c27560tests - fix configs perms for linuxcb56e7d04atests - add chown for custom linux configse847343143tests - fix linux/drupal (again)4caae414d5tests - fix linux/drupal8a23b96bf5tests - disable linux/moodlea4fd701d5dtests - temp disable linux/proxy-protocol39ed524f02tests - add missing variables.env for moodle/linuxd0e3f3ae26tests - call cleanup-linux.shb0fa57b056tests - replace restart with stop+start for linux testsec11360853tests - print logs when setup_test fails3be348ebe8tests - add haproxy cleanup for linux tests884ca0f6d0tests - add missing variables.env files for linuxe4321629f1tests - road to linux tests 🚀c277a33e9ctests - add missing which command for fedora512c60c519tests - add some debug info when linux/setup faile64cc29a8ctests - create /run/php folder for rpm linux distros42d29743b3linux - fix 755 perm on /opt/bunkerweb505d5c2ae4tests - fix behind-reverse-proxy/linux70992a0b50tests - fix haproxy logging again7e5465c595tests - fix haproxy logging againf5606b6933tests - fix haproxy directive265742cd94tests - haproxy add logs0580662cc8linux - copy current variables.env to make temp one8e15e2a400linux - set /opt/bunkerweb permissions to 75517801caebdtemp disable arm552588adf1temp disable arm5849c66e66tests - fix www.conf052dc23466tests - increase php logs verbosity for linux tests331c7e9545tests - add debug log file for PHPf71ad0f656php - fix fastcgi_params path34c648830btrying to fix PHP bug in Linux5c99a4b0e2refactor linux/start.sh and fix tests/cors www copyeb6f0d6737tests - fix purging wrong folder for linux tests6ea38b1f77bunkernet - fix wrong import in register jobb5c07dda01tests - add cleanup for linux tests17b6b0fdc8tests - fix PHP www.conf for Linux512ed7200dtests - add cors/linuxd8071e4c43tests - install php-fpm790fa37aebtests - fix behind-reverse-proxy/linux6005a8f73btests - fix behind-reverse-proxy/linux again and again09f56a1c6etests - fix behind-reverse-proxy/linux again0c4d2edf12tests - fix behind-reverse-proxy/linuxd53c54d4b8tests - add behind-reverse-proxy/linux093d426bc9better management of registration with BunkerNet and fix syntax error in LinuxTest3762c38741tests - copy variables.env for Linux tests55525abf15tests - fix mattermost/k8s23f8ec9571UI - fix container CVEsa38ca51380docker - dont generate config if already presente92938f004autoconf - fix container CVEsc2ad79a792Docker - fix CVE-2022-374348eefb4bf53examples - fix mattermost/k8s6d1ef606f7examples - fix nextcloud/k8s95c4ce723denable bad behavior on default server and various k8s fixese295b020e4tests - increase redmine timeout and add pvc cleanups1e499db505examples - fix gogs/k8sa642761366disable bad behavior if client is whitelisted and fix redmine/reverse-proxy-multisite examples115d517c71tests - add delays7c1474cd89examples - fix moodle/k8s port number305870cc22examples - edit moodle/k8s port number3df0f8505btests - add delay to moodle897528b730tests - fix magento/k8s again4f4c446f7bexamples - fix magento/k8s again69848dccc9examples - fix magento/k8s0516f0a839tests - assign bunkerweb-controller to srv141524a9e3dtests - force pv0d44b098f4tests - fix prestashop URL0e315dc5fctests - edit prestashopHost value5741391de6tests - change k8s service type of prestashop to clusterip6adff9cebdtests - increase timeout and remove pvc for prestashop/k8s97a2caf06etests - fix Kubernetes missing variable assign865f4f1b56tests - fix prestashop/kubernetese8305b0b65tests - fix missing prestashop/kubernetes.yml840b875f70docs - edit plugins page978bbe9ca1examples - fix missing configs subfolder in nextcloud/bw-data502c9f2fe9examples - fix radarr/swarm1c4f8bf55ctests - automatic volumes prune for swarm testsb6e2ad22a6tests - fix joomla/swarm216686fc8ctests - add delay parameterd648b1fbeatests - increase magento timeoutd3b725294ftests - wait until swarm services are runninga48200bc02examples - fix reverse-proxy-singlesite/swarmb429dd8043tests - increase timeout for swarm healthy check0440c61d0cexamples - fix gogs/swarmae36b98992docs - quick edit on PHP9a83fadd82examples - fix gogs/setup.swarm.sh permissions09141f2047examples - fix magento/swarmedf5421bf6examples - fix permissions for magento/setup-swarm.shc67564c7c8tests - increase timeout when doing requestsb076370090examples - fix mongo-express/swarmec35b0a547examples - fix mattermost/autoconf95e3022ebaexamples - fix autoconf/reverse-proxy-singlesited63538fd58examples - fix wordpress custom conf variable name for docker/autoconfe01b240723tests - ignore error when replacing patterns in files (binary files)217924fe46examples - fix reverse-proxy-singlesite regexbb6d02e0f6examples - escape dollars in reverse-proxy-singlesite compose files5c42fb58d7tests - fix reverse-proxy-singlesite2f8c5a1e9fexamples - fix host for reverse-proxy-multisiteaf866e8256edit docs/integrations for ansible and fix examples/mongo-express compose filee90d4cc7e2tests - fix json for reverse-proxy-multisite70ac3c01b3tests - fix missing arg no_copy_container07a962466btests - inline configs for docker/autoconf87c57c67c7tests - refactoring on the road, still needs some work8fb03a3171tests - on the road of refactoringdc8570ca87tests - add status type1513785705tests - refactor mattermost example4e7d795ea6tests - support custom cleanup-kubernetes.sh script and refactor some k8s tests with helm chartscc9d228abdupdate compose version to 3.3 for swarm examples so config directive is supported1819571473remove trailing space in DockerController and add missing bunkerweb prefix for autoconf-configs example324feb593dautoconf - fix missing configs update for DockerController22398d5678cors - fix typos in autoconf.yml5119c8da7cgogs - missing setting for autoconf0fca93e3e8tests - sleep 30s between autoconf tests17e14f4d53tests - fix wildcard with sudo3a46d318eetests - remove only content of subfolders4eff0c3f9dtests - fix behind reverse proxy urlbf58a17b8agogs - add setup-docker08d8bc8804tests - remove whole subfolders in bw-datab38f7c54e6tests - add kubernetes-configs and fix missing s in urls06f7fb096etests - fix docker-configs (again)b7101eb475tests - fix docker-configsa08b51bd03tests - fix gogs expected stringb2bcfb8c7ftests - fix hardened expected stringd3014b42f7examples - refactoring in progress7eae497194tests - prevent default rate limitbe21b3933atests - fix sudo cp again7bb881aa39tests - fix renamea607bd67cbtests - replace python cp with sudo cp6d06a32cc9tests - list example_data as rootc5526ef2fdMerge branch 'dev' of github.com:bunkerity/bunkerweb into dev75b2ae868btests - fix example_data path for docker72965e230eMerge branch 'dev' of https://github.com/bunkerity/bunkerweb into dev201e2cf0f3Correction logs Linux2033974442tests - init cors and fix example_data path for autoconfd8c8ceab36tests - fix LinuxTest setup and init work on integrating examples with the new test systemc02d888b32examples - rename setup scripts for drupal9a9f9ebf36examples - fix linux-setup.sh for drupal6e381ee028tests - disable copying bw-data files for k8s and swarm tests0ee09d47datests - force removing directories with AutoconfTestda2f6cb4f4tests - force removing directories with DockerTestd1d2e51a31cleanup tests directory and init tests refactoring for drupalc14b08faa7examples - edit authelia configuration.yml file for Linux integration80fee58e47bunkernet - add default api server in jobs37690a7a4cconfigs - enable default server if TEMP_NGINX is setb3fdd109a8linux - fix wrong variables.env path when running jobs once193449512aMerge branch 'dev' of github.com:bunkerity/bunkerweb into devf5ede78974examples - fix authelia variables.env767a7ab315Adjustements doc Ansible/Linux81b3703660wait until Linux test container is initialized and fix variables.env for authelia44fbf03158authelia - extract tarball to tmp02db54ce0dexamples - follow redirect when downloading authelia for linux14d61854e5add sudo to linux dependencies and curl to linux test images6f35561faetests - fix cp and end_fun for LinuxTest2505bc015ftests - add linux to authelia kindsb1df38374ftests - temp enable docker410212b158tests - run docker cp in a shellf2ac7bca74tests - fix typo in LinuxTesta0948923ectests - copy local files for Linux tests458ebe07fftests - dynamically find deb/rpm name2205043e75tests - fix LinuxTest.docker_exec()d370f1b053tests - add missing chmod import to LinuxTestbf6dd93aa7tests - replace rmdir with rmtree for LinuxTest773517311eMerge branch 'dev' of github.com:bunkerity/bunkerweb into dev850a8057cfignore CVE-2022-30065 until we have a fixe6271ccd63Final proofreading FPMf0ddb8328edocker - fix CVE-2022-30065 for autoconff260bcf23cSmall adjustementsfa319ec101tests - fix argv len check0294064532tests - fix typo in LinuxTestf47ab0adc5tests - integrated LinuxTesteca010231cFPM Linux/Ansible Doc4d61e96e47tests - LinuxTest on the roadc9c7303460tests - fix linux.sh58a82ddcd6tests - copy Linux packages to local directory8062d043c1tests - fix Linux dockerfile path0a09f8a750fix CVE-2022-29458bb425bc361tests - init work on Linux testsaa729daebbexamples - remove double $ from kubernetes authelia7edd55544ffix k8s example for authelia and ignore error code when doing debug_fail for k8s tests0fd77a8092examples - fix typo in kubernetes authelia720f36f473tests - init kubernetes refactoringea98b453d1tests - use unique domains for swarm tests4bd0129e46tests - also edit root domain6e47b29919tests - add sleep in the end of SwarmTest.init()abc500a4d4tests - fix domains for SwarmTest3780477940examples - fix authelia swarm compose version4a5e50005bfix typo in SwarmTest and fix authelia swarm example3b73c50c32tests - ignore docker stack ps return codeba6fddb56atests - init swarm refactoring9ecd2bd98dexamples - add missing network aliases to authelia autoconf7bbf77b7a5fix authelia autoconf example and debug fail before cleaning testsf02fe1ed91tests - remove only subdirectory on new tests and add cleanup when test failed0383cadd69tests - fix compose filename for autoconf testsaeba0ba72ctests - add missing AutoconfTest object67608a463atests - add missing decode8b3b1291cctests - from replace/rename functions to class method1c5c81d2cdtests - add missing importfa2d52d80ftests - remove useless log and return boolean from Test.end68bf5ef850tests - remove wrong cleanup call424b37bec9tests - change permissions as root2780ee190dtests - add debug_fail function07b0bb38dddocker - fix CVE-2022-29187 for ui and autoconfb47c2696eedocker - fix CVE-2022-29187fdb8ca3cadtests - replace internal _log with logger.logeb59a9377dtests - init refactoring for autoconf2e0542dbb0tests - ignore case when performing test0a996bf123tests - replace match with search48a6ba6328tests - fix rm command991ddb9eb9tests - remove file as root1e1d7d7f14tests - replace variable typo in get requestebc94f515etests - add missing char when replacing Docker volumese4f6017d64tests - replace example domains with test domainsdfc5f2e79etests - export runner envc07f85a424Merge branch 'dev' of github.com:bunkerity/bunkerweb into devab57be6570tests - fix missing copytree import and self parameter5f79aea4bbfpm single/multiple docker&autoconfcc760a646btests - fix datetime import againdb2c35cb3ftests - fix datetime import28f1b4f734tests - rename variablee1183a0d4cfix tests.json for authelia and exit when test exception occurs16573a397etests - do not run as rootde8cee491atests - add missing imports56afbd4577tests - run as root590ad46cd8tests - fix missing chmod import and Test.init log call8d580bc165tests - fix missing Test importa91fc73072tests - fix indent and isfile import773a37d456Merge branch 'dev' of github.com:bunkerity/bunkerweb into devb64af85262tests - DockerTest on the road0d3e1e2a13Update the plugins docs85217b57c3Fix a typo in the plugin page in the docsba75154d07Add url_for function to custom plugins templatesc055ec7ec3Fix duplication in plugins2c4efe9d0eAdd Plugin Pages feature795dfc0778Add static map files8b4b3f3b04ansible docs2e4758e948tests - DockerTest improvementc155227ec6tests - init work on refactoringdde1851416tests - increase timeout for magentoe62523d1dclua - use pcall with mmdb functions658ab75049docs - add ansible diagram8d6397a6baMerge branch 'dev' of github.com:bunkerity/bunkerweb into devf5c86cc4e2examples - add cors example8760110fbaMerge branch 'dev' of https://github.com/bunkerity/bunkerweb into devcc4f0b26a1Quickstart Ansible and integration7b769361afcors - init work on core plugin for CORS97e607110clinux - rename bunkerweb-ui.env to ui.envc3ee7929bedocs - change target of the web UI demo link to blank969a1e5d70Merge branch 'dev' of github.com:bunkerity/bunkerweb into dev5bf59c85d5docs - replace web UI gif with YT video430f665cdcMerge branch 'dev' of https://github.com/bunkerity/bunkerweb into dev5be21f9bf8Adding www folderafdd4de5a4fix regex checks with *_CUSTOM_CONF_* setting, add doc about DENY_STATUS_CODE5586b3733bmisc - add DENY_HTTP_STATUS setting (403 or 444)90e58f2612fix ui.env path for Linux integration and add docs for autoconf with rootless dockera00607af2edocs - add instructions for podmane880b7d598docs - add infos about Docker in rootless modefc925ccb11edit docs typo for UI and variable typo in autoconf5714221319ui - fix CVE-2022-2097287e763e0dautoconf - fix CVE-2022-209789f81140aecontainer - fix CVE-2022-2097 (again)a5c98f7099container - fix CVE-2022-2097429214727btests - fix data folder permissions (again)6b1c5a93e1tests - fix data folder permissionsfb85d1d2d1autoconf - fix typo in variablefdcbc8d361custom conf - fix wrong path with multisite configsb2bb93bcf8examples - fix docker-configs again2b59086f66examples - fix docker-configse09d4901eacontainers - fix regex for *^CUSTOM_CONF_*3594618e4cexamples - fix typo in docker-configs (again)e443112819examples - fix typo in docker-configs738e3b6e1acontainers - use python hack to get env var values from string5ac80a135ccontainers - replace compgen command with a python hack because compgen -e do not display var with dots8f258486effix multiple CVE with curl/libcurl and add autoconf/docker CUSTOM_CONF configs examples2dc18a7942autoconf - support both configs from files and autoconfe0a7005062autoconf - init support of custom variables using labels385b7c4134docs - add docs for custom config using labelse25babe3d2custom conf - dockera5457a164ccustom conf - init setting support0a1e8be71fexamples - add missing setup.sh for mattermost70c60f2a9btests - add mattermost and radarrf2dfb01724examples - edit mattermost and add radarr1a8eef2c85fix autoconf import for IngressController and init work on mattermost examplecb106a112eautoconf - fix indent in IngressController492648eeb2autoconf - fix 410 exceptions (k8s)1425ad0b42docs - update settings listf7290b2c79v1.4.2 releasec0a8a356c2linux - include bwcli in /usr/local/bin40007b0866add slack to official plugins and init work on EXTERNAL_PLUGIN_URLS setting6478512e48scheduler - only send /data folder if apis are present7aa6852d3cautoconf - fix missing scheduler in autoconf mode and missing apis list7bba81b16bautoconf - fix wrong variable name for environment5cb61380d7autoconf - add missing call to ConfigCaller constructorb2758cea76autoconf - init work on _get_static_services methoda18d77aeeeautoconf - init work on static server configs as env var4a699ef6c6fix missing local Linux images import in ci/cd, and fix bug related to jobs in Linux integration5690a58ab9fix IFS checking permissionse55928a37bfix bwcli commands when using Linux integration0f2388b1f2fix permissions check when file has space in the name2b43a9cbf5Merge branch 'dev' of https://github.com/bunkerity/bunkerized-nginx into dev5ecf39ee02Fix web-ui example with X-Script-Namead091493c3examples - add various certbot-dns examplesa65606c369examples - add certbot-dns-ovhcd0d70b8f6cache dev Linux images in ci/cd and disable site config generation for autoconf/swarm/k8se21a35017aplugins - support log_default() hook, same as log() but for default serverc563731e86autoconf - fix overwrite configs file when using Docker autoconf3c417d2ff0linux - fix fedora NGINX version in Dockerfile, fix missing arg when building DEB/RPM and force NGINX version DEB deps970082f92elinux - force NGINX version in RPM deps4a2504c3b8reflect ci/cd changes to devfd0c7b1e53ci/cd - add automatic build for Linux images1e6d62ce79fix packagecloud yank name1a4e21481edocs - edit supported architectures for prebuilt Docker imagesbcaca6f034v1.4.1 release424214fd56add changelog and add missing s in authentik url82b42d5b9cMerge pull request #259 from Brawdunoir/masterdb4e2cf266update linux docs, minor fix in ingress example and update default value for bunkernet job0ef82619b8temp disable automatic tests for authentik and test automatic arm build on dedicated hardwaref2655e331dremove arm build again, fix proxy_*_timeout directives and add authelia exampled51ae1c1b9Remove USE_ before authbasic plugin settingscd0438b8cesupport REVERSE_PROXY_*_TIMEOUT settings, remove useless push in CI/CD and try to build arm on GH runnersf9a042526eadd docs about compiling BW from source on Linux, add docs about packages pinning on Linux and fix regex for REVERSE_PROXY_AUTH_REQUEST and REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL15ac64b05flet's encrypt - fix bug when AUTOCONF_MODE=yese0f8895e9ainit support for auth_request and add authentik examplee852298352don't send local IP to BunkerNet on default server, fix certbot new when MULTISITE=no and fix unknown reason in get_reason972a284efddocker - drop support for prebuilt arm images5258d8e58fdocs - edit linux install procedureacb4bea97dreflect CI/CD changes for master pushes42067e864aGHA - temp disable armv7 build until we have a fix for cryptography dependency217bddabfdGHA - different caches for armv7 and armv8 imagesc5fba13674fix GHA typos1b21f9eac3fix UI tag in GHA jobs389e050943fix links in docs and change cache location for GHA jobs05a89c3037fix registry URL in GHA jobsa0ed8a27e9add debug flag to GHA buildx stepsd0ac5e3059update GHA actions versionb16f8f11adupdate GHA actions versiona23ed06e66fix typo in GHA jobs6b9be078b8refactoring of GHA jobs8e198ed82elinux - fix documentation link in systemd unit filesc3b527afe8actions - fix RPMs path972e5471d1actions - fix linux deb/rpm generationb246c6d7e2fix wrong branch name in actions and image name for linux testsb78fd55427fix freetype CVE945241339aactions - rename main branch to master1af2264fabtemp stop push to private repo6f28708c10docs - add missing settinga9f886804abunkerweb 1.4.03a078326c5Merge pull request #199 from Myzel394/patch-1d43b82b757remote API - only do action if 4033850cacb9cprepare for v1.3.2c00c7f46a0lua - verify certs when doing HTTPS requests163af4a49dprepare for v1.3.298e85eb99fdocs - update security tuning sections : distributed blacklist and request limit2e63bb0256docs - reflect kubernetes/swarm changes into the doc6546a0edb7disable country ban if IP is local, update default values of PERMISSIONS_POLICY and FEATURE_POLICY, upgrade archlinux packages before testingab00381746ui - fix ROOT_FOLDER bug in serve-files.conf9f7097de0drequest limit - fix some LUA code24d6337a57limit req - multiple url supportbfb5319c16limit req - add burst and delay parameters4c77a14825use annotations as env var in Ingress definition, fix cidr parsing for reserved ips, fix missing empty when job is external, fix ping check for remote api and init work hour/day support for request limit4e45fa3874integrations - acme without shared folder when using k8s/swarma9a26b82d9fixed typo00d91dcaaajobs - move certbot hooks to python650ad7ea49integrations - fix missing acme folder when using Swarm or Kubernetes7045c0c2b6jobs - fix encoding error on CentOSf0f432487bremote API - ban IP from distributed DBfdc02be051remote API - basic send of bad IPsfb799765a4jobs - fix str/bytes helld53f02b5b3api - client side (untested)7b9722fac4jobs - add remote API31ed4ff834centos - update ca-certificates in install scriptbc5f3ee88efix CVEs and add init to Debian test imagea6b21aae8cfix typo in settings.json, bump Debian to bullseyes, init support of Arch Linux64aa9c2530init work remote API5d94cc8f43docs - init changes about storagelesse7ee21cbb5antibot - fix path for templates and dataa0f8cbdac1antibot - fix LUA typo in recaptcha mode178d7a6849Merge pull request #182 from Nakinox/patch-2ca81535bb3swarm/k8s - less storage, more API062fa3e78aintegration - continue work on storageless config for k8s and swarm95f2d2af9cUpdate docker-compose.ymle55dff8128api - init work on storageless configurationf0f1c79d40v1.3.1 release3d2f5e2389conf - add REVERSE_PROXY_KEEPALIVEb079c99fb9Merge branch 'patch-15' of github.com:thelittlefireman/bunkerized-nginx into keepalive2e403c6ebcconfig - add CUSTOM_HEADERf75a05584econfig - add REVERSE_PROXY_BUFFERING148edf6814tests - add github token to trivy scannera19d8aa041Merge pull request #180 from vepito/vepito-patch-1480cff86bcMerge pull request #179 from thelittlefireman/patch-1635df3423d0missing blank line29f4069de7switch the use cases72e4384596Fix typo related to non-HTTP configurationa4a2647737jobs - fix docker reload and only do cron jobs when necessary892e533694Missmatch in docs with modsec foldera056141609deps - use ModSecurity v3.0.4 instead of v3.0.5 to avoid memory leak0772a9ba8edocs - edit badge version33e0ffd5b1Merge branch 'master' into dev4cb3e089e3linux - git SHA1 commit in install.sh8808f161c5docs - dev to master links and VERSION upgrade1c60ec9804tests - fix volume wait with linux testsb13ff34569add REDIRECT_TO_REQUEST_URI variable and edit environment variables docs58f2926e95docs - various examples fixes9de628f3ebMissing proxy_set_header for keep alive6cc1abc893Allow keep alive connection when ws is offa824e15684linux - rename cronfd52bb7c8dlinux - fix cron jobs0938b20eb8UI - use sudo for Linux integrationb948e08bd5UI - use systemctl on Linuxfde14d1621linux - fix unknown scheme error and do nginx reload as root in UI8a4eb3f2a3remove .site files (gen), uninstall remove folder at the end (linux) and run jobs when reloading local instances (UI)2a0b84074aui - fix bug when Docker is used but Swarm is disabled, add jobs from API /reload and fix docker-compose docaec22d1a81ui - edit docs and fix CSRF028fc61b4fdocs - add dns_resolvers and permissions to Linuxa903960b4cdocs - fix missing subfolder in Linux quickstart guidea28f06f08flinux - run temp nginx to solve let's encrypt challenges6c8bc6b349tests - fix Linux systemd bug when writing to /tmp folder2b3b4a5c3flinux - systemd support57e4247eablinux - systemd unit filef9d4e90894docs - edit k8s php service port and append suffix to hosts4f024ec566docs - add DNS_RESOLVERS for k8s integrationbc46fc3d4cappend suffix to ingress hosts0be1da18a6remove old conf before generation, dynamic DNS for PHP and reverse proxy and swarm fixes in quickstart guide3cedc0ae13quickstart guide fixesf1d5c07cc1autoconf - various kubernetes fixesc9a6b6c27dautoconf - fixed infinite lockb199464a73various bug fixes related to Swarm integration4a9d64d9d9add favicon to web UI and fix some tech docs31536a3fe2linux - reload as root7b47c7304fexamples - minor fixes in architecture images83e7ce9cdeexamples - polishing before next release0ad5159a33docs - add changelog for next version6240d8e28dui - read variables.env when Linux is used2f80f64dd5docs - last polishe98da9b637docs polishing and fix install.sh gpg --verifyd9f7706969docs - web UI75f299978cdocs - special foldersef34b2cec1docs quickstart / multisite9b9110214adocs - quickstart guide / php9e2a8070e4docs - quickstart guide / reverse proxy733136ac1adocs - init quickstartfa172ce5a9docs - linux integrationf6a9184ae9docs - k8s integrationd37dc2b629docs - swarm integrationf7c115edffdocs - add autoconf doc to Docker sectiondfbb091361docs - init integrations/Docker8e4a65fecafix global.env generation and add web UI gif to README0573ba7b5aui - centering things without breaking sticky navbar and menubcd421de09ui - various bug fixes more or less related to UI2ec28c79cbdocs - fix README tocfec60a4b14ui - minor styling fixesdd7d1a2c78ui - fix example, subpath behind reverse proxy and add socket proxy rights for swarm0c1883472ddocs - edit kubernetes overview image and add configuration section on the readme4e6eab794ddocs - fix wrong swarm imageb23135b663docs - add docker and kubernetes imagesace9be3979docs - add autoconf and swarm images8958e5107cdocs - add overview imageb2cfc15c2asecurity - add security policy94bef079a8examples - add architecture images50266c2285examples - add the last missing README.md stubs22e2fe869fexamples improvement - added some README.md stubs55186bbef5examples improvement - hardened, joomla, kubernetes, load-balancer and moodled8286ced7cexamples improvement - certbot cloudflare and wildcard, clamav, crowdsec, ghost and gogs44de2253d2examples improvement - traefik alternative, autoconf reverse proxy and basic website6d73fbdedbexamples - update authelia and autoconf-phpb6809266afautoconf - let's encrypt support for ingress controller4e178b474cautoconf - basic ingress controller support for kubernetes021147f9d9autoconf - fix wait and redis5a26d06c87autoconf - fix infinite lock and honor DOCKER_HOST env varbc01427defignore CVE-2021-36159 and redirect job logs as root when using autoconf652614f41bautoconf - use DNS for Swarm instances discovery24d9cce82fautoconf - various bug fixes in Swarm modef866ef6325autoconf - minor fixes, prepare Swarm testing1a32e7c02cautoconf - various bug fixes with DockerController7180378d0cautoconf - init Config refactoring6e66571fb9various cleaningf44e41cedejobs - lock and reload management26db144df4autoconf refactoring and fix CVE-2021-36159a68ad53c3fautoconf - controller classes01bba1d3f6autoconf - init refactoring before k8s integration0597074438k8s - init work on parsing ingress rules, helpers to setup on k8s, basic examplesbc3c17a2f0examples - init k8s example556836b499autoconf - init annotations parser for k8s22612f1757minor edit on Linux tests and init work on k8s API50c279617bjobs - improved log and reload managementef8969e2cfcertbot - add USE_LETS_ENCRYPT_STAGING=yes/no env var for using staging or production servers of let's encrypt0dc2a5ec25edit visibility of Job members and integration of a generic checker for nginx9a207dfdc5fix missing import in generator, expand networks to ips in jobs and init work on a generic checker with shared dict and redis supporta60fbbb5b3hotfix - fix CVE-2021-33560a1b9010d9epull v1.2.8 fixes when applicable3178545c2fv1.2.8 release36b8760d4dresolve bugs on the stable version8bb6676f58settings - fix PHP_* again4234f82c01settings - edit EMAIL_LETS_ENCRYPT regexb99fb27df5fix missing parameter when calling reload in autoconf and edit REMOTE_PHP_PATH regex876fcd1814conf - add WORKER_PROCESSES26dc796155jobs - fix line edit280d189864jobs - avoid reload when not necessary5f845680ffjobs - edit referrers and user-agents data and init work on autoconf integrationd12369c900jobs - various bugs fixed and old files removed366e39f591jobs - SelfSignedCert, runner and reloader71741b2d34jobs - cache management2fca4cd014jobs - logging and error managementfccf14627fjobs - python stubsb3684efaf6jobs - init work on refactoring82548378aecrowdsec - move as external pluginb926b0db62examples - use example.com instead of website.com6713f56ec1linux - fix centos install2b923c05c1compile and install LUA 5.1.5 to /opt/bunkerized-nginx/deps and introduced REDIRECT_TO feature71cf3cf5c1use local sources when building Docker image, add LOCAL_PHP and LOCAL_PHP_REMOTE to settings.json and fix pip bug related to removed working directory8e3dbf1c70fixed some fedora bugs, support LOCAL_PHP and LOCAL_PHP_PATH and sample variables.env49ada6a8c5linux - init work on fedora support947e86f7c3linux - uninstall scripta12561a85bremove useless nginx-keys folder and add lua_package_cpath to http conf6b19bd0264deps - add cjson LUA files to deps folder6738b28b99deps - move dependencies to dedicated /opt/bunkerized-nginx/deps folder to avoid messing with the system010c0fd6d4rename gen/requirements.py to requirements.txt, add git/bash to Docker deps and fix typos in READMEecf30a71f7deps - init work on single install scriptffc4fc950edeps - manual compile/install of libmaxmind and upgrade lua-resty-coreb9955699b7Merge pull request #152 from thelittlefireman/patch-11860fd1ace5Upgrade despseb5d13fb8dUpgrade lua-nginx module to 0.10.20ca41987cd6Upgrade corerules to 3.3.0 & modsecurity to 3.0.53af1b397faUI - digging bugs from services, still some work to do72a09eac6dUI - add CSRF protection0d3f7d3925UI - admin authentication and bootstrap update6be082e0a9UI - init work on admin account4947796c99UI - fix instances bugsba197dfa43UI - bind gunicorn to 127.0.0.1/0.0.0.0:50004dd1ff8479UI - copy from helpers, systemd service and instances page updatef771ec43f1ui - init Instances class to support Linux and API for Docker/Swarme241b0c939logs - move everything from /var/log to /var/log/nginxd03a1a6e3blinux - add jobs.log2c9c9fb62clinux - run master process as rootdeb28c5991autoconf - fix folders2ea7331dadjobs - disable post-jobs when SWARM_MODE=yes on SIGHUP92ee40819ewhitelist - fix /.well-known/acme-challenge whitelist for let's encrypt2ccfb26e81docker - fix CVE-2021-3356070f9f8417etemplates - add missing new line when necessaryc4aef1d606authelia - choose portal or auth basic modea385183d88authelia - various fixescec47f3a75body injection feature and add authelia to documentationc894c8370eauthelia - add variables to settings.jsonf73b088f79authelia - initial work130c6752ddMerge pull request #148 from aFresquetIntech/devf97ea67855Create .env8504299861Correction4a8da40cf2reverse-proxy-zammad0114c7b09fexamples - edit basic PHPbebe89afb0linux - edit path for default errors, ignore comments in variables.env, install/prepare certbotb2cceb608clinux - fix centos37f5e4ed71linux - fixed debian/ubuntu but still some work needed on centos98568a57c9linux - fix /var/log and typo in daemon directive4991922878linux - fix daemon directive and rights on /etc/nginxbcb8acc364linux - add RX permissions to /opta9279053a4linux - add executable right to gen/main.py60057a17e3linux - fix tests docker cp and pass single -c argument to sud0366fcc0dlinux - started work on bunkerized-nginx commandb448d91ca8actions - fix centos test and docker image name when pushinge309ce6fd5docker - fix permissions on /opt37090dc66eactions - fix manifest error with buildx and load6bb6facd88add load: true when autobuilding images and move from /bin/sh to /bin/basha1fcbd4b83fix actions and configure09a2a4f9e5github actions refactoring1e02368e8alinux/docker - common /opt/bunkerized-nginx folderbbb5134a39fix configure arguments and CRS includeb0f93fb840fix Dockerfile againc892f037dbfix Dockerfile731c0f61dflinux - init work on installer93543d3962Linux - use the same dependencies script for Docker5ec9e6ab49linux - CentOS 7 installcc0d0af8d2linux - ubuntu installer43d2097d14linux - nginx install on Debianf880e5e2aalinux - continued work on install helpers for Debian9636013f5elinux - started work on installer15bdb076c8hotfix - fix docs get_git_branchd62c4f466dv1.2.7 releasead52ef3260autoconf - prevent race condition by checking health state3bd3b6fd7aMerge pull request #145 from thelittlefireman/patch-10e41acc20c2Upgrade ModSecurity-nginx to v1.0.23c721dc2a0add HEALTHCHECK to Dockerfile and append 10.0.0.0/8 to DNSBL whitelist491d879fecjobs - cleaning the mess when using autoconf without swarm mode52534510ecfix bug when AUTO_LETS_ENCRYPT=yes and certbot can't resolve challenges2c7337576djobs - fix syntax error9e4961ccb5docs - rename sitemap to bypass rtd rewrite01857d8ac0gen - display the reason when ignoring a variableab9f9e0a4cjobs - fix jobs when MULTISITE=yes29dc64ca30actions - add Docker cache to speedup auto build on the dev branchb5cd4e0375docker - build and push images from GitHub actions because of future DockerHub restrictions on autobuild16101144c5self-signed cert - fix bugs95510e6e1dsettings - add underscore to CUSTOM_HTTPS_CERT/KEY regexdd5890e760geoip - fix bug when using GeoIPc3a437fa82docs - rename the sitemap to avoid conflicts ?518ddd3236docs - custom robots.txt177a82ee6edocs - automated sitemap.yml39db7b368fv1.2.6 release9442e59141jobs - fix jobs in Swarm modefcc6b3b5e4various bug fixes related to Swarm678ad70b01docs, various fixes and certbot-cloudflare examplee8f5db0b29docs - add plugins system8295f6aebaplugins - clamav example388fc1a0e8plugins - started basic plugin system62217a3210add contributing guidelines and license53e433b1a4readme - replace some badgesf640157b1fMerge pull request #138 from bunkerity/feature-request-templated646f3e5b7Update issue templates4b31d005ebcrowdsec and generator fixesd2135c19c0docs - road to v1.2.68cda1baf77fix web ui multiple variables and add default error pages445032406bdnsbl - disable checks when IP is local74fb015366web UI - init work on using docker-socket-proxyee178de6abweb ui - mostly finished templating integration (needs some testing)7323525b69ui - show only multisite vars for settings82e47f147dui - Dockerfile fixes and missing get_config function2db967ad1dtemplating - road to web ui1d96620ae6templating - init integration into web ui99c259bf18templating - prepare integration into uic7b81cfc10various bug fixes related to HTTPSdfce0c06ddautoconf - fixing various bug when SWARM_MODE=yes0f8e56a668templating - fixing bugs with autoconff950abdc24templating - started integration into autoconf4a73ae8197various bug fixes on templates and nginx update to 1.20.1e2f02ee91etemplating - prepare integration for autoconfa991b262efremove ClamAV because of GPL and started work on read-only filesystema8bc17e836templating - started integration into docker imageec19f93081templating - added missing features in site templates23aa053003templating - auth basic support289ad106cbtemplating - multisite supportbbc5bbc9e9templating - fix some site templates633a07686ftemplating - init work on site templates996c45df42templating - init work on global templates801530baf3templating - road to full jinja2 templatesc65dda3917templating - init work on templating with jinja2ea891969c1templating - updated settings.json with global settings698ae17c49templating - init work on generic settings management6645632846antibot - basic pow with javascript16e5ede130antibot - custom templates8260746fe1logs/lua - add logger toolde560490d3fix LUA array variables and add LOG_LEVEL to the troubleshooting section96db3a450dlog - add LOG_LEVEL variable73543f4b0ehardening - add no-new-privilegesd9bb97be50lua - move global vars from lua to site config (untested)863283d090started work on moving variables from .lua to nginx600484b16ecrowdsec - fix bugs and update example7c6a13c549examples - improve nextcloud example so it works with webdav clientsb3bb4ec40fremove unnecessary dependencies and update doc about certificate bundle69f4657208examples - fix typo BAD_BEHAVIOR_STATUS_CODESd02985d213check permissions for missing volumes and add comment about permissions on examplesb0ca85ff75v1.2.5 - performance improvement2f115c444dMerge pull request #131 from bunkerity/issue-templates7f15741ea2Update issue templates288b8eb851docs improvement + road to v1.2.561c08fb97bdocs - troubleshooting01ef47a669docs - security tuning improvement71515a9101doc - volumes lista33d0658c6docs - road to a beautiful documentation0b3ff6a9f4bad behavior - move from fail2ban to pure luaeb2d0d330dperformance - rsyslog and fail2ban removing5bcbb38638doc - official document startedca660b2501init work on official doc3a34436cd8add AquaeAtrae example for ROOT_SITE_SUBFOLDERb1d03cd11cperformance - move bad user-agents and referrers checks from nginx to LUA with caching42c3fb8740add sandbox allow-downloads to the default value of CONTENT_SECURITY_POLICYf1c043604aadd missing backslash in the quickstart guide and update autoconf examples with the depends_on directivefd61df205fperformance - move external blacklists checks from nginx to LUA009d6fb5aechoose connection and nofile numbers, increase error_log level to get modsecurity rules, add MODSECURITY_SEC_AUDIT_ENGINE varba4185a42ejobs - fix automatic reload70976d0fbcfix user-agent not blocking and add documentation on bundle when USE_CUSTOM_HTTPS=yes062a39c63aintegrate AquaeAtrae work - add ROOT_SITE_SUBFOLDER83841b290ajobs - edit adren work on external blacklists10dc58cb6dMerge pull request #126 from adren/patch-6668754686cMerge pull request #125 from adren/patch-584b1933f63Merge pull request #124 from adren/patch-415f6d0a32aMerge pull request #123 from adren/patch-3e628361a89Merge pull request #122 from adren/patch-1f8d71e067eimproved way to generate user-agent file02ae3b6bd3change IFS before subshell2fb0e7c473deduplicate list of user-agents9adcc2f1a7more optimized way to generate map referrer file7b98db4d14improve the generation of blocking file (abusers)ddb2b85916improve generation of block file (Tor exit nodes)da1a460a64huge improvement to generate blocking file07be626842hotfix - fix API in autoconf swarm mode3bb164395ehotfix - move API_WHITELIST_IP edit to lua.shbc2568a172v1.2.4 - nginx 1.20.0 support5ec74880d8update README for v1.2.4f84fd7c9a2fix permissions issues for autoconf and fix volume for ghost example6521d7a27afix client cache so it works in combination with reverse proxy and examples update813607fbc3improve crowdsec example and disable modsec logging when not necessary843644f806log - replace some WARN tags from LUA logs with NOTICE to avoid confusion19fa0eb25flog - print modsec_audit.log to make debugging easierb4df287228log - send logs to remote syslog server5ce41edc03api - whitelist IP/network for APIa3cfb50b4dexample - fix certbot wildcard25494acaceexample - wildcard certificate with certbota98dae1fb6fix CVE-2021-20205 and examples update1a7abab570nginx 1.20.0 support42b7a57f01fix autoconf bug when removing config with multiple server name and increase default LIMIT_CONN_MAX for average website with HTTP202f9fbe5fcautoconf - fix certbot bug when multiple server_name for one service69fe066777autoconf - fix bug when multiple server_name for one service74417abc9cfixing bugs - run as GID 101 instead of 0, different permissions checks in swarm mode and disable including server confs in swarm modeba7524a419fixed LUA bugb55aafb997finding the LUA bugdeeb7a76a2Merge pull request #117 from thelittlefireman/patch-9ee8aaa4e7efix lua crash 2605d59a45cFix lua mistakeb85c991b6ebug fixes - /usr/local/lib/lua rights and syntax error in site-config0d3658adf0REVERSE_PROXY_HEADERS - use proxy_set_header instead of more_set_headers0b22209c96documentation - userns remap featuree44a1f3e14added the uri to limit_req_zone key to limit bruteforce attack on a specific resource instead of the whole serviceaa614f82f9print error when permissions are wrong on common volumesc03d410b0arefactored whitelisting of user-agentse190167bfcCIDR support with whitelist/blacklist IP31e72dce1cfix /usr/local/lib/lua rights and multiple server_name support with autoconfb8105fc558feature - whitelist URIe73c10fd80crowdsec - fix permissions on /usr/local/lib/lua and on /var/log filesa122a259c0minor fix on AutoConf logs and auto disable etag with reverse proxy7c4894d3b8autoconf - fix remove event, generate config from nginx vars, more logs533c2a1034fix sed script when writing site env5611d544d6remove reference to USE_PHP397182f18dadd link to twitter accountc5c5fb17b5v1.2.3 - swarm support017a7780fbREADME update, default cron update and new parameters to ui34d9db7a8bweb ui - bug fixes361c66ca61fixed bugs with MULTISITE variables and swarm exampleafc6678855road to v1.2.3 - fixing bugsc40fb33175road to swarm - automatic reload after jobs93ad3c0b51road to swarm - let's encrypt fixceed904882road to swarm - still some mess to fixb8027d2bacMerge pull request #102 from thelittlefireman/proxy_custom_headers8d03a14a6aMerge pull request #103 from thelittlefireman/fix_truncated_3d16f4517a4Enhancement add custom proxy headers #9789ca91b3ffFix truncated variables (last commit)6a714e2eceroad to swarm - fix race condition on initial configuration0d3da03534prepare /www directory, fix log socket path and whitelist acme challenges path33163f65b3init work on disabling root processesa2543384cdroad to swarm - add openssl to autoconf, fix api_uri in LUA, fix file rights3591715f21road to swarm - fixing things95f7ca5b2droad to swarm support - needs a lot of testing816fa47cbbintroducing SWARM_MODE env var7756c2df3cMerge pull request #98 from mromanelli9/fix/readme7509ec2f2cbasic API to be used in swarm mode6e93575e16remove ALLOWALL from X_FRAME_OPTIONS optionsba4c977550remove old anchor781e4c8cbbautoconf little work on swarm supporte04c783d1eautoconf - init work on swarm modee12b656bd5Merge branch 'patch-7' of https://github.com/thelittlefireman/bunkerized-nginx into devcae05447d3custom crontab values4b58e22657Merge branch 'patch-5' of https://github.com/thelittlefireman/bunkerized-nginx into dev6b56e21a09Merge branch 'whitelist_ua' of https://github.com/thelittlefireman/bunkerized-nginx into dev544a09e8daUpdate lua-cs-bouncer8386dd4a2acustom config outside server blockf052a25168Merge branch 'pre_server_confs' of https://github.com/thelittlefireman/bunkerized-nginx into dev43750f5536Merge pull request #73 from thelittlefireman/patch-49142afdb54Merge pull request #72 from thelittlefireman/patch-366c4fed791Fix env variable with space are truncated 2f41846e9d6Fix env variable with space are truncated92cc705b92Reduce memory usage : set cron tasks at different hours.47fb3a05b3Upgrade crowdsecurity/lua-cs-bouncer5940f402c7improve default tls securityd9ca275d53Add before `server {}` config.8353bd9c85Allow to add a whitelist by site on user-agentd902e2f297Add last missing reverse proxy header1a8b8043c8Add LIMIT_CONN var to server.conf65120a7e97Add USE_CONN_LIMIT info to Readme.mdb093a47554Add default values for LIMIT_CONN73dbf03c9aadd USE_LIMIT_CONN zone to global config6ee746236aAdd USE_LIMIT_CONN to site-configfa935eb6e3edit nginx.conf to add limit_conncf231e13cbAdd limit-conn.confd5d699252cv1.2.2 - web UI (beta)50f95420b5README update - road to v1.2.2dc382c3e04various fixes - autoconf process order, multisite config and examples0026328f25edit default FAIL2BAN_IGNOREIP subnets9023ab5aedMerge pull request #67 from thelittlefireman/patch-2124474ad66Edit README.md to add FAIL2BAN_IGNOREIPeac9c8f513Prepare FAIL2BAN_IGNOREIP to avoid self blocking1ee490de6dPrepare FAIL2BAN_IGNOREIP to avoid self blocking825e6a747ecrowdsec v1 integrated09a984c86bstarted crowdsec v1 integrationfd7afa17b3fix missing ';' in includeb9b7fdfcc4Merge pull request #63 from thelittlefireman/patch-158e1d66bc7UI - minor alert css fix7026643f8aUI - fix missing MULTISITE env var when managing services06f688fe97fixed stop and reload operationsc65b78b1ccUI - instances/services backend update (needs testing)f9b9b9546fUI - introduced multiple config parameters (like reverse proxy) in frontendb5fe6335c7UI - instances backend started951f3957fdUI - default service values0f520b8914UI - services backend started569ad75c42UI - config.json refactoringbd7b6af668UI - load config template from json459bb8ea1cUI services modals and default CSP update (fix new tab links)208b5acb30UI - minor services list improvement59b2fed416UI - basic services lista4871a915eAdd missing proxy headers026783f018Fix missing reverse proxy headers8115853453Fix missing proxy headers on site-config.shc5f283b00eUI - minor front update03ce7a6483fix modsec double inclusion when MULTISITE=yes3f7e2c54b3JOBS - fixed some job script and right temp nginx reloadbb0f46d8afJOBS - fix job_logc5b32dfc4cfix CVE-2020-1971 again9a4f96ad18fix CVE-2020-1971f258426f55JOBS - fallback to old conf in case reload failed119e963612JOBS - be more verbose about jobs failure/success373988670aMerge pull request #54 from thelittlefireman/patch-42a956f2cd3Fix #5215a37a8682UI - minor UI improvement3a3d527907UI - basic read fixese6b5f460c9UI - basic read from docker API002e3ed2basecurity tests for autoconf and ui7b55acbe8bweb UI example and CVE-2020-8231 fix again559b7835d4ui - automated build4ea01bd93fprint some logs when blocking botsa73891a3b8fix CVE-2020-823126199f52c8remove additional / in modsecurity include5c3f94a84fedit reverse proxy var name in README043fcdc136autoconf - automated buildb86ded3d1cautoconf - multi arch Dockerfile92569679b6dynamic reload of nginx by sending SIGHUP15e74e4860more work on standalone autoconffd0a6412d0init work on standalone autoconf419fdfc86efix auth basic when MULTISITE=yes0bc1f652b4v1.2.1 - autoconf feature (beta)6c7461e298integrate thelittlefireman workd01bc5e014Merge branch 'patch-1' of https://github.com/thelittlefireman/bunkerized-nginx into dev75c69c8105last fixes before next release ?e26b8482aaAdd missing EMAIL_LETS_ENCRYPT parameterf618c73e6croad to v1.2.178c1e5c676examples - same domains for internal tests481e10d3efreverse proxy - websocket exampleaae2a71983autoconf - php examplef3bf04e390dirty fix to disable default server when MULTISITE=yes36cbb927c0autoconf - various fixes95153dbc5dmoved UA, referrer and country check after whitelist and blacklist check26947179a4moved UA and referrer check to LUA88f27bfeb8autoconf - reverse proxy example and pass default vars3cc1615c4dfix user-agent script8bacf722a6Merge branch 'fix/variable-naming' of https://github.com/mromanelli9/bunkerized-nginx into dev2bfc4b41fafirst work on automatic configuration587d4a92ebincorrect variable namingc311d0c825add crawler-detecter bad UA0d03f49ebcwebsocket support with reverse proxy2112c306a8custom log format8f9dcc5ab8last fix ?2fe05d3fd3fixing scripts again and againdb04c0345cfix referrers agained8bd902b1fix referrers script3a7aa5d9c0block bad referrers9ec9de6ca2multiple lets encrypt certificates when MULTISITE=yes791342cbe6fix LUA DNS code when answers is nil2f23671c3bfail2ban fix when MULTISITE=yese350a717fffix default DNS_RESOLVERSe818acb0d1prestashop exampleb92f74ed98dirty fix for CVE-2020-289289688e66508check all vulnerabilities with trivy700dfc0184v1.2.0 release42e4298b5creadme update - v1.2.0 changes813b42cfa9php and nextcloud examples fix58fcf0a725added Permissions-Policy header5879183802custom headers to remove2032596880automatic trivy scaneaf817d57aphp config and examples fixesdd7768c856whitelist/blacklist country at LUA level to avoid SEO issuesfe1d724c9fcountry whitelist/blacklist0635eb368bvarious bug fixesfbf81c94becached blacklists dataed451877aeexamples update and multiple REVERSE_PROXY_* on single site0f18e9c552reverse proxy support via env vars8f7cb5318eproxy caching support60fbbc1013move some http directives to server0f0593456cvarious fixes8cdc155ac0multisite examples and certbot renew fix1abe1da89ebrotli supportf18c054b42gzip support4dea1975e2client cachingc2b05c463cfix BLOCK_COUNTRY bug and add support for ModSecurity custom confs when multisite=yes2da51d92a6multisite - bug fixesbd7997497bautotest through github actionse89e34a84fauto test fixff02878dd8auto test setup44b016be93road to multi server block support36c4f3e065v1.1.2 - CrowdSec integration and custom ports798f6c726dexamples - nextcloud fix and tomcat761c14a0b8custom HTTP and HTTPS ports4a07eca696crowdsec integratione1274a6082passbolt example3ec81cd849Fix broken line in README95752ff0c4v1.1.1 - TLS 1.2 support8623510f8chttps fix95a76b11fapeterkimzz integration and dhparamb0e4740a7d[New Features] - Added "HTTPS_PROTOCOLS" environment value to enable to customize TLS version. default value is "TLSv1.3". (because TLSv1.2 sometimes needed) - READMD.mde843608575README update - v1.1.02f68667893logrotate copytruncate1d63838ee6examples - fix port numbere4bdd4af5dexamples - nextcloud fix and moodle2c33463af7renamed logrotate script9ff210bed8wordpress and nextcloud examples0b73018865install CRS by tag in compile.she1356e3eb0logrotate.conf update and some cleanup34a0da444flogging fix again022a653ebcdisplay fail2ban.log and logging bug fix4c11a9125cautomatic docker tags with VERSION88b52478c3automatic Secure flag on cookiesce82e22dberemove integrated PHP397415211eantibot - check IP with sessions and recaptcha68d7988551tor hidden service example16eab0f631README update6a22f7711cload balancer example222426854eMerge pull request #13 from FacundoAcevedo/patch-1d63c57985eFix typo in the link in the TOCe19a7c693drun master nginx process as non-root user7a8795883bdockerfile fix - compile01095bd72fgpg fix and secure git clone0e6729c62echeck GPG signature of nginx sources040b6a2234Merge branch 'patch-1' of https://github.com/fabianmoronzirfas/bunkerized-nginx into dev5f62120e4dfix(typo): add missing »find«e8503b9cc5ARM build fix676571e4a4use nginx:stable-alpine as base image34254a09e9examples and DNS_RESOLVERS fix81cff3648creadme updatee166b1fea9awesome gif resizedf08bba8cc2awesome gifccf4392280session secret fixc1d44387b5basic antibot feature through recaptcha v3135126e3f4readme fixac251b0f69Merge branch 'master' of https://github.com/ZILosoft/bunkerized-nginx into devac242c9774Update README.md2909b79891basic antibot feature through captcha446ee3761bbasic antibot using javascript6e1c43c4cdbasic antibot feature through cookie652d8ac979fixed typo in manifestde1952b5f9README - toc update and title fix16a458db23README improvementf27d80e0d5various fixes and lua loggingfc3d911ff7improved blacklist/whitelist/dnsbl with luaef7d842ff0arm64v8 auto build and master manifest0e57049832manifest for automated buildsaaef370079improved logging with rsyslog6e3c2ddcc2integrated ajarmoszuk work919b418d58Added the ability to self generate SSL certificatesfb1a0182e2Added the ability to see Real IPs if Nginx is running under another proxy (such as Traefik).2e0a8307d1i386 fix again181003efe1i386 fixfca7bb0758automatic builds764038d40dREADME updatef4c43a2148block proxies and abusers3a9afa47b6Merge pull request #5 from ajarmoszuk/patch-12c12df3b96update default req_limit values2f967a9f47Update entrypoint.sheba5f6280ereq limit44155b5d62dnsbl ipairs fix829c1c6974some fixes and README updatef3721a50dbsitewide auth basicb56e4e765adnsbl feature1654e913a4lua support3e5ca583c9remote PHP-FPM supportbcd17dbea2automatic geoip update14ec9f3e63logrotate and compile fixes5b5e6e33a6awesome logo1aa1dcf50dlogrotate supportf30a06d943syslog integration and fail2ban improvementcd19841ec3readme - details about modsec include order94b29a6ca2fixed some include ordersbf605ce59dcustom root folder and little fixesb14b09ad5ddefault CSP update4f5e5f013ereadme improve76bd069f25php POST max size and custom HTTPS cert1d6ab7275fhttp basic auth fix472ec31cd2readme fixcaa415e126http basic auth8561d47be0create a customized image4bede275fbfix typoefcf937109inspectFile fixccaaa8b57dreadme fixb83111ad17realip, minor fixes and READMEa2be2e8ae1improved README : format, modsec, fail2ban and clamav48a0036d26updated readmebf0bef289dclamav support193070b148fail2ban support716e54e597custom http/server confs and better modsec customization43403f69eedisable default server69ac95b29eblock country and various fixesecf2de8b72multiple let's encrypt domains8427564f4duser-agents escape fixc56bde4f0cfix certbot-renew.sh syntax834afa1327http to https redirectd5f8c7647dcustom modules and write access5bcdb0219ef**k markup ?3233f3b76ffix readme62eda8173bimproved README09e6b50e58custom conf5d16f6a8f2fix README1b5f6deb22cookie flags and maxmind updateea1dbc617cupdated readme0b703ea559content security policy1e642e2f13initial readmee90060ce68initial work70f849fbb5Initial commit REVERT: bea1be3bbf doc: Fix typo. (#97) REVERT: d502e41996 bugfix: nginx crash when accessing uninitialized pointer. REVERT: 91eb0db9ef bugfix: update handling of multiple headers changed in nginx 1.23.0. REVERT: e536bc595d bugfix: fixed build error with nginx >= 1.23.0 REVERT: 00be83f1dd doc: update the description of nginx compatibility. (#131) REVERT: a4a0686605 travis-ci: upgrade dist of travis-ci to ubuntu bionic. (#124) REVERT: f85af9649b travis-ci: bumped the NGINX core to 1.19.9, remove clang compiler mode from travis to save credits. (#121) REVERT: d6d7ebab3c travis-ci: bumped the NGINX core to 1.19.3. (#114) REVERT: af8160e017 doc: we now work with nginx 1.17.x (up to 1.17.8 at least). REVERT: 743a4bb1a2 travis-ci: bumped the NGINX core to 1.17.8. REVERT: 552e216a0d travis-ci: switched to OpenResty's fork of LuaJIT. REVERT: 7255ae95d9 travis-ci: bumped the NGINX core to 1.17.4. REVERT: 380e994d31 doc: updated the nginx compatibility list. REVERT: ab40f34464 travis: bumped the nginx core version to 1.17.1. REVERT: d3a920ad34 travis: clone the lua-resty-core and lua-resty-lrucache repositories. REVERT: 085fbbc28f travis: bumped the nginx core version to 1.15.8. REVERT: f1fadb9e29 tests: t/input-cookie.t: fixed a failing test case with our newest version of ngx_http_lua's LuaJIT alert log. REVERT: a9f7c7e86c tests: added a passing test for overriding Cache-Control header created by proxy module. REVERT: 55fbdaba96 doc: bumped version to 0.33. REVERT: f389f11785 tests: added new valgrind false positives in the latest nginx core. REVERT: 79ac9547b7 tests: valgrind.suppress: removed too aggressive suppressions in nginx mem pools and luajit lj_str_new. REVERT: a799a97ba3 tests: minor tweaks in valgrind.suppress. REVERT: d63cf91edc tests: removed extra file-trailing newlines. REVERT: 4512b82a82 feature: add wildcard match support for more_clear_input_headers. REVERT: 7b0762aba6 doc: adjusted the doc for the use of wildcards in header names. thanks Dejiang Zhu for the report. REVERT: 8096689630 doc: updated copyright notice. REVERT: 732874a0fc travis-ci: several improvements and tweaks. REVERT: 491df7f8d8 doc: fixed more_clear_input_headers usage examples. REVERT: 5aa76052d5 doc: bumped version to 0.32. REVERT: 04916fbc45 tests: skipped the newly added test case that cannot run in check leak test mode. REVERT: 30fb25901c bugfix: more_set_input_headers: skips setting multi-value headers for bad requests to avoid segfaults. REVERT: 84241e444b doc: bumped version to 0.31. REVERT: 2054d92618 doc: typo fixes. REVERT: 72c81c922d skipped check leak mode for two test cases using malformed requests. REVERT: fbab586961 doc: claims that we work with 1.10.x since it is essentially the same as 1.9.x. REVERT: 4fccc2a196 bugfix: fixed a typo in an error message. REVERT: 0a5bad9073 bugfix: when the nginx core does not properly initialize r->headers_in.headers (due to 400 bad requests and etc), more_set_input_headers might lead to crashes. thanks Marcin Teodorczyk for the report. REVERT: 7fc33974dc doc: fixed the release year. REVERT: 4cb061b575 travis-ci: use "prove -r t" to run the test suite and test against nginx 1.10.0 instead of 1.8.1. REVERT: cf016595f6 various coding style fixes. REVERT: 4612cb62dc Merge branch 'master' of github.com:openresty/headers-more-nginx-module REVERT: 63b8039d7d doc: release 0.30 and compatibility with nginx cores as far as 1.9.15. REVERT: b120f866ec Merge pull request #52 from chipitsine/master REVERT: 182d12a19b fixed "exit 0" on failed build REVERT: 981a6914a4 feature: initial travis-ci support. REVERT: f5559ec571 doc: documented the dynamic module support in this module. REVERT: cabd03a867 doc: typo fix. REVERT: 2f93b9a310 feature: now this module can be compiled as a dynamic module with ./configure --add-dynamic-module=PATH in NGINX 1.9.11+. thanks Sjir Bagmeijer for the original patch in #44. REVERT: cc19196c71 minor test tweaks. REVERT: e77178fd2a config: some refactoring. REVERT: 443753c53a doc: ngx_openresty -> OpenResty. REVERT: f14b3667ca doc: stated that we are compatible with nginx cores as far as 1.9.7. REVERT: 88f797a5cb bumped version to 0.29. REVERT: e8822662b0 bugfix: changing the built-in header X-Forwarded-For via more_set_input_headers or more_clear_input_headersmight not take effect in some parts of the nginx core (like $proxy_add_x_forwarded_for). REVERT: bbaa39fd96 added a .gitattributes file to correct GitHub's language tag. REVERT: 51dcf09014 doc: bumped version to 0.28. REVERT: 473fc9d8e8 bugfix: fixed errors and warnings with C compilers without variadic macro support. REVERT: a744defdfa removed the useless code snippet enabled by the unused NGX_HTTP_HEADERS macro. it also triggered a compilation error. thanks Vadim A. Misbakh-Soloviov for the report in #39. REVERT: c8b4b0a958 updated docs to reflect recent changes. REVERT: 5031112c0e tests: fixed the test plan in input.t. REVERT: 42d8019f04 bugfix: setting (builtin) request headers Upgrade, Accept, Accept-Language, Depth, Destination, Overwrite, and Date might not take effect in standard nginx modules like ngx_http_proxy, ngx_http_headers, and ngx_http_dav. REVERT: bc48417d87 bugfix: when the response header Content-Type contains params like "; charset=utf-8", the -t MIME-List options did not work as expected at all. thanks Joseph Bartels for the report in #38. REVERT: 4648e827ec doc: we no longer sync from the nginx wiki site. REVERT: d0e1a74087 util/build.sh: removed $LUAJIT_LIB and /usr/local/lib from the RPATH list. REVERT: f6a745a160 bugfix: clearing input headers If-Unmodified-Since, If-Match, and If-None-Match did not clear the builtin "shortcut" fields in ngx_http_headers_in_t which might confuse other nginx modules like ngx_http_not_modified_filter_module. The first header gets "shortcuts" fields since nginx 0.9.2 while the latter two since nginx 1.3.3. REVERT: 4b20caa633 tests: disabled the test cases exercising multiple http {} blocks since this undocumented feature has been disabled since nginx 1.9.3. REVERT: ccaede8899 doc: bumped version to 0.26. REVERT: fdf4eabef3 minor coding style fixes. REVERT: d20bf26a80 fixed compilation failures with nginx 1.7.11+ configured with --with-threads. REVERT: a7f81f20be updated doc to reflect recent changes. REVERT: 02fd3778ab style: fixed the coding style of labels. REVERT: b4f9e524a1 optimize: removed the unused C function ngx_http_headers_more_rm_header. thanks Markus Linnala for the catch in #28. REVERT: 2a33f3d017 doc: made it clear that more_set_headers always override existing headers with the same name. REVERT: 95d8178b05 suppressed a valgrind false positive in libdl. REVERT: 0c6e05d312 updated docs to reflect recent changes. REVERT: 61af6c9eed doc: documented the limitation that we cannot remove the "Connection" response header with this module. thanks Michael Orlando for bringing this up in #22. REVERT: 6e9dd00bb2 added the missing bit in commit 40414ca1. thanks Edwin Cleton for the report. REVERT: 6d4d619b37 minor coding style fix. REVERT: 40414ca1f6 fixed a warning from the Microsoft C compiler. thanks Edwin Cleton for the report. REVERT: 4b718e786f various coding style fixes. REVERT: 7a6fd11368 doc: bumped version to 0.24 and claims that we work with nginx 1.4.4. REVERT: fe2a70ea51 updated valgrind.suppress for i386. REVERT: 540c6770fa bugfix: more_set_input_headers did not completely override the existing request header with multiple values. thanks Aviram Cohen for the report. REVERT: bb92718431 doc: minor markdown formatting tweaks. REVERT: b66e2ef1be removed the plain text README file. REVERT: ad3d8d622a bumped version to 0.23. REVERT: 35f8faf541 doc: added syntax highlighting to the code samples. REVERT: 9c4b6ee1dd minor coding style fixes. REVERT: 1caf5cc413 bugfix: removing request headers might lead to memory corruptions. REVERT: 566cebf002 minor coding style fixes. REVERT: 6f06b3720d doc: markdown: added a "table of contents" seciton and lots of "Back to TOC" links. REVERT: 5f1425508a docs: eliminated links to the nginx wiki wherever possible. REVERT: 211760978b bugfix: more_set_input_headers might overwrite the value of the $host variable with bad values. REVERT: 5a70b6b468 bugfix: more_set_headers and more_clear_headers might now work when multiple http {} blocks were used in nginx.conf. REVERT: 3bc9f941b4 bugfix: eliminated use of C global variables during configuration phase. REVERT: 035a5f3d31 updated docs to reflect recent changes. REVERT: 6d19a39805 fixed the test plan in sanity.t. REVERT: 31d0e78b7b bumped version to 0.22. REVERT: 3392914d27 added a (passing) test for setting response headers for HTTP 0.9 requests. REVERT: 625c550aa5 updated .gitignore a bit. REVERT: 147c2737b0 bugfix: segfaults would happen in more_set_input_headers and more_clear_input_headers when processing HTTP 0.9 requests. thanks Bin Wang for the report in #14. REVERT: 26f96fb419 bugfix: we did not properly initialize the location response header field in commit b21333e2d. this is a further fix for issue #7. REVERT: 00ee3cfcf8 massive coding style fixes. REVERT: b21333e2dc bugfix: segfault might happen when using more_set_headers or more_clear_headers in the case that the nginx core initiated a 301 redirect. this issue was caused by an optimization in the nginx core where ngx_http_core_find_config_phase, for example, does not fully initialize the "Location" response header after creating the header. thanks Brian Akins for the original report in #7 and Vladimir Protasov for the insight in chaoslawful/lua-nginx-module#260. REVERT: ec05b8981d updated docs to reflect recent changes. REVERT: be5ea9a6d6 bugfix: segmentation fault might happen in nginx 1.4.x when using more_set_input_headers on the Cookie request headers because recent versions of nginx no longer always initialize r->headers_in.cookies. REVERT: 0df17d017b bumped version to 0.20. REVERT: 376b7bc233 massive coding style fixes in ngx_http_headers_more_headers_in.c. REVERT: e9f060d50d added test cases for the recent fixes in the Cookie request header handling. REVERT: 2da1aaa9f5 fixed places where we should return NGX_ERROR instead of NGX_HTTP_INTERNAL_SERVER_ERROR; also fixed a clang warning. REVERT: a45243e2f7 bugfix: modifying the Cookie request headers via more_set_input_headers/more_clear_input_headers did not update the Nginx internal data structure, r->headers_in.cookies, at the same time, which might cause issues when reading variables $cookie_COOKIE, for example. REVERT: e9b817509c bugfix: modifying the Via request header via more_set_input_headers/more_clear_input_headers did not update the special internal field in the Nginx core, "r->headers_in.via", when the ngx_gzip_filter module is enabled. REVERT: c7feaa395e bugfix: modifying the X-Real-IP request header via more_set_input_headers/more_clear_input_headers did not update the special internal field in the Nginx core, "r->headers_in.x_real_ip", when the ngx_realip module is enabled. REVERT: 27c2137c67 bugfix: modifying the Connection request header via more_set_input_headers/more_clear_input_headers did not update the special internal flags in the Nginx core, "r->headers_in.connection_type" and "r->headers_in.keep_alive_n". REVERT: 95ed9ce74e bugfix: modifying the User-Agent request header via more_set_input_headers/more_clear_input_headers did not update those special internal flags in the Nginx core, like "r->headers_in.msie6" and "r->headers_in.opera". REVERT: 22ed8a4143 updated docs to reflect recent changes. REVERT: 9ba50727f2 updated tests to reflect recent changes in ngx_echo regarding the $echo_client_request_headers variable (commit agentzh/echo-nginx-module@2adcf59ec5. REVERT: 27bcbd290f updated docs to reflect recent changes. REVERT: 5f9684bbdc updated .gitignore a bit. REVERT: d658a2f908 bugfix: more_clear_input_headers would result in memory invalid reads when removing the 21st request headers. thanks Umesh Sirsiwal for reporting this issue as chaoslawful/lua-nginx-module#176. REVERT: 0f6132327b removed the sendmsg/ngx_channel valgrind suppression rules. REVERT: 07702cf8ba updated valgrind.suppress for valgrind 3.8.0. REVERT: bdb1068b6c updated docs to fix my English name. also fixed an issue in the sample code in docs that Transfer-Encoding cannot be cleared. thanks koukou73gr. REVERT: 658698495b updated docs to reflect recent changes. REVERT: 3147c8b4fc updated .gitignore. REVERT: 278ba7d207 bugfix: fixed a set-but-not-read warning from the clang static analyzer. REVERT: 05a862b334 fixed compatibility with nginx 0.7.65. thanks Banping for reporting this. REVERT: b7c8cfcd36 updated docs to reflect recent changes. REVERT: 2f5f6601a3 updated .gitignore. REVERT: 4ea0a75ad2 bugfix: more_clear_input_headers did not remove all the instances for the builtin headers or custom headers. bugfix: more_clear_input_headers might accidentally remove request headers that are not specified at all and leave the specified headers with just empty header values when removing multiple built-in headers. thanks Matthieu Tourne for reporting the issues. REVERT: de80b79722 added a (passing) test for rewrite + more_set_input_headers. REVERT: 81c8750f15 updated valgrind.suppress for linux i386. REVERT: cf7e2d5877 updated valgrind.suppress for the "hup reload" + valgrind/memcheck testing mode. REVERT: 33a82ed11c updated valgrind.suppress and .gitignore. REVERT: aa2ae0f8b1 updated valgrind.suppress. REVERT: 4b4bfca98a updated valgrind.suppress. REVERT: 34e2389212 updated valgrind.suppress. REVERT: 3580526017 allow use of the DDEBUG macro from the outside (via the "-D DDEBUG=1" cc opton). REVERT: de77fd22c3 updated docs to reflect recent changes. REVERT: 719ffa26a8 reindexed the test cases. REVERT: 5f082e5647 Merge branch 'master' of github.com:agentzh/headers-more-nginx-module REVERT: 006ecab226 bugfix: removing builtin headers in huge request headers with 20+ entries could result in data loss. thanks Chris Dumoulin for the patch in github issue #6. REVERT: 4f911f68d9 updated valgrind.suppress for gcc 4.6. REVERT: 87595f7445 optimized the previous commit for padding header value strings with '\0'. REVERT: 7a719b8aef bugfix: the more_set_input_headers directive might cause invalid memory reads because nginx request header values must be null terminated. thanks Maxim Dounin. REVERT: ffdda45351 bugfix: more_set_input_headers did not handle the Accept-Encoding request headers properly. thanks 天街夜色. REVERT: 6cd7ae83cb bugfix: Cache-Control header modification might introduce empty value headers when using with the standard ngx_headers module. REVERT: 55ad2f48ec fixed the download page links in docs. REVERT: be6a17e768 updated docs to state that we work with nginx 1.0.8 and 1.1.5. REVERT: f7cb29e248 fixed setting Cache-Control response headers. we should properly prepare the r->cache_control array as well. REVERT: 5de933dc40 we should not set header->hash with ngx_hash_key_lc, not simply to 1. REVERT: b3c6230a3c use Test::Nginx::Socket instead of Test::Nginx::LWP. REVERT: ff219e96e2 fixed a bug when setting a multi-value response header to a single value: the single value will be repeated on each old value. REVERT: 3790855327 confirmed that we work with nginx 1.0.6. REVERT: 9057b09916 fixed on-demand hander/filter registration trick for HUP. REVERT: 936a555d6a fixed the "<" and ">" symbols in the markdown doc. REVERT: 5d484ecc78 updated links in docs. REVERT: 8b78aec445 renamed the wiki file. REVERT: 264e523fa6 added internal cross links to README.markdown. REVERT: e6c6358562 added more hyper-links to README.markdown. REVERT: 61db52f559 removed unused utilities. REVERT: 12ccabb154 fixed source lines exceeding 80 cols; checked README.markdown. REVERT: 78286ca0d8 confirmed that we work with nginx 1.0.5. REVERT: 137855d9d7 release v0.15. REVERT: 5fac223792 now more_set_headers supports overriding charset in Content-Type. thanks ML. REVERT: 2c629dee0e fixed an issue in more_clear_headers: we should remove all the instances of the headers specified, not only the first occurrence. thanks 李杨. REVERT: b1c4273ae5 back-ported a bugfix from ngx_lua: in output header set, we should always set the header->hash to 1. thanks moodydeath for reporting it. REVERT: 6a12aa5243 confirmed that we work with nginx 1.0.2. REVERT: ef15b439f0 minor updates. REVERT: b27e5d92ab minor coding style fixes. REVERT: 28c62d1d27 added more tests for Accept-Ranges and also fixed a bug when clearing this header. thanks Bo Blangstrup. REVERT: 7bba2a12bc fixed the links to the test suite. REVERT: 2cbbc15d68 updated the documentation to reflect recent changes. REVERT: 3641ccfd58 updated .gitignore. REVERT: fb2d8935d6 now we postpone the rewrite phase handler only once rather than on every main request previously. this will save some CPU cycles on every request. REVERT: d732166ebd removed the bundled Test::Nginx module from our repos; also raised test/t to the toplevel directory. REVERT: 19e17f08b6 fixed two spots where we did not check against null pointers when allocating memory. REVERT: 592845e904 now we use the 2-clause bsd license. REVERT: 8bd248f0d7 updated README from the wiki page. REVERT: df422fe8ab minor tweaks of coding style and .gitignore. REVERT: c808e71eb6 renamed the source file names a bit. REVERT: c5b6141b4b minor coding style tweaks. REVERT: b4abf2bbf6 Merge branch 'master' of github.com:agentzh/headers-more-nginx-module REVERT: 80bcb021b6 Update Test::Nginx. REVERT: 442f866381 updated Test::Nginx. REVERT: 8447e58c5d updated Test::Nginx. REVERT: 780408eff1 Use build farm's default server port in tests. REVERT: 27735dd306 Update Test::Nginx. REVERT: 9508330b04 releng work for 0.13. REVERT: 7c6b53e245 fixed a bug in rewrite phase postponing algorithm which may cause eval {...} running after "if". thanks Liseen Wan (xunxin). REVERT: 7d2db6fa01 enabled the no-pool-nginx patch in our build.sh script for nginx 0.8.41. REVERT: b140336073 added a test case for adding a header with an empty variable as its value (from Piotr Sikora). REVERT: 435fee6d33 updated readme to reflect recent changes. REVERT: 079fa9507d fixed a vim typo... REVERT: e64e736af8 we should explicitly clear r->headers_out.content_type_lowcase or it will defeat the gzip filter module. REVERT: 55cbcab47d added tests for issue 3 ("breaks mime types") on GitHub but cannot reproduce the issue with nginx 0.7.66 nor nginx 0.8.40. REVERT: b8c8721523 updated docs for v0.11. REVERT: 87e6e73182 fixed the variables-in-Range-header issue reported by Alexander Vetrin. REVERT: 2afd97b483 use the name "ngx_headers_more" to help SEO. REVERT: ae532d8d9f updated docs for v0.10. REVERT: aaf5fce53b removed input headers physically from the r->headers_in.headers list because ngx_proxy does not honor h->hash. REVERT: 793158dcf4 removed some debugging code. REVERT: c68a095c47 now we can completely erase any output headers (both custom and builtin ones). REVERT: 75b1bfa5d2 updated README to reflect recent changes. REVERT: 00c986fdee minor style tweaks in the .t files. REVERT: c47b63790b fixed a memory initialization issue for more_set_input_headers -r, we should always initialize hv.replace even when replace == 0. thanks valgrind++ :D REVERT: 1b93def22d implemented wildcard header clear REVERT: 3a67ad8305 work around the links in README. REVERT: 126fce84cf updated Test::Nginx. REVERT: 5cd9a384f8 documented the -r option. REVERT: 0b16d5c3fe Merge branch 'dobe-r' REVERT: 0febdfca7f added -r flag to more_set_input_headers REVERT: 7da6665dab updated .gitignore. REVERT: d0f2bb40e3 sync'd the test scaffold with Test::Nginx 0.08 on CPAN. REVERT: fb5ebd5683 use ngx_null_string whenever possible. REVERT: 348da493f6 sync'd Test::Nginx to 0.07. REVERT: 4629b7f8e1 some coding style tweaks. REVERT: a127664fcc added t/bug.t REVERT: db9913e9c4 updated docs to reflect recent changes. REVERT: fc18a5cec1 fixed the more_clear_headers directive for builtin headers like "Server" and "Last-Modified" by always inserting an empty header when absent. Thanks Sebastiaan Deckers for reporting it. REVERT: 753e74c668 sync'd Test::Nginx 0.05. REVERT: 985eeb0b73 updated the test scaffold to Test::Nginx 0.04. REVERT: dd3ec52a2b updated test scaffold. REVERT: e427600d2b git ignore reindex. REVERT: 1792f2d93a releng work for v0.06. REVERT: f901cecf9c confirmed that we also work in subrequests in t/subrequest.t. REVERT: 1cc21a7152 now the input header handler runs at the *end* of the rewrite phase. REVERT: b154fdb6b7 now we free empty headers and types array structs eagerly. REVERT: 1a2d9c6f9a updated the test scaffold. REVERT: 05e0fd6c06 sync'd the docs with the wiki page and confirmed that it works with the new nginx 0.8.28 release. REVERT: 219e6dd055 added a test for rewriting the input Content-Length header using the rewrite module's set directive. REVERT: d5af630591 sync'd with the wiki page. REVERT: 6289231571 added the wiki page as the main doc. REVERT: bce15002dd added a (passing) test for mixed input/output setters. REVERT: 8288003cc9 more docs. REVERT: 3391d9d718 fixed variables in more_set_input_headers by registering the handler in the "access phase". REVERT: e2a7a9630d added new directives more_set_input_headers and more_clear_input_headers. REVERT: 83bf8ed38d now we require at least 0.7.44 due to the use of ngx_http_complex_value_t. REVERT: ad8b0e5eac releng for v0.03. REVERT: b93bd9b1fb fixed the uninitialized s/t bug in parse_statuses and parse_types. also added a (failing) test for the input header directives. REVERT: 219d75425d first big refactoring in order to introduce input header support. REVERT: 91cf5b797f refactored the structs into the header. REVERT: 993e75b205 more README tweaks. REVERT: 6023eac18f tested against the latest 0.8.27 and 0.7.64. REVERT: 1da2c87212 added more docs to README. REVERT: 8483f9a629 removed explicit clear header handlers. REVERT: ade7573bac now we support variables in new headers' values. REVERT: 742097fdc9 fixed a typo in README. REVERT: c131b08ed8 0.7.21 is the minimum nginx version requirement. REVERT: 5e86ea3794 more docs and more love. REVERT: 934fe6677a updated README. REVERT: c6af9971ed this module is now usable. REVERT: 0593d3b427 added tests for the Charset header. REVERT: 6fdb040be9 more tests and more fixes. REVERT: 51c4328839 fixed Content-Type. REVERT: ba695a3c0c fixed various bugs and all tests are passing now. REVERT: b3b5245537 fixed a bug where I carelessly used r->headers_in for r->headers_out. the test is passing now. REVERT: 2298986216 added a simple test which is failing atm :P REVERT: 5af162eb95 things are complete now but we haven't tested anything yet :P REVERT: bb0a53ca09 it finally compiles :) REVERT: af379a7356 implemented parsers for the -t and -s options in the config directives. REVERT: 1485546379 added usage to README. REVERT: 8b0498a951 added README. REVERT: 8876cec82b initial checkin git-subtree-dir: src/deps/src/headers-more-nginx-module git-subtree-split:576cb81979
This commit is contained in:
Théophile Diot
parent
1d1739b4ea
commit
d75296b5a5
5977 changed files with 1598263 additions and 55 deletions
6
.dockerignore
Normal file
6
.dockerignore
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
.git
|
||||
.idea/
|
||||
.vscode/
|
||||
__pycache__
|
||||
env
|
||||
node_modules
|
||||
18
.gitattributes
vendored
18
.gitattributes
vendored
|
|
@ -1 +1,17 @@
|
|||
*.t linguist-language=Text
|
||||
* text=auto eol=lf
|
||||
|
||||
# Folders
|
||||
src/deps/src/** -text -eol linguist-vendored=true
|
||||
src/common/core/modsecurity/files/** -text -eol linguist-vendored=true
|
||||
src/ui/static/js/editor/** -text -eol linguist-vendored=true
|
||||
src/ui/static/js/utils/purify/** -text -eol linguist-vendored=true
|
||||
src/ui/static/webfonts/** -text -eol linguist-vendored=true
|
||||
|
||||
# Files
|
||||
src/deps/misc/lua-pack.Makefile -linguist-vendored=true
|
||||
src/deps/misc/ngx_http_modsecurity_access.c -linguist-vendored=true
|
||||
src/ui/static/css/datepicker-foundation.css -linguist-vendored=true
|
||||
src/ui/static/css/flatpickr.css -linguist-vendored=true
|
||||
src/ui/static/css/flatpickr.dark.css -linguist-vendored=true
|
||||
src/ui/static/js/tsparticles.bundle.min.js -linguist-vendored=true
|
||||
src/ui/static/js/utils/flatpickr.js -linguist-vendored=true
|
||||
|
|
|
|||
91
.github/ISSUE_TEMPLATE/bug_report.yml
vendored
Normal file
91
.github/ISSUE_TEMPLATE/bug_report.yml
vendored
Normal file
|
|
@ -0,0 +1,91 @@
|
|||
name: 🐛 Bug Report
|
||||
description: Create a report to help us reproduce and fix the bug
|
||||
title: "[BUG] "
|
||||
labels: ["bug"]
|
||||
body:
|
||||
- type: markdown
|
||||
attributes:
|
||||
value: >
|
||||
#### Before submitting a bug, please make sure the issue hasn't been already addressed by searching through [the existing and past issues](https://github.com/bunkerity/bunkerweb/issues?q=is%3Aissue+sort%3Acreated-desc+).
