Skip to content

Commit a39db93

Browse files
LePresidenteLePresidente
committed
Use ne wbuild format for crowdsec bouncer
1 parent 78900de commit a39db93

File tree

2 files changed

+50
-203
lines changed

2 files changed

+50
-203
lines changed

‎Dockerfile

Lines changed: 12 additions & 203 deletions
Original file line numberDiff line numberDiff line change
@@ -67,25 +67,6 @@ RUN xx-verify /tmp/go/bin/bcrypt-tool
6767
COPY --from=upx /usr/bin/upx /usr/bin/upx
6868
RUN upx /tmp/go/bin/bcrypt-tool
6969

70-
# Install Crowdsec OpenResty Bouncer.
71-
RUN \
72-
# Install packages needed by the build.
73-
add-pkg --virtual build-dependencies \
74-
gettext \
75-
&& \
76-
# Download the Crowdsec OpenResty Bouncer package.
77-
echo "Downloading Crowdsec Openresty Bouncer package..." && \
78-
mkdir crowdsec-openresty-bouncer && \
79-
curl -# -L ${CROWDSEC_OPENRESTY_BOUNCER_URL} | tar xz --strip 1 -C crowdsec-openresty-bouncer && \
80-
# Deploy Crowdsec Openresty Bouncer.
81-
echo "Deploy Crowdsec Openresty Bouncer.." && \
82-
cd /tmp/crowdsec-openresty-bouncer && \
83-
bash ./install.sh --NGINX_CONF_DIR=/etc/nginx/conf.d --LIB_PATH=/var/lib/nginx/lualib --CONFIG_PATH=/defaults/crowdsec/ --DATA_PATH=/defaults/crowdsec/ --SSL_CERTS_PATH=/etc/ssl/certs/ca-cert-GTS_Root_R1.pem --docker && \
84-
sed-patch 's|ENABLED=.*|ENABLED=false|' /defaults/crowdsec/crowdsec-openresty-bouncer.conf && \
85-
# Cleanup.
86-
del-pkg build-dependencies && \
87-
rm -rf /tmp/* /tmp/.[!.]*
88-
8970
# Build certbot.
9071
FROM alpine:3.16 AS certbot
9172
COPY --from=mod_cryptography / /wheels
@@ -99,6 +80,14 @@ RUN \
9980
find /tmp/certbot-install/usr/lib/python3.10/site-packages -type f -name "*.exe" -delete && \
10081
find /tmp/certbot-install/usr/lib/python3.10/site-packages -type d -name tests -print0 | xargs -0 rm -r
10182

83+
# Build cs-openresty-boucner.
84+
FROM alpine:3.16 AS cs-openresty-bouncer
85+
ARG TARGETPLATFORM
86+
ARG CROWDSEC_OPENRESTY_BOUNCER_URL
87+
COPY --from=xx / /
88+
COPY src/cs-openresty-bouncer /build
89+
RUN /build/build.sh "$CROWDSEC_OPENRESTY_BOUNCER_URL"
90+
10291
# Pull base image.
10392
FROM jlesage/baseimage:alpine-3.16-v3.4.6
10493

