diff options
| -rw-r--r-- | .gitignore | 1 | ||||
| -rw-r--r-- | Readme.md | 103 | ||||
| -rw-r--r-- | doc/December.drawio | 178 | ||||
| -rw-r--r-- | ghost/.env.example | 55 | ||||
| -rw-r--r-- | ghost/compose.yml | 105 | ||||
| -rw-r--r-- | ghost/mysql-init-script/create-multiple-databases.sh | 18 | ||||
| -rw-r--r-- | ghost/stack.env | 54 | ||||
| -rw-r--r-- | git-server/Dockerfile | 35 | ||||
| -rw-r--r-- | git-server/Readme.md | 1 | ||||
| -rwxr-xr-x | git-server/git-shell-commands/no-interactive-login | 5 | ||||
| -rw-r--r-- | git-server/git.service | 11 | ||||
| -rw-r--r-- | git-server/server.yaml | 27 | ||||
| -rw-r--r-- | git-server/sshd_config | 145 | ||||
| -rw-r--r-- | git-server/start.sh | 27 | ||||
| -rw-r--r-- | nginx/docker-compose.yaml | 25 | ||||
| -rw-r--r-- | nginx/letsencrypt/index.html | 11 | ||||
| -rw-r--r-- | nginx/nginx.conf | 52 | ||||
| -rw-r--r-- | nginx/run_certbot.sh | 21 |
18 files changed, 874 insertions, 0 deletions
diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..4c49bd7 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.env diff --git a/Readme.md b/Readme.md new file mode 100644 index 0000000..bb77cd9 --- /dev/null +++ b/Readme.md @@ -0,0 +1,103 @@ +# BASTION +It's server system, that serves for control projects. + + +## Architecture +All architecture can be seen in Documentation/bastion.{jpg/drawio} + +Bastion are separates on parts (stacks), that works in containers + + + +## Host + +Requirments +1) debian + +2) docker + +installing docker: https://docs.docker.com/engine/install/debian/#install-using-the-repository + +## Each stack + +### Portainer +Portainer is great option for control docker on machine and fast deploy stacks. + +docker run -d --name="portainer" --restart on-failure -p 9000:9000 -p 8000:8000 -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:latest + +### Nginx +Main Web server. Through it each other container goes out. +Locates on each stack network (to working reverse proxy) + +Has one working container +Web-Server container +main nginx container, has outs to 80, 8000, 443 +has next volumes: +1. nginx conf directory, each service has own nginx file +2. letsencrypt etc - letsencrypt SSL certs +3. lts_site - letsencrypt plug site (now not works) +4. dhparam - dhparam cert + +certbot +letsencrypt container, that gives certs to certs volume +for work need running nginx container (acma) (and in firtst case it needed to disable ssl part of nginx conf) +it runs via run_certbot.sh script, where i can setup email, domian... + + +Instruction for build +1) create directories: +a. nginx conf (f.e. /var/nginx/conf) and copy nginx.conf to it +b. dh_param (f.e. /var/dh_param) and create cert: sudo openssl dhparam -out dhparam-2048.pem 2048 +c. letsencrypt dir (f.e. /var/letsencrypt) and two subdirs for it: + c.a. /var/letsencrypt/etc - for lts certificates + c.b. /var/letsencrypt/lts_site - for lts site (now not worknig :( ) and copy index.html to it + +2) run nginx server +docker compose up +IMPORTANT: now there is bug, where i can run nginx without ready certs, therefore it needed to comment ssl part of nginx.conf +3) run certbot script, it will create certs +4) rerun nginx server (with uncommented SSL part) + +TODO: +1) make automatic renew of certificate +2) make normal locating of nginx configs + +Usefull links: +https://phoenixnap.com/kb/letsencrypt-docker +https://stackoverflow.com/questions/51399883/adding-ssl-certs-to-nginx-docker-container + + + + +### Ghost +### Git +Git stack has git server, cgit and gerrit. + +Git server, that provides access to git repos via ssh(22 port) and git(9418) +It's simple container with openssh, git and git daemon. + +Based on https://github.com/jkarlosb/git-server-docker/ + +Notes: +1) git daemon runnnig via runuser, because we need to run daemon from git user + +Usefull links: +https://gpanders.com/blog/creating-your-own-git-server +https://linuxconfig.org/how-to-export-repositories-with-the-git-daemon +https://askubuntu.com/questions/1550366/ssh-sshd-breaking-changes-in-24-04 (why choose debian instead of ubuntu) + +TODO: +1) maybe create git.service with systemd (somehow) instead of running from script with detach? + + +Cgit + +### Jenkins +### Nexus + + +## Firewall +ATM is developing +In final it must allow only 80,8080, 8000, 443, 22, 4096, ssh port and maybe some debug purpose port + +## Backup diff --git a/doc/December.drawio b/doc/December.drawio new file mode 100644 index 0000000..c433002 --- /dev/null +++ b/doc/December.drawio @@ -0,0 +1,178 @@ +<mxfile host="app.diagrams.net" agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" version="29.2.9"> + <diagram name="Page-1" id="vdW78jsPRzWQe5W3cWmC"> + <mxGraphModel dx="2528" dy="2031" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0"> + <root> + <mxCell id="0" /> + <mxCell id="1" parent="0" /> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-18" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;dashed=1;dashPattern=8 4 1 4;verticalAlign=top;align=left;" value="GHOST NETWORK" vertex="1"> + <mxGeometry height="580" width="630" x="-460" y="300" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-11" parent="1" style="rounded=0;whiteSpace=wrap;html=1;dashed=1;fillColor=none;align=left;verticalAlign=top;" value="GHOST STACK" vertex="1"> + <mxGeometry height="480" width="530" x="-390" y="350" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-1" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="NGINX" vertex="1"> + <mxGeometry height="60" width="120" x="430" y="200" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-4" parent="1" style="ellipse;shape=cloud;whiteSpace=wrap;html=1;" value="swave.lol" vertex="1"> + <mxGeometry height="80" width="120" x="420" y="-40" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-6" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.775;entryY=0.913;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-4"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-7" connectable="0" parent="ukYa1G1XDBr4NXfLDrGU-6" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" value="443" vertex="1"> + <mxGeometry relative="1" x="0.5697" y="-7" as="geometry"> + <mxPoint as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-9" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-8" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" target="ukYa1G1XDBr4NXfLDrGU-1"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-17" connectable="0" parent="ukYa1G1XDBr4NXfLDrGU-9" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" value="2368" vertex="1"> + <mxGeometry relative="1" x="0.0371" as="geometry"> + <mxPoint as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-8" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="GHOST" vertex="1"> + <mxGeometry height="60" width="120" x="-170" y="380" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-26" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-10" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" target="ukYa1G1XDBr4NXfLDrGU-25"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-10" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="<div>GHOST-DB</div><div>(mysql)</div>" vertex="1"> + <mxGeometry height="60" width="120" x="-300" y="570" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-13" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="ACTIVITYPUB" vertex="1"> + <mxGeometry height="60" width="120" x="-300" y="460" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-23" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-15" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" target="ukYa1G1XDBr4NXfLDrGU-21"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-15" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="ACTIVITYPUB MIGRATE (executes ones)" vertex="1"> + <mxGeometry height="60" width="120" y="430" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-21" parent="1" style="shape=cylinder3;whiteSpace=wrap;html=1;boundedLbl=1;backgroundOutline=1;size=15;" value="GHOST_DATA&nbsp;<div>locates on host: /var/ghost</div>" vertex="1"> + <mxGeometry