|
||||
- type: textarea
|
||||
id: what-happened
|
||||
attributes:
|
||||
label: What happened?
|
||||
description: Concise description of what you're trying to do, the expected behavior and the current bug.
|
||||
placeholder: Describe the bug, the expected behavior and the current behavior
|
||||
validations:
|
||||
required: true
|
||||
- type: textarea
|
||||
id: how-to-reproduce
|
||||
attributes:
|
||||
label: How to reproduce?
|
||||
description: Concise description of how to reproduce the issue.
|
||||
placeholder: Describe how to reproduce the issue
|
||||
validations:
|
||||
required: true
|
||||
- type: textarea
|
||||
id: configuration-file
|
||||
attributes:
|
||||
label: Configuration file(s) (yaml or .env)
|
||||
description: |
|
||||
Please copy and paste your configuration file or the relevant part of it.
|
||||
⚠️ DON'T FORGET TO REMOVE PRIVATE DATA LIKE IP ADDRESSES ! ⚠️
|
||||
placeholder: Configuration file
|
||||
render: YAML
|
||||
- type: textarea
|
||||
id: logs
|
||||
attributes:
|
||||
label: Relevant log output
|
||||
description: |
|
||||
Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
|
||||
⚠️ DON'T FORGET TO REMOVE PRIVATE DATA LIKE IP ADDRESSES ! ⚠️
|
||||
placeholder: Log output
|
||||
render: shell
|
||||
- type: input
|
||||
id: version
|
||||
attributes:
|
||||
label: BunkerWeb version
|
||||
description: What version of BunkerWeb are you running?
|
||||
placeholder: Version
|
||||
value: 1.5.3
|
||||
validations:
|
||||
required: true
|
||||
- type: dropdown
|
||||
id: integration
|
||||
attributes:
|
||||
label: What integration are you using?
|
||||
options:
|
||||
- Docker
|
||||
- Autoconf
|
||||
- Swarm
|
||||
- Kubernetes
|
||||
- Linux
|
||||
- Ansible
|
||||
- Vagrant
|
||||
default: 0
|
||||
validations:
|
||||
required: true
|
||||
- type: input
|
||||
id: linux-distribution
|
||||
attributes:
|
||||
label: Linux distribution (if applicable)
|
||||
description: What Linux distribution are you using? (e.g. Ubuntu Server 18.04)
|
||||
placeholder: Linux distribution
|
||||
- type: checkboxes
|
||||
id: removed-private-data
|
||||
attributes:
|
||||
label: Removed private data
|
||||
description: |
|
||||
We would like to emphasize that we are not responsible for any private data that may be inadvertently included in the logs or configuration files.
|
||||
⚠️ I have removed all private data from the configuration file and the logs ⚠️
|
||||
options:
|
||||
- label: I have removed all private data from the configuration file and the logs
|
||||
required: true
|
||||
- type: checkboxes
|
||||
id: terms
|
||||
attributes:
|
||||
label: Code of Conduct
|
||||
description: By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/bunkerity/bunkerweb/blob/master/CODE_OF_CONDUCT.md)
|
||||
options:
|
||||
- label: I agree to follow this project's Code of Conduct
|
||||
required: true
|
||||
29
.github/ISSUE_TEMPLATE/documentation.yml
vendored
Normal file
29
.github/ISSUE_TEMPLATE/documentation.yml
vendored
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
name: 📚 Documentation enhancement
|
||||
description: Suggest an idea that will improve BunkerWeb documentation or declare a bug in the documentation
|
||||
title: "[DOC] "
|
||||
labels: ["documentation"]
|
||||
body:
|
||||
- type: markdown
|
||||
attributes:
|
||||
value: >
|
||||
#### Before submitting a documentation enhancement request, please make sure the feature hasn't been already addressed by searching through [the existing and past documentation enhancement requests](https://github.com/bunkerity/bunkerweb/issues?q=is%3Aissue+sort%3Acreated-desc+%5BDOC%5D+in%3Atitle).
|
||||
- type: textarea
|
||||
id: description
|
||||
attributes:
|
||||
label: Description
|
||||
description: Concise description of the error or what is missing.
|
||||
validations:
|
||||
required: true
|
||||
- type: textarea
|
||||
id: proposed-solution
|
||||
attributes:
|
||||
label: Proposed solution (optional)
|
||||
description: How it should be fixed or what should be added ?
|
||||
- type: checkboxes
|
||||
id: terms
|
||||
attributes:
|
||||
label: Code of Conduct
|
||||
description: By submitting this documentation enhancement request, you agree to follow our [Code of Conduct](https://github.com/bunkerity/bunkerweb/blob/master/CODE_OF_CONDUCT.md)
|
||||
options:
|
||||
- label: I agree to follow this project's Code of Conduct
|
||||
required: true
|
||||
29
.github/ISSUE_TEMPLATE/feature_request.yml
vendored
Normal file
29
.github/ISSUE_TEMPLATE/feature_request.yml
vendored
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
name: 🚀 Feature Request
|
||||
description: Suggest an idea that will improve BunkerWeb
|
||||
title: "[FEATURE] "
|
||||
labels: ["enhancement"]
|
||||
body:
|
||||
- type: markdown
|
||||
attributes:
|
||||
value: >
|
||||
#### Before submitting a feature request, please make sure the feature hasn't been already addressed by searching through [the existing and past feature requests](https://github.com/bunkerity/bunkerweb/issues?q=is%3Aissue+sort%3Acreated-desc+%5BFEATURE%5D+in%3Atitle).
|
||||
- type: textarea
|
||||
id: whats-needed-and-why
|
||||
attributes:
|
||||
label: What's needed and why?
|
||||
description: Describe the feature you would like to see in the project and why it should be implemented.
|
||||
validations:
|
||||
required: true
|
||||
- type: textarea
|
||||
id: implementations-ideas
|
||||
attributes:
|
||||
label: Implementations ideas (optional)
|
||||
description: How it should be used and integrated into the project ? List some posts, research papers or codes that we can use as implementation.
|
||||
- type: checkboxes
|
||||
id: terms
|
||||
attributes:
|
||||
label: Code of Conduct
|
||||
description: By submitting this feature request, you agree to follow our [Code of Conduct](https://github.com/bunkerity/bunkerweb/blob/master/CODE_OF_CONDUCT.md)
|
||||
options:
|
||||
- label: I agree to follow this project's Code of Conduct
|
||||
required: true
|
||||
13
.github/codeql.yml
vendored
Normal file
13
.github/codeql.yml
vendored
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
name: "CodeQL config"
|
||||
|
||||
paths:
|
||||
- src/autoconf
|
||||
- src/scheduler
|
||||
- src/ui
|
||||
- src/common
|
||||
paths-ignore:
|
||||
- src/ui/static/js/tsparticles.bundle.min.js
|
||||
- src/ui/static/js/editor
|
||||
- src/ui/static/js/utils/flatpickr.js
|
||||
- src/ui/static/js/utils/purify
|
||||
- src/common/core/modsecurity/files
|
||||
172
.github/dependabot.yml
vendored
Normal file
172
.github/dependabot.yml
vendored
Normal file
|
|
@ -0,0 +1,172 @@
|
|||
version: 2
|
||||
|
||||
updates:
|
||||
# GHA
|
||||
- package-ecosystem: "github-actions"
|
||||
directory: "/"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
time: "09:00"
|
||||
timezone: "Europe/Paris"
|
||||
assignees:
|
||||
- "TheophileDiot"
|
||||
reviewers:
|
||||
- "TheophileDiot"
|
||||
commit-message:
|
||||
prefix: "deps/gha"
|
||||
target-branch: "dev"
|
||||
|
||||
# BW
|
||||
- package-ecosystem: "docker"
|
||||
directory: "/src/bw"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
time: "09:00"
|
||||
timezone: "Europe/Paris"
|
||||
assignees:
|
||||
- "TheophileDiot"
|
||||
reviewers:
|
||||
- "TheophileDiot"
|
||||
commit-message:
|
||||
prefix: "deps/bw"
|
||||
target-branch: "dev"
|
||||
|
||||
# Scheduler
|
||||
- package-ecosystem: "docker"
|
||||
directory: "/src/scheduler"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
time: "09:00"
|
||||
timezone: "Europe/Paris"
|
||||
assignees:
|
||||
- "TheophileDiot"
|
||||
reviewers:
|
||||
- "TheophileDiot"
|
||||
commit-message:
|
||||
prefix: "deps/scheduler"
|
||||
target-branch: "dev"
|
||||
- package-ecosystem: "pip"
|
||||
directory: "/src/scheduler"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
time: "09:00"
|
||||
timezone: "Europe/Paris"
|
||||
assignees:
|
||||
- "TheophileDiot"
|
||||
reviewers:
|
||||
- "TheophileDiot"
|
||||
commit-message:
|
||||
prefix: "deps/scheduler"
|
||||
target-branch: "dev"
|
||||
|
||||
# Autoconf
|
||||
- package-ecosystem: "docker"
|
||||
directory: "/src/autoconf"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
time: "09:00"
|
||||
timezone: "Europe/Paris"
|
||||
assignees:
|
||||
- "TheophileDiot"
|
||||
reviewers:
|
||||
- "TheophileDiot"
|
||||
commit-message:
|
||||
prefix: "deps/autoconf"
|
||||
target-branch: "dev"
|
||||
- package-ecosystem: "pip"
|
||||
directory: "/src/autoconf"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
time: "09:00"
|
||||
timezone: "Europe/Paris"
|
||||
assignees:
|
||||
- "TheophileDiot"
|
||||
reviewers:
|
||||
- "TheophileDiot"
|
||||
commit-message:
|
||||
prefix: "deps/autoconf"
|
||||
target-branch: "dev"
|
||||
|
||||
# UI
|
||||
- package-ecosystem: "docker"
|
||||
directory: "/src/ui"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
time: "09:00"
|
||||
timezone: "Europe/Paris"
|
||||
assignees:
|
||||
- "TheophileDiot"
|
||||
reviewers:
|
||||
- "TheophileDiot"
|
||||
commit-message:
|
||||
prefix: "deps/ui"
|
||||
target-branch: "dev"
|
||||
- package-ecosystem: "pip"
|
||||
directory: "/src/ui"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
time: "09:00"
|
||||
timezone: "Europe/Paris"
|
||||
assignees:
|
||||
- "TheophileDiot"
|
||||
reviewers:
|
||||
- "TheophileDiot"
|
||||
commit-message:
|
||||
prefix: "deps/ui"
|
||||
target-branch: "dev"
|
||||
|
||||
# Misc
|
||||
- package-ecosystem: "pip"
|
||||
directory: "/src/deps"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
time: "09:00"
|
||||
timezone: "Europe/Paris"
|
||||
assignees:
|
||||
- "TheophileDiot"
|
||||
reviewers:
|
||||
- "TheophileDiot"
|
||||
commit-message:
|
||||
prefix: "deps/deps"
|
||||
target-branch: "dev"
|
||||
- package-ecosystem: "pip"
|
||||
directory: "/src/common/gen"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
time: "09:00"
|
||||
timezone: "Europe/Paris"
|
||||
assignees:
|
||||
- "TheophileDiot"
|
||||
reviewers:
|
||||
- "TheophileDiot"
|
||||
commit-message:
|
||||
prefix: "deps/common/gen"
|
||||
target-branch: "dev"
|
||||
- package-ecosystem: "pip"
|
||||
directory: "/src/common/db"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
time: "09:00"
|
||||
timezone: "Europe/Paris"
|
||||
assignees:
|
||||
- "TheophileDiot"
|
||||
reviewers:
|
||||
- "TheophileDiot"
|
||||
commit-message:
|
||||
prefix: "deps/common/db"
|
||||
target-branch: "dev"
|
||||
|
||||
# Terraform
|
||||
- package-ecosystem: "terraform"
|
||||
directory: "/tests/terraform"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
time: "09:00"
|
||||
timezone: "Europe/Paris"
|
||||
assignees:
|
||||
- "fl0ppy-d1sk"
|
||||
reviewers:
|
||||
- "fl0ppy-d1sk"
|
||||
commit-message:
|
||||
prefix: "deps/terraform"
|
||||
target-branch: "dev"
|
||||
283
.github/workflows/beta.yml
vendored
Normal file
283
.github/workflows/beta.yml
vendored
Normal file
|
|
@ -0,0 +1,283 @@
|
|||
name: Automatic push (BETA)
|
||||
|
||||
permissions: read-all
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [beta]
|
||||
|
||||
jobs:
|
||||
# Build amd64 + 386 containers images
|
||||
build-containers:
|
||||
strategy:
|
||||
matrix:
|
||||
image: [bunkerweb, scheduler, autoconf, ui]
|
||||
arch: [linux/amd64, linux/386]
|
||||
include:
|
||||
- release: beta
|
||||
cache: false
|
||||
push: false
|
||||
- image: bunkerweb
|
||||
dockerfile: src/bw/Dockerfile
|
||||
- image: scheduler
|
||||
dockerfile: src/scheduler/Dockerfile
|
||||
- image: autoconf
|
||||
dockerfile: src/autoconf/Dockerfile
|
||||
- image: ui
|
||||
dockerfile: src/ui/Dockerfile
|
||||
- arch: linux/amd64
|
||||
cache_suffix: amd64
|
||||
- arch: linux/386
|
||||
cache_suffix: "386"
|
||||
uses: ./.github/workflows/container-build.yml
|
||||
with:
|
||||
RELEASE: ${{ matrix.release }}
|
||||
ARCH: ${{ matrix.arch }}
|
||||
IMAGE: ${{ matrix.image }}
|
||||
DOCKERFILE: ${{ matrix.dockerfile }}
|
||||
CACHE: ${{ matrix.cache }}
|
||||
PUSH: ${{ matrix.push }}
|
||||
CACHE_SUFFIX: ${{ matrix.cache_suffix }}
|
||||
secrets:
|
||||
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
||||
|
||||
# Create ARM environment
|
||||
create-arm:
|
||||
uses: ./.github/workflows/create-arm.yml
|
||||
secrets:
|
||||
SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }}
|
||||
SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }}
|
||||
SCW_DEFAULT_PROJECT_ID: ${{ secrets.SCW_DEFAULT_PROJECT_ID }}
|
||||
SCW_DEFAULT_ORGANIZATION_ID: ${{ secrets.SCW_DEFAULT_ORGANIZATION_ID }}
|
||||
ARM_SSH_KEY: ${{ secrets.ARM_SSH_KEY }}
|
||||
ARM_SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }}
|
||||
|
||||
# Build arm64 + arm/v7 images
|
||||
build-containers-arm:
|
||||
needs: [create-arm]
|
||||
strategy:
|
||||
matrix:
|
||||
image: [bunkerweb, scheduler, autoconf, ui]
|
||||
arch: ["linux/arm64,linux/arm/v7"]
|
||||
include:
|
||||
- release: beta
|
||||
cache: false
|
||||
push: false
|
||||
cache_suffix: arm
|
||||
- image: bunkerweb
|
||||
dockerfile: src/bw/Dockerfile
|
||||
- image: scheduler
|
||||
dockerfile: src/scheduler/Dockerfile
|
||||
- image: autoconf
|
||||
dockerfile: src/autoconf/Dockerfile
|
||||
- image: ui
|
||||
dockerfile: src/ui/Dockerfile
|
||||
uses: ./.github/workflows/container-build.yml
|
||||
with:
|
||||
RELEASE: ${{ matrix.release }}
|
||||
ARCH: ${{ matrix.arch }}
|
||||
IMAGE: ${{ matrix.image }}
|
||||
DOCKERFILE: ${{ matrix.dockerfile }}
|
||||
CACHE: ${{ matrix.cache }}
|
||||
PUSH: ${{ matrix.push }}
|
||||
CACHE_SUFFIX: ${{ matrix.cache_suffix }}
|
||||
secrets:
|
||||
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
||||
ARM_SSH_KEY: ${{ secrets.ARM_SSH_KEY }}
|
||||
ARM_SSH_IP: ${{ needs.create-arm.outputs.ip }}
|
||||
ARM_SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }}
|
||||
|
||||
# Build Linux packages
|
||||
build-packages:
|
||||
needs: [create-arm]
|
||||
strategy:
|
||||
matrix:
|
||||
linux: [ubuntu, debian, fedora, rhel]
|
||||
platforms: [linux/amd64, linux/arm64]
|
||||
include:
|
||||
- release: beta
|
||||
- linux: ubuntu
|
||||
package: deb
|
||||
- linux: debian
|
||||
package: deb
|
||||
- linux: fedora
|
||||
package: rpm
|
||||
- linux: rhel
|
||||
package: rpm
|
||||
uses: ./.github/workflows/linux-build.yml
|
||||
with:
|
||||
RELEASE: ${{ matrix.release }}
|
||||
LINUX: ${{ matrix.linux }}
|
||||
PACKAGE: ${{ matrix.package }}
|
||||
TEST: false
|
||||
PLATFORMS: ${{ matrix.platforms }}
|
||||
secrets:
|
||||
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
||||
PRIVATE_REGISTRY: ${{ secrets.PRIVATE_REGISTRY }}
|
||||
PRIVATE_REGISTRY_TOKEN: ${{ secrets.PRIVATE_REGISTRY_TOKEN }}
|
||||
ARM_SSH_KEY: ${{ secrets.ARM_SSH_KEY }}
|
||||
ARM_SSH_IP: ${{ needs.create-arm.outputs.ip }}
|
||||
ARM_SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }}
|
||||
|
||||
# Wait for all builds and extract VERSION
|
||||
wait-builds:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [build-containers, build-containers-arm, build-packages]
|
||||
outputs:
|
||||
version: ${{ steps.getversion.outputs.version }}
|
||||
versionrpm: ${{ steps.getversionrpm.outputs.versionrpm }}
|
||||
steps:
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Get VERSION
|
||||
id: getversion
|
||||
run: echo "version=$(cat src/VERSION | tr -d '\n')" >> "$GITHUB_OUTPUT"
|
||||
- name: Get VERSION (for RPM based)
|
||||
id: getversionrpm
|
||||
run: echo "versionrpm=$(cat src/VERSION | tr -d '\n' | sed 's/-/_/g')" >> "$GITHUB_OUTPUT"
|
||||
|
||||
# Push Docker images
|
||||
push-images:
|
||||
needs: [create-arm, wait-builds]
|
||||
strategy:
|
||||
matrix:
|
||||
image:
|
||||
[bunkerweb, bunkerweb-scheduler, bunkerweb-autoconf, bunkerweb-ui]
|
||||
include:
|
||||
- release: beta
|
||||
- image: bunkerweb
|
||||
cache_from: bunkerweb
|
||||
dockerfile: src/bw/Dockerfile
|
||||
- image: bunkerweb-scheduler
|
||||
cache_from: scheduler
|
||||
dockerfile: src/scheduler/Dockerfile
|
||||
- image: bunkerweb-autoconf
|
||||
cache_from: autoconf
|
||||
dockerfile: src/autoconf/Dockerfile
|
||||
- image: bunkerweb-ui
|
||||
cache_from: ui
|
||||
dockerfile: src/ui/Dockerfile
|
||||
uses: ./.github/workflows/push-docker.yml
|
||||
with:
|
||||
IMAGE: bunkerity/${{ matrix.image }}:${{ matrix.release }},bunkerity/${{ matrix.image }}:${{ needs.wait-builds.outputs.version }}
|
||||
CACHE_FROM: ${{ matrix.cache_from }}-${{ matrix.release }}
|
||||
DOCKERFILE: ${{ matrix.dockerfile }}
|
||||
secrets:
|
||||
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
||||
ARM_SSH_KEY: ${{ secrets.ARM_SSH_KEY }}
|
||||
ARM_SSH_IP: ${{ needs.create-arm.outputs.ip }}
|
||||
ARM_SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }}
|
||||
|
||||
# Push Linux packages
|
||||
push-packages:
|
||||
needs: [wait-builds]
|
||||
strategy:
|
||||
matrix:
|
||||
linux: [ubuntu, debian, fedora, rhel]
|
||||
arch: [amd64, arm64]
|
||||
include:
|
||||
- release: beta
|
||||
repo: bunkerweb
|
||||
- linux: ubuntu
|
||||
separator: _
|
||||
suffix: ""
|
||||
version: jammy
|
||||
package: deb
|
||||
- linux: debian
|
||||
separator: _
|
||||
suffix: ""
|
||||
version: bullseye
|
||||
package: deb
|
||||
- linux: fedora
|
||||
separator: "-"
|
||||
suffix: "1."
|
||||
version: 38
|
||||
package: rpm
|
||||
- linux: el
|
||||
separator: "-"
|
||||
suffix: "1."
|
||||
version: 8
|
||||
package: rpm
|
||||
- linux: ubuntu
|
||||
arch: amd64
|
||||
package_arch: amd64
|
||||
- linux: debian
|
||||
arch: amd64
|
||||
package_arch: amd64
|
||||
- linux: fedora
|
||||
arch: amd64
|
||||
package_arch: x86_64
|
||||
- linux: el
|
||||
arch: amd64
|
||||
package_arch: x86_64
|
||||
- linux: ubuntu
|
||||
arch: arm64
|
||||
package_arch: arm64
|
||||
- linux: debian
|
||||
arch: arm64
|
||||
package_arch: arm64
|
||||
- linux: fedora
|
||||
arch: arm64
|
||||
package_arch: aarch64
|
||||
- linux: el
|
||||
arch: arm64
|
||||
package_arch: aarch64
|
||||
uses: ./.github/workflows/push-packagecloud.yml
|
||||
with:
|
||||
SEPARATOR: ${{ matrix.separator }}
|
||||
SUFFIX: ${{ matrix.suffix }}
|
||||
REPO: ${{ matrix.repo }}
|
||||
LINUX: ${{ matrix.linux }}
|
||||
VERSION: ${{ matrix.version }}
|
||||
PACKAGE: ${{ matrix.package }}
|
||||
BW_VERSION: ${{ matrix.package == 'rpm' && needs.wait-builds.outputs.versionrpm || needs.wait-builds.outputs.version }}
|
||||
PACKAGE_ARCH: ${{ matrix.package_arch }}
|
||||
ARCH: ${{ matrix.arch }}
|
||||
secrets:
|
||||
PACKAGECLOUD_TOKEN: ${{ secrets.PACKAGECLOUD_TOKEN }}
|
||||
|
||||
# Create doc PDF
|
||||
doc-pdf:
|
||||
needs: [wait-builds, push-images, push-packages]
|
||||
uses: ./.github/workflows/doc-to-pdf.yml
|
||||
with:
|
||||
VERSION: ${{ needs.wait-builds.outputs.version }}
|
||||
|
||||
# Push on GH
|
||||
push-gh:
|
||||
needs: [wait-builds, doc-pdf]
|
||||
permissions:
|
||||
contents: write
|
||||
discussions: write
|
||||
uses: ./.github/workflows/push-github.yml
|
||||
with:
|
||||
VERSION: ${{ needs.wait-builds.outputs.version }}
|
||||
PRERELEASE: true
|
||||
|
||||
# Push doc
|
||||
push-doc:
|
||||
needs: [wait-builds, push-gh]
|
||||
permissions:
|
||||
contents: write
|
||||
uses: ./.github/workflows/push-doc.yml
|
||||
with:
|
||||
VERSION: ${{ needs.wait-builds.outputs.version }}
|
||||
ALIAS: beta
|
||||
secrets:
|
||||
BUNKERBOT_TOKEN: ${{ secrets.BUNKERBOT_TOKEN }}
|
||||
|
||||
# Remove ARM VM
|
||||
rm-arm:
|
||||
if: ${{ always() }}
|
||||
needs: [create-arm, push-images, build-packages]
|
||||
uses: ./.github/workflows/rm-arm.yml
|
||||
secrets:
|
||||
ARM_ID: ${{ needs.create-arm.outputs.id }}
|
||||
SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }}
|
||||
SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }}
|
||||
SCW_DEFAULT_PROJECT_ID: ${{ secrets.SCW_DEFAULT_PROJECT_ID }}
|
||||
SCW_DEFAULT_ORGANIZATION_ID: ${{ secrets.SCW_DEFAULT_ORGANIZATION_ID }}
|
||||
31
.github/workflows/codeql.yml
vendored
Normal file
31
.github/workflows/codeql.yml
vendored
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
name: CodeQL Analysis
|
||||
|
||||
on:
|
||||
schedule:
|
||||
# Weekly on Saturdays.
|
||||
- cron: "30 1 * * 6"
|
||||
workflow_call:
|
||||
|
||||
jobs:
|
||||
code-security:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
actions: read
|
||||
contents: read
|
||||
security-events: write
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
language: ["python", "javascript"]
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Initialize CodeQL
|
||||
uses: github/codeql-action/init@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
|
||||
with:
|
||||
languages: ${{ matrix.language }}
|
||||
config-file: ./.github/codeql.yml
|
||||
- name: Perform CodeQL Analysis
|
||||
uses: github/codeql-action/analyze@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
|
||||
with:
|
||||
category: "/language:${{matrix.language}}"
|
||||
134
.github/workflows/container-build.yml
vendored
Normal file
134
.github/workflows/container-build.yml
vendored
Normal file
|
|
@ -0,0 +1,134 @@
|
|||
name: Build container (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
RELEASE:
|
||||
required: true
|
||||
type: string
|
||||
ARCH:
|
||||
required: true
|
||||
type: string
|
||||
IMAGE:
|
||||
required: true
|
||||
type: string
|
||||
DOCKERFILE:
|
||||
required: true
|
||||
type: string
|
||||
CACHE:
|
||||
required: false
|
||||
type: boolean
|
||||
default: true
|
||||
PUSH:
|
||||
required: false
|
||||
type: boolean
|
||||
default: true
|
||||
CACHE_SUFFIX:
|
||||
required: false
|
||||
type: string
|
||||
default: ""
|
||||
secrets:
|
||||
DOCKER_USERNAME:
|
||||
required: true
|
||||
DOCKER_TOKEN:
|
||||
required: true
|
||||
ARM_SSH_KEY:
|
||||
required: false
|
||||
ARM_SSH_IP:
|
||||
required: false
|
||||
ARM_SSH_CONFIG:
|
||||
required: false
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Prepare
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Replace VERSION
|
||||
if: inputs.RELEASE == 'testing'
|
||||
run: ./misc/update-version.sh testing
|
||||
- name: Setup SSH for ARM node
|
||||
if: inputs.CACHE_SUFFIX == 'arm'
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
echo "$SSH_KEY" > ~/.ssh/id_rsa_arm
|
||||
chmod 600 ~/.ssh/id_rsa_arm
|
||||
echo "$SSH_CONFIG" | sed "s/SSH_IP/$SSH_IP/g" > ~/.ssh/config
|
||||
env:
|
||||
SSH_KEY: ${{ secrets.ARM_SSH_KEY }}
|
||||
SSH_IP: ${{ secrets.ARM_SSH_IP }}
|
||||
SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }}
|
||||
- name: Setup Buildx
|
||||
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
|
||||
if: inputs.CACHE_SUFFIX != 'arm'
|
||||
- name: Setup Buildx (ARM)
|
||||
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
|
||||
if: inputs.CACHE_SUFFIX == 'arm'
|
||||
with:
|
||||
endpoint: ssh://root@arm
|
||||
platforms: linux/arm64,linux/arm/v7,linux/arm/v6
|
||||
- name: Login to Docker Hub
|
||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_USERNAME }}
|
||||
password: ${{ secrets.DOCKER_TOKEN }}
|
||||
- name: Login to ghcr
|
||||
if: inputs.PUSH == true
|
||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
# Compute metadata
|
||||
- name: Extract metadata
|
||||
id: meta
|
||||
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
|
||||
with:
|
||||
images: bunkerity/${{ inputs.IMAGE }}
|
||||
# Build cached image
|
||||
- name: Build image
|
||||
if: inputs.CACHE == true
|
||||
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
|
||||
with:
|
||||
context: .
|
||||
file: ${{ inputs.DOCKERFILE }}
|
||||
platforms: ${{ inputs.ARCH }}
|
||||
load: true
|
||||
tags: local/${{ inputs.IMAGE }}
|
||||
cache-from: type=gha,scope=${{ inputs.IMAGE }}-${{ inputs.RELEASE }}
|
||||
cache-to: type=gha,scope=${{ inputs.IMAGE }}-${{ inputs.RELEASE }},mode=min
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
# Build non-cached image
|
||||
- name: Build image
|
||||
if: inputs.CACHE != true
|
||||
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
|
||||
with:
|
||||
context: .
|
||||
file: ${{ inputs.DOCKERFILE }}
|
||||
platforms: ${{ inputs.ARCH }}
|
||||
load: ${{ inputs.CACHE_SUFFIX != 'arm' }}
|
||||
tags: local/${{ inputs.IMAGE }}
|
||||
cache-to: type=gha,scope=${{ inputs.IMAGE }}-${{ inputs.RELEASE }}-${{ inputs.CACHE_SUFFIX }},mode=min
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
# Check OS vulnerabilities
|
||||
- name: Check OS vulnerabilities
|
||||
if: ${{ inputs.CACHE_SUFFIX != 'arm' }}
|
||||
uses: aquasecurity/trivy-action@69cbbc0cbbf6a2b0bab8dcf0e9f2d7ead08e87e4 # master
|
||||
with:
|
||||
vuln-type: os
|
||||
skip-dirs: /root/.cargo
|
||||
image-ref: local/${{ inputs.IMAGE }}
|
||||
format: table
|
||||
exit-code: 1
|
||||
ignore-unfixed: false
|
||||
severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
|
||||
trivyignores: .trivyignore
|
||||
# Push image
|
||||
- name: Push image
|
||||
if: inputs.PUSH == true
|
||||
run: docker tag local/$IMAGE ghcr.io/bunkerity/$IMAGE-tests:$TAG && docker push ghcr.io/bunkerity/$IMAGE-tests:$TAG
|
||||
env:
|
||||
IMAGE: "${{ inputs.IMAGE }}"
|
||||
TAG: "${{ inputs.RELEASE }}"
|
||||
86
.github/workflows/create-arm.yml
vendored
Normal file
86
.github/workflows/create-arm.yml
vendored
Normal file
|
|
@ -0,0 +1,86 @@
|
|||
name: Create ARM node (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
outputs:
|
||||
id:
|
||||
description: "ARM ID"
|
||||
value: ${{ jobs.build.outputs.id }}
|
||||
ip:
|
||||
description: "ARM IP"
|
||||
value: ${{ jobs.build.outputs.ip }}
|
||||
|
||||
secrets:
|
||||
SCW_ACCESS_KEY:
|
||||
required: true
|
||||
SCW_SECRET_KEY:
|
||||
required: true
|
||||
SCW_DEFAULT_PROJECT_ID:
|
||||
required: true
|
||||
SCW_DEFAULT_ORGANIZATION_ID:
|
||||
required: true
|
||||
ARM_SSH_KEY:
|
||||
required: true
|
||||
ARM_SSH_CONFIG:
|
||||
required: true
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
id: ${{ steps.getinfo.outputs.id }}
|
||||
ip: ${{ steps.getinfo.outputs.ip }}
|
||||
steps:
|
||||
# Prepare
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Get ARM availabilities
|
||||
id: availabilities
|
||||
uses: scaleway/action-scw@c718eca1fcb9fec1fb1433752d61599c6a0ad2e9
|
||||
with:
|
||||
args: instance server-type get zone=fr-par-2
|
||||
export-config: true
|
||||
access-key: ${{ secrets.SCW_ACCESS_KEY }}
|
||||
secret-key: ${{ secrets.SCW_SECRET_KEY }}
|
||||
default-project-id: ${{ secrets.SCW_DEFAULT_PROJECT_ID }}
|
||||
default-organization-id: ${{ secrets.SCW_DEFAULT_ORGANIZATION_ID }}
|
||||
- name: Extract ARM type
|
||||
run: |
|
||||
TYPE=$(echo "$JSON" | jq '.servers | with_entries(select(.key | contains("AMP"))) | with_entries(select(.value.availability != "shortage")) | keys[] | select(. | test("^AMP2-C[0-9]+$")) | sub("AMP2-C"; "") | tonumber' | sort -n | tail -n 1 | xargs -I {} echo "AMP2-C{}")
|
||||
echo "Type is $TYPE"
|
||||
echo "TYPE=$TYPE" >> "$GITHUB_ENV"
|
||||
env:
|
||||
JSON: ${{ steps.availabilities.outputs.json }}
|
||||
- name: Create ARM VM
|
||||
id: scw
|
||||
uses: scaleway/action-scw@c718eca1fcb9fec1fb1433752d61599c6a0ad2e9
|
||||
with:
|
||||
args: instance server create zone=fr-par-2 type=${{ env.TYPE }} root-volume=block:50GB
|
||||
- name: Get info
|
||||
id: getinfo
|
||||
run: |
|
||||
echo "id=${{ fromJson(steps.scw.outputs.json).id }}" >> "$GITHUB_OUTPUT"
|
||||
echo "ip=${{ fromJson(steps.scw.outputs.json).public_ip.address }}" >> "$GITHUB_OUTPUT"
|
||||
- name: Wait for VM
|
||||
uses: scaleway/action-scw@c718eca1fcb9fec1fb1433752d61599c6a0ad2e9
|
||||
with:
|
||||
args: instance server wait ${{ fromJson(steps.scw.outputs.json).ID }} zone=fr-par-2
|
||||
- name: Wait for SSH
|
||||
uses: iFaxity/wait-on-action@628831cec646e6dacca502f34a6c6b46e131e51d
|
||||
with:
|
||||
resource: tcp:${{ fromJson(steps.scw.outputs.json).public_ip.address }}:22
|
||||
timeout: 300000
|
||||
- name: Setup SSH for ARM node
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
echo "$SSH_KEY" > ~/.ssh/id_rsa_arm
|
||||
chmod 600 ~/.ssh/id_rsa_arm
|
||||
echo "$SSH_CONFIG" | sed "s/SSH_IP/$SSH_IP/g" > ~/.ssh/config
|
||||
env:
|
||||
SSH_KEY: ${{ secrets.ARM_SSH_KEY }}
|
||||
SSH_IP: ${{ fromJson(steps.scw.outputs.json).public_ip.address }}
|
||||
SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }}
|
||||
- name: Install Docker
|
||||
run: ssh root@$SSH_IP "curl -fsSL https://test.docker.com -o test-docker.sh ; sh test-docker.sh"
|
||||
env:
|
||||
SSH_IP: ${{ fromJson(steps.scw.outputs.json).public_ip.address }}
|
||||
61
.github/workflows/dev-update-mmdb.yml
vendored
Normal file
61
.github/workflows/dev-update-mmdb.yml
vendored
Normal file
|
|
@ -0,0 +1,61 @@
|
|||
name: Update cached mmdb files
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: "0 12 1 * *"
|
||||
|
||||
jobs:
|
||||
mmdb-update:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
with:
|
||||
fetch-depth: 0
|
||||
token: ${{ secrets.BUNKERBOT_TOKEN }}
|
||||
ref: dev
|
||||
- name: Download mmdb files
|
||||
run: |
|
||||
mkdir -p src/bw/misc/
|
||||
cd src/bw/misc/
|
||||
CURL_RETURN_CODE=0
|
||||
CURL_OUTPUT=`curl -w httpcode=%{http_code} -s -o asn.mmdb.gz https://download.db-ip.com/free/dbip-asn-lite-$(date +%Y-%m).mmdb.gz 2> /dev/null` || CURL_RETURN_CODE=$?
|
||||
if [ ${CURL_RETURN_CODE} -ne 0 ]; then
|
||||
echo "Curl connection failed when downloading asn-lite mmdb file with return code - ${CURL_RETURN_CODE}"
|
||||
exit 1
|
||||
else
|
||||
echo "Curl connection success"
|
||||
# Check http code for curl operation/response in CURL_OUTPUT
|
||||
httpCode=$(echo "${CURL_OUTPUT}" | sed -e 's/.*\httpcode=//')
|
||||
if [ ${httpCode} -ne 200 ]; then
|
||||
echo "Curl operation/command failed due to server return code - ${httpCode}"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
CURL_RETURN_CODE=0
|
||||
CURL_OUTPUT=`curl -w httpcode=%{http_code} -s -o country.mmdb.gz https://download.db-ip.com/free/dbip-country-lite-$(date +%Y-%m).mmdb.gz 2> /dev/null` || CURL_RETURN_CODE=$?
|
||||
if [ ${CURL_RETURN_CODE} -ne 0 ]; then
|
||||
echo "Curl connection failed when downloading country-lite mmdb file with return code - ${CURL_RETURN_CODE}"
|
||||
exit 1
|
||||
else
|
||||
echo "Curl connection success"
|
||||
# Check http code for curl operation/response in CURL_OUTPUT
|
||||
httpCode=$(echo "${CURL_OUTPUT}" | sed -e 's/.*\httpcode=//')
|
||||
if [ ${httpCode} -ne 200 ]; then
|
||||
echo "Curl operation/command failed due to server return code - ${httpCode}"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
rm -f asn.mmdb country.mmdb
|
||||
gunzip asn.mmdb.gz country.mmdb.gz
|
||||
- name: Commit and push changes
|
||||
uses: stefanzweifel/git-auto-commit-action@8756aa072ef5b4a080af5dc8fef36c5d586e521d # v5.0.0
|
||||
with:
|
||||
branch: dev
|
||||
commit_message: "Monthly mmdb update"
|
||||
commit_options: "--no-verify"
|
||||
commit_user_name: "BunkerBot"
|
||||
commit_user_email: "bunkerbot@bunkerity.com"
|
||||
214
.github/workflows/dev.yml
vendored
Normal file
214
.github/workflows/dev.yml
vendored
Normal file
|
|
@ -0,0 +1,214 @@
|
|||
name: Automatic tests (DEV)
|
||||
|
||||
permissions: read-all
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [dev]
|
||||
|
||||
jobs:
|
||||
# Containers
|
||||
build-containers:
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
strategy:
|
||||
matrix:
|
||||
image: [bunkerweb, scheduler, autoconf, ui]
|
||||
include:
|
||||
- image: bunkerweb
|
||||
dockerfile: src/bw/Dockerfile
|
||||
- image: scheduler
|
||||
dockerfile: src/scheduler/Dockerfile
|
||||
- image: autoconf
|
||||
dockerfile: src/autoconf/Dockerfile
|
||||
- image: ui
|
||||
dockerfile: src/ui/Dockerfile
|
||||
uses: ./.github/workflows/container-build.yml
|
||||
with:
|
||||
RELEASE: dev
|
||||
ARCH: linux/amd64
|
||||
CACHE: true
|
||||
IMAGE: ${{ matrix.image }}
|
||||
DOCKERFILE: ${{ matrix.dockerfile }}
|
||||
secrets:
|
||||
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
||||
|
||||
# Build Linux packages
|
||||
build-packages:
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
strategy:
|
||||
matrix:
|
||||
linux: [ubuntu, debian, fedora, rhel]
|
||||
include:
|
||||
- linux: ubuntu
|
||||
package: deb
|
||||
- linux: debian
|
||||
package: deb
|
||||
- linux: fedora
|
||||
package: rpm
|
||||
- linux: rhel
|
||||
package: rpm
|
||||
uses: ./.github/workflows/linux-build.yml
|
||||
with:
|
||||
RELEASE: dev
|
||||
LINUX: ${{ matrix.linux }}
|
||||
PACKAGE: ${{ matrix.package }}
|
||||
TEST: true
|
||||
PLATFORMS: linux/amd64
|
||||
secrets:
|
||||
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
||||
|
||||
codeql:
|
||||
uses: ./.github/workflows/codeql.yml
|
||||
permissions:
|
||||
actions: read
|
||||
contents: read
|
||||
security-events: write
|
||||
|
||||
# UI tests
|
||||
tests-ui:
|
||||
needs: [codeql, build-containers]
|
||||
uses: ./.github/workflows/tests-ui.yml
|
||||
with:
|
||||
RELEASE: dev
|
||||
tests-ui-linux:
|
||||
needs: [codeql, build-packages]
|
||||
uses: ./.github/workflows/tests-ui-linux.yml
|
||||
with:
|
||||
RELEASE: dev
|
||||
|
||||
# Core tests
|
||||
prepare-tests-core:
|
||||
needs: [codeql, build-containers, build-packages]
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- id: set-matrix
|
||||
run: |
|
||||
tests=$(find ./tests/core/ -maxdepth 1 -mindepth 1 -type d -printf "%f\n" | jq -c --raw-input --slurp 'split("\n")| .[0:-1]')
|
||||
echo "tests=$tests" >> $GITHUB_OUTPUT
|
||||
outputs:
|
||||
tests: ${{ steps.set-matrix.outputs.tests }}
|
||||
tests-core:
|
||||
needs: prepare-tests-core
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
test: ${{ fromJson(needs.prepare-tests-core.outputs.tests) }}
|
||||
uses: ./.github/workflows/test-core.yml
|
||||
with:
|
||||
TEST: ${{ matrix.test }}
|
||||
RELEASE: dev
|
||||
tests-core-linux:
|
||||
needs: prepare-tests-core
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
test: ${{ fromJson(needs.prepare-tests-core.outputs.tests) }}
|
||||
uses: ./.github/workflows/test-core-linux.yml
|
||||
with:
|
||||
TEST: ${{ matrix.test }}
|
||||
RELEASE: dev
|
||||
secrets: inherit
|
||||
|
||||
# Push with dev tag
|
||||
push-dev:
|
||||
needs: [tests-ui, tests-core]
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
steps:
|
||||
- name: Login to Docker Hub
|
||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_USERNAME }}
|
||||
password: ${{ secrets.DOCKER_TOKEN }}
|
||||
- name: Login to ghcr
|
||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Push BW image
|
||||
run: docker pull ghcr.io/bunkerity/$FROM-tests:dev && docker tag ghcr.io/bunkerity/$FROM-tests:dev bunkerity/$TO:dev && docker tag ghcr.io/bunkerity/$FROM-tests:dev ghcr.io/bunkerity/$TO:dev && docker push bunkerity/$TO:dev && docker push ghcr.io/bunkerity/$TO:dev
|
||||
env:
|
||||
FROM: "bunkerweb"
|
||||
TO: "bunkerweb"
|
||||
- name: Push scheduler image
|
||||
run: docker pull ghcr.io/bunkerity/$FROM-tests:dev && docker tag ghcr.io/bunkerity/$FROM-tests:dev bunkerity/$TO:dev && docker tag ghcr.io/bunkerity/$FROM-tests:dev ghcr.io/bunkerity/$TO:dev && docker push bunkerity/$TO:dev && docker push ghcr.io/bunkerity/$TO:dev
|
||||
env:
|
||||
FROM: "scheduler"
|
||||
TO: "bunkerweb-scheduler"
|
||||
- name: Push UI image
|
||||
run: docker pull ghcr.io/bunkerity/$FROM-tests:dev && docker tag ghcr.io/bunkerity/$FROM-tests:dev bunkerity/$TO:dev && docker tag ghcr.io/bunkerity/$FROM-tests:dev ghcr.io/bunkerity/$TO:dev && docker push bunkerity/$TO:dev && docker push ghcr.io/bunkerity/$TO:dev
|
||||
env:
|
||||
FROM: "ui"
|
||||
TO: "bunkerweb-ui"
|
||||
- name: Push autoconf image
|
||||
run: docker pull ghcr.io/bunkerity/$FROM-tests:dev && docker tag ghcr.io/bunkerity/$FROM-tests:dev bunkerity/$TO:dev && docker tag ghcr.io/bunkerity/$FROM-tests:dev ghcr.io/bunkerity/$TO:dev && docker push bunkerity/$TO:dev && docker push ghcr.io/bunkerity/$TO:dev
|
||||
env:
|
||||
FROM: "autoconf"
|
||||
TO: "bunkerweb-autoconf"
|
||||
|
||||
# Push Linux packages
|
||||
push-packages:
|
||||
needs: [tests-ui-linux, tests-core-linux]
|
||||
strategy:
|
||||
matrix:
|
||||
linux: [ubuntu, debian, fedora, el]
|
||||
arch: [amd64]
|
||||
include:
|
||||
- release: dev
|
||||
repo: bunkerweb
|
||||
- linux: ubuntu
|
||||
separator: _
|
||||
suffix: ""
|
||||
version: jammy
|
||||
package: deb
|
||||
- linux: debian
|
||||
separator: _
|
||||
suffix: ""
|
||||
version: bullseye
|
||||
package: deb
|
||||
- linux: fedora
|
||||
separator: "-"
|
||||
suffix: "1."
|
||||
version: 38
|
||||
package: rpm
|
||||
- linux: el
|
||||
separator: "-"
|
||||
suffix: "1."
|
||||
version: 8
|
||||
package: rpm
|
||||
- linux: ubuntu
|
||||
arch: amd64
|
||||
package_arch: amd64
|
||||
- linux: debian
|
||||
arch: amd64
|
||||
package_arch: amd64
|
||||
- linux: fedora
|
||||
arch: amd64
|
||||
package_arch: x86_64
|
||||
- linux: el
|
||||
arch: amd64
|
||||
package_arch: x86_64
|
||||
uses: ./.github/workflows/push-packagecloud.yml
|
||||
with:
|
||||
SEPARATOR: ${{ matrix.separator }}
|
||||
SUFFIX: ${{ matrix.suffix }}
|
||||
REPO: ${{ matrix.repo }}
|
||||
LINUX: ${{ matrix.linux }}
|
||||
VERSION: ${{ matrix.version }}
|
||||
PACKAGE: ${{ matrix.package }}
|
||||
BW_VERSION: ${{ matrix.release }}
|
||||
PACKAGE_ARCH: ${{ matrix.package_arch }}
|
||||
ARCH: ${{ matrix.arch }}
|
||||
secrets:
|
||||
PACKAGECLOUD_TOKEN: ${{ secrets.PACKAGECLOUD_TOKEN }}
|
||||
38
.github/workflows/doc-to-pdf.yml
vendored
Normal file
38
.github/workflows/doc-to-pdf.yml
vendored
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
name: Generate documentation PDF (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
VERSION:
|
||||
required: true
|
||||
type: string
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Prepare
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Install Python
|
||||
uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
|
||||
with:
|
||||
python-version: "3.10"
|
||||
- name: Install doc requirements
|
||||
run: pip install --no-cache-dir --require-hashes -r docs/requirements.txt
|
||||
- name: Install chromium
|
||||
run: sudo apt install chromium-browser
|
||||
- name: Install node
|
||||
uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
|
||||
with:
|
||||
node-version: 18
|
||||
- name: Install puppeteer
|
||||
run: cd docs && npm install
|
||||
- name: Run mkdocs serve in background
|
||||
run: mkdocs serve & sleep 10
|
||||
- name: Run pdf script
|
||||
run: node docs/misc/pdf.js http://localhost:8000/print_page/ BunkerWeb_documentation_v${{ inputs.VERSION }}.pdf 'BunkerWeb documentation v${{ inputs.VERSION }}'
|
||||
- uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
|
||||
with:
|
||||
name: BunkerWeb_documentation_v${{ inputs.VERSION }}.pdf
|
||||
path: BunkerWeb_documentation_v${{ inputs.VERSION }}.pdf
|
||||
152
.github/workflows/linux-build.yml
vendored
Normal file
152
.github/workflows/linux-build.yml
vendored
Normal file
|
|
@ -0,0 +1,152 @@
|
|||
name: Build Linux package (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
RELEASE:
|
||||
required: true
|
||||
type: string
|
||||
LINUX:
|
||||
required: true
|
||||
type: string
|
||||
PACKAGE:
|
||||
required: true
|
||||
type: string
|
||||
PLATFORMS:
|
||||
required: true
|
||||
type: string
|
||||
TEST:
|
||||
required: false
|
||||
type: boolean
|
||||
default: false
|
||||
secrets:
|
||||
DOCKER_USERNAME:
|
||||
required: true
|
||||
DOCKER_TOKEN:
|
||||
required: true
|
||||
ARM_SSH_KEY:
|
||||
required: false
|
||||
ARM_SSH_IP:
|
||||
required: false
|
||||
ARM_SSH_CONFIG:
|
||||
required: false
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Prepare
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Replace VERSION
|
||||
if: inputs.RELEASE == 'testing' || inputs.RELEASE == 'dev' || inputs.RELEASE == 'ui'
|
||||
run: ./misc/update-version.sh ${{ inputs.RELEASE }}
|
||||
- name: Extract arch
|
||||
run: |
|
||||
echo "ARCH=${{ env.PLATFORMS }}" | sed 's/linux//g' | sed 's@/@@g' >> "$GITHUB_ENV"
|
||||
env:
|
||||
PLATFORMS: ${{ inputs.PLATFORMS }}
|
||||
- name: Extract linux arch
|
||||
if: inputs.PACKAGE == 'rpm'
|
||||
run: |
|
||||
echo "LARCH=${{ env.ARCH }}" | sed 's/amd64/x86_64/g' | sed 's/arm64/aarch64/g' >> "$GITHUB_ENV"
|
||||
env:
|
||||
ARCH: ${{ env.ARCH }}
|
||||
- name: Extract linux arch
|
||||
if: inputs.PACKAGE == 'deb'
|
||||
run: |
|
||||
echo "LARCH=${{ env.ARCH }}" >> "$GITHUB_ENV"
|
||||
env:
|
||||
ARCH: ${{ env.ARCH }}
|
||||
- name: Setup SSH for ARM node
|
||||
if: startsWith(env.ARCH, 'arm') == true
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
echo "$SSH_KEY" > ~/.ssh/id_rsa_arm
|
||||
chmod 600 ~/.ssh/id_rsa_arm
|
||||
echo "$SSH_CONFIG" | sed "s/SSH_IP/$SSH_IP/g" > ~/.ssh/config
|
||||
env:
|
||||
SSH_KEY: ${{ secrets.ARM_SSH_KEY }}
|
||||
SSH_IP: ${{ secrets.ARM_SSH_IP }}
|
||||
SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }}
|
||||
- name: Setup Buildx
|
||||
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
|
||||
if: startsWith(env.ARCH, 'arm') == false
|
||||
- name: Setup Buildx (ARM)
|
||||
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
|
||||
if: startsWith(env.ARCH, 'arm') == true
|
||||
with:
|
||||
endpoint: ssh://root@arm
|
||||
platforms: linux/arm64,linux/arm/v7,linux/arm/v6
|
||||
- name: Login to Docker Hub
|
||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_USERNAME }}
|
||||
password: ${{ secrets.DOCKER_TOKEN }}
|
||||
- name: Login to ghcr
|
||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
# Build testing package image
|
||||
- name: Build package image
|
||||
if: inputs.RELEASE == 'testing' || inputs.RELEASE == 'dev' || inputs.RELEASE == 'ui'
|
||||
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
|
||||
with:
|
||||
context: .
|
||||
load: true
|
||||
file: src/linux/Dockerfile-${{ inputs.LINUX }}
|
||||
platforms: ${{ inputs.PLATFORMS }}
|
||||
tags: local/bunkerweb-${{ inputs.LINUX }}:latest
|
||||
cache-from: type=gha,scope=${{ inputs.LINUX }}-${{ inputs.RELEASE }}
|
||||
cache-to: type=gha,scope=${{ inputs.LINUX }}-${{ inputs.RELEASE }},mode=min
|
||||
# Build non-testing package image
|
||||
- name: Build package image
|
||||
if: inputs.RELEASE != 'testing' && inputs.RELEASE != 'dev'
|
||||
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
|
||||
with:
|
||||
context: .
|
||||
load: true
|
||||
file: src/linux/Dockerfile-${{ inputs.LINUX }}
|
||||
platforms: ${{ inputs.PLATFORMS }}
|
||||
tags: local/bunkerweb-${{ inputs.LINUX }}:latest
|
||||
# Generate package
|
||||
- name: Generate package
|
||||
if: startsWith(env.ARCH, 'arm') == false
|
||||
run: ./src/linux/package.sh ${{ inputs.LINUX }} ${{ env.LARCH }}
|
||||
env:
|
||||
LARCH: ${{ env.LARCH }}
|
||||
- name: Generate package (ARM)
|
||||
if: startsWith(env.ARCH, 'arm') == true
|
||||
run: |
|
||||
docker save local/bunkerweb-${{ inputs.LINUX }}:latest | ssh -C root@arm docker load
|
||||
scp ./src/linux/package.sh root@arm:/opt
|
||||
ssh root@arm chmod +x /opt/package.sh
|
||||
ssh root@arm /opt/package.sh ${{ inputs.LINUX }} ${{ env.LARCH }} "$(cat src/VERSION | tr -d '\n')"
|
||||
scp -r root@arm:/root/package-${{ inputs.LINUX }} ./package-${{ inputs.LINUX }}
|
||||
env:
|
||||
LARCH: ${{ env.LARCH }}
|
||||
- uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
|
||||
with:
|
||||
name: package-${{ inputs.LINUX }}-${{ env.LARCH }}
|
||||
path: package-${{ inputs.LINUX }}/*.${{ inputs.PACKAGE }}
|
||||
# Build test image
|
||||
- name: Extract metadata
|
||||
if: inputs.TEST == true
|
||||
id: meta
|
||||
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
|
||||
with:
|
||||
images: ghcr.io/bunkerity/${{ inputs.LINUX }}-tests:${{ inputs.RELEASE }}
|
||||
- name: Build test image
|
||||
if: inputs.TEST == true
|
||||
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
|
||||
with:
|
||||
context: .
|
||||
file: tests/linux/Dockerfile-${{ inputs.LINUX }}
|
||||
platforms: ${{ inputs.PLATFORMS }}
|
||||
push: true
|
||||
tags: ghcr.io/bunkerity/${{ inputs.LINUX }}-tests:${{ inputs.RELEASE }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
cache-from: type=gha,scope=${{ inputs.LINUX }}-${{ inputs.RELEASE }}-tests
|
||||
cache-to: type=gha,scope=${{ inputs.LINUX }}-${{ inputs.RELEASE }}-tests,mode=min
|
||||
41
.github/workflows/push-doc.yml
vendored
Normal file
41
.github/workflows/push-doc.yml
vendored
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
name: Push documentation (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
VERSION:
|
||||
required: true
|
||||
type: string
|
||||
ALIAS:
|
||||
required: true
|
||||
type: string
|
||||
secrets:
|
||||
BUNKERBOT_TOKEN:
|
||||
required: true
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
with:
|
||||
fetch-depth: 0
|
||||
token: ${{ secrets.BUNKERBOT_TOKEN }}
|
||||
- name: Replace VERSION
|
||||
if: inputs.VERSION == 'testing'
|
||||
run: ./misc/update-version.sh testing
|
||||
- name: Setup git user
|
||||
run: |
|
||||
git config --global user.name "BunkerBot"
|
||||
git config --global user.email "bunkerbot@bunkerity.com"
|
||||
- uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
|
||||
with:
|
||||
python-version: "3.10"
|
||||
- name: Install doc requirements
|
||||
run: pip install --no-cache-dir --require-hashes -r docs/requirements.txt
|
||||
- name: Push doc
|
||||
run: mike deploy --update-aliases --push --no-redirect ${{ inputs.VERSION }} ${{ inputs.ALIAS }}
|
||||
- name: Set default doc
|
||||
if: inputs.ALIAS == 'latest'
|
||||
run: mike set-default --push latest
|
||||
82
.github/workflows/push-docker.yml
vendored
Normal file
82
.github/workflows/push-docker.yml
vendored
Normal file
|
|
@ -0,0 +1,82 @@
|
|||
name: Push image (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
IMAGE:
|
||||
required: true
|
||||
type: string
|
||||
TAGS:
|
||||
required: true
|
||||
type: string
|
||||
CACHE_FROM:
|
||||
required: true
|
||||
type: string
|
||||
DOCKERFILE:
|
||||
required: true
|
||||
type: string
|
||||
secrets:
|
||||
DOCKER_USERNAME:
|
||||
required: true
|
||||
DOCKER_TOKEN:
|
||||
required: true
|
||||
ARM_SSH_KEY:
|
||||
required: true
|
||||
ARM_SSH_CONFIG:
|
||||
required: true
|
||||
ARM_SSH_IP:
|
||||
required: true
|
||||
|
||||
jobs:
|
||||
push:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Prepare
|
||||
- name: Check out repository code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Login to Docker Hub
|
||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_USERNAME }}
|
||||
password: ${{ secrets.DOCKER_TOKEN }}
|
||||
- name: Login to ghcr
|
||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Setup SSH for ARM node
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
echo "$SSH_KEY" > ~/.ssh/id_rsa_arm
|
||||
chmod 600 ~/.ssh/id_rsa_arm
|
||||
echo "$SSH_CONFIG" | sed "s/SSH_IP/$SSH_IP/g" > ~/.ssh/config
|
||||
env:
|
||||
SSH_KEY: ${{ secrets.ARM_SSH_KEY }}
|
||||
SSH_IP: ${{ secrets.ARM_SSH_IP }}
|
||||
SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }}
|
||||
- name: Setup Buildx (ARM)
|
||||
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
|
||||
with:
|
||||
endpoint: ssh://root@arm
|
||||
platforms: linux/arm64,linux/arm/v7,linux/arm/v6
|
||||
# Compute metadata
|
||||
- name: Extract metadata
|
||||
id: meta
|
||||
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
|
||||
with:
|
||||
images: bunkerity/${{ inputs.IMAGE }}
|
||||
# Build and push
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
|
||||
with:
|
||||
context: .
|
||||
file: ${{ inputs.DOCKERFILE }}
|
||||
platforms: linux/amd64,linux/386,linux/arm64,linux/arm/v7
|
||||
push: true
|
||||
tags: ${{ inputs.TAGS }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
cache-from: |
|
||||
type=gha,scope=${{ inputs.CACHE_FROM }}-amd64
|
||||
type=gha,scope=${{ inputs.CACHE_FROM }}-386
|
||||
type=gha,scope=${{ inputs.CACHE_FROM }}-arm
|
||||
97
.github/workflows/push-github.yml
vendored
Normal file
97
.github/workflows/push-github.yml
vendored
Normal file
|
|
@ -0,0 +1,97 @@
|
|||
name: Push on GitHub (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
VERSION:
|
||||
required: true
|
||||
type: string
|
||||
PRERELEASE:
|
||||
required: true
|
||||
type: boolean
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Checkout
|
||||
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
# Get PDF doc
|
||||
- name: Get documentation
|
||||
if: inputs.VERSION != 'testing'
|
||||
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
||||
with:
|
||||
name: BunkerWeb_documentation_v${{ inputs.VERSION }}.pdf
|
||||
# Create tag
|
||||
- uses: rickstaa/action-create-tag@861755f3fcbce1b21a65c17bad10e7d35c27b6d9 # v1.7.1
|
||||
name: Create tag
|
||||
if: inputs.VERSION != 'testing'
|
||||
with:
|
||||
tag: "v${{ inputs.VERSION }}"
|
||||
message: "v${{ inputs.VERSION }}"
|
||||
force_push_tag: true
|
||||
# Create tag
|
||||
- uses: rickstaa/action-create-tag@861755f3fcbce1b21a65c17bad10e7d35c27b6d9 # v1.7.1
|
||||
name: Create tag
|
||||
if: inputs.VERSION == 'testing'
|
||||
with:
|
||||
tag: "${{ inputs.VERSION }}"
|
||||
message: "${{ inputs.VERSION }}"
|
||||
force_push_tag: true
|
||||
# Extract changelog
|
||||
- name: Extract changelog
|
||||
if: inputs.VERSION != 'testing'
|
||||
id: getchangelog
|
||||
run: |
|
||||
content=$(awk -v n=2 '/##/{n--}; n > 0' CHANGELOG.md | grep -v '# Changelog' | grep -v '##' | sed '/^$/d')
|
||||
content="${content//'%'/'%25'}"
|
||||
content="${content//$'\n'/'%0A'}"
|
||||
content="${content//$'\r'/'%0D'}"
|
||||
echo "content=$content" >> $GITHUB_OUTPUT
|
||||
# Create release
|
||||
- name: Create release
|
||||
if: inputs.VERSION != 'testing'
|
||||
uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
|
||||
with:
|
||||
body: |
|
||||
Documentation : https://docs.bunkerweb.io/${{ inputs.VERSION }}/
|
||||
|
||||
Docker tags :
|
||||
- BunkerWeb : `bunkerity/bunkerweb:${{ inputs.VERSION }}` or `ghcr.io/bunkerity/bunkerweb:${{ inputs.VERSION }}`
|
||||
- Scheduler : `bunkerity/bunkerweb-scheduler:${{ inputs.VERSION }}` or `ghcr.io/bunkerity/bunkerweb-scheduler:${{ inputs.VERSION }}`
|
||||
- Autoconf : `bunkerity/bunkerweb-autoconf:${{ inputs.VERSION }}` or `ghcr.io/bunkerity/bunkerweb-autoconf:${{ inputs.VERSION }}`
|
||||
- UI : `bunkerity/bunkerweb-ui:${{ inputs.VERSION }}` or `ghcr.io/bunkerity/bunkerweb-ui:${{ inputs.VERSION }}`
|
||||
|
||||
Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=${{ inputs.VERSION }}&filter=all&dist=
|
||||
|
||||
Changelog :
|
||||
${{ steps.getchangelog.outputs.content }}
|
||||
draft: true
|
||||
prerelease: ${{ inputs.PRERELEASE }}
|
||||
name: v${{ inputs.VERSION }}
|
||||
tag_name: v${{ inputs.VERSION }}
|
||||
discussion_category_name: Announcements
|
||||
files: BunkerWeb_documentation_v${{ inputs.VERSION }}.pdf
|
||||
# Create release
|
||||
- name: Create release
|
||||
if: inputs.VERSION == 'testing'
|
||||
uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
|
||||
with:
|
||||
body: |
|
||||
**The testing version of BunkerWeb should not be used in production, please use the latest stable version instead.**
|
||||
|
||||
Documentation : https://docs.bunkerweb.io/${{ inputs.VERSION }}/
|
||||
|
||||
Docker tags :
|
||||
- BunkerWeb : `bunkerity/bunkerweb:${{ inputs.VERSION }}` or `ghcr.io/bunkerity/bunkerweb:${{ inputs.VERSION }}`
|
||||
- Scheduler : `bunkerity/bunkerweb-scheduler:${{ inputs.VERSION }}` or `ghcr.io/bunkerity/bunkerweb-scheduler:${{ inputs.VERSION }}`
|
||||
- Autoconf : `bunkerity/bunkerweb-autoconf:${{ inputs.VERSION }}` or `ghcr.io/bunkerity/bunkerweb-autoconf:${{ inputs.VERSION }}`
|
||||
- UI : `bunkerity/bunkerweb-ui:${{ inputs.VERSION }}` or `ghcr.io/bunkerity/bunkerweb-ui:${{ inputs.VERSION }}`
|
||||
|
||||
Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=${{ inputs.VERSION }}&filter=all&dist=
|
||||
|
||||
Please note that when using Linux Debian or Ubuntu integration, you will need to add the `force-bad-version` directive to your `/etc/dpkg/dpkg.cfg` file before installing the testing version of BunkerWeb.
