Merge pull request #1 from szaimen/enh/noid/initial-implementation

Author: szaimen

.github/workflows/docker-build.yml

@@ -38,5 +38,5 @@ jobs:
           context: './'
           no-cache: true
           file: 'Dockerfile'
-          tags: szaimen/aio-fail2ban:${{ github.event.inputs.tagName }}
+          tags: szaimen/aio-caddy:${{ github.event.inputs.tagName }}
           provenance: false

Caddyfile

@@ -0,0 +1,11 @@
+{
+    auto_https disable_redirects
+
+    storage file_system {
+        root /data
+    }
+
+    log {
+        level ERROR
+    }
+}

Dockerfile

@@ -1,15 +1,38 @@
+
+FROM golang:1.21.1-alpine3.18 as go
+
+ENV XCADDY_VERSION 0.3.5
+ENV CADDY_HASH 29233e285b83dfa070d1f6889c021cb32c161b89
+
+# hadolint ignore=DL3018
+RUN set -ex; \
+    apk add --no-cache \
+        build-base; \
+    go install github.com/caddyserver/xcaddy/cmd/xcaddy@"$XCADDY_VERSION"; \
+    chmod +x /go/bin/xcaddy; \
+    /go/bin/xcaddy build --with github.com/porech/caddy-maxmind-geolocation@"$CADDY_HASH"
+
 FROM alpine:3.18.4
 
 # hadolint ignore=DL3018
 RUN set -ex; \
-    apk add --no-cache fail2ban tzdata util-linux-misc bash nftables ip6tables; \
-    mv /etc/fail2ban/filter.d/common.conf /tmp/; \
-    rm -r /etc/fail2ban/jail.d/*; \
-    rm -r /etc/fail2ban/filter.d/*; \
-    mv /tmp/common.conf /etc/fail2ban/filter.d/
+    apk add --no-cache shadow; \
+    deluser www-data; \
+    groupmod -g 333 xfs; \
+    usermod -u 333 -g 333 xfs; \
+    addgroup -g 33 -S www-data; \
+    adduser -u 33 -D -S -G www-data www-data; \
+    apk del shadow; \
+    apk add --no-cache tzdata bash bind-tools netcat-openbsd; \
+    mkdir /data; \
+    chown 33:33 -R /data; \
+    chmod 770 -R /data
+
+VOLUME /data
 
+COPY --from=go /go/bin/caddy /usr/local/bin/caddy
 COPY --chmod=775 start.sh /start.sh
+COPY --chmod=664 Caddyfile /Caddyfile
 
-# hadolint ignore=DL3002
-USER root
+USER www-data
 ENTRYPOINT [ "/start.sh" ]

README.md

@@ -1,2 +1,2 @@
-# aio-fail2ban
-Fail2ban container used in https://github.com/nextcloud/all-in-one/tree/main/community-containers/fail2ban
+# aio-caddy
+Caddy container used in https://github.com/nextcloud/all-in-one/tree/main/community-containers/caddy

start.sh

@@ -1,94 +1,79 @@
 #!/bin/bash
 
-# Fix socket
-rm -f /run/fail2ban/*
-
-if ! mountpoint -q /nextcloud; then
-    echo "/nextcloud is not a mountpoint which it must be!"
+if ! mountpoint -q /data; then
+    echo "/data is not a mountpoint!"
     exit 1
 fi
 
-while ! [ -f /nextcloud/data/nextcloud.log ]; do
-    echo "Waiting for /nextcloud/data/nextcloud.log to become available"
+while ! nc -z nextcloud-aio-nextcloud 9001; do
+    echo "Waiting for nextcloud to start"
     sleep 5
 done
 
-cat << FILTER > /etc/fail2ban/filter.d/nextcloud.conf
-[INCLUDES]
-before = common.conf
-
-[Definition]
-_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
-failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
-            ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
-datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
-FILTER
+set -x
+# Reset the file
+sed -i "/(GEOFILTER)/,$ d" /Cadddyfile
 