height="100" width="150" x="-80" y="620" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-22" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-8" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-21"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-24" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-13" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-21"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-25" parent="1" style="shape=cylinder3;whiteSpace=wrap;html=1;boundedLbl=1;backgroundOutline=1;size=15;" value="MYSQL_DB<div>locates on host: /var/mysql_db</div>" vertex="1"> + <mxGeometry height="110" width="180" x="-330" y="700" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-29" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-28" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=1;entryY=0.5;entryDx=0;entryDy=0;" target="ukYa1G1XDBr4NXfLDrGU-1"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-30" connectable="0" parent="ukYa1G1XDBr4NXfLDrGU-29" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" value="9000" vertex="1"> + <mxGeometry relative="1" x="-0.0014" y="-1" as="geometry"> + <mxPoint as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-28" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="PORTAINER.IO" vertex="1"> + <mxGeometry height="60" width="120" x="840" y="20" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-31" parent="1" style="shape=cylinder3;whiteSpace=wrap;html=1;boundedLbl=1;backgroundOutline=1;size=15;" value="portainer_data" vertex="1"> + <mxGeometry height="80" width="120" x="730" y="150" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-32" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-28" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-31"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-33" parent="1" style="shape=cylinder3;whiteSpace=wrap;html=1;boundedLbl=1;backgroundOutline=1;size=15;" value="docker.sock" vertex="1"> + <mxGeometry height="80" width="110" x="910" y="150" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-34" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-28" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-33"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-35" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-1" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.454;entryY=0.936;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-4"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-36" connectable="0" parent="ukYa1G1XDBr4NXfLDrGU-35" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" value="80" vertex="1"> + <mxGeometry relative="1" x="0.4183" y="-1" as="geometry"> + <mxPoint as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-37" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;dashed=1;dashPattern=8 4 1 4;align=left;verticalAlign=top;" value="JENKINS NETWORK" vertex="1"> + <mxGeometry height="480" width="570" x="650" y="340" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-38" parent="1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=none;strokeColor=default;dashed=1;dashPattern=8 4 1 4;align=left;verticalAlign=top;" value="NEXUS ARTIFACTS NETWORK" vertex="1"> + <mxGeometry height="300" width="410" x="210" y="340" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-46" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-40" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=1;entryDx=0;entryDy=0;" target="ukYa1G1XDBr4NXfLDrGU-1"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-40" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="NEXUS" vertex="1"> + <mxGeometry height="60" width="120" x="360" y="370" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-41" parent="1" style="shape=cylinder3;whiteSpace=wrap;html=1;boundedLbl=1;backgroundOutline=1;size=15;" value="ARTIFACTORY<div>locates on host: /var/artifactory</div>" vertex="1"> + <mxGeometry height="120" width="190" x="370" y="490" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-43" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-40" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-41"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-47" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-44" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=1;entryY=0.75;entryDx=0;entryDy=0;" target="ukYa1G1XDBr4NXfLDrGU-1"> + <mxGeometry