|
||||
draft: false
|
||||
prerelease: ${{ inputs.PRERELEASE }}
|
||||
name: Testing
|
||||
tag_name: ${{ inputs.VERSION }}
|
||||
79
.github/workflows/push-packagecloud.yml
vendored
Normal file
79
.github/workflows/push-packagecloud.yml
vendored
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
name: Push packagecloud (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
SEPARATOR:
|
||||
required: true
|
||||
type: string
|
||||
SUFFIX:
|
||||
required: true
|
||||
type: string
|
||||
REPO:
|
||||
required: true
|
||||
type: string
|
||||
LINUX:
|
||||
required: true
|
||||
type: string
|
||||
VERSION:
|
||||
required: true
|
||||
type: string
|
||||
PACKAGE:
|
||||
required: true
|
||||
type: string
|
||||
BW_VERSION:
|
||||
required: true
|
||||
type: string
|
||||
ARCH:
|
||||
required: true
|
||||
type: string
|
||||
PACKAGE_ARCH:
|
||||
required: true
|
||||
type: string
|
||||
secrets:
|
||||
PACKAGECLOUD_TOKEN:
|
||||
required: true
|
||||
|
||||
jobs:
|
||||
push:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Prepare
|
||||
- name: Check out repository code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Install ruby
|
||||
uses: ruby/setup-ruby@8575951200e472d5f2d95c625da0c7bec8217c42 # v1.161.0
|
||||
with:
|
||||
ruby-version: "3.0"
|
||||
- name: Install packagecloud
|
||||
run: gem install package_cloud
|
||||
# Download packages
|
||||
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
||||
if: inputs.LINUX != 'el'
|
||||
with:
|
||||
name: package-${{ inputs.LINUX }}-${{ inputs.PACKAGE_ARCH }}
|
||||
path: /tmp/${{ inputs.LINUX }}
|
||||
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
||||
if: inputs.LINUX == 'el'
|
||||
with:
|
||||
name: package-rhel-${{ inputs.PACKAGE_ARCH }}
|
||||
path: /tmp/${{ inputs.LINUX }}
|
||||
# Remove existing packages
|
||||
- name: Remove existing package
|
||||
run: package_cloud yank bunkerity/${{ inputs.REPO }}/${{ inputs.LINUX }}/${{ inputs.VERSION }} bunkerweb${{ inputs.SEPARATOR }}${{ inputs.BW_VERSION }}${{ inputs.SEPARATOR }}${{ inputs.SUFFIX }}${{ inputs.PACKAGE_ARCH }}.${{ inputs.PACKAGE }}
|
||||
continue-on-error: true
|
||||
env:
|
||||
PACKAGECLOUD_TOKEN: ${{ secrets.PACKAGECLOUD_TOKEN }}
|
||||
# Update name
|
||||
# - name: Rename package
|
||||
# if: inputs.BW_VERSION == 'testing'
|
||||
# run: sudo apt install -y rename && rename 's/[0-9]\.[0-9]\.[0-9]/testing/' /tmp/${{ inputs.LINUX }}/*.${{ inputs.PACKAGE }}
|
||||
# Push package
|
||||
- name: Push package to packagecloud
|
||||
uses: danielmundi/upload-packagecloud@46cd0e61152bf952dbc0d1759e609d3d22649030 # v1
|
||||
with:
|
||||
PACKAGE-NAME: /tmp/${{ inputs.LINUX }}/*.${{ inputs.PACKAGE }}
|
||||
PACKAGECLOUD-USERNAME: bunkerity
|
||||
PACKAGECLOUD-REPO: ${{ inputs.REPO }}
|
||||
PACKAGECLOUD-DISTRIB: ${{ inputs.LINUX }}/${{ inputs.VERSION }}
|
||||
PACKAGECLOUD-TOKEN: ${{ secrets.PACKAGECLOUD_TOKEN }}
|
||||
295
.github/workflows/release.yml
vendored
Normal file
295
.github/workflows/release.yml
vendored
Normal file
|
|
@ -0,0 +1,295 @@
|
|||
name: Automatic push (RELEASE)
|
||||
|
||||
permissions: read-all
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [master]
|
||||
|
||||
jobs:
|
||||
scorecards-analysis:
|
||||
uses: ./.github/workflows/scorecards-analysis.yml
|
||||
|
||||
codeql:
|
||||
uses: ./.github/workflows/codeql.yml
|
||||
permissions:
|
||||
actions: read
|
||||
contents: read
|
||||
security-events: write
|
||||
|
||||
# Build amd64 + 386 containers images
|
||||
build-containers:
|
||||
strategy:
|
||||
matrix:
|
||||
image: [bunkerweb, scheduler, autoconf, ui]
|
||||
arch: [linux/amd64, linux/386]
|
||||
include:
|
||||
- release: latest
|
||||
cache: false
|
||||
push: false
|
||||
- image: bunkerweb
|
||||
dockerfile: src/bw/Dockerfile
|
||||
- image: scheduler
|
||||
dockerfile: src/scheduler/Dockerfile
|
||||
- image: autoconf
|
||||
dockerfile: src/autoconf/Dockerfile
|
||||
- image: ui
|
||||
dockerfile: src/ui/Dockerfile
|
||||
- arch: linux/amd64
|
||||
cache_suffix: amd64
|
||||
- arch: linux/386
|
||||
cache_suffix: "386"
|
||||
uses: ./.github/workflows/container-build.yml
|
||||
with:
|
||||
RELEASE: ${{ matrix.release }}
|
||||
ARCH: ${{ matrix.arch }}
|
||||
IMAGE: ${{ matrix.image }}
|
||||
DOCKERFILE: ${{ matrix.dockerfile }}
|
||||
CACHE: ${{ matrix.cache }}
|
||||
PUSH: ${{ matrix.push }}
|
||||
CACHE_SUFFIX: ${{ matrix.cache_suffix }}
|
||||
secrets:
|
||||
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
||||
|
||||
# Create ARM environment
|
||||
create-arm:
|
||||
uses: ./.github/workflows/create-arm.yml
|
||||
secrets:
|
||||
SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }}
|
||||
SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }}
|
||||
SCW_DEFAULT_PROJECT_ID: ${{ secrets.SCW_DEFAULT_PROJECT_ID }}
|
||||
SCW_DEFAULT_ORGANIZATION_ID: ${{ secrets.SCW_DEFAULT_ORGANIZATION_ID }}
|
||||
ARM_SSH_KEY: ${{ secrets.ARM_SSH_KEY }}
|
||||
ARM_SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }}
|
||||
|
||||
# Build arm64 + arm/v7 images
|
||||
build-containers-arm:
|
||||
needs: [create-arm]
|
||||
strategy:
|
||||
matrix:
|
||||
image: [bunkerweb, scheduler, autoconf, ui]
|
||||
arch: ["linux/arm64,linux/arm/v7"]
|
||||
include:
|
||||
- release: latest
|
||||
cache: false
|
||||
push: false
|
||||
cache_suffix: arm
|
||||
- image: bunkerweb
|
||||
dockerfile: src/bw/Dockerfile
|
||||
- image: scheduler
|
||||
dockerfile: src/scheduler/Dockerfile
|
||||
- image: autoconf
|
||||
dockerfile: src/autoconf/Dockerfile
|
||||
- image: ui
|
||||
dockerfile: src/ui/Dockerfile
|
||||
uses: ./.github/workflows/container-build.yml
|
||||
with:
|
||||
RELEASE: ${{ matrix.release }}
|
||||
ARCH: ${{ matrix.arch }}
|
||||
IMAGE: ${{ matrix.image }}
|
||||
DOCKERFILE: ${{ matrix.dockerfile }}
|
||||
CACHE: ${{ matrix.cache }}
|
||||
PUSH: ${{ matrix.push }}
|
||||
CACHE_SUFFIX: ${{ matrix.cache_suffix }}
|
||||
secrets:
|
||||
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
||||
ARM_SSH_KEY: ${{ secrets.ARM_SSH_KEY }}
|
||||
ARM_SSH_IP: ${{ needs.create-arm.outputs.ip }}
|
||||
ARM_SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }}
|
||||
|
||||
# Build Linux packages
|
||||
build-packages:
|
||||
needs: [create-arm]
|
||||
strategy:
|
||||
matrix:
|
||||
linux: [ubuntu, debian, fedora, rhel]
|
||||
platforms: [linux/amd64, linux/arm64]
|
||||
include:
|
||||
- release: latest
|
||||
- linux: ubuntu
|
||||
package: deb
|
||||
- linux: debian
|
||||
package: deb
|
||||
- linux: fedora
|
||||
package: rpm
|
||||
- linux: rhel
|
||||
package: rpm
|
||||
uses: ./.github/workflows/linux-build.yml
|
||||
with:
|
||||
RELEASE: ${{ matrix.release }}
|
||||
LINUX: ${{ matrix.linux }}
|
||||
PACKAGE: ${{ matrix.package }}
|
||||
TEST: false
|
||||
PLATFORMS: ${{ matrix.platforms }}
|
||||
secrets:
|
||||
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
||||
ARM_SSH_KEY: ${{ secrets.ARM_SSH_KEY }}
|
||||
ARM_SSH_IP: ${{ needs.create-arm.outputs.ip }}
|
||||
ARM_SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }}
|
||||
|
||||
# Wait for all builds and extract VERSION
|
||||
wait-builds:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [codeql, build-containers, build-containers-arm, build-packages]
|
||||
outputs:
|
||||
version: ${{ steps.getversion.outputs.version }}
|
||||
versionrpm: ${{ steps.getversionrpm.outputs.versionrpm }}
|
||||
steps:
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Get VERSION
|
||||
id: getversion
|
||||
run: echo "version=$(cat src/VERSION | tr -d '\n')" >> "$GITHUB_OUTPUT"
|
||||
- name: Get VERSION (for RPM based)
|
||||
id: getversionrpm
|
||||
run: echo "versionrpm=$(cat src/VERSION | tr -d '\n' | sed 's/-/_/g')" >> "$GITHUB_OUTPUT"
|
||||
|
||||
# Push Docker images
|
||||
push-images:
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
needs: [create-arm, wait-builds]
|
||||
strategy:
|
||||
matrix:
|
||||
image:
|
||||
[bunkerweb, bunkerweb-scheduler, bunkerweb-autoconf, bunkerweb-ui]
|
||||
include:
|
||||
- release: latest
|
||||
- image: bunkerweb
|
||||
cache_from: bunkerweb
|
||||
dockerfile: src/bw/Dockerfile
|
||||
- image: bunkerweb-scheduler
|
||||
cache_from: scheduler
|
||||
dockerfile: src/scheduler/Dockerfile
|
||||
- image: bunkerweb-autoconf
|
||||
cache_from: autoconf
|
||||
dockerfile: src/autoconf/Dockerfile
|
||||
- image: bunkerweb-ui
|
||||
cache_from: ui
|
||||
dockerfile: src/ui/Dockerfile
|
||||
uses: ./.github/workflows/push-docker.yml
|
||||
with:
|
||||
IMAGE: ${{ matrix.image }}
|
||||
TAGS: bunkerity/${{ matrix.image }}:${{ matrix.release }},bunkerity/${{ matrix.image }}:${{ needs.wait-builds.outputs.version }},ghcr.io/bunkerity/${{ matrix.image }}:${{ matrix.release }},ghcr.io/bunkerity/${{ matrix.image }}:${{ needs.wait-builds.outputs.version }}
|
||||
CACHE_FROM: ${{ matrix.cache_from }}-${{ matrix.release }}
|
||||
DOCKERFILE: ${{ matrix.dockerfile }}
|
||||
secrets:
|
||||
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
||||
ARM_SSH_KEY: ${{ secrets.ARM_SSH_KEY }}
|
||||
ARM_SSH_IP: ${{ needs.create-arm.outputs.ip }}
|
||||
ARM_SSH_CONFIG: ${{ secrets.ARM_SSH_CONFIG }}
|
||||
|
||||
# Push Linux packages
|
||||
push-packages:
|
||||
needs: [wait-builds]
|
||||
strategy:
|
||||
matrix:
|
||||
linux: [ubuntu, debian, fedora, el]
|
||||
arch: [amd64, arm64]
|
||||
include:
|
||||
- release: latest
|
||||
repo: bunkerweb
|
||||
- linux: ubuntu
|
||||
separator: _
|
||||
suffix: ""
|
||||
version: jammy
|
||||
package: deb
|
||||
- linux: debian
|
||||
separator: _
|
||||
suffix: ""
|
||||
version: bullseye
|
||||
package: deb
|
||||
- linux: fedora
|
||||
separator: "-"
|
||||
suffix: "1."
|
||||
version: 38
|
||||
package: rpm
|
||||
- linux: el
|
||||
separator: "-"
|
||||
suffix: "1."
|
||||
version: 8
|
||||
package: rpm
|
||||
- linux: ubuntu
|
||||
arch: amd64
|
||||
package_arch: amd64
|
||||
- linux: debian
|
||||
arch: amd64
|
||||
package_arch: amd64
|
||||
- linux: fedora
|
||||
arch: amd64
|
||||
package_arch: x86_64
|
||||
- linux: el
|
||||
arch: amd64
|
||||
package_arch: x86_64
|
||||
- linux: ubuntu
|
||||
arch: arm64
|
||||
package_arch: arm64
|
||||
- linux: debian
|
||||
arch: arm64
|
||||
package_arch: arm64
|
||||
- linux: fedora
|
||||
arch: arm64
|
||||
package_arch: aarch64
|
||||
- linux: el
|
||||
arch: arm64
|
||||
package_arch: aarch64
|
||||
uses: ./.github/workflows/push-packagecloud.yml
|
||||
with:
|
||||
SEPARATOR: ${{ matrix.separator }}
|
||||
SUFFIX: ${{ matrix.suffix }}
|
||||
REPO: ${{ matrix.repo }}
|
||||
LINUX: ${{ matrix.linux }}
|
||||
VERSION: ${{ matrix.version }}
|
||||
PACKAGE: ${{ matrix.package }}
|
||||
BW_VERSION: ${{ matrix.package == 'rpm' && needs.wait-builds.outputs.versionrpm || needs.wait-builds.outputs.version }}
|
||||
PACKAGE_ARCH: ${{ matrix.package_arch }}
|
||||
ARCH: ${{ matrix.arch }}
|
||||
secrets:
|
||||
PACKAGECLOUD_TOKEN: ${{ secrets.PACKAGECLOUD_TOKEN }}
|
||||
|
||||
# Create doc PDF
|
||||
doc-pdf:
|
||||
needs: [wait-builds, push-images, push-packages]
|
||||
uses: ./.github/workflows/doc-to-pdf.yml
|
||||
with:
|
||||
VERSION: ${{ needs.wait-builds.outputs.version }}
|
||||
|
||||
# Push on GH
|
||||
push-gh:
|
||||
needs: [wait-builds, doc-pdf]
|
||||
permissions:
|
||||
contents: write
|
||||
discussions: write
|
||||
uses: ./.github/workflows/push-github.yml
|
||||
with:
|
||||
VERSION: ${{ needs.wait-builds.outputs.version }}
|
||||
PRERELEASE: false
|
||||
|
||||
# Push doc
|
||||
push-doc:
|
||||
needs: [wait-builds, push-gh]
|
||||
permissions:
|
||||
contents: write
|
||||
uses: ./.github/workflows/push-doc.yml
|
||||
with:
|
||||
VERSION: ${{ needs.wait-builds.outputs.version }}
|
||||
ALIAS: latest
|
||||
secrets:
|
||||
BUNKERBOT_TOKEN: ${{ secrets.BUNKERBOT_TOKEN }}
|
||||
|
||||
# Remove ARM VM
|
||||
rm-arm:
|
||||
if: ${{ always() }}
|
||||
needs: [create-arm, push-images, build-packages]
|
||||
uses: ./.github/workflows/rm-arm.yml
|
||||
secrets:
|
||||
ARM_ID: ${{ needs.create-arm.outputs.id }}
|
||||
SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }}
|
||||
SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }}
|
||||
SCW_DEFAULT_PROJECT_ID: ${{ secrets.SCW_DEFAULT_PROJECT_ID }}
|
||||
SCW_DEFAULT_ORGANIZATION_ID: ${{ secrets.SCW_DEFAULT_ORGANIZATION_ID }}
|
||||
32
.github/workflows/rm-arm.yml
vendored
Normal file
32
.github/workflows/rm-arm.yml
vendored
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
name: Create ARM node (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
secrets:
|
||||
SCW_ACCESS_KEY:
|
||||
required: true
|
||||
SCW_SECRET_KEY:
|
||||
required: true
|
||||
SCW_DEFAULT_PROJECT_ID:
|
||||
required: true
|
||||
SCW_DEFAULT_ORGANIZATION_ID:
|
||||
required: true
|
||||
ARM_ID:
|
||||
required: true
|
||||
|
||||
jobs:
|
||||
rm:
|
||||
if: ${{ always() }}
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Prepare
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Delete ARM VM
|
||||
uses: scaleway/action-scw@c718eca1fcb9fec1fb1433752d61599c6a0ad2e9
|
||||
with:
|
||||
args: instance server delete ${{ secrets.ARM_ID }} zone=fr-par-2 with-ip=true with-volumes=all force-shutdown=true
|
||||
access-key: ${{ secrets.SCW_ACCESS_KEY }}
|
||||
secret-key: ${{ secrets.SCW_SECRET_KEY }}
|
||||
default-project-id: ${{ secrets.SCW_DEFAULT_PROJECT_ID }}
|
||||
default-organization-id: ${{ secrets.SCW_DEFAULT_ORGANIZATION_ID }}
|
||||
30
.github/workflows/scorecards-analysis.yml
vendored
Normal file
30
.github/workflows/scorecards-analysis.yml
vendored
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
name: Scorecard analysis workflow
|
||||
|
||||
on:
|
||||
branch_protection_rule:
|
||||
schedule:
|
||||
# Weekly on Saturdays.
|
||||
- cron: "30 1 * * 6"
|
||||
workflow_call:
|
||||
|
||||
permissions: read-all
|
||||
|
||||
jobs:
|
||||
analysis:
|
||||
name: Scorecard analysis
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: "Checkout code"
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
- name: "Run analysis"
|
||||
uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
|
||||
with:
|
||||
results_file: results.sarif
|
||||
results_format: sarif
|
||||
publish_results: true
|
||||
- name: "Upload SARIF results to code scanning"
|
||||
uses: github/codeql-action/upload-sarif@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
|
||||
with:
|
||||
sarif_file: results.sarif
|
||||
62
.github/workflows/staging-create-infra.yml
vendored
Normal file
62
.github/workflows/staging-create-infra.yml
vendored
Normal file
|
|
@ -0,0 +1,62 @@
|
|||
name: Create staging infra (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
TYPE:
|
||||
required: true
|
||||
type: string
|
||||
secrets:
|
||||
CICD_SECRETS:
|
||||
required: true
|
||||
SECRET_KEY:
|
||||
required: true
|
||||
K8S_IP:
|
||||
required: true
|
||||
|
||||
jobs:
|
||||
create:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Prepare
|
||||
- name: Generate SSH keypair
|
||||
run: ssh-keygen -b 2048 -t rsa -f ~/.ssh/id_rsa -q -N "" && ssh-keygen -f ~/.ssh/id_rsa -y > ~/.ssh/id_rsa.pub && echo -e "Host *\n StrictHostKeyChecking no" > ~/.ssh/ssh_config
|
||||
if: inputs.TYPE != 'k8s'
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Install terraform
|
||||
uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
|
||||
- name: Install kubectl
|
||||
uses: azure/setup-kubectl@901a10e89ea615cf61f57ac05cecdf23e7de06d8 # v3.2
|
||||
if: inputs.TYPE == 'k8s'
|
||||
with:
|
||||
version: "v1.28.2"
|
||||
- name: Set up Python 3.11
|
||||
uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
|
||||
if: inputs.TYPE != 'k8s'
|
||||
with:
|
||||
python-version: "3.11"
|
||||
- name: Install ansible
|
||||
run: pip install --no-cache-dir --require-hashes -r misc/requirements-ansible.txt
|
||||
if: inputs.TYPE != 'k8s'
|
||||
- name: Install ansible libs
|
||||
run: ansible-galaxy install --timeout 120 monolithprojects.github_actions_runner,1.18.1 && ansible-galaxy collection install --timeout 120 community.general
|
||||
if: inputs.TYPE != 'k8s'
|
||||
# Create infra
|
||||
- run: ./tests/create.sh ${{ inputs.TYPE }}
|
||||
env:
|
||||
CICD_SECRETS: ${{ secrets.CICD_SECRETS }}
|
||||
K8S_IP: ${{ secrets.K8S_IP }}
|
||||
- run: |
|
||||
tar -cf terraform.tar /tmp/${{ inputs.TYPE }}
|
||||
echo "$SECRET_KEY" > /tmp/.secret_key
|
||||
openssl enc -in terraform.tar -aes-256-cbc -pbkdf2 -iter 100000 -md sha256 -pass file:/tmp/.secret_key -out terraform.tar.enc
|
||||
rm -f /tmp/.secret_key
|
||||
if: always()
|
||||
env:
|
||||
SECRET_KEY: ${{ secrets.SECRET_KEY }}
|
||||
- uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
|
||||
if: always()
|
||||
with:
|
||||
name: tf-${{ inputs.TYPE }}
|
||||
path: terraform.tar.enc
|
||||
49
.github/workflows/staging-delete-infra.yml
vendored
Normal file
49
.github/workflows/staging-delete-infra.yml
vendored
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
name: Delete staging infra (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
TYPE:
|
||||
required: true
|
||||
type: string
|
||||
secrets:
|
||||
CICD_SECRETS:
|
||||
required: true
|
||||
SECRET_KEY:
|
||||
required: true
|
||||
|
||||
jobs:
|
||||
delete:
|
||||
if: ${{ always() }}
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 15
|
||||
steps:
|
||||
# Prepare
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Install terraform
|
||||
uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
|
||||
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
||||
with:
|
||||
name: tf-${{ inputs.TYPE }}
|
||||
path: /tmp
|
||||
- run: |
|
||||
echo "$SECRET_KEY" > /tmp/.secret_key
|
||||
openssl enc -d -in /tmp/terraform.tar.enc -aes-256-cbc -pbkdf2 -iter 100000 -md sha256 -pass file:/tmp/.secret_key -out /tmp/terraform.tar
|
||||
rm -f /tmp/.secret_key
|
||||
tar xf /tmp/terraform.tar -C / && mkdir ~/.ssh && touch ~/.ssh/id_rsa.pub
|
||||
env:
|
||||
SECRET_KEY: ${{ secrets.SECRET_KEY }}
|
||||
- uses: azure/setup-kubectl@901a10e89ea615cf61f57ac05cecdf23e7de06d8 # v3.2
|
||||
if: inputs.TYPE == 'k8s'
|
||||
with:
|
||||
version: "v1.28.2"
|
||||
# Remove infra
|
||||
- run: kubectl delete daemonsets,replicasets,services,deployments,pods,rc,ingress,statefulsets --all --all-namespaces --timeout=60s ; kubectl delete pvc --all --timeout=60s ; kubectl delete pv --all --timeout=60s
|
||||
if: inputs.TYPE == 'k8s'
|
||||
continue-on-error: true
|
||||
env:
|
||||
KUBECONFIG: /tmp/k8s/kubeconfig
|
||||
- run: ./tests/rm.sh ${{ inputs.TYPE }}
|
||||
env:
|
||||
CICD_SECRETS: ${{ secrets.CICD_SECRETS }}
|
||||
138
.github/workflows/staging-tests.yml
vendored
Normal file
138
.github/workflows/staging-tests.yml
vendored
Normal file
|
|
@ -0,0 +1,138 @@
|
|||
name: Perform staging tests (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
TYPE:
|
||||
required: true
|
||||
type: string
|
||||
RUNS_ON:
|
||||
required: true
|
||||
type: string
|
||||
# secrets:
|
||||
# PRIVATE_REGISTRY:
|
||||
# required: true
|
||||
# PRIVATE_REGISTRY_TOKEN:
|
||||
# required: true
|
||||
# TEST_DOMAINS:
|
||||
# required: true
|
||||
# ROOT_DOMAIN:
|
||||
# required: true
|
||||
|
||||
jobs:
|
||||
tests:
|
||||
runs-on: ${{ fromJSON(inputs.RUNS_ON) }}
|
||||
steps:
|
||||
# Prepare
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Login to ghcr
|
||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- run: docker pull ghcr.io/bunkerity/bunkerweb-tests:testing && docker tag ghcr.io/bunkerity/bunkerweb-tests:testing local/bunkerweb-tests:latest
|
||||
if: contains(fromJSON('["linux", "k8s"]'), inputs.TYPE) != true
|
||||
- run: docker pull ghcr.io/bunkerity/scheduler-tests:testing && docker tag ghcr.io/bunkerity/scheduler-tests:testing local/scheduler-tests:latest
|
||||
if: contains(fromJSON('["linux", "k8s"]'), inputs.TYPE) != true
|
||||
- run: docker pull ghcr.io/bunkerity/autoconf-tests:testing && docker tag ghcr.io/bunkerity/autoconf-tests:testing local/autoconf-tests:latest
|
||||
if: contains(fromJSON('["autoconf", "swarm"]'), inputs.TYPE)
|
||||
- name: Push images to local repo
|
||||
run: docker tag local/bunkerweb-tests:latest 192.168.42.100:5000/bunkerweb-tests:latest && docker push 192.168.42.100:5000/bunkerweb-tests:latest && docker tag local/scheduler-tests:latest 192.168.42.100:5000/scheduler-tests:latest && docker push 192.168.42.100:5000/scheduler-tests:latest && docker tag local/autoconf-tests:latest 192.168.42.100:5000/autoconf-tests:latest && docker push 192.168.42.100:5000/autoconf-tests:latest
|
||||
if: inputs.TYPE == 'swarm'
|
||||
- name: Install test dependencies
|
||||
run: pip3 install --no-cache-dir --require-hashes -r tests/requirements.txt
|
||||
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
||||
with:
|
||||
name: tf-k8s
|
||||
path: /tmp
|
||||
if: inputs.TYPE == 'k8s'
|
||||
- run: |
|
||||
echo "$SECRET_KEY" > /tmp/.secret_key
|
||||
openssl enc -d -in /tmp/terraform.tar.enc -aes-256-cbc -pbkdf2 -iter 100000 -md sha256 -pass file:/tmp/.secret_key -out /tmp/terraform.tar
|
||||
rm -f /tmp/.secret_key
|
||||
tar xf /tmp/terraform.tar -C /
|
||||
mkdir /tmp/reg
|
||||
cp tests/terraform/k8s-reg.tf /tmp/reg
|
||||
cp tests/terraform/providers.tf /tmp/reg
|
||||
cd /tmp/reg
|
||||
export TF_VAR_k8s_reg_user=${REG_USER}
|
||||
export TF_VAR_k8s_reg_token=${REG_TOKEN}
|
||||
terraform init
|
||||
terraform apply -auto-approve
|
||||
env:
|
||||
SECRET_KEY: ${{ secrets.SECRET_KEY }}
|
||||
REG_USER: ${{ github.actor }}
|
||||
REG_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
if: inputs.TYPE == 'k8s'
|
||||
- uses: azure/setup-kubectl@901a10e89ea615cf61f57ac05cecdf23e7de06d8 # v3.2
|
||||
if: inputs.TYPE == 'k8s'
|
||||
with:
|
||||
version: "v1.28.2"
|
||||
- uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
|
||||
if: inputs.TYPE == 'k8s'
|
||||
- name: Pull BW linux ubuntu test image
|
||||
if: inputs.TYPE == 'linux'
|
||||
run: docker pull ghcr.io/bunkerity/ubuntu-tests:testing && docker tag ghcr.io/bunkerity/ubuntu-tests:testing local/ubuntu:latest
|
||||
- name: Pull BW linux debian test image
|
||||
if: inputs.TYPE == 'linux'
|
||||
run: docker pull ghcr.io/bunkerity/debian-tests:testing && docker tag ghcr.io/bunkerity/debian-tests:testing local/debian:latest
|
||||
- name: Pull BW linux fedora test image
|
||||
if: inputs.TYPE == 'linux'
|
||||
run: docker pull ghcr.io/bunkerity/fedora-tests:testing && docker tag ghcr.io/bunkerity/fedora-tests:testing local/fedora:latest
|
||||
- name: Pull BW linux rhel test image
|
||||
if: inputs.TYPE == 'linux'
|
||||
run: docker pull ghcr.io/bunkerity/rhel-tests:testing && docker tag ghcr.io/bunkerity/rhel-tests:testing local/rhel:latest
|
||||
# Do tests
|
||||
- name: Run tests
|
||||
if: inputs.TYPE == 'docker'
|
||||
run: export $(echo "$TEST_DOMAINS" | xargs) && ./tests/main.py "${{ inputs.TYPE }}"
|
||||
env:
|
||||
TEST_DOMAINS: ${{ secrets.TEST_DOMAINS_DOCKER }}
|
||||
ROOT_DOMAIN: ${{ secrets.ROOT_DOMAIN }}
|
||||
- name: Run tests
|
||||
if: inputs.TYPE == 'autoconf'
|
||||
run: export $(echo "$TEST_DOMAINS" | xargs) && ./tests/main.py "${{ inputs.TYPE }}"
|
||||
env:
|
||||
TEST_DOMAINS: ${{ secrets.TEST_DOMAINS_AUTOCONF }}
|
||||
ROOT_DOMAIN: ${{ secrets.ROOT_DOMAIN }}
|
||||
- name: Run tests
|
||||
if: inputs.TYPE == 'swarm'
|
||||
run: export $(echo "$TEST_DOMAINS" | xargs) && ./tests/main.py "${{ inputs.TYPE }}"
|
||||
env:
|
||||
TEST_DOMAINS: ${{ secrets.TEST_DOMAINS_SWARM }}
|
||||
ROOT_DOMAIN: ${{ secrets.ROOT_DOMAIN }}
|
||||
- name: Run tests
|
||||
if: inputs.TYPE == 'k8s'
|
||||
run: export $(echo "$TEST_DOMAINS" | xargs) && ./tests/main.py "kubernetes"
|
||||
env:
|
||||
TEST_DOMAINS: ${{ secrets.TEST_DOMAINS_KUBERNETES }}
|
||||
ROOT_DOMAIN: ${{ secrets.ROOT_DOMAIN }}
|
||||
KUBECONFIG: "/tmp/k8s/kubeconfig"
|
||||
PRIVATE_REGISTRY: ${{ secrets.PRIVATE_REGISTRY }}
|
||||
IMAGE_TAG: "testing"
|
||||
- name: Run Linux ubuntu tests
|
||||
if: inputs.TYPE == 'linux'
|
||||
run: export $(echo "$TEST_DOMAINS" | xargs) && ./tests/main.py "linux" "ubuntu"
|
||||
env:
|
||||
TEST_DOMAINS: ${{ secrets.TEST_DOMAINS_LINUX }}
|
||||
ROOT_DOMAIN: ${{ secrets.ROOT_DOMAIN }}
|
||||
- name: Run Linux debian tests
|
||||
if: inputs.TYPE == 'linux'
|
||||
run: export $(echo "$TEST_DOMAINS" | xargs) && ./tests/main.py "linux" "debian"
|
||||
env:
|
||||
TEST_DOMAINS: ${{ secrets.TEST_DOMAINS_LINUX }}
|
||||
ROOT_DOMAIN: ${{ secrets.ROOT_DOMAIN }}
|
||||
- name: Run Linux fedora tests
|
||||
if: inputs.TYPE == 'linux'
|
||||
run: export $(echo "$TEST_DOMAINS" | xargs) && ./tests/main.py "linux" "fedora"
|
||||
env:
|
||||
TEST_DOMAINS: ${{ secrets.TEST_DOMAINS_LINUX }}
|
||||
ROOT_DOMAIN: ${{ secrets.ROOT_DOMAIN }}
|
||||
- name: Run Linux rhel tests
|
||||
if: inputs.TYPE == 'linux'
|
||||
run: export $(echo "$TEST_DOMAINS" | xargs) && ./tests/main.py "linux" "rhel"
|
||||
env:
|
||||
TEST_DOMAINS: ${{ secrets.TEST_DOMAINS_LINUX }}
|
||||
ROOT_DOMAIN: ${{ secrets.ROOT_DOMAIN }}
|
||||
273
.github/workflows/staging.yml
vendored
Normal file
273
.github/workflows/staging.yml
vendored
Normal file
|
|
@ -0,0 +1,273 @@
|
|||
name: Automatic tests (STAGING)
|
||||
|
||||
permissions: read-all
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [staging]
|
||||
|
||||
jobs:
|
||||
# Build Docker images
|
||||
build-containers:
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
strategy:
|
||||
matrix:
|
||||
image: [bunkerweb, scheduler, autoconf, ui]
|
||||
include:
|
||||
- image: bunkerweb
|
||||
dockerfile: src/bw/Dockerfile
|
||||
- image: scheduler
|
||||
dockerfile: src/scheduler/Dockerfile
|
||||
- image: autoconf
|
||||
dockerfile: src/autoconf/Dockerfile
|
||||
- image: ui
|
||||
dockerfile: src/ui/Dockerfile
|
||||
uses: ./.github/workflows/container-build.yml
|
||||
with:
|
||||
RELEASE: testing
|
||||
ARCH: linux/amd64
|
||||
CACHE: true
|
||||
PUSH: true
|
||||
IMAGE: ${{ matrix.image }}
|
||||
DOCKERFILE: ${{ matrix.dockerfile }}
|
||||
secrets:
|
||||
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
||||
|
||||
# Build Linux packages
|
||||
build-packages:
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
strategy:
|
||||
matrix:
|
||||
linux: [ubuntu, debian, fedora, rhel]
|
||||
include:
|
||||
- linux: ubuntu
|
||||
package: deb
|
||||
- linux: debian
|
||||
package: deb
|
||||
- linux: fedora
|
||||
package: rpm
|
||||
- linux: rhel
|
||||
package: rpm
|
||||
uses: ./.github/workflows/linux-build.yml
|
||||
with:
|
||||
RELEASE: testing
|
||||
LINUX: ${{ matrix.linux }}
|
||||
PACKAGE: ${{ matrix.package }}
|
||||
TEST: true
|
||||
PLATFORMS: linux/amd64
|
||||
secrets:
|
||||
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
||||
|
||||
codeql:
|
||||
uses: ./.github/workflows/codeql.yml
|
||||
permissions:
|
||||
actions: read
|
||||
contents: read
|
||||
security-events: write
|
||||
|
||||
# Create infrastructures and prepare tests
|
||||
create-infras:
|
||||
needs: [codeql, build-containers, build-packages]
|
||||
strategy:
|
||||
matrix:
|
||||
type: [docker, autoconf, swarm, k8s, linux]
|
||||
uses: ./.github/workflows/staging-create-infra.yml
|
||||
with:
|
||||
TYPE: ${{ matrix.type }}
|
||||
secrets:
|
||||
CICD_SECRETS: ${{ secrets.CICD_SECRETS }}
|
||||
SECRET_KEY: ${{ secrets.SECRET_KEY }}
|
||||
K8S_IP: ${{ secrets.K8S_IP }}
|
||||
prepare-tests-core:
|
||||
needs: [codeql, build-containers, build-packages]
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- id: set-matrix
|
||||
run: |
|
||||
tests=$(find ./tests/core/ -maxdepth 1 -mindepth 1 -type d -printf "%f\n" | jq -c --raw-input --slurp 'split("\n")| .[0:-1]')
|
||||
echo "tests=$tests" >> $GITHUB_OUTPUT
|
||||
outputs:
|
||||
tests: ${{ steps.set-matrix.outputs.tests }}
|
||||
|
||||
# Perform tests
|
||||
tests-ui:
|
||||
needs: [codeql, build-containers]
|
||||
uses: ./.github/workflows/tests-ui.yml
|
||||
with:
|
||||
RELEASE: testing
|
||||
tests-ui-linux:
|
||||
needs: [codeql, build-packages]
|
||||
uses: ./.github/workflows/tests-ui-linux.yml
|
||||
with:
|
||||
RELEASE: testing
|
||||
staging-tests:
|
||||
needs: [create-infras]
|
||||
strategy:
|
||||
matrix:
|
||||
type: [docker, autoconf, swarm, k8s, linux]
|
||||
include:
|
||||
- type: docker
|
||||
runs_on: "['self-hosted', 'bw-docker']"
|
||||
- type: autoconf
|
||||
runs_on: "['self-hosted', 'bw-autoconf']"
|
||||
- type: swarm
|
||||
runs_on: "['self-hosted', 'bw-swarm']"
|
||||
- type: k8s
|
||||
runs_on: "['ubuntu-latest']"
|
||||
- type: linux
|
||||
runs_on: "['self-hosted', 'bw-linux']"
|
||||
uses: ./.github/workflows/staging-tests.yml
|
||||
with:
|
||||
TYPE: ${{ matrix.type }}
|
||||
RUNS_ON: ${{ matrix.runs_on }}
|
||||
secrets: inherit
|
||||
tests-core:
|
||||
needs: prepare-tests-core
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
test: ${{ fromJson(needs.prepare-tests-core.outputs.tests) }}
|
||||
uses: ./.github/workflows/test-core.yml
|
||||
with:
|
||||
TEST: ${{ matrix.test }}
|
||||
RELEASE: testing
|
||||
tests-core-linux:
|
||||
needs: prepare-tests-core
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
test: ${{ fromJson(needs.prepare-tests-core.outputs.tests) }}
|
||||
uses: ./.github/workflows/test-core-linux.yml
|
||||
with:
|
||||
TEST: ${{ matrix.test }}
|
||||
RELEASE: testing
|
||||
secrets: inherit
|
||||
|
||||
# Delete infrastructures
|
||||
delete-infras:
|
||||
if: ${{ always() }}
|
||||
needs: [staging-tests]
|
||||
strategy:
|
||||
matrix:
|
||||
type: [docker, autoconf, swarm, k8s, linux]
|
||||
uses: ./.github/workflows/staging-delete-infra.yml
|
||||
with:
|
||||
TYPE: ${{ matrix.type }}
|
||||
secrets:
|
||||
CICD_SECRETS: ${{ secrets.CICD_SECRETS }}
|
||||
SECRET_KEY: ${{ secrets.SECRET_KEY }}
|
||||
|
||||
# Push Docker images
|
||||
push-images:
|
||||
needs: [staging-tests, tests-ui, tests-core]
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
steps:
|
||||
- name: Login to Docker Hub
|
||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_USERNAME }}
|
||||
password: ${{ secrets.DOCKER_TOKEN }}
|
||||
- name: Login to ghcr
|
||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Push BW image
|
||||
run: docker pull ghcr.io/bunkerity/bunkerweb-tests:testing && docker tag ghcr.io/bunkerity/bunkerweb-tests:testing bunkerity/bunkerweb:testing && docker push bunkerity/bunkerweb:testing && docker tag bunkerity/bunkerweb:testing ghcr.io/bunkerity/bunkerweb:testing && docker push ghcr.io/bunkerity/bunkerweb:testing
|
||||
- name: Push scheduler image
|
||||
run: docker pull ghcr.io/bunkerity/scheduler-tests:testing && docker tag ghcr.io/bunkerity/scheduler-tests:testing bunkerity/bunkerweb-scheduler:testing && docker push bunkerity/bunkerweb-scheduler:testing && docker tag bunkerity/bunkerweb-scheduler:testing ghcr.io/bunkerity/bunkerweb-scheduler:testing && docker push ghcr.io/bunkerity/bunkerweb-scheduler:testing
|
||||
- name: Push UI image
|
||||
run: docker pull ghcr.io/bunkerity/ui-tests:testing && docker tag ghcr.io/bunkerity/ui-tests:testing bunkerity/bunkerweb-ui:testing && docker push bunkerity/bunkerweb-ui:testing && docker tag bunkerity/bunkerweb-ui:testing ghcr.io/bunkerity/bunkerweb-ui:testing && docker push ghcr.io/bunkerity/bunkerweb-ui:testing
|
||||
- name: Push autoconf image
|
||||
run: docker pull ghcr.io/bunkerity/autoconf-tests:testing && docker tag ghcr.io/bunkerity/autoconf-tests:testing bunkerity/bunkerweb-autoconf:testing && docker push bunkerity/bunkerweb-autoconf:testing && docker tag bunkerity/bunkerweb-autoconf:testing ghcr.io/bunkerity/bunkerweb-autoconf:testing && docker push ghcr.io/bunkerity/bunkerweb-autoconf:testing
|
||||
|
||||
# Push Linux packages
|
||||
push-packages:
|
||||
needs: [staging-tests, tests-ui-linux, tests-core-linux]
|
||||
strategy:
|
||||
matrix:
|
||||
linux: [ubuntu, debian, fedora, el]
|
||||
arch: [amd64]
|
||||
include:
|
||||
- release: testing
|
||||
repo: bunkerweb
|
||||
- linux: ubuntu
|
||||
separator: _
|
||||
suffix: ""
|
||||
version: jammy
|
||||
package: deb
|
||||
- linux: debian
|
||||
separator: _
|
||||
suffix: ""
|
||||
version: bullseye
|
||||
package: deb
|
||||
- linux: fedora
|
||||
separator: "-"
|
||||
suffix: "1."
|
||||
version: 38
|
||||
package: rpm
|
||||
- linux: el
|
||||
separator: "-"
|
||||
suffix: "1."
|
||||
version: 8
|
||||
package: rpm
|
||||
- linux: ubuntu
|
||||
arch: amd64
|
||||
package_arch: amd64
|
||||
- linux: debian
|
||||
arch: amd64
|
||||
package_arch: amd64
|
||||
- linux: fedora
|
||||
arch: amd64
|
||||
package_arch: x86_64
|
||||
- linux: el
|
||||
arch: amd64
|
||||
package_arch: x86_64
|
||||
uses: ./.github/workflows/push-packagecloud.yml
|
||||
with:
|
||||
SEPARATOR: ${{ matrix.separator }}
|
||||
SUFFIX: ${{ matrix.suffix }}
|
||||
REPO: ${{ matrix.repo }}
|
||||
LINUX: ${{ matrix.linux }}
|
||||
VERSION: ${{ matrix.version }}
|
||||
PACKAGE: ${{ matrix.package }}
|
||||
BW_VERSION: ${{ matrix.release }}
|
||||
PACKAGE_ARCH: ${{ matrix.package_arch }}
|
||||
ARCH: ${{ matrix.arch }}
|
||||
secrets:
|
||||
PACKAGECLOUD_TOKEN: ${{ secrets.PACKAGECLOUD_TOKEN }}
|
||||
|
||||
# Push doc
|
||||
push-doc:
|
||||
needs: [push-images, push-packages]
|
||||
permissions:
|
||||
contents: write
|
||||
uses: ./.github/workflows/push-doc.yml
|
||||
with:
|
||||
VERSION: testing
|
||||
ALIAS: unstable
|
||||
secrets:
|
||||
BUNKERBOT_TOKEN: ${{ secrets.BUNKERBOT_TOKEN }}
|
||||
|
||||
# Push on GH
|
||||
push-gh:
|
||||
needs: [push-doc]
|
||||
permissions:
|
||||
contents: write
|
||||
discussions: write
|
||||
uses: ./.github/workflows/push-github.yml
|
||||
with:
|
||||
VERSION: testing
|
||||
PRERELEASE: true
|
||||
97
.github/workflows/test-core-linux.yml
vendored
Normal file
97
.github/workflows/test-core-linux.yml
vendored
Normal file
|
|
@ -0,0 +1,97 @@
|
|||
name: Core test Linux (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
TEST:
|
||||
required: true
|
||||
type: string
|
||||
RELEASE:
|
||||
required: true
|
||||
type: string
|
||||
|
||||
jobs:
|
||||
tests:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Prepare
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Set up Python 3.11
|
||||
uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
|
||||
with:
|
||||
python-version: "3.11"
|
||||
- name: Install Firefox manually and dependencies
|
||||
run: |
|
||||
sudo apt purge -y firefox
|
||||
sudo apt update
|
||||
sudo apt install --no-install-recommends -y openssl git nodejs tar bzip2 wget curl grep libx11-xcb1 libappindicator3-1 libasound2 libdbus-glib-1-2 libxtst6 libxt6 php-fpm unzip
|
||||
wget -O firefox-setup.tar.bz2 "https://download.mozilla.org/?product=firefox-latest-ssl&os=linux64"
|
||||
sudo tar -xjf firefox-setup.tar.bz2 -C /opt/
|
||||
sudo rm -f /usr/bin/firefox
|
||||
sudo ln -s /opt/firefox/firefox /usr/bin/firefox
|
||||
sudo chmod 755 /opt/firefox /opt/firefox/firefox
|
||||
rm -f firefox-setup.tar.bz2
|
||||
- name: Download geckodriver
|
||||
uses: nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0
|
||||
with:
|
||||
max_attempts: 3
|
||||
timeout_minutes: 20
|
||||
command: |
|
||||
GECKODRIVER_VERSION=`curl -i https://github.com/mozilla/geckodriver/releases/latest | grep -Po 'v[0-9]+\.[0-9]+\.[0-9]+'` && \
|
||||
wget -O geckodriver.tar.gz -w 5 https://github.com/mozilla/geckodriver/releases/download/$GECKODRIVER_VERSION/geckodriver-$GECKODRIVER_VERSION-linux64.tar.gz
|
||||
sudo tar -xzf geckodriver.tar.gz -C /usr/local/bin
|
||||
sudo chmod +x /usr/local/bin/geckodriver
|
||||
rm -f geckodriver.tar.gz
|
||||
- name: Login to ghcr
|
||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Pull BW linux ubuntu test image
|
||||
run: docker pull ghcr.io/bunkerity/ubuntu-tests:${{ inputs.RELEASE }}
|
||||
- name: Copy deb file to host
|
||||
run: |
|
||||
container_id=$(docker create "ghcr.io/bunkerity/ubuntu-tests:${{ inputs.RELEASE }}")
|
||||
docker cp "$container_id:/opt/bunkerweb_${{ inputs.RELEASE }}-1_amd64.deb" "/tmp/bunkerweb.deb"
|
||||
docker rm "$container_id"
|
||||
- name: Install BunkerWeb
|
||||
run: |
|
||||
sudo apt install -y gnupg2 ca-certificates lsb-release ubuntu-keyring
|
||||
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
|
||||
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://nginx.org/packages/ubuntu `lsb_release -cs` nginx" | sudo tee /etc/apt/sources.list.d/nginx.list
|
||||
sudo apt update
|
||||
sudo apt install -y nginx=1.24.0-1~jammy
|
||||
- name: Fix version without a starting number
|
||||
if: inputs.RELEASE == 'testing' || inputs.RELEASE == 'dev'
|
||||
run: echo "force-bad-version" | sudo tee -a /etc/dpkg/dpkg.cfg
|
||||
- name: Edit configuration files
|
||||
run: |
|
||||
# Misc
|
||||
echo "127.0.0.1 www.example.com" | sudo tee -a /etc/hosts
|
||||
echo "127.0.0.1 app1.example.com" | sudo tee -a /etc/hosts
|
||||
echo "127.0.0.1 bwadm.example.com" | sudo tee -a /etc/hosts
|
||||
sudo cp ./tests/www-deb.conf /etc/php/8.1/fpm/pool.d/www.conf
|
||||
sudo systemctl stop php8.1-fpm
|
||||
sudo systemctl start php8.1-fpm
|
||||
# BunkerWeb
|
||||
sudo mkdir -p /etc/bunkerweb
|
||||
echo "SERVER_NAME=www.example.com" | sudo tee /etc/bunkerweb/variables.env
|
||||
echo "HTTP_PORT=80" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "HTTPS_PORT=443" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo 'DNS_RESOLVERS=9.9.9.9 8.8.8.8 8.8.4.4' | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo 'API_LISTEN_IP=127.0.0.1' | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "USE_BUNKERNET=no" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "USE_BLACKLIST=no" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "LOG_LEVEL=info" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
sudo chown nginx:nginx /etc/bunkerweb/variables.env
|
||||
sudo chmod 777 /etc/bunkerweb/variables.env
|
||||
- name: Install BunkerWeb
|
||||
run: sudo apt install -fy /tmp/bunkerweb.deb
|
||||
- name: Run tests
|
||||
run: |
|
||||
cd ./tests/core/${{ inputs.TEST }}
|
||||
MAKEFLAGS="-j $(nproc)" find . -name "requirements.txt" -exec pip install --no-cache-dir --require-hashes -r {} \;
|
||||
sudo truncate -s 0 /var/log/bunkerweb/error.log
|
||||
./test.sh "linux"
|
||||
36
.github/workflows/test-core.yml
vendored
Normal file
36
.github/workflows/test-core.yml
vendored
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
name: Core test (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
TEST:
|
||||
required: true
|
||||
type: string
|
||||
RELEASE:
|
||||
required: true
|
||||
type: string
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Prepare
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Login to ghcr
|
||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Pull BW image
|
||||
run: docker pull ghcr.io/bunkerity/bunkerweb-tests:${{ inputs.RELEASE }} && docker tag ghcr.io/bunkerity/bunkerweb-tests:${{ inputs.RELEASE }} bunkerweb-tests
|
||||
- name: Pull Scheduler image
|
||||
run: docker pull ghcr.io/bunkerity/scheduler-tests:${{ inputs.RELEASE }} && docker tag ghcr.io/bunkerity/scheduler-tests:${{ inputs.RELEASE }} scheduler-tests
|
||||
# Run test
|
||||
- name: Run test
|
||||
run: |
|
||||
cd ./tests/core/${{ inputs.TEST }}
|
||||
find . -type f -name 'docker-compose.*' -exec sed -i "s@bunkerity/bunkerweb:.*@bunkerweb-tests@" {} \;
|
||||
find . -type f -name 'docker-compose.*' -exec sed -i "s@bunkerity/bunkerweb-scheduler:.*@scheduler-tests@" {} \;
|
||||
./test.sh "docker"
|
||||
118
.github/workflows/tests-ui-linux.yml
vendored
Normal file
118
.github/workflows/tests-ui-linux.yml
vendored
Normal file
|
|
@ -0,0 +1,118 @@
|
|||
name: Core test Linux (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
RELEASE:
|
||||
required: true
|
||||
type: string
|
||||
|
||||
jobs:
|
||||
tests:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Prepare
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Set up Python 3.11
|
||||
uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
|
||||
with:
|
||||
python-version: "3.11"
|
||||
- name: Install Firefox manually and dependencies
|
||||
run: |
|
||||
sudo apt purge -y firefox
|
||||
sudo apt update
|
||||
sudo apt install --no-install-recommends -y zip nodejs tar bzip2 wget curl grep libx11-xcb1 libappindicator3-1 libasound2 libdbus-glib-1-2 libxtst6 libxt6
|
||||
wget -O firefox-setup.tar.bz2 "https://download.mozilla.org/?product=firefox-latest-ssl&os=linux64"
|
||||
sudo tar -xjf firefox-setup.tar.bz2 -C /opt/
|
||||
sudo rm -f /usr/bin/firefox
|
||||
sudo ln -s /opt/firefox/firefox /usr/bin/firefox
|
||||
sudo chmod 755 /opt/firefox /opt/firefox/firefox
|
||||
rm -f firefox-setup.tar.bz2
|
||||
- name: Download geckodriver
|
||||
uses: nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2.9.0
|
||||
with:
|
||||
max_attempts: 3
|
||||
timeout_minutes: 20
|
||||
command: |
|
||||
GECKODRIVER_VERSION=`curl -i https://github.com/mozilla/geckodriver/releases/latest | grep -Po 'v[0-9]+\.[0-9]+\.[0-9]+'` && \
|
||||
wget -O geckodriver.tar.gz -w 5 https://github.com/mozilla/geckodriver/releases/download/$GECKODRIVER_VERSION/geckodriver-$GECKODRIVER_VERSION-linux64.tar.gz
|
||||
sudo tar -xzf geckodriver.tar.gz -C /usr/local/bin
|
||||
sudo chmod +x /usr/local/bin/geckodriver
|
||||
rm -f geckodriver.tar.gz
|
||||
- name: Login to ghcr
|
||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Pull BW linux ubuntu test image
|
||||
run: docker pull ghcr.io/bunkerity/ubuntu-tests:${{ inputs.RELEASE }}
|
||||
- name: Copy deb file to host
|
||||
run: |
|
||||
container_id=$(docker create "ghcr.io/bunkerity/ubuntu-tests:${{ inputs.RELEASE }}")
|
||||
docker cp "$container_id:/opt/bunkerweb_${{ inputs.RELEASE }}-1_amd64.deb" "/tmp/bunkerweb.deb"
|
||||
docker rm "$container_id"
|
||||
- name: Install BunkerWeb
|
||||
run: |
|
||||
sudo apt install -y gnupg2 ca-certificates lsb-release ubuntu-keyring
|
||||
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
|
||||
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://nginx.org/packages/ubuntu `lsb_release -cs` nginx" | sudo tee /etc/apt/sources.list.d/nginx.list
|
||||
sudo apt update
|
||||
sudo apt install -y nginx=1.24.0-1~jammy
|
||||
- name: Fix version without a starting number
|
||||
if: inputs.RELEASE == 'testing' || inputs.RELEASE == 'dev' || inputs.RELEASE == 'ui'
|
||||
run: echo "force-bad-version" | sudo tee -a /etc/dpkg/dpkg.cfg
|
||||
- name: Install BunkerWeb
|
||||
run: sudo apt install -fy /tmp/bunkerweb.deb
|
||||
- name: Edit configuration files
|
||||
run: |
|
||||
# Misc
|
||||
echo "127.0.0.1 www.example.com" | sudo tee -a /etc/hosts
|
||||
echo "127.0.0.1 app1.example.com" | sudo tee -a /etc/hosts
|
||||
# BunkerWeb
|
||||
echo "SERVER_NAME=www.example.com" | sudo tee /etc/bunkerweb/variables.env
|
||||
echo "HTTP_PORT=80" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "HTTPS_PORT=443" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo 'DNS_RESOLVERS=9.9.9.9 8.8.8.8 8.8.4.4' | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo 'API_LISTEN_IP=127.0.0.1' | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "MULTISITE=yes" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "LOG_LEVEL=info" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "USE_BUNKERNET=no" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "USE_BLACKLIST=no" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "DISABLE_DEFAULT_SERVER=yes" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "USE_CLIENT_CACHE=yes" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "USE_GZIP=yes" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "DATASTORE_MEMORY_SIZE=384m" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "www.example.com_USE_UI=yes" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "www.example.com_SERVE_FILES=no" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "www.example.com_USE_REVERSE_PROXY=yes" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "www.example.com_REVERSE_PROXY_URL=/admin" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "www.example.com_REVERSE_PROXY_HOST=http://127.0.0.1:7000" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
echo "www.example.com_INTERCEPTED_ERROR_CODES=400 405 413 429 500 501 502 503 504" | sudo tee -a /etc/bunkerweb/variables.env
|
||||
|
||||
echo "ADMIN_USERNAME=admin" | sudo tee /etc/bunkerweb/ui.env
|
||||
echo "ADMIN_PASSWORD=S\$cr3tP@ssw0rd" | sudo tee -a /etc/bunkerweb/ui.env
|
||||
|
||||
sudo chown nginx:nginx /etc/bunkerweb/variables.env /etc/bunkerweb/ui.env
|
||||
sudo chmod 777 /etc/bunkerweb/variables.env /etc/bunkerweb/ui.env
|
||||
- name: Run tests
|
||||
run: |
|
||||
cd ./tests/ui
|
||||
MAKEFLAGS="-j $(nproc)" find . -name "requirements.txt" -exec pip install --no-cache-dir --require-hashes -r {} \;
|
||||
touch test.txt
|
||||
zip test.zip test.txt
|
||||
rm test.txt
|
||||
echo '{
|
||||
"id": "discord",
|
||||
"name": "Discord",
|
||||
"description": "Send alerts to a Discord channel (using webhooks).",
|
||||
"version": "0.1",
|
||||
"stream": "no",
|
||||
"settings": {}
|
||||
}' | tee plugin.json
|
||||
zip discord.zip plugin.json
|
||||
rm plugin.json
|
||||
./tests.sh "linux"
|
||||
env:
|
||||
MODE: ${{ inputs.RELEASE }}
|
||||
34
.github/workflows/tests-ui.yml
vendored
Normal file
34
.github/workflows/tests-ui.yml
vendored
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
name: Perform tests for UI (REUSABLE)
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
RELEASE:
|
||||
required: true
|
||||
type: string
|
||||
jobs:
|
||||
tests:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Prepare
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Login to ghcr
|
||||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Pull BW image
|
||||
run: docker pull ghcr.io/bunkerity/bunkerweb-tests:${{ inputs.RELEASE }} && docker tag ghcr.io/bunkerity/bunkerweb-tests:${{ inputs.RELEASE }} bunkerweb-tests
|
||||
- name: Pull Scheduler image
|
||||
run: docker pull ghcr.io/bunkerity/scheduler-tests:${{ inputs.RELEASE }} && docker tag ghcr.io/bunkerity/scheduler-tests:${{ inputs.RELEASE }} scheduler-tests
|
||||
- name: Pull UI image
|
||||
run: docker pull ghcr.io/bunkerity/ui-tests:${{ inputs.RELEASE }} && docker tag ghcr.io/bunkerity/ui-tests:${{ inputs.RELEASE }} ui-tests
|
||||
# Do tests
|
||||
- name: Run tests
|
||||
run: |
|
||||
cd ./tests/ui
|
||||
./tests.sh "docker"
|
||||
env:
|
||||
MODE: ${{ inputs.RELEASE }}
|
||||
75
.github/workflows/ui.yml
vendored
Normal file
75
.github/workflows/ui.yml
vendored
Normal file
|
|
@ -0,0 +1,75 @@
|
|||
name: Automatic tests (UI)
|
||||
|
||||
permissions: read-all
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ui]
|
||||
|
||||
jobs:
|
||||
# Containers
|
||||
build-containers:
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
strategy:
|
||||
matrix:
|
||||
image: [bunkerweb, scheduler, ui]
|
||||
include:
|
||||
- image: bunkerweb
|
||||
dockerfile: src/bw/Dockerfile
|
||||
- image: scheduler
|
||||
dockerfile: src/scheduler/Dockerfile
|
||||
- image: ui
|
||||
dockerfile: src/ui/Dockerfile
|
||||
uses: ./.github/workflows/container-build.yml
|
||||
with:
|
||||
RELEASE: ui
|
||||
CACHE: true
|
||||
ARCH: linux/amd64
|
||||
IMAGE: ${{ matrix.image }}
|
||||
DOCKERFILE: ${{ matrix.dockerfile }}
|
||||
secrets:
|
||||
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
||||
|
||||
# Build Linux packages
|
||||
build-packages:
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
strategy:
|
||||
matrix:
|
||||
linux: [ubuntu]
|
||||
include:
|
||||
- linux: ubuntu
|
||||
package: deb
|
||||
uses: ./.github/workflows/linux-build.yml
|
||||
with:
|
||||
RELEASE: ui
|
||||
LINUX: ${{ matrix.linux }}
|
||||
PACKAGE: ${{ matrix.package }}
|
||||
TEST: true
|
||||
PLATFORMS: linux/amd64
|
||||
secrets:
|
||||
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
|
||||
|
||||
codeql:
|
||||
uses: ./.github/workflows/codeql.yml
|
||||
permissions:
|
||||
actions: read
|
||||
contents: read
|
||||
security-events: write
|
||||
|
||||
# UI tests
|
||||
tests-ui:
|
||||
needs: [codeql, build-containers]
|
||||
uses: ./.github/workflows/tests-ui.yml
|
||||
with:
|
||||
RELEASE: ui
|
||||
tests-ui-linux:
|
||||
needs: [codeql, build-packages]
|
||||
uses: ./.github/workflows/tests-ui-linux.yml
|
||||
with:
|
||||
RELEASE: ui
|
||||
62
.gitignore
vendored
62
.gitignore
vendored
|
|
@ -1,54 +1,8 @@
|
|||
reindex
|
||||
.libs
|
||||
*.swp
|
||||
*.slo
|
||||
*.la
|
||||
*.swo
|
||||
*.lo
|
||||
*~
|
||||
*.o
|
||||
print.txt
|
||||
.rsync
|
||||
*.tar.gz
|
||||
dist
|
||||
build[78]
|
||||
build
|
||||
tags
|
||||
update-readme
|
||||
*.tmp
|
||||
test/Makefile
|
||||
test/blib
|
||||
test.sh
|
||||
t.sh
|
||||
t/t.sh
|
||||
test/t/servroot/
|
||||
releng
|
||||
reset
|
||||
*.t_
|
||||
genmobi.sh
|
||||
*.mobi
|
||||
misc/chunked
|
||||
src/headers.c
|
||||
src/headers.h
|
||||
src/module.c
|
||||
src/module.h
|
||||
src/util.c
|
||||
src/util.h
|
||||
go
|
||||
ctags
|
||||
src/in.c
|
||||
src/in.h
|
||||
src/out.c
|
||||
src/out.h
|
||||
build[89]
|
||||
build1[0-9]
|
||||
buildroot/
|
||||
work/
|
||||
all
|
||||
t/servroot
|
||||
analyze
|
||||
cov
|
||||
nginx
|
||||
*.plist
|
||||
a.patch
|
||||
Makefile
|
||||
site/
|
||||
.idea/
|
||||
.vscode/
|
||||
__pycache__
|
||||
env
|
||||
node_modules
|
||||
/src/ui/*.txt
|
||||
.mypy_cache
|
||||
|
|
|
|||
2
.luacheckrc
Normal file
2
.luacheckrc
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
globals = {"ngx", "delay", "unpack"}
|
||||
ignore = {"411"}
|
||||
77
.pre-commit-config.yaml
Normal file
77
.pre-commit-config.yaml
Normal file
|
|
@ -0,0 +1,77 @@
|
|||
# See https://pre-commit.com for more information
|
||||
# See https://pre-commit.com/hooks.html for more hooks
|
||||
exclude: (^LICENSE.md$|^src/VERSION$|^src/(bw/misc/root-ca.pem$|deps/src/|common/core/modsecurity/files|ui/static/js/(editor/|utils/purify/|tsparticles\.bundle\.min\.js))|\.(svg|drawio|patch\d?|ascii|tf|tftpl)$)
|
||||
repos:
|
||||
- repo: https://github.com/pre-commit/pre-commit-hooks
|
||||
rev: c4a0b883114b00d8d76b479c820ce7950211c99b # frozen: v4.5.0
|
||||
hooks:
|
||||
- id: requirements-txt-fixer
|
||||
name: Fix requirements.txt and requirements.in files
|
||||
description: Sorts entries in requirements.txt and requirements.in files.
|
||||
files: (requirements|constraints).*\.(txt|in)$
|
||||
- id: trailing-whitespace
|
||||
- id: end-of-file-fixer
|
||||
- id: check-yaml
|
||||
exclude: ^(mkdocs.yml|examples/bigbluebutton/docker-compose.yml)$
|
||||
args: ["--allow-multiple-documents"]
|
||||
- id: check-case-conflict
|
||||
|
||||
- repo: https://github.com/ambv/black
|
||||
rev: 2a1c67e0b2f81df602ec1f6e7aeb030b9709dc7c # frozen: 23.11.0
|
||||
hooks:
|
||||
- id: black
|
||||
name: Black Python Formatter
|
||||
language_version: python3.9
|
||||
|
||||
- repo: https://github.com/pre-commit/mirrors-prettier
|
||||
rev: ffb6a759a979008c0e6dff86e39f4745a2d9eac4 # frozen: v3.1.0
|
||||
hooks:
|
||||
- id: prettier
|
||||
name: Prettier Code Formatter
|
||||
|
||||
- repo: https://github.com/JohnnyMorganz/StyLua
|
||||
rev: f9afc7f33bc19f7708fbc1d7eea0606e0d41080a # frozen: v0.19.1
|
||||
hooks:
|
||||
- id: stylua-github
|
||||
exclude: ^src/(bw/lua/middleclass.lua|common/core/antibot/captcha.lua)$
|
||||
|
||||
- repo: https://github.com/lunarmodules/luacheck
|
||||
rev: ababb6d403d634eb74d2c541035e9ede966e710d # frozen: v1.1.1
|
||||
hooks:
|
||||
- id: luacheck
|
||||
exclude: ^src/(bw/lua/middleclass.lua|common/core/antibot/captcha.lua)$
|
||||
args: ["--std", "min", "--codes", "--ranges", "--no-cache"]
|
||||
|
||||
- repo: https://github.com/pycqa/flake8
|
||||
rev: 10f4af6dbcf93456ba7df762278ae61ba3120dc6 # frozen: 6.1.0
|
||||
hooks:
|
||||
- id: flake8
|
||||
name: Flake8 Python Linter
|
||||
args: ["--max-line-length=250", "--ignore=E266,E402,E722,W503"]
|
||||
|
||||
- repo: https://github.com/dosisod/refurb
|
||||
rev: 63209fc1735ef2497dd9c00774ba72a23bb1cdf9 # frozen: v1.23.0
|
||||
hooks:
|
||||
- id: refurb
|
||||
name: Refurb Python Refactoring Tool
|
||||
exclude: ^tests/
|
||||
|
||||
- repo: https://github.com/codespell-project/codespell
|
||||
rev: 6e41aba91fb32e9feb741a6258eefeb9c6e4a482 # frozen: v2.2.6
|
||||
hooks:
|
||||
- id: codespell
|
||||
name: Codespell Spell Checker
|
||||
exclude: (^src/(common/core/.+/files|bw/loading)/.+.html|modsecurity-rules.conf.*)$
|
||||
entry: codespell --ignore-regex="(tabEl|Widgits)" --skip src/ui/static/js/utils/flatpickr.js,CHANGELOG.md
|
||||
language: python
|
||||
types: [text]
|
||||
|
||||
- repo: https://github.com/gitleaks/gitleaks
|
||||
rev: b813e6fe08b87541cb77296359ba1b7a50a00c98 # frozen: v8.18.0
|
||||
hooks:
|
||||
- id: gitleaks
|
||||
|
||||
- repo: https://github.com/koalaman/shellcheck-precommit
|
||||
rev: 3f77b826548d8dc2d26675f077361c92773b50a7 # frozen: v0.9.0
|
||||
hooks:
|
||||
- id: shellcheck
|
||||
20
.prettierignore
Normal file
20
.prettierignore
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
docs/
|
||||
env/
|
||||
*/env/
|
||||
*.min*
|
||||
src/common/core/modsecurity/
|
||||
src/deps/src/
|
||||
mkdocs.yml
|
||||
CHANGELOG.md
|
||||
CONTRIBUTING.md
|
||||
CODE_OF_CONDUCT.md
|
||||
LICENSE.md
|
||||
README.md
|
||||
SECURITY.md
|
||||
tsparticles.bundle.min.js
|
||||
flatpickr.*
|
||||
src/ui/static/js/editor/*
|
||||
src/ui/static/js/utils/purify/*
|
||||
src/ui/templates/*
|
||||
datepicker-foundation.css
|
||||
examples/*
|
||||
0
.trivyignore
Normal file
0
.trivyignore
Normal file
324
CHANGELOG.md
Normal file
324
CHANGELOG.md
Normal file
|
|
@ -0,0 +1,324 @@
|
|||
# Changelog
|
||||
|
||||
## v1.5.3 -
|
||||
|
||||
- [BUGFIX] Fix BunkerWeb not loading his own settings after a docker restart
|
||||
- [BUGFIX] Fix Custom configs not following the service name after an update on the UI
|
||||
- [BUGFIX] Fix UI clearing configs folder at startup
|
||||
- [BUGFIX] Fix Database not clearing old services when not using multisite
|
||||
- [BUGFIX] Fix UI using the wrong database when generating the new config when using an external database
|
||||
- [BUGFIX] Small fixes on linux paths creating unnecessary folders
|
||||
- [BUGFIX] Fix ACME renewal fails on redirection enabled Service
|
||||
- [BUGFIX] Fix errors when using a server name with multiple values in web UI
|
||||
- [BUGFIX] Fix error when deleting a service that have custom configs on web UI
|
||||
- [BUGFIX] Fix rare bug where database is locked
|
||||
- [MISC] Updated core dependencies
|
||||
- [MISC] Updated self-signed job to regenerate the cert if the subject or the expiration date has changed
|
||||
- [MISC] Jobs that download files from urls will now remove old cached files if urls are empty
|
||||
- [MISC] Replaced gevent with gthread in UI for security reasons
|
||||
- [MISC] Add HTML sanitization when injecting code in pages in the UI
|
||||
- [MISC] Optimize the way the UI handles services creation and edition
|
||||
- [MISC] Optimize certbot renew script to renew all domains in one command
|
||||
- [MISC] Use capability instead of sudo in Linux
|
||||
- [SECURITY] Init work on OpenSSF best practices
|
||||
|
||||
## v1.5.2 - 2023/09/10
|
||||
|
||||
- [BUGFIX] Fix UI fetching only default values from the database (fixes no trash button too)
|
||||
- [BUGFIX] Fix infinite loop when using autoconf
|
||||
- [BUGFIX] Fix BunkerWeb fails to start after reboot on Fedora and Rhel
|
||||
- [BUGFIX] Fix logs page not working in UI on Linux integrations
|
||||
- [BUGFIX] Fix settings regex that had issues in general and with the UI
|
||||
- [BUGFIX] Fix scheduler error with external plugins when reloading
|
||||
- [BUGFIX] Fix permissions with folders in linux integrations
|
||||
- [MISC] Push Docker images to GitHub packages (ghcr.io repository)
|
||||
- [MISC] Improved CI/CD
|
||||
- [MISC] Updated python dependencies
|
||||
- [MISC] Updated Python Docker image to 3.11.5-alpine in Dockerfiles
|
||||
- [MISC] Add support for ModSecurity JSON LogFormat
|
||||
- [MISC] Updated OWASP coreruleset to 3.3.5
|
||||
|
||||
## v1.5.1 - 2023/08/08
|
||||
|
||||
- [BUGFIX] New version checker in logs displays "404 not found"
|
||||
- [BUGFIX] New version checker in UI
|
||||
- [BUGFIX] Only get the right keys from plugin.json files when importing plugins
|
||||
- [BUGFIX] Remove external resources for Google fonts in UI
|
||||
- [BUGFIX] Support multiple plugin uploads in one zip when using the UI
|
||||
- [BUGFIX] Variable being ignored instead of saved in the database when value is empty
|
||||
- [BUGFIX] ALLOWED_METHODS regex working with LOCK/UNLOCK methods
|
||||
- [BUGFIX] Custom certificate bug after the refactoring
|
||||
- [BUGFIX] Wrong variables in header phase (fix CORS feature too)
|
||||
- [BUGFIX] UI not working in Ubuntu (python zope module)
|
||||
- [BUGFIX] Patch ModSecurity to run it after LUA code (should fix whitelist problems)
|
||||
- [BUGFIX] Custom configurations from env were not being deleted properly
|
||||
- [BUGFIX] Missing concepts image not displayed in the documentation
|
||||
- [BUGFIX] Scheduler not picking up new instances IPs in autoconf modes
|
||||
- [BUGFIX] Autoconf deadlock in k8s
|
||||
- [BUGFIX] Missing HTTP and HTTPS ports for temp nginx
|
||||
- [BUGFIX] Infinite loop when sessions is not valid
|
||||
- [BUGFIX] Missing valid LE certificates in edge cases
|
||||
- [BUGFIX] Wrong service namespace in k8s
|
||||
- [BUGFIX] DNS_RESOLVERS regex not accepting hostnames
|
||||
- [PERFORMANCE] Reduce CPU and RAM usage of scheduler
|
||||
- [PERFORMANCE] Cache ngx.ctx instead of loading it each time
|
||||
- [PERFORMANCE] Use per-worker LRU cache for common RO LUA values
|
||||
- [FEATURE] Add Turnstile antibot mode
|
||||
- [FEATURE] Add more CORS headers
|
||||
- [FEATURE] Add KEEP_UPSTREAM_HEADERS to preserve headers when using reverse proxy
|
||||
- [FEATURE] Add the possibility to download the different lists and plugins from a local file (like the blacklist)
|
||||
- [FEATURE] External plugins can now be downloaded from a tar.gz and tar.xz file as well as zip
|
||||
- [FEATURE] Add X-Forwarded-Prefix header when using reverse proxy
|
||||
- [FEATURE] Add REDIRECT_TO_STATUS_CODE to choose status code 301 or 302 when redirecting
|
||||
- [DOCUMENTATION] Add timezone information
|
||||
- [DOCUMENTATION] Add timezone informat
|
||||
- [MISC] Add LOG_LEVEL=warning for docker socket proxy in docs, examples and boilerplates
|
||||
- [MISC] Temp remove VMWare provider for Vagrant integration
|
||||
- [MISC] Remove X-Script-Name header and ABSOLUTE_URI variable when using UI
|
||||
- [MISC] Move logs to /var/log/bunkerweb folder
|
||||
- [MISC] Reduce "Got an error reading communication packets" warnings in mariadb/mysql
|
||||
|
||||
## v1.5.0 - 2023/05/23
|
||||
|
||||
- Refactoring of almost all the components of the project
|
||||
- Dedicated scheduler service to manage jobs and configuration
|
||||
- Store configuration in a database backend
|
||||
- Improved web UI and make it working with all integrations
|
||||
- Improved internal LUA code
|
||||
- Improved internal cache of BW
|
||||
- Add Redis support when using clustered integrations
|
||||
- Add RHEL integration
|
||||
- Add Vagrant integration
|
||||
- Init support of generic TCP/UDP (stream)
|
||||
- Init support of IPv6
|
||||
- Improved CI/CD : UI tests, core tests and release automation
|
||||
- Reduce Docker images size
|
||||
- Fix and improved core plugins : antibot, cors, dnsbl, ...
|
||||
- Use PCRE regex instead of LUA patterns
|
||||
- Connectivity tests at startup/reload with logging
|
||||
|
||||
## v1.5.0-beta - 2023/05/02
|
||||
|
||||
- Refactoring of almost all the components of the project
|
||||
- Dedicated scheduler service to manage jobs and configuration
|
||||
- Store configuration in a database backend
|
||||
- Improved web UI and make it working with all integrations
|
||||
- Improved internal LUA code
|
||||
- Improved internal cache of BW
|
||||
- Add Redis support when using clustered integrations
|
||||
- Add RHEL integration
|
||||
- Add Vagrant integration
|
||||
- Init support of generic TCP/UDP (stream)
|
||||
- Init support of IPv6
|
||||
- Improved CI/CD : UI tests, core tests and release automation
|
||||
- Reduce Docker images size
|
||||
- Fix and improved core plugins : antibot, cors, dnsbl, ...
|
||||
- Use PCRE regex instead of LUA patterns
|
||||
- Connectivity tests at startup/reload with logging
|
||||
|
||||
## v1.4.8 - 2023/04/05
|
||||
|
||||
- Fix UI bug related to multiple settings
|
||||
- Increase check reload interval in UI to avoid rate limit
|
||||
- Fix Let's Encrypt error when using auth basic
|
||||
- Fix wrong setting name in realip job (again)
|
||||
- Fix blog posts retrieval in the UI
|
||||
- Fix missing logs for UI
|
||||
- Fix error log if BunkerNet ip list is empty
|
||||
- Updated python dependencies
|
||||
- Gunicorn will now show the logs in the console for the UI
|
||||
- BunkerNet job will now create the ip list file at the beginning of the job to avoid errors
|
||||
|
||||
## v1.4.7 - 2023/02/27
|
||||
|
||||
- Fix DISABLE_DEFAULT_SERVER=yes not working with HTTPS (again)
|
||||
- Fix wrong setting name in realip job
|
||||
- Fix whitelisting not working with modsecurity
|
||||
|
||||
## v1.4.6 - 2023/02/14
|
||||
|
||||
- Fix error in the UI when a service have multiple domains
|
||||
- Fix bwcli bans command
|
||||
- Fix documentation about Linux Fedora install
|
||||
- Fix DISABLE_DEFAULT_SERVER=yes not working with HTTPS
|
||||
- Add INTERCEPTED_ERROR_CODES setting
|
||||
|
||||
## v1.4.5 - 2022/11/26
|
||||
|
||||
- Fix bwcli syntax error
|
||||
- Fix UI not working using Linux integration
|
||||
- Fix missing openssl dep in autoconf
|
||||
- Fix typo in selfsigned job
|
||||
|
||||
## v1.4.4 - 2022/11/10
|
||||
|
||||
- Fix k8s controller not watching the events when there is an exception
|
||||
- Fix python dependencies bug in CentOS and Fedora
|
||||
- Fix incorrect log when reloading nginx using Linux integration
|
||||
- Fix UI dev mode, production mode is now the default
|
||||
- Fix wrong exposed port in the UI container
|
||||
- Fix endless loading in the UI
|
||||
- Fix \*_CUSTOM_CONF_\* dissapear when jobs are executed
|
||||
- Fix various typos in documentation
|
||||
- Fix warning about StartLimitIntervalSec directive when using Linux
|
||||
- Fix incorrect log when issuing certbot renew
|
||||
- Fix certbot renew error when using Linux or Docker integration
|
||||
- Add greylist core feature
|
||||
- Add BLACKLIST_IGNORE_\* settings
|
||||
- Add automatic change of SecRequestBodyLimit modsec directive based on MAX_CLIENT_SIZE setting
|
||||
- Add MODSECURITY_SEC_RULE_ENGINE and MODSECURITY_SEC_AUDIT_LOG_PARTS settings
|
||||
- Add manual ban and get bans to the API/CLI
|
||||
- Add Brawdunoir community example
|
||||
- Improve core plugins order and add documentation about it
|
||||
- Improve overall documentation
|
||||
- Improve CI/CD
|
||||
|
||||
## v1.4.3 - 2022/08/26
|
||||
|
||||
- Fix various documentation errors/typos and add various enhancements
|
||||
- Fix ui.env not read when using Linux integration
|
||||
- Fix wrong variables.env path when using Linux integration
|
||||
- Fix missing default server when TEMP_NGINX=yes
|
||||
- Fix check if BunkerNet is activated on default server
|
||||
- Fix request crash when mmdb lookup fails
|
||||
- Fix bad behavior trigger when request is whitelisted
|
||||
- Fix bad behavior not triggered when request is on default server
|
||||
- Fix BW overriding config when config is already present
|
||||
- Add Ansible integration in beta
|
||||
- Add \*_CUSTOM_CONF_\* setting to automatically add custom config files from setting value
|
||||
- Add DENY_HTTP_STATUS setting to choose standard 403 error page (default) or 444 to close connection when access is denied
|
||||
- Add CORS (Cross-Origin Resource Sharing) core plugin
|
||||
- Add documentation about Docker in rootless mode and podman
|
||||
- Improve automatic tests setup
|
||||
- Migrate CI/CD infrastructure to another provider
|
||||
|
||||
## v1.4.2 - 2022/06/28
|
||||
|
||||
- Fix "too old resource version" exceptions when using k8s integration
|
||||
- Fix missing bwcli command with Linux integration
|
||||
- Fix various bugs with jobs scheduler when using autoconf/swarm/k8s
|
||||
- Fix bwcli unban command when using Linux integration
|
||||
- Fix permissions check when filename has a space
|
||||
- Fix static config (SERVER_NAME not empty) support when using autoconf/swarm/k8s
|
||||
- Fix config files overwrite when using Docker autoconf
|
||||
- Add EXTERNAL_PLUGIN_URLS setting to automatically download and install external plugins
|
||||
- Add log_default() plugin hook
|
||||
- Add various certbot-dns examples
|
||||
- Add mattermost example
|
||||
- Add radarr example
|
||||
- Add Discord and Slack to list of official plugins
|
||||
- Force NGINX version dependencies in Linux packages DEB/RPM
|
||||
|
||||
## v1.4.1 - 2022/06/16
|
||||
|
||||
- Fix sending local IPs to BunkerNet when DISABLE_DEFAULT_SERVER=yes
|
||||
- Fix certbot bug when AUTOCONF_MODE=yes
|
||||
- Fix certbot bug when MULTISITE=no
|
||||
- Add reverse proxy timeouts settings
|
||||
- Add auth_request settings
|
||||
- Add authentik and authelia examples
|
||||
- Prebuilt Docker images for arm64 and armv7
|
||||
- Improve documentation for Linux integration
|
||||
- Various fixes in the documentation
|
||||
|
||||
## v1.4.0 - 2022/06/06
|
||||
|
||||
- Project renamed to BunkerWeb
|
||||
- Internal architecture fully revised with a modular approach
|
||||
- Improved CI/CD with automatic tests for multiple integrations
|
||||
- Plugin improvement
|
||||
- Volume improvement for container-based integrations
|
||||
- Web UI improvement with various new features
|
||||
- Web tool to generate settings from a user-friendly UI
|
||||
- Linux packages
|
||||
- Various bug fixes
|
||||
|
||||
## v1.3.2 - 2021/10/24
|
||||
|
||||
- Use API instead of a shared folder for Swarm and Kubernetes integrations
|
||||
- Beta integration of distributed bad IPs database through a remote API
|
||||
- Improvement of the request limiting feature : hour/day rate and multiple URL support
|
||||
- Various bug fixes related to antibot feature
|
||||
- Init support of Arch Linux
|
||||
- Fix Moodle example
|
||||
- Fix ROOT_FOLDER bug in serve-files.conf when using the UI
|
||||
- Update default values for PERMISSIONS_POLICY and FEATURE_POLICY
|
||||
- Disable COUNTRY ban if IP is local
|
||||
|
||||
## v1.3.1 - 2021/09/02
|
||||
|
||||
- Use ModSecurity v3.0.4 instead of v3.0.5 to fix memory leak
|
||||
- Fix ignored variables to control jobs
|
||||
- Fix bug when LISTEN_HTTP=no and MULTISITE=yes
|
||||
- Add CUSTOM_HEADER variable
|
||||
- Add REVERSE_PROXY_BUFFERING variable
|
||||
- Add REVERSE_PROXY_KEEPALIVE variable
|
||||
- Fix documentation for modsec and modsec-crs special folders
|
||||
|
||||
## v1.3.0 - 2021/08/23
|
||||
|
||||
- Kubernetes integration in beta
|
||||
- Linux integration in beta
|
||||
- autoconf refactoring
|
||||
- jobs refactoring
|
||||
- UI refactoring
|
||||
- UI security : login/password authentication and CRSF protection
|
||||
- various dependencies updates
|
||||
- move CrowdSec as an external plugin
|
||||
- Authelia support
|
||||
- improve various regexes
|
||||
- add INJECT_BODY variable
|
||||
- add WORKER_PROCESSES variable
|
||||
- add USE_LETS_ENCRYPT_STAGING variable
|
||||
- add LOCAL_PHP and LOCAL_PHP_PATH variables
|
||||
- add REDIRECT_TO variable
|
||||
|
||||
## v1.2.8 - 2021/07/22
|
||||
|
||||
- Fix broken links in README
|
||||
- Fix regex for EMAIL_LETS_ENCRYPT
|
||||
- Fix regex for REMOTE_PHP and REMOTE_PHP_PATH
|
||||
- Fix regex for SELF_SIGNED_*
|
||||
- Fix various bugs related to web UI
|
||||
- Fix bug in autoconf (missing instances parameter to reload function)
|
||||
- Remove old .env files when generating a new configuration
|
||||
|
||||
## v1.2.7 - 2021/06/14
|
||||
|
||||
- Add custom robots.txt and sitemap to RTD
|
||||
- Fix missing GeoIP DB bug when using BLACKLIST/WHITELIST_COUNTRY
|
||||
- Add underscore "_" to allowed chars for CUSTOM_HTTPS_CERT/KEY
|
||||
- Fix bug when using automatic self-signed certificate
|
||||
- Build and push images from GitHub actions instead of Docker Hub autobuild
|
||||
- Display the reason when generator is ignoring a variable
|
||||
- Various bug fixes related to certbot and jobs
|
||||
- Split jobs into pre and post jobs
|
||||
- Add HEALTHCHECK to image
|
||||
- Fix race condition when using autoconf without Swarm by checking healthy state
|
||||
- Bump modsecurity-nginx to v1.0.2
|
||||
- Community chat with bridged platforms
|
||||
|
||||
## v1.2.6 - 2021/06/06
|
||||
|
||||
- Move from "ghetto-style" shell scripts to generic jinja2 templating
|
||||
- Init work on a basic plugins system
|
||||
- Move ClamAV to external plugin
|
||||
- Reduce image size by removing unnecessary dependencies
|
||||
- Fix CrowdSec example
|
||||
- Change some global variables to multisite
|
||||
- Add LOG_LEVEL environment variable
|
||||
- Read-only container support
|
||||
- Improved antibot javascript with a basic proof of work
|
||||
- Update nginx to 1.20.1
|
||||
- Support of docker-socket-proxy with web UI
|
||||
- Add certbot-cloudflare example
|
||||
- Disable DNSBL checks when IP is local
|
||||
|
||||
## v1.2.5 - 2021/05/14
|
||||
|
||||
- Performance improvement : move some nginx security checks to LUA and external blacklist parsing enhancement
|
||||
- Init work on official documentation on readthedocs
|
||||
- Fix default value for CONTENT_SECURITY_POLICY to allow file downloads
|
||||
- Add ROOT_SITE_SUBFOLDER environment variable
|
||||
|
||||
## TODO - retrospective changelog
|
||||
128
CODE_OF_CONDUCT.md
Normal file
128
CODE_OF_CONDUCT.md
Normal file
|
|
@ -0,0 +1,128 @@
|
|||
# Contributor Covenant Code of Conduct
|
||||
|
||||
## Our Pledge
|
||||
|
||||
We as members, contributors, and leaders pledge to make participation in our
|
||||
community a harassment-free experience for everyone, regardless of age, body
|
||||
size, visible or invisible disability, ethnicity, sex characteristics, gender
|
||||
identity and expression, level of experience, education, socio-economic status,
|
||||
nationality, personal appearance, race, religion, or sexual identity
|
||||
and orientation.
