Initial commit

Dockerfile

@@ -0,0 +1,8 @@
+FROM caddy:builder-alpine AS builder
+
+RUN xcaddy build \
+    --with github.com/mastercactapus/caddy2-proxyprotocol
+
+FROM caddy:alpine
+
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy

LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2022 Steffen Munk
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2022 Steffen Munk
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,65 @@
+# Proxy for UDM Pro
+
+Create a reverse proxy for UDM Pro.
+
+Work based upon https://github.com/boostchicken-dev/udm-utilities/issues/149
+
+## Prerequisities
+- Create a proxy network (vlan 5, 10.0.5.1/24, no DHCP)
+- Create port forwards, ie. WAN -> 10.0.5.4 (TCP/80,443) if needed
+- Working **on_boot.d** setup (https://github.com/boostchicken/udm-utilities)
+
+## Setup
+
+Follow the steps below to get going
+
+1. Download or clone this repository into /mnt/data/proxy.
+2. Customize `on_boot.d/30-proxy.sh` to your needs.
+3. Symlink container proxy boot script
+
+    `$ ln -sf /mnt/data/proxy/on_boot.d/30-proxy.sh /mnt/data/proxy/.`
+
+4. Run boot script (to create update network and create CNI configuration for container)
+
+    `$ /mnt/data/on_boot.d/30-proxy.sh`
+
+    It fail when trying to run the container, but thats okay, its just for setting op needed configuration before initial image run.
+
+5. Register the container with podman
+
+    `$ podman run -d --systemd=false --network proxy --name proxy -v "/mnt/data/proxy/Caddyfile:/etc/proxy/Caddyfile" xpherism:udm-proxy`
+
+6. Run boot script again and we are done :-)
+
+Remember to change the `etc/caddy/Caddyfile` to your requirements and add mounts additional mounts to podman run if needed.<br>
+The default caddefile proxies unifi.my.domain to 10.0.0.1 (ie. unifi controller)
+If you keep the proxy settings for the unifi controller, then you need do following first to avoid redirect recursion
+
+`$ ln -sf /mnt/data/proxy/etc/unifi-core/config.yaml /mnt/data/unifi-os/unifi-core/.`
+
+This disabled http->https redirect from unifi controller which is the cause of the above problem.
+
+## Image
+
+Container image `xpherism:udm-proxy` is caddy built with the following modules
+- proxy protocol (github.com/mastercactapus/caddy2-proxyprotocol)
+
+Feel free to use the vanilla `caddy` docker image or roll your own depending on your needs.
+
+To update container image, simple do
+
+`$ podman stop proxy && podman rm proxy` and run boot script again :-)
+
+For more information
+- https://hub.docker.com/_/caddy
+- https://caddyserver.com/docs/caddyfile
+- https://github.com/mastercactapus/caddy2-proxyprotocol
+- https://github.com/boostchicken/udm-utilities
+
+To build your own image, simple fork this repository and change what you need and simple run
+
+ `$ docker build --platform arm64 -t udm-proxy .`
+
+## TODO
+- Add DNS proxy DoH or DoT to `xpherism:udm-proxy` docker image
+- If bored make a simple UI to reverse proxy :-)

etc/caddy/Caddyfile

@@ -0,0 +1,20 @@
+#{
+#        debug
+#}
+
+*.my.domain, my.domain {
+        tls /etc/caddy/my.domain.crt /etc/caddy/my.domain.crt.key
+
+        @unifi host unifi.my.domain
+        handle @unifi {
+                reverse_proxy https://10.0.0.1 {
+                        transport http {
+                                # unifi has selfsigned default certs, ignore any security issues (caddy fails to verify it)
+                                tls_insecure_skip_verify
+                        }
+                }
+        }
+        handle {
+                respond "Nothing to see here... move along!"
+        }
+}

etc/unifi-core/config.yaml

@@ -0,0 +1,3 @@
+# override file for podman exec -it unifi-os cat /usr/share/unifi-core/app/config/config.yaml
+# diable http->https redirect otherwise we end with endless redirect from caddy
+enforceHttps: false

on_boot.d/30-proxy.sh

@@ -0,0 +1,74 @@
+#!/bin/sh
+
+## configuration variables: (must match your network create in UI, remember to disable dhcp)
+VLAN=5
+IPV4_IP_PROXY="10.0.5.4"
+IPV4_GW="10.0.5.1"
+
+
+SCRIPTPATH="$(realpath "$0")"
+SCRIPTNAME="$(basename "${SCRIPTPATH%.*}")"
+CONTAINER_CNI_PATH="${SCRIPTPATH%/*/*}/etc/cni/net.d/$SCRIPTNAME.conflist"
+CONTAINER_NAME=proxy
+
+## network configuration and startup:
+CNI_PATH=/mnt/data/podman/cni
+if [ ! -f "$CNI_PATH"/macvlan ]; then
+  mkdir -p $CNI_PATH
+  curl -L https://github.com/containernetworking/plugins/releases/download/v0.9.0/cni-plugins-linux-arm64-v0.9.0.tgz | tar -xz -C $CNI_PATH
+fi
+
+mkdir -p "$(dirname "$CONTAINER_CNI_PATH")"
+
+echo "
+{
+  \"cniVersion\": \"0.4.0\",
+  \"name\": \"proxy\",
+  \"plugins\": [
+    {
+      \"type\": \"macvlan\",
+      \"mode\": \"bridge\",
+      \"master\": \"br$VLAN\",
+      \"ipam\": {
+        \"type\": \"static\",
+        \"addresses\": [
+          {
+            \"address\": \"$IPV4_IP_PROXY/24\",
+            \"gateway\": \"$IPV4_GW\"
+          }
+        ],
+        \"routes\": [
+          {\"dst\": \"0.0.0.0/0\"}
+        ]
+      }
+    }
+  ]
+}
+" > "$CONTAINER_CNI_PATH"
+
+ln -fs "$CONTAINER_CNI_PATH" "/etc/cni/net.d/$(basename "$CONTAINER_CNI_PATH")"
+
+# set VLAN bridge promiscuous
+ip link set br${VLAN} promisc on
+
+# create macvlan bridge and add IPv4 IP
+ip link add br${VLAN}.mac link br${VLAN} type macvlan mode bridge
+ip addr add ${IPV4_GW}/24 dev br${VLAN}.mac noprefixroute
+
+# set macvlan bridge promiscuous and bring it up
+ip link set br${VLAN}.mac promisc on
+ip link set br${VLAN}.mac up
+
+#######################################################################################
+# add IPv4 route to container
+ip route add ${IPV4_IP_PROXY}/32 dev br${VLAN}.mac
+#######################################################################################
+
+
+#######################################################################################
+if podman container exists ${CONTAINER_NAME}; then
+  podman start ${CONTAINER_NAME}
+else
+  logger -s -t podman-proxy -p ERROR Container $CONTAINER_NAME not found, make sure you set the proper name, you can ignore this error if it is your first time setting it up
+fi
+#######################################################################################