relative="1" as="geometry"> + <Array as="points"> + <mxPoint x="850" y="245" /> + </Array> + </mxGeometry> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-59" connectable="0" parent="ukYa1G1XDBr4NXfLDrGU-47" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" value="8080" vertex="1"> + <mxGeometry relative="1" x="-0.6204" y="1" as="geometry"> + <mxPoint as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-54" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-44" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" target="ukYa1G1XDBr4NXfLDrGU-50"> + <mxGeometry relative="1" as="geometry"> + <Array as="points"> + <mxPoint x="850" y="540" /> + <mxPoint x="1060" y="540" /> + </Array> + </mxGeometry> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-55" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-44" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" target="ukYa1G1XDBr4NXfLDrGU-48"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-56" connectable="0" parent="ukYa1G1XDBr4NXfLDrGU-55" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" value="run jobs" vertex="1"> + <mxGeometry relative="1" x="-0.1179" y="-1" as="geometry"> + <mxPoint as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-57" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-44" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=1;entryY=0.75;entryDx=0;entryDy=0;" target="ukYa1G1XDBr4NXfLDrGU-1"> + <mxGeometry relative="1" as="geometry"> + <Array as="points"> + <mxPoint x="810" y="245" /> + </Array> + </mxGeometry> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-58" connectable="0" parent="ukYa1G1XDBr4NXfLDrGU-57" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" value="50000" vertex="1"> + <mxGeometry relative="1" x="-0.6026" y="-2" as="geometry"> + <mxPoint as="offset" /> + </mxGeometry> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-44" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="JENKINS" vertex="1"> + <mxGeometry height="60" width="120" x="790" y="370" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-45" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-44" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=1;entryY=0.5;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-41"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-51" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-48" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;" target="ukYa1G1XDBr4NXfLDrGU-50"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-48" parent="1" style="rounded=0;whiteSpace=wrap;html=1;" value="JENKINS-DOCKER" vertex="1"> + <mxGeometry height="60" width="120" x="990" y="370" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-49" parent="1" style="shape=cylinder3;whiteSpace=wrap;html=1;boundedLbl=1;backgroundOutline=1;size=15;" value="JENKINS_DATA" vertex="1"> + <mxGeometry height="100" width="170" x="720" y="650" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-50" parent="1" style="shape=cylinder3;whiteSpace=wrap;html=1;boundedLbl=1;backgroundOutline=1;size=15;" value="JENKINS_CERTS" vertex="1"> + <mxGeometry height="90" width="160" x="980" y="650" as="geometry" /> + </mxCell> + <mxCell id="ukYa1G1XDBr4NXfLDrGU-53" edge="1" parent="1" source="ukYa1G1XDBr4NXfLDrGU-44" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;" target="ukYa1G1XDBr4NXfLDrGU-49"> + <mxGeometry relative="1" as="geometry" /> + </mxCell> + </root> + </mxGraphModel> + </diagram> +</mxfile> diff --git a/ghost/.env.example b/ghost/.env.example new file mode 100644 index 0000000..b15abff --- /dev/null +++ b/ghost/.env.example @@ -0,0 +1,55 @@ +# Based on https://github.com/TryGhost/ghost-docker +# + +# Use the below flags to enable the Analytics or ActivityPub containers as well +COMPOSE_PROFILES=activitypub + +# Ghost domain +# Custom public domain Ghost will run on +DOMAIN=swawe.lol + +# Ghost Admin domain +# If you have Ghost Admin setup on a separate domain uncomment the line below and add the domain +# You also need to uncomment the corresponding block in your Caddyfile +# ADMIN_DOMAIN= + +# Database settings +# All database