|
||||
|
||||
We pledge to act and interact in ways that contribute to an open, welcoming,
|
||||
diverse, inclusive, and healthy community.
|
||||
|
||||
## Our Standards
|
||||
|
||||
Examples of behavior that contributes to a positive environment for our
|
||||
community include:
|
||||
|
||||
* Demonstrating empathy and kindness toward other people
|
||||
* Being respectful of differing opinions, viewpoints, and experiences
|
||||
* Giving and gracefully accepting constructive feedback
|
||||
* Accepting responsibility and apologizing to those affected by our mistakes,
|
||||
and learning from the experience
|
||||
* Focusing on what is best not just for us as individuals, but for the
|
||||
overall community
|
||||
|
||||
Examples of unacceptable behavior include:
|
||||
|
||||
* The use of sexualized language or imagery, and sexual attention or
|
||||
advances of any kind
|
||||
* Trolling, insulting or derogatory comments, and personal or political attacks
|
||||
* Public or private harassment
|
||||
* Publishing others' private information, such as a physical or email
|
||||
address, without their explicit permission
|
||||
* Other conduct which could reasonably be considered inappropriate in a
|
||||
professional setting
|
||||
|
||||
## Enforcement Responsibilities
|
||||
|
||||
Community leaders are responsible for clarifying and enforcing our standards of
|
||||
acceptable behavior and will take appropriate and fair corrective action in
|
||||
response to any behavior that they deem inappropriate, threatening, offensive,
|
||||
or harmful.
|
||||
|
||||
Community leaders have the right and responsibility to remove, edit, or reject
|
||||
comments, commits, code, wiki edits, issues, and other contributions that are
|
||||
not aligned to this Code of Conduct, and will communicate reasons for moderation
|
||||
decisions when appropriate.
|
||||
|
||||
## Scope
|
||||
|
||||
This Code of Conduct applies within all community spaces, and also applies when
|
||||
an individual is officially representing the community in public spaces.
|
||||
Examples of representing our community include using an official e-mail address,
|
||||
posting via an official social media account, or acting as an appointed
|
||||
representative at an online or offline event.
|
||||
|
||||
## Enforcement
|
||||
|
||||
Instances of abusive, harassing, or otherwise unacceptable behavior may be
|
||||
reported to the community leaders responsible for enforcement at
|
||||
contact@bunkerity.com.
|
||||
All complaints will be reviewed and investigated promptly and fairly.
|
||||
|
||||
All community leaders are obligated to respect the privacy and security of the
|
||||
reporter of any incident.
|
||||
|
||||
## Enforcement Guidelines
|
||||
|
||||
Community leaders will follow these Community Impact Guidelines in determining
|
||||
the consequences for any action they deem in violation of this Code of Conduct:
|
||||
|
||||
### 1. Correction
|
||||
|
||||
**Community Impact**: Use of inappropriate language or other behavior deemed
|
||||
unprofessional or unwelcome in the community.
|
||||
|
||||
**Consequence**: A private, written warning from community leaders, providing
|
||||
clarity around the nature of the violation and an explanation of why the
|
||||
behavior was inappropriate. A public apology may be requested.
|
||||
|
||||
### 2. Warning
|
||||
|
||||
**Community Impact**: A violation through a single incident or series
|
||||
of actions.
|
||||
|
||||
**Consequence**: A warning with consequences for continued behavior. No
|
||||
interaction with the people involved, including unsolicited interaction with
|
||||
those enforcing the Code of Conduct, for a specified period of time. This
|
||||
includes avoiding interactions in community spaces as well as external channels
|
||||
like social media. Violating these terms may lead to a temporary or
|
||||
permanent ban.
|
||||
|
||||
### 3. Temporary Ban
|
||||
|
||||
**Community Impact**: A serious violation of community standards, including
|
||||
sustained inappropriate behavior.
|
||||
|
||||
**Consequence**: A temporary ban from any sort of interaction or public
|
||||
communication with the community for a specified period of time. No public or
|
||||
private interaction with the people involved, including unsolicited interaction
|
||||
with those enforcing the Code of Conduct, is allowed during this period.
|
||||
Violating these terms may lead to a permanent ban.
|
||||
|
||||
### 4. Permanent Ban
|
||||
|
||||
**Community Impact**: Demonstrating a pattern of violation of community
|
||||
standards, including sustained inappropriate behavior, harassment of an
|
||||
individual, or aggression toward or disparagement of classes of individuals.
|
||||
|
||||
**Consequence**: A permanent ban from any sort of public interaction within
|
||||
the community.
|
||||
|
||||
## Attribution
|
||||
|
||||
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
|
||||
version 2.0, available at
|
||||
https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
|
||||
|
||||
Community Impact Guidelines were inspired by [Mozilla's code of conduct
|
||||
enforcement ladder](https://github.com/mozilla/diversity).
|
||||
|
||||
[homepage]: https://www.contributor-covenant.org
|
||||
|
||||
For answers to common questions about this code of conduct, see the FAQ at
|
||||
https://www.contributor-covenant.org/faq. Translations are available at
|
||||
https://www.contributor-covenant.org/translations.
|
||||
21
CONTRIBUTING.md
Normal file
21
CONTRIBUTING.md
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
# Contributing to bunkerweb
|
||||
|
||||
First off all, thanks for being here and showing your support to the project !
|
||||
|
||||
We accept many types of contributions whether they are technical or not. Every community feedback, work or help is, and will always be, appreciated.
|
||||
|
||||
## Talk about the project
|
||||
|
||||
The first thing you can do is to talk about the project. You can share it on social media (by the way, you can can also follow us on [LinkedIn](https://www.linkedin.com/company/bunkerity/), [Twitter](https://twitter.com/bunkerity) and [GitHub](https://github.com/bunkerity)), make a blog post about it or simply tell your friends/colleagues that's an awesome project..
|
||||
|
||||
## Join the community
|
||||
|
||||
You can join the [Discord server](https://discord.com/invite/fTf46FmtyD), the [GitHub discussions](https://github.com/bunkerity/bunkerweb/discussions) and the [/r/BunkerWeb](https://www.reddit.com/r/BunkerWeb) subreddit to talk about the project and help others.
|
||||
|
||||
## Reporting bugs / ask for features
|
||||
|
||||
The preferred way to report bugs and asking for features is using [issues](https://github.com/bunkerity/bunkerweb/issues). Before opening a new one, please check if a related issue is already opened using the "filters" bar. When creating a new issue please select and fill the "Bug report" or "Feature request" template.
|
||||
|
||||
## Code contribution
|
||||
|
||||
The preferred way to contribute code is using [pull requests](https://github.com/bunkerity/bunkerweb/pulls). Before creating a pull request, please check if your code is related to an opened issue. If that's not the case, you should first create an issue so we can discuss about it. This procedure is here to avoid wasting your time in case the PR will be rejected. For minor changes (e.g. : typo, quick fix, ...), opening an issue might be facultative. **Don't forget to edit the documentations when needed !**
|
||||
660
LICENSE.md
Normal file
660
LICENSE.md
Normal file
|
|
@ -0,0 +1,660 @@
|
|||
### GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
|
||||
Version 3, 19 November 2007
|
||||
|
||||
Copyright (C) 2007 Free Software Foundation, Inc.
|
||||
<https://fsf.org/>
|
||||
|
||||
Everyone is permitted to copy and distribute verbatim copies of this
|
||||
license document, but changing it is not allowed.
|
||||
|
||||
### Preamble
|
||||
|
||||
The GNU Affero General Public License is a free, copyleft license for
|
||||
software and other kinds of works, specifically designed to ensure
|
||||
cooperation with the community in the case of network server software.
|
||||
|
||||
The licenses for most software and other practical works are designed
|
||||
to take away your freedom to share and change the works. By contrast,
|
||||
our General Public Licenses are intended to guarantee your freedom to
|
||||
share and change all versions of a program--to make sure it remains
|
||||
free software for all its users.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
them if you wish), that you receive source code or can get it if you
|
||||
want it, that you can change the software or use pieces of it in new
|
||||
free programs, and that you know you can do these things.
|
||||
|
||||
Developers that use our General Public Licenses protect your rights
|
||||
with two steps: (1) assert copyright on the software, and (2) offer
|
||||
you this License which gives you legal permission to copy, distribute
|
||||
and/or modify the software.
|
||||
|
||||
A secondary benefit of defending all users' freedom is that
|
||||
improvements made in alternate versions of the program, if they
|
||||
receive widespread use, become available for other developers to
|
||||
incorporate. Many developers of free software are heartened and
|
||||
encouraged by the resulting cooperation. However, in the case of
|
||||
software used on network servers, this result may fail to come about.
|
||||
The GNU General Public License permits making a modified version and
|
||||
letting the public access it on a server without ever releasing its
|
||||
source code to the public.
|
||||
|
||||
The GNU Affero General Public License is designed specifically to
|
||||
ensure that, in such cases, the modified source code becomes available
|
||||
to the community. It requires the operator of a network server to
|
||||
provide the source code of the modified version running there to the
|
||||
users of that server. Therefore, public use of a modified version, on
|
||||
a publicly accessible server, gives the public access to the source
|
||||
code of the modified version.
|
||||
|
||||
An older license, called the Affero General Public License and
|
||||
published by Affero, was designed to accomplish similar goals. This is
|
||||
a different license, not a version of the Affero GPL, but Affero has
|
||||
released a new version of the Affero GPL which permits relicensing
|
||||
under this license.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
### TERMS AND CONDITIONS
|
||||
|
||||
#### 0. Definitions.
|
||||
|
||||
"This License" refers to version 3 of the GNU Affero General Public
|
||||
License.
|
||||
|
||||
"Copyright" also means copyright-like laws that apply to other kinds
|
||||
of works, such as semiconductor masks.
|
||||
|
||||
"The Program" refers to any copyrightable work licensed under this
|
||||
License. Each licensee is addressed as "you". "Licensees" and
|
||||
"recipients" may be individuals or organizations.
|
||||
|
||||
To "modify" a work means to copy from or adapt all or part of the work
|
||||
in a fashion requiring copyright permission, other than the making of
|
||||
an exact copy. The resulting work is called a "modified version" of
|
||||
the earlier work or a work "based on" the earlier work.
|
||||
|
||||
A "covered work" means either the unmodified Program or a work based
|
||||
on the Program.
|
||||
|
||||
To "propagate" a work means to do anything with it that, without
|
||||
permission, would make you directly or secondarily liable for
|
||||
infringement under applicable copyright law, except executing it on a
|
||||
computer or modifying a private copy. Propagation includes copying,
|
||||
distribution (with or without modification), making available to the
|
||||
public, and in some countries other activities as well.
|
||||
|
||||
To "convey" a work means any kind of propagation that enables other
|
||||
parties to make or receive copies. Mere interaction with a user
|
||||
through a computer network, with no transfer of a copy, is not
|
||||
conveying.
|
||||
|
||||
An interactive user interface displays "Appropriate Legal Notices" to
|
||||
the extent that it includes a convenient and prominently visible
|
||||
feature that (1) displays an appropriate copyright notice, and (2)
|
||||
tells the user that there is no warranty for the work (except to the
|
||||
extent that warranties are provided), that licensees may convey the
|
||||
work under this License, and how to view a copy of this License. If
|
||||
the interface presents a list of user commands or options, such as a
|
||||
menu, a prominent item in the list meets this criterion.
|
||||
|
||||
#### 1. Source Code.
|
||||
|
||||
The "source code" for a work means the preferred form of the work for
|
||||
making modifications to it. "Object code" means any non-source form of
|
||||
a work.
|
||||
|
||||
A "Standard Interface" means an interface that either is an official
|
||||
standard defined by a recognized standards body, or, in the case of
|
||||
interfaces specified for a particular programming language, one that
|
||||
is widely used among developers working in that language.
|
||||
|
||||
The "System Libraries" of an executable work include anything, other
|
||||
than the work as a whole, that (a) is included in the normal form of
|
||||
packaging a Major Component, but which is not part of that Major
|
||||
Component, and (b) serves only to enable use of the work with that
|
||||
Major Component, or to implement a Standard Interface for which an
|
||||
implementation is available to the public in source code form. A
|
||||
"Major Component", in this context, means a major essential component
|
||||
(kernel, window system, and so on) of the specific operating system
|
||||
(if any) on which the executable work runs, or a compiler used to
|
||||
produce the work, or an object code interpreter used to run it.
|
||||
|
||||
The "Corresponding Source" for a work in object code form means all
|
||||
the source code needed to generate, install, and (for an executable
|
||||
work) run the object code and to modify the work, including scripts to
|
||||
control those activities. However, it does not include the work's
|
||||
System Libraries, or general-purpose tools or generally available free
|
||||
programs which are used unmodified in performing those activities but
|
||||
which are not part of the work. For example, Corresponding Source
|
||||
includes interface definition files associated with source files for
|
||||
the work, and the source code for shared libraries and dynamically
|
||||
linked subprograms that the work is specifically designed to require,
|
||||
such as by intimate data communication or control flow between those
|
||||
subprograms and other parts of the work.
|
||||
|
||||
The Corresponding Source need not include anything that users can
|
||||
regenerate automatically from other parts of the Corresponding Source.
|
||||
|
||||
The Corresponding Source for a work in source code form is that same
|
||||
work.
|
||||
|
||||
#### 2. Basic Permissions.
|
||||
|
||||
All rights granted under this License are granted for the term of
|
||||
copyright on the Program, and are irrevocable provided the stated
|
||||
conditions are met. This License explicitly affirms your unlimited
|
||||
permission to run the unmodified Program. The output from running a
|
||||
covered work is covered by this License only if the output, given its
|
||||
content, constitutes a covered work. This License acknowledges your
|
||||
rights of fair use or other equivalent, as provided by copyright law.
|
||||
|
||||
You may make, run and propagate covered works that you do not convey,
|
||||
without conditions so long as your license otherwise remains in force.
|
||||
You may convey covered works to others for the sole purpose of having
|
||||
them make modifications exclusively for you, or provide you with
|
||||
facilities for running those works, provided that you comply with the
|
||||
terms of this License in conveying all material for which you do not
|
||||
control copyright. Those thus making or running the covered works for
|
||||
you must do so exclusively on your behalf, under your direction and
|
||||
control, on terms that prohibit them from making any copies of your
|
||||
copyrighted material outside their relationship with you.
|
||||
|
||||
Conveying under any other circumstances is permitted solely under the
|
||||
conditions stated below. Sublicensing is not allowed; section 10 makes
|
||||
it unnecessary.
|
||||
|
||||
#### 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||
|
||||
No covered work shall be deemed part of an effective technological
|
||||
measure under any applicable law fulfilling obligations under article
|
||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||
similar laws prohibiting or restricting circumvention of such
|
||||
measures.
|
||||
|
||||
When you convey a covered work, you waive any legal power to forbid
|
||||
circumvention of technological measures to the extent such
|
||||
circumvention is effected by exercising rights under this License with
|
||||
respect to the covered work, and you disclaim any intention to limit
|
||||
operation or modification of the work as a means of enforcing, against
|
||||
the work's users, your or third parties' legal rights to forbid
|
||||
circumvention of technological measures.
|
||||
|
||||
#### 4. Conveying Verbatim Copies.
|
||||
|
||||
You may convey verbatim copies of the Program's source code as you
|
||||
receive it, in any medium, provided that you conspicuously and
|
||||
appropriately publish on each copy an appropriate copyright notice;
|
||||
keep intact all notices stating that this License and any
|
||||
non-permissive terms added in accord with section 7 apply to the code;
|
||||
keep intact all notices of the absence of any warranty; and give all
|
||||
recipients a copy of this License along with the Program.
|
||||
|
||||
You may charge any price or no price for each copy that you convey,
|
||||
and you may offer support or warranty protection for a fee.
|
||||
|
||||
#### 5. Conveying Modified Source Versions.
|
||||
|
||||
You may convey a work based on the Program, or the modifications to
|
||||
produce it from the Program, in the form of source code under the
|
||||
terms of section 4, provided that you also meet all of these
|
||||
conditions:
|
||||
|
||||
- a) The work must carry prominent notices stating that you modified
|
||||
it, and giving a relevant date.
|
||||
- b) The work must carry prominent notices stating that it is
|
||||
released under this License and any conditions added under
|
||||
section 7. This requirement modifies the requirement in section 4
|
||||
to "keep intact all notices".
|
||||
- c) You must license the entire work, as a whole, under this
|
||||
License to anyone who comes into possession of a copy. This
|
||||
License will therefore apply, along with any applicable section 7
|
||||
additional terms, to the whole of the work, and all its parts,
|
||||
regardless of how they are packaged. This License gives no
|
||||
permission to license the work in any other way, but it does not
|
||||
invalidate such permission if you have separately received it.
|
||||
- d) If the work has interactive user interfaces, each must display
|
||||
Appropriate Legal Notices; however, if the Program has interactive
|
||||
interfaces that do not display Appropriate Legal Notices, your
|
||||
work need not make them do so.
|
||||
|
||||
A compilation of a covered work with other separate and independent
|
||||
works, which are not by their nature extensions of the covered work,
|
||||
and which are not combined with it such as to form a larger program,
|
||||
in or on a volume of a storage or distribution medium, is called an
|
||||
"aggregate" if the compilation and its resulting copyright are not
|
||||
used to limit the access or legal rights of the compilation's users
|
||||
beyond what the individual works permit. Inclusion of a covered work
|
||||
in an aggregate does not cause this License to apply to the other
|
||||
parts of the aggregate.
|
||||
|
||||
#### 6. Conveying Non-Source Forms.
|
||||
|
||||
You may convey a covered work in object code form under the terms of
|
||||
sections 4 and 5, provided that you also convey the machine-readable
|
||||
Corresponding Source under the terms of this License, in one of these
|
||||
ways:
|
||||
|
||||
- a) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by the
|
||||
Corresponding Source fixed on a durable physical medium
|
||||
customarily used for software interchange.
|
||||
- b) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by a
|
||||
written offer, valid for at least three years and valid for as
|
||||
long as you offer spare parts or customer support for that product
|
||||
model, to give anyone who possesses the object code either (1) a
|
||||
copy of the Corresponding Source for all the software in the
|
||||
product that is covered by this License, on a durable physical
|
||||
medium customarily used for software interchange, for a price no
|
||||
more than your reasonable cost of physically performing this
|
||||
conveying of source, or (2) access to copy the Corresponding
|
||||
Source from a network server at no charge.
|
||||
- c) Convey individual copies of the object code with a copy of the
|
||||
written offer to provide the Corresponding Source. This
|
||||
alternative is allowed only occasionally and noncommercially, and
|
||||
only if you received the object code with such an offer, in accord
|
||||
with subsection 6b.
|
||||
- d) Convey the object code by offering access from a designated
|
||||
place (gratis or for a charge), and offer equivalent access to the
|
||||
Corresponding Source in the same way through the same place at no
|
||||
further charge. You need not require recipients to copy the
|
||||
Corresponding Source along with the object code. If the place to
|
||||
copy the object code is a network server, the Corresponding Source
|
||||
may be on a different server (operated by you or a third party)
|
||||
that supports equivalent copying facilities, provided you maintain
|
||||
clear directions next to the object code saying where to find the
|
||||
Corresponding Source. Regardless of what server hosts the
|
||||
Corresponding Source, you remain obligated to ensure that it is
|
||||
available for as long as needed to satisfy these requirements.
|
||||
- e) Convey the object code using peer-to-peer transmission,
|
||||
provided you inform other peers where the object code and
|
||||
Corresponding Source of the work are being offered to the general
|
||||
public at no charge under subsection 6d.
|
||||
|
||||
A separable portion of the object code, whose source code is excluded
|
||||
from the Corresponding Source as a System Library, need not be
|
||||
included in conveying the object code work.
|
||||
|
||||
A "User Product" is either (1) a "consumer product", which means any
|
||||
tangible personal property which is normally used for personal,
|
||||
family, or household purposes, or (2) anything designed or sold for
|
||||
incorporation into a dwelling. In determining whether a product is a
|
||||
consumer product, doubtful cases shall be resolved in favor of
|
||||
coverage. For a particular product received by a particular user,
|
||||
"normally used" refers to a typical or common use of that class of
|
||||
product, regardless of the status of the particular user or of the way
|
||||
in which the particular user actually uses, or expects or is expected
|
||||
to use, the product. A product is a consumer product regardless of
|
||||
whether the product has substantial commercial, industrial or
|
||||
non-consumer uses, unless such uses represent the only significant
|
||||
mode of use of the product.
|
||||
|
||||
"Installation Information" for a User Product means any methods,
|
||||
procedures, authorization keys, or other information required to
|
||||
install and execute modified versions of a covered work in that User
|
||||
Product from a modified version of its Corresponding Source. The
|
||||
information must suffice to ensure that the continued functioning of
|
||||
the modified object code is in no case prevented or interfered with
|
||||
solely because modification has been made.
|
||||
|
||||
If you convey an object code work under this section in, or with, or
|
||||
specifically for use in, a User Product, and the conveying occurs as
|
||||
part of a transaction in which the right of possession and use of the
|
||||
User Product is transferred to the recipient in perpetuity or for a
|
||||
fixed term (regardless of how the transaction is characterized), the
|
||||
Corresponding Source conveyed under this section must be accompanied
|
||||
by the Installation Information. But this requirement does not apply
|
||||
if neither you nor any third party retains the ability to install
|
||||
modified object code on the User Product (for example, the work has
|
||||
been installed in ROM).
|
||||
|
||||
The requirement to provide Installation Information does not include a
|
||||
requirement to continue to provide support service, warranty, or
|
||||
updates for a work that has been modified or installed by the
|
||||
recipient, or for the User Product in which it has been modified or
|
||||
installed. Access to a network may be denied when the modification
|
||||
itself materially and adversely affects the operation of the network
|
||||
or violates the rules and protocols for communication across the
|
||||
network.
|
||||
|
||||
Corresponding Source conveyed, and Installation Information provided,
|
||||
in accord with this section must be in a format that is publicly
|
||||
documented (and with an implementation available to the public in
|
||||
source code form), and must require no special password or key for
|
||||
unpacking, reading or copying.
|
||||
|
||||
#### 7. Additional Terms.
|
||||
|
||||
"Additional permissions" are terms that supplement the terms of this
|
||||
License by making exceptions from one or more of its conditions.
|
||||
Additional permissions that are applicable to the entire Program shall
|
||||
be treated as though they were included in this License, to the extent
|
||||
that they are valid under applicable law. If additional permissions
|
||||
apply only to part of the Program, that part may be used separately
|
||||
under those permissions, but the entire Program remains governed by
|
||||
this License without regard to the additional permissions.
|
||||
|
||||
When you convey a copy of a covered work, you may at your option
|
||||
remove any additional permissions from that copy, or from any part of
|
||||
it. (Additional permissions may be written to require their own
|
||||
removal in certain cases when you modify the work.) You may place
|
||||
additional permissions on material, added by you to a covered work,
|
||||
for which you have or can give appropriate copyright permission.
|
||||
|
||||
Notwithstanding any other provision of this License, for material you
|
||||
add to a covered work, you may (if authorized by the copyright holders
|
||||
of that material) supplement the terms of this License with terms:
|
||||
|
||||
- a) Disclaiming warranty or limiting liability differently from the
|
||||
terms of sections 15 and 16 of this License; or
|
||||
- b) Requiring preservation of specified reasonable legal notices or
|
||||
author attributions in that material or in the Appropriate Legal
|
||||
Notices displayed by works containing it; or
|
||||
- c) Prohibiting misrepresentation of the origin of that material,
|
||||
or requiring that modified versions of such material be marked in
|
||||
reasonable ways as different from the original version; or
|
||||
- d) Limiting the use for publicity purposes of names of licensors
|
||||
or authors of the material; or
|
||||
- e) Declining to grant rights under trademark law for use of some
|
||||
trade names, trademarks, or service marks; or
|
||||
- f) Requiring indemnification of licensors and authors of that
|
||||
material by anyone who conveys the material (or modified versions
|
||||
of it) with contractual assumptions of liability to the recipient,
|
||||
for any liability that these contractual assumptions directly
|
||||
impose on those licensors and authors.
|
||||
|
||||
All other non-permissive additional terms are considered "further
|
||||
restrictions" within the meaning of section 10. If the Program as you
|
||||
received it, or any part of it, contains a notice stating that it is
|
||||
governed by this License along with a term that is a further
|
||||
restriction, you may remove that term. If a license document contains
|
||||
a further restriction but permits relicensing or conveying under this
|
||||
License, you may add to a covered work material governed by the terms
|
||||
of that license document, provided that the further restriction does
|
||||
not survive such relicensing or conveying.
|
||||
|
||||
If you add terms to a covered work in accord with this section, you
|
||||
must place, in the relevant source files, a statement of the
|
||||
additional terms that apply to those files, or a notice indicating
|
||||
where to find the applicable terms.
|
||||
|
||||
Additional terms, permissive or non-permissive, may be stated in the
|
||||
form of a separately written license, or stated as exceptions; the
|
||||
above requirements apply either way.
|
||||
|
||||
#### 8. Termination.
|
||||
|
||||
You may not propagate or modify a covered work except as expressly
|
||||
provided under this License. Any attempt otherwise to propagate or
|
||||
modify it is void, and will automatically terminate your rights under
|
||||
this License (including any patent licenses granted under the third
|
||||
paragraph of section 11).
|
||||
|
||||
However, if you cease all violation of this License, then your license
|
||||
from a particular copyright holder is reinstated (a) provisionally,
|
||||
unless and until the copyright holder explicitly and finally
|
||||
terminates your license, and (b) permanently, if the copyright holder
|
||||
fails to notify you of the violation by some reasonable means prior to
|
||||
60 days after the cessation.
|
||||
|
||||
Moreover, your license from a particular copyright holder is
|
||||
reinstated permanently if the copyright holder notifies you of the
|
||||
violation by some reasonable means, this is the first time you have
|
||||
received notice of violation of this License (for any work) from that
|
||||
copyright holder, and you cure the violation prior to 30 days after
|
||||
your receipt of the notice.
|
||||
|
||||
Termination of your rights under this section does not terminate the
|
||||
licenses of parties who have received copies or rights from you under
|
||||
this License. If your rights have been terminated and not permanently
|
||||
reinstated, you do not qualify to receive new licenses for the same
|
||||
material under section 10.
|
||||
|
||||
#### 9. Acceptance Not Required for Having Copies.
|
||||
|
||||
You are not required to accept this License in order to receive or run
|
||||
a copy of the Program. Ancillary propagation of a covered work
|
||||
occurring solely as a consequence of using peer-to-peer transmission
|
||||
to receive a copy likewise does not require acceptance. However,
|
||||
nothing other than this License grants you permission to propagate or
|
||||
modify any covered work. These actions infringe copyright if you do
|
||||
not accept this License. Therefore, by modifying or propagating a
|
||||
covered work, you indicate your acceptance of this License to do so.
|
||||
|
||||
#### 10. Automatic Licensing of Downstream Recipients.
|
||||
|
||||
Each time you convey a covered work, the recipient automatically
|
||||
receives a license from the original licensors, to run, modify and
|
||||
propagate that work, subject to this License. You are not responsible
|
||||
for enforcing compliance by third parties with this License.
|
||||
|
||||
An "entity transaction" is a transaction transferring control of an
|
||||
organization, or substantially all assets of one, or subdividing an
|
||||
organization, or merging organizations. If propagation of a covered
|
||||
work results from an entity transaction, each party to that
|
||||
transaction who receives a copy of the work also receives whatever
|
||||
licenses to the work the party's predecessor in interest had or could
|
||||
give under the previous paragraph, plus a right to possession of the
|
||||
Corresponding Source of the work from the predecessor in interest, if
|
||||
the predecessor has it or can get it with reasonable efforts.
|
||||
|
||||
You may not impose any further restrictions on the exercise of the
|
||||
rights granted or affirmed under this License. For example, you may
|
||||
not impose a license fee, royalty, or other charge for exercise of
|
||||
rights granted under this License, and you may not initiate litigation
|
||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||
any patent claim is infringed by making, using, selling, offering for
|
||||
sale, or importing the Program or any portion of it.
|
||||
|
||||
#### 11. Patents.
|
||||
|
||||
A "contributor" is a copyright holder who authorizes use under this
|
||||
License of the Program or a work on which the Program is based. The
|
||||
work thus licensed is called the contributor's "contributor version".
|
||||
|
||||
A contributor's "essential patent claims" are all patent claims owned
|
||||
or controlled by the contributor, whether already acquired or
|
||||
hereafter acquired, that would be infringed by some manner, permitted
|
||||
by this License, of making, using, or selling its contributor version,
|
||||
but do not include claims that would be infringed only as a
|
||||
consequence of further modification of the contributor version. For
|
||||
purposes of this definition, "control" includes the right to grant
|
||||
patent sublicenses in a manner consistent with the requirements of
|
||||
this License.
|
||||
|
||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||
patent license under the contributor's essential patent claims, to
|
||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||
propagate the contents of its contributor version.
|
||||
|
||||
In the following three paragraphs, a "patent license" is any express
|
||||
agreement or commitment, however denominated, not to enforce a patent
|
||||
(such as an express permission to practice a patent or covenant not to
|
||||
sue for patent infringement). To "grant" such a patent license to a
|
||||
party means to make such an agreement or commitment not to enforce a
|
||||
patent against the party.
|
||||
|
||||
If you convey a covered work, knowingly relying on a patent license,
|
||||
and the Corresponding Source of the work is not available for anyone
|
||||
to copy, free of charge and under the terms of this License, through a
|
||||
publicly available network server or other readily accessible means,
|
||||
then you must either (1) cause the Corresponding Source to be so
|
||||
available, or (2) arrange to deprive yourself of the benefit of the
|
||||
patent license for this particular work, or (3) arrange, in a manner
|
||||
consistent with the requirements of this License, to extend the patent
|
||||
license to downstream recipients. "Knowingly relying" means you have
|
||||
actual knowledge that, but for the patent license, your conveying the
|
||||
covered work in a country, or your recipient's use of the covered work
|
||||
in a country, would infringe one or more identifiable patents in that
|
||||
country that you have reason to believe are valid.
|
||||
|
||||
If, pursuant to or in connection with a single transaction or
|
||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||
covered work, and grant a patent license to some of the parties
|
||||
receiving the covered work authorizing them to use, propagate, modify
|
||||
or convey a specific copy of the covered work, then the patent license
|
||||
you grant is automatically extended to all recipients of the covered
|
||||
work and works based on it.
|
||||
|
||||
A patent license is "discriminatory" if it does not include within the
|
||||
scope of its coverage, prohibits the exercise of, or is conditioned on
|
||||
the non-exercise of one or more of the rights that are specifically
|
||||
granted under this License. You may not convey a covered work if you
|
||||
are a party to an arrangement with a third party that is in the
|
||||
business of distributing software, under which you make payment to the
|
||||
third party based on the extent of your activity of conveying the
|
||||
work, and under which the third party grants, to any of the parties
|
||||
who would receive the covered work from you, a discriminatory patent
|
||||
license (a) in connection with copies of the covered work conveyed by
|
||||
you (or copies made from those copies), or (b) primarily for and in
|
||||
connection with specific products or compilations that contain the
|
||||
covered work, unless you entered into that arrangement, or that patent
|
||||
license was granted, prior to 28 March 2007.
|
||||
|
||||
Nothing in this License shall be construed as excluding or limiting
|
||||
any implied license or other defenses to infringement that may
|
||||
otherwise be available to you under applicable patent law.
|
||||
|
||||
#### 12. No Surrender of Others' Freedom.
|
||||
|
||||
If conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot convey a
|
||||
covered work so as to satisfy simultaneously your obligations under
|
||||
this License and any other pertinent obligations, then as a
|
||||
consequence you may not convey it at all. For example, if you agree to
|
||||
terms that obligate you to collect a royalty for further conveying
|
||||
from those to whom you convey the Program, the only way you could
|
||||
satisfy both those terms and this License would be to refrain entirely
|
||||
from conveying the Program.
|
||||
|
||||
#### 13. Remote Network Interaction; Use with the GNU General Public License.
|
||||
|
||||
Notwithstanding any other provision of this License, if you modify the
|
||||
Program, your modified version must prominently offer all users
|
||||
interacting with it remotely through a computer network (if your
|
||||
version supports such interaction) an opportunity to receive the
|
||||
Corresponding Source of your version by providing access to the
|
||||
Corresponding Source from a network server at no charge, through some
|
||||
standard or customary means of facilitating copying of software. This
|
||||
Corresponding Source shall include the Corresponding Source for any
|
||||
work covered by version 3 of the GNU General Public License that is
|
||||
incorporated pursuant to the following paragraph.
|
||||
|
||||
Notwithstanding any other provision of this License, you have
|
||||
permission to link or combine any covered work with a work licensed
|
||||
under version 3 of the GNU General Public License into a single
|
||||
combined work, and to convey the resulting work. The terms of this
|
||||
License will continue to apply to the part which is the covered work,
|
||||
but the work with which it is combined will remain governed by version
|
||||
3 of the GNU General Public License.
|
||||
|
||||
#### 14. Revised Versions of this License.
|
||||
|
||||
The Free Software Foundation may publish revised and/or new versions
|
||||
of the GNU Affero General Public License from time to time. Such new
|
||||
versions will be similar in spirit to the present version, but may
|
||||
differ in detail to address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Program
|
||||
specifies that a certain numbered version of the GNU Affero General
|
||||
Public License "or any later version" applies to it, you have the
|
||||
option of following the terms and conditions either of that numbered
|
||||
version or of any later version published by the Free Software
|
||||
Foundation. If the Program does not specify a version number of the
|
||||
GNU Affero General Public License, you may choose any version ever
|
||||
published by the Free Software Foundation.
|
||||
|
||||
If the Program specifies that a proxy can decide which future versions
|
||||
of the GNU Affero General Public License can be used, that proxy's
|
||||
public statement of acceptance of a version permanently authorizes you
|
||||
to choose that version for the Program.
|
||||
|
||||
Later license versions may give you additional or different
|
||||
permissions. However, no additional obligations are imposed on any
|
||||
author or copyright holder as a result of your choosing to follow a
|
||||
later version.
|
||||
|
||||
#### 15. Disclaimer of Warranty.
|
||||
|
||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT
|
||||
WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT
|
||||
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND
|
||||
PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE
|
||||
DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR
|
||||
CORRECTION.
|
||||
|
||||
#### 16. Limitation of Liability.
|
||||
|
||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR
|
||||
CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES
|
||||
ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT
|
||||
NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR
|
||||
LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM
|
||||
TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER
|
||||
PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
#### 17. Interpretation of Sections 15 and 16.
|
||||
|
||||
If the disclaimer of warranty and limitation of liability provided
|
||||
above cannot be given local legal effect according to their terms,
|
||||
reviewing courts shall apply local law that most closely approximates
|
||||
an absolute waiver of all civil liability in connection with the
|
||||
Program, unless a warranty or assumption of liability accompanies a
|
||||
copy of the Program in return for a fee.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
### How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these
|
||||
terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest to
|
||||
attach them to the start of each source file to most effectively state
|
||||
the exclusion of warranty; and each file should have at least the
|
||||
"copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU Affero General Public License as
|
||||
published by the Free Software Foundation, either version 3 of the
|
||||
License, or (at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU Affero General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Affero General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
Also add information on how to contact you by electronic and paper
|
||||
mail.
|
||||
|
||||
If your software can interact with users remotely through a computer
|
||||
network, you should also make sure that it provides a way for users to
|
||||
get its source. For example, if your program is a web application, its
|
||||
interface could display a "Source" link that leads users to an archive
|
||||
of the code. There are many ways you could offer source, and different
|
||||
solutions will be better for different programs; see section 13 for
|
||||
the specific requirements.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or
|
||||
school, if any, to sign a "copyright disclaimer" for the program, if
|
||||
necessary. For more information on this, and how to apply and follow
|
||||
the GNU AGPL, see <https://www.gnu.org/licenses/>.
|
||||
363
README.md
Normal file
363
README.md
Normal file
|
|
@ -0,0 +1,363 @@
|
|||
<p align="center">
|
||||
<img alt="BunkerWeb logo" src="https://github.com/bunkerity/bunkerweb/raw/v1.5.3/misc/logo.png" />
|
||||
</p>
|
||||
|
||||
<p align="center">
|
||||
<img src="https://img.shields.io/github/v/release/bunkerity/bunkerweb?label=stable" />
|
||||
<img src="https://img.shields.io/github/v/release/bunkerity/bunkerweb?include_prereleases&label=latest" />
|
||||
<br />
|
||||
<img src="https://img.shields.io/github/last-commit/bunkerity/bunkerweb" />
|
||||
<img src="https://img.shields.io/github/issues/bunkerity/bunkerweb">
|
||||
<img src="https://img.shields.io/github/issues-pr/bunkerity/bunkerweb">
|
||||
<br />
|
||||
<img src="https://img.shields.io/github/actions/workflow/status/bunkerity/bunkerweb/dev.yml?branch=dev&label=CI%2FCD%20dev" />
|
||||
<img src="https://img.shields.io/github/actions/workflow/status/bunkerity/bunkerweb/staging.yml?branch=staging&label=CI%2FCD%20staging" />
|
||||
<a href="https://www.bestpractices.dev/projects/8001">
|
||||
<img src="https://www.bestpractices.dev/projects/8001/badge">
|
||||
</a>
|
||||
</p>
|
||||
|
||||
<p align="center">
|
||||
📓 <a href="https://docs.bunkerweb.io">Documentation</a>
|
||||
|
|
||||
👨💻 <a href="https://demo.bunkerweb.io">Demo</a>
|
||||
|
|
||||
🛡️ <a href="https://github.com/bunkerity/bunkerweb/raw/v1.5.3/examples">Examples</a>
|
||||
|
|
||||
💬 <a href="https://discord.com/invite/fTf46FmtyD">Chat</a>
|
||||
|
|
||||
📝 <a href="https://github.com/bunkerity/bunkerweb/discussions">Forum</a>
|
||||
|
|
||||
⚙️ <a href="https://config.bunkerweb.io">Configurator</a>
|
||||
|
|
||||
🗺️ <a href="https://threatmap.bunkerweb.io">Threatmap</a>
|
||||
</p>
|
||||
|
||||
> 🛡️ Make security by default great again !
|
||||
|
||||
# BunkerWeb
|
||||
|
||||
<p align="center">
|
||||
<img alt="Overview banner" src="https://github.com/bunkerity/bunkerweb/raw/v1.5.3/docs/assets/img/intro-overview.svg" />
|
||||
</p>
|
||||
|
||||
BunkerWeb is a next-generation and open-source Web Application Firewall (WAF).
|
||||
|
||||
Being a full-featured web server (based on [NGINX](https://nginx.org/) under the hood), it will protect your web services to make them "secure by default". BunkerWeb integrates seamlessly into your existing environments ([Linux](https://docs.bunkerweb.io/1.5.3/integrations/#linux), [Docker](https://docs.bunkerweb.io/1.5.3/integrations/#docker), [Swarm](https://docs.bunkerweb.io/1.5.3/integrations/#swarm), [Kubernetes](https://docs.bunkerweb.io/1.5.3/integrations/#kubernetes), …) and is fully configurable (don't panic, there is an [awesome web UI](https://docs.bunkerweb.io/1.5.3/web-ui/) if you don't like the CLI) to meet your own use-cases . In other words, cybersecurity is no more a hassle.
|
||||
|
||||
BunkerWeb contains primary [security features](https://docs.bunkerweb.io/1.5.3/security-tuning/) as part of the core but can be easily extended with additional ones thanks to a [plugin system](https://docs.bunkerweb.io/1.5.3/plugins/)).
|
||||
|
||||
## Why BunkerWeb ?
|
||||
|
||||
- **Easy integration into existing environments** : support for Linux, Docker, Swarm, Kubernetes, Ansible, Vagrant, ...
|
||||
- **Highly customizable** : enable, disable and configure features easily to meet your use case
|
||||
- **Secure by default** : offers out-of-the-box and hassle-free minimal security for your web services
|
||||
- **Awesome web UI** : keep control of everything more efficiently without the need of the CLI
|
||||
- **Plugin system** : extend BunkerWeb to meet your own use-cases
|
||||
- **Free as in "freedom"** : licensed under the free [AGPLv3 license](https://www.gnu.org/licenses/agpl-3.0.en.html)
|
||||
|
||||
## Security features
|
||||
|
||||
A non-exhaustive list of security features :
|
||||
|
||||
- **HTTPS** support with transparent **Let's Encrypt** automation
|
||||
- **State-of-the-art web security** : HTTP security headers, prevent leaks, TLS hardening, ...
|
||||
- Integrated **ModSecurity WAF** with the **OWASP Core Rule Set**
|
||||
- **Automatic ban** of strange behaviors based on HTTP status code
|
||||
- Apply **connections and requests limit** for clients
|
||||
- **Block bots** by asking them to solve a **challenge** (e.g. : cookie, javascript, captcha, hCaptcha or reCAPTCHA)
|
||||
- **Block known bad IPs** with external blacklists and DNSBL
|
||||
- And much more ...
|
||||
|
||||
Learn more about the core security features in the [security tuning](https://docs.bunkerweb.io/1.5.3/security-tuning/) section of the documentation.
|
||||
|
||||
## Demo
|
||||
|
||||
<p align="center">
|
||||
<a href="https://www.youtube.com/watch?v=ZhYV-QELzA4" target="_blank"><img alt="BunkerWeb demo" src="https://img.youtube.com/vi/ZhYV-QELzA4/0.jpg" /></a>
|
||||
</p>
|
||||
|
||||
A demo website protected with BunkerWeb is available at [demo.bunkerweb.io](https://demo.bunkerweb.io). Feel free to visit it and perform some security tests.
|
||||
|
||||
# Concepts
|
||||
|
||||
<p align="center">
|
||||
<img alt="Concepts banner" src="https://github.com/bunkerity/bunkerweb/raw/v1.5.3/docs/assets/img/concepts.svg" />
|
||||
</p>
|
||||
|
||||
You will find more information about the key concepts of BunkerWeb in the [documentation](https://docs.bunkerweb.io/1.5.3/concepts).
|
||||
|
||||
## Integrations
|
||||
|
||||
The first concept is the integration of BunkerWeb into the target environment. We prefer to use the word "integration" instead of "installation" because one of the goals of BunkerWeb is to integrate seamlessly into existing environments.
|
||||
|
||||
The following integrations are officially supported :
|
||||
|
||||
- [Docker](https://docs.bunkerweb.io/1.5.3/integrations/#docker)
|
||||
- [Docker autoconf](https://docs.bunkerweb.io/1.5.3/integrations/#docker-autoconf)
|
||||
- [Swarm](https://docs.bunkerweb.io/1.5.3/integrations/#swarm)
|
||||
- [Kubernetes](https://docs.bunkerweb.io/1.5.3/integrations/#kubernetes)
|
||||
- [Linux](https://docs.bunkerweb.io/1.5.3/integrations/#linux)
|
||||
- [Ansible](https://docs.bunkerweb.io/1.5.3/integrations/#ansible)
|
||||
- [Vagrant](https://docs.bunkerweb.io/1.5.3/integrations/#vagrant)
|
||||
|
||||
## Settings
|
||||
|
||||
Once BunkerWeb is integrated into your environment, you will need to configure it to serve and protect your web applications.
|
||||
|
||||
The configuration of BunkerWeb is done by using what we call the "settings" or "variables". Each setting is identified by a name such as `AUTO_LETS_ENCRYPT` or `USE_ANTIBOT`. You can assign values to the settings to configure BunkerWeb.
|
||||
|
||||
Here is a dummy example of a BunkerWeb configuration :
|
||||
|
||||
```conf
|
||||
SERVER_NAME=www.example.com
|
||||
AUTO_LETS_ENCRYPT=yes
|
||||
USE_ANTIBOT=captcha
|
||||
REFERRER_POLICY=no-referrer
|
||||
USE_MODSECURITY=no
|
||||
USE_GZIP=yes
|
||||
USE_BROTLI=no
|
||||
```
|
||||
|
||||
You will find an easy to use settings generator at [config.bunkerweb.io](https://config.bunkerweb.io).
|
||||
|
||||
## Multisite mode
|
||||
|
||||
The multisite mode is a crucial concept to understand when using BunkerWeb. Because the goal is to protect web applications, we intrinsically inherit the concept of "virtual host" or "vhost" (more info [here](https://en.wikipedia.org/wiki/Virtual_hosting)) which makes it possible to serve multiple web applications from a single (or a cluster of) instance.
|
||||
|
||||
By default, the multisite mode of BunkerWeb is disabled which means that only one web application will be served and all the settings will be applied to it. The typical use case is when you have a single application to protect : you don't have to worry about the multisite and the default behavior should be the right one for you.
|
||||
|
||||
When multisite mode is enabled, BunkerWeb will serve and protect multiple web applications. Each web application is identified by a unique server name and have its own set of settings. The typical use case is when you have multiple applications to protect and you want to use a single (or a cluster depending of the integration) instance of BunkerWeb.
|
||||
|
||||
## Custom configurations
|
||||
|
||||
Because meeting all the use cases only using the settings is not an option (even with [external plugins](https://docs.bunkerweb.io/1.5.3/plugins)), you can use custom configurations to solve your specific challenges.
|
||||
|
||||
Under the hood, BunkerWeb uses the notorious NGINX web server, that's why you can leverage its configuration system for your specific needs. Custom NGINX configurations can be included in different [contexts](https://docs.nginx.com/nginx/admin-guide/basic-functionality/managing-configuration-files/#contexts) like HTTP or server (all servers and/or specific server block).
|
||||
|
||||
Another core component of BunkerWeb is the ModSecurity Web Application Firewall : you can also use custom configurations to fix some false positives or add custom rules for example.
|
||||
|
||||
## Database
|
||||
|
||||
State of the current configuration of BunkerWeb is stored in a backend database which contains the following data :
|
||||
|
||||
- Settings defined for all the services
|
||||
- Custom configurations
|
||||
- BunkerWeb instances
|
||||
- Metadata about jobs execution
|
||||
- Cached files
|
||||
|
||||
The following backend database are supported : SQLite, MariaDB, MySQL and PostgreSQL
|
||||
|
||||
## Scheduler
|
||||
|
||||
To make things automagically work together, a dedicated service called the scheduler is in charge of :
|
||||
|
||||
- Storing the settings and custom configurations inside the database
|
||||
- Executing various tasks (called jobs)
|
||||
- Generating a configuration which is understood by BunkerWeb
|
||||
- Being the intermediary for other services (like web UI or autoconf)
|
||||
|
||||
In other words, the scheduler is the brain of BunkerWeb.
|
||||
|
||||
# Setup
|
||||
|
||||
## Docker
|
||||
|
||||
<p align="center">
|
||||
<img alt="Docker banner" src="https://github.com/bunkerity/bunkerweb/raw/v1.5.3/docs/assets/img/integration-docker.svg" />
|
||||
</p>
|
||||
|
||||
We provide ready to use prebuilt images for x64, x86, armv7 and arm64 platforms on [Docker Hub](https://hub.docker.com/u/bunkerity).
|
||||
|
||||
Docker integration key concepts are :
|
||||
|
||||
- **Environment variables** to configure BunkerWeb
|
||||
- **Scheduler** container to store configuration and execute jobs
|
||||
- **Networks** to expose ports for clients and connect to upstream web services
|
||||
|
||||
You will find more information in the [Docker integration section](https://docs.bunkerweb.io/1.5.3/integrations/#docker) of the documentation.
|
||||
|
||||
## Docker autoconf
|
||||
|
||||
<p align="center">
|
||||
<img alt="Docker autoconf banner" src="https://github.com/bunkerity/bunkerweb/raw/v1.5.3/docs/assets/img/integration-autoconf.svg" />
|
||||
</p>
|
||||
|
||||
The downside of using environment variables is that the container needs to be recreated each time there is an update which is not very convenient. To counter that issue, you can use another image called **autoconf** which will listen for Docker events and automatically reconfigure BunkerWeb in real-time without recreating the container.
|
||||
|
||||
Instead of defining environment variables for the BunkerWeb container, you simply add **labels** to your web applications containers and the **autoconf** will "automagically" take care of the rest.
|
||||
|
||||
You will find more information in the [Docker autoconf section](https://docs.bunkerweb.io/1.5.3/integrations/#docker-autoconf) of the documentation.
|
||||
|
||||
## Swarm
|
||||
|
||||
<p align="center">
|
||||
<img alt="Swarm banner" src="https://github.com/bunkerity/bunkerweb/raw/v1.5.3/docs/assets/img/integration-swarm.svg" />
|
||||
</p>
|
||||
|
||||
To automatically configure BunkerWeb instances, a special service, called **autoconf** will listen for Docker Swarm events like service creation or deletion and automatically configure the **BunkerWeb instances** in real-time without downtime.
|
||||
|
||||
Like the [Docker autoconf integration](https://docs.bunkerweb.io/1.5.3/integrations/#docker-autoconf), configuration for web services is defined using labels starting with the special **bunkerweb.** prefix.
|
||||
|
||||
You will find more information in the [Swarm section](https://docs.bunkerweb.io/1.5.3/integrations/#swarm) of the documentation.
|
||||
|
||||
## Kubernetes
|
||||
|
||||
<p align="center">
|
||||
<img alt="Kubernetes banner" src="https://github.com/bunkerity/bunkerweb/raw/v1.5.3/docs/assets/img/integration-kubernetes.svg" />
|
||||
</p>
|
||||
|
||||
The autoconf acts as an [Ingress controller](https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/) and will configure the BunkerWeb instances according to the [Ingress resources](https://kubernetes.io/docs/concepts/services-networking/ingress/). It also monitors other Kubernetes objects like [ConfigMap](https://kubernetes.io/docs/concepts/configuration/configmap/) for custom configurations.
|
||||
|
||||
You will find more information in the [Kubernetes section](https://docs.bunkerweb.io/1.5.3/integrations/#kubernetes) of the documentation.
|
||||
|
||||
## Linux
|
||||
|
||||
<p align="center">
|
||||
<img alt="Linux banner" src="https://github.com/bunkerity/bunkerweb/raw/v1.5.3/docs/assets/img/integration-linux.svg" />
|
||||
</p>
|
||||
|
||||
List of supported Linux distros :
|
||||
|
||||
- Debian 11 "Bullseye"
|
||||
- Ubuntu 22.04 "Jammy"
|
||||
- Fedora 38
|
||||
- RHEL 8.7
|
||||
|
||||
Repositories of Linux packages for BunkerWeb are available on [PackageCloud](https://packagecloud.io/bunkerity/bunkerweb), they provide a bash script to automatically add and trust the repository (but you can also follow the [manual installation](https://packagecloud.io/bunkerity/bunkerweb/install) instructions if you prefer).
|
||||
|
||||
You will find more information in the [Linux section](https://docs.bunkerweb.io/1.5.3/integrations/#linux) of the documentation.
|
||||
|
||||
## Ansible
|
||||
|
||||
<p align="center">
|
||||
<img alt="Ansible banner" src="https://github.com/bunkerity/bunkerweb/raw/v1.5.3/docs/assets/img/integration-ansible.svg" />
|
||||
</p>
|
||||
|
||||
List of supported Linux distros :
|
||||
|
||||
- Debian 11 "Bullseye"
|
||||
- Ubuntu 22.04 "Jammy"
|
||||
- Fedora 38
|
||||
- RHEL 8.7
|
||||
|
||||
[Ansible](https://www.ansible.com/) is an IT automation tool. It can configure systems, deploy software, and orchestrate more advanced IT tasks such as continuous deployments or zero downtime rolling updates.
|
||||
|
||||
A specific BunkerWeb Ansible role is available on [Ansible Galaxy](https://galaxy.ansible.com/bunkerity/bunkerweb) (source code is available [here](https://github.com/bunkerity/bunkerweb-ansible)).
|
||||
|
||||
You will find more information in the [Ansible section](https://docs.bunkerweb.io/1.5.3/integrations/#ansible) of the documentation.
|
||||
|
||||
## Vagrant
|
||||
|
||||
We maintain ready to use Vagrant boxes hosted on Vagrant cloud for the following providers :
|
||||
|
||||
- virtualbox
|
||||
- libvirt
|
||||
|
||||
You will find more information in the [Vagrant section](https://docs.bunkerweb.io/1.5.3/integrations/#vagrant) of the documentation.
|
||||
|
||||
# Quickstart guide
|
||||
|
||||
Once you have setup BunkerWeb with the integration of your choice, you can follow the [quickstart guide](https://docs.bunkerweb.io/1.5.3/quickstart-guide/) that will cover the following common use cases :
|
||||
|
||||
- Protecting a single HTTP application
|
||||
- Protecting multiple HTTP application
|
||||
- Retrieving the real IP of clients when operating behind a load balancer
|
||||
- Adding custom configurations
|
||||
- Protecting generic TCP/UDP applications
|
||||
- In combination with PHP
|
||||
|
||||
# Security tuning
|
||||
|
||||
BunkerWeb offers many security features that you can configure with [settings](https://docs.bunkerweb.io/1.5.3/settings). Even if the default values of settings ensure a minimal "security by default", we strongly recommend you to tune them. By doing so you will be able to ensure a security level of your choice but also manage false positives.
|
||||
|
||||
You will find more information in the [security tuning section](https://docs.bunkerweb.io/1.5.3/security-tuning) of the documentation.
|
||||
|
||||
# Settings
|
||||
|
||||
To help you tuning BunkerWeb we have made an easy to use settings generator tool available at [config.bunkerweb.io](https://config.bunkerweb.io).
|
||||
|
||||
As a general rule when multisite mode is enabled, if you want to apply settings with multisite context to a specific server you will need to add the primary (first) server name as a prefix like `www.example.com_USE_ANTIBOT=captcha` or `myapp.example.com_USE_GZIP=yes` for example.
|
||||
|
||||
When settings are considered as "multiple", it means that you can have multiple groups of settings for the same feature by adding numbers as suffix like `REVERSE_PROXY_URL_1=/subdir`, `REVERSE_PROXY_HOST_1=http://myhost1`, `REVERSE_PROXY_URL_2=/anotherdir`, `REVERSE_PROXY_HOST_2=http://myhost2`, ... for example.
|
||||
|
||||
Check the [settings section](https://docs.bunkerweb.io/1.5.3/settings) of the documentation to get the full list.
|
||||
|
||||
# Web UI
|
||||
|
||||
<p align="center">
|
||||
<a href="https://www.youtube.com/watch?v=Ao20SfvQyr4">
|
||||
<img src="https://github.com/bunkerity/bunkerweb/raw/v1.5.3/docs/assets/img/user_interface_demo.png" height="300" />
|
||||
</a>
|
||||
</p>
|
||||
|
||||
The "Web UI" is a web application that helps you manage your BunkerWeb instance using a user-friendly interface instead of the command-line one.
|
||||
|
||||
- Start, stop, restart and reload your BunkerWeb instance
|
||||
- Add, edit and delete settings for your web applications
|
||||
- Add, edit and delete custom configurations for NGINX and ModSecurity
|
||||
- Install and uninstall external plugins
|
||||
- Explore the cached files
|
||||
- Monitor jobs execution
|
||||
- View the logs and search pattern
|
||||
|
||||
You will find more information in the [Web UI section](https://docs.bunkerweb.io/1.5.3/web-ui) of the documentation.
|
||||
|
||||
# Plugins
|
||||
|
||||
BunkerWeb comes with a plugin system to make it possible to easily add new features. Once a plugin is installed, you can manage it using additional settings defined by the plugin.
|
||||
|
||||
Here is the list of "official" plugins that we maintain (see the [bunkerweb-plugins](https://github.com/bunkerity/bunkerweb-plugins) repository for more information) :
|
||||
|
||||
| Name | Version | Description | Link |
|
||||
| :------------: | :-----: | :------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------: |
|
||||
| **ClamAV** | 1.2 | Automatically scans uploaded files with the ClamAV antivirus engine and denies the request when a file is detected as malicious. | [bunkerweb-plugins/clamav](https://github.com/bunkerity/bunkerweb-plugins/tree/main/clamav) |
|
||||
| **Coraza** | 1.2 | Inspect requests using a the Coraza WAF (alternative of ModSecurity). | [bunkerweb-plugins/coraza](https://github.com/bunkerity/bunkerweb-plugins/tree/main/coraza) |
|
||||
| **CrowdSec** | 1.2 | CrowdSec bouncer for BunkerWeb. | [bunkerweb-plugins/crowdsec](https://github.com/bunkerity/bunkerweb-plugins/tree/main/crowdsec) |
|
||||
| **Discord** | 1.2 | Send security notifications to a Discord channel using a Webhook. | [bunkerweb-plugins/discord](https://github.com/bunkerity/bunkerweb-plugins/tree/main/discord) |
|
||||
| **Slack** | 1.2 | Send security notifications to a Slack channel using a Webhook. | [bunkerweb-plugins/slack](https://github.com/bunkerity/bunkerweb-plugins/tree/main/slack) |
|
||||
| **VirusTotal** | 1.2 | Automatically scans uploaded files with the VirusTotal API and denies the request when a file is detected as malicious. | [bunkerweb-plugins/virustotal](https://github.com/bunkerity/bunkerweb-plugins/tree/main/virustotal) |
|
||||
| **WebHook** | 1.2 | Send security notifications to a custom HTTP endpoint using a Webhook. | [bunkerweb-plugins/slack](https://github.com/bunkerity/bunkerweb-plugins/tree/main/webhook) |
|
||||
|
||||
You will find more information in the [plugins section](https://docs.bunkerweb.io/1.5.3/plugins) of the documentation.
|
||||
|
||||
# Support
|
||||
|
||||
## Professional
|
||||
|
||||
We offer professional services related to BunkerWeb like :
|
||||
|
||||
* Consulting
|
||||
* Support
|
||||
* Custom development
|
||||
* Partnership
|
||||
|
||||
Please contact us at [contact@bunkerity.com](mailto:contact@bunkerity.com) if you are interested.
|
||||
|
||||
## Community
|
||||
|
||||
To get free community support you can use the following media :
|
||||
|
||||
* The #help channel of BunkerWeb in the [Discord server](https://discord.com/invite/fTf46FmtyD)
|
||||
* The help category of [GitHub discussions](https://github.com/bunkerity/bunkerweb/discussions)
|
||||
* The [/r/BunkerWeb](https://www.reddit.com/r/BunkerWeb) subreddit
|
||||
* The [Server Fault](https://serverfault.com/) and [Super User](https://superuser.com/) forums
|
||||
|
||||
Please don't use [GitHub issues](https://github.com/bunkerity/bunkerweb/issues) to ask for help, use it only for bug reports and feature requests.
|
||||
|
||||
# License
|
||||
|
||||
This project is licensed under the terms of the [GNU Affero General Public License (AGPL) version 3](https://github.com/bunkerity/bunkerweb/raw/v1.5.3/LICENSE.md).
|
||||
|
||||
# Contribute
|
||||
|
||||
If you would like to contribute to the plugins you can read the [contributing guidelines](https://github.com/bunkerity/bunkerweb/raw/v1.5.3/CONTRIBUTING.md) to get started.
|
||||
|
||||
# Security policy
|
||||
|
||||
We take security bugs as serious issues and encourage responsible disclosure, see our [security policy](https://github.com/bunkerity/bunkerweb/raw/v1.5.3/SECURITY.md) for more information.
|
||||
|
||||
# Stargazers over time
|
||||
|
||||
[](https://starchart.cc/bunkerity/bunkerweb)
|
||||
17
SECURITY.md
Normal file
17
SECURITY.md
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
# Security policy
|
||||
|
||||
Even though this project is focused on security, it is still prone to possible vulnerabilities. We consider every security bug as a serious issue and will try our best to address it.
|
||||
|
||||
## Responsible disclosure
|
||||
|
||||
If you have found a security bug, please send us an email at security \[@\] bunkerity.com (using a ProtonMail if possible) with technical details so we can resolve it as soon as possible.
|
||||
|
||||
Here is a non-exhaustive list of issues we consider as high risk :
|
||||
- Vulnerability in the code
|
||||
- Bypass of a security feature
|
||||
- Vulnerability in a third-party dependency
|
||||
- Risk in the supply chain
|
||||
|
||||
## Bounty
|
||||
|
||||
To encourage responsible disclosure, we may reward you with a bounty at the sole discretion of the maintainers.
|
||||
5
TODO
Normal file
5
TODO
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
- Ansible
|
||||
- Vagrant
|
||||
- Plugins
|
||||
- Find a way to do rdns in background
|
||||
- fix db warnings (Got an error reading communication packets)
|
||||
4
docs/Dockerfile
Normal file
4
docs/Dockerfile
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
FROM squidfunk/mkdocs-material@sha256:e5f28aa0c3ac8206f93e44a0c52ea85616b0d6c674319cd1d87a241594788355
|
||||
|
||||
COPY mkdocs.yml /docs
|
||||
COPY docs /docs/docs
|
||||
97
docs/about.md
Normal file
97
docs/about.md
Normal file
|
|
@ -0,0 +1,97 @@
|
|||
# About
|
||||
|
||||
## Who maintains BunkerWeb ?
|
||||
|
||||
BunkerWeb is maintained by [Bunkerity](https://www.bunkerity.com), a French 🇫🇷 company specialized in Cybersecurity 🛡️.
|
||||
|
||||
## Do you offer professional services ?
|
||||
|
||||
Yes, we offer professional services related to BunkerWeb such as :
|
||||
|
||||
- Consulting
|
||||
- Support
|
||||
- Custom development
|
||||
- Partnership
|
||||
|
||||
Please contact us at [contact@bunkerity.com](mailto:contact@bunkerity.com) if you are interested.
|
||||
|
||||
## Where to get community support ?
|
||||
|
||||
To get free community support, you can use the following media :
|
||||
|
||||
- The #help channel of BunkerWeb in the [Discord server](https://discord.com/invite/fTf46FmtyD)
|
||||
- The help category of [GitHub discussions](https://github.com/bunkerity/bunkerweb/discussions)
|
||||
- The [/r/BunkerWeb](https://www.reddit.com/r/BunkerWeb) subreddit
|
||||
- The [Server Fault](https://serverfault.com/) and [Super User](https://superuser.com/) forums
|
||||
|
||||
Please don't use [GitHub issues](https://github.com/bunkerity/bunkerweb/issues) to ask for help, use it only for bug reports and feature requests.
|
||||
|
||||
## How can I contribute ?
|
||||
|
||||
Here is a non-exhaustive list of what you can do :
|
||||
|
||||
- Join the [Discord server](https://discord.com/invite/fTf46FmtyD), [/r/BunkerWeb](https://www.reddit.com/r/BunkerWeb) subreddit and [GitHub discussions](https://github.com/bunkerity/bunkerweb/discussions) to talk about the project and help others
|
||||
- Follow us on [LinkedIn](https://www.linkedin.com/company/bunkerity/), [Twitter](https://twitter.com/bunkerity) and [GitHub](https://github.com/bunkerity)
|
||||
- Report bugs and propose new features using [issues](https://github.com/bunkerity/bunkerweb/issues)
|
||||
- Contribute to the code using [pull requests](https://github.com/bunkerity/bunkerweb/pulls)
|
||||
- Write an awesome [plugin](plugins.md)
|
||||
- Talk about BunkerWeb to your friends/colleagues, on social media, on your blog, ...
|
||||
|
||||
## How to report security issue ?
|
||||
|
||||
Please contact us at [security@bunkerity.com](mailto:security@bunkerity.com) using the following PGP key :
|
||||
|
||||
```conf
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQINBGCEMiMBEACtXJBDbF86qjC/Q1cfmJfYcYrbk6eE5czknG294XObC97wAgDf
|
||||
/MbX6bnti4kDRpflGDqQtwOXudcEzledTD4bdDUKvZwqPoYQGa24uCuUxSINTLXr
|
||||
RuoMaKfpvs7trsFXp5iYUqf4Org2aaJE7Tk/9sOvxgdqsT22jEgCZXTRU1qG494U
|
||||
u6XRQN8hKlw6aa6njjX9vUk6Jpl46/kwwO9mpXBZX6iFKYnBlUWs2k8d6D6cO5aZ
|
||||
KLoYyz5v3Gw2hHSqj4qbVQPTIT7qrrcfd8nblYK7Dh3IM+vQq7a7lB0AudIyBNPd
|
||||
rsypi9ZYgwI3lv/rmQnDc32Ua5cLvTvgg/XoaNK9ogc3kei1+hXODEgRA/zvSKqq
|
||||
20i/1Y0OnIGv89LOI6urWpOgDAhQUV5xvANll2lm3Bkmy29UOzNadUc/yImxrM06
|
||||
HwX82ju6PFAqOaxMW6SEE71ylGOSlikAGNcmmc5Ihd1J/VRZA4PBiQ31gQxFRpUC
|
||||
3NTw2QNAD1kjni5PuQD10Q1Ognvb6uJh/MtqsoX6r1t+Oly9MblFSuyqFkqNO3F0
|
||||
QAJqprhJlQ3YOcJdJ1EZR7qs0xJm5h+lw0Z/UINqkwiZUW3PCO8BKxfq6sfdwM8L
|
||||
5hPhyUzy2gIJ0J/4NGYEBH1ojoYODGU8OCSmyjSTY9SoVMeWDfqYP4ZTvQARAQAB
|
||||
tCVidW5rZXJpdHktcGdwIDxjb250YWN0QGJ1bmtlcml0eS5jb20+iQJUBBMBCAA+
|
||||
FiEEw78SjkcVxXCq7hStPYCAbxJgKnwFAmCEMiMCGwMFCQPCIP0FCwkIBwIGFQoJ
|
||||
CAsCBBYCAwECHgECF4AACgkQPYCAbxJgKnzvYhAAnNqGB6ce2eZzwk1EiNlNaXaA
|
||||
hFWLq/s/J1IOAP+0V5jKJxA6zTX01HyIfIIHQy6nrxxEXzYsIUHdJ+HBPCNswCqn
|
||||
2d/aDkkfoEUc1bUD0c2bXfoSCsAeIoK+eOf6iSr4IENVoIUYFQTUKFNu+Y7eDL0I
|
||||
J8Xadg53G+fkK9LE6TeYpBs3hDT4w7vlDfIwWa1NC9HoLzSmZ2fqZ7SnihLGsLmp
|
||||
98VqDrDjhRPzrz5/tVYgvPCQQU5ED/TayCCYvrGpw9gP8qmEOabIUz0ppGwEfQVs
|
||||
Wycilm1/Js/qjdbxUFMipBIzDu7bI3kMLmENhI+16Xtub9dUrvkW2SdDngYhtWj8
|
||||
IzVOe6N/XDuiRGpaYFpEuXbrnDFexe1ygZwnVHt3fukPfa7W8mhMs2kY1ishIA0O
|
||||
WElKO1Q6N0ZWEad0PwM8NCDjaDUNWQC36ZF/MS+ipHWx9joPUjImY2AXDjN+L+Si
|
||||
ABQIe4Fo6Jx6S6Bi8YvPq8idYZvaWFJjBvmaPjxdUMPbIsMRiEjvlrhvqhLuVBpE
|
||||
lGA+M4UJGw5yBl+yiiLDuws/Fppv9HwNqw6Uq1m1XaW859Om1GGBKYfphyn+fHjR
|
||||
7ftOuT7Ss4zioXT4mscOZgkfzDAqgpZiHjYhe7tLUu7iD6UEsZmey/gRV0hCxng3
|
||||
N7yaRrBu0+3sIQV4jYC5Ag0EYIQyIwEQALSurJGOx7At5mRFjvhXd4/JHuBZZOSI
|
||||
M45LSJ+mKYnAGmwsL0AneZMIf6Yc0Vcn32oqlIXN5aB8jIt91pChLre8tl/lFZZP
|
||||
xY3WIEBJhZF0FIUqSQLjg4HD0S70REii7Om1kgtZueid8V6T5F1JDcO2mDoh8oc9
|
||||
h9nRQ1Ld6dblEuwBzbFkI1K6OUk1+ec7+mQc7orHdBVgelmqwG7fGZnPiN3XfklF
|
||||
dnwSkFIX/qkAsKQmmx1VSzaGFoPLajf4wrkzZdA3iEafsHyvdEFlezZCZ7TsoHBh
|
||||
tNg1Psg6MbBVgiMfHyRHSEBJZ7r5Awj2MpFUFMOd1IPcor1I254mx0VYfCvof4Km
|
||||
Ri1F/86kHc23A77pd4HFYZWiZjaWhh12L+wz5fDL5/sSFXVGSCtSWIKx6FjysZ+v
|
||||
szk3lItHoomZhA7M+FjU/cOjq9hae9uwZeU39DQk0/npln2RcHitoqgUIzII5woO
|
||||
S3SlMSc910tHf40D2cBr1iFKC0jQICjkDexB9CtNx/N25SJmLfiimYtk6/NHlPq4
|
||||
HXdq6ZfLZ7xQmuGcyWv4f0pwA2CK3twISpsIxIKe456WYTDtQu9d1s987dvmw6F/
|
||||
qURC6m2WPGroHb8COQTKzbshjpGUmLpyR3FXki4wNXeI1KaQLL7NpZmK6yJlWviO
|
||||
1sCjh4m7VS+zABEBAAGJAjwEGAEIACYWIQTDvxKORxXFcKruFK09gIBvEmAqfAUC
|
||||
YIQyIwIbDAUJA8Ig/QAKCRA9gIBvEmAqfP2WEACqmXEhu4ARl2yT9bay0+W3F1q1
|
||||
MrLQkcVOau2ihXx3PhYsXRUoEFj72VDAar41WIlHsPJfB14WtSlYcX2XdjHLHMpC
|
||||
dL2eGhqIcHzFChR0vGjtvm2wae/rJTChWf8WXiHrRnRcfFFfhpCvkNi43fQeH4yp
|
||||
cel2a35WV+IRbnkCkaly2NG3XO0t83Siok8Ku+OJGPatUMxJmaEVQeeXVPDzVRva
|
||||
rtvyd9Sclkd9QDPBLZyWHC1vsPKGRJpi5uDZjGxhaFRkimw/SYtFHj7AUrMKAIHB
|
||||
GfEcwC3Eq4rF0FeCOPfBd2vwGGrRflx76jK9rj288ta9Oq6u6ev8PCVzt0E7jrSf
|
||||
AX88vfVRcxihNfj/9i5xmY596jpgbvNA2aJX2hAO3Q8pD6AunVXPUyc3RlFHt7jC
|
||||
tL+9Xv7Qwjz7OToWqj+9cM6T+6oZLxYNVPT72Z/KOFW+mzGb87qjcsDMb/hu2fNq
|
||||
tSWyZk2AAgHQyG1y8vCQQzsDnUDM6NIPwYG5XMP+11WAsPk5fP1ksixpUqIWgjhY
|
||||
M22YUsjLeaRtgSmhAGIkbBgecs1EHSZZ6sf2lB8gSom1wW0UCBPSifP0DwYFizS5
|
||||
SOk62kZ0lqEctwgKDe3MNQnPxt9+tU9L1pIkyXgXihcOLiCMl434K0djJXxIbiX0
|
||||
JvbFAfI3qteepvnjBQ==
|
||||
=g1tf
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
```
|
||||
19
docs/assets/extra.css
Normal file
19
docs/assets/extra.css
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
:root {
|
||||
--md-primary-fg-color: #125678;
|
||||
--md-text-font: "Roboto";
|
||||
}
|
||||
|
||||
.md-footer {
|
||||
background-color: #125678;
|
||||
}
|
||||
|
||||
/*
|
||||
@font-face {
|
||||
font-family: Consolas, monaco, monospace;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: "TitleFont";
|
||||
src: "assets/font-title.woff";
|
||||
}
|
||||
*/
|
||||
BIN
docs/assets/favicon.png
Normal file
BIN
docs/assets/favicon.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 1.4 KiB |
1
docs/assets/img/bunkerweb_db.svg
Normal file
1
docs/assets/img/bunkerweb_db.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 38 KiB |
1
docs/assets/img/concepts.svg
Normal file
1
docs/assets/img/concepts.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 76 KiB |
86
docs/assets/img/core-order.svg
Executable file
86
docs/assets/img/core-order.svg
Executable file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 138 KiB |
BIN
docs/assets/img/demo.gif
Normal file
BIN
docs/assets/img/demo.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 48 MiB |
1
docs/assets/img/integration-ansible.svg
Normal file
1
docs/assets/img/integration-ansible.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 91 KiB |
1
docs/assets/img/integration-autoconf.svg
Normal file
1
docs/assets/img/integration-autoconf.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 104 KiB |
1
docs/assets/img/integration-docker.svg
Normal file
1
docs/assets/img/integration-docker.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 70 KiB |
1
docs/assets/img/integration-kubernetes.svg
Normal file
1
docs/assets/img/integration-kubernetes.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 170 KiB |
1
docs/assets/img/integration-linux.svg
Normal file
1
docs/assets/img/integration-linux.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 98 KiB |
1
docs/assets/img/integration-swarm.svg
Normal file
1
docs/assets/img/integration-swarm.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 138 KiB |
1
docs/assets/img/intro-overview.svg
Normal file
1
docs/assets/img/intro-overview.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 111 KiB |
BIN
docs/assets/img/todo.jpg
Normal file
BIN
docs/assets/img/todo.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 3.6 KiB |
BIN
docs/assets/img/user_interface_demo.png
Normal file
BIN
docs/assets/img/user_interface_demo.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 66 KiB |
BIN
docs/assets/logo.png
Normal file
BIN
docs/assets/logo.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 4 KiB |
146
docs/concepts.md
Normal file
146
docs/concepts.md
Normal file
|
|
@ -0,0 +1,146 @@
|
|||
# Concepts
|
||||
|
||||
<figure markdown>
|
||||
{ align=center, width="600" }
|
||||
</figure>
|
||||
|
||||
## Integrations
|
||||
|
||||
The first concept is the integration of BunkerWeb into the target environment. We prefer to use the word "integration" instead of "installation" because one of the goals of BunkerWeb is to integrate seamlessly into existing environments.
