Tetszik 0
Fork 0

Utoljára aktív 6 months ago

Revízió 242db591ac3390e0ac315588de163d07c11f209d

deploy_socat.sh Eredeti
1#!/bin/bash
2
3if [ $(ip -6 route | grep -c ^default) -eq 0 ]; then exit; fi
4apt install socat || exit
5
6cat > /etc/systemd/system/socat\@.service <<EOF
7[Unit]
8Description=ipv6 to ipv4 port forwarding
9After=network.target
10
11[Service]
12Type=simple
13ExecStart=/usr/bin/socat TCP6-LISTEN:%i,ipv6only=1,reuseaddr,fork TCP4:127.0.0.1:%i
14
15[Install]
16WantedBy=docker.service
17EOF
18systemctl daemon-reload
19for PROTO in http https; do
20 systemctl enable socat@${PROTO}.service
21 systemctl start socat@${PROTO}.service
22done
23
deploy_traefik.sh Eredeti
1#!/bin/bash
2DOCKER_BASE="${DOCKER_BASE:-/srv/docker}"
3TRAEFIK_DIR="${TRAEFIK_DIR:-traefik}"
4
5mkdir -p ${DOCKER_BASE}/${TRAEFIK_DIR}/container.conf
6
7touch ${DOCKER_BASE}/${TRAEFIK_DIR}/container.conf/.env
8ln -s container.conf/.env ${DOCKER_BASE}/${TRAEFIK_DIR}/
9
10cat > ${DOCKER_BASE}/${TRAEFIK_DIR}/container.conf/docker-compose.yml <<EOF
11# Inspired by https://containo.us/blog/traefik-2-0-docker-101-fc2893944b9d/
12
13version: '3.7'
14
15services:
16 traefik:
17 image: traefik:2.4
18 command:
19 - --entrypoints.web.address=:80
20 - --entrypoints.websecure.address=:443
21 - "--log.level=INFO"
22 - --providers.docker=true
23 - --providers.docker.exposedbydefault=false
24 - --api=true
25 - --certificatesresolvers.default.acme.caserver=\${LEAPI:-https://acme-v02.api.letsencrypt.org/directory}
26 - --certificatesresolvers.default.acme.email=\${LEMAIL:-ssladmin@test.org}
27 - --certificatesresolvers.default.acme.storage=/etc/traefik/acme.json
28 - --certificatesresolvers.default.acme.tlschallenge=true
29 - --providers.file.filename=/etc/traefik/traefik_providers.yaml
30 - --providers.file.watch=true
31 logging:
32 options:
33 max-size: "100M"
34 max-file: "10"
35 networks:
36 - system_traefik
37 environment:
38 - LC_ALL=C.UTF-8
39 - TZ=Europe/Berlin
40 labels:
41 # Enable Traefik for it's own backend
42 - traefik.enable=true
43 # Dashboard
44 - traefik.http.routers.traefik.rule=Host(\`traefik.test.org\`)
45 - traefik.http.routers.traefik.entrypoints=websecure
46 - traefik.http.routers.traefik.tls=true
47 - traefik.http.routers.traefik.tls.certresolver=default
48 - traefik.http.routers.traefik.service=api@internal
49 # Basic auth for dashboard
50 - traefik.http.routers.traefik.middlewares=authtraefik@docker,default-security-headers@file
51 # middleware authtraefik
52 - traefik.http.middlewares.authtraefik.basicauth.users=\${DASHBOARD_USERS:-admin:\$\$apr1\$\$AAbCdQpX\$\$ajelS9mMisKRG.lqcY/uXU/} # user/password
53 ports:
54 - "80:80"
55 - "443:443"
56 restart: always
57 volumes:
58 - "./config/:/etc/traefik/"
59 - "/var/run/docker.sock:/var/run/docker.sock:ro"
60
61networks:
62 system_traefik:
63 external: true
64EOF
65ln -s container.conf/docker-compose.yml ${DOCKER_BASE}/${TRAEFIK_DIR}/
66
67cat > ${DOCKER_BASE}/${TRAEFIK_DIR}/container.conf/production.yml <<EOF
68version: '3.7'
69
70services:
71
72 traefik:
73 labels:
74 # See https://docs.traefik.io/migration/v1-to-v2/#strip-and-rewrite-path-prefixes
