cleanup; Readme still in WIP
This commit is contained in:
parent
321acaf85d
commit
e356e4cf16
6 changed files with 17 additions and 252 deletions
65
README.md
65
README.md
|
|
@ -1,15 +1,13 @@
|
|||
# `sso.base23.de` - Base23 SSO for all services
|
||||
# `sso.s1q.dev` - Base23 SSO for all services
|
||||
|
||||
[Authentik](https://goauthentik.io/) based SSO for our sevices.
|
||||
|
||||
## Table of Contents
|
||||
|
||||
- [`sso.base23.de` - Base23 SSO for all services](#ssobase23de---base23-sso-for-all-services)
|
||||
- [`sso.s1q.dev` - Base23 SSO for all services](#ssos1qdev---base23-sso-for-all-services)
|
||||
- [Table of Contents](#table-of-contents)
|
||||
- [Prerequisites](#prerequisites)
|
||||
- [Server Setup](#server-setup)
|
||||
- [Tailscale](#tailscale)
|
||||
- [Base23 Docker registry login](#base23-docker-registry-login)
|
||||
- [CrowdSec](#crowdsec)
|
||||
- [Setup CrowdSec Repo](#setup-crowdsec-repo)
|
||||
- [Install CrowdSec](#install-crowdsec)
|
||||
|
|
@ -25,32 +23,7 @@
|
|||
|
||||
## Prerequisites
|
||||
|
||||
### Server Setup
|
||||
|
||||
```shell
|
||||
apt update \
|
||||
&& apt upgrade -y \
|
||||
&& for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do sudo apt remove $pkg; done \
|
||||
&& apt install ca-certificates curl \
|
||||
&& install -m 0755 -d /etc/apt/keyrings \
|
||||
&& curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc \
|
||||
&& chmod a+r /etc/apt/keyrings/docker.asc \
|
||||
&& echo \
|
||||
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
|
||||
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
|
||||
tee /etc/apt/sources.list.d/docker.list > /dev/null \
|
||||
&& apt update \
|
||||
&& apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin \
|
||||
&& mkdir -p /var/lib/apps \
|
||||
&& ln -s /var/lib/apps \
|
||||
&& apt install -y git vim \
|
||||
&& TEMP_DIR=$(mktemp -d) \
|
||||
&& curl -fsSL https://github.com/go-acme/lego/releases/download/v4.20.2/lego_v4.20.2_linux_amd64.tar.gz -o ${TEMP_DIR}/lego_v4.20.2_linux_amd64.tar.gz \
|
||||
&& tar xzvf ${TEMP_DIR}/lego_v4.20.2_linux_amd64.tar.gz --directory=${TEMP_DIR} \
|
||||
&& install -m 755 -o root -g root "${TEMP_DIR}/lego" "/usr/local/bin" \
|
||||
&& rm -rf ${TEMP_DIR} \
|
||||
&& unset TEMP_DIR
|
||||
```
|
||||
- dokploy
|
||||
|
||||
### Tailscale
|
||||
|
||||
|
|
@ -61,18 +34,12 @@ printf "Enter preauthkey for Tailscale: " \
|
|||
&& curl -fsSL https://pkgs.tailscale.com/stable/debian/bookworm.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list \
|
||||
&& apt-get update \
|
||||
&& apt-get install tailscale \
|
||||
&& tailscale up --login-server https://vpn.base23.de --authkey ${TAILSCALE_PREAUTHKEY} --advertise-tags=tag:prod-servers \
|
||||