|
||||
|
||||
The following integrations are officially supported :
|
||||
|
||||
- [Docker](integrations.md#docker)
|
||||
- [Docker autoconf](integrations.md#docker-autoconf)
|
||||
- [Swarm](integrations.md#swarm)
|
||||
- [Kubernetes](integrations.md#kubernetes)
|
||||
- [Linux](integrations.md#linux)
|
||||
- [Ansible](integrations.md#ansible)
|
||||
- [Vagrant](integrations.md#vagrant)
|
||||
|
||||
If you think that a new integration should be supported, do not hesitate to open a [new issue](https://github.com/bunkerity/bunkerweb/issues) on the GitHub repository.
|
||||
|
||||
!!! info "Going further"
|
||||
|
||||
The technical details of all BunkerWeb integrations are available in the [integrations section](integrations.md) of the documentation.
|
||||
|
||||
## Settings
|
||||
|
||||
Once BunkerWeb is integrated into your environment, you will need to configure it to serve and protect your web applications.
|
||||
|
||||
The configuration of BunkerWeb is done by using what we call the "settings" or "variables". Each setting is identified by a name such as `AUTO_LETS_ENCRYPT` or `USE_ANTIBOT`. You can assign values to the settings to configure BunkerWeb.
|
||||
|
||||
Here is a dummy example of a BunkerWeb configuration :
|
||||
|
||||
```conf
|
||||
SERVER_NAME=www.example.com
|
||||
AUTO_LETS_ENCRYPT=yes
|
||||
USE_ANTIBOT=captcha
|
||||
REFERRER_POLICY=no-referrer
|
||||
USE_MODSECURITY=no
|
||||
USE_GZIP=yes
|
||||
USE_BROTLI=no
|
||||
```
|
||||
|
||||
!!! info "Going further"
|
||||
|
||||
The complete list of available settings with descriptions and possible values is available in the [settings section](settings.md) of the documentation.
|
||||
|
||||
!!! info "Settings generator tool"
|
||||
|
||||
To help you tune BunkerWeb, we offer an easy-to-use settings generator tool available at [config.bunkerweb.io](https://config.bunkerweb.io).
|
||||
|
||||
## Multisite mode
|
||||
|
||||
Understanding the multisite mode is essential when utilizing BunkerWeb. As our primary focus is safeguarding web applications, our solution is intricately linked to the concept of "virtual hosts" or "vhosts" (more info [here](https://en.wikipedia.org/wiki/Virtual_hosting)). These virtual hosts enable the serving of multiple web applications from a single instance or cluster.
|
||||
|
||||
By default, BunkerWeb has the multisite mode disabled. This means that only one web application will be served, and all settings will be applied to it. This setup is ideal when you have a single application to protect, as you don't need to concern yourself with multisite configurations.
|
||||
|
||||
However, when the multisite mode is enabled, BunkerWeb becomes capable of serving and protecting multiple web applications. Each web application is identified by a unique server name and has its own set of settings. This mode proves beneficial when you have multiple applications to secure, and you prefer to utilize a single instance (or a cluster) of BunkerWeb.
|
||||
|
||||
The activation of the multisite mode is controlled by the `MULTISITE` setting, which can be set to `yes` to enable it or `no` to keep it disabled (which is the default value).
|
||||
|
||||
Each setting within BunkerWeb has a specific context that determines where it can be applied. If the context is set to "global," the setting can't be applied per server or site but is instead applied to the entire configuration as a whole. On the other hand, if the context is "multisite," the setting can be applied globally and per server. To define a multisite setting for a specific server, simply add the server name as a prefix to the setting name. For example, `app1.example.com_AUTO_LETS_ENCRYPT` or `app2.example.com_USE_ANTIBOT` are examples of setting names with server name prefixes. When a multisite setting is defined globally without a server prefix, all servers inherit that setting. However, individual servers can still override the setting if the same setting is defined with a server name prefix.
|
||||
|
||||
Understanding the intricacies of multisite mode and its associated settings allows you to tailor BunkerWeb's behavior to suit your specific requirements, ensuring optimal protection for your web applications.
|
||||
|
||||
Here's a dummy example of a multisite BunkerWeb configuration :
|
||||
|
||||
```conf
|
||||
MULTISITE=yes
|
||||
SERVER_NAME=app1.example.com app2.example.com app3.example.com
|
||||
AUTO_LETS_ENCRYPT=yes
|
||||
USE_GZIP=yes
|
||||
USE_BROTLI=yes
|
||||
app1.example.com_USE_ANTIBOT=javascript
|
||||
app1.example.com_USE_MODSECURITY=no
|
||||
app2.example.com_USE_ANTIBOT=cookie
|
||||
app2.example.com_WHITELIST_COUNTRY=FR
|
||||
app3.example.com_USE_BAD_BEHAVIOR=no
|
||||
```
|
||||
|
||||
!!! info "Going further"
|
||||
|
||||
You will find concrete examples of multisite mode in the [quickstart guide](quickstart-guide.md) of the documentation and the [examples](https://github.com/bunkerity/bunkerweb/tree/v1.5.3/examples) directory of the repository.
|
||||
|
||||
## Custom configurations
|
||||
|
||||
To address unique challenges and cater to specific use cases, BunkerWeb offers the flexibility of custom configurations. While the provided settings and [external plugins](plugins.md) cover a wide range of scenarios, there may be situations that require additional customization.
|
||||
|
||||
BunkerWeb is built on the renowned NGINX web server, which provides a powerful configuration system. This means you can leverage NGINX's configuration capabilities to meet your specific needs. Custom NGINX configurations can be included in various [contexts](https://docs.nginx.com/nginx/admin-guide/basic-functionality/managing-configuration-files/#contexts) such as HTTP or server, allowing you to fine-tune the behavior of BunkerWeb according to your requirements. Whether you need to customize global settings or apply configurations to specific server blocks, BunkerWeb empowers you to optimize its behavior to align perfectly with your use case.
|
||||
|
||||
Another integral component of BunkerWeb is the ModSecurity Web Application Firewall. With custom configurations, you have the flexibility to address false positives or add custom rules to further enhance the protection provided by ModSecurity. These custom configurations allow you to fine-tune the behavior of the firewall and ensure that it aligns with the specific requirements of your web applications.
|
||||
|
||||
By leveraging custom configurations, you unlock a world of possibilities to tailor BunkerWeb's behavior and security measures precisely to your needs. Whether it's adjusting NGINX configurations or fine-tuning ModSecurity, BunkerWeb provides the flexibility to meet your unique challenges effectively.
|
||||
|
||||
!!! info "Going further"
|
||||
|
||||
You will find concrete examples of custom configurations in the [quickstart guide](quickstart-guide.md) of the documentation and the [examples](https://github.com/bunkerity/bunkerweb/tree/v1.5.3/examples) directory of the repository.
|
||||
|
||||
## Database
|
||||
|
||||
BunkerWeb securely stores its current configuration in a backend database, which contains essential data for smooth operation. The following information is stored in the database:
|
||||
|
||||
- **Settings for all services**: The database holds the defined settings for all the services provided by BunkerWeb. This ensures that your configurations and preferences are preserved and readily accessible.
|
||||
|
||||
- **Custom configurations**: Any custom configurations you create are also stored in the backend database. This includes personalized settings and modifications tailored to your specific requirements.
|
||||
|
||||
- **BunkerWeb instances**: Information about BunkerWeb instances, including their setup and relevant details, is stored in the database. This allows for easy management and monitoring of multiple instances if applicable.
|
||||
|
||||
- **Metadata about job execution**: The database stores metadata related to the execution of various jobs within BunkerWeb. This includes information about scheduled tasks, maintenance processes, and other automated activities.
|
||||
|
||||
- **Cached files**: BunkerWeb utilizes caching mechanisms for improved performance. The database holds cached files, ensuring efficient retrieval and delivery of frequently accessed resources.
|
||||
|
||||
Under the hood, whenever you edit a setting or add a new configuration, BunkerWeb automatically stores the changes in the database, ensuring data persistence and consistency. BunkerWeb supports multiple backend database options, including SQLite, MariaDB, MySQL, and PostgreSQL.
|
||||
|
||||
Configuring the database is straightforward using the `DATABASE_URI` setting, which follows the specified formats for each supported database:
|
||||
|
||||
- **SQLite**: `sqlite:///var/lib/bunkerweb/db.sqlite3`
|
||||
- **MariaDB**: `mariadb+pymysql://bunkerweb:changeme@bw-db:3306/db`
|
||||
- **MySQL**: `mysql+pymysql://bunkerweb:changeme@bw-db:3306/db`
|
||||
- **PostgreSQL**: `postgresql://bunkerweb:changeme@bw-db:5432/db`
|
||||
|
||||
By specifying the appropriate database URI in the configuration, you can seamlessly integrate BunkerWeb with your preferred database backend, ensuring efficient and reliable storage of your configuration data.
|
||||
|
||||
<figure markdown>
|
||||
{ align=center, width="800" }
|
||||
<figcaption>Database Schema</figcaption>
|
||||
</figure>
|
||||
|
||||
## Scheduler
|
||||
|
||||
For seamless coordination and automation, BunkerWeb employs a specialized service known as the scheduler. The scheduler plays a vital role in ensuring smooth operation by performing the following tasks:
|
||||
|
||||
- **Storing settings and custom configurations**: The scheduler is responsible for storing all the settings and custom configurations within the backend database. This centralizes the configuration data, making it easily accessible and manageable.
|
||||
|
||||
- **Executing various tasks (jobs)**: The scheduler handles the execution of various tasks, referred to as jobs. These jobs encompass a range of activities, such as periodic maintenance, scheduled updates, or any other automated tasks required by BunkerWeb.
|
||||
|
||||
- **Generating BunkerWeb configuration**: The scheduler generates a configuration that is readily understood by BunkerWeb. This configuration is derived from the stored settings and custom configurations, ensuring that the entire system operates cohesively.
|
||||
|
||||
- **Acting as an intermediary for other services**: The scheduler acts as an intermediary, facilitating communication and coordination between different components of BunkerWeb. It interfaces with services such as the web UI or autoconf, ensuring a seamless flow of information and data exchange.
|
||||
|
||||
In essence, the scheduler serves as the brain of BunkerWeb, orchestrating various operations and ensuring the smooth functioning of the system.
|
||||
|
||||
Depending on the integration approach, the execution environment of the scheduler may differ. In container-based integrations, the scheduler is executed within its dedicated container, providing isolation and flexibility. On the other hand, for Linux-based integrations, the scheduler is self-contained within the bunkerweb service, simplifying the deployment and management process.
|
||||
|
||||
By employing the scheduler, BunkerWeb streamlines the automation and coordination of essential tasks, enabling efficient and reliable operation of the entire system.
|
||||
1
docs/diagrams/concepts.drawio
Normal file
1
docs/diagrams/concepts.drawio
Normal file
File diff suppressed because one or more lines are too long
1
docs/diagrams/core-order.drawio
Executable file
1
docs/diagrams/core-order.drawio
Executable file
|
|
@ -0,0 +1 @@
|
|||
<mxfile host="app.diagrams.net" modified="2022-10-13T12:11:36.746Z" agent="5.0 (Windows)" etag="qIM9S_K3KBWfpHSqmD4a" version="20.4.0"><diagram id="C5RBs43oDa-KdzZeNtuy" name="Page-1">7Z1df6I4FIc/jZfdHxDevFSkrVuHzqjdrntHlVF20HQR2zqffkMhAglqtEJoYW4Gjrz/z3OScxJoCxjLtxvffl58gzPHa0nC7K0Fei1JkkRdR/+Flm1sAWo7ssx9dxbZxMQwcn87sVGIrRt35qwzGwYQeoH7nDVO4WrlTIOMzfZ9+Jrd7Cf0smd9tucOZRhNbY+2PrqzYBFZdUlL7LeOO1/gM4v4/pY23ji+k/XCnsHXlAmYLWD4EAbR0vLNcLzw6eHn8tjfPnqDX+rNnz/W/9kP3bux9ddVdLDrU3bZ3YLvrIKzD73a2Lf9lfFyfbUdXc2DjvjPuH8lg+jYL7a3iR9YfLPBFj9BZ4YeaLwK/WAB53Ble2Zi7fpws5o54XkEtJZsM4DwGRlFZPzXCYJt7B32JoDItAiWXvxrdM7wRIRoR+443m4NN/7UOXCbsYKB7c+d4NDjkHa6IiIcuHQCf4t29B3PDtyX7NXZsWfOd9slTx8txAKcIIaQo4XqoevtztwXtDgPFzuGYY5G+Ad0ntRvOZt3zZu+he1PPrkluT8pvechTkOJXxdu4Iye7ffH/IpiRZ6AL44fOG9nSEg/cRyA2nJ0nDj8KNHaa0KyiPFcpCjWhYIkwnh8cV5kRl6kPeqVw4tMafF42x+bg/5obKI19GyvKXH8BVw+bdbHPfqn63kG9KD/vh8QRUXVtNAOV0HKfv3+r0ACVFXIEHCF/T3NgJLDgAgKg4B+8F8Rgl135SgFgCcF+MBHmo3B0Oz0JiEVzI0B3Zh0LCsh68w2hZ3APaTtI7MoAvV29QhU60EgYCVQ4Uog3YnuDjrG3YUaoopgIO56WhXiQK8HBworBxpXDhRKjZuhOfliGAClehhoLF0A4/7BGg8nTWt/WF9Fr5y+oB5Zp9RmDHOAa9qJL/Mwbbuol5RfjhLXs0bdQe2BE9v8gatHhgtYM1zANcMFTBnuOcB1H6w7c2iZ49pBR/ZiqgBdXi+mfOjQY/W3f6dXJuHB/lDwau8tPni0to3XCoeVNRkG+gdhjXf9Dl104YnLCHLWZSRFyR4jurJ4N8IZdtfxAf/IG6uikB52xiYz/4P+t/64hn1cMpWvAv108niQfsd7gq9p8N8N6IfwcblT23sHdNYJh5CRderZ67U7zeqRjRXngu+8ucFuN7Sc2gutJTuFK2UFC5wRHq8YtPM9JeUIeX6AbR+NKaqWdUSF9K/oTqmYQh9JI1xaJscA90Qn5CD2NrXZc7jB+sAla8SAjKhmxt3RQnTIi8Y+WWmaQrKFYxnP55oogrzqJD0yY4373fuwB2rcmsYdc9tlmWavfk2X1q5cy4W7RRedt2Fava8zawMpQotU6rwNWW3iJxkWWeKnkK9zSfM7mPL+UQqVo1gZt53BwLRu9qYIZHzcuYDIECOzsRB1BAxVPxA7i8JPJgpqzNOm1MLwk7niJ1QMP4kVP670SSz0fR/en9SuDc0fD+ZofH6H5SsAydocFscj04Bhz7TYRwsbYdMq8lP2xBkRBZZRUoF2komzh8soeLkKZRSZtYyyr6NUThll97JF7IaA7EezVlEkorYByKTpQkUUmaw/KmXUUPLGbT9VhTHBYdJK6o2cKozMOcSeOUnloLErKOKyIBl5WdEgR6llsRg0qAJHGWgoeSWMBo2ip63yRUMjau9y+0w0dLL0LheDRlvggUZeEaJBo+iZrJxbDeFSrYZSTqshCjx6VEpeiaBho+gxW85skEO2pEuzsqGSzQYJ2aXYEAEPNk58s7rqbAh82WCdGsyZDfVIT4iZDTKjJ/tmn5uNE6fXNmwcYoN5Fi/ndIPwtLOn+mhkJl7UTB8+fapPPw+uUmx8jlScDPfntxtkAbegdqMt8kCDbT7VYHD/2Axb5XrznmErgN2N27CV0tTmecyPVPa8KlBSb5kojijnDlupwpGuxYWiHjlbGWglRD3MXAXQIEZ0RVY00t0BziO6CvPUYa4juoB412ZXkDwVDUAMJ8lKMWjIZMJaBhpasXnkCq6cg1yc0eFFh792w7ssZ/4CTx/WyfB+bqFQJI+EneviGR8gP7ZVxrsdGkvGV0pf5oPuWPHuxnE3Yq5AENGZtXJ9MY+hEyHrnvIZlDQEWS9ZBz785eBMIw5v6aQkNtmeO1+FroZkd5C9i+NjJ/5h6c5m7wE0L+HJ+mKroByGHHSmp1SqOa5U2EsgGp3A1E4SUSAjPl9NdLrnXD9NJL1amtDTKSbmqG6iKGK1RJEaUChN8mbpl6sKPYJcP1U08jslgLcqdM5ZP1XIRoU/K3QOVT9VBKFqqtCfqa1fY08WjfmrQr/8VTtWdLJcib+ozE0UOqWvISrkpzfxRCFeqrTpDLJ+qlBj/XidmypNDhmqIFdNliaLROmJVjVV6CyyhrAoxBdp+MtCp5GNLLtvqfGThc4jaygLFcS4y9IkknktfnGyoNXkDxtGw5bJ34cE5v8=</diagram></mxfile>
|
||||
1
docs/diagrams/integration-ansible.drawio
Normal file
1
docs/diagrams/integration-ansible.drawio
Normal file
File diff suppressed because one or more lines are too long
1
docs/diagrams/integration-autoconf.drawio
Normal file
1
docs/diagrams/integration-autoconf.drawio
Normal file
File diff suppressed because one or more lines are too long
1
docs/diagrams/integration-docker.drawio
Normal file
1
docs/diagrams/integration-docker.drawio
Normal file
File diff suppressed because one or more lines are too long
1
docs/diagrams/integration-kubernetes.drawio
Normal file
1
docs/diagrams/integration-kubernetes.drawio
Normal file
|
|
@ -0,0 +1 @@
|
|||
<mxfile host="app.diagrams.net" modified="2022-04-18T18:09:08.815Z" agent="5.0 (Windows)" etag="uCmxwbMvDXNNCQliGYIF" version="17.4.5"><diagram id="To2Da4PRRWEcok_Ws3eM" name="Page-1">7Vxtd6I4FP41fqyHFwP40aLOetrRbtvZmf2IEJEtEhdia/fXb4IBIYnjS8XiDJ6eCjchyM3zPCT3Blq6vVh/iZ3l/CvyYNjSFG/d0vstTVMV3SJf1PK+sQDT2Bj8OPBYpa3hKfgPZkcy6yrwYFKqiBEKcbAsG10URdDFJZsTx+itXG2GwvJZl44PBcOT64Si9Xvg4TmzqoqyLfgDBv6cndoCrGDhZJWZIZk7HnormPRBS7djhPBma7G2YUidl/llc9xwR2n+w2IY4UMOGGkTy5v/dzddjpcunPQj95+7G9YZr064Yhfc0oyQtHc7JRs+3bAn4+fHyT2p9XDfGw+ycnKivAq7QPyeeS1Gq8iD9MQqKX6bBxg+LR2Xlr4RnBDbHC9CVjwLwtBGIYrJfoQiUuk2wTF6gZmxpemqBgzTopVRhIfOIggpnmwUJSh0EmZ/Qqs4PcccYwIPDeg98o84hP6jFZK2j5AfQmcZJG0XLdICN0mrDmebVskm367sd7zCGAcEJr0w8CNShtEyd0SxT1g30epwXTCxPvoC0QLimJxWYaUdk+Hlndt/28IvZ8e8gDzVYEaHQd7P296igmwwYBwBEnU/SMaTPkGGQj3UAKRagKigDJBcYPYCpFMVQDrHAERrAHJZBakBQMAxABk3AKkWIGa3dgAxJQDhOpyMn5Z0cxbCdY+O7IgzYOSxzb5LnJkEbrnftyBROBQQRw+HBvkIUGD4uDQK5L0dOlMYPqAkwAGiVpf0OowL1e+5ClOEMTmffuuwdvIjyHf8/oO6og2y3b+ZZ9Kd/rq09872dgIOO7EP8f5xA/RKQ2wRlgXYAQnqMlsMQwcHr+WBuQyJ7AwPKCC/OEe9BkAJ9cJ4KUl7lR1VHEjzDell+phcOxu/CO2kvMiv+nSqWAJVRmN78nU0/kKsz4+94XBkC+QhyoDL1JCDXtRJAUc8UBeB59HTSDWYI+AOpbs0186goUAFbbVbwkFXVFFV7bYNTYS0DirS0e6HdZR1eyOiO0TUGwa0S34ujbWRvLJSqcA4TfK6yp6GKta8bDDSjA9+pfFBp1ZkASY3PtBPHB8A0GmrWrmtC48RVFnIpuHLlfMF1IovVvdM42lL3zEdvRRZtE8giweg5XV+G7IkpA9x5q1piNwX6sB1gH8wZ9HtlD1tDbDdLX/oTkafLe1KpGOHncK7JHPoToBc5f1MN8r81Exu0nEoPzvmnoaq5qcu8HM0fh48jnv3zYz3cjNe3VDaSvFjlFGR7X/m9FeVZSIaKW+knJPoKxtqGRY3QrK67RPFXIj9i01VLediMqiR88vLOcFUSc7VGqq5LCu0SQ1Sv21Tg0Wb4jnYuaHbN0nspkcZ/67QBjy0A6j7ifN3uD51fO72gtPzVrLT3n4b3w0evw9uC+lK2c8SzByyT05kFgH482xmaZJOP9cJWY2LQubyWgKpRIYrS1uqYjLm4mhUZg675WW23ZhN0ao8DR7/GtmDmgO0AsDo6qcDRpagqYGkHQOiKxe+M+AKaHUTIk1MkOTddNP79jyxJ+NhXXrgCm89fI9/vpJoshB/oyRXpiRWp3ZKIouG1xhDv9mQhgdMDYRIDM8K/t4Tc8uiSIdG3HZ0wa8acTs107grWlGK4DGnlRe2pDUOWeiyN5DGwgg1CaQBs9PmlgHqp6YtJW11ANdWxaE0bfdswgteM/W7W01hHEEMCYiV3sMoX3odS+6zheMEFjcxuOoXEQLTkuj5hQNvujibeISOR3n8Sq6WeMWmTUR+DKmLFCeiZS6KZoG/IF12fuCEcIYb2GSw4WL4epaQLWJGpqLneEJsqdg3nRvjTw9ptjdA7y8+nEufEDtuCHDkstPfbARwRM7NPC3nZu7LuclWvnJ39Qusrvi8xRQc5bSTM3D841mSps43bJCyVZzh9d8jAmwCSYptxYcRjB0Mc01fkT0K0WZAsF/ZBRmXsOLUNRZ6RzbZq25wIEXPx6d7jdafrPWZnh+n9WpdtB5chdbzAs1T6WClt/Y0VLHOi4uhGp2vh84bplY/YZc9pM0L+wvE7pz1RwEOnpPM835KezIp9yQn6ZplgoEmi6HO0g8pWVJWpJcIbskfvS+SH2grbUOnXy3Qp7NQWqCmZo2zdqXWtAm+ZndHw2Z6NCmXNKJyNs3i6pI/cnnsRrhY+/T1OO2XPBTTDlx6H7hdxqN0o08AeJ1YBlxEGkgi0qZsMmpVhOPd77RhCQw3h9s2mZDJiZBfGGVRjsMyCw1DKmNIEPm/4njvDBS0uOc8gXIYBa2q4kHisig7HWB8lQQHG8ZUxhh38QmEOe51JvUikqYCjkhiZNWSEIl/vPNsRPr48/xNbvWnoNkVD903RT53bvWQ6fVhydZPmzZziy0Bnww9OLFqcVlV/jZV8bT5DC8baEh3GOnUhnQffAibn3ydSjo+VgX4XGHVpBNTiH04CyIanIpXYbp2YUY6njgWTikXYfwauNTcxKqqnd+bahkZnQu/50gOF0kOK4OLu0qo7jRBzUsnrzSlnb3u+TJYIbvb9ydvlGj7Fmp98D8=</diagram></mxfile>
|
||||
1
docs/diagrams/integration-linux.drawio
Normal file
1
docs/diagrams/integration-linux.drawio
Normal file
File diff suppressed because one or more lines are too long
1
docs/diagrams/integration-swarm.drawio
Normal file
1
docs/diagrams/integration-swarm.drawio
Normal file
File diff suppressed because one or more lines are too long
1
docs/diagrams/intro-overview.drawio
Normal file
1
docs/diagrams/intro-overview.drawio
Normal file
File diff suppressed because one or more lines are too long
67
docs/index.md
Normal file
67
docs/index.md
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
# Introduction
|
||||
|
||||
## Overview
|
||||
|
||||
<figure markdown>
|
||||
{ align=center, width="800" }
|
||||
<figcaption>Make your web services secure by default !</figcaption>
|
||||
</figure>
|
||||
|
||||
Introducing BunkerWeb, the **cutting-edge** and **open-source Web Application Firewall** (WAF) that will revolutionize your web security experience.
|
||||
|
||||
With BunkerWeb, your web services are safeguarded by default, providing you with peace of mind and enhanced protection. Powered by [NGINX](https://nginx.org/), this comprehensive web server combines advanced features seamlessly, ensuring your online assets remain secure.
|
||||
|
||||
BunkerWeb effortlessly integrates into your existing environments, whether it's [Linux](integrations.md#linux), [Docker](integrations.md#docker), [Swarm](integrations.md#swarm), [Kubernetes](integrations.md#kubernetes), or more. Its versatility allows for easy configuration to suit your specific requirements. Don't worry if you prefer a user-friendly interface—BunkerWeb offers an exceptional [web UI](web-ui.md) alongside the command-line interface (CLI), ensuring accessibility for all users.
|
||||
|
||||
Experience the transformation in cybersecurity, where complexities and obstacles are a thing of the past. With BunkerWeb, fortifying your digital assets has never been more delightful and hassle-free.
|
||||
|
||||
Furthermore, BunkerWeb boasts a comprehensive set of primary [security features](security-tuning.md) at its core. However, what sets it apart is its remarkable flexibility through an intuitive [plugin system](plugins.md). This ingenious design empowers you to effortlessly enhance BunkerWeb with additional security measures, ensuring a tailored and robust defense for your web applications.
|
||||
|
||||
By seamlessly integrating new plugins into BunkerWeb, you can customize and expand its capabilities to address specific security requirements unique to your environment. Whether you need to strengthen authentication protocols, bolster threat detection, or implement specialized security measures, BunkerWeb's [plugin system](plugins.md) grants you the freedom to fortify your web infrastructure with ease.
|
||||
|
||||
With BunkerWeb's dynamic [plugin system](plugins.md), security becomes an enjoyable journey of exploration and empowerment. Discover the endless possibilities and create a fortified web environment that perfectly aligns with your needs.
|
||||
|
||||
|
||||
## Why BunkerWeb ?
|
||||
|
||||
- **Easy integration into existing environments** : Seamlessly integrate BunkerWeb into various environments such as Linux, Docker, Swarm, Kubernetes, Ansible, Vagrant, and more. Enjoy a smooth transition and hassle-free implementation.
|
||||
|
||||
- **Highly customizable** : Tailor BunkerWeb to your specific requirements with ease. Enable, disable, and configure features effortlessly, allowing you to customize the security settings according to your unique use case.
|
||||
|
||||
- **Secure by default** : BunkerWeb provides out-of-the-box, hassle-free minimal security for your web services. Experience peace of mind and enhanced protection right from the start.
|
||||
|
||||
- **Awesome web UI** : Take control of BunkerWeb more efficiently with the exceptional web user interface (UI). Navigate settings and configurations effortlessly through a user-friendly graphical interface, eliminating the need for the command-line interface (CLI).
|
||||
|
||||
- **Plugin system** : Extend the capabilities of BunkerWeb to meet your own use cases. Seamlessly integrate additional security measures and customize the functionality of BunkerWeb according to your specific requirements.
|
||||
|
||||
- **Free as in "freedom"** : BunkerWeb is licensed under the free [AGPLv3 license](https://www.gnu.org/licenses/agpl-3.0.en.html), embracing the principles of freedom and openness. Enjoy the freedom to use, modify, and distribute the software, backed by a supportive community.
|
||||
|
||||
## Security features
|
||||
|
||||
Explore the impressive array of security features offered by BunkerWeb. While not exhaustive, here are some notable highlights:
|
||||
|
||||
- **HTTPS** support with transparent **Let's Encrypt** automation : Easily secure your web services with automated Let's Encrypt integration, ensuring encrypted communication between clients and your server.
|
||||
|
||||
- **State-of-the-art web security** : Benefit from cutting-edge web security measures, including comprehensive HTTP security headers, prevention of data leaks, and TLS hardening techniques.
|
||||
|
||||
- Integrated **ModSecurity WAF** with the **OWASP Core Rule Set** : Enjoy enhanced protection against web application attacks with the integration of ModSecurity, fortified by the renowned OWASP Core Rule Set.
|
||||
|
||||
- **Automatic ban** of strange behaviors based on HTTP status code : BunkerWeb intelligently identifies and blocks suspicious activities by automatically banning behaviors that trigger abnormal HTTP status codes.
|
||||
|
||||
- Apply **connections and requests limit** for clients : Set limits on the number of connections and requests from clients, preventing resource exhaustion and ensuring fair usage of server resources.
|
||||
|
||||
- **Block bots** with **challenge-based verification** : Keep malicious bots at bay by challenging them to solve puzzles such as cookies, JavaScript tests, captcha, hCaptcha, reCAPTCHA or Turnstile, effectively blocking unauthorized access.
|
||||
|
||||
- **Block known bad IPs** with external blacklists and DNSBL : Utilize external blacklists and DNS-based blackhole lists (DNSBL) to proactively block known malicious IP addresses, bolstering your defense against potential threats.
|
||||
|
||||
- **And much more...** : BunkerWeb is packed with a plethora of additional security features that go beyond this list, providing you with comprehensive protection and peace of mind.
|
||||
|
||||
To delve deeper into the core security features, we invite you to explore the [security tuning](security-tuning.md) section of the documentation. Discover how BunkerWeb empowers you to fine-tune and optimize security measures according to your specific needs.
|
||||
|
||||
## Demo
|
||||
|
||||
<p align="center">
|
||||
<iframe style="display: block;" width="560" height="315" src="https://www.youtube-nocookie.com/embed/ZhYV-QELzA4" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
|
||||
</p>
|
||||
|
||||
A demo website protected with BunkerWeb is available at [demo.bunkerweb.io](https://demo.bunkerweb.io). Feel free to visit it and perform some security tests.
|
||||
1256
docs/integrations.md
Normal file
1256
docs/integrations.md
Normal file
File diff suppressed because it is too large
Load diff
89
docs/json2md.py
Executable file
89
docs/json2md.py
Executable file
|
|
@ -0,0 +1,89 @@
|
|||
#!/usr/bin/python3
|
||||
|
||||
from io import StringIO
|
||||
from json import loads
|
||||
from glob import glob
|
||||
from pathlib import Path
|
||||
from pytablewriter import MarkdownTableWriter
|
||||
|
||||
|
||||
def print_md_table(settings) -> MarkdownTableWriter:
|
||||
writer = MarkdownTableWriter(
|
||||
headers=["Setting", "Default", "Context", "Multiple", "Description"],
|
||||
value_matrix=[
|
||||
[
|
||||
f"`{setting}`",
|
||||
"" if data["default"] == "" else f"`{data['default']}`",
|
||||
data["context"],
|
||||
"no" if "multiple" not in data else "yes",
|
||||
data["help"],
|
||||
]
|
||||
for setting, data in settings.items()
|
||||
],
|
||||
)
|
||||
return writer
|
||||
|
||||
|
||||
def stream_support(support) -> str:
|
||||
md = "STREAM support "
|
||||
if support == "no":
|
||||
md += ":x:"
|
||||
elif support == "yes":
|
||||
md += ":white_check_mark:"
|
||||
else:
|
||||
md += ":warning:"
|
||||
return md
|
||||
|
||||
|
||||
doc = StringIO()
|
||||
|
||||
print("# Settings\n", file=doc)
|
||||
print(
|
||||
'!!! info "Settings generator tool"\n\n To help you tune BunkerWeb, we have made an easy-to-use settings generator tool available at [config.bunkerweb.io](https://config.bunkerweb.io).\n',
|
||||
file=doc,
|
||||
)
|
||||
print(
|
||||
"This section contains the full list of settings supported by BunkerWeb."
|
||||
+ " If you are not yet familiar with BunkerWeb, you should first read the [concepts](concepts.md) section of the documentation."
|
||||
+ " Please follow the instructions for your own [integration](integrations.md) on how to apply the settings.\n",
|
||||
file=doc,
|
||||
)
|
||||
print(
|
||||
"As a general rule when multisite mode is enabled, if you want to apply settings with multisite context to a specific server, you will need to add the primary"
|
||||
+ " (first) server name as a prefix like `www.example.com_USE_ANTIBOT=captcha` or `myapp.example.com_USE_GZIP=yes` for example.\n",
|
||||
file=doc,
|
||||
)
|
||||
print(
|
||||
'When settings are considered as "multiple", it means that you can have multiple groups of settings for the same feature by adding numbers as suffix like `REVERSE_PROXY_URL_1=/subdir`,'
|
||||
+ " `REVERSE_PROXY_HOST_1=http://myhost1`, `REVERSE_PROXY_URL_2=/anotherdir`, `REVERSE_PROXY_HOST_2=http://myhost2`, ... for example.\n",
|
||||
file=doc,
|
||||
)
|
||||
|
||||
# Print global settings
|
||||
print("## Global settings\n", file=doc)
|
||||
print(f"\n{stream_support('partial')}\n", file=doc)
|
||||
with open("src/common/settings.json", "r") as f:
|
||||
print(print_md_table(loads(f.read())), file=doc)
|
||||
print(file=doc)
|
||||
|
||||
# Print core settings
|
||||
print("## Core settings\n", file=doc)
|
||||
core_settings = {}
|
||||
for core in glob("src/common/core/*/plugin.json"):
|
||||
with open(core, "r") as f:
|
||||
core_plugin = loads(f.read())
|
||||
if len(core_plugin["settings"]) > 0:
|
||||
core_settings[core_plugin["name"]] = core_plugin
|
||||
|
||||
for name, data in dict(sorted(core_settings.items())).items():
|
||||
print(f"### {data['name']}\n", file=doc)
|
||||
print(f"{stream_support(data['stream'])}\n", file=doc)
|
||||
print(f"{data['description']}\n", file=doc)
|
||||
print(print_md_table(data["settings"]), file=doc)
|
||||
|
||||
doc.seek(0)
|
||||
content = doc.read()
|
||||
doc = StringIO(content.replace("\\|", "|"))
|
||||
doc.seek(0)
|
||||
|
||||
Path("docs", "settings.md").write_text(doc.read(), encoding="utf-8")
|
||||
41
docs/migrating.md
Normal file
41
docs/migrating.md
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
# Migrating from 1.4.X
|
||||
|
||||
!!! warning "Read this if you were a 1.4.X user"
|
||||
|
||||
A lot of things changed since the 1.4.X releases. Container-based integrations stacks contain more services but, trust us, fundamental principles of BunkerWeb are still there. You will find ready to use boilerplates for various integrations in the [misc/integrations](https://github.com/bunkerity/bunkerweb/tree/v1.5.3/misc/integrations) folder of the repository.
|
||||
|
||||
## Scheduler
|
||||
|
||||
Back to the 1.4.X releases, jobs (like Let's Encrypt certificate generation/renewal or blacklists download) **were executed in the same container as BunkerWeb**. For the purpose of [separation of concerns](https://en.wikipedia.org/wiki/Separation_of_concerns), we decided to create a **separate service** which is now responsible for managing jobs.
|
||||
|
||||
Called **Scheduler**, this service also generates the final configuration used by BunkerWeb and acts as an intermediary between autoconf and BunkerWeb. In other words, the scheduler is the **brain of the BunkerWeb 1.5.X stack**.
|
||||
|
||||
You will find more information about the scheduler [here](concepts.md#scheduler).
|
||||
|
||||
## Database
|
||||
|
||||
BunkerWeb configuration is **no more stored in a plain file** (located at `/etc/nginx/variables.env` if you didn't know it). That's it, we now support a **fully-featured database as a backend** to store settings, cache, custom configs, ... 🥳
|
||||
|
||||
Using a real database offers many advantages :
|
||||
|
||||
- Backup of the current configuration
|
||||
- Usage with multiple services (scheduler, web UI, ...)
|
||||
- Upgrade to a new BunkerWeb version
|
||||
|
||||
Please note that we actually support, **SQLite**, **MySQL**, **MariaDB** and **PostgreSQL** as backends.
|
||||
|
||||
You will find more information about the database [here](concepts.md#database).
|
||||
|
||||
## Redis
|
||||
|
||||
When BunkerWeb 1.4.X was used in cluster mode (Swarm or Kubernetes integrations), **data were not shared among the nodes**. For example, if an attacker was banned via the "bad behavior" feature on a specific node, **he could still connect to the other nodes**.
|
||||
|
||||
Security is not the only reason to have a shared data store for clustered integrations, **caching** is also another one. We can now **store results** of time-consuming operations like (reverse) dns lookups so they are **available for other nodes**.
|
||||
|
||||
We actually support **Redis** as a backend for the shared data store.
|
||||
|
||||
See the list of [redis settings](settings.md#redis) and the corresponding documentation of your integration for more information.
|
||||
|
||||
## Default values and new settings
|
||||
|
||||
The default value of some settings have changed and we have added many other settings, we recommend you read the [security tuning](security-tuning.md) and [settings](settings.md) sections of the documentation.
|
||||
49
docs/misc/pdf.js
Normal file
49
docs/misc/pdf.js
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
const puppeteer = require('puppeteer');
|
||||
var args = process.argv.slice(2);
|
||||
var url = args[0];
|
||||
var pdfPath = args[1];
|
||||
var title = args[2];
|
||||
|
||||
console.log('Saving', url, 'to', pdfPath);
|
||||
|
||||
// date – formatted print date
|
||||
// title – document title
|
||||
// url – document location
|
||||
// pageNumber – current page number
|
||||
// totalPages – total pages in the document
|
||||
headerHtml = `
|
||||
<div style="font-size: 10px; text-align: center; width: 100%;">
|
||||
<span>${title}</span>
|
||||
</div>`;
|
||||
|
||||
footerHtml = `<div style="font-size: 10px; text-align: center; width: 100%;"><span class="pageNumber"></span> / <span class="totalPages"></span></div>`;
|
||||
|
||||
|
||||
(async() => {
|
||||
const browser = await puppeteer.launch({
|
||||
headless: true,
|
||||
executablePath: process.env.CHROME_BIN || null,
|
||||
args: ['--no-sandbox', '--headless', '--disable-gpu', '--disable-dev-shm-usage']
|
||||
});
|
||||
|
||||
const page = await browser.newPage();
|
||||
await page.goto(url, { waitUntil: 'networkidle2' });
|
||||
await page.pdf({
|
||||
path: pdfPath, // path to save pdf file
|
||||
format: 'A4', // page format
|
||||
displayHeaderFooter: true, // display header and footer (in this example, required!)
|
||||
printBackground: true, // print background
|
||||
landscape: false, // use horizontal page layout
|
||||
headerTemplate: headerHtml, // indicate html template for header
|
||||
footerTemplate: footerHtml,
|
||||
scale: 1, //Scale amount must be between 0.1 and 2
|
||||
margin: { // increase margins (in this example, required!)
|
||||
top: 80,
|
||||
bottom: 80,
|
||||
left: 30,
|
||||
right: 30
|
||||
}
|
||||
});
|
||||
|
||||
await browser.close();
|
||||
})();
|
||||
22
docs/overrides/main.html
Normal file
22
docs/overrides/main.html
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
{% extends "base.html" %}
|
||||
|
||||
{% block outdated %}
|
||||
You're not viewing the documentation of the latest version.
|
||||
<a href="{{ '../' ~ base_url }}">
|
||||
<strong>Click here to view latest.</strong>
|
||||
</a>
|
||||
{% endblock %}
|
||||
|
||||
{% block announce %}
|
||||
📢 Looking for tailored support, consulting or development for BunkerWeb ?
|
||||
Contact us at <a href="mailto:contact@bunkerity.com" style="color: #3f6ec6; text-decoration: underline">contact@bunkerity.com</a> for enterprise offers !
|
||||
{% endblock %}
|
||||
|
||||
{% block libs %}
|
||||
<script
|
||||
async
|
||||
defer
|
||||
data-domain="docs.bunkerweb.io"
|
||||
src="https://data.bunkerity.com/js/script.js"
|
||||
></script>
|
||||
{% endblock %}
|
||||
1115
docs/package-lock.json
generated
Normal file
1115
docs/package-lock.json
generated
Normal file
File diff suppressed because it is too large
Load diff
5
docs/package.json
Normal file
5
docs/package.json
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"dependencies": {
|
||||
"puppeteer": "^21.3.6"
|
||||
}
|
||||
}
|
||||
557
docs/plugins.md
Normal file
557
docs/plugins.md
Normal file
|
|
@ -0,0 +1,557 @@
|
|||
# Plugins
|
||||
|
||||
BunkerWeb comes with a plugin system making it possible to easily add new features. Once a plugin is installed, you can manage it using additional settings defined by the plugin.
|
||||
|
||||
## Official plugins
|
||||
|
||||
Here is the list of "official" plugins that we maintain (see the [bunkerweb-plugins](https://github.com/bunkerity/bunkerweb-plugins) repository for more information) :
|
||||
|
||||
| Name | Version | Description | Link |
|
||||
| :------------: | :-----: | :------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------: |
|
||||
| **ClamAV** | 1.2 | Automatically scans uploaded files with the ClamAV antivirus engine and denies the request when a file is detected as malicious. | [bunkerweb-plugins/clamav](https://github.com/bunkerity/bunkerweb-plugins/tree/main/clamav) |
|
||||
| **Coraza** | 1.2 | Inspect requests using a the Coraza WAF (alternative of ModSecurity). | [bunkerweb-plugins/coraza](https://github.com/bunkerity/bunkerweb-plugins/tree/main/coraza) |
|
||||
| **CrowdSec** | 1.2 | CrowdSec bouncer for BunkerWeb. | [bunkerweb-plugins/crowdsec](https://github.com/bunkerity/bunkerweb-plugins/tree/main/crowdsec) |
|
||||
| **Discord** | 1.2 | Send security notifications to a Discord channel using a Webhook. | [bunkerweb-plugins/discord](https://github.com/bunkerity/bunkerweb-plugins/tree/main/discord) |
|
||||
| **Slack** | 1.2 | Send security notifications to a Slack channel using a Webhook. | [bunkerweb-plugins/slack](https://github.com/bunkerity/bunkerweb-plugins/tree/main/slack) |
|
||||
| **VirusTotal** | 1.2 | Automatically scans uploaded files with the VirusTotal API and denies the request when a file is detected as malicious. | [bunkerweb-plugins/virustotal](https://github.com/bunkerity/bunkerweb-plugins/tree/main/virustotal) |
|
||||
| **WebHook** | 1.2 | Send security notifications to a custom HTTP endpoint using a Webhook. | [bunkerweb-plugins/webhook](https://github.com/bunkerity/bunkerweb-plugins/tree/main/webhook) |
|
||||
|
||||
## How to use a plugin
|
||||
|
||||
### Automatic
|
||||
|
||||
If you want to quickly install external plugins, you can use the `EXTERNAL_PLUGIN_URLS` setting. It takes a list of URLs, separated with space, pointing to compressed (zip format) archive containing one or more plugin(s).
|
||||
|
||||
You can use the following value if you want to automatically install the official plugins : `EXTERNAL_PLUGIN_URLS=https://github.com/bunkerity/bunkerweb-plugins/archive/refs/tags/v1.2.zip`
|
||||
|
||||
### Manual
|
||||
|
||||
The first step is to install the plugin by putting the plugin files inside the corresponding `plugins` data folder, the procedure depends on your integration :
|
||||
|
||||
=== "Docker"
|
||||
|
||||
When using the [Docker integration](integrations.md#docker), plugins must be written to the volume mounted on `/data/plugins` into the scheduler container.
|
||||
|
||||
The first thing to do is to create the plugins folder :
|
||||
|
||||
```shell
|
||||
mkdir -p ./bw-data/plugins
|
||||
```
|
||||
|
||||
Then, you can drop the plugins of your choice into that folder :
|
||||
|
||||
```shell
|
||||
git clone https://github.com/bunkerity/bunkerweb-plugins && \
|
||||
cp -rp ./bunkerweb-plugins/* ./bw-data/plugins
|
||||
```
|
||||
|
||||
Because the scheduler runs as an unprivileged user with UID and GID 101, you will need to edit the permissions :
|
||||
|
||||
```shell
|
||||
chown -R 101:101 ./bw-data
|
||||
```
|
||||
|
||||
Then you can mount the volume when starting your Docker stack :
|
||||
|
||||
```yaml
|
||||
version: '3.5'
|
||||
services:
|
||||
...
|
||||
bw-scheduler:
|
||||
image: bunkerity/bunkerweb-scheduler:1.5.3
|
||||
volumes:
|
||||
- ./bw-data:/data
|
||||
...
|
||||
```
|
||||
|
||||
=== "Docker autoconf"
|
||||
|
||||
When using the [Docker autoconf integration](integrations.md#docker-autoconf), plugins must be written to the volume mounted on `/data/plugins` into the scheduler container.
|
||||
|
||||
|
||||
The first thing to do is to create the plugins folder :
|
||||
|
||||
```shell
|
||||
mkdir -p ./bw-data/plugins
|
||||
```
|
||||
|
||||
Then, you can drop the plugins of your choice into that folder :
|
||||
|
||||
```shell
|
||||
git clone https://github.com/bunkerity/bunkerweb-plugins && \
|
||||
cp -rp ./bunkerweb-plugins/* ./bw-data/plugins
|
||||
```
|
||||
|
||||
Because the scheduler runs as an unprivileged user with UID and GID 101, you will need to edit the permissions :
|
||||
|
||||
```shell
|
||||
chown -R 101:101 ./bw-data
|
||||
```
|
||||
|
||||
Then you can mount the volume when starting your Docker stack :
|
||||
|
||||
```yaml
|
||||
version: '3.5'
|
||||
services:
|
||||
...
|
||||
bw-scheduler:
|
||||
image: bunkerity/bunkerweb-scheduler:1.5.3
|
||||
volumes:
|
||||
- ./bw-data:/data
|
||||
...
|
||||
```
|
||||
|
||||
=== "Swarm"
|
||||
|
||||
When using the [Swarm integration](integrations.md#swarm), plugins must be written to the volume mounted on `/data/plugins` into the scheduler container.
|
||||
|
||||
!!! info "Swarm volume"
|
||||
Configuring a Swarm volume that will persist when the scheduler service is running on different nodes is not covered is in this documentation. We will assume that you have a shared folder mounted on `/shared` across all nodes.
|
||||
|
||||
The first thing to do is to create the plugins folder :
|
||||
|
||||
```shell
|
||||
mkdir -p /shared/bw-plugins
|
||||
```
|
||||
|
||||
Then, you can drop the plugins of your choice into that folder :
|
||||
|
||||
```shell
|
||||
git clone https://github.com/bunkerity/bunkerweb-plugins && \
|
||||
cp -rp ./bunkerweb-plugins/* /shared/bw-plugins
|
||||
```
|
||||
|
||||
Because the scheduler runs as an unprivileged user with UID and GID 101, you will need to edit the permissions :
|
||||
|
||||
```shell
|
||||
chown -R 101:101 /shared/bw-plugins
|
||||
```
|
||||
|
||||
Then you can mount the volume when starting your Swarm stack :
|
||||
|
||||
```yaml
|
||||
version: '3.5'
|
||||
services:
|
||||
...
|
||||
bw-scheduler:
|
||||
image: bunkerity/bunkerweb-scheduler:1.5.3
|
||||
volumes:
|
||||
- /shared/bw-plugins:/data/plugins
|
||||
...
|
||||
```
|
||||
|
||||
=== "Kubernetes"
|
||||
|
||||
When using the [Kubernetes integration](integrations.md#kubernetes), plugins must be written to the volume mounted on `/data/plugins` into the scheduler container.
|
||||
|
||||
The fist thing to do is to declare a [PersistentVolumeClaim](https://kubernetes.io/docs/concepts/storage/persistent-volumes/) that will contain our plugins data :
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: pvc-bunkerweb-plugins
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
```
|
||||
|
||||
You can now add the volume mount and an init containers to automatically provision the volume :
|
||||
|
||||
```yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: bunkerweb-scheduler
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: bunkerweb-scheduler
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: bunkerweb-scheduler
|
||||
spec:
|
||||
serviceAccountName: sa-bunkerweb
|
||||
containers:
|
||||
- name: bunkerweb-scheduler
|
||||
image: bunkerity/bunkerweb-scheduler:1.5.3
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: KUBERNETES_MODE
|
||||
value: "yes"
|
||||
- name: "DATABASE_URI"
|
||||
value: "mariadb+pymysql://bunkerweb:changeme@svc-bunkerweb-db:3306/db"
|
||||
volumeMounts:
|
||||
- mountPath: "/data/plugins"
|
||||
name: vol-plugins
|
||||
initContainers:
|
||||
- name: bunkerweb-scheduler-init
|
||||
image: alpine/git
|
||||
command: ["/bin/sh", "-c"]
|
||||
args: ["git clone https://github.com/bunkerity/bunkerweb-plugins /data/plugins && chown -R 101:101 /data/plugins"]
|
||||
volumeMounts:
|
||||
- mountPath: "/data/plugins"
|
||||
name: vol-plugins
|
||||
volumes:
|
||||
- name: vol-plugins
|
||||
persistentVolumeClaim:
|
||||
claimName: pvc-bunkerweb-plugins
|
||||
```
|
||||
|
||||
=== "Linux"
|
||||
|
||||
When using the [Linux integration](integrations.md#linux), plugins must be written to the `/etc/bunkerweb/plugins` folder :
|
||||
|
||||
```shell
|
||||
git clone https://github.com/bunkerity/bunkerweb-plugins && \
|
||||
cp -rp ./bunkerweb-plugins/* /etc/bunkerweb/plugins && \
|
||||
chown -R nginx:nginx /etc/bunkerweb/plugins
|
||||
```
|
||||
|
||||
=== "Ansible"
|
||||
|
||||
When using the [Ansible integration](integrations.md#ansible), you can use the `plugins` variable to set a local folder containing your plugins that will be copied to your BunkerWeb instances.
|
||||
|
||||
Let's assume that you have plugins inside the `bunkerweb-plugins` folder :
|
||||
|
||||
```shell
|
||||
git clone https://github.com/bunkerity/bunkerweb-plugins
|
||||
```
|
||||
|
||||
In your Ansible inventory, you can use the `plugins` variable to set the path of plugins folder :
|
||||
|
||||
```ini
|
||||
[mybunkers]
|
||||
192.168.0.42 ... custom_plugins="{{ playbook_dir }}/bunkerweb-plugins"
|
||||
```
|
||||
|
||||
Or alternatively, in your playbook file :
|
||||
|
||||
```yaml
|
||||
- hosts: all
|
||||
become: true
|
||||
vars:
|
||||
- custom_plugins: "{{ playbook_dir }}/bunkerweb-plugins"
|
||||
roles:
|
||||
- bunkerity.bunkerweb
|
||||
```
|
||||
|
||||
Run the playbook :
|
||||
|
||||
```shell
|
||||
ansible-playbook -i inventory.yml playbook.yml
|
||||
```
|
||||
|
||||
=== "Vagrant"
|
||||
|
||||
When using the [Vagrant integration](integrations.md#vagrant), plugins must be written to the `/etc/bunkerweb/plugins` folder (you will need to do a `vagrant ssh` first) :
|
||||
|
||||
```shell
|
||||
git clone https://github.com/bunkerity/bunkerweb-plugins && \
|
||||
cp -rp ./bunkerweb-plugins/* /etc/bunkerweb/plugins
|
||||
```
|
||||
|
||||
## Writing a plugin
|
||||
|
||||
!!! tip "Existing plugins"
|
||||
|
||||
If the documentation is not enough, you can have a look at the existing source code of [official plugins](https://github.com/bunkerity/bunkerweb-plugins) and the [core plugins](https://github.com/bunkerity/bunkerweb/tree/v1.5.3/src/common/core) (already included in BunkerWeb but they are plugins, technically speaking).
|
||||
|
||||
The first step is to create a folder that will contain the plugin :
|
||||
|
||||
```shell
|
||||
mkdir myplugin && \
|
||||
cd myplugin
|
||||
```
|
||||
|
||||
### Metadata
|
||||
|
||||
A file named **plugin.json** and written at the root of the plugin folder must contain metadata about the plugin. Here is an example :
|
||||
|
||||
```json
|
||||
{
|
||||
"id": "myplugin",
|
||||
"name": "My Plugin",
|
||||
"description": "Just an example plugin.",
|
||||
"version": "1.0",
|
||||
"stream": "partial",
|
||||
"settings": {
|
||||
"DUMMY_SETTING": {
|
||||
"context": "multisite",
|
||||
"default": "1234",
|
||||
"help": "Here is the help of the setting.",
|
||||
"id": "dummy-id",
|
||||
"label": "Dummy setting",
|
||||
"regex": "^.*$",
|
||||
"type": "text"
|
||||
}
|
||||
},
|
||||
"jobs": [
|
||||
{
|
||||
"name": "my-job",
|
||||
"file": "my-job.py",
|
||||
"every": "hour"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
Here are the details of the fields :
|
||||
|
||||
| Field | Mandatory | Type | Description |
|
||||
| :-----------: | :-------: | :----: | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `id` | yes | string | Internal ID for the plugin : must be unique among other plugins (including "core" ones) and contain only lowercase chars. |
|
||||
| `name` | yes | string | Name of your plugin. |
|
||||
| `description` | yes | string | Description of your plugin. |
|
||||
| `version` | yes | string | Version of your plugin. |
|
||||
| `stream` | yes | string | Information about stream support : `no`, `yes` or `partial`.
|
||||
| `settings` | yes | dict | List of the settings of your plugin. |
|
||||
| `jobs` | no | list | List of the jobs of your plugin. |
|
||||
|
||||
Each setting has the following fields (the key is the ID of the settings used in a configuration) :
|
||||
|
||||
| Field | Mandatory | Type | Description |
|
||||
| :--------: | :-------: | :----: | :----------------------------------------------------------- |
|
||||
| `context` | yes | string | Context of the setting : `multisite` or `global`. |
|
||||
| `default` | yes | string | The default value of the setting. |
|
||||
| `help` | yes | string | Help text about the plugin (shown in web UI). |
|
||||
| `id` | yes | string | Internal ID used by the web UI for HTML elements. |
|
||||
| `label` | yes | string | Label shown by the web UI. |
|
||||
| `regex` | yes | string | The regex used to validate the value provided by the user. |
|
||||
| `type` | yes | string | The type of the field : `text`, `check`, `select` or `password`. |
|
||||
| `multiple` | no | string | Unique ID to group multiple settings with numbers as suffix. |
|
||||
| `select` | no | list | List of possible string values when `type` is `select`. |
|
||||
|
||||
Each job has the following fields :
|
||||
|
||||
| Field | Mandatory | Type | Description |
|
||||
| :-----: | :-------: | :----: | :-------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `name` | yes | string | Name of the job. |
|
||||
| `file` | yes | string | Name of the file inside the jobs folder. |
|
||||
| `every` | yes | string | Job scheduling frequency : `minute`, `hour`, `day`, `week` or `once` (no frequency, only once before (re)generating the configuration). |
|
||||
|
||||
### Configurations
|
||||
|
||||
You can add custom NGINX configurations by adding a folder named **confs** with content similar to the [custom configurations](quickstart-guide.md#custom-configurations). Each subfolder inside the **confs** will contain [jinja2](https://jinja.palletsprojects.com) templates that will be generated and loaded at the corresponding context (`http`, `server-http`, `default-server-http`, `stream` and `server-stream`).
|
||||
|
||||
Here is an example for a configuration template file inside the **confs/server-http** folder named **example.conf** :
|
||||
|
||||
```conf
|
||||
location /setting {
|
||||
default_type 'text/plain';
|
||||
content_by_lua_block {
|
||||
ngx.say('{{ DUMMY_SETTING }}')
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
`{{ DUMMY_SETTING }}` will be replaced by the value of the `DUMMY_SETTING` chosen by the user of the plugin.
|
||||
|
||||
### LUA
|
||||
|
||||
#### Main script
|
||||
|
||||
Under the hood, BunkerWeb is using the [NGINX LUA module](https://github.com/openresty/lua-nginx-module) to execute code within NGINX. Plugins that need to execute code must provide a lua file at the root directory of the plugin folder using the `id` value of **plugin.json** as its name. Here is an example named **myplugin.lua** :
|
||||
|
||||
```lua
|
||||
local class = require "middleclass"
|
||||
local plugin = require "bunkerweb.plugin"
|
||||
local utils = require "bunkerweb.utils"
|
||||
|
||||
|
||||
local myplugin = class("myplugin", plugin)
|
||||
|
||||
|
||||
function myplugin:initialize()
|
||||
plugin.initialize(self, "myplugin")
|
||||
self.dummy = "dummy"
|
||||
end
|
||||
|
||||
function myplugin:init()
|
||||
self.logger:log(ngx.NOTICE, "init called")
|
||||
return self:ret(true, "success")
|
||||
end
|
||||
|
||||
function myplugin:set()
|
||||
self.logger:log(ngx.NOTICE, "set called")
|
||||
return self:ret(true, "success")
|
||||
end
|
||||
|
||||
function myplugin:access()
|
||||
self.logger:log(ngx.NOTICE, "access called")
|
||||
return self:ret(true, "success")
|
||||
end
|
||||
|
||||
function myplugin:log()
|
||||
self.logger:log(ngx.NOTICE, "log called")
|
||||
return self:ret(true, "success")
|
||||
end
|
||||
|
||||
function myplugin:log_default()
|
||||
self.logger:log(ngx.NOTICE, "log_default called")
|
||||
return self:ret(true, "success")
|
||||
end
|
||||
|
||||
function myplugin:preread()
|
||||
self.logger:log(ngx.NOTICE, "preread called")
|
||||
return self:ret(true, "success")
|
||||
end
|
||||
|
||||
function myplugin:log_stream()
|
||||
self.logger:log(ngx.NOTICE, "log_stream called")
|
||||
return self:ret(true, "success")
|
||||
end
|
||||
|
||||
return myplugin
|
||||
```
|
||||
|
||||
The declared functions are automatically called during specific contexts. Here are the details of each function :
|
||||
|
||||
| Function | Context | Description | Return value |
|
||||
| :------: | :--------------------------------------------------------------------------: | :-------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `init` | [init_by_lua](https://github.com/openresty/lua-nginx-module#init_by_lua) | Called when NGINX just started or received a reload order. the typical use case is to prepare any data that will be used by your plugin. | `ret`, `msg`<ul><li>`ret` (boolean) : true if no error or else false</li><li>`msg` (string) : success or error message</li></ul>|
|
||||
| `set` | [set_by_lua](https://github.com/openresty/lua-nginx-module#set_by_lua) | Called before each request received by the server.The typical use case is for computing before access phase. | `ret`, `msg`<ul><li>`ret` (boolean) : true if no error or else false</li><li>`msg` (string) : success or error message</li></ul>|
|
||||
| `access` | [access_by_lua](https://github.com/openresty/lua-nginx-module#access_by_lua) | Called on each request received by the server. The typical use case is to do the security checks here and deny the request if needed. | `ret`, `msg`,`status`,`redirect`<ul><li>`ret` (boolean) : true if no error or else false</li><li>`msg` (string) : success or error message</li><li>`status` (number) : interrupt current process and return [HTTP status](https://github.com/openresty/lua-nginx-module#http-status-constants)</li><li>`redirect` (URL) : if set will redirect to given URL</li></ul> |
|
||||
| `log` | [log_by_lua](https://github.com/openresty/lua-nginx-module#log_by_lua) | Called when a request has finished (and before it gets logged to the access logs). The typical use case is to make stats or compute counters for example. | `ret`, `msg`<ul><li>`ret` (boolean) : true if no error or else false</li><li>`msg` (string) : success or error message</li></ul> |
|
||||
| `log_default` | [log_by_lua](https://github.com/openresty/lua-nginx-module#log_by_lua) | Same as `log` but only called on the default server. | `ret`, `msg`<ul><li>`ret` (boolean) : true if no error or else false</li><li>`msg` (string) : success or error message</li></ul> |
|
||||
| `preread` | [preread_by_lua](https://github.com/openresty/stream-lua-nginx-module#preread_by_lua_block) | Similar to the `access` function but for stream mode. | `ret`, `msg`,`status`<ul><li>`ret` (boolean) : true if no error or else false</li><li>`msg` (string) : success or error message</li><li>`status` (number) : interrupt current process and return [status](https://github.com/openresty/lua-nginx-module#http-status-constants)</li></ul> |
|
||||
| `log_stream` | [log_by_lua](https://github.com/openresty/stream-lua-nginx-module#log_by_lua_block) | Similar to the `log` function but for stream mode. | `ret`, `msg`<ul><li>`ret` (boolean) : true if no error or else false</li><li>`msg` (string) : success or error message</li></ul> |
|
||||
|
||||
#### Libraries
|
||||
|
||||
All directives from [NGINX LUA module](https://github.com/openresty/lua-nginx-module) and are available and [NGINX stream LUA module](https://github.com/openresty/stream-lua-nginx-module). On top of that, you can use the LUA libraries included within BunkerWeb : see [this script](https://github.com/bunkerity/bunkerweb/blobsrc/deps/clone.sh) for the complete list.
|
||||
|
||||
If you need additional libraries, you can put them in the root folder of the plugin and access them by prefixing them with your plugin ID. Here is an example file named **mylibrary.lua** :
|
||||
|
||||
```lua
|
||||
local _M = {}
|
||||
|
||||
_M.dummy = function ()
|
||||
return "dummy"
|
||||
end
|
||||
|
||||
return _M
|
||||
```
|
||||
|
||||
And here is how you can use it from the **myplugin.lua** file :
|
||||
|
||||
```lua
|
||||
local mylibrary = require "myplugin.mylibrary"
|
||||
|
||||
...
|
||||
|
||||
mylibrary.dummy()
|
||||
|
||||
...
|
||||
```
|
||||
|
||||
#### Helpers
|
||||
|
||||
Some helpers modules provide common helpful helpers :
|
||||
|
||||
- `self.variables` : allows to access and store plugins' attributes
|
||||
- `self.logger` : print logs
|
||||
- `bunkerweb.utils` : various useful functions
|
||||
- `bunkerweb.datastore` : access the global shared data on one instance (key/value store)
|
||||
- `bunkerweb.clusterstore` : access a Redis data store shared between BunkerWeb instances (key/value store)
|
||||
|
||||
To access the functions, you first need to **require** the modules :
|
||||
|
||||
```lua
|
||||
local utils = require "bunkerweb.utils"
|
||||
local datastore = require "bunkerweb.datastore"
|
||||
local clustestore = require "bunkerweb.clustertore"
|
||||
```
|
||||
|
||||
Retrieve a setting value :
|
||||
|
||||
```lua
|
||||
local myvar = self.variables["DUMMY_SETTING"]
|
||||
if not myvar then
|
||||
self.logger:log(ngx.ERR, "can't retrieve setting DUMMY_SETTING")
|
||||
else
|
||||
self.logger:log(ngx.NOTICE, "DUMMY_SETTING = " .. value)
|
||||
end
|
||||
```
|
||||
|
||||
Store something in the local cache :
|
||||
|
||||
```lua
|
||||
local ok, err = self.datastore:set("plugin_myplugin_something", "somevalue")
|
||||
if not ok then
|
||||
self.logger:log(ngx.ERR, "can't save plugin_myplugin_something into datastore : " .. err)
|
||||
else
|
||||
self.logger:log(ngx.NOTICE, "successfully saved plugin_myplugin_something into datastore")
|
||||
end
|
||||
```
|
||||
|
||||
Check if an IP address is global :
|
||||
|
||||
```lua
|
||||
local ret, err = utils.ip_is_global(ngx.ctx.bw.remote_addr)
|
||||
if ret == nil then
|
||||
self.logger:log(ngx.ERR, "error while checking if IP " .. ngx.ctx.bw.remote_addr .. " is global or not : " .. err)
|
||||
elseif not ret then
|
||||
self.logger:log(ngx.NOTICE, "IP " .. ngx.ctx.bw.remote_addr .. " is not global")
|
||||
else
|
||||
self.logger:log(ngx.NOTICE, "IP " .. ngx.ctx.bw.remote_addr .. " is global")
|
||||
end
|
||||
```
|
||||
|
||||
!!! tip "More examples"
|
||||
|
||||
If you want to see the full list of available functions, you can have a look at the files present in the [lua directory](https://github.com/bunkerity/bunkerweb/tree/v1.5.3/src/bw/lua/bunkerweb) of the repository.
|
||||
|
||||
### Jobs
|
||||
|
||||
BunkerWeb uses an internal job scheduler for periodic tasks like renewing certificates with certbot, downloading blacklists, downloading MMDB files, ... You can add tasks of your choice by putting them inside a subfolder named **jobs** and listing them in the **plugin.json** metadata file. Don't forget to add the execution permissions for everyone to avoid any problems when a user is cloning and installing your plugin.
|
||||
|
||||
### Plugin page
|
||||
|
||||
Plugin pages are used to display information about your plugin and interact with the user inside the plugins section of the [web UI](web-ui.md).
|
||||
|
||||
Everything related to the web UI is located inside a subfolder named **ui** at the root directory of your plugin. A template file named **template.html** and located inside the **ui** subfolder contains the client code and logic to display your page. Another file named **actions.py** and also located inside the **ui** subfolder contains code that will be executed when the user is interacting with your page (filling a form for example).
|
||||
|
||||
!!! info "Jinja 2 template"
|
||||
The **template.html** file is a Jinja2 template, please refer to the [Jinja2 documentation](https://jinja.palletsprojects.com) if needed.
|
||||
|
||||
A plugin page can have a form that is used to submit data to the plugin. To get the values of the form, you need to put a **actions.py** file in the **ui** folder. Inside the file, **you must define a function that has the same name as the plugin**. This function will be called when the form is submitted. You can then use the **request** object (from the [Flask library](https://flask.palletsprojects.com)) to get the values of the form. The form's action must finish with **/plugins/<*plugin_id*>**. The helper function `url_for` will generate for you the prefix of the URL : `{{ url_for('plugins') }}/plugin_id`.
|
||||
|
||||
If you want to display variables generated from your **actions.py** in your template file, you can return a dictionary with variables name as keys and variables value as values. Here is dummy example where we return a single variable :
|
||||
|
||||
```python
|
||||
def myplugin() :
|
||||
return {"foo": "bar"}
|
||||
```
|
||||
|
||||
And we display it in the **template.html** file :
|
||||
```html
|
||||
{% if foo %}
|
||||
Content of foo is : {{ foo }}.
|
||||
{% endif %}
|
||||
```
|
||||
|
||||
Please note that every form submission is protected via a CSRF token, you will need to include the following snippet into your forms :
|
||||
```html
|
||||
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}" />
|
||||
```
|
||||
|
||||
Retrieving user submitted data is pretty simple, thanks to the request module provided by Flask :
|
||||
|
||||
```python
|
||||
from flask import request
|
||||
|
||||
def myplugin() :
|
||||
my_form_value = request.form["my_form_input"]
|
||||
```
|
||||
|
||||
!!! info "Python libraries"
|
||||
You can use Python libraries that are already available like :
|
||||
`Flask`, `Flask-Login`, `Flask-WTF`, `beautifulsoup4`, `docker`, `Jinja2`, `python-magic` and `requests`. To see the full list, you can have a look at the Web UI [requirements.txt](https://github.com/bunkerity/bunkerweb/blobsrc/ui/requirements.txt). If you need external libraries, you can install them inside the **ui** folder of your plugin and then use the classical **import** directive.
