Skip to content

Commit ea4c759

Browse files
wouldgowouldgo
authored
Merge pull request #4 from 720kb/next
Next
2 parents 7c22c34 + 834a3e3 commit ea4c759

9 files changed

+189
-173
lines changed

‎.gitignore

Whitespace-only changes.

‎.gitmodules

-3
This file was deleted.

‎Dockerfile

+144-78
Original file line numberDiff line numberDiff line change
@@ -1,86 +1,152 @@
1-
FROM ubuntu
2-
MAINTAINER Dario Andrei <wouldgo84@gmail.com>
1+
FROM alpine:3.6
2+
ARG NGINX_VERSION=1.13.2
3+
#ftp://ftp.openssl.org/source/
4+
ARG OPENSSL_VERSION=1.0.2l
5+
ARG HEADERES_MORE_NGINX_MODULE=0.33
6+
ARG MODSECURITY_MODULE=3.0.0
7+
ARG MODSECURITY_NGINX_MODULE=1.0.0
8+
ARG NAXSI_MODULE=0.55.3
39

4-
RUN apt-get update && apt-get upgrade -y
10+
RUN apk --no-cache add \
11+
curl-dev \
12+
wget \
13+
linux-headers \
14+
alpine-sdk \
15+
zlib-dev \
16+
pcre-dev \
17+
libxslt-dev \
18+
libxml2-dev \
19+
geoip-dev \
20+
perl \
21+
libaio-dev \
22+
acme-client \
23+
libtool \
24+
m4 \
25+
autoconf \
26+
automake \
27+
yajl-dev \
28+
gd-dev
529

6-
RUN apt-get install -y \
7-
wget \
8-
build-essential \
9-
zlib1g-dev \
10-
libpcre3-dev \
11-
libxslt1-dev \
12-
libxml2-dev \
13-
libgd2-xpm-dev \
14-
libgeoip-dev \
15-
libgoogle-perftools-dev \
16-
libperl-dev
30+
RUN addgroup -g 9000 -S www-data \
31+
&& adduser -u 9000 -D -S -G www-data www-data
1732

18-
RUN wget http://nginx.org/download/nginx-$(wget -O - http://nginx.org/download/ | \
19-
grep -o -P '<a href="nginx-.+.tar.gz">' | \
20-
sed -re's/<a href="nginx-(.+)\.tar.gz">/\1/g' | \
21-
tail -1).tar.gz -O latest_ngnix.gzipped && \
22-
wget $(wget -O - ftp://ftp.openssl.org/source/ | \
23-
grep -o -P 'ftp://ftp\.openssl\.org:21/source/openssl-1\.0\.2\w.*.tar.gz' | \
24-
sed -re's/(ftp:\/\/ftp\.openssl\.org:21\/source\/openssl-1\.0\.2\w\.tar\.gz)">.+/\1/g' | \
25-
sed -n 1p) -O latest_openssl.gzipped
33+
RUN mkdir -p /tmp/nginx \
34+
/tmp/headers-more-nginx-module \
35+
/tmp/modsecurity-nginx \
36+
/tmp/naxsi \
37+
/opt/.openssl \
38+
/opt/nginx-configuration \
39+
/opt/modsecurity
2640