&& tailscale up --login-server https://vpn.s1q.dev --authkey ${TAILSCALE_PREAUTHKEY} \
|
||||
&& sleep 2 \
|
||||
&& tailscale status \
|
||||
&& unset TAILSCALE_PREAUTHKEY
|
||||
```
|
||||
|
||||
### Base23 Docker registry login
|
||||
|
||||
```shell
|
||||
docker login -u gitlab+deploy-token-5 registry.git.base23.de
|
||||
```
|
||||
|
||||
### CrowdSec
|
||||
|
||||
#### Setup CrowdSec Repo
|
||||
|
|
@ -116,9 +83,9 @@ systemctl restart crowdsec; systemctl status crowdsec.service
|
|||
Whitelist Tailscale IPs:
|
||||
|
||||
```shell
|
||||
cat << EOF > /etc/crowdsec/parsers/s02-enrich/01-base23-tailscale.yaml \
|
||||
cat << EOF > /etc/crowdsec/parsers/s02-enrich/01-s1q-dev-tailscale.yaml \
|
||||
&& systemctl restart crowdsec; journalctl -xef -u crowdsec.service
|
||||
name: base23/tailscale ## Must be unqiue
|
||||
name: s1q-dev/tailscale ## Must be unqiue
|
||||
description: "Whitelist events from Tailscale Subnet"
|
||||
whitelist:
|
||||
reason: "Tailscale clients"
|
||||
|
|
@ -127,18 +94,18 @@ whitelist:
|
|||
EOF
|
||||
```
|
||||
|
||||
Whitelist our current Public IPs:
|
||||
Whitelist my current Public IPs:
|
||||
|
||||
```shell
|
||||
mkdir -p /etc/crowdsec/postoverflows/s01-whitelist/ \
|
||||
&& cat << EOF > /etc/crowdsec/postoverflows/s01-whitelist/01-base23-public-ips.yaml \
|
||||
&& cat << EOF > /etc/crowdsec/postoverflows/s01-whitelist/01-s1q-dev-public-ips.yaml \
|
||||
&& crowdsec -t && systemctl restart crowdsec; systemctl status crowdsec.service
|
||||
name: base23/public-ips ## Must be unqiue
|
||||
description: "Whitelist events from base23 public IPs"
|
||||
name: s1q-dev/public-ips ## Must be unqiue
|
||||
description: "Whitelist events from s1q-dev public IPs"
|
||||
whitelist:
|
||||
reason: "Base23 Public IPs"
|
||||
reason: "s1q-dev Public IPs"
|
||||
expression:
|
||||
- evt.Overflow.Alert.Source.IP in LookupHost("asterix.ddns.base23.de")
|
||||
- evt.Overflow.Alert.Source.IP in LookupHost("r3w.de")
|
||||
EOF
|
||||
```
|
||||
|
||||
|
|
@ -151,8 +118,8 @@ cscli collections install firix/authentik \
|
|||
---
|
||||
source: docker
|
||||
container_name_regexp:
|
||||
- sso-base23-de-server-*
|
||||
- sso-base23-de-worker-*
|
||||
- sso-s1q-dev-de-server-*
|
||||
- sso-s1q-dev-de-worker-*
|
||||
labels:
|
||||
type: authentik
|
||||
EOF
|
||||
|
|
@ -177,8 +144,8 @@ Setup notifications:
|
|||
|
||||
```shell
|
||||
cd /root/apps \
|
||||
&& git clone ssh://git@git.base23.de:222/base23/sso.base23.de.git \
|
||||
&& cd sso.base23.de \
|
||||
&& git clone ssh://git@git.base23.de:222/base23/sso.s1q.dev.git \
|
||||
&& cd sso.s1q.dev \
|
||||
&& ./scripts/init.sh
|
||||
```
|
||||
|
||||
|
|
|
|||
|
|
@ -1,90 +0,0 @@
|
|||
# Upstream where your authentik server is hosted.
|
||||
upstream authentik {
|
||||
server server:9443;