|
||||
2424
docs/quickstart-guide.md
Normal file
2424
docs/quickstart-guide.md
Normal file
File diff suppressed because it is too large
Load diff
5
docs/requirements.in
Normal file
5
docs/requirements.in
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
mike==2.0.0
|
||||
mkdocs==1.5.3
|
||||
mkdocs-material==9.4.8
|
||||
mkdocs-print-site-plugin==2.3.6
|
||||
pytablewriter==1.2.0
|
||||
527
docs/requirements.txt
Normal file
527
docs/requirements.txt
Normal file
|
|
@ -0,0 +1,527 @@
|
|||
#
|
||||
# This file is autogenerated by pip-compile with Python 3.9
|
||||
# by the following command:
|
||||
#
|
||||
# pip-compile --allow-unsafe --generate-hashes --strip-extras requirements.in
|
||||
#
|
||||
babel==2.13.1 \
|
||||
--hash=sha256:33e0952d7dd6374af8dbf6768cc4ddf3ccfefc244f9986d4074704f2fbd18900 \
|
||||
--hash=sha256:7077a4984b02b6727ac10f1f7294484f737443d7e2e66c5e4380e41a3ae0b4ed
|
||||
# via mkdocs-material
|
||||
certifi==2023.7.22 \
|
||||
--hash=sha256:539cc1d13202e33ca466e88b2807e29f4c13049d6d87031a3c110744495cb082 \
|
||||
--hash=sha256:92d6037539857d8206b8f6ae472e8b77db8058fec5937a1ef3f54304089edbb9
|
||||
# via requests
|
||||
chardet==5.2.0 \
|
||||
--hash=sha256:1b3b6ff479a8c414bc3fa2c0852995695c4a026dcd6d0633b2dd092ca39c1cf7 \
|
||||
--hash=sha256:e1cf59446890a00105fe7b7912492ea04b6e6f06d4b742b2c788469e34c82970
|
||||
# via mbstrdecoder
|
||||
charset-normalizer==3.3.2 \
|
||||
--hash=sha256:06435b539f889b1f6f4ac1758871aae42dc3a8c0e24ac9e60c2384973ad73027 \
|
||||
--hash=sha256:06a81e93cd441c56a9b65d8e1d043daeb97a3d0856d177d5c90ba85acb3db087 \
|
||||
--hash=sha256:0a55554a2fa0d408816b3b5cedf0045f4b8e1a6065aec45849de2d6f3f8e9786 \
|
||||
--hash=sha256:0b2b64d2bb6d3fb9112bafa732def486049e63de9618b5843bcdd081d8144cd8 \
|
||||
--hash=sha256:10955842570876604d404661fbccbc9c7e684caf432c09c715ec38fbae45ae09 \
|
||||
--hash=sha256:122c7fa62b130ed55f8f285bfd56d5f4b4a5b503609d181f9ad85e55c89f4185 \
|
||||
--hash=sha256:1ceae2f17a9c33cb48e3263960dc5fc8005351ee19db217e9b1bb15d28c02574 \
|
||||
--hash=sha256:1d3193f4a680c64b4b6a9115943538edb896edc190f0b222e73761716519268e \
|
||||
--hash=sha256:1f79682fbe303db92bc2b1136016a38a42e835d932bab5b3b1bfcfbf0640e519 \
|
||||
--hash=sha256:2127566c664442652f024c837091890cb1942c30937add288223dc895793f898 \
|
||||
--hash=sha256:22afcb9f253dac0696b5a4be4a1c0f8762f8239e21b99680099abd9b2b1b2269 \
|
||||
--hash=sha256:25baf083bf6f6b341f4121c2f3c548875ee6f5339300e08be3f2b2ba1721cdd3 \
|
||||
--hash=sha256:2e81c7b9c8979ce92ed306c249d46894776a909505d8f5a4ba55b14206e3222f \
|
||||
--hash=sha256:3287761bc4ee9e33561a7e058c72ac0938c4f57fe49a09eae428fd88aafe7bb6 \
|
||||
--hash=sha256:34d1c8da1e78d2e001f363791c98a272bb734000fcef47a491c1e3b0505657a8 \
|
||||
--hash=sha256:37e55c8e51c236f95b033f6fb391d7d7970ba5fe7ff453dad675e88cf303377a \
|
||||
--hash=sha256:3d47fa203a7bd9c5b6cee4736ee84ca03b8ef23193c0d1ca99b5089f72645c73 \
|
||||
--hash=sha256:3e4d1f6587322d2788836a99c69062fbb091331ec940e02d12d179c1d53e25fc \
|
||||
--hash=sha256:42cb296636fcc8b0644486d15c12376cb9fa75443e00fb25de0b8602e64c1714 \
|
||||
--hash=sha256:45485e01ff4d3630ec0d9617310448a8702f70e9c01906b0d0118bdf9d124cf2 \
|
||||
--hash=sha256:4a78b2b446bd7c934f5dcedc588903fb2f5eec172f3d29e52a9096a43722adfc \
|
||||
--hash=sha256:4ab2fe47fae9e0f9dee8c04187ce5d09f48eabe611be8259444906793ab7cbce \
|
||||
--hash=sha256:4d0d1650369165a14e14e1e47b372cfcb31d6ab44e6e33cb2d4e57265290044d \
|
||||
--hash=sha256:549a3a73da901d5bc3ce8d24e0600d1fa85524c10287f6004fbab87672bf3e1e \
|
||||
--hash=sha256:55086ee1064215781fff39a1af09518bc9255b50d6333f2e4c74ca09fac6a8f6 \
|
||||
--hash=sha256:572c3763a264ba47b3cf708a44ce965d98555f618ca42c926a9c1616d8f34269 \
|
||||
--hash=sha256:573f6eac48f4769d667c4442081b1794f52919e7edada77495aaed9236d13a96 \
|
||||
--hash=sha256:5b4c145409bef602a690e7cfad0a15a55c13320ff7a3ad7ca59c13bb8ba4d45d \
|
||||
--hash=sha256:6463effa3186ea09411d50efc7d85360b38d5f09b870c48e4600f63af490e56a \
|
||||
--hash=sha256:65f6f63034100ead094b8744b3b97965785388f308a64cf8d7c34f2f2e5be0c4 \
|
||||
--hash=sha256:663946639d296df6a2bb2aa51b60a2454ca1cb29835324c640dafb5ff2131a77 \
|
||||
--hash=sha256:6897af51655e3691ff853668779c7bad41579facacf5fd7253b0133308cf000d \
|
||||
--hash=sha256:68d1f8a9e9e37c1223b656399be5d6b448dea850bed7d0f87a8311f1ff3dabb0 \
|
||||
--hash=sha256:6ac7ffc7ad6d040517be39eb591cac5ff87416c2537df6ba3cba3bae290c0fed \
|
||||
--hash=sha256:6b3251890fff30ee142c44144871185dbe13b11bab478a88887a639655be1068 \
|
||||
--hash=sha256:6c4caeef8fa63d06bd437cd4bdcf3ffefe6738fb1b25951440d80dc7df8c03ac \
|
||||
--hash=sha256:6ef1d82a3af9d3eecdba2321dc1b3c238245d890843e040e41e470ffa64c3e25 \
|
||||
--hash=sha256:753f10e867343b4511128c6ed8c82f7bec3bd026875576dfd88483c5c73b2fd8 \
|
||||
--hash=sha256:7cd13a2e3ddeed6913a65e66e94b51d80a041145a026c27e6bb76c31a853c6ab \
|
||||
--hash=sha256:7ed9e526742851e8d5cc9e6cf41427dfc6068d4f5a3bb03659444b4cabf6bc26 \
|
||||
--hash=sha256:7f04c839ed0b6b98b1a7501a002144b76c18fb1c1850c8b98d458ac269e26ed2 \
|
||||
--hash=sha256:802fe99cca7457642125a8a88a084cef28ff0cf9407060f7b93dca5aa25480db \
|
||||
--hash=sha256:80402cd6ee291dcb72644d6eac93785fe2c8b9cb30893c1af5b8fdd753b9d40f \
|
||||
--hash=sha256:8465322196c8b4d7ab6d1e049e4c5cb460d0394da4a27d23cc242fbf0034b6b5 \
|
||||
--hash=sha256:86216b5cee4b06df986d214f664305142d9c76df9b6512be2738aa72a2048f99 \
|
||||
--hash=sha256:87d1351268731db79e0f8e745d92493ee2841c974128ef629dc518b937d9194c \
|
||||
--hash=sha256:8bdb58ff7ba23002a4c5808d608e4e6c687175724f54a5dade5fa8c67b604e4d \
|
||||
--hash=sha256:8c622a5fe39a48f78944a87d4fb8a53ee07344641b0562c540d840748571b811 \
|
||||
--hash=sha256:8d756e44e94489e49571086ef83b2bb8ce311e730092d2c34ca8f7d925cb20aa \
|
||||
--hash=sha256:8f4a014bc36d3c57402e2977dada34f9c12300af536839dc38c0beab8878f38a \
|
||||
--hash=sha256:9063e24fdb1e498ab71cb7419e24622516c4a04476b17a2dab57e8baa30d6e03 \
|
||||
--hash=sha256:90d558489962fd4918143277a773316e56c72da56ec7aa3dc3dbbe20fdfed15b \
|
||||
--hash=sha256:923c0c831b7cfcb071580d3f46c4baf50f174be571576556269530f4bbd79d04 \
|
||||
--hash=sha256:95f2a5796329323b8f0512e09dbb7a1860c46a39da62ecb2324f116fa8fdc85c \
|
||||
--hash=sha256:96b02a3dc4381e5494fad39be677abcb5e6634bf7b4fa83a6dd3112607547001 \
|
||||
--hash=sha256:9f96df6923e21816da7e0ad3fd47dd8f94b2a5ce594e00677c0013018b813458 \
|
||||
--hash=sha256:a10af20b82360ab00827f916a6058451b723b4e65030c5a18577c8b2de5b3389 \
|
||||
--hash=sha256:a50aebfa173e157099939b17f18600f72f84eed3049e743b68ad15bd69b6bf99 \
|
||||
--hash=sha256:a981a536974bbc7a512cf44ed14938cf01030a99e9b3a06dd59578882f06f985 \
|
||||
--hash=sha256:a9a8e9031d613fd2009c182b69c7b2c1ef8239a0efb1df3f7c8da66d5dd3d537 \
|
||||
--hash=sha256:ae5f4161f18c61806f411a13b0310bea87f987c7d2ecdbdaad0e94eb2e404238 \
|
||||
--hash=sha256:aed38f6e4fb3f5d6bf81bfa990a07806be9d83cf7bacef998ab1a9bd660a581f \
|
||||
--hash=sha256:b01b88d45a6fcb69667cd6d2f7a9aeb4bf53760d7fc536bf679ec94fe9f3ff3d \
|
||||
--hash=sha256:b261ccdec7821281dade748d088bb6e9b69e6d15b30652b74cbbac25e280b796 \
|
||||
--hash=sha256:b2b0a0c0517616b6869869f8c581d4eb2dd83a4d79e0ebcb7d373ef9956aeb0a \
|
||||
--hash=sha256:b4a23f61ce87adf89be746c8a8974fe1c823c891d8f86eb218bb957c924bb143 \
|
||||
--hash=sha256:bd8f7df7d12c2db9fab40bdd87a7c09b1530128315d047a086fa3ae3435cb3a8 \
|
||||
--hash=sha256:beb58fe5cdb101e3a055192ac291b7a21e3b7ef4f67fa1d74e331a7f2124341c \
|
||||
--hash=sha256:c002b4ffc0be611f0d9da932eb0f704fe2602a9a949d1f738e4c34c75b0863d5 \
|
||||
--hash=sha256:c083af607d2515612056a31f0a8d9e0fcb5876b7bfc0abad3ecd275bc4ebc2d5 \
|
||||
--hash=sha256:c180f51afb394e165eafe4ac2936a14bee3eb10debc9d9e4db8958fe36afe711 \
|
||||
--hash=sha256:c235ebd9baae02f1b77bcea61bce332cb4331dc3617d254df3323aa01ab47bd4 \
|
||||
--hash=sha256:cd70574b12bb8a4d2aaa0094515df2463cb429d8536cfb6c7ce983246983e5a6 \
|
||||
--hash=sha256:d0eccceffcb53201b5bfebb52600a5fb483a20b61da9dbc885f8b103cbe7598c \
|
||||
--hash=sha256:d965bba47ddeec8cd560687584e88cf699fd28f192ceb452d1d7ee807c5597b7 \
|
||||
--hash=sha256:db364eca23f876da6f9e16c9da0df51aa4f104a972735574842618b8c6d999d4 \
|
||||
--hash=sha256:ddbb2551d7e0102e7252db79ba445cdab71b26640817ab1e3e3648dad515003b \
|
||||
--hash=sha256:deb6be0ac38ece9ba87dea880e438f25ca3eddfac8b002a2ec3d9183a454e8ae \
|
||||
--hash=sha256:e06ed3eb3218bc64786f7db41917d4e686cc4856944f53d5bdf83a6884432e12 \
|
||||
--hash=sha256:e27ad930a842b4c5eb8ac0016b0a54f5aebbe679340c26101df33424142c143c \
|
||||
--hash=sha256:e537484df0d8f426ce2afb2d0f8e1c3d0b114b83f8850e5f2fbea0e797bd82ae \
|
||||
--hash=sha256:eb00ed941194665c332bf8e078baf037d6c35d7c4f3102ea2d4f16ca94a26dc8 \
|
||||
--hash=sha256:eb6904c354526e758fda7167b33005998fb68c46fbc10e013ca97f21ca5c8887 \
|
||||
--hash=sha256:eb8821e09e916165e160797a6c17edda0679379a4be5c716c260e836e122f54b \
|
||||
--hash=sha256:efcb3f6676480691518c177e3b465bcddf57cea040302f9f4e6e191af91174d4 \
|
||||
--hash=sha256:f27273b60488abe721a075bcca6d7f3964f9f6f067c8c4c605743023d7d3944f \
|
||||
--hash=sha256:f30c3cb33b24454a82faecaf01b19c18562b1e89558fb6c56de4d9118a032fd5 \
|
||||
--hash=sha256:fb69256e180cb6c8a894fee62b3afebae785babc1ee98b81cdf68bbca1987f33 \
|
||||
--hash=sha256:fd1abc0d89e30cc4e02e4064dc67fcc51bd941eb395c502aac3ec19fab46b519 \
|
||||
--hash=sha256:ff8fa367d09b717b2a17a052544193ad76cd49979c805768879cb63d9ca50561
|
||||
# via requests
|
||||
click==8.1.7 \
|
||||
--hash=sha256:ae74fb96c20a0277a1d615f1e4d73c8414f5a98db8b799a7931d1582f3390c28 \
|
||||
--hash=sha256:ca9853ad459e787e2192211578cc907e7594e294c7ccc834310722b41b9ca6de
|
||||
# via mkdocs
|
||||
colorama==0.4.6 \
|
||||
--hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
|
||||
--hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
|
||||
# via mkdocs-material
|
||||
dataproperty==1.0.1 \
|
||||
--hash=sha256:0b8b07d4fb6453fcf975b53d35dea41f3cfd69c9d79b5010c3cf224ff0407a7a \
|
||||
--hash=sha256:723e5729fa6e885e127a771a983ee1e0e34bb141aca4ffe1f0bfa7cde34650a4
|
||||
# via
|
||||
# pytablewriter
|
||||
# tabledata
|
||||
ghp-import==2.1.0 \
|
||||
--hash=sha256:8337dd7b50877f163d4c0289bc1f1c7f127550241988d568c1db512c4324a619 \
|
||||
--hash=sha256:9c535c4c61193c2df8871222567d7fd7e5014d835f97dc7b7439069e2413d343
|
||||
# via mkdocs
|
||||
idna==3.4 \
|
||||
--hash=sha256:814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4 \
|
||||
--hash=sha256:90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2
|
||||
# via requests
|
||||
importlib-metadata==6.8.0 \
|
||||
--hash=sha256:3ebb78df84a805d7698245025b975d9d67053cd94c79245ba4b3eb694abe68bb \
|
||||
--hash=sha256:dbace7892d8c0c4ac1ad096662232f831d4e64f4c4545bd53016a3e9d4654743
|
||||
# via
|
||||
# markdown
|
||||
# mike
|
||||
# mkdocs
|
||||
importlib-resources==6.1.1 \
|
||||
--hash=sha256:3893a00122eafde6894c59914446a512f728a0c1a45f9bb9b63721b6bacf0b4a \
|
||||
--hash=sha256:e8bf90d8213b486f428c9c39714b920041cb02c184686a3dee24905aaa8105d6
|
||||
# via mike
|
||||
jinja2==3.1.2 \
|
||||
--hash=sha256:31351a702a408a9e7595a8fc6150fc3f43bb6bf7e319770cbc0db9df9437e852 \
|
||||
--hash=sha256:6088930bfe239f0e6710546ab9c19c9ef35e29792895fed6e6e31a023a182a61
|
||||
# via
|
||||
# mike
|
||||
# mkdocs
|
||||
# mkdocs-material
|
||||
markdown==3.5.1 \
|
||||
--hash=sha256:5874b47d4ee3f0b14d764324d2c94c03ea66bee56f2d929da9f2508d65e722dc \
|
||||
--hash=sha256:b65d7beb248dc22f2e8a31fb706d93798093c308dc1aba295aedeb9d41a813bd
|
||||
# via
|
||||
# mkdocs
|
||||
# mkdocs-material
|
||||
# pymdown-extensions
|
||||
markupsafe==2.1.3 \
|
||||
--hash=sha256:05fb21170423db021895e1ea1e1f3ab3adb85d1c2333cbc2310f2a26bc77272e \
|
||||
--hash=sha256:0a4e4a1aff6c7ac4cd55792abf96c915634c2b97e3cc1c7129578aa68ebd754e \
|
||||
--hash=sha256:10bbfe99883db80bdbaff2dcf681dfc6533a614f700da1287707e8a5d78a8431 \
|
||||
--hash=sha256:134da1eca9ec0ae528110ccc9e48041e0828d79f24121a1a146161103c76e686 \
|
||||
--hash=sha256:14ff806850827afd6b07a5f32bd917fb7f45b046ba40c57abdb636674a8b559c \
|
||||
--hash=sha256:1577735524cdad32f9f694208aa75e422adba74f1baee7551620e43a3141f559 \
|
||||
--hash=sha256:1b40069d487e7edb2676d3fbdb2b0829ffa2cd63a2ec26c4938b2d34391b4ecc \
|
||||
--hash=sha256:1b8dd8c3fd14349433c79fa8abeb573a55fc0fdd769133baac1f5e07abf54aeb \
|
||||
--hash=sha256:1f67c7038d560d92149c060157d623c542173016c4babc0c1913cca0564b9939 \
|
||||
--hash=sha256:282c2cb35b5b673bbcadb33a585408104df04f14b2d9b01d4c345a3b92861c2c \
|
||||
--hash=sha256:2c1b19b3aaacc6e57b7e25710ff571c24d6c3613a45e905b1fde04d691b98ee0 \
|
||||
--hash=sha256:2ef12179d3a291be237280175b542c07a36e7f60718296278d8593d21ca937d4 \
|
||||
--hash=sha256:338ae27d6b8745585f87218a3f23f1512dbf52c26c28e322dbe54bcede54ccb9 \
|
||||
--hash=sha256:3c0fae6c3be832a0a0473ac912810b2877c8cb9d76ca48de1ed31e1c68386575 \
|
||||
--hash=sha256:3fd4abcb888d15a94f32b75d8fd18ee162ca0c064f35b11134be77050296d6ba \
|
||||
--hash=sha256:42de32b22b6b804f42c5d98be4f7e5e977ecdd9ee9b660fda1a3edf03b11792d \
|
||||
--hash=sha256:47d4f1c5f80fc62fdd7777d0d40a2e9dda0a05883ab11374334f6c4de38adffd \
|
||||
--hash=sha256:504b320cd4b7eff6f968eddf81127112db685e81f7e36e75f9f84f0df46041c3 \
|
||||
--hash=sha256:525808b8019e36eb524b8c68acdd63a37e75714eac50e988180b169d64480a00 \
|
||||
--hash=sha256:56d9f2ecac662ca1611d183feb03a3fa4406469dafe241673d521dd5ae92a155 \
|
||||
--hash=sha256:5bbe06f8eeafd38e5d0a4894ffec89378b6c6a625ff57e3028921f8ff59318ac \
|
||||
--hash=sha256:65c1a9bcdadc6c28eecee2c119465aebff8f7a584dd719facdd9e825ec61ab52 \
|
||||
--hash=sha256:68e78619a61ecf91e76aa3e6e8e33fc4894a2bebe93410754bd28fce0a8a4f9f \
|
||||
--hash=sha256:69c0f17e9f5a7afdf2cc9fb2d1ce6aabdb3bafb7f38017c0b77862bcec2bbad8 \
|
||||
--hash=sha256:6b2b56950d93e41f33b4223ead100ea0fe11f8e6ee5f641eb753ce4b77a7042b \
|
||||
--hash=sha256:715d3562f79d540f251b99ebd6d8baa547118974341db04f5ad06d5ea3eb8007 \
|
||||
--hash=sha256:787003c0ddb00500e49a10f2844fac87aa6ce977b90b0feaaf9de23c22508b24 \
|
||||
--hash=sha256:7ef3cb2ebbf91e330e3bb937efada0edd9003683db6b57bb108c4001f37a02ea \
|
||||
--hash=sha256:8023faf4e01efadfa183e863fefde0046de576c6f14659e8782065bcece22198 \
|
||||
--hash=sha256:8758846a7e80910096950b67071243da3e5a20ed2546e6392603c096778d48e0 \
|
||||
--hash=sha256:8afafd99945ead6e075b973fefa56379c5b5c53fd8937dad92c662da5d8fd5ee \
|
||||
--hash=sha256:8c41976a29d078bb235fea9b2ecd3da465df42a562910f9022f1a03107bd02be \
|
||||
--hash=sha256:8e254ae696c88d98da6555f5ace2279cf7cd5b3f52be2b5cf97feafe883b58d2 \
|
||||
--hash=sha256:8f9293864fe09b8149f0cc42ce56e3f0e54de883a9de90cd427f191c346eb2e1 \
|
||||
--hash=sha256:9402b03f1a1b4dc4c19845e5c749e3ab82d5078d16a2a4c2cd2df62d57bb0707 \
|
||||
--hash=sha256:962f82a3086483f5e5f64dbad880d31038b698494799b097bc59c2edf392fce6 \
|
||||
--hash=sha256:9aad3c1755095ce347e26488214ef77e0485a3c34a50c5a5e2471dff60b9dd9c \
|
||||
--hash=sha256:9dcdfd0eaf283af041973bff14a2e143b8bd64e069f4c383416ecd79a81aab58 \
|
||||
--hash=sha256:aa57bd9cf8ae831a362185ee444e15a93ecb2e344c8e52e4d721ea3ab6ef1823 \
|
||||
--hash=sha256:aa7bd130efab1c280bed0f45501b7c8795f9fdbeb02e965371bbef3523627779 \
|
||||
--hash=sha256:ab4a0df41e7c16a1392727727e7998a467472d0ad65f3ad5e6e765015df08636 \
|
||||
--hash=sha256:ad9e82fb8f09ade1c3e1b996a6337afac2b8b9e365f926f5a61aacc71adc5b3c \
|
||||
--hash=sha256:af598ed32d6ae86f1b747b82783958b1a4ab8f617b06fe68795c7f026abbdcad \
|
||||
--hash=sha256:b076b6226fb84157e3f7c971a47ff3a679d837cf338547532ab866c57930dbee \
|
||||
--hash=sha256:b7ff0f54cb4ff66dd38bebd335a38e2c22c41a8ee45aa608efc890ac3e3931bc \
|
||||
--hash=sha256:bfce63a9e7834b12b87c64d6b155fdd9b3b96191b6bd334bf37db7ff1fe457f2 \
|
||||
--hash=sha256:c011a4149cfbcf9f03994ec2edffcb8b1dc2d2aede7ca243746df97a5d41ce48 \
|
||||
--hash=sha256:c9c804664ebe8f83a211cace637506669e7890fec1b4195b505c214e50dd4eb7 \
|
||||
--hash=sha256:ca379055a47383d02a5400cb0d110cef0a776fc644cda797db0c5696cfd7e18e \
|
||||
--hash=sha256:cb0932dc158471523c9637e807d9bfb93e06a95cbf010f1a38b98623b929ef2b \
|
||||
--hash=sha256:cd0f502fe016460680cd20aaa5a76d241d6f35a1c3350c474bac1273803893fa \
|
||||
--hash=sha256:ceb01949af7121f9fc39f7d27f91be8546f3fb112c608bc4029aef0bab86a2a5 \
|
||||
--hash=sha256:d080e0a5eb2529460b30190fcfcc4199bd7f827663f858a226a81bc27beaa97e \
|
||||
--hash=sha256:dd15ff04ffd7e05ffcb7fe79f1b98041b8ea30ae9234aed2a9168b5797c3effb \
|
||||
--hash=sha256:df0be2b576a7abbf737b1575f048c23fb1d769f267ec4358296f31c2479db8f9 \
|
||||
--hash=sha256:e09031c87a1e51556fdcb46e5bd4f59dfb743061cf93c4d6831bf894f125eb57 \
|
||||
--hash=sha256:e4dd52d80b8c83fdce44e12478ad2e85c64ea965e75d66dbeafb0a3e77308fcc \
|
||||
--hash=sha256:f698de3fd0c4e6972b92290a45bd9b1536bffe8c6759c62471efaa8acb4c37bc \
|
||||
--hash=sha256:fec21693218efe39aa7f8599346e90c705afa52c5b31ae019b2e57e8f6542bb2 \
|
||||
--hash=sha256:ffcc3f7c66b5f5b7931a5aa68fc9cecc51e685ef90282f4a82f0f5e9b704ad11
|
||||
# via
|
||||
# jinja2
|
||||
# mkdocs
|
||||
mbstrdecoder==1.1.3 \
|
||||
--hash=sha256:d66c1ed3f2dc4e7c5d87cd44a75be10bc5af4250f95b38bbaedd7851308ce938 \
|
||||
--hash=sha256:dcfd2c759322eb44fe193a9e0b1b86c5b87f3ec5ea8e1bb43b3e9ae423f1e8fe
|
||||
# via
|
||||
# dataproperty
|
||||
# pytablewriter
|
||||
# typepy
|
||||
mergedeep==1.3.4 \
|
||||
--hash=sha256:0096d52e9dad9939c3d975a774666af186eda617e6ca84df4c94dec30004f2a8 \
|
||||
--hash=sha256:70775750742b25c0d8f36c55aed03d24c3384d17c951b3175d898bd778ef0307
|
||||
# via mkdocs
|
||||
mike==2.0.0 \
|
||||
--hash=sha256:566f1cab1a58cc50b106fb79ea2f1f56e7bfc8b25a051e95e6eaee9fba0922de \
|
||||
--hash=sha256:87f496a65900f93ba92d72940242b65c86f3f2f82871bc60ebdcffc91fad1d9e
|
||||
# via -r requirements.in
|
||||
mkdocs==1.5.3 \
|
||||
--hash=sha256:3b3a78e736b31158d64dbb2f8ba29bd46a379d0c6e324c2246c3bc3d2189cfc1 \
|
||||
--hash=sha256:eb7c99214dcb945313ba30426c2451b735992c73c2e10838f76d09e39ff4d0e2
|
||||
# via
|
||||
# -r requirements.in
|
||||
# mike
|
||||
# mkdocs-material
|
||||
mkdocs-material==9.4.8 \
|
||||
--hash=sha256:8b20f6851bddeef37dced903893cd176cf13a21a482e97705a103c45f06ce9b9 \
|
||||
--hash=sha256:f0c101453e8bc12b040e8b64ca39a405d950d8402609b1378cc2b98976e74b5f
|
||||
# via
|
||||
# -r requirements.in
|
||||
# mkdocs-print-site-plugin
|
||||
mkdocs-material-extensions==1.3 \
|
||||
--hash=sha256:0297cc48ba68a9fdd1ef3780a3b41b534b0d0df1d1181a44676fda5f464eeadc \
|
||||
--hash=sha256:f0446091503acb110a7cab9349cbc90eeac51b58d1caa92a704a81ca1e24ddbd
|
||||
# via mkdocs-material
|
||||
mkdocs-print-site-plugin==2.3.6 \
|
||||
--hash=sha256:01ccb1ceccc87f29e1612bebb77c3bf9980809fbce750fc2113f9d6acea589d4 \
|
||||
--hash=sha256:82e5cabcfb7fe3074daecea018f28ccb4bff086f965e3103fe91019a76752f22
|
||||
# via -r requirements.in
|
||||
packaging==23.2 \
|
||||
--hash=sha256:048fb0e9405036518eaaf48a55953c750c11e1a1b68e0dd1a9d62ed0c092cfc5 \
|
||||
--hash=sha256:8c491190033a9af7e1d931d0b5dacc2ef47509b34dd0de67ed209b5203fc88c7
|
||||
# via
|
||||
# mkdocs
|
||||
# typepy
|
||||
paginate==0.5.6 \
|
||||
--hash=sha256:5e6007b6a9398177a7e1648d04fdd9f8c9766a1a945bceac82f1929e8c78af2d
|
||||
# via mkdocs-material
|
||||
pathspec==0.11.2 \
|
||||
--hash=sha256:1d6ed233af05e679efb96b1851550ea95bbb64b7c490b0f5aa52996c11e92a20 \
|
||||
--hash=sha256:e0d8d0ac2f12da61956eb2306b69f9469b42f4deb0f3cb6ed47b9cce9996ced3
|
||||
# via mkdocs
|
||||
pathvalidate==3.2.0 \
|
||||
--hash=sha256:5e8378cf6712bff67fbe7a8307d99fa8c1a0cb28aa477056f8fc374f0dff24ad \
|
||||
--hash=sha256:cc593caa6299b22b37f228148257997e2fa850eea2daf7e4cc9205cef6908dee
|
||||
# via pytablewriter
|
||||
platformdirs==4.0.0 \
|
||||
--hash=sha256:118c954d7e949b35437270383a3f2531e99dd93cf7ce4dc8340d3356d30f173b \
|
||||
--hash=sha256:cb633b2bcf10c51af60beb0ab06d2f1d69064b43abf4c185ca6b28865f3f9731
|
||||
# via mkdocs
|
||||
pygments==2.16.1 \
|
||||
--hash=sha256:13fc09fa63bc8d8671a6d247e1eb303c4b343eaee81d861f3404db2935653692 \
|
||||
--hash=sha256:1daff0494820c69bc8941e407aa20f577374ee88364ee10a98fdbe0aece96e29
|
||||
# via mkdocs-material
|
||||
pymdown-extensions==10.4 \
|
||||
--hash=sha256:bc46f11749ecd4d6b71cf62396104b4a200bad3498cb0f5dad1b8502fe461a35 \
|
||||
--hash=sha256:cfc28d6a09d19448bcbf8eee3ce098c7d17ff99f7bd3069db4819af181212037
|
||||
# via mkdocs-material
|
||||
pyparsing==3.1.1 \
|
||||
--hash=sha256:32c7c0b711493c72ff18a981d24f28aaf9c1fb7ed5e9667c9e84e3db623bdbfb \
|
||||
--hash=sha256:ede28a1a32462f5a9705e07aea48001a08f7cf81a021585011deba701581a0db
|
||||
# via mike
|
||||
pytablewriter==1.2.0 \
|
||||
--hash=sha256:0204a4bb684a22140d640f2599f09e137bcdc18b3dd49426f4a555016e246b46 \
|
||||
--hash=sha256:4a30e2bb4bf5bc1069b1d2b2bc41947577c4517ab0875b23a5b194d296f543d8
|
||||
# via -r requirements.in
|
||||
python-dateutil==2.8.2 \
|
||||
--hash=sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86 \
|
||||
--hash=sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9
|
||||
# via
|
||||
# ghp-import
|
||||
# typepy
|
||||
pytz==2023.3.post1 \
|
||||
--hash=sha256:7b4fddbeb94a1eba4b557da24f19fdf9db575192544270a9101d8509f9f43d7b \
|
||||
--hash=sha256:ce42d816b81b68506614c11e8937d3aa9e41007ceb50bfdcb0749b921bf646c7
|
||||
# via typepy
|
||||
pyyaml==6.0.1 \
|
||||
--hash=sha256:04ac92ad1925b2cff1db0cfebffb6ffc43457495c9b3c39d3fcae417d7125dc5 \
|
||||
--hash=sha256:062582fca9fabdd2c8b54a3ef1c978d786e0f6b3a1510e0ac93ef59e0ddae2bc \
|
||||
--hash=sha256:0d3304d8c0adc42be59c5f8a4d9e3d7379e6955ad754aa9d6ab7a398b59dd1df \
|
||||
--hash=sha256:1635fd110e8d85d55237ab316b5b011de701ea0f29d07611174a1b42f1444741 \
|
||||
--hash=sha256:184c5108a2aca3c5b3d3bf9395d50893a7ab82a38004c8f61c258d4428e80206 \
|
||||
--hash=sha256:18aeb1bf9a78867dc38b259769503436b7c72f7a1f1f4c93ff9a17de54319b27 \
|
||||
--hash=sha256:1d4c7e777c441b20e32f52bd377e0c409713e8bb1386e1099c2415f26e479595 \
|
||||
--hash=sha256:1e2722cc9fbb45d9b87631ac70924c11d3a401b2d7f410cc0e3bbf249f2dca62 \
|
||||
--hash=sha256:1fe35611261b29bd1de0070f0b2f47cb6ff71fa6595c077e42bd0c419fa27b98 \
|
||||
--hash=sha256:28c119d996beec18c05208a8bd78cbe4007878c6dd15091efb73a30e90539696 \
|
||||
--hash=sha256:326c013efe8048858a6d312ddd31d56e468118ad4cdeda36c719bf5bb6192290 \
|
||||
--hash=sha256:40df9b996c2b73138957fe23a16a4f0ba614f4c0efce1e9406a184b6d07fa3a9 \
|
||||
--hash=sha256:42f8152b8dbc4fe7d96729ec2b99c7097d656dc1213a3229ca5383f973a5ed6d \
|
||||
--hash=sha256:49a183be227561de579b4a36efbb21b3eab9651dd81b1858589f796549873dd6 \
|
||||
--hash=sha256:4fb147e7a67ef577a588a0e2c17b6db51dda102c71de36f8549b6816a96e1867 \
|
||||
--hash=sha256:50550eb667afee136e9a77d6dc71ae76a44df8b3e51e41b77f6de2932bfe0f47 \
|
||||
--hash=sha256:510c9deebc5c0225e8c96813043e62b680ba2f9c50a08d3724c7f28a747d1486 \
|
||||
--hash=sha256:5773183b6446b2c99bb77e77595dd486303b4faab2b086e7b17bc6bef28865f6 \
|
||||
--hash=sha256:596106435fa6ad000c2991a98fa58eeb8656ef2325d7e158344fb33864ed87e3 \
|
||||
--hash=sha256:6965a7bc3cf88e5a1c3bd2e0b5c22f8d677dc88a455344035f03399034eb3007 \
|
||||
--hash=sha256:69b023b2b4daa7548bcfbd4aa3da05b3a74b772db9e23b982788168117739938 \
|
||||
--hash=sha256:6c22bec3fbe2524cde73d7ada88f6566758a8f7227bfbf93a408a9d86bcc12a0 \
|
||||
--hash=sha256:704219a11b772aea0d8ecd7058d0082713c3562b4e271b849ad7dc4a5c90c13c \
|
||||
--hash=sha256:7e07cbde391ba96ab58e532ff4803f79c4129397514e1413a7dc761ccd755735 \
|
||||
--hash=sha256:81e0b275a9ecc9c0c0c07b4b90ba548307583c125f54d5b6946cfee6360c733d \
|
||||
--hash=sha256:855fb52b0dc35af121542a76b9a84f8d1cd886ea97c84703eaa6d88e37a2ad28 \
|
||||
--hash=sha256:8d4e9c88387b0f5c7d5f281e55304de64cf7f9c0021a3525bd3b1c542da3b0e4 \
|
||||
--hash=sha256:9046c58c4395dff28dd494285c82ba00b546adfc7ef001486fbf0324bc174fba \
|
||||
--hash=sha256:9eb6caa9a297fc2c2fb8862bc5370d0303ddba53ba97e71f08023b6cd73d16a8 \
|
||||
--hash=sha256:a0cd17c15d3bb3fa06978b4e8958dcdc6e0174ccea823003a106c7d4d7899ac5 \
|
||||
--hash=sha256:afd7e57eddb1a54f0f1a974bc4391af8bcce0b444685d936840f125cf046d5bd \
|
||||
--hash=sha256:b1275ad35a5d18c62a7220633c913e1b42d44b46ee12554e5fd39c70a243d6a3 \
|
||||
--hash=sha256:b786eecbdf8499b9ca1d697215862083bd6d2a99965554781d0d8d1ad31e13a0 \
|
||||
--hash=sha256:ba336e390cd8e4d1739f42dfe9bb83a3cc2e80f567d8805e11b46f4a943f5515 \
|
||||
--hash=sha256:baa90d3f661d43131ca170712d903e6295d1f7a0f595074f151c0aed377c9b9c \
|
||||
--hash=sha256:bc1bf2925a1ecd43da378f4db9e4f799775d6367bdb94671027b73b393a7c42c \
|
||||
--hash=sha256:bd4af7373a854424dabd882decdc5579653d7868b8fb26dc7d0e99f823aa5924 \
|
||||
--hash=sha256:bf07ee2fef7014951eeb99f56f39c9bb4af143d8aa3c21b1677805985307da34 \
|
||||
--hash=sha256:bfdf460b1736c775f2ba9f6a92bca30bc2095067b8a9d77876d1fad6cc3b4a43 \
|
||||
--hash=sha256:c8098ddcc2a85b61647b2590f825f3db38891662cfc2fc776415143f599bb859 \
|
||||
--hash=sha256:d2b04aac4d386b172d5b9692e2d2da8de7bfb6c387fa4f801fbf6fb2e6ba4673 \
|
||||
--hash=sha256:d483d2cdf104e7c9fa60c544d92981f12ad66a457afae824d146093b8c294c54 \
|
||||
--hash=sha256:d858aa552c999bc8a8d57426ed01e40bef403cd8ccdd0fc5f6f04a00414cac2a \
|
||||
--hash=sha256:e7d73685e87afe9f3b36c799222440d6cf362062f78be1013661b00c5c6f678b \
|
||||
--hash=sha256:f003ed9ad21d6a4713f0a9b5a7a0a79e08dd0f221aff4525a2be4c346ee60aab \
|
||||
--hash=sha256:f22ac1c3cac4dbc50079e965eba2c1058622631e526bd9afd45fedd49ba781fa \
|
||||
--hash=sha256:faca3bdcf85b2fc05d06ff3fbc1f83e1391b3e724afa3feba7d13eeab355484c \
|
||||
--hash=sha256:fca0e3a251908a499833aa292323f32437106001d436eca0e6e7833256674585 \
|
||||
--hash=sha256:fd1592b3fdf65fff2ad0004b5e363300ef59ced41c2e6b3a99d4089fa8c5435d \
|
||||
--hash=sha256:fd66fc5d0da6d9815ba2cebeb4205f95818ff4b79c3ebe268e75d961704af52f
|
||||
# via
|
||||
# mike
|
||||
# mkdocs
|
||||
# pymdown-extensions
|
||||
# pyyaml-env-tag
|
||||
pyyaml-env-tag==0.1 \
|
||||
--hash=sha256:70092675bda14fdec33b31ba77e7543de9ddc88f2e5b99160396572d11525bdb \
|
||||
--hash=sha256:af31106dec8a4d68c60207c1886031cbf839b68aa7abccdb19868200532c2069
|
||||
# via mkdocs
|
||||
regex==2023.10.3 \
|
||||
--hash=sha256:00ba3c9818e33f1fa974693fb55d24cdc8ebafcb2e4207680669d8f8d7cca79a \
|
||||
--hash=sha256:00e871d83a45eee2f8688d7e6849609c2ca2a04a6d48fba3dff4deef35d14f07 \
|
||||
--hash=sha256:06e9abc0e4c9ab4779c74ad99c3fc10d3967d03114449acc2c2762ad4472b8ca \
|
||||
--hash=sha256:0b9ac09853b2a3e0d0082104036579809679e7715671cfbf89d83c1cb2a30f58 \
|
||||
--hash=sha256:0d47840dc05e0ba04fe2e26f15126de7c755496d5a8aae4a08bda4dd8d646c54 \
|
||||
--hash=sha256:0f649fa32fe734c4abdfd4edbb8381c74abf5f34bc0b3271ce687b23729299ed \
|
||||
--hash=sha256:107ac60d1bfdc3edb53be75e2a52aff7481b92817cfdddd9b4519ccf0e54a6ff \
|
||||
--hash=sha256:11175910f62b2b8c055f2b089e0fedd694fe2be3941b3e2633653bc51064c528 \
|
||||
--hash=sha256:12bd4bc2c632742c7ce20db48e0d99afdc05e03f0b4c1af90542e05b809a03d9 \
|
||||
--hash=sha256:16f8740eb6dbacc7113e3097b0a36065a02e37b47c936b551805d40340fb9971 \
|
||||
--hash=sha256:1c0e8fae5b27caa34177bdfa5a960c46ff2f78ee2d45c6db15ae3f64ecadde14 \
|
||||
--hash=sha256:2c54e23836650bdf2c18222c87f6f840d4943944146ca479858404fedeb9f9af \
|
||||
--hash=sha256:3367007ad1951fde612bf65b0dffc8fd681a4ab98ac86957d16491400d661302 \
|
||||
--hash=sha256:36362386b813fa6c9146da6149a001b7bd063dabc4d49522a1f7aa65b725c7ec \
|
||||
--hash=sha256:39807cbcbe406efca2a233884e169d056c35aa7e9f343d4e78665246a332f597 \
|
||||
--hash=sha256:39cdf8d141d6d44e8d5a12a8569d5a227f645c87df4f92179bd06e2e2705e76b \
|
||||
--hash=sha256:3b2c3502603fab52d7619b882c25a6850b766ebd1b18de3df23b2f939360e1bd \
|
||||
--hash=sha256:3ccf2716add72f80714b9a63899b67fa711b654be3fcdd34fa391d2d274ce767 \
|
||||
--hash=sha256:3fef4f844d2290ee0ba57addcec17eec9e3df73f10a2748485dfd6a3a188cc0f \
|
||||
--hash=sha256:4023e2efc35a30e66e938de5aef42b520c20e7eda7bb5fb12c35e5d09a4c43f6 \
|
||||
--hash=sha256:4a3ee019a9befe84fa3e917a2dd378807e423d013377a884c1970a3c2792d293 \
|
||||
--hash=sha256:4a8bf76e3182797c6b1afa5b822d1d5802ff30284abe4599e1247be4fd6b03be \
|
||||
--hash=sha256:4a992f702c9be9c72fa46f01ca6e18d131906a7180950958f766c2aa294d4b41 \
|
||||
--hash=sha256:4c34d4f73ea738223a094d8e0ffd6d2c1a1b4c175da34d6b0de3d8d69bee6bcc \
|
||||
--hash=sha256:4cd1bccf99d3ef1ab6ba835308ad85be040e6a11b0977ef7ea8c8005f01a3c29 \
|
||||
--hash=sha256:4ef80829117a8061f974b2fda8ec799717242353bff55f8a29411794d635d964 \
|
||||
--hash=sha256:58837f9d221744d4c92d2cf7201c6acd19623b50c643b56992cbd2b745485d3d \
|
||||
--hash=sha256:5a8f91c64f390ecee09ff793319f30a0f32492e99f5dc1c72bc361f23ccd0a9a \
|
||||
--hash=sha256:5addc9d0209a9afca5fc070f93b726bf7003bd63a427f65ef797a931782e7edc \
|
||||
--hash=sha256:6239d4e2e0b52c8bd38c51b760cd870069f0bdf99700a62cd509d7a031749a55 \
|
||||
--hash=sha256:66e2fe786ef28da2b28e222c89502b2af984858091675044d93cb50e6f46d7af \
|
||||
--hash=sha256:69c0771ca5653c7d4b65203cbfc5e66db9375f1078689459fe196fe08b7b4930 \
|
||||
--hash=sha256:6ac965a998e1388e6ff2e9781f499ad1eaa41e962a40d11c7823c9952c77123e \
|
||||
--hash=sha256:6c56c3d47da04f921b73ff9415fbaa939f684d47293f071aa9cbb13c94afc17d \
|
||||
--hash=sha256:6f85739e80d13644b981a88f529d79c5bdf646b460ba190bffcaf6d57b2a9863 \
|
||||
--hash=sha256:706e7b739fdd17cb89e1fbf712d9dc21311fc2333f6d435eac2d4ee81985098c \
|
||||
--hash=sha256:741ba2f511cc9626b7561a440f87d658aabb3d6b744a86a3c025f866b4d19e7f \
|
||||
--hash=sha256:7434a61b158be563c1362d9071358f8ab91b8d928728cd2882af060481244c9e \
|
||||
--hash=sha256:76066d7ff61ba6bf3cb5efe2428fc82aac91802844c022d849a1f0f53820502d \
|
||||
--hash=sha256:7979b834ec7a33aafae34a90aad9f914c41fd6eaa8474e66953f3f6f7cbd4368 \
|
||||
--hash=sha256:7eece6fbd3eae4a92d7c748ae825cbc1ee41a89bb1c3db05b5578ed3cfcfd7cb \
|
||||
--hash=sha256:7ef1e014eed78ab650bef9a6a9cbe50b052c0aebe553fb2881e0453717573f52 \
|
||||
--hash=sha256:81dce2ddc9f6e8f543d94b05d56e70d03a0774d32f6cca53e978dc01e4fc75b8 \
|
||||
--hash=sha256:82fcc1f1cc3ff1ab8a57ba619b149b907072e750815c5ba63e7aa2e1163384a4 \
|
||||
--hash=sha256:8d1f21af4c1539051049796a0f50aa342f9a27cde57318f2fc41ed50b0dbc4ac \
|
||||
--hash=sha256:90a79bce019c442604662d17bf69df99090e24cdc6ad95b18b6725c2988a490e \
|
||||
--hash=sha256:9145f092b5d1977ec8c0ab46e7b3381b2fd069957b9862a43bd383e5c01d18c2 \
|
||||
--hash=sha256:91dc1d531f80c862441d7b66c4505cd6ea9d312f01fb2f4654f40c6fdf5cc37a \
|
||||
--hash=sha256:979c24cbefaf2420c4e377ecd1f165ea08cc3d1fbb44bdc51bccbbf7c66a2cb4 \
|
||||
--hash=sha256:994645a46c6a740ee8ce8df7911d4aee458d9b1bc5639bc968226763d07f00fa \
|
||||
--hash=sha256:9b98b7681a9437262947f41c7fac567c7e1f6eddd94b0483596d320092004533 \
|
||||
--hash=sha256:9c6b4d23c04831e3ab61717a707a5d763b300213db49ca680edf8bf13ab5d91b \
|
||||
--hash=sha256:9c6d0ced3c06d0f183b73d3c5920727268d2201aa0fe6d55c60d68c792ff3588 \
|
||||
--hash=sha256:9fd88f373cb71e6b59b7fa597e47e518282455c2734fd4306a05ca219a1991b0 \
|
||||
--hash=sha256:a8f4e49fc3ce020f65411432183e6775f24e02dff617281094ba6ab079ef0915 \
|
||||
--hash=sha256:a9e908ef5889cda4de038892b9accc36d33d72fb3e12c747e2799a0e806ec841 \
|
||||
--hash=sha256:ad08a69728ff3c79866d729b095872afe1e0557251da4abb2c5faff15a91d19a \
|
||||
--hash=sha256:adbccd17dcaff65704c856bd29951c58a1bd4b2b0f8ad6b826dbd543fe740988 \
|
||||
--hash=sha256:b0c7d2f698e83f15228ba41c135501cfe7d5740181d5903e250e47f617eb4292 \
|
||||
--hash=sha256:b3ab05a182c7937fb374f7e946f04fb23a0c0699c0450e9fb02ef567412d2fa3 \
|
||||
--hash=sha256:b6104f9a46bd8743e4f738afef69b153c4b8b592d35ae46db07fc28ae3d5fb7c \
|
||||
--hash=sha256:ba7cd6dc4d585ea544c1412019921570ebd8a597fabf475acc4528210d7c4a6f \
|
||||
--hash=sha256:bc72c231f5449d86d6c7d9cc7cd819b6eb30134bb770b8cfdc0765e48ef9c420 \
|
||||
--hash=sha256:bce8814b076f0ce5766dc87d5a056b0e9437b8e0cd351b9a6c4e1134a7dfbda9 \
|
||||
--hash=sha256:be5e22bbb67924dea15039c3282fa4cc6cdfbe0cbbd1c0515f9223186fc2ec5f \
|
||||
--hash=sha256:be6b7b8d42d3090b6c80793524fa66c57ad7ee3fe9722b258aec6d0672543fd0 \
|
||||
--hash=sha256:bfe50b61bab1b1ec260fa7cd91106fa9fece57e6beba05630afe27c71259c59b \
|
||||
--hash=sha256:bff507ae210371d4b1fe316d03433ac099f184d570a1a611e541923f78f05037 \
|
||||
--hash=sha256:c148bec483cc4b421562b4bcedb8e28a3b84fcc8f0aa4418e10898f3c2c0eb9b \
|
||||
--hash=sha256:c15ad0aee158a15e17e0495e1e18741573d04eb6da06d8b84af726cfc1ed02ee \
|
||||
--hash=sha256:c2169b2dcabf4e608416f7f9468737583ce5f0a6e8677c4efbf795ce81109d7c \
|
||||
--hash=sha256:c55853684fe08d4897c37dfc5faeff70607a5f1806c8be148f1695be4a63414b \
|
||||
--hash=sha256:c65a3b5330b54103e7d21cac3f6bf3900d46f6d50138d73343d9e5b2900b2353 \
|
||||
--hash=sha256:c7964c2183c3e6cce3f497e3a9f49d182e969f2dc3aeeadfa18945ff7bdd7051 \
|
||||
--hash=sha256:cc3f1c053b73f20c7ad88b0d1d23be7e7b3901229ce89f5000a8399746a6e039 \
|
||||
--hash=sha256:ce615c92d90df8373d9e13acddd154152645c0dc060871abf6bd43809673d20a \
|
||||
--hash=sha256:d29338556a59423d9ff7b6eb0cb89ead2b0875e08fe522f3e068b955c3e7b59b \
|
||||
--hash=sha256:d8a993c0a0ffd5f2d3bda23d0cd75e7086736f8f8268de8a82fbc4bd0ac6791e \
|
||||
--hash=sha256:d9c727bbcf0065cbb20f39d2b4f932f8fa1631c3e01fcedc979bd4f51fe051c5 \
|
||||
--hash=sha256:dac37cf08fcf2094159922edc7a2784cfcc5c70f8354469f79ed085f0328ebdf \
|
||||
--hash=sha256:dd829712de97753367153ed84f2de752b86cd1f7a88b55a3a775eb52eafe8a94 \
|
||||
--hash=sha256:e54ddd0bb8fb626aa1f9ba7b36629564544954fff9669b15da3610c22b9a0991 \
|
||||
--hash=sha256:e77c90ab5997e85901da85131fd36acd0ed2221368199b65f0d11bca44549711 \
|
||||
--hash=sha256:ebedc192abbc7fd13c5ee800e83a6df252bec691eb2c4bedc9f8b2e2903f5e2a \
|
||||
--hash=sha256:ef71561f82a89af6cfcbee47f0fabfdb6e63788a9258e913955d89fdd96902ab \
|
||||
--hash=sha256:f0a47efb1dbef13af9c9a54a94a0b814902e547b7f21acb29434504d18f36e3a \
|
||||
--hash=sha256:f4f2ca6df64cbdd27f27b34f35adb640b5d2d77264228554e68deda54456eb11 \
|
||||
--hash=sha256:fb02e4257376ae25c6dd95a5aec377f9b18c09be6ebdefa7ad209b9137b73d48
|
||||
# via mkdocs-material
|
||||
requests==2.31.0 \
|
||||
--hash=sha256:58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f \
|
||||
--hash=sha256:942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1
|
||||
# via
|
||||
# importlib-metadata
|
||||
# importlib-resources
|
||||
|
||||
# The following packages are considered to be unsafe in a requirements file:
|
||||
setuptools==68.2.2 \
|
||||
--hash=sha256:4ac1475276d2f1c48684874089fefcd83bd7162ddaafb81fac866ba0db282a87 \
|
||||
--hash=sha256:b454a35605876da60632df1a60f736524eb73cc47bbc9f3f1ef1b644de74fd2a
|
||||
# via mkdocs-material
|
||||
six==1.16.0 \
|
||||
--hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \
|
||||
--hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
|
||||
# via python-dateutil
|
||||
tabledata==1.3.3 \
|
||||
--hash=sha256:4abad1c996d8607e23b045b44dc0c5f061668f3c37585302c5f6c84c93a89962 \
|
||||
--hash=sha256:c90daaba9a408e4397934b3ff2f6c06797d5289676420bf520c741ad43e6ff91
|
||||
# via pytablewriter
|
||||
tcolorpy==0.1.4 \
|
||||
--hash=sha256:d0926480aa5012f34877d69fc3b670f207dc165674e68ad07458fa6ee5b12724 \
|
||||
--hash=sha256:f0dceb1cb95e554cee63024b3cd2fd8d4628c568773de2d1e6b4f0478461901c
|
||||
# via pytablewriter
|
||||
typepy==1.3.2 \
|
||||
--hash=sha256:b69fd48b9f50cdb3809906eef36b855b3134ff66c8893a4f8580abddb0b39517 \
|
||||
--hash=sha256:d5d1022a424132622993800f1d2cd16cfdb691ac4e3b9c325f0fcb37799db1ae
|
||||
# via
|
||||
# dataproperty
|
||||
# pytablewriter
|
||||
# tabledata
|
||||
# typepy
|
||||
urllib3==2.0.7 \
|
||||
--hash=sha256:c97dfde1f7bd43a71c8d2a58e369e9b2bf692d1334ea9f9cae55add7d0dd0f84 \
|
||||
--hash=sha256:fdb6d215c776278489906c2f8916e6e7d4f5a9b602ccbcfdf7f016fc8da0596e
|
||||
# via requests
|
||||
verspec==0.1.0 \
|
||||
--hash=sha256:741877d5633cc9464c45a469ae2a31e801e6dbbaa85b9675d481cda100f11c31 \
|
||||
--hash=sha256:c4504ca697b2056cdb4bfa7121461f5a0e81809255b41c03dda4ba823637c01e
|
||||
# via mike
|
||||
watchdog==3.0.0 \
|
||||
--hash=sha256:0e06ab8858a76e1219e68c7573dfeba9dd1c0219476c5a44d5333b01d7e1743a \
|
||||
--hash=sha256:13bbbb462ee42ec3c5723e1205be8ced776f05b100e4737518c67c8325cf6100 \
|
||||
--hash=sha256:233b5817932685d39a7896b1090353fc8efc1ef99c9c054e46c8002561252fb8 \
|
||||
--hash=sha256:25f70b4aa53bd743729c7475d7ec41093a580528b100e9a8c5b5efe8899592fc \
|
||||
--hash=sha256:2b57a1e730af3156d13b7fdddfc23dea6487fceca29fc75c5a868beed29177ae \
|
||||
--hash=sha256:336adfc6f5cc4e037d52db31194f7581ff744b67382eb6021c868322e32eef41 \
|
||||
--hash=sha256:3aa7f6a12e831ddfe78cdd4f8996af9cf334fd6346531b16cec61c3b3c0d8da0 \
|
||||
--hash=sha256:3ed7c71a9dccfe838c2f0b6314ed0d9b22e77d268c67e015450a29036a81f60f \
|
||||
--hash=sha256:4c9956d27be0bb08fc5f30d9d0179a855436e655f046d288e2bcc11adfae893c \
|
||||
--hash=sha256:4d98a320595da7a7c5a18fc48cb633c2e73cda78f93cac2ef42d42bf609a33f9 \
|
||||
--hash=sha256:4f94069eb16657d2c6faada4624c39464f65c05606af50bb7902e036e3219be3 \
|
||||
--hash=sha256:5113334cf8cf0ac8cd45e1f8309a603291b614191c9add34d33075727a967709 \
|
||||
--hash=sha256:51f90f73b4697bac9c9a78394c3acbbd331ccd3655c11be1a15ae6fe289a8c83 \
|
||||
--hash=sha256:5d9f3a10e02d7371cd929b5d8f11e87d4bad890212ed3901f9b4d68767bee759 \
|
||||
--hash=sha256:7ade88d0d778b1b222adebcc0927428f883db07017618a5e684fd03b83342bd9 \
|
||||
--hash=sha256:7c5f84b5194c24dd573fa6472685b2a27cc5a17fe5f7b6fd40345378ca6812e3 \
|
||||
--hash=sha256:7e447d172af52ad204d19982739aa2346245cc5ba6f579d16dac4bfec226d2e7 \
|
||||
--hash=sha256:8ae9cda41fa114e28faf86cb137d751a17ffd0316d1c34ccf2235e8a84365c7f \
|
||||
--hash=sha256:8f3ceecd20d71067c7fd4c9e832d4e22584318983cabc013dbf3f70ea95de346 \
|
||||
--hash=sha256:9fac43a7466eb73e64a9940ac9ed6369baa39b3bf221ae23493a9ec4d0022674 \
|
||||
--hash=sha256:a70a8dcde91be523c35b2bf96196edc5730edb347e374c7de7cd20c43ed95397 \
|
||||
--hash=sha256:adfdeab2da79ea2f76f87eb42a3ab1966a5313e5a69a0213a3cc06ef692b0e96 \
|
||||
--hash=sha256:ba07e92756c97e3aca0912b5cbc4e5ad802f4557212788e72a72a47ff376950d \
|
||||
--hash=sha256:c07253088265c363d1ddf4b3cdb808d59a0468ecd017770ed716991620b8f77a \
|
||||
--hash=sha256:c9d8c8ec7efb887333cf71e328e39cffbf771d8f8f95d308ea4125bf5f90ba64 \
|
||||
--hash=sha256:d00e6be486affb5781468457b21a6cbe848c33ef43f9ea4a73b4882e5f188a44 \
|
||||
--hash=sha256:d429c2430c93b7903914e4db9a966c7f2b068dd2ebdd2fa9b9ce094c7d459f33
|
||||
# via mkdocs
|
||||
zipp==3.17.0 \
|
||||
--hash=sha256:0e923e726174922dce09c53c59ad483ff7bbb8e572e00c7f7c46b88556409f31 \
|
||||
--hash=sha256:84e64a1c28cf7e91ed2078bb8cc8c259cb19b76942096c8d7b84947690cabaf0
|
||||
# via pytablewriter
|
||||
4
docs/robots.txt
Normal file
4
docs/robots.txt
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
User-agent: *
|
||||
Allow: /latest/
|
||||
|
||||
Sitemap: https://docs.bunkerweb.io/latest/sitemap.xml
|
||||
495
docs/security-tuning.md
Normal file
495
docs/security-tuning.md
Normal file
|
|
@ -0,0 +1,495 @@
|
|||
# Security tuning
|
||||
|
||||
BunkerWeb offers many security features that you can configure with [settings](settings.md). Even if the default values of settings ensure a minimal "security by default", we strongly recommend you tune them. By doing so you will be able to ensure the security level of your choice but also manage false positives.
|
||||
|
||||
!!! tip "Other settings"
|
||||
This section only focuses on security tuning, see the [settings section](settings.md) of the documentation for other settings.
|
||||
|
||||
<figure markdown>
|
||||
{ align=center }
|
||||
<figcaption>Overview and order of the core security plugins</figcaption>
|
||||
</figure>
|
||||
|
||||
## HTTP protocol
|
||||
|
||||
### Deny status code
|
||||
|
||||
STREAM support :warning:
|
||||
|
||||
The first thing to define is the kind of action to do when a client access is denied. You can control the action with the `DENY_HTTP_STATUS` setting which allows the following values :
|
||||
|
||||
- `403` : send a "classical" Forbidden HTTP status code (a web page or custom content will be displayed)
|
||||
- `444` : close the connection (no web page or custom content will be displayed)
|
||||
|
||||
The default value is `403` and we suggest you set it to `444` only if you already fixed a lot of false positive, you are familiar with BunkerWeb and want a higher level of security.
|
||||
|
||||
When using stream mode, value is ignored and always set to `444` with effect of closing the connection.
|
||||
|
||||
### Default server
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
In the HTTP protocol, the Host header is used to determine which server the client wants to send the request to. That header is facultative and may be missing from the request or can be set as an unknown value. This is a common case, a lot of bots are scanning the Internet and are trying to exploit services or simply doing some fingerprinting.
|
||||
|
||||
You can disable any request containing undefined or unknown Host value by setting `DISABLE_DEFAULT_SERVER` to `yes` (default : `no`). Please note that clients won't even receive a response, the TCP connection will be closed (using the special 444 status code of NGINX).
|
||||
|
||||
### Allowed methods
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
You can control the allowed HTTP methods by listing them (separated with "|") in the `ALLOWED_METHODS` setting (default : `GET|POST|HEAD`). Clients sending a method which is not listed will get a "405 - Method Not Allowed".
|
||||
|
||||
### Max sizes
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
You can control the maximum body size with the `MAX_CLIENT_SIZE` setting (default : `10m`). See [here](https://nginx.org/en/docs/syntax.html) for accepted values. You can use the special value `0` to allow a body of infinite size (not recommended).
|
||||
|
||||
### Serve files
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
To disable serving files from the www folder, you can set `SERVE_FILES` to `no` (default : `yes`). The value `no` is recommended if you use BunkerWeb as a reverse proxy.
|
||||
|
||||
### Headers
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Headers are very important when it comes to HTTP security. While some of them might be too verbose, others' verbosity will need to be increased, especially on the client-side.
|
||||
|
||||
#### Remove headers
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
You can automatically remove verbose headers in the HTTP responses by using the `REMOVE_HEADERS` setting (default : `Server X-Powered-By X-AspNet-Version X-AspNetMvc-Version`).
|
||||
|
||||
#### Keep upstream headers
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
You can automatically keep headers from upstream servers and prevent BunkerWeb from overriding them in the HTTP responses by using the `KEEP_UPSTREAM_HEADERS` setting (default : `Content-Security-Policy Permissions-Policy Feature-Policy X-Frame-Options`). A special value `*` is available to keep all headers. List of headers to keep must be separated with a space. Note that if the header is not present in the upstream response, it will be added by BunkerWeb.
|
||||
|
||||
#### Cookies
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
When it comes to cookies security, we can use the following flags :
|
||||
|
||||
- HttpOnly : disable any access to the cookie from Javascript using document.cookie
|
||||
- SameSite : policy when requests come from third-party websites
|
||||
- Secure : only send cookies on HTTPS request
|
||||
|
||||
Cookie flags can be overridden with values of your choice by using the `COOKIE_FLAGS` setting (default : `* HttpOnly SameSite=Lax`). See [here](https://github.com/AirisX/nginx_cookie_flag_module) for accepted values.
|
||||
|
||||
The Secure flag can be automatically added if HTTPS is used by using the `COOKIE_AUTO_SECURE_FLAG` setting (default : `yes`). The value `no` is not recommended unless you know what you're doing.
|
||||
|
||||
#### Security headers
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Various security headers are available and most of them can be set using BunkerWeb settings. Here is the list of headers, the corresponding setting and default value :
|
||||
|
||||
| Header | Setting | Default |
|
||||
| :-------------------------: | :-------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: |
|
||||
| `Content-Security-Policy` | `CONTENT_SECURITY_POLICY` | `object-src 'none'; frame-src 'self'; child-src 'self'; form-action 'self'; frame-ancestors 'self';` |
|
||||
| `Strict-Transport-Security` | `STRICT_TRANSPORT_SECURITY` | `max-age=31536000` |
|
||||
| `Referrer-Policy` | `REFERRER_POLICY` | `strict-origin-when-cross-origin` |
|
||||
| `Permissions-Policy` | `PERMISSIONS_POLICY` | `accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), web-share=(), xr-spatial-tracking=()` |
|
||||
| `Feature-Policy` | `FEATURE_POLICY` | `accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'none'; encrypted-media 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'none'; 'none'; geolocation 'none'; gyroscope 'none'; layout-animation 'none'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; payment 'none'; picture-in-picture 'none'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'none'; unoptimized-images 'none'; unsized-media 'none'; usb 'none'; screen-wake-lock 'none'; web-share 'none'; xr-spatial-tracking 'none';` |
|
||||
| `X-Frame-Options` | `X_FRAME_OPTIONS` | `SAMEORIGIN` |
|
||||
| `X-Content-Type-Options` | `X_CONTENT_TYPE_OPTIONS` | `nosniff` |
|
||||
| `X-XSS-Protection` | `X_XSS_PROTECTION` | `1; mode=block` |
|
||||
|
||||
#### CORS
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
[Cross-Origin Resource Sharing](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) lets you manage how your service can be contacted from different origins. Please note that you will have to allow the `OPTIONS` HTTP method using the `ALLOWED_METHODS` if you want to enable it (more info [here](#allowed-methods)). Here is the list of settings related to CORS :
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|------------------------|------------------------------------------------------------------------------------|---------|--------|-------------------------------------------------------------------|
|
||||
|`USE_CORS` |`no` |multisite|no |Use CORS |
|
||||
|`CORS_ALLOW_ORIGIN` |`*` |multisite|no |Allowed origins to make CORS requests : PCRE regex or *. |
|
||||
|`CORS_EXPOSE_HEADERS` |`Content-Length,Content-Range` |multisite|no |Value of the Access-Control-Expose-Headers header. |
|
||||
|`CORS_MAX_AGE` |`86400` |multisite|no |Value of the Access-Control-Max-Age header. |
|
||||
|`CORS_ALLOW_CREDENTIALS`|`no` |multisite|no |Send the Access-Control-Allow-Credentials header. |
|
||||
|`CORS_ALLOW_METHODS` |`GET, POST, OPTIONS` |multisite|no |Value of the Access-Control-Allow-Methods header. |
|
||||
|`CORS_ALLOW_HEADERS` |`DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range`|multisite|no |Value of the Access-Control-Allow-Headers header. |
|
||||
|`CORS_DENY_REQUEST` |`yes` |multisite|no |Deny request and don't send it to backend if Origin is not allowed.|
|
||||
|
||||
Here is some examples of possible values for `CORS_ALLOW_ORIGIN` setting :
|
||||
|
||||
- `*` will allow all origin
|
||||
- `^https://www\.example\.com$` will allow `https://www.example.com`
|
||||
- `^https://.+\.example.com$` will allow any origins when domain ends with `.example.com`
|
||||
- `^https://(www\.example1\.com|www\.example2\.com)$` will allow both `https://www.example1.com` and `https://www.example2.com`
|
||||
- `^https?://www\.example\.com$` will allow both `https://www.example.com` and `http://www.example.com`
|
||||
|
||||
## HTTPS / SSL/TLS
|
||||
|
||||
Besides the HTTPS / SSL/TLS configuration, the following settings related to HTTPS / SSL/TLS can be set :
|
||||
|
||||
| Setting | Default | Description |
|
||||
| :---------------------------: | :---------------: | :----------------------------------------------------------------------------------------------------------- |
|
||||
| `REDIRECT_HTTP_TO_HTTPS` | `no` | When set to `yes`, will redirect every HTTP request to HTTPS even if BunkerWeb is not configured with HTTPS. |
|
||||
| `AUTO_REDIRECT_HTTP_TO_HTTPS` | `yes` | When set to `yes`, will redirect every HTTP request to HTTPS only if BunkerWeb is configured with HTTPS. |
|
||||
| `SSL_PROTOCOLS` | `TLSv1.2 TLSv1.3` | List of supported SSL/TLS protocols when SSL is enabled. |
|
||||
| `HTTP2` | `yes` | When set to `yes`, will enable HTTP2 protocol support when using HTTPS. |
|
||||
| `LISTEN_HTTP` | `yes` | When set to `no`, BunkerWeb will not listen for HTTP requests. Useful if you want HTTPS only for example. |
|
||||
|
||||
### Let's Encrypt
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
BunkerWeb comes with automatic Let's Encrypt certificate generation and renewal. This is the easiest way of getting HTTPS / SSL/TLS working out of the box for public-facing web applications. Please note that you will need to set up proper DNS A record(s) for each of your domains pointing to your public IP(s) where BunkerWeb is accessible.
|
||||
|
||||
Here is the list of related settings :
|
||||
|
||||
| Setting | Default | Description |
|
||||
| :------------------------: | :----------------------: | :----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `AUTO_LETS_ENCRYPT` | `no` | When set to `yes`, HTTPS / SSL/TLS will be enabled with automatic certificate generation and renewal from Let's Encrypt. |
|
||||
| `EMAIL_LETS_ENCRYPT` | `contact@{FIRST_SERVER}` | Email to use when generating certificates. Let's Encrypt will send notifications to that email like certificate expiration. |
|
||||
| `USE_LETS_ENCRYPT_STAGING` | `no` | When set to `yes`, the staging server of Let's Encrypt will be used instead of the production one. Useful when doing tests to avoid being "blocked" due to limits. |
|
||||
|
||||
Full Let's Encrypt automation is fully working with stream mode as long as you open the `80/tcp` port from the outside. Please note that you will need to use the `LISTEN_STREAM_PORT_SSL` setting in order to choose your listening SSL/TLS port.
|
||||
|
||||
### Custom certificate
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
If you want to use your own certificates, here is the list of related settings :
|
||||
|
||||
| Setting |Default| Context |Multiple| Description |
|
||||
|-----------------|-------|---------|--------|--------------------------------------------------------------------------------|
|
||||
|`USE_CUSTOM_SSL` |`no` |multisite|no |Use custom HTTPS / SSL/TLS certificate. |
|
||||
|`CUSTOM_SSL_CERT`| |multisite|no |Full path of the certificate or bundle file (must be readable by the scheduler).|
|
||||
|`CUSTOM_SSL_KEY` | |multisite|no |Full path of the key file (must be readable by the scheduler). |
|
||||
|
||||
|
||||
When `USE_CUSTOM_SSL` is set to `yes`, BunkerWeb will check every day if the custom certificate specified in `CUSTOM_SSL_CERT` is modified and will reload NGINX if that's the case.
|
||||
|
||||
When using stream mode, you will need to use the `LISTEN_STREAM_PORT_SSL` setting in order to choose your listening SSL/TLS port.
|
||||
|
||||
### Self-signed
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
If you want to quickly test HTTPS / SSL/TLS for staging/dev environment you can configure BunkerWeb to generate self-signed certificates, here is the list of related settings :
|
||||
|
||||
| Setting | Default | Description |
|
||||
| :------------------------: | :--------------------: | :------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `GENERATE_SELF_SIGNED_SSL` | `no` | When set to `yes`, HTTPS / SSL/TLS will be enabled with automatic self-signed certificate generation and renewal from Let's Encrypt. |
|
||||
| `SELF_SIGNED_SSL_EXPIRY` | `365` | Number of days for the certificate expiration (**-days** value used with **openssl**). |
|
||||
| `SELF_SIGNED_SSL_SUBJ` | `/CN=www.example.com/` | Certificate subject to use (**-subj** value used with **openssl**). |
|
||||
|
||||
When using stream mode, you will need to use the `LISTEN_STREAM_PORT_SSL` setting in order to choose your listening SSL/TLS port.
|
||||
|
||||
## ModSecurity
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
ModSecurity is integrated and enabled by default alongside the OWASP Core Rule Set within BunkerWeb. Here is the list of related settings :
|
||||
|
||||
| Setting | Default | Description |
|
||||
| :-------------------: | :-----: | :---------------------------------------------------------------------------------------------------- |
|
||||
| `USE_MODSECURITY` | `yes` | When set to `yes`, ModSecurity will be enabled. |
|
||||
| `USE_MODSECURITY_CRS` | `yes` | When set to `yes` and `USE_MODSECURITY` is also set to `yes`, the OWASP Core Rule Set will be loaded. |
|
||||
|
||||
We strongly recommend keeping both ModSecurity and the OWASP Core Rule Set enabled. The only downsides are the false positives that may occur. But they can be fixed with some efforts and the CRS team maintains a list of exclusions for common applications (e.g., WordPress, Nextcloud, Drupal, Cpanel, ...).
|
||||
|
||||
Tuning ModSecurity and the CRS can be done using [custom configurations](quickstart-guide.md#custom-configurations) :
|
||||
|
||||
- modsec-crs : before the OWASP Core Rule Set is loaded
|
||||
- modsec : after the OWASP Core Rule Set is loaded (also used if CRS is not loaded)
|
||||
|
||||
For example, you can add a custom configuration with type `modsec-crs` to add CRS exclusions :
|
||||
|
||||
```conf
|
||||
SecAction \
|
||||
"id:900130,\
|
||||
phase:1,\
|
||||
nolog,\
|
||||
pass,\
|
||||
t:none,\
|
||||
setvar:tx.crs_exclusions_wordpress=1"
|
||||
```
|
||||
|
||||
You can also add a custom configuration with type `modsec` to update loaded CRS rules :
|
||||
|
||||
```conf
|
||||
SecRule REQUEST_FILENAME "/wp-admin/admin-ajax.php" "id:1,ctl:ruleRemoveByTag=attack-xss,ctl:ruleRemoveByTag=attack-rce"
|
||||
SecRule REQUEST_FILENAME "/wp-admin/options.php" "id:2,ctl:ruleRemoveByTag=attack-xss"
|
||||
SecRule REQUEST_FILENAME "^/wp-json/yoast" "id:3,ctl:ruleRemoveById=930120"
|
||||
```
|
||||
|
||||
## Bad behavior
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
When attackers search for and/or exploit vulnerabilities they might generate some "suspicious" HTTP status codes that a "regular" user won’t generate within a period of time. If we detect that kind of behavior we can ban the offending IP address and force the attacker to come up with a new one.
|
||||
|
||||
That kind of security measure is implemented and enabled by default in BunkerWeb and is called "Bad behavior". Here is the list of the related settings :
|
||||
|
||||
| Setting | Default | Description |
|
||||
| :-------------------------: | :---------------------------: | :--------------------------------------------------------------------------- |
|
||||
| `USE_BAD_BEHAVIOR` | `yes` | When set to `yes`, the Bad behavior feature will be enabled. |
|
||||
| `BAD_BEHAVIOR_STATUS_CODES` | `400 401 403 404 405 429 444` | List of HTTP status codes considered as "suspicious". |
|
||||
| `BAD_BEHAVIOR_BAN_TIME` | `86400` | The duration time (in seconds) of a ban when a client reached the threshold. |
|
||||
| `BAD_BEHAVIOR_THRESHOLD` | `10` | Maximum number of "suspicious" HTTP status codes within the time period. |
|
||||
| `BAD_BEHAVIOR_COUNT_TIME` | `60` | Period of time during which we count "suspicious" HTTP status codes. |
|
||||
|
||||
In other words, with the default values, if a client generates more than `10` status codes from the list `400 401 403 404 405 429 444` within `60` seconds their IP address will be banned for `86400` seconds.
|
||||
|
||||
When using stream mode, only the `444` status code will count as "bad".
|
||||
|
||||
## Antibot
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Attackers will certainly use automated tools to exploit/find some vulnerabilities in your web applications. One countermeasure is to challenge the users to detect if they look like a bot. If the challenge is solved, we consider the client as "legitimate" and they can access the web application.