settings must not be changed once the database is initialised +DATABASE_ROOT_PASSWORD= +DATABASE_USER= +DATABASE_PASSWORD= + +# ActivityPub +# If you'd prefer to self-host ActivityPub yourself uncomment the line below +ACTIVITYPUB_TARGET=activitypub:8080 + +# Ghost configuration (https://ghost.org/docs/config/) + +# SMTP Email (https://ghost.org/docs/config/#mail) +# Transactional email is required for logins, account creation (staff invites), password resets and other features +# This is not related to bulk mail / newsletter sending +#mail__transport=SMTP +#mail__options__host=smtp.example.com +#mail__options__port=465 +#mail__options__secure=true +#mail__options__auth__user=postmaster@example.com +#mail__options__auth__pass=1234567890 + +# Advanced customizations + +# Force Ghost version +# You should only do this if you need to pin a specific version +# The update commands won't work +# GHOST_VERSION=6-alpine + +# Port Ghost should listen on +# You should only need to edit this if you want to host +# multiple sites on the same server +# GHOST_PORT=2368 + +# Data locations +# Location to store uploaded data +UPLOAD_LOCATION=./docker/ghost/ + +# Location for database data +MYSQL_DATA_LOCATION=./docker/mysql diff --git a/ghost/compose.yml b/ghost/compose.yml new file mode 100644 index 0000000..10ca118 --- /dev/null +++ b/ghost/compose.yml @@ -0,0 +1,105 @@ +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/compose-spec/compose-spec/main/schema/compose-spec.json +# Based on https://github.com/TryGhost/ghost-docker and https://noted.lol/self-host-ghost/ +# I removed caddy and tinnybird +services: + + ghost: + # Do not alter this without updating the Tinybird Sync container as well + image: ghost:${GHOST_VERSION:-6-alpine} + restart: always + ports: # we need ports for testing + - 2368:2368 + #expose: + #- "127.0.0.1:${GHOST_PORT:-2368}" + # This is required to import current config when migrating + # IMPORTANT + # In usual install use .env + # In case of portainer.io use stack.env + env_file: + stack.env + environment: + NODE_ENV: production + url: http://${DOMAIN:?DOMAIN environment variable is required} + #url: https://${DOMAIN:?DOMAIN environment variable is required} ATM i have not SSL for it + #admin__url: ${ADMIN_DOMAIN:+https://${ADMIN_DOMAIN}} + admin__url: ${ADMIN_DOMAIN:+http://${ADMIN_DOMAIN}} + database__client: mysql + database__connection__host: ghost-db + database__connection__user: ${DATABASE_USER:-ghost} + database__connection__password: ${DATABASE_PASSWORD:?DATABASE_PASSWORD environment variable is required} + database__connection__database: ghost + volumes: + - ${UPLOAD_LOCATION:-./data/ghost}:/var/lib/ghost/content + depends_on: + ghost-db: + condition: service_healthy + activitypub: + condition: service_started + required: false + networks: + - ghost_network + + ghost-db: + image: mysql:8 + restart: always + expose: + - "3306" + environment: + MYSQL_ROOT_PASSWORD: ${DATABASE_ROOT_PASSWORD:?DATABASE_ROOT_PASSWORD environment variable is required} + MYSQL_USER: ${DATABASE_USER:-ghost} + MYSQL_PASSWORD: ${DATABASE_PASSWORD:?DATABASE_PASSWORD environment variable is required} + MYSQL_DATABASE: ghost + MYSQL_MULTIPLE_DATABASES: activitypub + volumes: + - /var/lib/docker/mysql-init-script:/docker-entrypoint-initdb.d + - ${MYSQL_DATA_LOCATION:-./data/mysql}:/var/lib/mysql + healthcheck: + test: mysqladmin ping -p$$MYSQL_ROOT_PASSWORD -h 127.0.0.1 + interval: 1s + start_period: 30s + start_interval: 10s + retries: 120 + networks: + - ghost_network + + activitypub: + image: ghcr.io/tryghost/activitypub:1.1.0 + restart: always + expose: + - "8080" + volumes: + - ${UPLOAD_LOCATION:-./data/ghost}:/opt/activitypub/content + environment: + # See https://github.com/TryGhost/ActivityPub/blob/main/docs/env-vars.md + NODE_ENV: production + MYSQL_HOST: ghost-db + MYSQL_USER: ${DATABASE_USER:-ghost} + MYSQL_PASSWORD: ${DATABASE_PASSWORD:?DATABASE_PASSWORD environment variable is required} + MYSQL_DATABASE: activitypub + LOCAL_STORAGE_PATH: /opt/activitypub/content/images/activitypub + LOCAL_STORAGE_HOSTING_URL: https://${DOMAIN}/content/images/activitypub + depends_on: + ghost-db: + condition: service_healthy + activitypub-migrate: + condition: service_completed_successfully + profiles: [activitypub] + networks: + - ghost_network + + # Suporting Services + activitypub-migrate: + image: ghcr.io/tryghost/activitypub-migrations:1.1.0 + environment: + MYSQL_DB: mysql://${DATABASE_USER:-ghost}:${DATABASE_PASSWORD:?DATABASE_PASSWORD environment variable is required}@tcp(ghost-db:3306)/activitypub + networks: + - ghost_network + depends_on: + ghost-db: + condition: service_healthy + profiles: [activitypub] + restart: no + +networks: + ghost_network: diff --git a/ghost/mysql-init-script/create-multiple-databases.sh b/ghost/mysql-init-script/create-multiple-databases.sh new file mode 100644 index 0000000..6b0d32e --- /dev/null +++ b/ghost/mysql-init-script/create-multiple-databases.sh @@ -0,0 +1,18 @@ +#!/bin/bash + +set -e +set -u + +if [ -n "$MYSQL_MULTIPLE_DATABASES" ]; then + echo "Creating multiple databases: $MYSQL_MULTIPLE_DATABASES" + + for db in $(echo "$MYSQL_MULTIPLE_DATABASES" | tr ',' ' '); do + echo "Creating database: $db" + mysql -u root -p"$MYSQL_ROOT_PASSWORD" <<-EOSQL + CREATE DATABASE IF NOT EXISTS \`$db\`; + GRANT ALL ON \`$db\`.* TO '$MYSQL_USER'@'%'; +EOSQL + done + + echo "Multiple databases created" +fi diff --git a/ghost/stack.env b/ghost/stack.env new file mode 100644 index 0000000..941f07e --- /dev/null +++ b/ghost/stack.env @@ -0,0 +1,54 @@ +# Based on https://github.com/TryGhost/ghost-docker +# + +# Use the below flags to enable the Analytics or ActivityPub containers as well +COMPOSE_PROFILES=activitypub + +# Ghost domain +# Custom public domain Ghost will run on +DOMAIN=swave.lol:2368 + +# Ghost Admin domain +# If you have Ghost Admin setup on a separate domain uncomment the line below and add the domain +# You also need to uncomment the corresponding block in your Caddyfile +# ADMIN_DOMAIN= + +# Database settings +# All database settings must not be changed once the database is initialised +DATABASE_ROOT_PASSWORD=ghostuserp@ssword +DATABASE_USER=ghost +DATABASE_PASSWORD=ghostghostpasswOrd +# ActivityPub +# If you'd prefer to self-host ActivityPub yourself uncomment the line below +ACTIVITYPUB_TARGET=activitypub:8080 + +# Ghost configuration (https://ghost.org/docs/config/) + +# SMTP Email (https://ghost.org/docs/config/#mail) +# Transactional email is required for logins, account creation (staff invites), password resets and other features +# This is not related to bulk mail / newsletter sending +#mail__transport=SMTP +#mail__options__host=smtp.example.com +#mail__options__port=465 +#mail__options__secure=true +#mail__options__auth__user=postmaster@example.com +#mail__options__auth__pass=1234567890 + +# Advanced customizations + +# Force Ghost version +# You should only do this if you need to pin a specific version +# The update commands won't work +# GHOST_VERSION=6-alpine + +# Port Ghost should listen on +# You should only need to edit this if you want to host +# multiple sites on the same server +# GHOST_PORT=2368 + +# Data locations +# Location to store uploaded data +UPLOAD_LOCATION=./docker/ghost/ + +# Location for database data +MYSQL_DATA_LOCATION=./docker/mysql diff --git a/git-server/Dockerfile b/git-server/Dockerfile new file mode 100644 index 0000000..b8a905f --- /dev/null +++ b/git-server/Dockerfile @@ -0,0 +1,35 @@ +#Use basic ubuntu to git server and git daemon +FROM debian:latest + +RUN apt-get -y update && apt-get -y install openssh-server git + +# Key generation on the server +RUN ssh-keygen -A + +WORKDIR /git-server/ + +# -D flag avoids password generation +# -s flag changes user's shell +RUN mkdir /git-server/keys \ + && adduser --disabled-password --shell /usr/bin/git-shell git \ + && echo git:12345 | chpasswd \ + && mkdir /home/git/.ssh + + +# This is a login shell for SSH accounts to provide restricted Git access. +# It permits execution only of server-side Git commands implementing the +# pull/push functionality, plus custom commands present in a subdirectory +# named git-shell-commands in the user’s home directory. +# More info: https://git-scm.com/docs/git-shell +COPY