|
||||
# Improve performance by keeping some connections alive.
|
||||
keepalive 10;
|
||||
}
|
||||
|
||||
# Upgrade WebSocket if requested, otherwise use keepalive
|
||||
map $http_upgrade $connection_upgrade_keepalive {
|
||||
default upgrade;
|
||||
'' '';
|
||||
}
|
||||
|
||||
# Server just for serving a health endpoint
|
||||
server {
|
||||
listen 127.0.0.1:8181;
|
||||
server_name localhost;
|
||||
|
||||
# replace with the IP address of your resolver
|
||||
resolver ${NGINX_RESOLVER};
|
||||
|
||||
# Handle /health separately without serving any files
|
||||
location = /health {
|
||||
access_log off;
|
||||
default_type text/plain;
|
||||
return 200 'OK';
|
||||
}
|
||||
}
|
||||
|
||||
# Redirect to HTTPS
|
||||
server {
|
||||
listen ${NGINX_HTTP_PORT};
|
||||
listen [::]:${NGINX_HTTP_PORT};
|
||||
server_name ${NGINX_SERVERNAME};
|
||||
|
||||
# Exclude Let's Encrypt directory from redirection
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/letsencrypt;
|
||||
}
|
||||
|
||||
# Redirect all other traffic to HTTPS
|
||||
location / {
|
||||
return 302 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
# HTTPS Server
|
||||
server {
|
||||
listen ${NGINX_HTTPS_PORT} ssl;
|
||||
listen [::]:${NGINX_HTTPS_PORT} ssl;
|
||||
http2 on;
|
||||
server_name ${NGINX_SERVERNAME};
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/certs/_.base23.de.crt;
|
||||
ssl_certificate_key /etc/nginx/ssl/certs/_.base23.de.key;
|
||||
ssl_session_timeout ${NGINX_SSL_SESSION_TIMEOUT};
|
||||
ssl_session_cache ${NGINX_SSL_SESSION_CACHE};
|
||||
|
||||
ssl_dhparam /etc/nginx/ssl/dhparams.pem;
|
||||
|
||||
# intermediate configuration
|
||||
ssl_protocols ${NGINX_SSL_PROTOCOLS};
|
||||
ssl_ciphers ${NGINX_SSL_CIPHERS};
|
||||
ssl_prefer_server_ciphers ${NGINX_SSL_PREFER_SERVER_CIPHERS};
|
||||
|
||||
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
|
||||
add_header Strict-Transport-Security ${NGINX_HEADER_STRICT_TRANSPORT_SECURITY};
|
||||
|
||||
# OCSP stapling
|
||||
ssl_stapling ${NGINX_SSL_STAPLING};
|
||||
ssl_stapling_verify ${NGINX_SSL_STAPLING_VERIFY};
|
||||
|
||||
# verify chain of trust of OCSP response using Root CA and Intermediate certs
|
||||
ssl_trusted_certificate /etc/nginx/ssl/certs/_.base23.de.issuer.crt;
|
||||
|
||||
# replace with the IP address of your resolver
|
||||
resolver ${NGINX_RESOLVER};
|
||||
|
||||
client_max_body_size 50m;
|
||||
|
||||
location / {
|
||||
proxy_pass https://authentik;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade_keepalive;
|
||||
}
|
||||
}
|
||||
|
|
@ -1,83 +0,0 @@
|
|||
ARG IMAGE=nginxinc/nginx-unprivileged:stable-bullseye
|
||||
|
||||
FROM $IMAGE AS builder
|
||||
|
||||
ARG HTTP_SUBSTITUTIONS_VERSION='e12e965ac1837ca709709f9a26f572a54d83430e'
|
||||
ARG HEADERS_MORE_VERSION='0.37'
|
||||
|
||||
USER root
|
||||
|
||||
RUN set -x \
|
||||
&& apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
build-essential \
|
||||
libgd-dev \
|
||||
libgeoip-dev \
|
||||
libedit-dev \
|
||||
libxslt1-dev \
|
||||
libssl-dev \
|
||||
libpcre2-dev \
|
||||
libperl-dev \
|
||||
zlib1g-dev \
|
||||
unzip \
|
||||
&& rm -rf /var/lib/apt/lists/* \
|
||||
&& mkdir -p /usr/src \
|
||||
&& curl \
|
||||
-o nginx.tar.gz \
|
||||
https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz \
|
||||
&& curl -L \
|
||||
-o nginx_substitutions_filter.zip \
|
||||
https://codeload.github.com/yaoweibin/ngx_http_substitutions_filter_module/zip/${HTTP_SUBSTITUTIONS_VERSION} \
|
||||
&& curl -L \
|
||||
-o headers-more-nginx-module.zip \
|
||||
https://codeload.github.com/openresty/headers-more-nginx-module/zip/refs/tags/v${HEADERS_MORE_VERSION} \
|
||||
&& tar -zxC /usr/src -f nginx.tar.gz \
|
||||
&& unzip nginx_substitutions_filter.zip -d /usr/src \
|
||||
&& unzip headers-more-nginx-module.zip -d /usr/src \
|
||||
&& rm nginx.tar.gz \
|
||||