|
||||
|
||||
That kind of security is implemented but not enabled by default in BunkerWeb and is called "Antibot". Here is the list of supported challenges :
|
||||
|
||||
- **Cookie** : send a cookie to the client, we expect to get the cookie back on other requests
|
||||
- **Javascript** : force a client to solve a computation challenge using Javascript
|
||||
- **Captcha** : force the client to solve a classical captcha (no external dependencies)
|
||||
- **hCaptcha** : force the client to solve a captcha from hCaptcha
|
||||
- **reCAPTCHA** : force the client to get a minimum score with Google reCAPTCHA
|
||||
- **Turnstile** : enforce rate limiting and access control for APIs and web applications using various mechanisms with Coudflare Turnstile
|
||||
|
||||
Here is the list of related settings :
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|---------------------------|------------|---------|--------|------------------------------------------------------------------------------------------------------------------------------|
|
||||
|`USE_ANTIBOT` |`no` |multisite|no |Activate antibot feature. |
|
||||
|`ANTIBOT_URI` |`/challenge`|multisite|no |Unused URI that clients will be redirected to to solve the challenge. |
|
||||
|`ANTIBOT_RECAPTCHA_SCORE` |`0.7` |multisite|no |Minimum score required for reCAPTCHA challenge. |
|
||||
|`ANTIBOT_RECAPTCHA_SITEKEY`| |multisite|no |Sitekey for reCAPTCHA challenge. |
|
||||
|`ANTIBOT_RECAPTCHA_SECRET` | |multisite|no |Secret for reCAPTCHA challenge. |
|
||||
|`ANTIBOT_HCAPTCHA_SITEKEY` | |multisite|no |Sitekey for hCaptcha challenge. |
|
||||
|`ANTIBOT_HCAPTCHA_SECRET` | |multisite|no |Secret for hCaptcha challenge. |
|
||||
|`ANTIBOT_TURNSTILE_SITEKEY`| |multisite|no |Sitekey for Turnstile challenge. |
|
||||
|`ANTIBOT_TURNSTILE_SECRET` | |multisite|no |Secret for Turnstile challenge. |
|
||||
|`ANTIBOT_TIME_RESOLVE` |`60` |multisite|no |Maximum time (in seconds) clients have to resolve the challenge. Once this time has passed, a new challenge will be generated.|
|
||||
|`ANTIBOT_TIME_VALID` |`86400` |multisite|no |Maximum validity time of solved challenges. Once this time has passed, clients will need to resolve a new one. |
|
||||
|
||||
Please note that antibot feature is using a cookie to maintain a session with clients. If you are using BunkerWeb in a clustered environment, you will need to set the `SESSIONS_SECRET` and `SESSIONS_NAME` settings to another value than the default one (which is `random`). You will find more info about sessions [here](settings.md#sessions).
|
||||
|
||||
## Blacklisting, whitelisting and greylisting
|
||||
|
||||
The blacklisting security feature is very easy to understand : if a specific criteria is met, the client will be banned. As for the whitelisting, it's the exact opposite : if a specific criteria is met, the client will be allowed and no additional security check will be done. Whereas for the greylisting : if a specific criteria is met, the client will be allowed but additional security checks will be done.
|
||||
|
||||
You can configure blacklisting, whitelisting and greylisting at the same time. If that's the case, note that whitelisting is executed before blacklisting and greylisting : even if a criteria is true for all of them, the client will be whitelisted.
|
||||
|
||||
### Blacklisting
|
||||
|
||||
STREAM support :warning:
|
||||
|
||||
You can use the following settings to set up blacklisting :
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|----------------------------------|------------------------------------------------------------------------------------------------------------------------------|---------|--------|------------------------------------------------------------------------------------------------|
|
||||
|`USE_BLACKLIST` |`yes` |multisite|no |Activate blacklist feature. |
|
||||
|`BLACKLIST_IP` | |multisite|no |List of IP/network, separated with spaces, to block. |
|
||||
|`BLACKLIST_IP_URLS` |`https://www.dan.me.uk/torlist/?exit` |global |no |List of URLs, separated with spaces, containing bad IP/network to block. |
|
||||
|`BLACKLIST_RDNS_GLOBAL` |`yes` |multisite|no |Only perform RDNS blacklist checks on global IP addresses. |
|
||||
|`BLACKLIST_RDNS` |`.shodan.io .censys.io` |multisite|no |List of reverse DNS suffixes, separated with spaces, to block. |
|
||||
|`BLACKLIST_RDNS_URLS` | |global |no |List of URLs, separated with spaces, containing reverse DNS suffixes to block. |
|
||||
|`BLACKLIST_ASN` | |multisite|no |List of ASN numbers, separated with spaces, to block. |
|
||||
|`BLACKLIST_ASN_URLS` | |global |no |List of URLs, separated with spaces, containing ASN to block. |
|
||||
|`BLACKLIST_USER_AGENT` | |multisite|no |List of User-Agent (PCRE regex), separated with spaces, to block. |
|
||||
|`BLACKLIST_USER_AGENT_URLS` |`https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-user-agents.list`|global |no |List of URLs, separated with spaces, containing bad User-Agent to block. |
|
||||
|`BLACKLIST_URI` | |multisite|no |List of URI (PCRE regex), separated with spaces, to block. |
|
||||
|`BLACKLIST_URI_URLS` | |global |no |List of URLs, separated with spaces, containing bad URI to block. |
|
||||
|`BLACKLIST_IGNORE_IP` | |multisite|no |List of IP/network, separated with spaces, to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_IP_URLS` | |global |no |List of URLs, separated with spaces, containing IP/network to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_RDNS` | |multisite|no |List of reverse DNS suffixes, separated with spaces, to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_RDNS_URLS` | |global |no |List of URLs, separated with spaces, containing reverse DNS suffixes to ignore in the blacklist.|
|
||||
|`BLACKLIST_IGNORE_ASN` | |multisite|no |List of ASN numbers, separated with spaces, to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_ASN_URLS` | |global |no |List of URLs, separated with spaces, containing ASN to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_USER_AGENT` | |multisite|no |List of User-Agent (PCRE regex), separated with spaces, to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_USER_AGENT_URLS`| |global |no |List of URLs, separated with spaces, containing User-Agent to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_URI` | |multisite|no |List of URI (PCRE regex), separated with spaces, to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_URI_URLS` | |global |no |List of URLs, separated with spaces, containing URI to ignore in the blacklist. |
|
||||
|
||||
When using stream mode, only IP, RDNS and ASN checks will be done.
|
||||
|
||||
### Greylisting
|
||||
|
||||
STREAM support :warning:
|
||||
|
||||
You can use the following settings to set up greylisting :
|
||||
|
||||
| Setting |Default| Context |Multiple| Description |
|
||||
|--------------------------|-------|---------|--------|----------------------------------------------------------------------------------------------|
|
||||
|`USE_GREYLIST` |`no` |multisite|no |Activate greylist feature. |
|
||||
|`GREYLIST_IP` | |multisite|no |List of IP/network, separated with spaces, to put into the greylist. |
|
||||
|`GREYLIST_IP_URLS` | |global |no |List of URLs, separated with spaces, containing good IP/network to put into the greylist. |
|
||||
|`GREYLIST_RDNS_GLOBAL` |`yes` |multisite|no |Only perform RDNS greylist checks on global IP addresses. |
|
||||
|`GREYLIST_RDNS` | |multisite|no |List of reverse DNS suffixes, separated with spaces, to put into the greylist. |
|
||||
|`GREYLIST_RDNS_URLS` | |global |no |List of URLs, separated with spaces, containing reverse DNS suffixes to put into the greylist.|
|
||||
|`GREYLIST_ASN` | |multisite|no |List of ASN numbers, separated with spaces, to put into the greylist. |
|
||||
|`GREYLIST_ASN_URLS` | |global |no |List of URLs, separated with spaces, containing ASN to put into the greylist. |
|
||||
|`GREYLIST_USER_AGENT` | |multisite|no |List of User-Agent (PCRE regex), separated with spaces, to put into the greylist. |
|
||||
|`GREYLIST_USER_AGENT_URLS`| |global |no |List of URLs, separated with spaces, containing good User-Agent to put into the greylist. |
|
||||
|`GREYLIST_URI` | |multisite|no |List of URI (PCRE regex), separated with spaces, to put into the greylist. |
|
||||
|`GREYLIST_URI_URLS` | |global |no |List of URLs, separated with spaces, containing bad URI to put into the greylist. |
|
||||
|
||||
When using stream mode, only IP, RDNS and ASN checks will be done.
|
||||
|
||||
### Whitelisting
|
||||
|
||||
STREAM support :warning:
|
||||
|
||||
You can use the following settings to set up whitelisting :
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|---------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|--------|----------------------------------------------------------------------------------|
|
||||
|`USE_WHITELIST` |`yes` |multisite|no |Activate whitelist feature. |
|
||||
|`WHITELIST_IP` |`20.191.45.212 40.88.21.235 40.76.173.151 40.76.163.7 20.185.79.47 52.142.26.175 20.185.79.15 52.142.24.149 40.76.162.208 40.76.163.23 40.76.162.191 40.76.162.247 54.208.102.37 107.21.1.8`|multisite|no |List of IP/network, separated with spaces, to put into the whitelist. |
|
||||
|`WHITELIST_IP_URLS` | |global |no |List of URLs, separated with spaces, containing good IP/network to whitelist. |
|
||||
|`WHITELIST_RDNS_GLOBAL` |`yes` |multisite|no |Only perform RDNS whitelist checks on global IP addresses. |
|
||||
|`WHITELIST_RDNS` |`.google.com .googlebot.com .yandex.ru .yandex.net .yandex.com .search.msn.com .baidu.com .baidu.jp .crawl.yahoo.net .fwd.linkedin.com .twitter.com .twttr.com .discord.com` |multisite|no |List of reverse DNS suffixes, separated with spaces, to whitelist. |
|
||||
|`WHITELIST_RDNS_URLS` | |global |no |List of URLs, separated with spaces, containing reverse DNS suffixes to whitelist.|
|
||||
|`WHITELIST_ASN` |`32934` |multisite|no |List of ASN numbers, separated with spaces, to whitelist. |
|
||||
|`WHITELIST_ASN_URLS` | |global |no |List of URLs, separated with spaces, containing ASN to whitelist. |
|
||||
|`WHITELIST_USER_AGENT` | |multisite|no |List of User-Agent (PCRE regex), separated with spaces, to whitelist. |
|
||||
|`WHITELIST_USER_AGENT_URLS`| |global |no |List of URLs, separated with spaces, containing good User-Agent to whitelist. |
|
||||
|`WHITELIST_URI` | |multisite|no |List of URI (PCRE regex), separated with spaces, to whitelist. |
|
||||
|`WHITELIST_URI_URLS` | |global |no |List of URLs, separated with spaces, containing bad URI to whitelist. |
|
||||
|
||||
When using stream mode, only IP, RDNS and ASN checks will be done.
|
||||
|
||||
## Reverse scan
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
Reverse scan is a feature designed to detect open ports by establishing TCP connections with clients' IP addresses.
|
||||
Consider adding this feature if you want to detect possible open proxies or connections from servers.
|
||||
|
||||
We provide a list of suspicious ports by default but it can be modified to fit your needs. Be mindful, adding too many ports to the list can significantly slow down clients' connections due to the network checks. If a listed port is open, the client's access will be denied.
|
||||
|
||||
Please be aware, this feature is new and further improvements will be added soon.
|
||||
|
||||
Here is the list of settings related to reverse scan :
|
||||
|
||||
| Setting | Default | Description |
|
||||
| :----------: | :--------------------------------------------------------------------------: | :--------------------------------------------- |
|
||||
| `USE_REVERSE_SCAN` | `no` | When set to `yes`, will enable ReverseScan. |
|
||||
| `REVERSE_SCAN_PORTS` | `22 80 443 3128 8000 8080` | List of suspicious ports to scan. |
|
||||
| `REVERSE_SCAN_TIMEOUT` | `500` | Specify the maximum timeout (in ms) when scanning a port. |
|
||||
|
||||
## BunkerNet
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
BunkerNet is a crowdsourced database of malicious requests shared between all BunkerWeb instances over the world.
|
||||
|
||||
If you enable BunkerNet, malicious requests will be sent to a remote server and will be analyzed by our systems. By doing so, we can extract malicious data from everyone's reports and give back the results to each BunkerWeb instances participating into BunkerNet.
|
||||
|
||||
At the moment, that feature should be considered in "beta". We only extract malicious IP and we are very strict about how we do it to avoid any "poisoning". We strongly recommend activating it (which is the default) because the more instances participate, the more data we have to improve the algorithm.
|
||||
|
||||
The setting used to enable or disable BunkerNet is `USE_BUNKERNET` (default : `yes`).
|
||||
|
||||
## DNSBL
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
DNSBL or "DNS BlackList" is an external list of malicious IPs that you query using the DNS protocol. Automatic querying of that kind of blacklist is supported by BunkerWeb. If a remote DNSBL server of your choice says that the IP address of the client is in the blacklist, it will be banned.
|
||||
|
||||
Here is the list of settings related to DNSBL :
|
||||
|
||||
| Setting | Default | Description |
|
||||
| :----------: | :--------------------------------------------------------------------------: | :--------------------------------------------- |
|
||||
| `USE_DNSBL` | `yes` | When set to `yes`, will enable DNSBL checking. |
|
||||
| `DNSBL_LIST` | `bl.blocklist.de problems.dnsbl.sorbs.net sbl.spamhaus.org xbl.spamhaus.org` | List of DNSBL servers to ask. |
|
||||
|
||||
## Limiting
|
||||
|
||||
BunkerWeb supports applying a limit policy to :
|
||||
|
||||
- Number of connections per IP
|
||||
- Number of requests per IP and URL within a time period
|
||||
|
||||
Please note that it should not be considered as an effective solution against DoS or DDoS but rather as an anti-bruteforce measure or rate limit policy for API.
|
||||
|
||||
In both cases (connections or requests) if the limit is reached, the client will receive the HTTP status "429 - Too Many Requests".
|
||||
|
||||
### Connections
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
The following settings are related to the Limiting connections feature :
|
||||
|
||||
| Setting | Default | Description |
|
||||
| :--------------------: | :-----: | :----------------------------------------------------------------------------------------- |
|
||||
| `USE_LIMIT_CONN` | `yes` | When set to `yes`, will limit the maximum number of concurrent connections for a given IP. |
|
||||
| `LIMIT_CONN_MAX_HTTP1` | `10` | Maximum number of concurrent connections when using HTTP1 protocol. |
|
||||
| `LIMIT_CONN_MAX_HTTP2` | `100` | Maximum number of concurrent streams when using HTTP2 protocol. |
|
||||
| `LIMIT_CONN_MAX_STREAM`| `10` | Maximum number of connections per IP when using stream. |
|
||||
|
||||
### Requests
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
The following settings are related to the Limiting requests feature :
|
||||
|
||||
| Setting |Default| Context |Multiple| Description |
|
||||
|-----------------------|-------|---------|--------|---------------------------------------------------------------------------------------------|
|
||||
|`USE_LIMIT_REQ` |`yes` |multisite|no |Activate limit requests feature. |
|
||||
|`LIMIT_REQ_URL` |`/` |multisite|yes |URL (PCRE regex) where the limit request will be applied or special value / for all requests.|
|
||||
|`LIMIT_REQ_RATE` |`2r/s` |multisite|yes |Rate to apply to the URL (s for second, m for minute, h for hour and d for day). |
|
||||
|`USE_LIMIT_CONN` |`yes` |multisite|no |Activate limit connections feature. |
|
||||
|`LIMIT_CONN_MAX_HTTP1` |`10` |multisite|no |Maximum number of connections per IP when using HTTP/1.X protocol. |
|
||||
|`LIMIT_CONN_MAX_HTTP2` |`100` |multisite|no |Maximum number of streams per IP when using HTTP/2 protocol. |
|
||||
|`LIMIT_CONN_MAX_STREAM`|`10` |multisite|no |Maximum number of connections per IP when using stream. |
|
||||
|
||||
Please note that you can add different rates for different URLs by adding a number as a suffix to the settings for example : `LIMIT_REQ_URL_1=^/url1$`, `LIMIT_REQ_RATE_1=5r/d`, `LIMIT_REQ_URL_2=^/url2/subdir/.*$`, `LIMIT_REQ_RATE_2=1r/m`, ...
|
||||
|
||||
Another important thing to note is that `LIMIT_REQ_URL` values are PCRE regex.
|
||||
|
||||
## Country
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
The country security feature allows you to apply policy based on the country of the IP address of clients :
|
||||
|
||||
- Deny any access if the country is in a blacklist
|
||||
- Only allow access if the country is in a whitelist (other security checks will still be executed)
|
||||
|
||||
Here is the list of related settings :
|
||||
|
||||
| Setting | Default | Description |
|
||||
| :-----------------: | :-----: | :------------------------------------------- |
|
||||
| `BLACKLIST_COUNTRY` | | List of 2 letters country code to blacklist. |
|
||||
| `WHITELIST_COUNTRY` | | List of 2 letters country code to whitelist. |
|
||||
|
||||
Using both country blacklist and whitelist at the same time makes no sense. If you do, please note that only the whitelist will be executed.
|
||||
|
||||
## Authentication
|
||||
|
||||
### Auth basic
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
You can quickly protect sensitive resources like the admin area for example, by requiring HTTP basic authentication. Here is the list of related settings :
|
||||
|
||||
| Setting | Default | Description |
|
||||
| :-----------------------: | :---------------: | :------------------------------------------------------------------------------------------- |
|
||||
| `USE_AUTH_BASIC` | `no` | When set to `yes` HTTP auth basic will be enabled. |
|
||||
| `AUTH_BASIC_LOCATION` | `sitewide` | Location (URL) of the sensitive resource. Use special value `sitewide` to enable everywhere. |
|
||||
| `AUTH_BASIC_USER` | `changeme` | The username required. |
|
||||
| `AUTH_BASIC_PASSWORD` | `changeme` | The password required. |
|
||||
| `AUTH_BASIC_TEXT` | `Restricted area` | Text to display in the auth prompt. |
|
||||
|
||||
### Auth request
|
||||
|
||||
You can deploy complex authentication (e.g. SSO), by using the auth request settings (see [here](https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-subrequest-authentication/) for more information on the feature). Please note that you will find [Authelia](https://www.authelia.com/) and [Authentik](https://goauthentik.io/) examples in the [repository](https://github.com/bunkerity/bunkerweb/tree/v1.5.3/examples).
|
||||
|
||||
**Auth request settings are related to reverse proxy rules.**
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|---------------------------------------|----------------------------------|---------|--------|--------------------------------------------------------------------------------------------------------------------|
|
||||
|`REVERSE_PROXY_AUTH_REQUEST` | |multisite|yes |Enable authentication using an external provider (value of auth_request directive). |
|
||||
|`REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL`| |multisite|yes |Redirect clients to sign-in URL when using REVERSE_PROXY_AUTH_REQUEST (used when auth_request call returned 401). |
|
||||
|`REVERSE_PROXY_AUTH_REQUEST_SET` | |multisite|yes |List of variables to set from the authentication provider, separated with ; (values of auth_request_set directives).|
|
||||
541
docs/settings.md
Normal file
541
docs/settings.md
Normal file
|
|
@ -0,0 +1,541 @@
|
|||
# Settings
|
||||
|
||||
!!! info "Settings generator tool"
|
||||
|
||||
To help you tune BunkerWeb, we have made an easy-to-use settings generator tool available at [config.bunkerweb.io](https://config.bunkerweb.io).
|
||||
|
||||
This section contains the full list of settings supported by BunkerWeb. If you are not yet familiar with BunkerWeb, you should first read the [concepts](concepts.md) section of the documentation. Please follow the instructions for your own [integration](integrations.md) on how to apply the settings.
|
||||
|
||||
As a general rule when multisite mode is enabled, if you want to apply settings with multisite context to a specific server, you will need to add the primary (first) server name as a prefix like `www.example.com_USE_ANTIBOT=captcha` or `myapp.example.com_USE_GZIP=yes` for example.
|
||||
|
||||
When settings are considered as "multiple", it means that you can have multiple groups of settings for the same feature by adding numbers as suffix like `REVERSE_PROXY_URL_1=/subdir`, `REVERSE_PROXY_HOST_1=http://myhost1`, `REVERSE_PROXY_URL_2=/anotherdir`, `REVERSE_PROXY_HOST_2=http://myhost2`, ... for example.
|
||||
|
||||
## Global settings
|
||||
|
||||
|
||||
STREAM support :warning:
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|------------------------------|------------------------------------------------------------------------------------------------------------------------|---------|--------|--------------------------------------------------|
|
||||
|`IS_LOADING` |`no` |global |no |Internal use : set to yes when BW is loading. |
|
||||
|`NGINX_PREFIX` |`/etc/nginx/` |global |no |Where nginx will search for configurations. |
|
||||
|`HTTP_PORT` |`8080` |global |no |HTTP port number which bunkerweb binds to. |
|
||||
|`HTTPS_PORT` |`8443` |global |no |HTTPS port number which bunkerweb binds to. |
|
||||
|`MULTISITE` |`no` |global |no |Multi site activation. |
|
||||
|`SERVER_NAME` |`www.example.com` |multisite|no |List of the virtual hosts served by bunkerweb. |
|
||||
|`WORKER_PROCESSES` |`auto` |global |no |Number of worker processes. |
|
||||
|`WORKER_RLIMIT_NOFILE` |`2048` |global |no |Maximum number of open files for worker processes.|
|
||||
|`WORKER_CONNECTIONS` |`1024` |global |no |Maximum number of connections per worker. |
|
||||
|`LOG_FORMAT` |`$host $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"`|global |no |The format to use for access logs. |
|
||||
|`LOG_LEVEL` |`notice` |global |no |The level to use for error logs. |
|
||||
|`DNS_RESOLVERS` |`127.0.0.11` |global |no |DNS addresses of resolvers to use. |
|
||||
|`DATASTORE_MEMORY_SIZE` |`64m` |global |no |Size of the internal datastore. |
|
||||
|`CACHESTORE_MEMORY_SIZE` |`64m` |global |no |Size of the internal cachestore. |
|
||||
|`CACHESTORE_IPC_MEMORY_SIZE` |`16m` |global |no |Size of the internal cachestore (ipc). |
|
||||
|`CACHESTORE_MISS_MEMORY_SIZE` |`16m` |global |no |Size of the internal cachestore (miss). |
|
||||
|`CACHESTORE_LOCKS_MEMORY_SIZE`|`16m` |global |no |Size of the internal cachestore (locks). |
|
||||
|`USE_API` |`yes` |global |no |Activate the API to control BunkerWeb. |
|
||||
|`API_HTTP_PORT` |`5000` |global |no |Listen port number for the API. |
|
||||
|`API_LISTEN_IP` |`0.0.0.0` |global |no |Listen IP address for the API. |
|
||||
|`API_SERVER_NAME` |`bwapi` |global |no |Server name (virtual host) for the API. |
|
||||
|`API_WHITELIST_IP` |`127.0.0.0/8` |global |no |List of IP/network allowed to contact the API. |
|
||||
|`AUTOCONF_MODE` |`no` |global |no |Enable Autoconf Docker integration. |
|
||||
|`SWARM_MODE` |`no` |global |no |Enable Docker Swarm integration. |
|
||||
|`KUBERNETES_MODE` |`no` |global |no |Enable Kubernetes integration. |
|
||||
|`SERVER_TYPE` |`http` |multisite|no |Server type : http or stream. |
|
||||
|`LISTEN_STREAM` |`yes` |multisite|no |Enable listening for non-ssl (passthrough). |
|
||||
|`LISTEN_STREAM_PORT` |`1337` |multisite|no |Listening port for non-ssl (passthrough). |
|
||||
|`LISTEN_STREAM_PORT_SSL` |`4242` |multisite|no |Listening port for ssl (passthrough). |
|
||||
|`USE_UDP` |`no` |multisite|no |UDP listen instead of TCP (stream). |
|
||||
|`USE_IPV6` |`no` |global |no |Enable IPv6 connectivity. |
|
||||
|
||||
|
||||
## Core settings
|
||||
|
||||
### Antibot
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Bot detection by using a challenge.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|---------------------------|------------|---------|--------|------------------------------------------------------------------------------------------------------------------------------|
|
||||
|`USE_ANTIBOT` |`no` |multisite|no |Activate antibot feature. |
|
||||
|`ANTIBOT_URI` |`/challenge`|multisite|no |Unused URI that clients will be redirected to to solve the challenge. |
|
||||
|`ANTIBOT_RECAPTCHA_SCORE` |`0.7` |multisite|no |Minimum score required for reCAPTCHA challenge. |
|
||||
|`ANTIBOT_RECAPTCHA_SITEKEY`| |multisite|no |Sitekey for reCAPTCHA challenge. |
|
||||
|`ANTIBOT_RECAPTCHA_SECRET` | |multisite|no |Secret for reCAPTCHA challenge. |
|
||||
|`ANTIBOT_HCAPTCHA_SITEKEY` | |multisite|no |Sitekey for hCaptcha challenge. |
|
||||
|`ANTIBOT_HCAPTCHA_SECRET` | |multisite|no |Secret for hCaptcha challenge. |
|
||||
|`ANTIBOT_TURNSTILE_SITEKEY`| |multisite|no |Sitekey for Turnstile challenge. |
|
||||
|`ANTIBOT_TURNSTILE_SECRET` | |multisite|no |Secret for Turnstile challenge. |
|
||||
|`ANTIBOT_TIME_RESOLVE` |`60` |multisite|no |Maximum time (in seconds) clients have to resolve the challenge. Once this time has passed, a new challenge will be generated.|
|
||||
|`ANTIBOT_TIME_VALID` |`86400` |multisite|no |Maximum validity time of solved challenges. Once this time has passed, clients will need to resolve a new one. |
|
||||
|
||||
### Auth basic
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Enforce login before accessing a resource or the whole site using HTTP basic auth method.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|---------------------|-----------------|---------|--------|------------------------------------------------|
|
||||
|`USE_AUTH_BASIC` |`no` |multisite|no |Use HTTP basic auth |
|
||||
|`AUTH_BASIC_LOCATION`|`sitewide` |multisite|no |URL of the protected resource or sitewide value.|
|
||||
|`AUTH_BASIC_USER` |`changeme` |multisite|no |Username |
|
||||
|`AUTH_BASIC_PASSWORD`|`changeme` |multisite|no |Password |
|
||||
|`AUTH_BASIC_TEXT` |`Restricted area`|multisite|no |Text to display |
|
||||
|
||||
### Bad behavior
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
Ban IP generating too much 'bad' HTTP status code in a period of time.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|---------------------------|-----------------------------|---------|--------|--------------------------------------------------------------------------------------------|
|
||||
|`USE_BAD_BEHAVIOR` |`yes` |multisite|no |Activate Bad behavior feature. |
|
||||
|`BAD_BEHAVIOR_STATUS_CODES`|`400 401 403 404 405 429 444`|multisite|no |List of HTTP status codes considered as 'bad'. |
|
||||
|`BAD_BEHAVIOR_BAN_TIME` |`86400` |multisite|no |The duration time (in seconds) of a ban when the corresponding IP has reached the threshold.|
|
||||
|`BAD_BEHAVIOR_THRESHOLD` |`10` |multisite|no |Maximum number of 'bad' HTTP status codes within the period of time before IP is banned. |
|
||||
|`BAD_BEHAVIOR_COUNT_TIME` |`60` |multisite|no |Period of time (in seconds) during which we count 'bad' HTTP status codes. |
|
||||
|
||||
### Blacklist
|
||||
|
||||
STREAM support :warning:
|
||||
|
||||
Deny access based on internal and external IP/network/rDNS/ASN blacklists.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|----------------------------------|------------------------------------------------------------------------------------------------------------------------------|---------|--------|------------------------------------------------------------------------------------------------|
|
||||
|`USE_BLACKLIST` |`yes` |multisite|no |Activate blacklist feature. |
|
||||
|`BLACKLIST_IP` | |multisite|no |List of IP/network, separated with spaces, to block. |
|
||||
|`BLACKLIST_IP_URLS` |`https://www.dan.me.uk/torlist/?exit` |global |no |List of URLs, separated with spaces, containing bad IP/network to block. |
|
||||
|`BLACKLIST_RDNS_GLOBAL` |`yes` |multisite|no |Only perform RDNS blacklist checks on global IP addresses. |
|
||||
|`BLACKLIST_RDNS` |`.shodan.io .censys.io` |multisite|no |List of reverse DNS suffixes, separated with spaces, to block. |
|
||||
|`BLACKLIST_RDNS_URLS` | |global |no |List of URLs, separated with spaces, containing reverse DNS suffixes to block. |
|
||||
|`BLACKLIST_ASN` | |multisite|no |List of ASN numbers, separated with spaces, to block. |
|
||||
|`BLACKLIST_ASN_URLS` | |global |no |List of URLs, separated with spaces, containing ASN to block. |
|
||||
|`BLACKLIST_USER_AGENT` | |multisite|no |List of User-Agent (PCRE regex), separated with spaces, to block. |
|
||||
|`BLACKLIST_USER_AGENT_URLS` |`https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-user-agents.list`|global |no |List of URLs, separated with spaces, containing bad User-Agent to block. |
|
||||
|`BLACKLIST_URI` | |multisite|no |List of URI (PCRE regex), separated with spaces, to block. |
|
||||
|`BLACKLIST_URI_URLS` | |global |no |List of URLs, separated with spaces, containing bad URI to block. |
|
||||
|`BLACKLIST_IGNORE_IP` | |multisite|no |List of IP/network, separated with spaces, to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_IP_URLS` | |global |no |List of URLs, separated with spaces, containing IP/network to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_RDNS` | |multisite|no |List of reverse DNS suffixes, separated with spaces, to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_RDNS_URLS` | |global |no |List of URLs, separated with spaces, containing reverse DNS suffixes to ignore in the blacklist.|
|
||||
|`BLACKLIST_IGNORE_ASN` | |multisite|no |List of ASN numbers, separated with spaces, to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_ASN_URLS` | |global |no |List of URLs, separated with spaces, containing ASN to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_USER_AGENT` | |multisite|no |List of User-Agent (PCRE regex), separated with spaces, to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_USER_AGENT_URLS`| |global |no |List of URLs, separated with spaces, containing User-Agent to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_URI` | |multisite|no |List of URI (PCRE regex), separated with spaces, to ignore in the blacklist. |
|
||||
|`BLACKLIST_IGNORE_URI_URLS` | |global |no |List of URLs, separated with spaces, containing URI to ignore in the blacklist. |
|
||||
|
||||
### Brotli
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Compress HTTP requests with the brotli algorithm.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|-------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|--------|-------------------------------------------------------|
|
||||
|`USE_BROTLI` |`no` |multisite|no |Use brotli |
|
||||
|`BROTLI_TYPES` |`application/atom+xml application/javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype application/x-font-ttf application/x-javascript application/xhtml+xml application/xml font/eot font/opentype font/otf font/truetype image/svg+xml image/vnd.microsoft.icon image/x-icon image/x-win-bitmap text/css text/javascript text/plain text/xml`|multisite|no |List of MIME types that will be compressed with brotli.|
|
||||
|`BROTLI_MIN_LENGTH`|`1000` |multisite|no |Minimum length for brotli compression. |
|
||||
|`BROTLI_COMP_LEVEL`|`6` |multisite|no |The compression level of the brotli algorithm. |
|
||||
|
||||
### BunkerNet
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
Share threat data with other BunkerWeb instances via BunkerNet.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|------------------|--------------------------|---------|--------|-----------------------------|
|
||||
|`USE_BUNKERNET` |`yes` |multisite|no |Activate BunkerNet feature. |
|
||||
|`BUNKERNET_SERVER`|`https://api.bunkerweb.io`|global |no |Address of the BunkerNet API.|
|
||||
|
||||
### CORS
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Cross-Origin Resource Sharing.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|------------------------------|------------------------------------------------------------------------------------|---------|--------|-------------------------------------------------------------------|
|
||||
|`USE_CORS` |`no` |multisite|no |Use CORS |
|
||||
|`CORS_ALLOW_ORIGIN` |`*` |multisite|no |Allowed origins to make CORS requests : PCRE regex or *. |
|
||||
|`CORS_EXPOSE_HEADERS` |`Content-Length,Content-Range` |multisite|no |Value of the Access-Control-Expose-Headers header. |
|
||||
|`CROSS_ORIGIN_OPENER_POLICY` | |multisite|no |Value for the Cross-Origin-Opener-Policy header. |
|
||||
|`CROSS_ORIGIN_EMBEDDER_POLICY`| |multisite|no |Value for the Cross-Origin-Embedder-Policy header. |
|
||||
|`CROSS_ORIGIN_RESOURCE_POLICY`| |multisite|no |Value for the Cross-Origin-Resource-Policy header. |
|
||||
|`CORS_MAX_AGE` |`86400` |multisite|no |Value of the Access-Control-Max-Age header. |
|
||||
|`CORS_ALLOW_CREDENTIALS` |`no` |multisite|no |Send the Access-Control-Allow-Credentials header. |
|
||||
|`CORS_ALLOW_METHODS` |`GET, POST, OPTIONS` |multisite|no |Value of the Access-Control-Allow-Methods header. |
|
||||
|`CORS_ALLOW_HEADERS` |`DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range`|multisite|no |Value of the Access-Control-Allow-Headers header. |
|
||||
|`CORS_DENY_REQUEST` |`yes` |multisite|no |Deny request and don't send it to backend if Origin is not allowed.|
|
||||
|
||||
### Client cache
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Manage caching for clients.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|-------------------------|------------------------------------------------------------|---------|--------|--------------------------------------------------------------------|
|
||||
|`USE_CLIENT_CACHE` |`no` |multisite|no |Tell client to store locally static files. |
|
||||
|`CLIENT_CACHE_EXTENSIONS`|`jpg|jpeg|png|bmp|ico|svg|tif|css|js|otf|ttf|eot|woff|woff2`|global |no |List of file extensions, separated with pipes that should be cached.|
|
||||
|`CLIENT_CACHE_ETAG` |`yes` |multisite|no |Send the HTTP ETag header for static resources. |
|
||||
|`CLIENT_CACHE_CONTROL` |`public, max-age=15552000` |multisite|no |Value of the Cache-Control HTTP header. |
|
||||
|
||||
### Country
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
Deny access based on the country of the client IP.
|
||||
|
||||
| Setting |Default| Context |Multiple| Description |
|
||||
|-------------------|-------|---------|--------|-----------------------------------------------------------------------------|
|
||||
|`BLACKLIST_COUNTRY`| |multisite|no |Deny access if the country of the client is in the list (2 letters code). |
|
||||
|`WHITELIST_COUNTRY`| |multisite|no |Deny access if the country of the client is not in the list (2 letters code).|
|
||||
|
||||
### Custom HTTPS certificate
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
Choose custom certificate for HTTPS.
|
||||
|
||||
| Setting |Default| Context |Multiple| Description |
|
||||
|-----------------|-------|---------|--------|--------------------------------------------------------------------------------|
|
||||
|`USE_CUSTOM_SSL` |`no` |multisite|no |Use custom HTTPS certificate. |
|
||||
|`CUSTOM_SSL_CERT`| |multisite|no |Full path of the certificate or bundle file (must be readable by the scheduler).|
|
||||
|`CUSTOM_SSL_KEY` | |multisite|no |Full path of the key file (must be readable by the scheduler). |
|
||||
|
||||
### DB
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
Integrate easily the Database.
|
||||
|
||||
| Setting | Default |Context|Multiple| Description |
|
||||
|--------------|-----------------------------------------|-------|--------|--------------------------------------------------|
|
||||
|`DATABASE_URI`|`sqlite:////var/lib/bunkerweb/db.sqlite3`|global |no |The database URI, following the sqlalchemy format.|
|
||||
|
||||
### DNSBL
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
Deny access based on external DNSBL servers.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|------------|----------------------------------------------------------------------------|---------|--------|-----------------------|
|
||||
|`USE_DNSBL` |`yes` |multisite|no |Activate DNSBL feature.|
|
||||
|`DNSBL_LIST`|`bl.blocklist.de problems.dnsbl.sorbs.net sbl.spamhaus.org xbl.spamhaus.org`|global |no |List of DNSBL servers. |
|
||||
|
||||
### Errors
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Manage default error pages
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|-------------------------|-------------------------------------------------|---------|--------|------------------------------------------------------------------------------------------------------------------------|
|
||||
|`ERRORS` | |multisite|no |List of HTTP error code and corresponding error pages, separated with spaces (404=/my404.html 403=/errors/403.html ...).|
|
||||
|`INTERCEPTED_ERROR_CODES`|`400 401 403 404 405 413 429 500 501 502 503 504`|multisite|no |List of HTTP error code intercepted by Bunkerweb |
|
||||
|
||||
### Greylist
|
||||
|
||||
STREAM support :warning:
|
||||
|
||||
Allow access while keeping security features based on internal and external IP/network/rDNS/ASN greylists.
|
||||
|
||||
| Setting |Default| Context |Multiple| Description |
|
||||
|--------------------------|-------|---------|--------|----------------------------------------------------------------------------------------------|
|
||||
|`USE_GREYLIST` |`no` |multisite|no |Activate greylist feature. |
|
||||
|`GREYLIST_IP` | |multisite|no |List of IP/network, separated with spaces, to put into the greylist. |
|
||||
|`GREYLIST_IP_URLS` | |global |no |List of URLs, separated with spaces, containing good IP/network to put into the greylist. |
|
||||
|`GREYLIST_RDNS_GLOBAL` |`yes` |multisite|no |Only perform RDNS greylist checks on global IP addresses. |
|
||||
|`GREYLIST_RDNS` | |multisite|no |List of reverse DNS suffixes, separated with spaces, to put into the greylist. |
|
||||
|`GREYLIST_RDNS_URLS` | |global |no |List of URLs, separated with spaces, containing reverse DNS suffixes to put into the greylist.|
|
||||
|`GREYLIST_ASN` | |multisite|no |List of ASN numbers, separated with spaces, to put into the greylist. |
|
||||
|`GREYLIST_ASN_URLS` | |global |no |List of URLs, separated with spaces, containing ASN to put into the greylist. |
|
||||
|`GREYLIST_USER_AGENT` | |multisite|no |List of User-Agent (PCRE regex), separated with spaces, to put into the greylist. |
|
||||
|`GREYLIST_USER_AGENT_URLS`| |global |no |List of URLs, separated with spaces, containing good User-Agent to put into the greylist. |
|
||||
|`GREYLIST_URI` | |multisite|no |List of URI (PCRE regex), separated with spaces, to put into the greylist. |
|
||||
|`GREYLIST_URI_URLS` | |global |no |List of URLs, separated with spaces, containing bad URI to put into the greylist. |
|
||||
|
||||
### Gzip
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Compress HTTP requests with the gzip algorithm.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|-----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|--------|-----------------------------------------------------|
|
||||
|`USE_GZIP` |`no` |multisite|no |Use gzip |
|
||||
|`GZIP_TYPES` |`application/atom+xml application/javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype application/x-font-ttf application/x-javascript application/xhtml+xml application/xml font/eot font/opentype font/otf font/truetype image/svg+xml image/vnd.microsoft.icon image/x-icon image/x-win-bitmap text/css text/javascript text/plain text/xml`|multisite|no |List of MIME types that will be compressed with gzip.|
|
||||
|`GZIP_MIN_LENGTH`|`1000` |multisite|no |Minimum length for gzip compression. |
|
||||
|`GZIP_COMP_LEVEL`|`5` |multisite|no |The compression level of the gzip algorithm. |
|
||||
|
||||
### HTML injection
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Inject custom HTML code before the </body> tag.
|
||||
|
||||
| Setting |Default| Context |Multiple| Description |
|
||||
|-------------|-------|---------|--------|------------------------|
|
||||
|`INJECT_BODY`| |multisite|no |The HTML code to inject.|
|
||||
|
||||
### Headers
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Manage HTTP headers sent to clients.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|-------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|--------|----------------------------------------------------------------------------------------------|
|
||||
|`CUSTOM_HEADER` | |multisite|yes |Custom header to add (HeaderName: HeaderValue). |
|
||||
|`REMOVE_HEADERS` |`Server Expect-CT X-Powered-By X-AspNet-Version X-AspNetMvc-Version` |multisite|no |Headers to remove (Header1 Header2 Header3 ...) |
|
||||
|`KEEP_UPSTREAM_HEADERS` |`Content-Security-Policy Permissions-Policy Feature-Policy X-Frame-Options` |multisite|no |Headers to keep from upstream (Header1 Header2 Header3 ... or * for all). |
|
||||
|`STRICT_TRANSPORT_SECURITY` |`max-age=31536000` |multisite|no |Value for the Strict-Transport-Security header. |
|
||||
|`COOKIE_FLAGS` |`* HttpOnly SameSite=Lax` |multisite|yes |Cookie flags automatically added to all cookies (value accepted for nginx_cookie_flag_module).|
|
||||
|`COOKIE_AUTO_SECURE_FLAG` |`yes` |multisite|no |Automatically add the Secure flag to all cookies. |
|
||||
|`CONTENT_SECURITY_POLICY` |`object-src 'none'; form-action 'self'; frame-ancestors 'self';` |multisite|no |Value for the Content-Security-Policy header. |
|
||||
|`CONTENT_SECURITY_POLICY_REPORT_ONLY`|`no` |multisite|no |Send reports for violations of the Content-Security-Policy header instead of blocking them. |
|
||||
|`REFERRER_POLICY` |`strict-origin-when-cross-origin` |multisite|no |Value for the Referrer-Policy header. |
|
||||
|`PERMISSIONS_POLICY` |`accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), web-share=(), xr-spatial-tracking=()` |multisite|no |Value for the Permissions-Policy header. |
|
||||
|`FEATURE_POLICY` |`accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'none'; encrypted-media 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'none'; geolocation 'none'; gyroscope 'none'; layout-animation 'none'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; payment 'none'; picture-in-picture 'none'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'none'; unoptimized-images 'none'; unsized-media 'none'; usb 'none'; screen-wake-lock 'none'; web-share 'none'; xr-spatial-tracking 'none';`|multisite|no |Value for the Feature-Policy header. |
|
||||
|`X_FRAME_OPTIONS` |`SAMEORIGIN` |multisite|no |Value for the X-Frame-Options header. |
|
||||
|`X_CONTENT_TYPE_OPTIONS` |`nosniff` |multisite|no |Value for the X-Content-Type-Options header. |
|
||||
|`X_XSS_PROTECTION` |`1; mode=block` |multisite|no |Value for the X-XSS-Protection header. |
|
||||
|
||||
### Let's Encrypt
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
Automatic creation, renewal and configuration of Let's Encrypt certificates.
|
||||
|
||||
| Setting |Default| Context |Multiple| Description |
|
||||
|--------------------------|-------|---------|--------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
|`AUTO_LETS_ENCRYPT` |`no` |multisite|no |Activate automatic Let's Encrypt mode. |
|
||||
|`EMAIL_LETS_ENCRYPT` | |multisite|no |Email used for Let's Encrypt notification and in certificate. |
|
||||
|`USE_LETS_ENCRYPT_STAGING`|`no` |multisite|no |Use the staging environment for Let’s Encrypt certificate generation. Useful when you are testing your deployments to avoid being rate limited in the production environment.|
|
||||
|
||||
### Limit
|
||||
|
||||
STREAM support :warning:
|
||||
|
||||
Limit maximum number of requests and connections.
|
||||
|
||||
| Setting |Default| Context |Multiple| Description |
|
||||
|-----------------------|-------|---------|--------|---------------------------------------------------------------------------------------------|
|
||||
|`USE_LIMIT_REQ` |`yes` |multisite|no |Activate limit requests feature. |
|
||||
|`LIMIT_REQ_URL` |`/` |multisite|yes |URL (PCRE regex) where the limit request will be applied or special value / for all requests.|
|
||||
|`LIMIT_REQ_RATE` |`2r/s` |multisite|yes |Rate to apply to the URL (s for second, m for minute, h for hour and d for day). |
|
||||
|`USE_LIMIT_CONN` |`yes` |multisite|no |Activate limit connections feature. |
|
||||
|`LIMIT_CONN_MAX_HTTP1` |`10` |multisite|no |Maximum number of connections per IP when using HTTP/1.X protocol. |
|
||||
|`LIMIT_CONN_MAX_HTTP2` |`100` |multisite|no |Maximum number of streams per IP when using HTTP/2 protocol. |
|
||||
|`LIMIT_CONN_MAX_STREAM`|`10` |multisite|no |Maximum number of connections per IP when using stream. |
|
||||
|
||||
### Miscellaneous
|
||||
|
||||
STREAM support :warning:
|
||||
|
||||
Miscellaneous settings.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|-----------------------------|-----------------------|---------|--------|-----------------------------------------------------------------------------------------------------------------------------|
|
||||
|`DISABLE_DEFAULT_SERVER` |`no` |global |no |Close connection if the request vhost is unknown. |
|
||||
|`REDIRECT_HTTP_TO_HTTPS` |`no` |multisite|no |Redirect all HTTP request to HTTPS. |
|
||||
|`AUTO_REDIRECT_HTTP_TO_HTTPS`|`yes` |multisite|no |Try to detect if HTTPS is used and activate HTTP to HTTPS redirection if that's the case. |
|
||||
|`ALLOWED_METHODS` |`GET|POST|HEAD` |multisite|no |Allowed HTTP and WebDAV methods, separated with pipes to be sent by clients. |
|
||||
|`MAX_CLIENT_SIZE` |`10m` |multisite|no |Maximum body size (0 for infinite). |
|
||||
|`SERVE_FILES` |`yes` |multisite|no |Serve files from the local folder. |
|
||||
|`ROOT_FOLDER` | |multisite|no |Root folder containing files to serve (/var/www/html/{server_name} if unset). |
|
||||
|`SSL_PROTOCOLS` |`TLSv1.2 TLSv1.3` |multisite|no |The supported version of TLS. We recommend the default value TLSv1.2 TLSv1.3 for compatibility reasons. |
|
||||
|`HTTP2` |`yes` |multisite|no |Support HTTP2 protocol when HTTPS is enabled. |
|
||||
|`LISTEN_HTTP` |`yes` |multisite|no |Respond to (insecure) HTTP requests. |
|
||||
|`USE_OPEN_FILE_CACHE` |`no` |multisite|no |Enable open file cache feature |
|
||||
|`OPEN_FILE_CACHE` |`max=1000 inactive=20s`|multisite|no |Open file cache directive |
|
||||
|`OPEN_FILE_CACHE_ERRORS` |`yes` |multisite|no |Enable open file cache for errors |
|
||||
|`OPEN_FILE_CACHE_MIN_USES` |`2` |multisite|no |Enable open file cache minimum uses |
|
||||
|`OPEN_FILE_CACHE_VALID` |`30s` |multisite|no |Open file cache valid time |
|
||||
|`EXTERNAL_PLUGIN_URLS` | |global |no |List of external plugins URLs (direct download to .zip or .tar file) to download and install (URLs are separated with space).|
|
||||
|`DENY_HTTP_STATUS` |`403` |global |no |HTTP status code to send when the request is denied (403 or 444). When using 444, BunkerWeb will close the connection. |
|
||||
|
||||
### ModSecurity
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Management of the ModSecurity WAF.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|---------------------------------|--------------|---------|--------|------------------------------------------|
|
||||
|`USE_MODSECURITY` |`yes` |multisite|no |Enable ModSecurity WAF. |
|
||||
|`USE_MODSECURITY_CRS` |`yes` |multisite|no |Enable OWASP Core Rule Set. |
|
||||
|`MODSECURITY_SEC_AUDIT_ENGINE` |`RelevantOnly`|multisite|no |SecAuditEngine directive of ModSecurity. |
|
||||
|`MODSECURITY_SEC_RULE_ENGINE` |`On` |multisite|no |SecRuleEngine directive of ModSecurity. |
|
||||
|`MODSECURITY_SEC_AUDIT_LOG_PARTS`|`ABCFHZ` |multisite|no |SecAuditLogParts directive of ModSecurity.|
|
||||
|
||||
### PHP
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Manage local or remote PHP-FPM.
|
||||
|
||||
| Setting |Default| Context |Multiple| Description |
|
||||
|-----------------|-------|---------|--------|------------------------------------------------------------|
|
||||
|`REMOTE_PHP` | |multisite|no |Hostname of the remote PHP-FPM instance. |
|
||||
|`REMOTE_PHP_PATH`| |multisite|no |Root folder containing files in the remote PHP-FPM instance.|
|
||||
|`LOCAL_PHP` | |multisite|no |Path to the PHP-FPM socket file. |
|
||||
|`LOCAL_PHP_PATH` | |multisite|no |Root folder containing files in the local PHP-FPM instance. |
|
||||
|
||||
### Real IP
|
||||
|
||||
STREAM support :warning:
|
||||
|
||||
Get real IP of clients when BunkerWeb is behind a reverse proxy / load balancer.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|--------------------|-----------------------------------------|---------|--------|--------------------------------------------------------------------------------------------------------|
|
||||
|`USE_REAL_IP` |`no` |multisite|no |Retrieve the real IP of client. |
|
||||
|`USE_PROXY_PROTOCOL`|`no` |multisite|no |Enable PROXY protocol communication. |
|
||||
|`REAL_IP_FROM` |`192.168.0.0/16 172.16.0.0/12 10.0.0.0/8`|multisite|no |List of trusted IPs / networks, separated with spaces, where proxied requests come from. |
|
||||
|`REAL_IP_FROM_URLS` | |global |no |List of URLs containing trusted IPs / networks, separated with spaces, where proxied requests come from.|
|
||||
|`REAL_IP_HEADER` |`X-Forwarded-For` |multisite|no |HTTP header containing the real IP or special value proxy_protocol for PROXY protocol. |
|
||||
|`REAL_IP_RECURSIVE` |`yes` |multisite|no |Perform a recursive search in the header container IP address. |
|
||||
|
||||
### Redirect
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Manage HTTP redirects.
|
||||
|
||||
| Setting |Default| Context |Multiple| Description |
|
||||
|-------------------------|-------|---------|--------|-------------------------------------------------|
|
||||
|`REDIRECT_TO` | |multisite|no |Redirect a whole site to another one. |
|
||||
|`REDIRECT_TO_REQUEST_URI`|`no` |multisite|no |Append the requested URI to the redirect address.|
|
||||
|`REDIRECT_TO_STATUS_CODE`|`301` |multisite|no |Status code to send to client when redirecting. |
|
||||
|
||||
### Redis
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
Redis server configuration when using BunkerWeb in cluster mode.
|
||||
|
||||
| Setting |Default|Context|Multiple| Description |
|
||||
|----------------------|-------|-------|--------|------------------------------------------------------------------|
|
||||
|`USE_REDIS` |`no` |global |no |Activate Redis. |
|
||||
|`REDIS_HOST` | |global |no |Redis server IP or hostname. |
|
||||
|`REDIS_PORT` |`6379` |global |no |Redis server port. |
|
||||
|`REDIS_DATABASE` |`0` |global |no |Redis database number. |
|
||||
|`REDIS_SSL` |`no` |global |no |Use SSL/TLS connection with Redis server. |
|
||||
|`REDIS_TIMEOUT` |`1000` |global |no |Redis server timeout (in ms) for connect, read and write. |
|
||||
|`REDIS_KEEPALIVE_IDLE`|`30000`|global |no |Max idle time (in ms) before closing redis connection in the pool.|
|
||||
|`REDIS_KEEPALIVE_POOL`|`10` |global |no |Max number of redis connection(s) kept in the pool. |
|
||||
|
||||
### Reverse proxy
|
||||
|
||||
STREAM support :warning:
|
||||
|
||||
Manage reverse proxy configurations.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|---------------------------------------|----------------------------------|---------|--------|-----------------------------------------------------------------------------------------------------------------------------|
|
||||
|`USE_REVERSE_PROXY` |`no` |multisite|no |Activate reverse proxy mode. |
|
||||
|`REVERSE_PROXY_INTERCEPT_ERRORS` |`yes` |multisite|no |Intercept and rewrite errors. |
|
||||
|`REVERSE_PROXY_HOST` | |multisite|yes |Full URL of the proxied resource (proxy_pass). |
|
||||
|`REVERSE_PROXY_URL` | |multisite|yes |Location URL that will be proxied. |
|
||||
|`REVERSE_PROXY_WS` |`no` |multisite|yes |Enable websocket on the proxied resource. |
|
||||
|`REVERSE_PROXY_HEADERS` | |multisite|yes |List of HTTP headers to send to proxied resource separated with semicolons (values for proxy_set_header directive). |
|
||||
|`REVERSE_PROXY_HEADERS_CLIENT` | |multisite|yes |List of HTTP headers to send to client separated with semicolons (values for add_header directive). |
|
||||
|`REVERSE_PROXY_BUFFERING` |`yes` |multisite|yes |Enable or disable buffering of responses from proxied resource. |
|
||||
|`REVERSE_PROXY_KEEPALIVE` |`no` |multisite|yes |Enable or disable keepalive connections with the proxied resource. |
|
||||
|`REVERSE_PROXY_AUTH_REQUEST` | |multisite|yes |Enable authentication using an external provider (value of auth_request directive). |
|
||||
|`REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL`| |multisite|yes |Redirect clients to sign-in URL when using REVERSE_PROXY_AUTH_REQUEST (used when auth_request call returned 401). |
|
||||
|`REVERSE_PROXY_AUTH_REQUEST_SET` | |multisite|yes |List of variables to set from the authentication provider, separated with semicolons (values of auth_request_set directives).|
|
||||
|`USE_PROXY_CACHE` |`no` |multisite|no |Enable or disable caching of the proxied resources. |
|
||||
|`PROXY_CACHE_PATH_LEVELS` |`1:2` |global |no |Hierarchy levels of the cache. |
|
||||
|`PROXY_CACHE_PATH_ZONE_SIZE` |`10m` |global |no |Maximum size of cached metadata when caching proxied resources. |
|
||||
|`PROXY_CACHE_PATH_PARAMS` |`max_size=100m` |global |no |Additional parameters to add to the proxy_cache directive. |
|
||||
|`PROXY_CACHE_METHODS` |`GET HEAD` |multisite|no |HTTP methods that should trigger a cache operation. |
|
||||
|`PROXY_CACHE_MIN_USES` |`2` |multisite|no |The minimum number of requests before a response is cached. |
|
||||
|`PROXY_CACHE_KEY` |`$scheme$host$request_uri` |multisite|no |The key used to uniquely identify a cached response. |
|
||||
|`PROXY_CACHE_VALID` |`200=24h 301=1h 302=24h` |multisite|no |Define the caching time depending on the HTTP status code (list of status=time), separated with spaces. |
|
||||
|`PROXY_NO_CACHE` |`$http_pragma $http_authorization`|multisite|no |Conditions to disable caching of responses. |
|
||||
|`PROXY_CACHE_BYPASS` |`0` |multisite|no |Conditions to bypass caching of responses. |
|
||||
|`REVERSE_PROXY_CONNECT_TIMEOUT` |`60s` |multisite|yes |Timeout when connecting to the proxied resource. |
|
||||
|`REVERSE_PROXY_READ_TIMEOUT` |`60s` |multisite|yes |Timeout when reading from the proxied resource. |
|
||||
|`REVERSE_PROXY_SEND_TIMEOUT` |`60s` |multisite|yes |Timeout when sending to the proxied resource. |
|
||||
|
||||
### Reverse scan
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
Scan clients ports to detect proxies or servers.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|----------------------|--------------------------|---------|--------|------------------------------------------------------------------|
|
||||
|`USE_REVERSE_SCAN` |`no` |multisite|no |Enable scanning of clients ports and deny access if one is opened.|
|
||||
|`REVERSE_SCAN_PORTS` |`22 80 443 3128 8000 8080`|multisite|no |List of port to scan when using reverse scan feature. |
|
||||
|`REVERSE_SCAN_TIMEOUT`|`500` |multisite|no |Specify the maximum timeout (in ms) when scanning a port. |
|
||||
|
||||
### Self-signed certificate
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
Generate self-signed certificate.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|--------------------------|----------------------|---------|--------|-----------------------------------------|
|
||||
|`GENERATE_SELF_SIGNED_SSL`|`no` |multisite|no |Generate and use self-signed certificate.|
|
||||
|`SELF_SIGNED_SSL_EXPIRY` |`365` |multisite|no |Self-signed certificate expiry in days. |
|
||||
|`SELF_SIGNED_SSL_SUBJ` |`/CN=www.example.com/`|multisite|no |Self-signed certificate subject. |
|
||||
|
||||
### Sessions
|
||||
|
||||
STREAM support :white_check_mark:
|
||||
|
||||
Management of session used by other plugins.
|
||||
|
||||
| Setting |Default |Context|Multiple| Description |
|
||||
|---------------------------|--------|-------|--------|---------------------------------------------------------------------------------|
|
||||
|`SESSIONS_SECRET` |`random`|global |no |Secret used to encrypt sessions variables for storing data related to challenges.|
|
||||
|`SESSIONS_NAME` |`random`|global |no |Name of the cookie given to clients. |
|
||||
|`SESSIONS_IDLING_TIMEOUT` |`1800` |global |no |Maximum time (in seconds) of inactivity before the session is invalidated. |
|
||||
|`SESSIONS_ROLLING_TIMEOUT` |`3600` |global |no |Maximum time (in seconds) before a session must be renewed. |
|
||||
|`SESSIONS_ABSOLUTE_TIMEOUT`|`86400` |global |no |Maximum time (in seconds) before a session is destroyed. |
|
||||
|`SESSIONS_CHECK_IP` |`yes` |global |no |Destroy session if IP address is different than original one. |
|
||||
|`SESSIONS_CHECK_USER_AGENT`|`yes` |global |no |Destroy session if User-Agent is different than original one. |
|
||||
|
||||
### UI
|
||||
|
||||
STREAM support :x:
|
||||
|
||||
Integrate easily the BunkerWeb UI.
|
||||
|
||||
|Setting |Default| Context |Multiple|Description|
|
||||
|--------|-------|---------|--------|-----------|
|
||||
|`USE_UI`|`no` |multisite|no |Use UI |
|
||||
|
||||
### Whitelist
|
||||
|
||||
STREAM support :warning:
|
||||
|
||||
Allow access based on internal and external IP/network/rDNS/ASN whitelists.
|
||||
|
||||
| Setting | Default | Context |Multiple| Description |
|
||||
|---------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|--------|----------------------------------------------------------------------------------|
|
||||
|`USE_WHITELIST` |`yes` |multisite|no |Activate whitelist feature. |
|
||||
|`WHITELIST_IP` |`20.191.45.212 40.88.21.235 40.76.173.151 40.76.163.7 20.185.79.47 52.142.26.175 20.185.79.15 52.142.24.149 40.76.162.208 40.76.163.23 40.76.162.191 40.76.162.247` |multisite|no |List of IP/network, separated with spaces, to put into the whitelist. |
|
||||
|`WHITELIST_IP_URLS` | |global |no |List of URLs, separated with spaces, containing good IP/network to whitelist. |
|
||||
|`WHITELIST_RDNS_GLOBAL` |`yes` |multisite|no |Only perform RDNS whitelist checks on global IP addresses. |
|
||||
|`WHITELIST_RDNS` |`.google.com .googlebot.com .yandex.ru .yandex.net .yandex.com .search.msn.com .baidu.com .baidu.jp .crawl.yahoo.net .fwd.linkedin.com .twitter.com .twttr.com .discord.com`|multisite|no |List of reverse DNS suffixes, separated with spaces, to whitelist. |
|
||||
|`WHITELIST_RDNS_URLS` | |global |no |List of URLs, separated with spaces, containing reverse DNS suffixes to whitelist.|
|
||||
|`WHITELIST_ASN` |`32934` |multisite|no |List of ASN numbers, separated with spaces, to whitelist. |
|
||||
|`WHITELIST_ASN_URLS` | |global |no |List of URLs, separated with spaces, containing ASN to whitelist. |
|
||||
|`WHITELIST_USER_AGENT` | |multisite|no |List of User-Agent (PCRE regex), separated with spaces, to whitelist. |
|
||||
|`WHITELIST_USER_AGENT_URLS`| |global |no |List of URLs, separated with spaces, containing good User-Agent to whitelist. |
|
||||
|`WHITELIST_URI` | |multisite|no |List of URI (PCRE regex), separated with spaces, to whitelist. |
|
||||
|`WHITELIST_URI_URLS` | |global |no |List of URLs, separated with spaces, containing bad URI to whitelist. |
|
||||
287
docs/troubleshooting.md
Normal file
287
docs/troubleshooting.md
Normal file
|
|
@ -0,0 +1,287 @@
|
|||
# Troubleshooting
|
||||
|
||||
## Logs
|
||||
|
||||
When troubleshooting, logs are your best friends. We try our best to provide user-friendly logs to help you understand what's happening.
|
||||
|
||||
Please note that you can set `LOG_LEVEL` setting to `info` (default : `notice`) to increase the verbosity of BunkerWeb.
|
||||
|
||||
Here is how you can access the logs, depending on your integration :
|
||||
|
||||
=== "Docker"
|
||||
|
||||
!!! tip "List containers"
|
||||
To list the running containers, you can use the following command :
|
||||
```shell
|
||||
docker ps
|
||||
```
|
||||
|
||||
You can use the `docker logs` command (replace `mybunker` with the name of your container) :
|
||||
```shell
|
||||
docker logs mybunker
|
||||
```
|
||||
|
||||
Here is the docker-compose equivalent (replace `mybunker` with the name of the services declared in the docker-compose.yml file) :
|
||||
```shell
|
||||
docker-compose logs mybunker
|
||||
```
|
||||
|
||||
=== "Docker autoconf"
|
||||
|
||||
!!! tip "List containers"
|
||||
To list the running containers, you can use the following command :
|
||||
```shell
|
||||
docker ps
|
||||
```
|
||||
|
||||
You can use the `docker logs` command (replace `mybunker` and `myautoconf` with the name of your containers) :
|
||||
```shell
|
||||
docker logs mybunker
|
||||
docker logs myautoconf
|
||||
```
|
||||
|
||||
Here is the docker-compose equivalent (replace `mybunker` and `myautoconf` with the name of the services declared in the docker-compose.yml file) :
|
||||
```shell
|
||||
docker-compose logs mybunker
|
||||
docker-compose logs myautoconf
|
||||
```
|
||||
|
||||
=== "Swarm"
|
||||
|
||||
!!! tip "List services"
|
||||
To list the services, you can use the following command :
|
||||
```shell
|
||||
docker service ls
|
||||
```
|
||||
|
||||
You can use the `docker service logs` command (replace `mybunker` and `myautoconf` with the name of your services) :
|
||||
```shell
|
||||
docker service logs mybunker
|
||||
docker service logs myautoconf
|
||||
```
|
||||
|
||||
=== "Kubernetes"
|
||||
|
||||
!!! tip "List pods"
|
||||
To list the pods, you can use the following command :
|
||||
```shell
|
||||
kubectl get pods
|
||||
```
|
||||
You can use the `kubectl logs` command (replace `mybunker` and `myautoconf` with the name of your pods) :
|
||||
```shell
|
||||
kubectl logs mybunker
|
||||
kubectl logs myautoconf
|
||||
```
|
||||
|
||||
=== "Linux"
|
||||
|
||||
For errors related to BunkerWeb services (e.g. not starting), you can use `journalctl` :
|
||||
```shell
|
||||
journalctl -u bunkerweb --no-pager
|
||||
```
|
||||
|
||||
Common logs are located inside the `/var/log/bunkerweb` directory :
|
||||
```shell
|
||||
cat /var/log/bunkerweb/error.log
|
||||
cat /var/log/bunkerweb/access.log
|
||||
```
|
||||
|
||||
=== "Ansible"
|
||||
|
||||
For errors related to BunkerWeb services (e.g. not starting), you can use `journalctl` :
|
||||
```shell
|
||||
ansible -i inventory.yml all -a "journalctl -u bunkerweb --no-pager" --become
|
||||
```
|
||||
|
||||
Common logs are located inside the `/var/log/bunkerweb` directory :
|
||||
```shell
|
||||
ansible -i inventory.yml all -a "cat /var/log/bunkerweb/error.log" --become
|
||||
ansible -i inventory.yml all -a "cat /var/log/bunkerweb/access.log" --become
|
||||
```
|
||||
|
||||
=== "Vagrant"
|
||||
|
||||
For errors related to BunkerWeb services (e.g. not starting), you can use `journalctl` :
|
||||
```shell
|
||||
journalctl -u bunkerweb --no-pager
|
||||
```
|
||||
|
||||
Common logs are located inside the `/var/log/bunkerweb` directory :
|
||||
```shell
|
||||
cat /var/log/bunkerweb/error.log
|
||||
cat /var/log/bunkerweb/access.log
|
||||
```
|
||||
|
||||
## Permissions
|
||||
|
||||
Don't forget that BunkerWeb runs as an unprivileged user for obvious security reasons. Double-check the permissions of files and folders used by BunkerWeb, especially if you use custom configurations (more info [here](quickstart-guide.md#custom-configurations)). You will need to set at least **RW** rights on files and **_RWX_** on folders.
|
||||
|
||||
## ModSecurity
|
||||
|
||||
The default BunkerWeb configuration of ModSecurity is to load the Core Rule Set in anomaly scoring mode with a paranoia level (PL) of 1 :
|
||||
|
||||
- Each matched rule will increase an anomaly score (so many rules can match a single request)
|
||||
- PL1 includes rules with fewer chances of false positives (but less security than PL4)
|
||||
- the default threshold for anomaly score is 5 for requests and 4 for responses
|
||||
|
||||
Let's take the following logs as an example of ModSecurity detection using default configuration (formatted for better readability) :
|
||||
|
||||
```log
|
||||
2022/04/26 12:01:10 [warn] 85#85: *11 ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `lfi-os-files.data' against variable `ARGS:id' (Value: `/etc/passwd' )
|
||||
[file "/usr/share/bunkerweb/core/modsecurity/files/coreruleset/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"]
|
||||
[line "78"]
|
||||
[id "930120"]
|
||||
[rev ""]
|
||||
[msg "OS File Access Attempt"]
|
||||
[data "Matched Data: etc/passwd found within ARGS:id: /etc/passwd"]
|
||||
[severity "2"]
|
||||
[ver "OWASP_CRS/3.3.2"]
|
||||
[maturity "0"]
|
||||
[accuracy "0"]
|
||||
[tag "application-multi"]
|
||||
[tag "language-multi"]
|
||||
[tag "platform-multi"]
|
||||
[tag "attack-lfi"]
|
||||
[tag "paranoia-level/1"]
|
||||
[tag "OWASP_CRS"]
|
||||
[tag "capec/1000/255/153/126"]
|
||||
[tag "PCI/6.5.4"]
|
||||
[hostname "172.17.0.2"]
|
||||
[uri "/"]
|
||||
[unique_id "165097447014.179282"]
|
||||
[ref "o1,10v9,11t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,t:lowercase"],
|
||||
client: 172.17.0.1, server: localhost, request: "GET /?id=/etc/passwd HTTP/1.1", host: "localhost"
|
||||
2022/04/26 12:01:10 [warn] 85#85: *11 ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `unix-shell.data' against variable `ARGS:id' (Value: `/etc/passwd' )
|
||||
[file "/usr/share/bunkerweb/core/modsecurity/files/coreruleset/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"]
|
||||
[line "480"]
|
||||
[id "932160"]
|
||||
[rev ""]
|
||||
[msg "Remote Command Execution: Unix Shell Code Found"]
|
||||
[data "Matched Data: etc/passwd found within ARGS:id: /etc/passwd"]
|
||||
[severity "2"]
|
||||
[ver "OWASP_CRS/3.3.2"]
|
||||
[maturity "0"]
|
||||
[accuracy "0"]
|
||||
[tag "application-multi"]
|
||||
[tag "language-shell"]
|
||||
[tag "platform-unix"]
|
||||
[tag "attack-rce"]
|
||||
[tag "paranoia-level/1"]
|
||||
[tag "OWASP_CRS"]
|
||||
[tag "capec/1000/152/248/88"]
|
||||
[tag "PCI/6.5.2"]
|
||||
[hostname "172.17.0.2"]
|
||||
[uri "/"]
|
||||
[unique_id "165097447014.179282"]
|
||||
[ref "o1,10v9,11t:urlDecodeUni,t:cmdLine,t:normalizePath,t:lowercase"],
|
||||
client: 172.17.0.1, server: localhost, request: "GET /?id=/etc/passwd HTTP/1.1", host: "localhost"
|
||||
2022/04/26 12:01:10 [error] 85#85: *11 [client 172.17.0.1] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `10' )
|
||||
[file "/usr/share/bunkerweb/core/modsecurity/files/coreruleset/rules/REQUEST-949-BLOCKING-EVALUATION.conf"]
|
||||
[line "80"]
|
||||
[id "949110"]
|
||||
[rev ""]
|
||||
[msg "Inbound Anomaly Score Exceeded (Total Score: 10)"]
|
||||
[data ""]
|
||||
[severity "2"]
|
||||
[ver "OWASP_CRS/3.3.2"]
|
||||
[maturity "0"]
|
||||
[accuracy "0"]
|
||||
[tag "application-multi"]
|
||||
[tag "language-multi"]
|
||||
[tag "platform-multi"]
|
||||
[tag "attack-generic"]
|
||||
[hostname "172.17.0.2"]
|
||||
[uri "/"]
|
||||
[unique_id "165097447014.179282"]
|
||||
[ref ""],
|
||||
client: 172.17.0.1, server: localhost, request: "GET /?id=/etc/passwd HTTP/1.1", host: "localhost"
|
||||
```
|
||||
|
||||
As we can see, there are 3 different logs :
|
||||
|
||||
1. Rule **930120** matched
|
||||
2. Rule **932160** matched
|
||||
3. Access denied (rule **949110**)
|
||||
|
||||
One important thing to understand is that rule **949110** is not a "real" one : it's the one that will deny the request because the anomaly threshold is reached (which is **10** in this example). You should never remove the **949110** rule !
|
||||
|
||||
If it's a false-positive, you should then focus on both **930120** and **932160** rules. ModSecurity and/or CRS tuning is out of the scope of this documentation but don't forget that you can apply custom configurations before and after the CRS is loaded (more info [here](quickstart-guide.md#custom-configurations)).
|
||||
|
||||
## Bad Behavior
|
||||
|
||||
A common false-positive case is when the client is banned because of the "bad behavior" feature which means that too many suspicious HTTP status codes were generated within a time period (more info [here](security-tuning.md#bad-behavior)). You should start by reviewing the settings and then edit them according to your web application(s) like removing a suspicious HTTP code, decreasing the count time, increasing the threshold, ...
|
||||
|
||||
## IP unban
|
||||
|
||||
You can manually unban an IP which can be useful when doing some tests but it needs the setting `USE_API` set to `yes` (which is not the default) so you can contact the internal API of BunkerWeb (replace `1.2.3.4` with the IP address to unban) :
|
||||
|
||||
=== "Docker"
|
||||
|
||||
You can use the `docker exec` command (replace `mybunker` with the name of your container) :
|
||||
```shell
|
||||
docker exec mybunker bwcli unban 1.2.3.4
|
||||
```
|
||||
|
||||
Here is the docker-compose equivalent (replace `mybunker` with the name of the services declared in the docker-compose.yml file) :
|
||||
```shell
|
||||
docker-compose exec mybunker bwcli unban 1.2.3.4
|
||||
```
|
||||
|
||||
=== "Docker autoconf"
|
||||
|
||||
You can use the `docker exec` command (replace `myautoconf` with the name of your container) :
|
||||
```shell
|
||||
docker exec myautoconf bwcli unban 1.2.3.4
|
||||
```
|
||||
|
||||
Here is the docker-compose equivalent (replace `myautoconf` with the name of the services declared in the docker-compose.yml file) :
|
||||
```shell
|
||||
docker-compose exec myautoconf bwcli unban 1.2.3.4
|
||||
```
|
||||
|
||||
=== "Swarm"
|
||||
|
||||
You can use the `docker exec` command (replace `myautoconf` with the name of your service) :
|
||||
```shell
|
||||
docker exec $(docker ps -q -f name=myautoconf) bwcli unban 1.2.3.4
|
||||
```
|
||||
|
||||
=== "Kubernetes"
|
||||
|
||||
You can use the `kubectl exec` command (replace `myautoconf` with the name of your pod) :
|
||||
```shell
|
||||
kubectl exec myautoconf bwcli unban 1.2.3.4
|
||||
```
|
||||
|
||||
=== "Linux"
|
||||
|
||||
You can use the `bwcli` command (as root) :
|
||||
```shell
|
||||
sudo bwcli unban 1.2.3.4
|
||||
```
|
||||
|
||||
=== "Ansible"
|
||||
|
||||
You can use the `bwcli` command :
|
||||
```shell
|
||||
ansible -i inventory.yml all -a "bwcli unban 1.2.3.4" --become
|
||||
```
|
||||
|
||||
=== "Vagrant"
|
||||
|
||||
You can use the `bwcli` command (as root) :
|
||||
```shell
|
||||
sudo bwcli unban 1.2.3.4
|
||||
```
|
||||
|
||||
## Whitelisting
|
||||
|
||||
If you have bots that need to access your website, the recommended way to avoid any false positive is to whitelist them using the [whitelisting feature](security-tuning.md#blacklisting-and-whitelisting). We don't recommend using the `WHITELIST_URI*` or `WHITELIST_USER_AGENT*` settings unless they are set to secret and unpredictable values. Common use cases are :
|
||||
|
||||
- Healthcheck / status bot
|
||||
- Callback like IPN or webhook
|
||||
- Social media crawler
|
||||
|
||||
## Timezone
|
||||
|
||||
When using container-based integrations, the timezone of the container may not match the one of the host machine. To resolve that, you can set the `TZ` environment variable to the timezone of your choice on your containers (e.g. `TZ=Europe/Paris`). You will find the list of timezone identifiers [here](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List).
