Skip to content
This repository was archived by the owner on Mar 16, 2024. It is now read-only.

Commit 644849a

Browse files
author
yacht7
committed
Make several changes
- update to Alpine 3.12 - move Shadowsocks and Tinyproxy to wrapper scripts to simplify code - add healthcheck to kill container if OpenVPN can't reconnect
1 parent 52d294b commit 644849a

File tree

5 files changed

+86
-74
lines changed

5 files changed

+86
-74
lines changed

‎Dockerfile‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
1-
FROM alpine:3.11.6
1+
FROM alpine:3.12
22

33
LABEL maintainer="[email protected]"
44

5-
ENV KILL_SWITCH=on
5+
ENV KILL_SWITCH=on\
6+
VPN_LOG_LEVEL=3
67

78
RUN \
89
echo '@testing http://dl-cdn.alpinelinux.org/alpine/edge/testing' >> /etc/apk/repositories && \
@@ -19,4 +20,4 @@ RUN \
1920

2021
COPY data/ /data
2122

22-
ENTRYPOINT ["/data/entry.sh"]
23+
ENTRYPOINT ["/data/scripts/entry.sh"]

data/entry.sh renamed to data/scripts/entry.sh

Lines changed: 52 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,21 @@
11
#!/bin/sh
22

3-
# When you run `docker stop` or any equivalent, a SIGTERM signal is sent to PID 1.
4-
# A process running as PID 1 inside a container is treated specially by Linux:
5-
# it ignores any signal with the default action. As a result, the process will
6-
# not terminate on SIGINT or SIGTERM unless it is coded to do so. Because of this,
7-
# I've defined behavior for when SIGINT and SIGTERM is received.
83
cleanup() {
4+
# When you run `docker stop` or any equivalent, a SIGTERM signal is sent to PID 1.
5+
# A process running as PID 1 inside a container is treated specially by Linux:
6+
# it ignores any signal with the default action. As a result, the process will
7+
# not terminate on SIGINT or SIGTERM unless it is coded to do so. Because of this,
8+
# I've defined behavior for when SIGINT and SIGTERM is received.
9+
if [ $healthcheck_child ]; then
10+
echo "Stopping healthcheck script..."
11+
kill -TERM $healthcheck_child
12+
fi
13+
914
if [ $openvpn_child ]; then
1015
echo "Stopping OpenVPN..."
1116
kill -TERM $openvpn_child
1217
fi
13-
18+
1419
sleep 1
1520
rm $config_file_modified
1621
echo "Exiting."
@@ -20,35 +25,34 @@ cleanup() {
2025
# Capture the filename of the first .conf file to use as the OpenVPN config.
2126
config_file_original=$(ls -1 /data/vpn/*.conf 2> /dev/null | head -1)
2227
if [ -z $config_file_original ]; then
23-
>&2 echo "[ERRO] No configuration file found. Please check your mount and file permissions. Exiting."
28+
>&2 echo "ERROR: No configuration file found. Please check your mount and file permissions. Exiting."
2429
exit 1
2530
fi
2631

27-
vpn_log_level=${VPN_LOG_LEVEL:-3}
28-
if ! $(echo $vpn_log_level | grep -Eq '^([1-9]|1[0-1])$'); then
29-
echo "[WARN] Invalid log level $vpn_log_level. Setting to default."
32+
if ! $(echo $VPN_LOG_LEVEL | grep -Eq '^([1-9]|1[0-1])$'); then
33+
echo "WARNING: Invalid log level $VPN_LOG_LEVEL. Setting to default."
3034
vpn_log_level=3
35+
else
36+
vpn_log_level=$VPN_LOG_LEVEL
3137
fi
3238

33-
echo -e "\n---- Details ----
39+
echo "
40+
---- Running with the following variables ----
3441
Kill switch: ${KILL_SWITCH:-off}
3542
Tinyproxy: ${TINYPROXY:-off}
3643
Shadowsocks: ${SHADOWSOCKS:-off}
3744
Whitelisting subnets: ${SUBNETS:-none}
3845
Using configuration file: $config_file_original
39-
Using OpenVPN log level: $vpn_log_level"
40-
41-
################################################################################
42-
43-
echo -e "\n---- OpenVPN Configuration ----"
46+
Using OpenVPN log level: $vpn_log_level
47+
"
4448

4549
# Create a new configuration file to modify so the original is left untouched.
4650
config_file_modified=${config_file_original}.modified
4751

48-
# These configuration file changes are required by Alpine.
4952
echo "Creating $config_file_modified and making required changes to that file."
5053
cp $config_file_original $config_file_modified
5154

55+
# These configuration file changes are required by Alpine.
5256
sed -i \
5357
-e '/up /c up \/etc\/openvpn\/up.sh' \
5458
-e '/down /c down \/etc\/openvpn\/down.sh' \
@@ -64,15 +68,10 @@ if ! grep -q 'pull-filter ignore "ifconfig-ipv6"' $config_file_modified; then
6468
printf '\npull-filter ignore "ifconfig-ipv6"' >> $config_file_modified
6569
fi
6670

67-
echo "[INFO] Changes made."
71+
echo -e "Changes made.\n"
6872

69-
# Upon receiving a SIGINT or SIGTERM, run the cleanup function.
7073
trap cleanup INT TERM
7174

72-
################################################################################
73-
74-
echo -e "\n---- Network, Kill switch, and Proxies ----"
75-
7675
if [ $KILL_SWITCH = "on" ]; then
7776
local_subnet=$(ip r | grep -v 'default via' | grep eth0 | tail -n 1 | cut -d " " -f 1)
7877
default_gateway=$(ip r | grep 'default via' | cut -d " " -f 3)
@@ -123,11 +122,12 @@ if [ $KILL_SWITCH = "on" ]; then
123122
echo "Allowing connections over VPN interface to forwarded ports..."
124123
if [ ! -z $FORWARDED_PORTS ]; then
125124
for port in ${FORWARDED_PORTS//,/ }; do
126-
if [ $port -lt 1024 ] || [ $port -gt 65535 ]; then
127-
echo "[WARN] $port not a valid port. Ignoring."
125+
if $(echo $port | grep -Eq '^[0-9]+$') && [ $port -ge 1024 ] && [ $port -le 65535 ]; then
126+
iptables -A INPUT -i tun0 -p tcp --dport $port -j ACCEPT
127+
iptables -A INPUT -i tun0 -p udp --dport $port -j ACCEPT
128+
else
129+
echo "WARNING: $port not a valid port. Ignoring."
128130
fi
129-
iptables -A INPUT -i tun0 -p tcp --dport $port -j ACCEPT
130-
iptables -A INPUT -i tun0 -p udp --dport $port -j ACCEPT
131131
done
132132
fi
133133

@@ -136,61 +136,42 @@ if [ $KILL_SWITCH = "on" ]; then
136136
iptables -P OUTPUT DROP
137137
iptables -P FORWARD DROP
138138

139-
echo "[INFO] iptables rules created and routes configured."
139+
echo -e "iptables rules created and routes configured.\n"
140140
else
141-
echo "[WARN] VPN kill switch is disabled. Traffic will be allowed outside of the tunnel if the connection is lost."
141+
echo -e "WARNING: VPN kill switch is disabled. Traffic will be allowed outside of the tunnel if the connection is lost.\n"
142142
fi
143143

144144
if [ "$SHADOWSOCKS" = "on" ]; then
145-
# https://www.gnu.org/software/bash/manual/html_node/Command-Grouping.html
146-
{
147-
echo "[INFO] Running Shadowsocks"
148-
# Wait for VPN connection to be established
149-
while ! ping -c 1 1.1.1.1 > /dev/null 2>&1; do
150-
sleep 1
151-
done
152-
153-
sed -i \
154-
-e "/server_port/c\ \"server_port\": ${SHADOWSOCKS_PORT:-8388}," \
155-
-e "/password/c\ \"password\": \"${SHADOWSOCKS_PASS:-password}\"," \
156-
/data/shadowsocks.conf
157-
158-
sleep 1
159-
ss-server -c /data/shadowsocks.conf
160-
} &
145+
echo -e "Running Shadowsocks.\n"
146+
sed -i \
147+
-e "/server_port/c\ \"server_port\": ${SHADOWSOCKS_PORT:-8388}," \
148+
-e "/password/c\ \"password\": \"${SHADOWSOCKS_PASS:-password}\"," \
149+
/data/shadowsocks.conf
150+
/data/scripts/shadowsocks-wrapper.sh &
161151
fi
162152

163153
if [ "$TINYPROXY" = "on" ]; then
164-
# https://www.gnu.org/software/bash/manual/html_node/Command-Grouping.html
165-
{
166-
echo "[INFO] Running Tinyproxy"
167-
while ! ping -c 1 1.1.1.1 > /dev/null 2>&1; do
168-
sleep 1
169-
done
170-
171-
addr_tun=$(ip a show dev tun0 | grep inet | cut -d " " -f 6 | cut -d "/" -f 1)
172-
173-
sed -i \
174-
-e "/Port/c Port ${TINYPROXY_PORT:-8888}" \
175-
-e "/Bind/c Bind $addr_tun" \
176-
/data//tinyproxy.conf
177-
178-
if [ $TINYPROXY_USER ]; then
179-
if [ $TINYPROXY_PASS ]; then
180-
echo -e "\nBasicAuth $TINYPROXY_USER $TINYPROXY_PASS" >> /data/tinyproxy.conf
181-
else
182-
echo "[WARN] Tinyproxy username supplied without password. Starting without credentials."
183-
fi
154+
echo -e "Running Tinyproxy.\n"
155+
sed -i \
156+
-e "/Port/c Port ${TINYPROXY_PORT:-8888}" \
157+
/data/tinyproxy.conf
158+
159+
if [ $TINYPROXY_USER ]; then
160+
if [ $TINYPROXY_PASS ]; then
161+
echo -e "\nBasicAuth $TINYPROXY_USER $TINYPROXY_PASS" >> /data/tinyproxy.conf
162+
else
163+
echo "WARNING: Tinyproxy username supplied without password. Starting without credentials."
184164
fi
185-
186-
sleep 1
187-
tinyproxy -c /data/tinyproxy.conf
188-
} &
165+
fi
166+
/data/scripts/tinyproxy-wrapper.sh &
189167
fi
190168

191-
echo "[INFO] Running OpenVPN"
169+
# /data/scripts/healthcheck.sh &
170+
# healthcheck_child=$!
192171

193-
openvpn --verb $vpn_log_level --auth-nocache --cd /data/vpn --config $config_file_modified &
172+
echo -e "Running OpenVPN client.\n"
194173

174+
openvpn --auth-nocache --cd /data/vpn --verb $vpn_log_level --config $config_file_modified &
195175
openvpn_child=$!
176+
196177
wait $openvpn_child

‎data/scripts/healthcheck.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/sh
2+
3+
sleep 10
4+
while ping -c 3 1.1.1.1 > /dev/null 2>&1; do
5+
sleep 10
6+
done
7+
echo "ERROR: Failed ping healthcheck. Exiting."
8+
9+
kill -- -1

‎data/scripts/shadowsocks-wrapper.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/sh
2+
3+
until ping -c 3 1.1.1.1 > /dev/null 2>&1; do
4+
sleep 1
5+
done
6+
7+
ss-server -c /data/shadowsocks.conf

‎data/scripts/tinyproxy-wrapper.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/sh
2+
3+
until ping -c 3 1.1.1.1 > /dev/null 2>&1; do
4+
sleep 1
5+
done
6+
7+
# This part is in the wrapper script because addr_tun requires the VPN connection
8+
# to be established.
9+
addr_tun=$(ip a show dev tun0 | grep inet | cut -d " " -f 6 | cut -d "/" -f 1)
10+
sed -i \
11+
-e "/Bind/c Bind $addr_tun" \
12+
/data/tinyproxy.conf
13+
14+
tinyproxy -d -c /data/tinyproxy.conf

0 commit comments

Comments
 (0)