git-shell-commands /home/git/git-shell-commands + + +# sshd_config file is edited for enable access key and disable access password +COPY sshd_config /etc/ssh/sshd_config +COPY start.sh start.sh +#COPY git.service /etc/systemd/git.service + +EXPOSE 22 +EXPOSE 9418 + +CMD ["sh", "start.sh"] diff --git a/git-server/Readme.md b/git-server/Readme.md new file mode 100644 index 0000000..60e0073 --- /dev/null +++ b/git-server/Readme.md @@ -0,0 +1 @@ +Based on https://github.com/jkarlosb/git-server-docker/ diff --git a/git-server/git-shell-commands/no-interactive-login b/git-server/git-shell-commands/no-interactive-login new file mode 100755 index 0000000..cb88a07 --- /dev/null +++ b/git-server/git-shell-commands/no-interactive-login @@ -0,0 +1,5 @@ +#!/bin/sh +printf '%s\n' "Welcome to git-server-docker!" +printf '%s\n' "You've successfully authenticated, but I do not" +printf '%s\n' "provide interactive shell access." +exit 128 diff --git a/git-server/git.service b/git-server/git.service new file mode 100644 index 0000000..f7df6a4 --- /dev/null +++ b/git-server/git.service @@ -0,0 +1,11 @@ +[Unit] +Description=Start Git Daemon + +[Service] +User=git +Group=git +ExecStart=/usr/bin/git daemon --reuseaddr --base-path=/repos --export-all --informative-errors --verbose +StandardError=journal + +[Install] +WantedBy=multi-user.target diff --git a/git-server/server.yaml b/git-server/server.yaml new file mode 100644 index 0000000..af6b381 --- /dev/null +++ b/git-server/server.yaml @@ -0,0 +1,27 @@ +version: '2' + +services: + + git-server: + image: git-server + restart: always + container_name: git-server + ports: + - "22:22" + - "9418:9418" + volumes: + - /var/git_ssh_keys:/git-server/keys + - /var/git:/repos + networks: + git-network: + ipv4_address: 172.22.0.2 + + +networks: + git-network: + name: git-network + driver: bridge + ipam: + config: + - subnet: 172.22.0.0/16 + gateway: 172.22.0.1 diff --git a/git-server/sshd_config b/git-server/sshd_config new file mode 100644 index 0000000..102169d --- /dev/null +++ b/git-server/sshd_config @@ -0,0 +1,145 @@ +# $OpenBSD: sshd_config,v 1.98 2016/02/17 05:29:04 djm Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +# The default requires explicit activation of protocol 1 +#Protocol 2 + +# HostKey for protocol version 1 +#HostKey /etc/ssh/ssh_host_key +# HostKeys for protocol version 2 +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_dsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Lifetime and size of ephemeral version 1 server key +#KeyRegenerationInterval 1h +#ServerKeyBits 1024 + +# Ciphers and keying +#RekeyLimit default none + +# Logging +# obsoletes QuietMode and FascistLogging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +#PermitRootLogin prohibit-password +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +# RSAAuthentication yes +PubkeyAuthentication yes + +# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 +# but this is overridden so installations will only check .ssh/authorized_keys +AuthorizedKeysFile .ssh/authorized_keys +#AuthorizedKeysFile /home/git/.ssh/authorized_keys + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#RhostsRSAAuthentication no +# similar for protocol version 2 +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# RhostsRSAAuthentication and HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +PasswordAuthentication no +#PermitEmptyPasswords no + +# Change to no to disable s/key passwords +#ChallengeResponseAuthentication yes + +# Kerberos options (deprecated) +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options (deprecated) +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +#UsePAM no + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +#X11Forwarding no +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +#PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +#UseLogin no +#UsePrivilegeSeparation sandbox +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#UseDNS no +#PidFile /run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# override default of no subsystems +Subsystem sftp /usr/lib/ssh/sftp-server + +# the following are HPN related configuration options +# tcp receive buffer polling. disable in non autotuning kernels +#TcpRcvBufPoll yes + +# disable hpn performance boosts +#HPNDisabled no + +# buffer size for hpn to non-hpn connections +#HPNBufferSize 2048 + + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server diff --git a/git-server/start.sh b/git-server/start.sh new file mode 100644 index 0000000..dcfb471 --- /dev/null +++ b/git-server/start.sh @@ -0,0 +1,27 @@ +#!