75 - traefik.http.routers.traefik.rule=Host(\`$(hostname -f)\`) && (PathPrefix(\`/traefik\`) || PathPrefix(\`/api\`))
76 # Redefine middleware for router 'traefik' as we add more middlewares
77 - traefik.http.routers.traefik.middlewares=authtraefik@docker,traefik-dashboard-stripprefix@file,default-security-headers@file
78EOF
79
80cat > ${DOCKER_BASE}/${TRAEFIK_DIR}/container.conf/traefik.service <<EOF
81[Unit]
82Description=Traefik Proxy Service
83After=network.target docker.service
84Requires=docker.service
85
86[Service]
87Type=oneshot
88RemainAfterExit=yes
89
90Environment="WORK_DIR=/srv/docker/traefik/"
91WorkingDirectory=/srv/docker/traefik/
92ExecStartPre=/bin/bash -c "/usr/bin/docker network inspect system_traefik &>/dev/null || /usr/bin/docker network create --driver bridge system_traefik"
93ExecStartPre=-/usr/local/bin/docker-compose -f "\${WORK_DIR}/docker-compose.yml" -f "\${WORK_DIR}/container.conf/production.yml" down
94ExecStart=/usr/local/bin/docker-compose -f "\${WORK_DIR}/docker-compose.yml" -f "\${WORK_DIR}/container.conf/production.yml" up -d
95ExecStop=/usr/local/bin/docker-compose -f "\${WORK_DIR}/docker-compose.yml" -f "\${WORK_DIR}/container.conf/production.yml" down
96
97[Install]
98WantedBy=docker.service
99EOF
100ln -s ${DOCKER_BASE}/${TRAEFIK_DIR}/container.conf/traefik.service /etc/systemd/system/
101
102mkdir -p ${DOCKER_BASE}/${TRAEFIK_DIR}/config
103
104cat > ${DOCKER_BASE}/${TRAEFIK_DIR}/config/traefik_providers.yaml <<EOF
105---
106tls:
107 options:
108 default:
109 minVersion: VersionTLS12
110 sniStrict: true
111 cipherSuites:
112 # TLS 1.2 cipher suites.
113 - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
114 - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
115 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
116 # IE 11 and Safari < 9 + iOS <9, OSX < 10.11
117 - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
118 # TLS 1.3 cipher suites.
119 - TLS_AES_128_GCM_SHA256
120 - TLS_AES_256_GCM_SHA384
121 - TLS_CHACHA20_POLY1305_SHA256
122 # TLS_FALLBACK_SCSV isn't a standard cipher suite but an indicator that the client is doing version fallback. See RFC 7507.
123 - TLS_FALLBACK_SCSV
124 curvePreferences:
125 - CurveP521
126 - CurveP384
127
128http:
129 middlewares:
130 redirect-web-to-websecure:
131 redirectScheme:
132 scheme: https
133 permanent: true
134 default-security-headers:
135 headers:
136 accessControlAllowMethods:
137 - GET
138 - POST
139 - DELETE
140 - OPTIONS
141 accessControlAllowOriginList: ["<origin>"]
142 accessControlMaxAge: 100
143 browserXssFilter: true
144 contentTypeNosniff: true
145 forceSTSHeader: true
146# frameDeny: true
147 sslRedirect: true
148 stsIncludeSubdomains: true
149 stsPreload: true
150 stsSeconds: 315360000
151# contentSecurityPolicy: "default-src 'self' 'unsafe-inline';script-src 'self' 'unsafe-inline' 'unsafe-eval';img-src 'self' data:;font-src 'self' data:;connect-src 'self' ws: wss:"
152# customRequestHeaders:
153# X-Frame-Options: "SAMEORIGIN"
154# customFrameOptionsValue: "SAMEORIGIN"
155 referrerPolicy: "same-origin"
156 featurePolicy: "vibrate 'self'"
157 traefik-dashboard-stripprefix:
158 stripPrefix:
159 prefixes:
160 - "/traefik"
161 services:
162 redirect-dummy:
163 loadBalancer:
164 servers:
165 - url: ""
166 routers:
167 # global redirect to https
168 # per domain see https://doc.traefik.io/traefik/migration/v1-to-v2/#http-to-https-redirection-is-now-configured-on-routers
169 web-to-websecure:
170 rule: "hostregexp(\`{host:.+}\`)"
171 service: "redirect-dummy@file"
172 entryPoints:
173 - "web"
174 middlewares:
175 - redirect-web-to-websecure@file
176EOF
177
178systemctl daemon-reload && systemctl enable traefik && systemctl start traefik
179
migrate_system_traefik_network.sh Eredeti
1#!/bin/bash
2sed -i '/^WorkingDirectory/a ExecStartPre=/bin/bash -c "/usr/bin/docker network inspect system_traefik &>/dev/null || /usr/bin/docker network create --driver bridge system_traefik"' /srv/docker/traefik/container.conf/traefik.service && systemctl daemon-reload
3sed -i '/image: traefik/a\ networks:\n - system_traefik' /srv/docker/traefik/container.conf/docker-compose.yml
4sed -i s/traefik_default/system_traefik/g /srv/docker/*/container.conf/*.yml
5sed -i s/traefik_default/system_traefik/g /srv/docker/portainer/data/compose/*/docker-compose.yml
6
migrate_to_v2.sh Eredeti
1#!/bin/bash
2BASEPATH="/srv/docker/traefik2/"
3
4export TRAEFIK_DIR="traefik2"
5
6# Download deployment script
7wget -q https://gist.githubusercontent.com/waja/37202007b10837a7fc2e6eacacd9b335/raw/deploy_traefik.sh \
8 -O /tmp/deploy_traefik.sh && \
9 # Remove auto start of the traefik daemon
10 sed '/^systemctl/d' -i /tmp/deploy_traefik.sh && \
11 sed -i '/etc\/systemd\/system\/$/d' /tmp/deploy_traefik.sh && \
12 # Run deployment
13 bash /tmp/deploy_traefik.sh
14
15# Migrate settings from old toml config
16ADMIN_CRED="$(grep users ${BASEPATH}/../traefik/config/traefik.toml | cut -d \" -f2)"
17EMAIL="$(grep email ${BASEPATH}/../traefik/config/traefik.toml | cut -d \" -f2)"
18echo "LEMAIL=${EMAIL}" > ${BASEPATH}/.env
19echo "#LEAPI=https://acme-staging-v02.api.letsencrypt.org/directory" >> ${BASEPATH}/.env
20echo "DASHBOARD_USERS=${ADMIN_CRED}" >> ${BASEPATH}/.env
21
22# Migrate old acme store to the new once
23wget -q https://github.com/traefik/traefik-migration-tool/releases/download/v0.13.1/traefik-migration-tool_v0.13.1_linux_amd64.tar.gz -P /tmp
24tar -xf /tmp/traefik-migration-tool_v0.13.1_linux_amd64.tar.gz -C /tmp
25/tmp/traefik-migration-tool acme -i /srv/docker/traefik/config/acme.json -o /srv/docker/traefik2/config/acme-new.json
26
27echo -e "You might want to the following:\nmv traefik traefik1 && mv traefik2 traefik && systemctl daemon-reload\ncd /srv/docker/traefik\ndocker-compose -f docker-compose.yml -f container.conf/production.yml pull\nsystemctl restart traefik && docker-compose -f docker-compose.yml -f container.conf/production.yml logs -f"
28
migrate_traefik_TLS11.sh Eredeti
1#!/bin/bash
2sed -i '/\[entryPoints.https.tls\]/a \ minVersion = "VersionTLS11"' /srv/docker/traefik/config/traefik.toml && systemctl restart traefik
3
migrate_traefik_TLS12.sh Eredeti
1#!/bin/bash
2sed -i s/VersionTLS11/VersionTLS12/ /srv/docker/traefik/config/traefik.toml && systemctl restart traefik
3

Ez az oldal Opengist alapú ⋅ Load: 70ms⋅

Magyar