@@ -130,197 +119,17 @@ RUN \
130119
# Certbot plugins. Thus, we need to manually install pip (with its
131120
# built-in dependencies). See:
132121
# https://pip.pypa.io/en/stable/development/vendoring-policy/
133-
curl -# -L "https://bootstrap.pypa.io/get-pip.py" | python3 && \
134-
# Then install certbot.
135-
CARGO_HOME=/tmp/.cargo pip install --no-cache-dir --prefix=/usr certbot && \
136-
find /usr/lib/python3.9/site-packages -type f -name "*.so" -exec strip {} ';' && \
137-
find /usr/lib/python3.9/site-packages -type f -name "*.h" -delete && \
138-
find /usr/lib/python3.9/site-packages -type f -name "*.c" -delete && \
139-
find /usr/lib/python3.9/site-packages -type f -name "*.exe" -delete && \
140-
find /usr/lib/python3.9/site-packages -type d -name tests -print0 | xargs -0 rm -r && \
141-
# Cleanup.
142-
del-pkg build-dependencies && \
143-
rm -rf /tmp/* /tmp/.[!.]*
144-
145-
# Install Nginx Proxy Manager.
146-
RUN \
147-
# Install packages needed by the build.
148-
add-pkg --virtual build-dependencies \
149-
build-base \
150-
curl \
151-
patch \
152-
yarn \
153-
git \
154-
python2 \
155-
python3 \
156-
npm \
157-
bash \
158-
&& \
159-
160-
# Install node-prune.
161-
echo "Installing node-prune..." && \
162-
mkdir /tmp/bin && \
163-
curl -sfL https://gobinaries.com/tj/node-prune | PREFIX=/tmp/bin sh && \
164-
165-
# Download the Nginx Proxy Manager package.
166-
echo "Downloading Nginx Proxy Manager package..." && \
167-
mkdir nginx-proxy-manager && \
168-
curl -# -L ${NGINX_PROXY_MANAGER_URL} | tar xz --strip 1 -C nginx-proxy-manager && \
169-
170-
sed-patch "s/\"version\": \"0.0.0\",/\"version\": \"${NGINX_PROXY_MANAGER_VERSION}\",/" nginx-proxy-manager/frontend/package.json && \
171-
sed-patch "s/\"version\": \"0.0.0\",/\"version\": \"${NGINX_PROXY_MANAGER_VERSION}\",/" nginx-proxy-manager/backend/package.json && \
172-
173-
cp -r nginx-proxy-manager /app && \
174-
175-
# Build Nginx Proxy Manager frontend.
176-
echo "Building Nginx Proxy Manager frontend..." && \
177-
cd /app/frontend && \
178-
yarn install && \
179-
yarn build && \
180-
/tmp/bin/node-prune && \
181-
cd /tmp && \
182-
183-
# Build Nginx Proxy Manager backend.
184-
echo "Building Nginx Proxy Manager backend..." && \
185-
cd /app/backend && \
186-
yarn install --prod && \
187-
/tmp/bin/node-prune && \
188-
cd /tmp && \
189-
190-
# Install Nginx Proxy Manager.
191-
echo "Installing Nginx Proxy Manager..." && \
192-
mkdir -p /opt && \
193-
cp -r /app/backend /opt/nginx-proxy-manager && \
194-
cp -r /app/frontend/dist /opt/nginx-proxy-manager/frontend && \
195-
cp -r /app/global /opt/nginx-proxy-manager && \
196-
mkdir /opt/nginx-proxy-manager/bin && \
197-
cp -r nginx-proxy-manager/docker/rootfs/bin/handle-ipv6-setting /opt/nginx-proxy-manager/bin/ && \
198-
cp -r nginx-proxy-manager/docker/rootfs/etc/nginx /etc/ && \
199-
cp -r nginx-proxy-manager/docker/rootfs/var/www /var/ && \
200-
cp -r nginx-proxy-manager/docker/rootfs/etc/letsencrypt.ini /etc/ && \
201-
cp -r nginx-proxy-manager/docker/rootfs/etc/logrotate.d /etc/ && \
202-
203-
# Remove the nginx development config.
204-
rm /etc/nginx/conf.d/dev.conf && \
205-
206-
# Change the management interface port to the unprivileged port 8181.
207-
sed-patch 's|81 default|8181 default|' /etc/nginx/conf.d/production.conf && \
208-
209-
# Change the management interface root.
210-
sed-patch 's|/app/frontend;|/opt/nginx-proxy-manager/frontend;|' /etc/nginx/conf.d/production.conf && \
211-
212-
# Change the HTTP port 80 to the unprivileged port 8080.
213-
sed-patch 's|80;|8080;|' /etc/nginx/conf.d/default.conf && \
214-
sed-patch 's|"80";|"8080";|' /etc/nginx/conf.d/default.conf && \
215-
sed-patch 's|listen 80;|listen 8080;|' /opt/nginx-proxy-manager/templates/letsencrypt-request.conf && \
216-
sed-patch 's|:80;|:8080;|' /opt/nginx-proxy-manager/templates/letsencrypt-request.conf && \
217-
sed-patch 's|listen 80;|listen 8080;|' /opt/nginx-proxy-manager/templates/_listen.conf && \
218-
sed-patch 's|:80;|:8080;|' /opt/nginx-proxy-manager/templates/_listen.conf && \
219-
sed-patch 's|80 default;|8080 default;|' /opt/nginx-proxy-manager/templates/default.conf && \
220-
221-
# Change the HTTPs port 443 to the unprivileged port 4443.
222-
sed-patch 's|443 |4443 |' /etc/nginx/conf.d/default.conf && \
223-
sed-patch 's|"443";|"4443";|' /etc/nginx/conf.d/default.conf && \
224-
sed-patch 's|listen 443 |listen 4443 |' /opt/nginx-proxy-manager/templates/_listen.conf && \
225-
sed-patch 's|:443 |:4443 |' /opt/nginx-proxy-manager/templates/_listen.conf && \
226-
sed-patch 's|:443;|:4443;|' /opt/nginx-proxy-manager/templates/_listen.conf && \
227-
228-
# Fix nginx test command line.
229-
sed-patch 's|-g "error_log off;"||' /opt/nginx-proxy-manager/internal/nginx.js && \
122+
curl -# -L "https://bootstrap.pypa.io/get-pip.py" | python3
230123

231-
# Remove the `user` directive, since we want nginx to run as non-root.
232-
sed-patch 's|user root;|#user root;|' /etc/nginx/nginx.conf && \
233-
234-
# Change client_body_temp_path.
235-
sed-patch 's|/tmp/nginx/body|/var/tmp/nginx/body|' /etc/nginx/nginx.conf && \
236-
237-
# Fix the logrotate config.
238-
sed-patch 's|root root|app app|' /etc/logrotate.d/nginx-proxy-manager && \
239-
sed-patch 's|/run/nginx.pid|/run/nginx/nginx.pid|' /etc/logrotate.d/nginx-proxy-manager && \
240-
sed-patch 's|logrotate /etc/logrotate.d/nginx-proxy-manager|logrotate -s /config/logrotate.status /etc/logrotate.d/nginx-proxy-manager|' /opt/nginx-proxy-manager/setup.js && \
241-
sed-patch 's|/data/logs/\*/access.log|/data/logs/access.log|' /etc/logrotate.d/nginx-proxy-manager && \
242-
sed-patch 's|/data/logs/\*/error.log|/data/logs/error.log|' /etc/logrotate.d/nginx-proxy-manager && \
243-
244-
# Redirect `/data' to '/config'.
245-
ln -s /config /data && \
246-
247-
# Make sure the config file for IP ranges is stored in persistent volume.
248-
mv /etc/nginx/conf.d/include/ip_ranges.conf /defaults/ && \
249-
ln -sf /config/nginx/ip_ranges.conf /etc/nginx/conf.d/include/ip_ranges.conf && \
250-
251-
# Make sure the config file for resolvers is stored in persistent volume.
252-
ln -sf /config/nginx/resolvers.conf /etc/nginx/conf.d/include/resolvers.conf && \
253-
254-
# Make sure nginx cache is stored on the persistent volume.
255-
ln -s /config/nginx/cache /var/lib/nginx/cache && \
256-
257-
# Make sure the manager config file is stored in persistent volume.
258-
rm -r /opt/nginx-proxy-manager/config && \
259-
mkdir /opt/nginx-proxy-manager/config && \
260-
ln -s /config/production.json /opt/nginx-proxy-manager/config/production.json && \
261-
262-
# Make sure letsencrypt certificates are stored in persistent volume.
263-
ln -s /config/letsencrypt /etc/letsencrypt && \
264-
265-
# Make sure some default certbot directories are stored in persistent volume.
266-
ln -s /config/letsencrypt-workdir /var/lib/letsencrypt && \
267-
ln -s /config/log/letsencrypt /var/log/letsencrypt && \
268-
269-
# Cleanup.
270-
del-pkg build-dependencies && \
271-
find /opt/nginx-proxy-manager -name "*.h" -delete && \
272-
find /opt/nginx-proxy-manager -name "*.cc" -delete && \
273-
find /opt/nginx-proxy-manager -name "*.c" -delete && \
274-
find /opt/nginx-proxy-manager -name "*.gyp" -delete && \
275-
rm -r \
276-
/app \
277-
/usr/lib/node_modules \
278-
&& \
279-
rm -rf /tmp/* /tmp/.[!.]*
280-
281-
# Install bcrypt-tool.
282-
RUN \
283-
# Install packages needed by the build.
284-
add-pkg --virtual build-dependencies \
285-
go \
286-
upx \
287-
git \
288-
musl-dev \
289-
&& \
290-
COPY --from=nginx /tmp/openresty-install/ /
291-
COPY --from=npm /tmp/nginx-proxy-manager-install/ /
292-
COPY --from=bcrypt-tool /tmp/go/bin/bcrypt-tool /usr/bin/
293-
COPY --from=certbot /tmp/certbot-install/ /
294-
295-
# Set internal environment variables.
296-
RUN \
297-
set-cont-env APP_NAME "Nginx Proxy Manager" && \
298-
set-cont-env APP_VERSION "$NGINX_PROXY_MANAGER_VERSION" && \
299-
set-cont-env DOCKER_IMAGE_VERSION "$DOCKER_IMAGE_VERSION" && \
300-
true
301-
# Install packages needed by the build.
302-
add-pkg --virtual build-dependencies \
303-
gettext \
304-
&& \
305-
# Download the Crowdsec OpenResty Bouncer package.
306-
echo "Downloading Crowdsec Openresty Bouncer package..." && \
307-
mkdir crowdsec-openresty-bouncer && \
308-
curl -# -L ${CROWDSEC_OPENRESTY_BOUNCER_URL} | tar xz --strip 1 -C crowdsec-openresty-bouncer && \
309-
# Deploy Crowdsec Openresty Bouncer.
310-
echo "Deploy Crowdsec Openresty Bouncer.." && \
311-
cd /tmp/crowdsec-openresty-bouncer && \
312-
bash ./install.sh --NGINX_CONF_DIR=/etc/nginx/conf.d --LIB_PATH=/var/lib/nginx/lualib --CONFIG_PATH=/defaults/crowdsec/ --DATA_PATH=/defaults/crowdsec/ --SSL_CERTS_PATH=/etc/ssl/certs/ca-cert-GTS_Root_R1.pem --docker && \
313-
sed-patch 's|ENABLED=.*|ENABLED=false|' /defaults/crowdsec/crowdsec-openresty-bouncer.conf && \
314-
# Cleanup.
315-
del-pkg build-dependencies && \
316-
rm -rf /tmp/* /tmp/.[!.]*
124+
# Install Crowdsec OpenResty Bouncer.
317125

318126
# Add files.
319127
COPY rootfs/ /
320128
COPY --from=nginx /tmp/openresty-install/ /
321129
COPY --from=npm /tmp/nginx-proxy-manager-install/ /
322130
COPY --from=bcrypt-tool /tmp/go/bin/bcrypt-tool /usr/bin/
323131
COPY --from=certbot /tmp/certbot-install/ /
132+
COPY --from=cs-openresty-bouncer /tmp/crowdsec-openresty-bouncer-install/ /
324133

325134
# Set internal environment variables.
326135
RUN \
@@ -345,4 +154,4 @@ LABEL \
345154
org.label-schema.description="Docker container for Nginx Proxy Manager" \
346155
org.label-schema.version="${DOCKER_IMAGE_VERSION:-unknown}" \
347156
org.label-schema.vcs-url="https://github.com/jlesage/docker-nginx-proxy-manager" \
348-
org.label-schema.schema-version="1.0"
157+
org.label-schema.schema-version="1.0"

‎src/cs-openresty-bouncer/build.sh

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/bin/sh
2+
3+
set -e # Exit immediately if a command exits with a non-zero status.
4+
set -u # Treat unset variables as an error.
5+
6+
log() {
7+
echo ">>> $*"
8+
}
9+
10+
CROWDSEC_OPENRESTY_BOUNCER_URL="${1:-}"
11+
12+
ROOTFS=/tmp/crowdsec-openresty-bouncer-install
13+
14+
if [ -z "$CROWDSEC_OPENRESTY_BOUNCER_URL" ]; then
15+
log "ERROR: bcrypt tool version missing."
16+
exit 1
17+
fi
18+
19+
#
20+
# Install required packages.
21+
#
22+
23+
apk --no-cache add \
24+
build-base \
25+
gettext \
26+
bash \
27+
28+
#
29+
# Build.
30+
#
31+
32+
log "Downloading Crowdsec Openresty Bouncer package..."
33+
mkdir /tmp/crowdsec-openresty-bouncer
34+
curl -# -L "${CROWDSEC_OPENRESTY_BOUNCER_URL}" | tar xz --strip 1 -C /tmp/crowdsec-openresty-bouncer
35+
log "Deploy Crowdsec Openresty Bouncer..."
36+
cd /tmp/crowdsec-openresty-bouncer
37+
bash ./install.sh --NGINX_CONF_DIR=${ROOTFS}/etc/nginx/conf.d --LIB_PATH=${ROOTFS}/var/lib/nginx/lualib --CONFIG_PATH=${ROOTFS}/defaults/crowdsec/ --DATA_PATH=${ROOTFS}/defaults/crowdsec/ --SSL_CERTS_PATH=/etc/ssl/certs/ca-cert-GTS_Root_R1.pem --docker
38+
sed-patch 's|ENABLED=.*|ENABLED=false|' ${ROOTFS}/defaults/crowdsec/crowdsec-openresty-bouncer.conf

0 commit comments

Comments
 (0)