Skip to content

Commit 4bdc4b1

Browse files
bfrenbfren
authored
v7.0.0 (#155)
Major updates * All init / request / regenerate executables now support single domains - use `-d XXXXXX` * Adding support for NAXSI web application firewall - use `PROXY_ENABLE_NAXSI=1` Minor updates * Using latest base image * Renaming `PROXY_URI` to `PROXY_DOMAIN` (if you don't rename you'll get a warning in logs but it will still work) * Adding more debug output Documentation updates * Adding new arguments to README
1 parent e5f239e commit 4bdc4b1

40 files changed

+690
-171
lines changed

‎Dockerfile‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,14 @@ ARG BF_VERSION
99
EXPOSE 443
1010

1111
ENV \
12-
# the base URI of the proxy server (will be used when SSL bindings fail)
13-
PROXY_URI= \
12+
# the base domain of the proxy server (will be used when SSL bindings fail)
13+
PROXY_DOMAIN= \
1414
# clean all config and certificates before doing anything else
1515
PROXY_CLEAN_INSTALL=0 \
1616
# enable automatic certificate updating
1717
PROXY_ENABLE_AUTO_UPDATE=1 \
18+
# enable NAXSI web application firewall
19+
PROXY_ENABLE_NAXSI=0 \
1820
# use hardened mode (remove old / insecure ciphers and protocols)
1921
PROXY_HARDEN=0 \
2022
# used for renewal notification emails

‎README.md‎

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
[Docker Repository](https://hub.docker.com/r/bfren/nginx-proxy) - [bfren ecosystem](https://github.com/bfren/docker)
66

7-
Nginx Proxy which uses [getssl](https://github.com/srvrco/getssl) to automate requesting and renewing SSL certificates via Let's Encrypt. Certificates are checked for renewal every day - the last check can be viewed in the `/ssl` volume.
7+
Nginx Proxy which uses [getssl](https://github.com/srvrco/getssl) to automate requesting and renewing SSL certificates via Let's Encrypt. Certificates are checked for renewal every day - the last check can be viewed in the `/ssl` volume. Also includes [NAXSI](https://github.com/nbs-system/naxsi), a web application firewall.
88

99
As of v4, configuration is handled via a JSON file - see ssl-conf-sample.json for an example and ssl-conf-schema.json for the full file definition.
1010

@@ -36,33 +36,34 @@ For SSL certificate requests to work correctly, ports 80 and 443 need mapping fr
3636

3737
| Variable | Values | Description | Default |
3838
| ------------------------------------- | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
39-
| `PROXY_URI` | URI | The base URI of the proxy server - will be used to handle unbound requests. | *None* - **required** |
39+
| `PROXY_AUTO_PRIMARY` | URI | If set (along with PROXY_AUTO_UPSTREAM) SSL config will be generated on first startup. | *None* |
40+
| `PROXY_AUTO_UPSTREAM` | URI | If set (along with PROXY_AUTO_PRIMARY) SSL config will be generated on first startup. | *None* |
41+
| `PROXY_AUTO_ALIASES` | string of URIs | Add aliases to the auto-generated conf.json on first startup. | *None* |
42+
| `PROXY_AUTO_CUSTOM` | 0 or 1 | Mark the auto-generated SSL config to 'custom' so the Nginx configuration is not regenerated on startup. | 0 |
4043
| `PROXY_CLEAN_INSTALL` | 0 or 1 | If 1, all Nginx and SSL configuration and certificates will be deleted and regenerated. | 0 |
44+
| `PROXY_DOMAIN` | URI | The base domain of the proxy server - will be used to handle unbound requests. | *None* - **required** |
45+
| `PROXY_ENABLE_NAXSI` | 0 or 1 | If 1, NAXSI web application firewall will be enabled for all sites. | 0 |
46+
| `PROXY_GETSSL_SKIP_HTTP_TOKEN_CHECK` | true or false | Set to true to enable `getssl`'s [skip HTTP token check](https://github.com/srvrco/getssl/wiki/Config-variables#skip_http_token_checkfalse). | false |
4147
| `PROXY_HARDEN` | 0 or 1 | If 1, only modern SSL ciphers and protocols will be enabled (some older devices may not be able to access it). | 0 |
4248
| `PROXY_LETS_ENCRYPT_EMAIL` | A valid email address | Used by Lets Encrypt for notification emails. | *None* - **required** |
4349
| `PROXY_LETS_ENCRYPT_LIVE` | 0 or 1 | Only set to 1 (to request live certificates) when your config is correct - Lets Encrypt rate limit certificate requests. | 0 |
50+
| `PROXY_MAINTENANCE_REFRESH_SECONDS` | A valid integer | The number of seconds to count down before the maintenance page auto-refreshes. | 6 |
4451
| `PROXY_SSL_DHPARAM_BITS` | A valid integer | The size of your DHPARAM variables - adjust down only if you have limited processing resources. | 4096 |
4552
| `PROXY_SSL_REDIRECT_TO_CANONICAL` | 0 or 1 | If 1, all requests will be redirected to the primary domain (defined in `conf.json`). | 0 |
46-
| `PROXY_GETSSL_SKIP_HTTP_TOKEN_CHECK` | true or false | Set to true to enable `getssl`'s [skip HTTP token check](https://github.com/srvrco/getssl/wiki/Config-variables#skip_http_token_checkfalse). | false |
47-
| `PROXY_AUTO_PRIMARY` | URI | If set (along with PROXY_AUTO_UPSTREAM) SSL config will be generated on first startup. | *None* |
48-
| `PROXY_AUTO_UPSTREAM` | URI | If set (along with PROXY_AUTO_PRIMARY) SSL config will be generated on first startup. | *None* |
49-
| `PROXY_AUTO_ALIASES` | string of URIs | Add aliases to the auto-generated conf.json on first startup. | *None* |
50-
| `PROXY_AUTO_CUSTOM` | 0 or 1 | Mark the auto-generated SSL config to 'custom' so the Nginx configuration is not regenerated on startup. | 0 |
5153
| `PROXY_UPSTREAM_DNS_RESOLVER` | IP address | Upstream DNS resolver - set to Docker's by default. | 127.0.0.11 |
52-
| `PROXY_MAINTENANCE_REFRESH_SECONDS` | A valid integer | The number of seconds to count down before the maintenance page auto-refreshes. | 6 |
5354