&& rm nginx_substitutions_filter.zip \
|
||||
&& rm headers-more-nginx-module.zip \
|
||||
&& cd /usr/src/nginx-${NGINX_VERSION} \
|
||||
&& set -eux \
|
||||
&& eval ./configure $(nginx -V 2>&1 | sed -n -e "s/^.*configure arguments: //p") \
|
||||
--add-dynamic-module=/usr/src/ngx_http_substitutions_filter_module-${HTTP_SUBSTITUTIONS_VERSION} \
|
||||
--add-dynamic-module=/usr/src/headers-more-nginx-module-${HEADERS_MORE_VERSION} \
|
||||
--with-http_sub_module \
|
||||
&& set +eux \
|
||||
&& make \
|
||||
&& make install
|
||||
|
||||
|
||||
|
||||
FROM $IMAGE
|
||||
|
||||
ARG BUILD_DATE=01.01.1970
|
||||
ARG IMG_TITLE=docker-image
|
||||
ARG IMAGE_VERSION=0
|
||||
ARG SRC_REV=0
|
||||
|
||||
COPY --from=builder --chown=root:root --chmod=0644 /usr/lib/nginx/modules/ngx_http_subs_filter_module.so /usr/lib/nginx/modules/ngx_http_subs_filter_module.so
|
||||
COPY --from=builder --chown=root:root --chmod=0644 /usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so /usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so
|
||||
COPY --from=builder --chown=root:root --chmod=0755 /usr/sbin/nginx /usr/sbin/nginx
|
||||
|
||||
RUN sed -i '1iload_module /usr/lib/nginx/modules/ngx_http_subs_filter_module.so;\n' /etc/nginx/nginx.conf \
|
||||
&& sed -i '1iload_module /usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so;\n' /etc/nginx/nginx.conf
|
||||
|
||||
# Redirect log output to stdout and stderr
|
||||
RUN set -x \
|
||||
&& sed -i 's,/var/log/nginx/error.log,/dev/stderr,' /etc/nginx/nginx.conf \
|
||||
&& sed -i 's,/var/log/nginx/access.log,/dev/stdout,' /etc/nginx/nginx.conf
|
||||
|
||||
# Healthcheck to ping the /health endpoint
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 CMD curl --fail http://localhost:8181/health || exit 1
|
||||
|
||||
LABEL \
|
||||
maintainer="philip.henning@base23.de" \
|
||||
org.opencontainers.image.created="${BUILD_DATE}" \
|
||||
org.opencontainers.image.vendor="Base23 GmbH" \
|
||||
org.opencontainers.image.authors="Philip Henning | Base23 GmbH <philip.henning@base23.de>" \
|
||||
org.opencontainers.image.title="${IMG_TITLE}" \
|
||||
org.opencontainers.image.description="rootless nginx image based on nginxinc/nginx-unprivileged with subst module" \
|
||||
org.opencontainers.image.version="${IMAGE_VERSION}" \
|
||||
org.opencontainers.image.source="https://git.base23.de/base23/sso.base23.de" \
|
||||
org.opencontainers.image.revision="${SRC_REV}"
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
#!/usr/bin/env bash
|
||||
set -euf -o pipefail
|
||||
|
||||
cd "$(dirname "$(realpath "$0")")/../"
|
||||
|
||||
lego \
|
||||
--path ./data/.lego \
|
||||
--email="acme@base23.de" \
|
||||
--domains="*.base23.de" \
|
||||
--dns hetzner \
|
||||
renew \
|
||||
--renew-hook="./scripts/cert_renew_hook.sh"
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
#!/usr/bin/env bash
|
||||
set -euf -o pipefail
|
||||
|
||||
cd "$(dirname "$(realpath "$0")")/../"
|
||||
|
||||
install -m 400 -o 101 -g 101 "./data/.lego/certificates"/{_.base23.de.crt,_.base23.de.issuer.crt,_.base23.de.key} "./data/nginx/certs"
|
||||
|
||||
docker compose restart nginx
|
||||
|
|
@ -11,20 +11,11 @@ STAGE="${1:-}"
|
|||
shift || true
|
||||
|
||||
if [[ -z "${STAGE,,}" ]]; then
|
||||
echo "Usage: $0 <prod|test>"
|
||||
echo "Usage: $0 <stage>"
|
||||
echo "Example: $0 test"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ "${STAGE,,}" == "prod" ]]; then
|
||||
DOCKER_COMPOSE_CLI="docker compose"
|
||||
elif [[ "${STAGE,,}" == "test" ]]; then
|
||||
DOCKER_COMPOSE_CLI="docker-compose-2.32.4"
|
||||
else
|
||||
echo "Invalid stage: ${STAGE,,}. Use 'prod' or 'test'."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cd "$(dirname "$(realpath "$0")")/../"
|
||||
AUTHENTIK_DOCKER_COMPOSE_PATH="$(realpath "$(pwd)")"
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue