rebrand to NPMplus/improve security headers/upsteam changes/dockerlint

Signed-off-by: Zoey <zoey@z0ey.de>
ZoeyVid · Oct 9, 2023 · fb0bb72 · fb0bb72
1 parent e2214b5
commit fb0bb72
Show file tree

Hide file tree

Showing 31 changed files with 202 additions and 110 deletions.
diff --git a/.github/workflows/caddy-latest.yml b/.github/workflows/caddy-latest.yml
@@ -14,6 +14,9 @@ jobs:
  - name: Convert Username
  id: un
  run: echo "un=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
+ - name: Convert repository name
+ id: rn
+ run: echo "rn=$(echo "${{ github.event.repository.name }}" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
  - name: Login to GitHub Container Registry
  uses: docker/login-action@v3
  with:
@@ -22,9 +25,14 @@ jobs:
  password: ${{ github.token }}
  - name: Push develop to latest
  run: |
- docker buildx imagetools create --tag ${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:caddy ${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:caddy-${{ github.ref_name }}
- docker buildx imagetools create --tag ghcr.io/${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:caddy ghcr.io/${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:caddy-${{ github.ref_name }}
+ docker buildx imagetools create --tag ${{ steps.un.outputs.un }}/nginx-proxy-manager:caddy ${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:caddy-${{ github.ref_name }}
+ docker buildx imagetools create --tag ghcr.io/${{ steps.un.outputs.un }}/nginx-proxy-manager:caddy ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:caddy-${{ github.ref_name }}
+ 
+ docker buildx imagetools create --tag ${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:caddy ${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:caddy-${{ github.ref_name }}
+ docker buildx imagetools create --tag ${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:caddy-${{ github.run_number }} ${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:caddy-${{ github.ref_name }}
+ docker buildx imagetools create --tag ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:caddy ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:caddy-${{ github.ref_name }}
+ docker buildx imagetools create --tag ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:caddy-${{ github.run_number }} ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:caddy-${{ github.ref_name }}
  - name: Show Caddy version
  run: |
- docker run --rm --entrypoint caddy ${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:caddy version
- docker run --rm --entrypoint caddy ghcr.io/${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:caddy version
+ docker run --rm --entrypoint caddy ${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:caddy version
+ docker run --rm --entrypoint caddy ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:caddy version
diff --git a/.github/workflows/caddy.yml b/.github/workflows/caddy.yml
@@ -31,6 +31,9 @@ jobs:
  - name: Convert Username
  id: un
  run: echo "un=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
+ - name: Convert repository name
+ id: rn
+ run: echo "rn=$(echo "${{ github.event.repository.name }}" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
  - name: Login to GitHub Container Registry
  uses: docker/login-action@v3
  with:
@@ -46,5 +49,5 @@ jobs:
  platforms: linux/amd64,linux/arm64 #,linux/amd64/v2,linux/amd64/v3,linux/amd64/v4 #,linux/ppc64le,linux/s390x,linux/386,linux/arm/v7,linux/arm/v6
  push: ${{ github.event_name != 'pull_request' }}
  tags: |
- ${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:caddy-${{ github.ref_name }}
- ghcr.io/${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:caddy-${{ github.ref_name }}
+ ${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:caddy-${{ github.ref_name }}
+ ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:caddy-${{ github.ref_name }}
diff --git a/.github/workflows/docker-latest.yml b/.github/workflows/docker-latest.yml
@@ -14,6 +14,9 @@ jobs:
  - name: Convert Username
  id: un
  run: echo "un=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
+ - name: Convert repository name
+ id: rn
+ run: echo "rn=$(echo "${{ github.event.repository.name }}" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
  - name: Login to GitHub Container Registry
  uses: docker/login-action@v3
  with:
@@ -22,11 +25,14 @@ jobs:
  password: ${{ github.token }}
  - name: Push develop to latest
  run: |
- docker buildx imagetools create --tag ${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:latest ${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:${{ github.ref_name }}
- docker buildx imagetools create --tag ${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:${{ github.run_number }} ${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:${{ github.ref_name }}
- docker buildx imagetools create --tag ghcr.io/${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:latest ghcr.io/${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:${{ github.ref_name }}
- docker buildx imagetools create --tag ghcr.io/${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:${{ github.run_number }} ghcr.io/${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:${{ github.ref_name }}
+ docker buildx imagetools create --tag ${{ steps.un.outputs.un }}/nginx-proxy-manager:latest ${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:${{ github.ref_name }}
+ docker buildx imagetools create --tag ghcr.io/${{ steps.un.outputs.un }}/nginx-proxy-manager:latest ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:${{ github.ref_name }}
+ 
+ docker buildx imagetools create --tag ${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:latest ${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:${{ github.ref_name }}