5455
## Helper Functions
5556

56-
| Function | Arguments | Description |
57-
| --------------------- | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
58-
| `nginx-adduser` | 0: username, 1: password | Add a user to enable basic HTTP auth. |
59-
| `nginx-regenerate` | -f: force | Removes non-custom Nginx configuration files (in `/sites`) and regenerates based on `conf.json` (with force, removes all). |
60-
| `ssl-cleanup` | -m: mode | Removes SSL and Nginx configuration files and directories not defined in `conf.json` (mode 0 = dry run, 1 = live). |
61-
| `ssl-init` | *None* | Initialises SSL configuration based on `conf.json`. |
62-
| `ssl-regenerate` | *None* | Removes SSL configuration files (in `/ssl/certs`) and regenerates based on `conf.json`. |
63-
| `ssl-regenerate-full` | *None* | Removes SSL configuration files (in `/ssl/certs`), as well as DH parameters, and regenerates based on `conf.json`. |
64-
| `ssl-request` | *None* | Requests SSL certificates from Lets Encrypt. |
65-
| `ssl-update` | *None* | Attempts to update SSL certificates manually. |
57+
| Function | Arguments | Description |
58+
| --------------------- | --------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
59+
| `nginx-adduser` | 0: username, 1: password | Add a user to enable basic HTTP auth. |
60+
| `nginx-regenerate` | -a: all domains, -d XXXXXX: only domain XXXXXX, -f: force | Removes non-custom Nginx configuration files (in `/sites`) and regenerates based on `conf.json` (with force, removes all). |
61+
| `ssl-cleanup` | -m: mode | Removes SSL and Nginx configuration files and directories not defined in `conf.json` (mode 0 = dry run, 1 = live). |
62+
| `ssl-init` | -a: all domains, -d XXXXXX: only domain XXXXXX | Initialises SSL configuration based on `conf.json`. |
63+
| `ssl-regenerate` | -a: all domains, -d XXXXXX: only domain XXXXXX | Removes SSL configuration files (in `/ssl/certs`) and regenerates based on `conf.json`. |
64+
| `ssl-regenerate-full` | *None* | Removes SSL configuration files (in `/ssl/certs`), as well as DH parameters, and regenerates based on `conf.json`. |
65+
| `ssl-request` | -a: all domains, -d XXXXXX: only domain XXXXXX | Requests SSL certificates from Lets Encrypt. |
66+
| `ssl-update` | -a: all domains, -d XXXXXX: only domain XXXXXX | Attempts to update SSL certificates manually. |
6667

6768
## Nginx Configuration Helpers
6869

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
6.1.7
1+
7.0.0

‎VERSION_MAJOR‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
6
1+
7

‎VERSION_MINOR‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
6.1
1+
7.0

‎overlay/etc/bf/ch.d/20-proxy‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
/etc/naxsi www:www 0640 0750
12
/etc/nginx/sites www:www 0640 0750
23
/etc/ssl/certs www:www 0640 0750
34
/sites www:www 0640 0750

‎overlay/etc/bf/init.d/20-env‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,8 @@ if [ "${PROXY_GETSSL_DEBUG-}" = "1" ] ; then
3636
else
3737
bf-env "PROXY_GETSSL_FLAGS" "-U"
3838
fi
39+
40+
if [ -n "${PROXY_URI-}" ] ; then
41+
bf-notok "Please rename your PROXY_URI environment variable to PROXY_DOMAIN."
42+
bf-env "PROXY_DOMAIN" "${PROXY_URI}"
43+
fi

‎overlay/etc/bf/init.d/22-ssl-init‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ fi
3838

3939

4040
#======================================================================================================================
41-
# Run initialisation script.
41+
# Run initialisation script for the proxy domain.
4242
#======================================================================================================================
4343

44-
ssl-init
44+
ssl-init -d "proxy"

‎overlay/etc/bf/init.d/23-naxsi‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/command/with-contenv bash
2+
3+
set -euo pipefail
4+
export BF_E=`basename ${0}`
5+
6+
7+
#======================================================================================================================
8+
# Generate NAXSI configuration.
9+
#======================================================================================================================
10+
11+
bf-echo "Generating NAXSI files."
12+
bf-esh ${BF_TEMPLATES}/naxsi.conf.esh /etc/nginx/helpers/naxsi.conf
13+
bf-done

‎overlay/etc/bf/init.d/23-maintenance‎ renamed to ‎overlay/etc/bf/init.d/24-maintenance‎

File renamed without changes.

0 commit comments

Comments
 (0)