sashatrask
62 lines
3.2 KiB
Docker
62 lines
3.2 KiB
Docker
FROM caddy:2.10.2-alpine@sha256:4c6e91c6ed0e2fa03efd5b44747b625fec79bc9cd06ac5235a779726618e530d AS caddy-edge-e2e
|
|
|
|
FROM debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171 AS fail2ban-edge-e2e
|
|
|
|
COPY --from=caddy-edge-e2e --chown=0:0 --chmod=0444 /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
|
|
RUN <<'SH'
|
|
set -eu
|
|
rm -f /etc/apt/sources.list /etc/apt/sources.list.d/debian.sources
|
|
printf '%s\n' \
|
|
'Types: deb' \
|
|
'URIs: http://snapshot.debian.org/archive/debian/20260914T000000Z/' \
|
|
'Suites: bookworm bookworm-updates' \
|
|
'Components: main' \
|
|
'Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg' \
|
|
'Check-Valid-Until: no' \
|
|
'' \
|
|
'Types: deb' \
|
|
'URIs: http://snapshot.debian.org/archive/debian-security/20260914T000000Z/' \
|
|
'Suites: bookworm-security' \
|
|
'Components: main' \
|
|
'Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg' \
|
|
'Check-Valid-Until: no' \
|
|
> /etc/apt/sources.list.d/debian.sources
|
|
printf '#!/bin/sh\nexit 101\n' > /usr/sbin/policy-rc.d
|
|
chmod 0755 /usr/sbin/policy-rc.d
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get -o Acquire::Retries=3 -o Acquire::https::Timeout=30 -o APT::Update::Error-Mode=any update
|
|
apt-get install -y --no-install-recommends fail2ban=1.0.2-2
|
|
rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/* /var/log/apt/*
|
|
find /etc/fail2ban/jail.d -type f -delete
|
|
install -d -o 0 -g 0 -m 0755 \
|
|
/etc/caddy /etc/caddy/denylist /etc/caddy/tls /etc/fail2ban/action.d /etc/fail2ban/fail2ban.d \
|
|
/etc/fail2ban/filter.d /etc/fail2ban/jail.d /etc/truf-edge/denylist \
|
|
/run/fail2ban /var/lib/fail2ban /var/lib/truf-edge /var/log/caddy /var/log/truf-edge
|
|
SH
|
|
|
|
COPY --from=caddy-edge-e2e --chown=0:0 --chmod=0555 /usr/bin/caddy /usr/bin/caddy
|
|
RUN cp /usr/bin/caddy /usr/bin/caddy-edge-e2e \
|
|
&& rm /usr/bin/caddy \
|
|
&& mv /usr/bin/caddy-edge-e2e /usr/bin/caddy \
|
|
&& chmod 0555 /usr/bin/caddy
|
|
COPY --chown=0:0 --chmod=0444 deploy/edge/Caddyfile /etc/caddy/Caddyfile
|
|
RUN chmod 0644 /etc/caddy/Caddyfile \
|
|
&& sed -i 's/^[[:space:]]*admin off$/\tadmin 127.0.0.1:2019/' /etc/caddy/Caddyfile \
|
|
&& chmod 0444 /etc/caddy/Caddyfile \
|
|
&& grep -Fx ' admin 127.0.0.1:2019' /etc/caddy/Caddyfile >/dev/null
|
|
COPY --chown=0:0 --chmod=0444 deploy/fail2ban/filter.d-truf-admin-auth.conf /etc/fail2ban/filter.d/truf-admin-auth.conf
|
|
COPY --chown=0:0 --chmod=0444 deploy/fail2ban/jail.d-truf-admin-auth.local /etc/fail2ban/jail.d/truf-admin-auth.local
|
|
COPY --chown=0:0 --chmod=0444 deploy/fail2ban/action.d-truf-caddy-admin-denylist.conf /etc/fail2ban/action.d/truf-caddy-admin-denylist.conf
|
|
COPY --chown=0:0 --chmod=0444 deploy/fail2ban/fail2ban.d-truf-persistence.local /etc/fail2ban/fail2ban.d/truf-persistence.local
|
|
COPY --chown=0:0 --chmod=0444 deploy/fail2ban/fail2ban.d-edge-e2e.local /etc/fail2ban/fail2ban.d/edge-e2e.local
|
|
COPY --chown=0:0 --chmod=0555 deploy/fail2ban/truf_caddy_admin_denylist.py /usr/local/sbin/truf-caddy-admin-denylist
|
|
COPY --chown=0:0 --chmod=0555 deploy/fail2ban/edge_e2e_docker_shim.py /usr/local/bin/docker
|
|
|
|
RUN fail2ban-server --version 2>&1 | grep -F 'v1.0.2' >/dev/null \
|
|
&& test "$(find /etc/fail2ban/jail.d -type f | wc -l)" -eq 1
|
|
|
|
USER 0:0
|
|
ENTRYPOINT ["/usr/bin/fail2ban-server", "-f", "-x"]
|
|
CMD []
|