+ docker buildx imagetools create --tag ${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:${{ github.run_number }} ${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:${{ github.ref_name }}
+ docker buildx imagetools create --tag ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:latest ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:${{ github.ref_name }}
+ docker buildx imagetools create --tag ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:${{ github.run_number }} ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:${{ github.ref_name }}
  - name: Show Nginx version
  run: |
- docker run --rm --entrypoint nginx ${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:latest -V
- docker run --rm --entrypoint nginx ghcr.io/${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:latest -V
+ docker run --rm --entrypoint nginx ${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:latest -V
+ docker run --rm --entrypoint nginx ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:latest -V
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
@@ -42,6 +42,9 @@ jobs:
  - name: Convert Username
  id: un
  run: echo "un=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
+ - name: Convert repository name
+ id: rn
+ run: echo "rn=$(echo "${{ github.event.repository.name }}" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
  - name: Login to GitHub Container Registry
  uses: docker/login-action@v3
  with:
@@ -63,15 +66,15 @@ jobs:
  platforms: linux/amd64,linux/arm64 #,linux/amd64/v2,linux/amd64/v3,linux/amd64/v4 #,linux/ppc64le,linux/s390x,linux/386,linux/arm/v7,linux/arm/v6
  push: ${{ github.event_name != 'pull_request' }}
  tags: |
- ${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:${{ github.ref_name }}
- ghcr.io/${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:${{ github.ref_name }}
+ ${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:${{ github.ref_name }}
+ ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:${{ github.ref_name }}
  build-args: |
- "BUILD=${{ github.event.repository.name }}"
+ "BUILD=${{ steps.rn.outputs.rn }}"
  - name: show version
  if: ${{ github.event_name != 'pull_request' }}
  run: |
- docker run --rm --entrypoint nginx ${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:${{ github.ref_name }} -V
- docker run --rm --entrypoint nginx ghcr.io/${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:${{ github.ref_name }} -V
+ docker run --rm --entrypoint nginx ${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:${{ github.ref_name }} -V
+ docker run --rm --entrypoint nginx ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:${{ github.ref_name }} -V
  - name: Set PR-Number (PR)
  if: ${{ github.event_name == 'pull_request' }}
  id: pr
@@ -84,15 +87,15 @@ jobs:
  file: ./Dockerfile
  platforms: linux/amd64,linux/arm64 #,linux/amd64/v2,linux/amd64/v3,linux/amd64/v4 #,linux/ppc64le,linux/s390x,linux/386,linux/arm/v7,linux/arm/v6
  push: ${{ github.event_name == 'pull_request' }}
- tags: ghcr.io/${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:${{ steps.pr.outputs.pr }}
+ tags: ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:${{ steps.pr.outputs.pr }}
  build-args: |
- "BUILD=${{ github.event.repository.name }}"
+ "BUILD=${{ steps.rn.outputs.rn }}"
  - name: show version (PR)
  if: ${{ github.event_name == 'pull_request' }}
- run: docker run --rm --entrypoint nginx ghcr.io/${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:${{ steps.pr.outputs.pr }} -V
+ run: docker run --rm --entrypoint nginx ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:${{ steps.pr.outputs.pr }} -V
  - name: add comment (PR)
  uses: mshick/add-pr-comment@v2
  if: ${{ github.event_name == 'pull_request' }}
  with:
- message: "The Docker Image can now be found here: `ghcr.io/${{ steps.un.outputs.un }}/${{ github.event.repository.name }}:${{ steps.pr.outputs.pr }}`"
- repo-token: ${{ github.token }}
+ message: "The Docker Image can now be found here: `ghcr.io/${{ steps.un.outputs.un }}/${{ steps.rn.outputs.rn }}:${{ steps.pr.outputs.pr }}`"
+ repo-token: ${{ github.token }}
diff --git a/.github/workflows/dockerlint.yml b/.github/workflows/dockerlint.yml
@@ -0,0 +1,27 @@
+name: Dockerlint
+on:
+ push:
+ pull_request:
+ workflow_dispatch:
+jobs:
+ docker-lint:
+ runs-on: ubuntu-latest
+ name: docker-lint
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+ - name: Install hadolint
+ run: |
+ sudo wget https://github.com/hadolint/hadolint/releases/latest/download/hadolint-Linux-x86_64 -O /usr/bin/hadolint
+ sudo chmod +x /usr/bin/hadolint
+ - name: run lint
+ run: |
+ DOCKERFILES="$(find . -name "*Dockerfile*")"
+ for file in $(echo "$DOCKERFILES" | tr " " "\n"); do
+ # DL3018 warning: Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`
+ # DL3013 warning: Pin versions in pip. Instead of `pip install <package>` use `pip install <package>==<version>` or `pip install --requirement <requirements file>`
+ hadolint "$file" --ignore DL3013 --ignore DL3018 | tee -a hadolint.log
+ done
+ if grep -q "DL[0-9]\+\|SC[0-9]\+" hadolint.log; then
+ exit 1
+ fi
diff --git a/Dockerfile b/Dockerfile
@@ -1,25 +1,26 @@
-FROM --platform="$BUILDPLATFORM" alpine:3.18.3 as frontend
+FROM --platform="$BUILDPLATFORM" alpine:3.18.4 as frontend
 COPY frontend /build/frontend
 COPY global/certbot-dns-plugins.js /build/frontend/certbot-dns-plugins.js
 ARG NODE_ENV=production \
  NODE_OPTIONS=--openssl-legacy-provider
+WORKDIR /build/frontend
 RUN apk add --no-cache ca-certificates nodejs yarn git python3 build-base && \
- cd /build/frontend && \
  yarn --no-lockfile install && \
  yarn --no-lockfile build && \
  yarn cache clean --all
 COPY darkmode.css /build/frontend/dist/css/darkmode.css
 COPY security.txt /build/frontend/dist/.well-known/security.txt
 
 
-FROM --platform="$BUILDPLATFORM" alpine:3.18.3 as backend
+FROM --platform="$BUILDPLATFORM" alpine:3.18.4 as backend
+SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
 COPY backend /build/backend
 COPY global/certbot-dns-plugins.js /build/backend/certbot-dns-plugins.js
 ARG NODE_ENV=production \
  TARGETARCH
+WORKDIR /build/backend
 RUN apk add --no-cache ca-certificates nodejs-current yarn && \
- wget https://gobinaries.com/tj/node-prune -O - | sh && \
- cd /build/backend && \
+ wget -q https://gobinaries.com/tj/node-prune -O - | sh && \
  if [ "$TARGETARCH" = "amd64" ]; then \
  npm_config_target_platform=linux npm_config_target_arch=x64 yarn install --no-lockfile; \
  elif [ "$TARGETARCH" = "arm64" ]; then \
@@ -29,40 +30,40 @@ RUN apk add --no-cache ca-certificates nodejs-current yarn && \
  yarn cache clean --all
 
 
-FROM python:3.11.5-alpine3.18 as certbot
+FROM python:3.12.0-alpine3.18 as certbot
+ENV PATH="/usr/local/certbot/bin:$PATH"
 RUN apk add --no-cache ca-certificates build-base libffi-dev && \
  python3 -m venv /usr/local/certbot && \
- . /usr/local/certbot/bin/activate && \
  pip install --no-cache-dir certbot
 
 
-FROM --platform="$BUILDPLATFORM" alpine:3.18.3 as crowdsec
+FROM --platform="$BUILDPLATFORM" alpine:3.18.4 as crowdsec
+WORKDIR /src
 RUN apk add --no-cache ca-certificates git build-base && \
  git clone --recursive https://github.com/crowdsecurity/cs-nginx-bouncer /src && \
- cd /src && \
  make && \
  tar xzf crowdsec-nginx-bouncer.tgz && \
  mv crowdsec-nginx-bouncer-* crowdsec-nginx-bouncer && \
- cd /src/crowdsec-nginx-bouncer && \
- sed -i "/lua_package_path/d" nginx/crowdsec_nginx.conf && \
- sed -i "s|/etc/crowdsec/bouncers/crowdsec-nginx-bouncer.conf|/data/etc/crowdsec/crowdsec.conf|g" nginx/crowdsec_nginx.conf && \
- sed -i "s|API_KEY=.*|API_KEY=|g" lua-mod/config_example.conf && \
- sed -i "s|ENABLED=.*|ENABLED=false|g" lua-mod/config_example.conf && \
- sed -i "s|API_URL=.*|API_URL=http://127.0.0.1:8080|g" lua-mod/config_example.conf && \
- sed -i "s|BAN_TEMPLATE_PATH=.*|BAN_TEMPLATE_PATH=/data/etc/crowdsec/ban.html|g" lua-mod/config_example.conf && \
- sed -i "s|CAPTCHA_TEMPLATE_PATH=.*|CAPTCHA_TEMPLATE_PATH=/data/etc/crowdsec/captcha.html|g" lua-mod/config_example.conf
+ sed -i "/lua_package_path/d" /src/crowdsec-nginx-bouncer/nginx/crowdsec_nginx.conf && \
+ sed -i "s|/etc/crowdsec/bouncers/crowdsec-nginx-bouncer.conf|/data/etc/crowdsec/crowdsec.conf|g" /src/crowdsec-nginx-bouncer/nginx/crowdsec_nginx.conf && \
+ sed -i "s|API_KEY=.*|API_KEY=|g" /src/crowdsec-nginx-bouncer/lua-mod/config_example.conf && \
+ sed -i "s|ENABLED=.*|ENABLED=false|g" /src/crowdsec-nginx-bouncer/lua-mod/config_example.conf && \
+ sed -i "s|API_URL=.*|API_URL=http://127.0.0.1:8080|g" /src/crowdsec-nginx-bouncer/lua-mod/config_example.conf && \
+ sed -i "s|BAN_TEMPLATE_PATH=.*|BAN_TEMPLATE_PATH=/data/etc/crowdsec/ban.html|g" /src/crowdsec-nginx-bouncer/lua-mod/config_example.conf && \
+ sed -i "s|CAPTCHA_TEMPLATE_PATH=.*|CAPTCHA_TEMPLATE_PATH=/data/etc/crowdsec/captcha.html|g" /src/crowdsec-nginx-bouncer/lua-mod/config_example.conf
 
 
-FROM zoeyvid/nginx-quic:197
+FROM zoeyvid/nginx-quic:205
+SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
 COPY rootfs /
 RUN apk add --no-cache ca-certificates tzdata tini \
  lua5.1-lzlib \
  nodejs-current \
  openssl apache2-utils \
  coreutils grep jq curl shadow sudo \
  luarocks5.1 wget lua5.1-dev build-base git yarn && \
- wget https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/modsecurity.conf-recommended -O /usr/local/nginx/conf/conf.d/include/modsecurity.conf && \
- wget https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/unicode.mapping -O /usr/local/nginx/conf/conf.d/include/unicode.mapping && \
+ wget -q https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/modsecurity.conf-recommended -O /usr/local/nginx/conf/conf.d/include/modsecurity.conf && \
+ wget -q https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/unicode.mapping -O /usr/local/nginx/conf/conf.d/include/unicode.mapping && \
  sed -i "s|SecRuleEngine .*|SecRuleEngine On|g" /usr/local/nginx/conf/conf.d/include/modsecurity.conf && \
  echo "Include /data/etc/modsecurity/modsecurity.conf" | tee -a /usr/local/nginx/conf/conf.d/include/modsecurity.conf && \
  cp /usr/local/nginx/conf/conf.d/include/modsecurity.conf /usr/local/nginx/conf/conf.d/include/modsecurity-crs.conf && \