/bin/sh + +# If there is some public key in keys folder +# then it copies its contain in authorized_keys file +if [ "$(ls -A /git-server/keys/)" ]; then + cd /home/git + cat /git-server/keys/*.pub > .ssh/authorized_keys + chown -R git:git .ssh + chmod 700 .ssh + chmod -R 600 .ssh/* +fi + +# Checking permissions and fixing SGID bit in repos folder +# More info: https://github.com/jkarlosb/git-server-docker/issues/1 +if [ "$(ls -A /repos/)" ]; then + cd /repos + chown -R git:git . + chmod -R ug+rwX . + find . -type d -exec chmod g+s '{}' + +fi + +# Run git daemon +#systemctl enable --now git.service +runuser -u git -- git daemon --reuseaddr --base-path=/repos --export-all --informative-errors --verbose --detach + +# -D flag avoids executing sshd as a daemon +/usr/sbin/sshd -D diff --git a/nginx/docker-compose.yaml b/nginx/docker-compose.yaml new file mode 100644 index 0000000..8aa8c4e --- /dev/null +++ b/nginx/docker-compose.yaml @@ -0,0 +1,25 @@ +version: '3' + +services: + webserver: + image: nginx:latest + ports: + - 80:80 + #- 8000:8000 + - 443:443 + restart: always + volumes: + - /var/nginx/conf/:/etc/nginx/conf.d:ro + - /var/letsencrypt/etc:/var/letsencrypt/etc:ro #letsencrypt SSL certs + - /var/letsencrypt/lts_site:/var/letsencrypt/lts_site:ro #letsencrypt plug site + - /var/dh_param/dhparam-2048.pem:/etc/ssl/certs/dhparam-2048.pem #dhparam cert + networks: + git-network: + ipv4_address: 172.22.0.254 + +networks: + #write each stack network (or connect it manually later) + git-network: + name: git-network + external: true + diff --git a/nginx/letsencrypt/index.html b/nginx/letsencrypt/index.html new file mode 100644 index 0000000..bd4cee4 --- /dev/null +++ b/nginx/letsencrypt/index.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8" /> + <title>LetsEncrypt Certs setup</title> +</head> +<body> + + <p>LetsEncrypt Certs setup</p> +</body> +</html> diff --git a/nginx/nginx.conf b/nginx/nginx.conf new file mode 100644 index 0000000..9e49ae7 --- /dev/null +++ b/nginx/nginx.conf @@ -0,0 +1,52 @@ +error_log /var/log/nginx/error.log warn; + +server { + listen 80; + listen [::]:80; + + server_name swave.lol; + + location / { + rewrite ^ https://$host$request_uri? permanent; + } + + #for certbot challenges (renewal process) + location ~ /.well-known/acme-challenge { + allow all; + root /var/letsencrypt/lts_site; + } +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name swave.com; + + server_tokens off; + + ssl_certificate /var/letsencrypt/etc/letsencrypt/live/swave.lol/fullchain.pem; + ssl_certificate_key /var/letsencrypt/etc/letsencrypt/live/swave.lol/privkey.pem; + + ssl_buffer_size 8k; + + ssl_dhparam /etc/ssl/certs/dhparam-2048.pem; + + ssl_protocols TLSv1.2 TLSv1.1 TLSv1; + ssl_prefer_server_ciphers on; + + ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5; + + ssl_ecdh_curve secp384r1; + ssl_session_tickets off; + + # OCSP stapling + ssl_stapling on; + ssl_stapling_verify on; + resolver 8.8.8.8; + + + # Define the specified charset to the “Content-Type” response header field + charset utf-8; +} + diff --git a/nginx/run_certbot.sh b/nginx/run_certbot.sh new file mode 100644 index 0000000..27e9127 --- /dev/null +++ b/nginx/run_certbot.sh @@ -0,0 +1,21 @@ +#!/bin/bash + +email=arseney300@gmail.com +domain=swave.lol +dir=/var/ +lts_dir=$dir/letsencrypt + +#create dir for lts etc +mkdir $lts_dir/etc +mkdir $lts_dir/lts_site +cp letsencrypt/index.html $lts_dir/lts_site + +docker run -it --rm \ + -v $lts_dir/etc:/etc/letsencrypt \ + -v $lts_dir/lts_site:/data/letsencrypt \ + certbot/certbot \ + certonly --webroot \ + --email $email \ + --agree-tos --no-eff-email \ + --webroot-path=/data/letsencrypt \ + -d $domain |