27-
RUN mkdir -p /tmp/nginx /opt/.openssl && \
28-
mkdir -p /opt/nginx-configuration && \
29-
tar --extract --file=latest_openssl.gzipped --strip-components=1 --directory=/opt/.openssl && \
30-
cd /opt/.openssl && \
31-
./config --prefix=/usr/local \
32-
--openssldir=/usr/local/open-ssl \
33-
threads \
34-
zlib && \
35-
make && \
36-
make test && \
37-
make install && \
38-
cd / && \
39-
tar --extract --file=latest_ngnix.gzipped --strip-components=1 --directory=/tmp/nginx && \
40-
cd /tmp/nginx && \
41-
./configure --prefix=/usr/local/nginx \
42-
--sbin-path=/usr/local/sbin/nginx \
43-
--conf-path=/opt/nginx-configuration/nginx.conf \
44-
--error-log-path=/var/log/nginx/error.log \
45-
--http-log-path=/var/log/nginx/access.log \
46-
--pid-path=/var/run/nginx.pid \
47-
--lock-path=/run/lock/subsys/nginx \
48-
--user=www-data --group=www-data \
49-
--with-file-aio \
50-
--with-ipv6 \
51-
--with-http_ssl_module \
52-
--with-openssl=/opt/.openssl \
53-
--with-stream \
54-
--with-http_v2_module \
55-
--with-http_realip_module \
56-
--with-http_addition_module \
57-
--with-http_xslt_module \
58-
--with-http_image_filter_module \
59-
--with-http_geoip_module \
60-
--with-http_sub_module \
61-
--with-http_dav_module \
62-
--with-http_flv_module \
63-
--with-http_mp4_module \
64-
--with-http_gunzip_module \
65-
--with-http_gzip_static_module \
66-
--with-http_random_index_module \
67-
--with-http_secure_link_module \
68-
--with-http_degradation_module \
69-
--with-http_stub_status_module \
70-
--with-http_perl_module \
71-
--with-mail \
72-
--with-mail_ssl_module \
73-
--with-pcre \
74-
--with-google_perftools_module \
75-
--with-debug && \
76-
make && \
77-
make install
41+
RUN wget http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz \
42+
-O latest_ngnix.gzipped
43+
RUN wget ftp://ftp.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz \
44+
-O latest_openssl.gzipped
45+
RUN wget https://github.com/openresty/headers-more-nginx-module/archive/v${HEADERES_MORE_NGINX_MODULE}.tar.gz \
46+
-O headers_more_nginx_module.gzipped
47+
RUN wget https://github.com/SpiderLabs/ModSecurity/releases/download/v${MODSECURITY_MODULE}/modsecurity-v${MODSECURITY_MODULE}.tar.gz \
48+
-O modsecurity.gzipped
49+
RUN wget https://github.com/SpiderLabs/ModSecurity-nginx/releases/download/v${MODSECURITY_NGINX_MODULE}/modsecurity-nginx-v${MODSECURITY_NGINX_MODULE}.tar.gz \
50+
-O modsecurity-nginx.gzipped
51+
RUN wget https://github.com/nbs-system/naxsi/archive/${NAXSI_MODULE}.tar.gz \
52+
-O naxsi.gzipped
7853

79-
RUN openssl dhparam -out /etc/dh2048.pem 2048
54+
WORKDIR /
55+
RUN tar --extract \
56+
--strip-components=1 \
57+
--file=latest_ngnix.gzipped --directory=/tmp/nginx \
58+
&& tar --extract \
59+
--strip-components=1 \
60+
--file=modsecurity.gzipped --directory=/opt/modsecurity \
61+
&& tar --extract \
62+
--strip-components=1 \
63+
--file=headers_more_nginx_module.gzipped --directory=/tmp/headers-more-nginx-module \
64+
&& tar --extract \
65+
--strip-components=1 \
66+
--file=latest_openssl.gzipped --directory=/opt/.openssl \
67+
&& tar --extract \
68+
--strip-components=1 \
69+
--file=modsecurity-nginx.gzipped --directory=/tmp/modsecurity-nginx \
70+
&& tar --extract \
71+
--strip-components=1 \
72+
--file=naxsi.gzipped --directory=/tmp/naxsi \
73+
&& rm -Rfv latest_ngnix.gzipped \
74+
latest_openssl.gzipped \
75+
headers_more_nginx_module.gzipped \
76+
modsecurity.gzipped \
77+
modsecurity-nginx.gzipped \
78+
naxsi.gzipped
79+
80+
WORKDIR /opt/modsecurity
81+
RUN ./configure \
82+
&& make -j 8 \
83+
&& make install
84+
85+
WORKDIR /opt/.openssl
86+
RUN ./config --prefix=/usr/local \
87+
--openssldir=/usr/local/open-ssl \
88+
threads \
89+
zlib \
90+
&& make -j 8 \
91+
&& make test \
92+
&& make install
93+
94+
WORKDIR /tmp/nginx
95+
RUN ./configure --prefix=/usr/local/nginx \
96+
--sbin-path=/usr/local/sbin/nginx \
97+
--user=www-data --group=www-data \
98+
--pid-path=/var/run/nginx.pid \
99+
--lock-path=/run/lock/subsys/nginx \
100+
--http-client-body-temp-path=/var/lib/nginx/body \
101+
--http-proxy-temp-path=/var/lib/nginx/proxy \
102+
--http-log-path=/var/log/nginx/access.log \
103+
--error-log-path=/var/log/nginx/error.log \
104+
--conf-path=/opt/nginx-configuration/nginx.conf \
105+
--add-module=/tmp/headers-more-nginx-module \
106+
--add-module=/tmp/modsecurity-nginx \
107+
--add-module=/tmp/naxsi/naxsi_src \
108+
--with-openssl=/opt/.openssl \
109+
--with-file-aio \
110+
--with-ipv6 \
111+
--with-http_ssl_module \
112+
--with-http_v2_module \
113+
--with-stream \
114+
--with-stream_ssl_module \
115+
--with-http_realip_module \
116+
--with-http_addition_module \
117+
--with-http_xslt_module \
118+
--with-http_image_filter_module \
119+
--with-http_geoip_module \
120+
--with-http_sub_module \
121+
--with-http_dav_module \
122+
--with-http_flv_module \
123+
--with-http_mp4_module \
124+
--with-http_gunzip_module \
125+
--with-http_gzip_static_module \
126+
--with-http_random_index_module \
127+
--with-http_secure_link_module \
128+
--with-http_degradation_module \
129+
--with-http_stub_status_module \
130+
--with-pcre-jit \
131+
--with-pcre \
132+
--with-debug \
133+
--with-mail \
134+
--with-mail_ssl_module \
135+
--without-mail_pop3_module \
136+
--without-http_uwsgi_module \
137+
--without-http_scgi_module \
138+
&& make -j 8 \
139+
&& make install
140+
141+
RUN openssl dhparam -out /etc/dhparam.pem 4096
142+
RUN mv /tmp/naxsi/naxsi_config/naxsi_core.rules /opt/naxsi_core.rules
143+
RUN mkdir -p /var/lib/nginx/body /var/www/acme
144+
RUN rm -Rfv /tmp/*
80145

81-
RUN mkdir /add-folder && mkdir -p /www/log
82-
ADD ./run/bootstrap.sh /opt/bootstrap.sh
83-
ADD ./add-folder.sh /add-folder/add-folder.sh
84146
EXPOSE 80 443
147+
WORKDIR /opt
148+
ADD ./run/bootstrap.sh bootstrap.sh
149+
ADD ./certbot certbot/
150+
RUN chmod u+x bootstrap.sh
85151

86-
CMD ["/bin/bash", "/opt/bootstrap.sh" ]
152+
ENTRYPOINT ["sh", "bootstrap.sh" ]

‎add-folder.sh

-71
This file was deleted.

‎build.sh

-8
This file was deleted.

‎certbot/config.ini

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
rsa-key-size = 4096
2+
email = wouldgo84@gmail.com
3+
server = https://acme-v01.api.letsencrypt.org/directory
4+
text = True

‎docker-compose.yml

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
version: '3.2'
2+
services:
3+
nginx:
4+
image: 720kb/nginx
5+
container_name: nginx
6+
hostname: nginx
7+
build:
8+
context: .
9+
dockerfile: Dockerfile
10+
args:
11+
NGINX_VERSION: 1.13.7
12+
OPENSSL_VERSION: 1.0.2n
13+
HEADERES_MORE_NGINX_MODULE: 0.33
14+
MODSECURITY_MODULE: 3.0.0
15+
MODSECURITY_NGINX_MODULE: 1.0.0
16+
NAXSI_MODULE: 0.55.3
17+
volumes:
18+
- type: volume
19+
source: nginx-conf
20+
target: /opt/nginx-configuration
21+
read_only: true
22+
- type: volume
23+
source: sites
24+
target: /var/sites
25+
read_only: true
26+
networks:
27+
- dmz
28+
- internal
29+
ports:
30+
- "80:80"
31+
- "443:443"
32+
networks:
33+
dmz:
34+
internal:
35+
36+
volumes:
37+
nginx-conf:
38+
driver: kassisol/gitvol:0.1.0
39+
driver_opts:
40+
url: https://${GITHUB_ACCESS_TOKEN}@github.com/720kb/nginx-confs.git
41+
sites:

‎nginx-configuration

-1
This file was deleted.

‎run-nginx.sh

-12
This file was deleted.

0 commit comments

Comments
 (0)