-cat << JAIL > /etc/fail2ban/jail.d/nextcloud.local
-[nextcloud]
-enabled = true
-port = 80,443,8080,8443,3478
-protocol = tcp,udp
-filter = nextcloud
-banaction = %(banaction_allports)s
-maxretry = 3
-bantime = 14400
-findtime = 14400
-logpath = /nextcloud/data/nextcloud.log
-chain=DOCKER-USER
-JAIL
+ALLOW_CONTRIES="$(head -n 1 filename /nextcloud/admin/files/nextcloud-aio-caddy/allowed-countries.txt)"
+if echo "$ALLOW_CONTRIES" | grep -q '^[A-Z ]\+$'; then
+    FILTER_SET=1
+fi
+if [ -f "/nextcloud/admin/files/nextcloud-aio-caddy/GeoLite2-Country.mmdb" ]; then
+    rm -f /data/GeoLite2-Country.mmdb
+    cp /nextcloud/admin/files/nextcloud-aio-caddy/GeoLite2-Country.mmdb /data/
+    FILE_THERE=1
+fi
 
-if [ -f /vaultwarden/vaultwarden.log ]; then
-    echo "Configuring vaultwarden for logs"
-    # Vaultwarden conf
-    cat << BW_CONF > /etc/fail2ban/filter.d/vaultwarden.conf
-[INCLUDES]
-before = common.conf
+if [ "$FILTER_SET" = 1 ] && [ "$FILE_THERE" = 1 ]; then
+    cat << CADDY >> /Caddyfile
+(GEOFILTER) {
+    @geofilter {
+        not maxmind_geolocation {
+            db_path "/data/GeoLite2-Country.mmdb"
+            allow_countries $ALLOW_CONTRIES
+        }
+        not remote_ip private_ranges
+    }
+    respond @geofilter 403
+}
+CADDY
+fi
 
-[Definition]
-failregex = ^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$
-ignoreregex =
-BW_CONF
+cat << CADDY >> /Caddyfile
+https://{\$NC_DOMAIN}:443 {
+    # import GEOFILTER
+    reverse_proxy nextcloud-aio-apache:{\$APACHE_PORT}
 
-    # Vaultwarden jail
-    cat << BW_JAIL_CONF > /etc/fail2ban/jail.d/vaultwarden.local
-[vaultwarden]
-enabled = true
-port = 80,443,8812
-protocol = tcp,udp
-filter = vaultwarden
-banaction = %(banaction_allports)s
-logpath = /vaultwarden/vaultwarden.log
-maxretry = 3
-bantime = 14400
-findtime = 14400
-chain=DOCKER-USER
-BW_JAIL_CONF
+    # TLS options
+    tls {
+        issuer acme {
+            disable_http_challenge
+        }
+    }
+}
+CADDY
 
-    # Vaultwarden-admin conf
-    cat << BWA_CONF > /etc/fail2ban/filter.d/vaultwarden-admin.conf
-[INCLUDES]
-before = common.conf
+if [ -n "$(dig A +short nextcloud-aio-vaultwarden)" ]; then
+    cat << CADDY >> /Caddyfile
+https://bw.{\$NC_DOMAIN}:443 {
+    # import GEOFILTER
+    reverse_proxy nextcloud-aio-vaultwarden:8812
 
-[Definition]
-failregex = ^.*Invalid admin token\. IP: <ADDR>.*$
-ignoreregex =
-BWA_CONF
+    # TLS options
+    tls {
+        issuer acme {
+            disable_http_challenge
+        }
+    }
+}
+CADDY
+fi
 
-    # Vaultwarden-admin jail
-    cat << BWA_JAIL_CONF > /etc/fail2ban/jail.d/vaultwarden-admin.local
-[vaultwarden-admin]
-enabled = true
-port = 80,443,8812
-protocol = tcp,udp
-filter = vaultwarden-admin
-banaction = %(banaction_allports)s
-logpath = /vaultwarden/vaultwarden.log
-maxretry = 3
-bantime = 14400
-findtime = 14400
-chain=DOCKER-USER
-BWA_JAIL_CONF
+if [ "$FILTER_SET" = 1 ] && [ "$FILE_THERE" = 1 ]; then
+    sed -i "s|# import GEOFILTER|import GEOFILTER|" /Caddyfile
 fi
+set +x
+
+caddy fmt --overwrite /Caddyfile
 
-fail2ban-server -f --logtarget stderr --loglevel info 
+caddy run --config /Caddyfile