|
||||
950
docs/web-ui.md
Normal file
950
docs/web-ui.md
Normal file
|
|
@ -0,0 +1,950 @@
|
|||
# Web UI
|
||||
|
||||
## Overview
|
||||
|
||||
<p align="center">
|
||||
<iframe style="display: block;" width="560" height="315" src="https://www.youtube-nocookie.com/embed/Ao20SfvQyr4" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
|
||||
</p>
|
||||
|
||||
The "Web UI" is a web application that helps you manage your BunkerWeb instance using a user-friendly interface instead of the command-line one.
|
||||
|
||||
## Features
|
||||
|
||||
- Start, stop, restart and reload your BunkerWeb instance
|
||||
- Add, edit and delete settings for your web applications
|
||||
- Add, edit and delete custom configurations for NGINX and ModSecurity
|
||||
- Install and uninstall external plugins
|
||||
- Explore the cached files
|
||||
- Monitor jobs execution
|
||||
- View the logs and search pattern
|
||||
|
||||
## Installation
|
||||
|
||||
Because the web UI is a web application, the recommended installation procedure is to use BunkerWeb in front of it as a reverse proxy.
|
||||
|
||||
!!! warning "Security considerations"
|
||||
|
||||
The security of the web UI is really important. If someone manages to gain access to the application, not only he will be able to edit your configurations but he could execute some code in the context of BunkerWeb (with a custom configuration containing LUA code for example). We highly recommend you to follow minimal security best practices like :
|
||||
|
||||
* Choose a strong password for the login (**at least 8 chars with 1 lower case letter, 1 upper case letter, 1 digit and 1 special char is required**)
|
||||
* Put the web UI under a "hard to guess" URI
|
||||
* Do not open the web UI on the Internet without any further restrictions
|
||||
* Apply settings listed in the [security tuning section](security-tuning.md) of the documentation
|
||||
|
||||
!!! info "Multisite mode"
|
||||
|
||||
The usage of the web UI implies enabling the [multisite mode](concepts.md#multisite-mode).
|
||||
|
||||
=== "Docker"
|
||||
|
||||
The web UI can be deployed using a dedicated container which is available on [Docker Hub](https://hub.docker.com/r/bunkerity/bunkerweb-ui) :
|
||||
|
||||
```shell
|
||||
docker pull bunkerity/bunkerweb-ui
|
||||
```
|
||||
|
||||
Alternatively, you can also build it yourself :
|
||||
|
||||
```shell
|
||||
git clone https://github.com/bunkerity/bunkerweb.git && \
|
||||
cd bunkerweb && \
|
||||
docker build -t my-bunkerweb-ui -f src/ui/Dockerfile .
|
||||
```
|
||||
|
||||
The following environment variables are used to configure the web UI container :
|
||||
|
||||
- `ADMIN_USERNAME` : username to access the web UI
|
||||
- `ADMIN_PASSWORD` : password to access the web UI
|
||||
|
||||
Accessing the web UI through BunkerWeb is a classical [reverse proxy setup](quickstart-guide.md#protect-http-applications). We recommend you to connect BunkerWeb and web UI using a dedicated network (like `bw-universe` also used by the scheduler) so it won't be on the same network of your web services for obvious security reasons. Please note that the web UI container is listening on the `7000` port.
|
||||
|
||||
!!! info "Database backend"
|
||||
|
||||
If you want another Database backend than MariaDB please refer to the docker-compose files in the [misc/integrations folder](https://github.com/bunkerity/bunkerweb/tree/v1.5.3/misc/integrations) of the repository.
|
||||
|
||||
Here is the docker-compose boilerplate that you can use (don't forget to edit the `changeme` data) :
|
||||
|
||||
```yaml
|
||||
version: "3.5"
|
||||
|
||||
services:
|
||||
bunkerweb:
|
||||
image: bunkerity/bunkerweb:1.5.3
|
||||
ports:
|
||||
- 80:8080
|
||||
- 443:8443
|
||||
labels:
|
||||
- "bunkerweb.INSTANCE=yes"
|
||||
environment:
|
||||
- SERVER_NAME=www.example.com
|
||||
- MULTISITE=yes
|
||||
- DATABASE_URI=mariadb+pymysql://bunkerweb:changeme@bw-db:3306/db # Remember to set a stronger password for the database
|
||||
- API_WHITELIST_IP=127.0.0.0/8 10.20.30.0/24
|
||||
- DISABLE_DEFAULT_SERVER=yes
|
||||
- USE_CLIENT_CACHE=yes
|
||||
- USE_GZIP=yes
|
||||
- www.example.com_USE_UI=yes
|
||||
- www.example.com_USE_REVERSE_PROXY=yes
|
||||
- www.example.com_REVERSE_PROXY_URL=/changeme
|
||||
- www.example.com_REVERSE_PROXY_HOST=http://bw-ui:7000
|
||||
- www.example.com_INTERCEPTED_ERROR_CODES=400 404 405 413 429 500 501 502 503 504
|
||||
networks:
|
||||
- bw-universe
|
||||
- bw-services
|
||||
|
||||
bw-scheduler:
|
||||
image: bunkerity/bunkerweb-scheduler:1.5.3
|
||||
depends_on:
|
||||
- bunkerweb
|
||||
- bw-docker
|
||||
environment:
|
||||
- DATABASE_URI=mariadb+pymysql://bunkerweb:changeme@bw-db:3306/db # Remember to set a stronger password for the database
|
||||
- DOCKER_HOST=tcp://bw-docker:2375
|
||||
networks:
|
||||
- bw-universe
|
||||
- bw-docker
|
||||
|
||||
bw-docker:
|
||||
image: tecnativa/docker-socket-proxy:nightly
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
environment:
|
||||
- CONTAINERS=1
|
||||
- LOG_LEVEL=warning
|
||||
networks:
|
||||
- bw-docker
|
||||
|
||||
bw-ui:
|
||||
image: bunkerity/bunkerweb-ui:1.5.3
|
||||
depends_on:
|
||||
- bw-docker
|
||||
environment:
|
||||
- DATABASE_URI=mariadb+pymysql://bunkerweb:changeme@bw-db:3306/db # Remember to set a stronger password for the database
|
||||
- DOCKER_HOST=tcp://bw-docker:2375
|
||||
- ADMIN_USERNAME=changeme
|
||||
- ADMIN_PASSWORD=changeme # Remember to set a stronger password for the changeme user
|
||||
networks:
|
||||
- bw-universe
|
||||
- bw-docker
|
||||
|
||||
bw-db:
|
||||
image: mariadb:10.10
|
||||
environment:
|
||||
- MYSQL_RANDOM_ROOT_PASSWORD=yes
|
||||
- MYSQL_DATABASE=db
|
||||
- MYSQL_USER=bunkerweb
|
||||
- MYSQL_PASSWORD=changeme # Remember to set a stronger password for the database
|
||||
volumes:
|
||||
- bw-data:/var/lib/mysql
|
||||
networks:
|
||||
- bw-docker
|
||||
|
||||
volumes:
|
||||
bw-data:
|
||||
|
||||
networks:
|
||||
bw-universe:
|
||||
name: bw-universe
|
||||
ipam:
|
||||
driver: default
|
||||
config:
|
||||
- subnet: 10.20.30.0/24
|
||||
bw-services:
|
||||
name: bw-services
|
||||
bw-docker:
|
||||
name: bw-docker
|
||||
```
|
||||
|
||||
=== "Docker autoconf"
|
||||
|
||||
The web UI can be deployed using a dedicated container which is available on [Docker Hub](https://hub.docker.com/r/bunkerity/bunkerweb-ui) :
|
||||
|
||||
```shell
|
||||
docker pull bunkerity/bunkerweb-ui
|
||||
```
|
||||
|
||||
Alternatively, you can also build it yourself :
|
||||
|
||||
```shell
|
||||
git clone https://github.com/bunkerity/bunkerweb.git && \
|
||||
cd bunkerweb && \
|
||||
docker build -t my-bunkerweb-ui -f src/ui/Dockerfile .
|
||||
```
|
||||
|
||||
The following environment variables are used to configure the web UI container :
|
||||
|
||||
- `ADMIN_USERNAME` : username to access the web UI
|
||||
- `ADMIN_PASSWORD` : password to access the web UI
|
||||
|
||||
Accessing the web UI through BunkerWeb is a classical [reverse proxy setup](quickstart-guide.md#protect-http-applications). We recommend you to connect BunkerWeb and web UI using a dedicated network (like `bw-universe` also used by the scheduler and autoconf) so it won't be on the same network of your web services for obvious security reasons. Please note that the web UI container is listening on the `7000` port.
|
||||
|
||||
!!! info "Database backend"
|
||||
|
||||
If you want another Database backend than MariaDB please refer to the docker-compose files in the [misc/integrations folder](https://github.com/bunkerity/bunkerweb/tree/v1.5.3/misc/integrations) of the repository.
|
||||
|
||||
Here is the docker-compose boilerplate that you can use (don't forget to edit the `changeme` data) :
|
||||
|
||||
```yaml
|
||||
version: "3.5"
|
||||
|
||||
services:
|
||||
bunkerweb:
|
||||
image: bunkerity/bunkerweb:1.5.3
|
||||
ports:
|
||||
- 80:8080
|
||||
- 443:8443
|
||||
labels:
|
||||
- "bunkerweb.INSTANCE=yes"
|
||||
environment:
|
||||
- SERVER_NAME=
|
||||
- DATABASE_URI=mariadb+pymysql://bunkerweb:changeme@bw-db:3306/db
|
||||
- AUTOCONF_MODE=yes
|
||||
- MULTISITE=yes
|
||||
- API_WHITELIST_IP=127.0.0.0/8 10.20.30.0/24
|
||||
networks:
|
||||
- bw-universe
|
||||
- bw-services
|
||||
|
||||
bw-autoconf:
|
||||
image: bunkerity/bunkerweb-autoconf:1.5.3
|
||||
depends_on:
|
||||
- bunkerweb
|
||||
- bw-docker
|
||||
environment:
|
||||
- DATABASE_URI=mariadb+pymysql://bunkerweb:changeme@bw-db:3306/db
|
||||
- AUTOCONF_MODE=yes
|
||||
- DOCKER_HOST=tcp://bw-docker:2375
|
||||
networks:
|
||||
- bw-universe
|
||||
- bw-docker
|
||||
|
||||
bw-scheduler:
|
||||
image: bunkerity/bunkerweb-scheduler:1.5.3
|
||||
depends_on:
|
||||
- bunkerweb
|
||||
- bw-docker
|
||||
environment:
|
||||
- DATABASE_URI=mariadb+pymysql://bunkerweb:changeme@bw-db:3306/db
|
||||
- DOCKER_HOST=tcp://bw-docker:2375
|
||||
- AUTOCONF_MODE=yes
|
||||
networks:
|
||||
- bw-universe
|
||||
- bw-docker
|
||||
|
||||
bw-docker:
|
||||
image: tecnativa/docker-socket-proxy:nightly
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
environment:
|
||||
- CONTAINERS=1
|
||||
- LOG_LEVEL=warning
|
||||
networks:
|
||||
- bw-docker
|
||||
|
||||
bw-db:
|
||||
image: mariadb:10.10
|
||||
environment:
|
||||
- MYSQL_RANDOM_ROOT_PASSWORD=yes
|
||||
- MYSQL_DATABASE=db
|
||||
- MYSQL_USER=bunkerweb
|
||||
- MYSQL_PASSWORD=changeme
|
||||
volumes:
|
||||
- bw-data:/var/lib/mysql
|
||||
networks:
|
||||
- bw-docker
|
||||
|
||||
bw-ui:
|
||||
image: bunkerity/bunkerweb-ui:1.5.3
|
||||
networks:
|
||||
bw-docker:
|
||||
bw-universe:
|
||||
aliases:
|
||||
- bw-ui
|
||||
environment:
|
||||
- DATABASE_URI=mariadb+pymysql://bunkerweb:changeme@bw-db:3306/db
|
||||
- DOCKER_HOST=tcp://bw-docker:2375
|
||||
- AUTOCONF_MODE=yes
|
||||
- ADMIN_USERNAME=admin
|
||||
- ADMIN_PASSWORD=changeme
|
||||
labels:
|
||||
- "bunkerweb.SERVER_NAME=www.example.com"
|
||||
- "bunkerweb.USE_UI=yes"
|
||||
- "bunkerweb.USE_REVERSE_PROXY=yes"
|
||||
- "bunkerweb.REVERSE_PROXY_URL=/changeme"
|
||||
- "bunkerweb.REVERSE_PROXY_HOST=http://bw-ui:7000"
|
||||
- "bunkerweb.INTERCEPTED_ERROR_CODES=400 404 405 413 429 500 501 502 503 504"
|
||||
|
||||
volumes:
|
||||
bw-data:
|
||||
|
||||
networks:
|
||||
bw-universe:
|
||||
name: bw-universe
|
||||
ipam:
|
||||
driver: default
|
||||
config:
|
||||
- subnet: 10.20.30.0/24
|
||||
bw-services:
|
||||
name: bw-services
|
||||
bw-docker:
|
||||
name: bw-docker
|
||||
```
|
||||
|
||||
=== "Swarm"
|
||||
|
||||
The web UI can be deployed using a dedicated container which is available on [Docker Hub](https://hub.docker.com/r/bunkerity/bunkerweb-ui) :
|
||||
|
||||
```shell
|
||||
docker pull bunkerity/bunkerweb-ui
|
||||
```
|
||||
|
||||
Alternatively, you can also build it yourself :
|
||||
|
||||
```shell
|
||||
git clone https://github.com/bunkerity/bunkerweb.git && \
|
||||
cd bunkerweb && \
|
||||
docker build -t my-bunkerweb-ui -f src/ui/Dockerfile .
|
||||
```
|
||||
|
||||
The following environment variables are used to configure the web UI container :
|
||||
|
||||
- `ADMIN_USERNAME` : username to access the web UI
|
||||
- `ADMIN_PASSWORD` : password to access the web UI
|
||||
|
||||
Accessing the web UI through BunkerWeb is a classical [reverse proxy setup](quickstart-guide.md#protect-http-applications). We recommend you to connect BunkerWeb and web UI using a dedicated network (like `bw-universe` also used by the scheduler and autoconf) so it won't be on the same network of your web services for obvious security reasons. Please note that the web UI container is listening on the `7000` port.
|
||||
|
||||
!!! info "Database backend"
|
||||
|
||||
If you want another Database backend than MariaDB please refer to the stack files in the [misc/integrations folder](https://github.com/bunkerity/bunkerweb/tree/v1.5.3/misc/integrations) of the repository.
|
||||
|
||||
Here is the stack boilerplate that you can use (don't forget to edit the `changeme` data) :
|
||||
|
||||
```yaml
|
||||
version: "3.5"
|
||||
|
||||
services:
|
||||
bunkerweb:
|
||||
image: bunkerity/bunkerweb:1.5.3
|
||||
ports:
|
||||
- published: 80
|
||||
target: 8080
|
||||
mode: host
|
||||
protocol: tcp
|
||||
- published: 443
|
||||
target: 8443
|
||||
mode: host
|
||||
protocol: tcp
|
||||
environment:
|
||||
- SERVER_NAME=
|
||||
- DATABASE_URI=mariadb+pymysql://bunkerweb:changeme@bw-db:3306/db
|
||||
- SWARM_MODE=yes
|
||||
- MULTISITE=yes
|
||||
- USE_REDIS=yes
|
||||
- REDIS_HOST=bw-redis
|
||||
- API_WHITELIST_IP=127.0.0.0/8 10.20.30.0/24
|
||||
networks:
|
||||
- bw-universe
|
||||
- bw-services
|
||||
deploy:
|
||||
mode: global
|
||||
placement:
|
||||
constraints:
|
||||
- "node.role == worker"
|
||||
labels:
|
||||
- "bunkerweb.INSTANCE=yes"
|
||||
|
||||
bw-autoconf:
|
||||
image: bunkerity/bunkerweb-autoconf:1.5.3
|
||||
environment:
|
||||
- SWARM_MODE=yes
|
||||
- DOCKER_HOST=tcp://bw-docker:2375
|
||||
- DATABASE_URI=mariadb+pymysql://bunkerweb:changeme@bw-db:3306/db
|
||||
networks:
|
||||
- bw-universe
|
||||
- bw-docker
|
||||
|
||||
bw-docker:
|
||||
image: tecnativa/docker-socket-proxy:nightly
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
environment:
|
||||
- CONFIGS=1
|
||||
- CONTAINERS=1
|
||||
- SERVICES=1
|
||||
- SWARM=1
|
||||
- TASKS=1
|
||||
- LOG_LEVEL=warning
|
||||
networks:
|
||||
- bw-docker
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- "node.role == manager"
|
||||
|
||||
bw-scheduler:
|
||||
image: bunkerity/bunkerweb-scheduler:1.5.3
|
||||
environment:
|
||||
- SWARM_MODE=yes
|
||||
- DOCKER_HOST=tcp://bw-docker:2375
|
||||
- DATABASE_URI=mariadb+pymysql://bunkerweb:changeme@bw-db:3306/db
|
||||
networks:
|
||||
- bw-universe
|
||||
- bw-docker
|
||||
|
||||
bw-db:
|
||||
image: mariadb:10.10
|
||||
environment:
|
||||
- MYSQL_RANDOM_ROOT_PASSWORD=yes
|
||||
- MYSQL_DATABASE=db
|
||||
- MYSQL_USER=bunkerweb
|
||||
- MYSQL_PASSWORD=changeme
|
||||
volumes:
|
||||
- bw-data:/var/lib/mysql
|
||||
networks:
|
||||
- bw-docker
|
||||
|
||||
bw-redis:
|
||||
image: redis:7-alpine
|
||||
networks:
|
||||
- bw-universe
|
||||
|
||||
bw-ui:
|
||||
image: bunkerity/bunkerweb-ui:1.5.3
|
||||
environment:
|
||||
- DATABASE_URI=mariadb+pymysql://bunkerweb:changeme@bw-db:3306/db # Remember to set a stronger password for the database
|
||||
- DOCKER_HOST=tcp://bw-docker:2375
|
||||
- ADMIN_USERNAME=changeme
|
||||
- ADMIN_PASSWORD=changeme # Remember to set a stronger password for the changeme user
|
||||
networks:
|
||||
- bw-universe
|
||||
- bw-docker
|
||||
deploy:
|
||||
labels:
|
||||
- "bunkerweb.SERVER_NAME=www.example.com"
|
||||
- "bunkerweb.USE_UI=yes"
|
||||
- "bunkerweb.USE_REVERSE_PROXY=yes"
|
||||
- "bunkerweb.REVERSE_PROXY_URL=/changeme"
|
||||
- "bunkerweb.REVERSE_PROXY_HOST=http://bw-ui:7000"
|
||||
- "bunkerweb.REVERSE_PROXY_INTERCEPT_ERRORS=no"
|
||||
- "bunkerweb.INTERCEPTED_ERROR_CODES=400 404 405 413 429 500 501 502 503 504"
|
||||
|
||||
volumes:
|
||||
bw-data:
|
||||
|
||||
networks:
|
||||
bw-universe:
|
||||
name: bw-universe
|
||||
driver: overlay
|
||||
attachable: true
|
||||
ipam:
|
||||
config:
|
||||
- subnet: 10.20.30.0/24
|
||||
bw-services:
|
||||
name: bw-services
|
||||
driver: overlay
|
||||
attachable: true
|
||||
bw-docker:
|
||||
name: bw-docker
|
||||
driver: overlay
|
||||
attachable: true
|
||||
```
|
||||
|
||||
=== "Kubernetes"
|
||||
|
||||
The web UI can be deployed using a dedicated container which is available on [Docker Hub](https://hub.docker.com/r/bunkerity/bunkerweb-ui) as a standard [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/).
|
||||
|
||||
The following environment variables are used to configure the web UI container :
|
||||
|
||||
- `ADMIN_USERNAME` : username to access the web UI
|
||||
- `ADMIN_PASSWORD` : password to access the web UI
|
||||
|
||||
Accessing the web UI through BunkerWeb is a classical [reverse proxy setup](quickstart-guide.md#protect-http-applications). Network segmentation between web UI and web services is not covered in this documentation. Please note that the web UI container is listening on the `7000` port.
|
||||
|
||||
!!! info "Database backend"
|
||||
|
||||
If you want another Database backend than MariaDB please refer to the yaml files in the [misc/integrations folder](https://github.com/bunkerity/bunkerweb/tree/v1.5.3/misc/integrations) of the repository.
|
||||
|
||||
Here is the yaml boilerplate that you can use (don't forget to edit the `changeme` data) :
|
||||
|
||||
```yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cr-bunkerweb
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["services", "pods", "configmaps"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: sa-bunkerweb
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: crb-bunkerweb
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: sa-bunkerweb
|
||||
namespace: default
|
||||
apiGroup: ""
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: cr-bunkerweb
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: bunkerweb
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: bunkerweb
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: bunkerweb
|
||||
# mandatory annotation
|
||||
annotations:
|
||||
bunkerweb.io/INSTANCE: "yes"
|
||||
spec:
|
||||
containers:
|
||||
# using bunkerweb as name is mandatory
|
||||
- name: bunkerweb
|
||||
image: bunkerity/bunkerweb:1.5.3
|
||||
imagePullPolicy: Always
|
||||
securityContext:
|
||||
runAsUser: 101
|
||||
runAsGroup: 101
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
hostPort: 80
|
||||
- containerPort: 8443
|
||||
hostPort: 443
|
||||
env:
|
||||
- name: KUBERNETES_MODE
|
||||
value: "yes"
|
||||
# replace with your DNS resolvers
|
||||
# e.g. : kube-dns.kube-system.svc.cluster.local
|
||||
- name: DNS_RESOLVERS
|
||||
value: "coredns.kube-system.svc.cluster.local"
|
||||
- name: USE_API
|
||||
value: "yes"
|
||||
# 10.0.0.0/8 is the cluster internal subnet
|
||||
- name: API_WHITELIST_IP
|
||||
value: "127.0.0.0/8 10.0.0.0/8"
|
||||
- name: SERVER_NAME
|
||||
value: ""
|
||||
- name: MULTISITE
|
||||
value: "yes"
|
||||
- name: USE_REDIS
|
||||
value: "yes"
|
||||
- name: REDIS_HOST
|
||||
value: "svc-bunkerweb-redis.default.svc.cluster.local"
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /usr/share/bunkerweb/helpers/healthcheck.sh
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /usr/share/bunkerweb/helpers/healthcheck.sh
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 1
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: bunkerweb-controller
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: bunkerweb-controller
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: bunkerweb-controller
|
||||
spec:
|
||||
serviceAccountName: sa-bunkerweb
|
||||
containers:
|
||||
- name: bunkerweb-controller
|
||||
image: bunkerity/bunkerweb-autoconf:1.5.3
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: KUBERNETES_MODE
|
||||
value: "yes"
|
||||
- name: "DATABASE_URI"
|
||||
value: "mariadb+pymysql://bunkerweb:changeme@svc-bunkerweb-db:3306/db"
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: bunkerweb-scheduler
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: bunkerweb-scheduler
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: bunkerweb-scheduler
|
||||
spec:
|
||||
serviceAccountName: sa-bunkerweb
|
||||
containers:
|
||||
- name: bunkerweb-scheduler
|
||||
image: bunkerity/bunkerweb-scheduler:1.5.3
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: KUBERNETES_MODE
|
||||
value: "yes"
|
||||
- name: "DATABASE_URI"
|
||||
value: "mariadb+pymysql://bunkerweb:changeme@svc-bunkerweb-db:3306/db"
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: bunkerweb-redis
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: bunkerweb-redis
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: bunkerweb-redis
|
||||
spec:
|
||||
containers:
|
||||
- name: bunkerweb-redis
|
||||
image: redis:7-alpine
|
||||
imagePullPolicy: Always
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: bunkerweb-db
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: bunkerweb-db
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: bunkerweb-db
|
||||
spec:
|
||||
containers:
|
||||
- name: bunkerweb-db
|
||||
image: mariadb:10.10
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: MYSQL_RANDOM_ROOT_PASSWORD
|
||||
value: "yes"
|
||||
- name: "MYSQL_DATABASE"
|
||||
value: "db"
|
||||
- name: "MYSQL_USER"
|
||||
value: "bunkerweb"
|
||||
- name: "MYSQL_PASSWORD"
|
||||
value: "changeme"
|
||||
volumeMounts:
|
||||
- mountPath: "/var/lib/mysql"
|
||||
name: vol-db
|
||||
volumes:
|
||||
- name: vol-db
|
||||
persistentVolumeClaim:
|
||||
claimName: pvc-bunkerweb
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: bunkerweb-ui
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: bunkerweb-ui
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: bunkerweb-ui
|
||||
spec:
|
||||
containers:
|
||||
- name: bunkerweb-ui
|
||||
image: bunkerity/bunkerweb-ui:1.5.3
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: ADMIN_USERNAME
|
||||
value: "changeme"
|
||||
- name: "ADMIN_PASSWORD"
|
||||
value: "changeme"
|
||||
- name: KUBERNETES_MODE
|
||||
value: "YES"
|
||||
- name: "DATABASE_URI"
|
||||
value: "mariadb+pymysql://bunkerweb:testor@svc-bunkerweb-db:3306/db"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: svc-bunkerweb
|
||||
spec:
|
||||
clusterIP: None
|
||||
selector:
|
||||
app: bunkerweb
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: svc-bunkerweb-db
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: bunkerweb-db
|
||||
ports:
|
||||
- name: sql
|
||||
protocol: TCP
|
||||
port: 3306
|
||||
targetPort: 3306
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: svc-bunkerweb-redis
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: bunkerweb-redis
|
||||
ports:
|
||||
- name: redis
|
||||
protocol: TCP
|
||||
port: 6379
|
||||
targetPort: 6379
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: svc-bunkerweb-ui
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: bunkerweb-ui
|
||||
ports:
|
||||
- name: http
|
||||
protocol: TCP
|
||||
port: 7000
|
||||
targetPort: 7000
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: pvc-bunkerweb
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
volumeName: pv-bunkerweb
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: ingress
|
||||
annotations:
|
||||
bunkerweb.io/www.example.com_USE_UI: "yes"
|
||||
bunkerweb.io/www.example.com_REVERSE_PROXY_INTERCEPT_ERRORS: "no"
|
||||
bunkerweb.io/www.example.com_INTERCEPTED_ERROR_CODES: '400 404 405 413 429 500 501 502 503 504'
|
||||
spec:
|
||||
rules:
|
||||
- host: www.example.com
|
||||
http:
|
||||
paths:
|
||||
- path: /changeme
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: svc-bunkerweb-ui
|
||||
port:
|
||||
number: 7000
|
||||
```
|
||||
|
||||
=== "Linux"
|
||||
|
||||
The installation of the web UI using the [Linux integration](integrations.md#linux) is pretty straightforward because it is installed with BunkerWeb.
|
||||
|
||||
The web UI comes as systemd service named `bunkerweb-ui` which is not enabled by default. If you want to start the web UI when on startup you can run the following command :
|
||||
|
||||
```shell
|
||||
systemctl enable bunkerweb
|
||||
```
|
||||
|
||||
A dedicated environment file located at `/etc/bunkerweb/ui.env` is used to configure the web UI :
|
||||
|
||||
```conf
|
||||
ADMIN_USERNAME=changeme
|
||||
ADMIN_PASSWORD=changeme
|
||||
```
|
||||
|
||||
Each time you edit the `/etc/bunkerweb/ui.env` file, you will need to restart the service :
|
||||
|
||||
```shell
|
||||
systemctl restart bunkerweb-ui
|
||||
```
|
||||
|
||||
Accessing the web UI through BunkerWeb is a classical [reverse proxy setup](quickstart-guide.md#protect-http-applications). Please note that the web UI is listening on the `7000` port and only on the loopback interface.
|
||||
|
||||
Here is the `/etc/bunkerweb/variables.env` boilerplate you can use :
|
||||
|
||||
```conf
|
||||
HTTP_PORT=80
|
||||
HTTPS_PORT=443
|
||||
DNS_RESOLVERS=8.8.8.8 8.8.4.4
|
||||
API_LISTEN_IP=127.0.0.1
|
||||
SERVER_NAME=www.example.com
|
||||
MULTISITE=yes
|
||||
www.example.com_USE_UI=yes
|
||||
www.example.com_USE_REVERSE_PROXY=yes
|
||||
www.example.com_REVERSE_PROXY_URL=/changeme
|
||||
www.example.com_REVERSE_PROXY_HOST=http://127.0.0.1:7000
|
||||
www.example.com_INTERCEPTED_ERROR_CODES=400 404 405 413 429 500 501 502 503 504
|
||||
```
|
||||
|
||||
Don't forget to restart the `bunkerweb` service :
|
||||
|
||||
```shell
|
||||
systemctl restart bunkerweb
|
||||
```
|
||||
|
||||
=== "Ansible"
|
||||
|
||||
The installation of the web UI using the [Vagrant integration](integrations.md#linux) is pretty straightforward because it is installed with BunkerWeb.
|
||||
|
||||
Create a `my_ui.env` filed used to configure the web UI :
|
||||
|
||||
```conf
|
||||
ADMIN_USERNAME=changeme
|
||||
ADMIN_PASSWORD=changeme
|
||||
```
|
||||
|
||||
Here is the `my_variables.env` boilerplate you can use :
|
||||
|
||||
```conf
|
||||
HTTP_PORT=80
|
||||
HTTPS_PORT=443
|
||||
DNS_RESOLVERS=8.8.8.8 8.8.4.4
|
||||
API_LISTEN_IP=127.0.0.1
|
||||
SERVER_NAME=www.example.com
|
||||
MULTISITE=yes
|
||||
www.example.com_USE_UI=yes
|
||||
www.example.com_USE_REVERSE_PROXY=yes
|
||||
www.example.com_REVERSE_PROXY_URL=/changeme
|
||||
www.example.com_REVERSE_PROXY_HOST=http://127.0.0.1:7000
|
||||
www.example.com_INTERCEPTED_ERROR_CODES=400 404 405 413 429 500 501 502 503 504
|
||||
```
|
||||
|
||||
The variable `enable_ui` can be set to `true` in order to activate the web UI service and the variable `custom_ui` can be used to specify the configuration file for the web UI :
|
||||
|
||||
```ini
|
||||
[mybunkers]
|
||||
192.168.0.42 variables_env="{{ playbook_dir }}/my_variables.env" enable_ui=true custom_ui="{{ playbook_dir }}/my_ui.env"
|
||||
```
|
||||
|
||||
Or alternatively, in your playbook file :
|
||||
|
||||
```yaml
|
||||
- hosts: all
|
||||
become: true
|
||||
vars:
|
||||
- variables_env: "{{ playbook_dir }}/my_variables.env"
|
||||
- enable_ui: true
|
||||
- custom_ui: "{{ playbook_dir }}/my_ui.env"
|
||||
roles:
|
||||
- bunkerity.bunkerweb
|
||||
```
|
||||
|
||||
|
||||
You can now run the playbook and be able to access the web UI :
|
||||
|
||||
```shell
|
||||
ansible-playbook -i inventory.yml playbook.yml
|
||||
```
|
||||
|
||||
=== "Vagrant"
|
||||
|
||||
The installation of the web UI using the [Vagrant integration](integrations.md#vagrant) is pretty straightforward because it is installed with BunkerWeb.
|
||||
|
||||
First of all, you will need to get a shell on your Vagrant box :
|
||||
|
||||
```shell
|
||||
vagrant ssh
|
||||
```
|
||||
|
||||
The web UI comes as systemd service named `bunkerweb-ui` which is not enabled by default. If you want to start the web UI when on startup you can run the following command :
|
||||
|
||||
```shell
|
||||
systemctl enable bunkerweb
|
||||
```
|
||||
|
||||
A dedicated environment file located at `/etc/bunkerweb/ui.env` is used to configure the web UI :
|
||||
|
||||
```conf
|
||||
ADMIN_USERNAME=changeme
|
||||
ADMIN_PASSWORD=changeme
|
||||
```
|
||||
|
||||
Each time you edit the `/etc/bunkerweb/ui.env` file, you will need to restart the service :
|
||||
|
||||
```shell
|
||||
systemctl restart bunkerweb-ui
|
||||
```
|
||||
|
||||
Accessing the web UI through BunkerWeb is a classical [reverse proxy setup](quickstart-guide.md#protect-http-applications). Please note that the web UI is listening on the `7000` port and only on the loopback interface.
|
||||
|
||||
Here is the `/etc/bunkerweb/variables.env` boilerplate you can use :
|
||||
|
||||
```conf
|
||||
HTTP_PORT=80
|
||||
HTTPS_PORT=443
|
||||
DNS_RESOLVERS=8.8.8.8 8.8.4.4
|
||||
API_LISTEN_IP=127.0.0.1
|
||||
SERVER_NAME=www.example.com
|
||||
MULTISITE=yes
|
||||
www.example.com_USE_UI=yes
|
||||
www.example.com_USE_REVERSE_PROXY=yes
|
||||
www.example.com_REVERSE_PROXY_URL=/changeme
|
||||
www.example.com_REVERSE_PROXY_HOST=http://127.0.0.1:7000
|
||||
www.example.com_INTERCEPTED_ERROR_CODES=400 404 405 413 429 500 501 502 503 504
|
||||
```
|
||||
|
||||
Don't forget to restart the `bunkerweb` service :
|
||||
|
||||
```shell
|
||||
systemctl restart bunkerweb
|
||||
```
|
||||
78
examples/authelia/authelia/configuration.yml
Normal file
78
examples/authelia/authelia/configuration.yml
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
---
|
||||
###############################################################
|
||||
# Authelia configuration #
|
||||
###############################################################
|
||||
|
||||
jwt_secret: a_very_important_secret
|
||||
default_redirection_url: https://auth.example.com
|
||||
|
||||
ntp:
|
||||
disable_failure: true
|
||||
|
||||
server:
|
||||
host: 0.0.0.0
|
||||
port: 9091
|
||||
|
||||
log:
|
||||
level: debug
|
||||
# This secret can also be set using the env variables AUTHELIA_JWT_SECRET_FILE
|
||||
|
||||
totp:
|
||||
issuer: authelia.com
|
||||
|
||||
# duo_api:
|
||||
# hostname: api-123456789.example.com
|
||||
# integration_key: ABCDEF
|
||||
# # This secret can also be set using the env variables AUTHELIA_DUO_API_SECRET_KEY_FILE
|
||||
# secret_key: 1234567890abcdefghifjkl
|
||||
|
||||
authentication_backend:
|
||||
file:
|
||||
path: /config/users_database.yml
|
||||
|
||||
access_control:
|
||||
default_policy: deny
|
||||
rules:
|
||||
# Rules applied to everyone
|
||||
- domain: auth.example.com
|
||||
policy: bypass
|
||||
- domain: app1.example.com
|
||||
policy: one_factor
|
||||
- domain: app2.example.com
|
||||
policy: two_factor
|
||||
|
||||
session:
|
||||
name: authelia_session
|
||||
# This secret can also be set using the env variables AUTHELIA_SESSION_SECRET_FILE
|
||||
secret: unsecure_session_secret
|
||||
expiration: 3600 # 1 hour
|
||||
inactivity: 300 # 5 minutes
|
||||
domain: example.com # Should match whatever your root protected domain is
|
||||
|
||||
redis:
|
||||
host: redis
|
||||
port: 6379
|
||||
# This secret can also be set using the env variables AUTHELIA_SESSION_REDIS_PASSWORD_FILE
|
||||
# password: authelia
|
||||
|
||||
regulation:
|
||||
max_retries: 3
|
||||
find_time: 120
|
||||
ban_time: 300
|
||||
|
||||
storage:
|
||||
encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this
|
||||
local:
|
||||
path: /config/db.sqlite3
|
||||
|
||||
notifier:
|
||||
filesystem:
|
||||
filename: /config/notification.txt
|
||||
#notifier:
|
||||
# smtp:
|
||||
# username: test
|
||||
# This secret can also be set using the env variables AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
|
||||
# password: password
|
||||
# host: mail.example.com
|
||||
# port: 25
|
||||
# sender: admin@example.com
|
||||
17
examples/authelia/authelia/users_database.yml
Normal file
17
examples/authelia/authelia/users_database.yml
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
---
|
||||
###############################################################
|
||||
# Users Database #
|
||||
###############################################################
|
||||
|
||||
# This file can be used if you do not have an LDAP set up.
|
||||
|
||||
# List of users
|
||||
users:
|
||||
authelia:
|
||||
displayname: "Authelia User"
|
||||
# Password is authelia
|
||||
password: "$6$rounds=50000$BpLnfgDsc2WD8F2q$Zis.ixdg9s/UOJYrs56b5QEZFiZECu0qZVNsIYxBaNJ7ucIL.nlxVCT5tqh8KHG8X4tlwCFm5r6NTOZZ5qRFN/" # yamllint disable-line rule:line-length
|
||||
email: authelia@authelia.com
|
||||
groups:
|
||||
- admins
|
||||
- dev
|
||||
81
examples/authelia/autoconf.yml
Normal file
81
examples/authelia/autoconf.yml
Normal file
|
|
@ -0,0 +1,81 @@
|
|||
version: "3"
|
||||
|
||||
services:
|
||||
# APPLICATIONS
|
||||
app1:
|
||||
image: tutum/hello-world
|
||||
networks:
|
||||
bw-services:
|
||||
aliases:
|
||||
- app1
|
||||
labels:
|
||||
- bunkerweb.SERVER_NAME=app1.example.com
|
||||
- bunkerweb.USE_REVERSE_PROXY=yes
|
||||
- bunkerweb.REVERSE_PROXY_URL=/
|
||||
- bunkerweb.REVERSE_PROXY_HOST=http://app1
|
||||
- bunkerweb.REVERSE_PROXY_AUTH_REQUEST=/authelia
|
||||
- bunkerweb.REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL=https://auth.example.com/?rd=$$scheme%3A%2F%2F$$host$$request_uri
|
||||
- bunkerweb.REVERSE_PROXY_AUTH_REQUEST_SET=$$user $$upstream_http_remote_user;$$groups $$upstream_http_remote_groups;$$name $$upstream_http_remote_name;$$email $$upstream_http_remote_email
|
||||
- bunkerweb.REVERSE_PROXY_HEADERS=Remote-User $$user;Remote-Groups $$groups;Remote-Name $$name;Remote-Email $$email
|
||||
- bunkerweb.REVERSE_PROXY_URL_999=/authelia
|
||||
- bunkerweb.REVERSE_PROXY_HOST_999=http://authelia:9091/api/verify
|
||||
- bunkerweb.REVERSE_PROXY_HEADERS_999=X-Original-URL $$scheme://$$http_host$$request_uri;Content-Length ""
|
||||
|
||||
app2:
|
||||
image: tutum/hello-world
|
||||
networks:
|
||||
bw-services:
|
||||
aliases:
|
||||
- app2
|
||||
labels:
|
||||
- bunkerweb.SERVER_NAME=app2.example.com
|
||||
- bunkerweb.USE_REVERSE_PROXY=yes
|
||||
- bunkerweb.REVERSE_PROXY_URL=/
|
||||
- bunkerweb.REVERSE_PROXY_HOST=http://app2
|
||||
- bunkerweb.REVERSE_PROXY_AUTH_REQUEST=/authelia
|
||||
- bunkerweb.REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL=https://auth.example.com/?rd=$$scheme%3A%2F%2F$$host$$request_uri
|
||||
- bunkerweb.REVERSE_PROXY_AUTH_REQUEST_SET=$$user $$upstream_http_remote_user;$$groups $$upstream_http_remote_groups;$$name $$upstream_http_remote_name;$$email $$upstream_http_remote_email
|
||||
- bunkerweb.REVERSE_PROXY_HEADERS=Remote-User $$user;Remote-Groups $$groups;Remote-Name $$name;Remote-Email $$email
|
||||
- bunkerweb.REVERSE_PROXY_URL_999=/authelia
|
||||
- bunkerweb.REVERSE_PROXY_HOST_999=http://authelia:9091/api/verify
|
||||
- bunkerweb.REVERSE_PROXY_HEADERS_999=X-Original-URL $$scheme://$$http_host$$request_uri;Content-Length ""
|
||||
|
||||
# AUTHELIA
|
||||
authelia:
|
||||
image: authelia/authelia:4
|
||||
networks:
|
||||
bw-services:
|
||||
aliases:
|
||||
- authelia
|
||||
volumes:
|
||||
- ./authelia:/config
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
disable: true
|
||||
environment:
|
||||
- TZ=Europe/Paris
|
||||
labels:
|
||||
- bunkerweb.SERVER_NAME=auth.example.com
|
||||
- bunkerweb.USE_REVERSE_PROXY=yes
|
||||
- bunkerweb.REVERSE_PROXY_URL=/
|
||||
- bunkerweb.REVERSE_PROXY_HOST=http://authelia:9091
|
||||
- bunkerweb.REVERSE_PROXY_INTERCEPT_ERRORS=no
|
||||
|
||||
redis:
|
||||
image: redis:7-alpine
|
||||
networks:
|
||||
bw-services:
|
||||
aliases:
|
||||
- redis
|
||||
volumes:
|
||||
- ./redis:/data
|
||||
expose:
|
||||
- 6379
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- TZ=Europe/Paris
|
||||
|
||||
networks:
|
||||
bw-services:
|
||||
external: true
|
||||
name: bw-services
|
||||
116
examples/authelia/docker-compose.yml
Normal file
116
examples/authelia/docker-compose.yml
Normal file
|
|
@ -0,0 +1,116 @@
|
|||
version: "3.4"
|
||||
|
||||
services:
|
||||
mybunker:
|
||||
image: bunkerity/bunkerweb:1.5.3
|
||||
ports:
|
||||
- 80:8080
|
||||
- 443:8443
|
||||
labels:
|
||||
- "bunkerweb.INSTANCE=yes"
|
||||
networks:
|
||||
- bw-universe
|
||||
- bw-services
|
||||
environment:
|
||||
- MULTISITE=yes
|
||||
- SERVER_NAME=auth.example.com app1.example.com app2.example.com # replace with your domains
|
||||
- API_WHITELIST_IP=127.0.0.0/8 10.20.30.0/24
|
||||
- SERVE_FILES=no
|
||||
- DISABLE_DEFAULT_SERVER=yes
|
||||
- AUTO_LETS_ENCRYPT=yes
|
||||
- USE_CLIENT_CACHE=yes
|
||||
- USE_GZIP=yes
|
||||
- USE_REVERSE_PROXY=yes
|
||||
# Proxy to auth_request URI
|
||||
- REVERSE_PROXY_URL_999=/authelia
|
||||
- REVERSE_PROXY_HOST_999=http://authelia:9091/api/verify
|
||||
- REVERSE_PROXY_HEADERS_999=X-Original-URL $$scheme://$$http_host$$request_uri;Content-Length ""
|
||||
# Authelia
|
||||
- auth.example.com_REVERSE_PROXY_URL=/
|
||||
- auth.example.com_REVERSE_PROXY_HOST=http://authelia:9091
|
||||
- auth.example.com_REVERSE_PROXY_INTERCEPT_ERRORS=no
|
||||
# Applications
|
||||
- app1.example.com_REVERSE_PROXY_URL=/
|
||||
- app1.example.com_REVERSE_PROXY_HOST=http://app1
|
||||
- app1.example.com_REVERSE_PROXY_AUTH_REQUEST=/authelia
|
||||
- app1.example.com_REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL=https://auth.example.com/?rd=$$scheme%3A%2F%2F$$host$$request_uri
|
||||
- app1.example.com_REVERSE_PROXY_AUTH_REQUEST_SET=$$user $$upstream_http_remote_user;$$groups $$upstream_http_remote_groups;$$name $$upstream_http_remote_name;$$email $$upstream_http_remote_email
|
||||
- app1.example.com_REVERSE_PROXY_HEADERS=Remote-User $$user;Remote-Groups $$groups;Remote-Name $$name;Remote-Email $$email
|
||||
- app2.example.com_REVERSE_PROXY_URL=/
|
||||
- app2.example.com_REVERSE_PROXY_HOST=http://app2
|
||||
- app2.example.com_REVERSE_PROXY_AUTH_REQUEST=/authelia
|
||||
- app2.example.com_REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL=https://auth.example.com/?rd=$$scheme%3A%2F%2F$$host$$request_uri
|
||||
- app2.example.com_REVERSE_PROXY_AUTH_REQUEST_SET=$$user $$upstream_http_remote_user;$$groups $$upstream_http_remote_groups;$$name $$upstream_http_remote_name;$$email $$upstream_http_remote_email
|
||||
- app2.example.com_REVERSE_PROXY_HEADERS=Remote-User $$user;Remote-Groups $$groups;Remote-Name $$name;Remote-Email $$email
|
||||
|
||||
bw-scheduler:
|
||||
image: bunkerity/bunkerweb-scheduler:1.5.3
|
||||
depends_on:
|
||||
- mybunker
|
||||
environment:
|
||||
- DOCKER_HOST=tcp://bw-docker-proxy:2375
|
||||
networks:
|
||||
- bw-universe
|
||||
- bw-docker
|
||||
volumes:
|
||||
- bw-data:/data
|
||||
|
||||
bw-docker-proxy:
|
||||
image: tecnativa/docker-socket-proxy:nightly
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
environment:
|
||||
- CONTAINERS=1
|
||||
- LOG_LEVEL=warning
|
||||
networks:
|
||||
- bw-docker
|
||||
|
||||
# APPLICATIONS
|
||||
app1:
|
||||
image: tutum/hello-world
|
||||
networks:
|
||||
- bw-services
|
||||
app2:
|
||||
image: tutum/hello-world
|
||||
networks:
|
||||
- bw-services
|
||||
|
||||
# AUTHELIA
|
||||
authelia:
|
||||
image: authelia/authelia:4
|
||||
container_name: authelia
|
||||
networks:
|
||||
- bw-services
|
||||
volumes:
|
||||
- ./authelia:/config
|
||||
restart: unless-stopped
|
||||
healthcheck:
|
||||
disable: true
|
||||
environment:
|
||||
- TZ=Europe/Paris
|
||||
|
||||
redis:
|
||||
image: redis:7-alpine
|
||||
container_name: redis
|
||||
networks:
|
||||
- bw-services
|
||||
volumes:
|
||||
- ./redis:/data
|
||||
expose:
|
||||
- 6379
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- TZ=Europe/Paris
|
||||
|
||||
volumes:
|
||||
bw-data:
|
||||
|
||||
networks:
|
||||
bw-universe:
|
||||
name: bw-universe
|
||||
ipam:
|
||||
driver: default
|
||||
config:
|
||||
- subnet: 10.20.30.0/24
|
||||
bw-services:
|
||||
bw-docker:
|
||||
303
examples/authelia/kubernetes.yml
Normal file
303
examples/authelia/kubernetes.yml
Normal file
|
|
@ -0,0 +1,303 @@
|
|||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: ingress
|
||||
annotations:
|
||||
bunkerweb.io/AUTO_LETS_ENCRYPT: "yes"
|
||||
bunkerweb.io/app1.example.com_REVERSE_PROXY_AUTH_REQUEST: "/authelia"
|
||||
bunkerweb.io/app1.example.com_REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL: "https://auth.example.com/?rd=$scheme%3A%2F%2F$host$request_uri"
|
||||
bunkerweb.io/app1.example.com_REVERSE_PROXY_AUTH_REQUEST_SET: "$user $upstream_http_remote_user;$groups $upstream_http_remote_groups;$name $upstream_http_remote_name;$email $upstream_http_remote_email"
|
||||
bunkerweb.io/app1.example.com_REVERSE_PROXY_HEADERS: "Remote-User $user;Remote-Groups $groups;Remote-Name $name;Remote-Email $email"
|
||||
bunkerweb.io/app1.example.com_REVERSE_PROXY_URL_999: "/authelia"
|
||||
bunkerweb.io/app1.example.com_REVERSE_PROXY_HOST_999: "http://authelia:9091/api/verify"
|
||||
bunkerweb.io/app1.example.com_REVERSE_PROXY_HEADERS_999: "X-Original-URL $scheme://$http_host$request_uri;Content-Length ''"
|
||||
bunkerweb.io/app2.example.com_REVERSE_PROXY_AUTH_REQUEST: "/authelia"
|
||||
bunkerweb.io/app2.example.com_REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL: "https://auth.example.com/?rd=$scheme%3A%2F%2F$host$request_uri"
|
||||
bunkerweb.io/app2.example.com_REVERSE_PROXY_AUTH_REQUEST_SET: "$user $upstream_http_remote_user;$groups $upstream_http_remote_groups;$name $upstream_http_remote_name;$email $upstream_http_remote_email"
|
||||
bunkerweb.io/app2.example.com_REVERSE_PROXY_HEADERS: "Remote-User $user;Remote-Groups $groups;Remote-Name $name;Remote-Email $email"
|
||||
bunkerweb.io/app2.example.com_REVERSE_PROXY_URL_999: "/authelia"
|
||||
bunkerweb.io/app2.example.com_REVERSE_PROXY_HOST_999: "http://authelia:9091/api/verify"
|
||||
bunkerweb.io/app2.example.com_REVERSE_PROXY_HEADERS_999: "X-Original-URL $scheme://$http_host$request_uri;Content-Length ''"
|
||||
bunkerweb.io/auth.example.com_REVERSE_PROXY_INTERCEPT_ERRORS: "no"
|
||||
spec:
|
||||
rules:
|
||||
- host: app1.example.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: svc-app1
|
||||
port:
|
||||
number: 80
|
||||
- host: app2.example.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: svc-app2
|
||||
port:
|
||||
number: 80
|
||||
- host: auth.example.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: svc-authelia
|
||||
port:
|
||||
number: 9091
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: app1
|
||||
labels:
|
||||
app: app1
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: app1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: app1
|
||||
spec:
|
||||
containers:
|
||||
- name: app1
|
||||
image: tutum/hello-world
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: svc-app1
|
||||
spec:
|
||||
selector:
|
||||
app: app1
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 80
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: app2
|
||||
labels:
|
||||
app: app2
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: app2
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: app2
|
||||
spec:
|
||||
containers:
|
||||
- name: app2
|
||||
image: tutum/hello-world
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: svc-app2
|
||||
spec:
|
||||
selector:
|
||||
app: app2
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 80
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: cfg-authelia
|
||||
data:
|
||||
configuration.yml: |
|
||||
---
|
||||
###############################################################
|
||||
# Authelia configuration #
|
||||
###############################################################
|
||||
|
||||
jwt_secret: a_very_important_secret
|
||||
default_redirection_url: https://auth.example.com
|
||||
|
||||
ntp:
|
||||
disable_failure: true
|
||||
|
||||
server:
|
||||
host: 0.0.0.0
|
||||
port: 9091
|
||||
|
||||
log:
|
||||
level: debug
|
||||
# This secret can also be set using the env variables AUTHELIA_JWT_SECRET_FILE
|
||||
|
||||
totp:
|
||||
issuer: authelia.com
|
||||
|
||||
# duo_api:
|
||||
# hostname: api-123456789.example.com
|
||||
# integration_key: ABCDEF
|
||||
# # This secret can also be set using the env variables AUTHELIA_DUO_API_SECRET_KEY_FILE
|
||||
# secret_key: 1234567890abcdefghifjkl
|
||||
|
||||
authentication_backend:
|
||||
file:
|
||||
path: /config/users_database.yml
|
||||
|
||||
access_control:
|
||||
default_policy: deny
|
||||
rules:
|
||||
# Rules applied to everyone
|
||||
- domain: auth.example.com
|
||||
policy: bypass
|
||||
- domain: app1.example.com
|
||||
policy: one_factor
|
||||
- domain: app2.example.com
|
||||
policy: two_factor
|
||||
|
||||
session:
|
||||
name: authelia_session
|
||||
# This secret can also be set using the env variables AUTHELIA_SESSION_SECRET_FILE
|
||||
secret: unsecure_session_secret
|
||||
expiration: 3600 # 1 hour
|
||||
inactivity: 300 # 5 minutes
|
||||
domain: example.com # Should match whatever your root protected domain is
|
||||
|
||||
redis:
|
||||
host: svc-redis
|
||||
port: 6379
|
||||
# This secret can also be set using the env variables AUTHELIA_SESSION_REDIS_PASSWORD_FILE
|
||||
# password: authelia
|
||||
|
||||
regulation:
|
||||
max_retries: 3
|
||||
find_time: 120
|
||||
ban_time: 300
|
||||
|
||||
storage:
|
||||
encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this
|
||||
local:
|
||||
path: /config/db.sqlite3
|
||||
|
||||
notifier:
|
||||
filesystem:
|
||||
filename: /config/notification.txt
|
||||
#notifier:
|
||||
# smtp:
|
||||
# username: test
|
||||
# This secret can also be set using the env variables AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
|
||||
# password: password
|
||||
# host: mail.example.com
|
||||
# port: 25
|
||||
# sender: admin@example.com
|
||||
...
|
||||
users_database.yml: |
|
||||
---
|
||||
###############################################################
|
||||
# Users Database #
|
||||
###############################################################
|
||||
|
||||
# This file can be used if you do not have an LDAP set up.
|
||||
|
||||
# List of users
|
||||
users:
|
||||
authelia:
|
||||
displayname: "Authelia User"
|
||||
# Password is authelia
|
||||
password: "$6$rounds=50000$BpLnfgDsc2WD8F2q$Zis.ixdg9s/UOJYrs56b5QEZFiZECu0qZVNsIYxBaNJ7ucIL.nlxVCT5tqh8KHG8X4tlwCFm5r6NTOZZ5qRFN/" # yamllint disable-line rule:line-length
|
||||
email: authelia@authelia.com
|
||||
groups:
|
||||
- admins
|
||||
- dev
|
||||
...
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: authelia
|
||||
labels:
|
||||
app: authelia
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: authelia
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: authelia
|
||||
spec:
|
||||
containers:
|
||||
- name: authelia
|
||||
image: authelia/authelia
|
||||
env:
|
||||
- name: TZ
|
||||
value: "Europe/Paris"
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config/configuration.yml
|
||||
subPath: configuration.yml
|
||||
- name: config
|
||||
mountPath: /config/users_database.yml
|
||||
subPath: users_database.yml
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: cfg-authelia
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: svc-authelia
|
||||
spec:
|
||||
selector:
|
||||
app: authelia
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9091
|
||||
targetPort: 9091
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: redis
|
||||
labels:
|
||||
app: redis
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: redis
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: redis
|
||||
spec:
|
||||
containers:
|
||||
- name: redis
|
||||
image: redis:alpine
|
||||
env:
|
||||
- name: TZ
|
||||
value: "Europe/Paris"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: svc-redis
|
||||
spec:
|
||||
selector:
|
||||
app: redis
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 6379
|
||||
targetPort: 6379
|
||||
19
examples/authelia/setup-linux.sh
Executable file
19
examples/authelia/setup-linux.sh
Executable file
|
|
@ -0,0 +1,19 @@
|
|||
#!/bin/bash
|
||||
|
||||
if [ "$(id -u)" -ne 0 ] ; then
|
||||
echo "❌ Run me as root"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
curl https://github.com/authelia/authelia/releases/download/v4.36.2/authelia-v4.36.2-linux-amd64.tar.gz -Lo /tmp/authelia.tar.gz
|
||||
tar -xzf /tmp/authelia.tar.gz -C /tmp
|
||||
mv /tmp/authelia-linux-amd64 /usr/bin/authelia
|
||||
mv /tmp/authelia.service /etc/systemd/system
|
||||
mkdir /etc/authelia
|
||||
cp ./authelia/* /etc/authelia
|
||||
sed -i "s@/config/@/etc/authelia/@g" /etc/authelia/configuration.yml
|
||||
sed -i "s@redis:@@g" /etc/authelia/configuration.yml
|
||||
sed -i "s@host: redis@@g" /etc/authelia/configuration.yml
|
||||
sed -i "s@port: 6379@@g" /etc/authelia/configuration.yml
|
||||
systemctl daemon-reload
|
||||
systemctl start authelia
|
||||
103
examples/authelia/swarm.yml
Normal file
103
examples/authelia/swarm.yml
Normal file
|
|
@ -0,0 +1,103 @@
|
|||
version: "3"
|
||||
|
||||
services:
|
||||
# APPLICATIONS
|
||||
app1:
|
||||
image: tutum/hello-world
|
||||
networks:
|
||||
- bw-services
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- "node.role==worker"
|
||||
labels:
|
||||
- bunkerweb.SERVER_NAME=app1.example.com
|
||||
- bunkerweb.USE_REVERSE_PROXY=yes
|
||||
- bunkerweb.REVERSE_PROXY_URL=/
|
||||
- bunkerweb.REVERSE_PROXY_HOST=http://app1
|
||||
- bunkerweb.REVERSE_PROXY_AUTH_REQUEST=/authelia
|
||||
- bunkerweb.REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL=https://auth.example.com/?rd=$$scheme%3A%2F%2F$$host$$request_uri
|
||||
- bunkerweb.REVERSE_PROXY_AUTH_REQUEST_SET=$$user $$upstream_http_remote_user;$$groups $$upstream_http_remote_groups;$$name $$upstream_http_remote_name;$$email $$upstream_http_remote_email
|
||||
- bunkerweb.REVERSE_PROXY_HEADERS=Remote-User $$user;Remote-Groups $$groups;Remote-Name $$name;Remote-Email $$email
|
||||
- bunkerweb.REVERSE_PROXY_URL_999=/authelia
|
||||
- bunkerweb.REVERSE_PROXY_HOST_999=http://authelia:9091/api/verify
|
||||
- bunkerweb.REVERSE_PROXY_HEADERS_999=X-Original-URL $$scheme://$$http_host$$request_uri;Content-Length ""
|
||||
|
||||
app2:
|
||||
image: tutum/hello-world
|
||||
networks:
|
||||
- bw-services
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- "node.role==worker"
|
||||
labels:
|
||||
- bunkerweb.SERVER_NAME=app2.example.com
|
||||
- bunkerweb.USE_REVERSE_PROXY=yes
|
||||
- bunkerweb.REVERSE_PROXY_URL=/
|
||||
- bunkerweb.REVERSE_PROXY_HOST=http://app2
|
||||
- bunkerweb.REVERSE_PROXY_AUTH_REQUEST=/authelia
|
||||
- bunkerweb.REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL=https://auth.example.com/?rd=$$scheme%3A%2F%2F$$host$$request_uri
|
||||
- bunkerweb.REVERSE_PROXY_AUTH_REQUEST_SET=$$user $$upstream_http_remote_user;$$groups $$upstream_http_remote_groups;$$name $$upstream_http_remote_name;$$email $$upstream_http_remote_email
|
||||
- bunkerweb.REVERSE_PROXY_HEADERS=Remote-User $$user;Remote-Groups $$groups;Remote-Name $$name;Remote-Email $$email
|
||||
- bunkerweb.REVERSE_PROXY_URL_999=/authelia
|
||||
- bunkerweb.REVERSE_PROXY_HOST_999=http://authelia:9091/api/verify
|
||||
- bunkerweb.REVERSE_PROXY_HEADERS_999=X-Original-URL $$scheme://$$http_host$$request_uri;Content-Length ""
|
||||
|
||||
# AUTHELIA
|
||||
authelia:
|
||||
image: authelia/authelia:4
|
||||
networks:
|
||||
- bw-services
|
||||
configs:
|
||||
- source: config_authelia_configuration
|
||||
target: /config/configuration.yml
|
||||
uid: "0"
|
||||
gid: "0"
|
||||
mode: 0444
|
||||
- source: config_authelia_users_database
|
||||
target: /config/users_database.yml
|
||||
uid: "0"
|
||||
gid: "0"
|
||||
mode: 0444
|
||||
healthcheck:
|
||||
disable: true
|
||||
environment:
|
||||
- TZ=Europe/Paris
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- "node.role==worker"
|
||||
labels:
|
||||
- bunkerweb.SERVER_NAME=auth.example.com
|
||||
- bunkerweb.USE_REVERSE_PROXY=yes
|
||||
- bunkerweb.REVERSE_PROXY_URL=/
|
||||
- bunkerweb.REVERSE_PROXY_HOST=http://authelia:9091
|
||||
- bunkerweb.REVERSE_PROXY_INTERCEPT_ERRORS=no
|
||||
|
||||
redis:
|
||||
image: redis:7-alpine
|
||||
networks:
|
||||
- bw-services
|
||||
volumes:
|
||||
- redis:/data
|
||||
environment:
|
||||
- TZ=Europe/Paris
|
||||
deploy:
|
||||
placement:
|
||||
constraints:
|
||||
- "node.role==worker"
|
||||
|
||||
networks:
|
||||
bw-services:
|
||||
external: true
|
||||
name: bw-services
|
||||
|
||||
volumes:
|
||||
redis:
|
||||
|
||||
configs:
|
||||
config_authelia_configuration:
|
||||
file: ./authelia/configuration.yml
|
||||
config_authelia_users_database:
|
||||
file: ./authelia/users_database.yml
|
||||
18
examples/authelia/tests.json
Normal file
18
examples/authelia/tests.json
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"name": "authelia",
|
||||
"kinds": ["docker", "autoconf", "swarm", "linux"],
|
||||
"timeout": 120,
|
||||
"delay": 60,
|
||||
"tests": [
|
||||
{
|
||||
"type": "string",
|
||||
"url": "https://app1.example.com",
|
||||
"string": "authelia"
|
||||
},
|
||||
{
|
||||
"type": "string",
|
||||
"url": "https://app2.example.com",
|
||||
"string": "authelia"
|
||||
}
|
||||
]
|
||||
}
|
||||
34
examples/authelia/variables.env
Normal file
34
examples/authelia/variables.env
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
HTTP_PORT=80
|
||||
HTTPS_PORT=443
|
||||
DNS_RESOLVERS=8.8.8.8 8.8.4.4
|
||||
API_LISTEN_IP=127.0.0.1
|
||||
MULTISITE=yes
|
||||
# Replace with your domains
|
||||
SERVER_NAME=auth.example.com app1.example.com app2.example.com
|
||||
SERVE_FILES=no
|
||||
DISABLE_DEFAULT_SERVER=yes
|
||||
AUTO_LETS_ENCRYPT=yes
|
||||
USE_CLIENT_CACHE=yes
|
||||
USE_GZIP=yes
|
||||
USE_REVERSE_PROXY=yes
|
||||
# Proxy to auth_request URI
|
||||
REVERSE_PROXY_URL_999=/authelia
|
||||
REVERSE_PROXY_HOST_999=http://127.0.0.1:9091/api/verify
|
||||
REVERSE_PROXY_HEADERS_999=X-Original-URL $scheme://$http_host$request_uri;Content-Length ""
|
||||
# Authelia
|
||||
auth.example.com_REVERSE_PROXY_URL=/
|
||||
auth.example.com_REVERSE_PROXY_HOST=http://127.0.0.1:9091
|
||||
auth.example.com_REVERSE_PROXY_INTERCEPT_ERRORS=no
|
||||
# Applications
|
||||
app1.example.com_REVERSE_PROXY_URL=/
|
||||
app1.example.com_REVERSE_PROXY_HOST=http://app1.example.com
|
||||
app1.example.com_REVERSE_PROXY_AUTH_REQUEST=/authelia
|
||||
app1.example.com_REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL=https://auth.example.com/?rd=$scheme%3A%2F%2F$host$request_uri
|
||||
app1.example.com_REVERSE_PROXY_AUTH_REQUEST_SET=$user $upstream_http_remote_user;$groups $upstream_http_remote_groups;$name $upstream_http_remote_name;$email $upstream_http_remote_email
|
||||
app1.example.com_REVERSE_PROXY_HEADERS=Remote-User $user;Remote-Groups $groups;Remote-Name $name;Remote-Email $email
|
||||
app2.example.com_REVERSE_PROXY_URL=/
|
||||
app2.example.com_REVERSE_PROXY_HOST=http://app2.example.com
|
||||
app2.example.com_REVERSE_PROXY_AUTH_REQUEST=/authelia
|
||||
app2.example.com_REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL=https://auth.example.com/?rd=$scheme%3A%2F%2F$host$request_uri
|
||||
app2.example.com_REVERSE_PROXY_AUTH_REQUEST_SET=$user $upstream_http_remote_user;$groups $upstream_http_remote_groups;$name $upstream_http_remote_name;$email $upstream_http_remote_email
|
||||
app2.example.com_REVERSE_PROXY_HEADERS=Remote-User $user;Remote-Groups $groups;Remote-Name $name;Remote-Email $email
|
||||
5
examples/authentik/.env
Normal file
5
examples/authentik/.env
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
PG_PASS=changeme
|
||||
AUTHENTIK_SECRET_KEY=changeme
|
||||
AUTHENTIK_COOKIE_DOMAIN=example.com
|
||||
AUTHENTIK_BOOTSTRAP_PASSWORD=changeme
|
||||
AUTHENTIK_BOOTSTRAP_TOKEN=changeme
|
||||
3
examples/authentik/README.md
Normal file
3
examples/authentik/README.md
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
We assume that you are already familiar with [Authentik](https://goauthentik.io/).
|
||||
|
||||
This example has been tested with a Proxy in Forward auth (domain level) mode (see [here](https://goauthentik.io/docs/providers/proxy/forward_auth) for more information).
|
||||
194
examples/authentik/docker-compose.yml
Normal file
194
examples/authentik/docker-compose.yml
Normal file
|
|
@ -0,0 +1,194 @@
|
|||
version: "3.4"
|
||||
|
||||
services:
|
||||
mybunker:
|
||||
image: bunkerity/bunkerweb:1.5.3
|
||||
ports:
|
||||
- 80:8080
|
||||
- 443:8443
|
||||
labels:
|
||||
- "bunkerweb.INSTANCE=yes"
|
||||
networks:
|
||||
- bw-universe
|
||||
- bw-services
|
||||
environment:
|
||||
- MULTISITE=yes
|
||||
- SERVER_NAME=auth.example.com app1.example.com app2.example.com # replace with your domains
|
||||
- API_WHITELIST_IP=127.0.0.0/8 10.20.30.0/24
|
||||
- SERVE_FILES=no
|
||||
- DISABLE_DEFAULT_SERVER=yes
|
||||
- AUTO_LETS_ENCRYPT=yes
|
||||
- USE_CLIENT_CACHE=yes
|
||||
- USE_GZIP=yes
|
||||
- USE_REVERSE_PROXY=yes
|
||||
# Proxy to outpost
|
||||
- REVERSE_PROXY_URL_999=/outpost.goauthentik.io
|
||||
- REVERSE_PROXY_HOST_999=http://server:9000
|
||||
- REVERSE_PROXY_HEADERS_999=X-Original-URL $$scheme://$$http_host$$request_uri;Content-Length ""
|
||||
- REVERSE_PROXY_HEADERS_CLIENT_999=Set-Cookie $$auth_cookie
|
||||
- REVERSE_PROXY_AUTH_REQUEST_SET_999=$$auth_cookie $$upstream_http_set_cookie
|
||||
# Authentik
|
||||
- auth.example.com_REVERSE_PROXY_URL=/
|
||||
- auth.example.com_REVERSE_PROXY_HOST=http://server:9000
|
||||
- auth.example.com_REVERSE_PROXY_WS=yes
|
||||
- auth.example.com_LIMIT_REQ_URL_1=^/api/
|
||||
- auth.example.com_LIMIT_REQ_RATE_1=5r/s
|
||||
- auth.example.com_REVERSE_PROXY_INTERCEPT_ERRORS=no
|
||||
- auth.example.com_ALLOWED_METHODS=GET|POST|HEAD|PUT|DELETE|PATCH
|
||||
- auth.example.com_COOKIE_FLAGS=* SameSite=Lax
|
||||
# Applications
|
||||
- app1.example.com_REVERSE_PROXY_URL=/
|
||||
- app1.example.com_REVERSE_PROXY_HOST=http://app1
|
||||
- app1.example.com_REVERSE_PROXY_AUTH_REQUEST=/outpost.goauthentik.io/auth/nginx
|
||||
- app1.example.com_REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL=https://auth.example.com/outpost.goauthentik.io/start?rd=$$scheme%3A%2F%2F$$host$$request_uri
|
||||
- app1.example.com_REVERSE_PROXY_AUTH_REQUEST_SET=$$auth_cookie $$upstream_http_set_cookie;$$authentik_username $$upstream_http_x_authentik_username;$$authentik_groups $$upstream_http_x_authentik_groups;$$authentik_email $$upstream_http_x_authentik_email;$$authentik_name $$upstream_http_x_authentik_name;$$authentik_uid $$upstream_http_x_authentik_uid
|
||||
- app1.example.com_REVERSE_PROXY_HEADERS_CLIENT=Set-Cookie $$auth_cookie
|
||||
- app1.example.com_REVERSE_PROXY_HEADERS=X-authentik-username $$authentik_username;X-authentik-groups $$authentik_groups;X-authentik-email $$authentik_email;X-authentik-name $$authentik_name;X-authentik-uid $$authentik_uid
|
||||
- app2.example.com_REVERSE_PROXY_URL=/
|
||||
- app2.example.com_REVERSE_PROXY_HOST=http://app2
|
||||
- app2.example.com_REVERSE_PROXY_AUTH_REQUEST=/outpost.goauthentik.io/auth/nginx
|
||||
- app2.example.com_REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL=https://auth.example.com/outpost.goauthentik.io/start?rd=$$scheme%3A%2F%2F$$host$$request_uri
|
||||
- app2.example.com_REVERSE_PROXY_AUTH_REQUEST_SET=$$auth_cookie $$upstream_http_set_cookie;$$authentik_username $$upstream_http_x_authentik_username;$$authentik_groups $$upstream_http_x_authentik_groups;$$authentik_email $$upstream_http_x_authentik_email;$$authentik_name $$upstream_http_x_authentik_name;$$authentik_uid $$upstream_http_x_authentik_uid
|
||||
- app2.example.com_REVERSE_PROXY_HEADERS_CLIENT=Set-Cookie $$auth_cookie
|
||||
- app2.example.com_REVERSE_PROXY_HEADERS=X-authentik-username $$authentik_username;X-authentik-groups $$authentik_groups;X-authentik-email $$authentik_email;X-authentik-name $$authentik_name;X-authentik-uid $$authentik_uid
|
||||
|
||||
bw-scheduler:
|
||||
image: bunkerity/bunkerweb-scheduler:1.5.3
|
||||
depends_on:
|
||||
- mybunker
|
||||
environment:
|
||||
- DOCKER_HOST=tcp://bw-docker-proxy:2375
|
||||
networks:
|
||||
- bw-universe
|
||||
- bw-docker
|
||||
volumes:
|
||||
- bw-data:/data
|
||||
|
||||
bw-docker-proxy:
|
||||
image: tecnativa/docker-socket-proxy:nightly
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
environment:
|
||||
- CONTAINERS=1
|
||||
- LOG_LEVEL=warning
|
||||
networks:
|
||||
- bw-docker
|
||||
|
||||
# APPLICATIONS
|
||||
app1:
|
||||
image: tutum/hello-world
|
||||
networks:
|
||||
- bw-services
|
||||
app2:
|
||||
image: tutum/hello-world
|
||||
networks:
|
||||
- bw-services
|
||||
|
||||
# AUTHENTIK SERVICES
|
||||
postgresql:
|
||||
image: docker.io/library/postgres:12-alpine
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- bw-services
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
|
||||
start_period: 20s
|
||||
interval: 30s
|
||||
retries: 5
|
||||
timeout: 5s
|
||||
volumes:
|
||||
- database:/var/lib/postgresql/data
|
||||
environment:
|
||||
- POSTGRES_PASSWORD=${PG_PASS:?database password required}
|
||||
- POSTGRES_USER=${PG_USER:-authentik}
|
||||
- POSTGRES_DB=${PG_DB:-authentik}
|
||||
env_file:
|
||||
- .env
|
||||
redis:
|
||||
image: docker.io/library/redis:alpine
|
||||
command: --save 60 1 --loglevel warning
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- bw-services
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
|
||||
start_period: 20s
|
||||
interval: 30s
|
||||
retries: 5
|
||||
timeout: 3s
|
||||
volumes:
|
||||
- redis:/data
|
||||
server:
|
||||
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2022.11.2}
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- bw-services
|
||||
command: server
|
||||
environment:
|
||||
AUTHENTIK_REDIS__HOST: redis
|
||||
AUTHENTIK_POSTGRESQL__HOST: postgresql
|
||||
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
|
||||
# AUTHENTIK_ERROR_REPORTING__ENABLED: "true"
|
||||
volumes:
|
||||
- ./media:/media
|
||||
- ./custom-templates:/templates
|
||||
- geoip:/geoip
|
||||
env_file:
|
||||
- .env
|
||||
# ports:
|
||||
# - "0.0.0.0:${AUTHENTIK_PORT_HTTP:-9000}:9000"
|
||||
# - "0.0.0.0:${AUTHENTIK_PORT_HTTPS:-9443}:9443"
|
||||
worker:
|
||||
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2022.11.2}
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- bw-services
|
||||
command: worker
|
||||
environment:
|
||||
AUTHENTIK_REDIS__HOST: redis
|
||||
AUTHENTIK_POSTGRESQL__HOST: postgresql
|
||||
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
|
||||
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
|
||||
# AUTHENTIK_ERROR_REPORTING__ENABLED: "true"
|
||||
# This is optional, and can be removed. If you remove this, the following will happen
|
||||
# - The permissions for the /media folders aren't fixed, so make sure they are 1000:1000
|
||||
# - The docker socket can't be accessed anymore
|
||||
user: root
|
||||
volumes:
|
||||
- ./media:/media
|
||||
- ./certs:/certs
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- ./custom-templates:/templates
|
||||
- geoip:/geoip
|
||||
env_file:
|
||||
- .env
|
||||
geoipupdate:
|
||||
image: "maxmindinc/geoipupdate:latest"
|
||||
networks:
|
||||
- bw-services
|
||||
volumes:
|
||||
- "geoip:/usr/share/GeoIP"
|
||||
environment:
|
||||
GEOIPUPDATE_EDITION_IDS: "GeoLite2-City"
|
||||
GEOIPUPDATE_FREQUENCY: "8"
|
||||
env_file:
|
||||
- .env
|
||||
|
||||
volumes:
|
||||
bw-data:
|
||||
database:
|
||||
redis:
|
||||
geoip:
|
||||
|
||||
networks:
|
||||
bw-universe:
|
||||
name: bw-universe
|
||||
ipam:
|
||||
driver: default
|
||||
config:
|
||||
- subnet: 10.20.30.0/24
|
||||
bw-services:
|
||||
bw-docker:
|
||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue