migrate to alpine image
This commit is contained in:
mercury
+34
-27
@@ -307,7 +307,7 @@ class Bot
|
||||
|
||||
public function generateSecret()
|
||||
{
|
||||
$this->secretSet(trim($this->ssh('head -c 16 /dev/urandom | xxd -ps', 'tg')));
|
||||
$this->secretSet(exec('head -c 16 /dev/urandom | xxd -ps'));
|
||||
}
|
||||
|
||||
public function setSecret()
|
||||
@@ -338,7 +338,7 @@ class Bot
|
||||
$this->ssh('pkill mtproto-proxy', 'tg');
|
||||
if (preg_match('~^\w{32}$~', $secret)) {
|
||||
$p = getenv('TGPORT');
|
||||
$this->ssh("/MTProxy/objs/bin/mtproto-proxy -u nobody -H $p --nat-info 10.10.0.8:{$this->ip} -S $secret --aes-pwd /proxy-secret /proxy-multi.conf -M 1 >/dev/null 2>&1 &", 'tg');
|
||||
$this->ssh("/MTProxy/mtproto-proxy -u nobody -H $p --nat-info 10.10.0.8:{$this->ip} -S $secret --aes-pwd /proxy-secret /proxy-multi.conf -M 1 >/dev/null 2>&1 &", 'tg');
|
||||
}
|
||||
}
|
||||
|
||||
@@ -461,8 +461,8 @@ class Bot
|
||||
$c['password'] = $l['password'] = $pass;
|
||||
file_put_contents('/config/ssserver.json', json_encode($c, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES));
|
||||
file_put_contents('/config/sslocal.json', json_encode($l, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES));
|
||||
$this->ssh('/ssserver -v -d -c /config.json', 'ss');
|
||||
$this->ssh('/sslocal -v -d -c /config.json', 'proxy');
|
||||
$this->ssh('/ss/ssserver -v -d -c /config.json', 'ss');
|
||||
$this->ssh('/ss/sslocal -v -d -c /config.json', 'proxy');
|
||||
$this->menu('ss');
|
||||
}
|
||||
|
||||
@@ -492,8 +492,8 @@ class Bot
|
||||
}
|
||||
file_put_contents('/config/ssserver.json', json_encode($c, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES));
|
||||
file_put_contents('/config/sslocal.json', json_encode($l, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES));
|
||||
$this->ssh('/ssserver -v -d -c /config.json', 'ss');
|
||||
$this->ssh('/sslocal -v -d -c /config.json', 'proxy');
|
||||
$this->ssh('/ss/ssserver -v -d -c /config.json', 'ss');
|
||||
$this->ssh('/ss/sslocal -v -d -c /config.json', 'proxy');
|
||||
$this->menu('ss');
|
||||
}
|
||||
|
||||
@@ -801,9 +801,9 @@ class Bot
|
||||
if (!empty($json['ad'])) {
|
||||
$out[] = 'update adguard';
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
$this->ssh("/AdGuardHome/AdGuardHome -s stop 2>&1", 'ad');
|
||||
$this->stopAd();
|
||||
yaml_emit_file('/config/adguard/AdGuardHome.yaml', $json['ad']);
|
||||
$this->ssh("/AdGuardHome/AdGuardHome -s start 2>&1", 'ad');
|
||||
$this->startAd();
|
||||
}
|
||||
// ss
|
||||
if (!empty($json['ss'])) {
|
||||
@@ -811,7 +811,7 @@ class Bot
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
$this->ssh('pkill ssserver', 'ss');
|
||||
file_put_contents('/config/ssserver.json', json_encode($json['ss'], JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES));
|
||||
$this->ssh('/ssserver -v -d -c /config.json', 'ss');
|
||||
$this->ssh('/ss/ssserver -v -d -c /config.json', 'ss');
|
||||
}
|
||||
// sl
|
||||
if (!empty($json['sl'])) {
|
||||
@@ -819,7 +819,7 @@ class Bot
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
$this->ssh('pkill sslocal', 'proxy');
|
||||
file_put_contents('/config/sslocal.json', json_encode($json['sl'], JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES));
|
||||
$this->ssh('/sslocal -v -d -c /config.json', 'proxy');
|
||||
$this->ssh('/ss/sslocal -v -d -c /config.json', 'proxy');
|
||||
}
|
||||
// mtproto
|
||||
if (!empty($json['mtproto'])) {
|
||||
@@ -1076,13 +1076,13 @@ class Bot
|
||||
if (preg_match('~test is successful~', $u)) {
|
||||
$u .= $this->ssh("nginx -s reload 2>&1", 'ng');
|
||||
$this->update($this->input['chat'], $this->input['message_id'], $u);
|
||||
$u .= $this->ssh("/AdGuardHome/AdGuardHome -s stop 2>&1", 'ad');
|
||||
$u .= $this->stopAd();
|
||||
$this->update($this->input['chat'], $this->input['message_id'], $u);
|
||||
$c = yaml_parse_file('/config/adguard/AdGuardHome.yaml');
|
||||
$c['tls']['enabled'] = false;
|
||||
$c['tls']['server_name'] = '';
|
||||
yaml_emit_file('/config/adguard/AdGuardHome.yaml', $c);
|
||||
$u .= $this->ssh("/AdGuardHome/AdGuardHome -s start 2>&1", 'ad');
|
||||
$u .= $this->startAd();
|
||||
$this->update($this->input['chat'], $this->input['message_id'], $u);
|
||||
unlink('/certs/cert_private');
|
||||
unlink('/certs/cert_public');
|
||||
@@ -1142,13 +1142,13 @@ class Bot
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
$out[] = 'Restart Adguard Home';
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
$out[] = $this->ssh("/AdGuardHome/AdGuardHome -s stop 2>&1", 'ad');
|
||||
$out[] = $this->stopAd();
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
$c = yaml_parse_file('/config/adguard/AdGuardHome.yaml');
|
||||
$c['tls']['enabled'] = true;
|
||||
$c['tls']['server_name'] = $conf['domain'];
|
||||
yaml_emit_file('/config/adguard/AdGuardHome.yaml', $c);
|
||||
$out[] = $this->ssh("/AdGuardHome/AdGuardHome -s start 2>&1", 'ad');
|
||||
$out[] = $this->startAd();
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
} else {
|
||||
file_put_contents('/config/nginx.conf', $nginx);
|
||||
@@ -1334,7 +1334,7 @@ class Bot
|
||||
{
|
||||
$out[] = 'Restart Adguard Home';
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
$out[] = $this->ssh("/AdGuardHome/AdGuardHome -s stop 2>&1", 'ad');
|
||||
$out[] = $this->stopAd();
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
$c = yaml_parse_file('/config/adguard/AdGuardHome.yaml');
|
||||
$c['users'][0]['password'] = password_hash($pass, PASSWORD_DEFAULT);
|
||||
@@ -1342,7 +1342,7 @@ class Bot
|
||||
$p = $this->getPacConf();
|
||||
$p['adpswd'] = $pass;
|
||||
$this->setPacConf($p);
|
||||
$out[] = $this->ssh("/AdGuardHome/AdGuardHome -s start 2>&1", 'ad');
|
||||
$out[] = $this->startAd();
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
sleep(3);
|
||||
$this->menu('adguard');
|
||||
@@ -1352,11 +1352,11 @@ class Bot
|
||||
{
|
||||
$out[] = 'Restart Adguard Home';
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
$out[] = $this->ssh("/AdGuardHome/AdGuardHome -s stop 2>&1", 'ad');
|
||||
$out[] = $this->stopAd();
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
$c = yaml_parse_file('/config/AdGuardHome.yaml');
|
||||
yaml_emit_file('/config/adguard/AdGuardHome.yaml', $c);
|
||||
$out[] = $this->ssh("/AdGuardHome/AdGuardHome -s start 2>&1", 'ad');
|
||||
$out[] = $this->startAd();
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
sleep(3);
|
||||
$this->menu('adguard');
|
||||
@@ -1420,12 +1420,12 @@ DNS-over-HTTPS with IP:
|
||||
{
|
||||
$out[] = 'Restart Adguard Home';
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
$out[] = $this->ssh("/AdGuardHome/AdGuardHome -s stop 2>&1", 'ad');
|
||||
$out[] = $this->stopAd();
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
$c = yaml_parse_file('/config/adguard/AdGuardHome.yaml');
|
||||
$c['dns']['upstream_dns'][] = $url;
|
||||
yaml_emit_file('/config/adguard/AdGuardHome.yaml', $c);
|
||||
$out[] = $this->ssh("/AdGuardHome/AdGuardHome -s start 2>&1", 'ad');
|
||||
$out[] = $this->startAd();
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
sleep(3);
|
||||
$this->menu('adguard');
|
||||
@@ -1435,17 +1435,24 @@ DNS-over-HTTPS with IP:
|
||||
{
|
||||
$out[] = 'Restart Adguard Home';
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
$out[] = $this->ssh("/AdGuardHome/AdGuardHome -s stop 2>&1", 'ad');
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
$this->stopAd();
|
||||
$c = yaml_parse_file('/config/adguard/AdGuardHome.yaml');
|
||||
unset($c['dns']['upstream_dns'][$k]);
|
||||
yaml_emit_file('/config/adguard/AdGuardHome.yaml', $c);
|
||||
$out[] = $this->ssh("/AdGuardHome/AdGuardHome -s start 2>&1", 'ad');
|
||||
$this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
|
||||
sleep(3);
|
||||
$this->startAd();
|
||||
$this->menu('adguard');
|
||||
}
|
||||
|
||||
public function startAd()
|
||||
{
|
||||
return $this->ssh('/AdGuardHome/AdGuardHome --pidfile /AdGuardHome/pid -c /opt/adguardhome/AdGuardHome.yaml -h 0.0.0.0 -w /opt/adguardhome/ > /dev/null 2>&1 &', 'ad', false);
|
||||
}
|
||||
|
||||
public function stopAd()
|
||||
{
|
||||
return $this->ssh('kill -15 $(cat /AdGuardHome/pid)', 'ad');
|
||||
}
|
||||
|
||||
public function selfsslInstall()
|
||||
{
|
||||
$this->setSSL('self');
|
||||
@@ -3077,7 +3084,7 @@ DNS-over-HTTPS with IP:
|
||||
$this->send($this->input['chat'], "disconnect: \n" . var_export($args, true) . "\n", $this->input['message_id']);
|
||||
}
|
||||
|
||||
public function ssh($cmd, $service = 'wg')
|
||||
public function ssh($cmd, $service = 'wg', $wait = true)
|
||||
{
|
||||
try {
|
||||
$c = ssh2_connect($service, 22);
|
||||
@@ -3092,7 +3099,7 @@ DNS-over-HTTPS with IP:
|
||||
if (empty($s)) {
|
||||
throw new Exception("exec fail: \n$cmd\n" . var_export($s, true));
|
||||
}
|
||||
stream_set_blocking($s, true);
|
||||
stream_set_blocking($s, $wait);
|
||||
$data = "";
|
||||
while ($buf = fread($s, 4096)) {
|
||||
$data .= $buf;
|
||||
|
||||
+3
-5
@@ -1,8 +1,6 @@
|
||||
user nginx;
|
||||
worker_processes auto;
|
||||
|
||||
load_module modules/ngx_stream_js_module.so;
|
||||
|
||||
error_log /logs/nginx_error;
|
||||
pid /var/run/nginx.pid;
|
||||
|
||||
@@ -36,11 +34,11 @@ http {
|
||||
}
|
||||
location /pac {
|
||||
access_log /logs/nginx_pac_access;
|
||||
proxy_pass http://unit;
|
||||
proxy_pass http://php;
|
||||
}
|
||||
location /tlgrm {
|
||||
access_log /logs/nginx_tlgrm_access;
|
||||
proxy_pass http://unit;
|
||||
proxy_pass http://php;
|
||||
}
|
||||
location /v2ray {
|
||||
access_log /logs/nginx_v2ray_access;
|
||||
@@ -86,7 +84,7 @@ http {
|
||||
# }
|
||||
# location /pac {
|
||||
# access_log /logs/nginx_pac_access;
|
||||
# proxy_pass http://unit;
|
||||
# proxy_pass http://php;
|
||||
# }
|
||||
# location ~\.well-known {
|
||||
# access_log /logs/nginx_certbot_access;
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
user nginx;
|
||||
worker_processes auto;
|
||||
|
||||
load_module modules/ngx_stream_js_module.so;
|
||||
|
||||
error_log /logs/nginx_error;
|
||||
pid /var/run/nginx.pid;
|
||||
|
||||
@@ -36,11 +34,11 @@ http {
|
||||
}
|
||||
location /pac {
|
||||
access_log /logs/nginx_pac_access;
|
||||
proxy_pass http://unit;
|
||||
proxy_pass http://php;
|
||||
}
|
||||
location /tlgrm {
|
||||
access_log /logs/nginx_tlgrm_access;
|
||||
proxy_pass http://unit;
|
||||
proxy_pass http://php;
|
||||
}
|
||||
location /v2ray {
|
||||
access_log /logs/nginx_v2ray_access;
|
||||
@@ -86,7 +84,7 @@ http {
|
||||
# }
|
||||
# location /pac {
|
||||
# access_log /logs/nginx_pac_access;
|
||||
# proxy_pass http://unit;
|
||||
# proxy_pass http://php;
|
||||
# }
|
||||
# location ~\.well-known {
|
||||
# access_log /logs/nginx_certbot_access;
|
||||
|
||||
+3
-3
@@ -1948,9 +1948,9 @@ ldap.max_links = -1
|
||||
|
||||
; List of headers files to preload, wildcard patterns allowed.
|
||||
;ffi.preload=
|
||||
extension=ssh2
|
||||
extension=yaml
|
||||
zend_extension=opcache
|
||||
; extension=ssh2
|
||||
; extension=yaml
|
||||
; zend_extension=opcache
|
||||
opcache.enable=1
|
||||
opcache.jit_buffer_size=128M
|
||||
opcache.enable_cli=1
|
||||
|
||||
@@ -0,0 +1,120 @@
|
||||
# $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $
|
||||
|
||||
# This is the sshd server system-wide configuration file. See
|
||||
# sshd_config(5) for more information.
|
||||
|
||||
# This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
|
||||
# The strategy used for options in the default sshd_config shipped with
|
||||
# OpenSSH is to specify options with their default value where
|
||||
# possible, but leave them commented. Uncommented options override the
|
||||
# default value.
|
||||
|
||||
#Port 22
|
||||
#AddressFamily any
|
||||
#ListenAddress 0.0.0.0
|
||||
#ListenAddress ::
|
||||
|
||||
#HostKey /etc/ssh/ssh_host_rsa_key
|
||||
#HostKey /etc/ssh/ssh_host_ecdsa_key
|
||||
#HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
# Ciphers and keying
|
||||
#RekeyLimit default none
|
||||
|
||||
# Logging
|
||||
#SyslogFacility AUTH
|
||||
#LogLevel INFO
|
||||
|
||||
# Authentication:
|
||||
|
||||
#LoginGraceTime 2m
|
||||
#PermitRootLogin prohibit-password
|
||||
#StrictModes yes
|
||||
#MaxAuthTries 6
|
||||
#MaxSessions 10
|
||||
|
||||
#PubkeyAuthentication yes
|
||||
|
||||
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
|
||||
# but this is overridden so installations will only check .ssh/authorized_keys
|
||||
AuthorizedKeysFile .ssh/authorized_keys
|
||||
|
||||
#AuthorizedPrincipalsFile none
|
||||
|
||||
#AuthorizedKeysCommand none
|
||||
#AuthorizedKeysCommandUser nobody
|
||||
|
||||
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
|
||||
#HostbasedAuthentication no
|
||||
# Change to yes if you don't trust ~/.ssh/known_hosts for
|
||||
# HostbasedAuthentication
|
||||
#IgnoreUserKnownHosts no
|
||||
# Don't read the user's ~/.rhosts and ~/.shosts files
|
||||
#IgnoreRhosts yes
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
#PasswordAuthentication yes
|
||||
#PermitEmptyPasswords no
|
||||
|
||||
# Change to no to disable s/key passwords
|
||||
#KbdInteractiveAuthentication yes
|
||||
|
||||
# Kerberos options
|
||||
#KerberosAuthentication no
|
||||
#KerberosOrLocalPasswd yes
|
||||
#KerberosTicketCleanup yes
|
||||
#KerberosGetAFSToken no
|
||||
|
||||
# GSSAPI options
|
||||
#GSSAPIAuthentication no
|
||||
#GSSAPICleanupCredentials yes
|
||||
|
||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||
# and session processing. If this is enabled, PAM authentication will
|
||||
# be allowed through the KbdInteractiveAuthentication and
|
||||
# PasswordAuthentication. Depending on your PAM configuration,
|
||||
# PAM authentication via KbdInteractiveAuthentication may bypass
|
||||
# the setting of "PermitRootLogin prohibit-password".
|
||||
# If you just want the PAM account and session checks to run without
|
||||
# PAM authentication, then enable this but set PasswordAuthentication
|
||||
# and KbdInteractiveAuthentication to 'no'.
|
||||
#UsePAM no
|
||||
|
||||
#AllowAgentForwarding yes
|
||||
# Feel free to re-enable these if your use case requires them.
|
||||
AllowTcpForwarding no
|
||||
GatewayPorts no
|
||||
X11Forwarding no
|
||||
#X11DisplayOffset 10
|
||||
#X11UseLocalhost yes
|
||||
#PermitTTY yes
|
||||
#PrintMotd yes
|
||||
#PrintLastLog yes
|
||||
#TCPKeepAlive yes
|
||||
#PermitUserEnvironment no
|
||||
#Compression delayed
|
||||
#ClientAliveInterval 0
|
||||
#ClientAliveCountMax 3
|
||||
#UseDNS no
|
||||
#PidFile /run/sshd.pid
|
||||
#MaxStartups 10:30:100
|
||||
#PermitTunnel no
|
||||
#ChrootDirectory none
|
||||
#VersionAddendum none
|
||||
|
||||
# no default banner path
|
||||
#Banner none
|
||||
|
||||
# override default of no subsystems
|
||||
Subsystem sftp internal-sftp
|
||||
|
||||
# Example of overriding settings on a per-user basis
|
||||
#Match User anoncvs
|
||||
# X11Forwarding no
|
||||
# AllowTcpForwarding no
|
||||
# PermitTTY no
|
||||
# ForceCommand cvs server
|
||||
HostKeyAlgorithms +ssh-rsa
|
||||
PubkeyAcceptedKeyTypes +ssh-rsa
|
||||
PasswordAuthentication no
|
||||
+28
-37
@@ -19,21 +19,22 @@ services:
|
||||
ng:
|
||||
build:
|
||||
context: dockerfile
|
||||
dockerfile: doh.dockerfile
|
||||
dockerfile: nginx.dockerfile
|
||||
volumes:
|
||||
- ./config/.profile:/root/.bashrc:ro
|
||||
- ./config/.profile:/root/.ashrc:ro
|
||||
- ./config/nginx.conf:/etc/nginx/nginx.conf
|
||||
- ./config/nginx_default.conf:/nginx_default.conf
|
||||
- ./scripts/start_ng.sh:/start_ng.sh
|
||||
- ./certs/:/certs/
|
||||
- ./ssh/:/ssh/
|
||||
- ./ssh:/ssh
|
||||
- ./config/sshd_config:/etc/ssh/sshd_config
|
||||
- ./logs/:/logs/
|
||||
ports:
|
||||
- 80:80
|
||||
- 443:443
|
||||
hostname: nginx
|
||||
depends_on:
|
||||
unit:
|
||||
php:
|
||||
condition: service_healthy
|
||||
ad:
|
||||
condition: service_started
|
||||
@@ -48,12 +49,12 @@ services:
|
||||
default:
|
||||
ipv4_address: 10.10.0.2
|
||||
logging: *default-logging
|
||||
unit:
|
||||
php:
|
||||
build:
|
||||
dockerfile: dockerfile/php.dockerfile
|
||||
volumes:
|
||||
- ./config/.profile:/root/.bashrc:ro
|
||||
- ./config/php.ini:/usr/local/etc/php/php.ini
|
||||
- ./config/.profile:/root/.ashrc:ro
|
||||
- ./config/php.ini:/etc/php82/php.ini
|
||||
- ./config/clients.json:/config/clients.json
|
||||
- ./config/pac.json:/config/pac.json
|
||||
- ./config/unit.json:/config/unit.json
|
||||
@@ -67,10 +68,10 @@ services:
|
||||
- type: volume
|
||||
target: /config/adguard
|
||||
source: adguard
|
||||
- ./ssh/:/ssh/
|
||||
- ./ssh:/ssh
|
||||
- ./app:/app
|
||||
- ./logs/:/logs/
|
||||
- ./scripts/start_unit.sh:/start_unit.sh
|
||||
- ./scripts/start_php.sh:/start_php.sh
|
||||
- ./scripts/check_file.sh:/check_file.sh
|
||||
- ./version:/version
|
||||
environment:
|
||||
@@ -80,10 +81,10 @@ services:
|
||||
WGPORT: ${WGPORT}
|
||||
SSPORT: ${SSPORT}
|
||||
TGPORT: ${TGPORT}
|
||||
hostname: unit
|
||||
hostname: php
|
||||
restart: unless-stopped
|
||||
stop_grace_period: 1s
|
||||
command: ["/bin/sh", "/start_unit.sh"]
|
||||
command: ["/bin/sh", "/start_php.sh"]
|
||||
working_dir: /app
|
||||
networks:
|
||||
default:
|
||||
@@ -92,24 +93,22 @@ services:
|
||||
- "host.docker.internal:host-gateway"
|
||||
logging: *default-logging
|
||||
healthcheck:
|
||||
test: ["CMD", "bash", "/check_file.sh"]
|
||||
test: ["CMD", "/bin/sh", "/check_file.sh"]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
proxy:
|
||||
build:
|
||||
dockerfile: dockerfile/shadowsocks.dockerfile
|
||||
args:
|
||||
RELEASE: ${RELEASE}
|
||||
SYSTEM: ${SYSTEM}
|
||||
volumes:
|
||||
- ./config/.profile:/root/.bashrc:ro
|
||||
- ./config/.profile:/root/.ashrc:ro
|
||||
- ./config/sslocal.json:/config.json
|
||||
- ./ssh:/ssh
|
||||
- ./config/sshd_config:/etc/ssh/sshd_config
|
||||
- ./scripts/start_proxy.sh:/start_proxy.sh
|
||||
hostname: proxy
|
||||
depends_on:
|
||||
unit:
|
||||
php:
|
||||
condition: service_healthy
|
||||
networks:
|
||||
default:
|
||||
@@ -123,20 +122,18 @@ services:
|
||||
wg:
|
||||
build:
|
||||
dockerfile: dockerfile/wireguard.dockerfile
|
||||
args:
|
||||
RELEASE: ${RELEASE}
|
||||
SYSTEM: ${SYSTEM}
|
||||
volumes:
|
||||
- ./config/.profile:/root/.bashrc:ro
|
||||
- ./config/.profile:/root/.ashrc:ro
|
||||
- ./config/wg0.conf:/etc/wireguard/wg0.conf
|
||||
- ./scripts/start_wg.sh:/start_wg.sh
|
||||
- ./scripts/reset_wg.sh:/reset_wg.sh
|
||||
- ./scripts/block_torrent.sh:/block_torrent.sh
|
||||
- ./scripts/unblock_torrent.sh:/unblock_torrent.sh
|
||||
- ./ssh:/ssh
|
||||
- ./config/sshd_config:/etc/ssh/sshd_config
|
||||
hostname: wireguard
|
||||
depends_on:
|
||||
unit:
|
||||
php:
|
||||
condition: service_healthy
|
||||
ports:
|
||||
- ${WGPORT}:${WGPORT}/udp
|
||||
@@ -155,23 +152,21 @@ services:
|
||||
ad:
|
||||
build:
|
||||
dockerfile: dockerfile/adguard.dockerfile
|
||||
args:
|
||||
RELEASE: ${RELEASE}
|
||||
SYSTEM: ${SYSTEM}
|
||||
ports:
|
||||
- 853:853
|
||||
volumes:
|
||||
- ./config/.profile:/root/.bashrc:ro
|
||||
- ./config/.profile:/root/.ashrc:ro
|
||||
- type: volume
|
||||
target: /opt/adguardhome
|
||||
source: adguard
|
||||
- ./ssh:/ssh
|
||||
- ./config/sshd_config:/etc/ssh/sshd_config
|
||||
- ./certs/:/certs/
|
||||
- ./logs/:/logs/
|
||||
- ./scripts/start_ad.sh:/start_ad.sh
|
||||
hostname: adguard
|
||||
depends_on:
|
||||
unit:
|
||||
php:
|
||||
condition: service_healthy
|
||||
environment:
|
||||
TZ: ${TZ}
|
||||
@@ -184,17 +179,15 @@ services:
|
||||
ss:
|
||||
build:
|
||||
dockerfile: dockerfile/shadowsocks.dockerfile
|
||||
args:
|
||||
RELEASE: ${RELEASE}
|
||||
SYSTEM: ${SYSTEM}
|
||||
volumes:
|
||||
- ./config/.profile:/root/.bashrc:ro
|
||||
- ./config/.profile:/root/.ashrc:ro
|
||||
- ./config/ssserver.json:/config.json
|
||||
- ./ssh:/ssh
|
||||
- ./config/sshd_config:/etc/ssh/sshd_config
|
||||
- ./scripts/start_ss.sh:/start_ss.sh
|
||||
hostname: shadowsocks
|
||||
depends_on:
|
||||
unit:
|
||||
php:
|
||||
condition: service_healthy
|
||||
ports:
|
||||
- ${SSPORT}:${SSPORT}/tcp
|
||||
@@ -211,17 +204,15 @@ services:
|
||||
tg:
|
||||
build:
|
||||
dockerfile: dockerfile/telegram.dockerfile
|
||||
args:
|
||||
RELEASE: ${RELEASE}
|
||||
SYSTEM: ${SYSTEM}
|
||||
volumes:
|
||||
- ./config/.profile:/root/.bashrc:ro
|
||||
- ./config/.profile:/root/.ashrc:ro
|
||||
- ./ssh:/ssh
|
||||
- ./config/sshd_config:/etc/ssh/sshd_config
|
||||
- ./scripts/start_tg.sh:/start_tg.sh
|
||||
- ./config/mtprotosecret:/mtprotosecret
|
||||
hostname: telegram
|
||||
depends_on:
|
||||
unit:
|
||||
php:
|
||||
condition: service_healthy
|
||||
ports:
|
||||
- ${TGPORT}:${TGPORT}
|
||||
|
||||
@@ -1,16 +1,11 @@
|
||||
arg SYSTEM
|
||||
arg RELEASE
|
||||
from ${SYSTEM}:${RELEASE}
|
||||
ENV DEBIAN_FRONTEND noninteractive
|
||||
run apt update && \
|
||||
apt install -y git net-tools lsof ssh wget && \
|
||||
apt clean autoclean && \
|
||||
apt autoremove -y && \
|
||||
from alpine:latest
|
||||
run apk add --no-cache --update openssh && \
|
||||
wget https://github.com/ameshkov/dnslookup/releases/download/v1.8.1/dnslookup-linux-amd64-v1.8.1.tar.gz && \
|
||||
tar -xf dnslookup-linux-amd64-v1.8.1.tar.gz
|
||||
run wget https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.32/AdGuardHome_linux_amd64.tar.gz && \
|
||||
tar -xf dnslookup-linux-amd64-v1.8.1.tar.gz && \
|
||||
wget https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.32/AdGuardHome_linux_amd64.tar.gz && \
|
||||
tar -xf AdGuardHome_linux_amd64.tar.gz && \
|
||||
mkdir -p /opt/adguardhome && \
|
||||
mkdir /root/.ssh
|
||||
copy config/AdGuardHome.yaml /opt/adguardhome/AdGuardHome.yaml
|
||||
env PATH="$PATH:/linux-amd64"
|
||||
env ENV="/root/.ashrc"
|
||||
|
||||
@@ -1,6 +0,0 @@
|
||||
from nginx:stable
|
||||
run apt update && \
|
||||
apt install -y git net-tools lsof ssh && \
|
||||
apt clean autoclean && \
|
||||
apt autoremove -y && \
|
||||
mkdir /root/.ssh
|
||||
@@ -0,0 +1,5 @@
|
||||
from alpine:latest
|
||||
run apk add nginx openssh \
|
||||
&& mkdir /root/.ssh \
|
||||
&& mkdir /var/cache/nginx
|
||||
env ENV="/root/.ashrc"
|
||||
@@ -1,10 +1,24 @@
|
||||
from nginx/unit:1.29.1-php8.1
|
||||
run apt update && apt install -y qrencode wget libssh2-1-dev ssh libicu-dev libyaml-dev certbot && \
|
||||
apt clean autoclean && \
|
||||
apt autoremove -y && \
|
||||
pecl install https://pecl.php.net/get/ssh2-1.3.1.tgz && \
|
||||
pecl install https://pecl.php.net/get/yaml-2.2.2.tgz && \
|
||||
docker-php-ext-install intl && \
|
||||
wget https://github.com/ameshkov/dnslookup/releases/download/v1.8.1/dnslookup-linux-amd64-v1.8.1.tar.gz && \
|
||||
tar -xf dnslookup-linux-amd64-v1.8.1.tar.gz
|
||||
from alpine:latest
|
||||
run apk add --no-cache --update php82 \
|
||||
php82-mbstring \
|
||||
php82-session \
|
||||
php82-curl \
|
||||
php82-opcache \
|
||||
php82-openssl \
|
||||
php82-iconv \
|
||||
php82-intl \
|
||||
php82-pecl-ssh2 \
|
||||
php82-pecl-yaml \
|
||||
unit \
|
||||
unit-php82 \
|
||||
xxd \
|
||||
certbot \
|
||||
libqrencode \
|
||||
openssh \
|
||||
curl \
|
||||
&& wget https://github.com/ameshkov/dnslookup/releases/download/v1.8.1/dnslookup-linux-amd64-v1.8.1.tar.gz \
|
||||
&& tar -xf dnslookup-linux-amd64-v1.8.1.tar.gz \
|
||||
&& rm dnslookup-linux-amd64-v1.8.1.tar.gz \
|
||||
&& ln -s /usr/bin/php82 /usr/bin/php
|
||||
env PATH="$PATH:/linux-amd64"
|
||||
env ENV="/root/.ashrc"
|
||||
@@ -1,15 +1,18 @@
|
||||
arg SYSTEM
|
||||
arg RELEASE
|
||||
from ${SYSTEM}:${RELEASE}
|
||||
ENV DEBIAN_FRONTEND noninteractive
|
||||
run apt update && \
|
||||
apt install -y ssh git net-tools xz-utils wget && \
|
||||
apt clean autoclean && \
|
||||
apt autoremove -y && \
|
||||
mkdir /root/.ssh && \
|
||||
touch /root/.ssh/authorized_keys && \
|
||||
wget https://github.com/shadowsocks/shadowsocks-rust/releases/download/v1.15.2/shadowsocks-v1.15.2.x86_64-unknown-linux-gnu.tar.xz && \
|
||||
tar -xf shadowsocks-v1.15.2.x86_64-unknown-linux-gnu.tar.xz && \
|
||||
wget https://github.com/teddysun/v2ray-plugin/releases/download/v5.2.0/v2ray-plugin-linux-amd64-v5.2.0.tar.gz && \
|
||||
tar -xf v2ray-plugin-linux-amd64-v5.2.0.tar.gz && \
|
||||
mv v2ray-plugin_linux_amd64 /usr/local/bin/v2ray-plugin
|
||||
from alpine:latest
|
||||
run apk add openssh git xz \
|
||||
&& mkdir /root/.ssh \
|
||||
&& mkdir /ss \
|
||||
&& wget https://github.com/shadowsocks/shadowsocks-rust/releases/download/v1.15.2/shadowsocks-v1.15.2.x86_64-unknown-linux-musl.tar.xz \
|
||||
&& tar -xf shadowsocks-v1.15.2.x86_64-unknown-linux-musl.tar.xz \
|
||||
&& wget https://github.com/teddysun/v2ray-plugin/releases/download/v5.2.0/v2ray-plugin-linux-amd64-v5.2.0.tar.gz \
|
||||
&& tar -xf v2ray-plugin-linux-amd64-v5.2.0.tar.gz \
|
||||
&& mv sslocal /ss/ \
|
||||
&& mv ssserver /ss/ \
|
||||
&& mv ssmanager /ss/ \
|
||||
&& mv ssservice /ss/ \
|
||||
&& mv ssurl /ss/ \
|
||||
&& mv v2ray-plugin_linux_amd64 /ss/v2ray-plugin \
|
||||
&& rm v2ray-plugin-linux-amd64-v5.2.0.tar.gz\
|
||||
&& rm shadowsocks-v1.15.2.x86_64-unknown-linux-musl.tar.xz
|
||||
env ENV="/root/.ashrc"
|
||||
env PATH="$PATH:/ss"
|
||||
|
||||
@@ -1,14 +1,15 @@
|
||||
arg SYSTEM
|
||||
arg RELEASE
|
||||
from ${SYSTEM}:${RELEASE}
|
||||
ENV DEBIAN_FRONTEND noninteractive
|
||||
run apt update && \
|
||||
apt install -y git curl build-essential libssl-dev zlib1g-dev xxd ssh && \
|
||||
apt clean autoclean && \
|
||||
apt autoremove -y && \
|
||||
mkdir /root/.ssh
|
||||
run git clone https://github.com/TelegramMessenger/MTProxy
|
||||
copy config/Makefile /MTProxy/Makefile
|
||||
run cd /MTProxy && make
|
||||
env PATH="$PATH:/MTProxy/objs/bin"
|
||||
|
||||
from alpine:3.6
|
||||
run apk add --no-cache --virtual .build-deps alpine-sdk linux-headers openssl-dev \
|
||||
&& git clone --single-branch --depth 1 https://github.com/TelegramMessenger/MTProxy.git /mtproxy/sources \
|
||||
&& mkdir /mtproxy/patches && wget -P /mtproxy/patches https://raw.githubusercontent.com/alexdoesh/mtproxy/master/patches/randr_compat.patch \
|
||||
&& cd /mtproxy/sources && patch -p0 -i /mtproxy/patches/randr_compat.patch \
|
||||
&& make \
|
||||
&& mkdir /MTProxy \
|
||||
&& mkdir /root/.ssh \
|
||||
&& cp /mtproxy/sources/objs/bin/mtproto-proxy /MTProxy \
|
||||
&& rm -rf /mtproxy \
|
||||
&& apk del .build-deps\
|
||||
&& apk add --no-cache --update curl openssh \
|
||||
&& ln -s /usr/lib/libcrypto.so.41 /usr/lib/libcrypto.so.1.0.0
|
||||
env PATH="$PATH:/MTProxy"
|
||||
env ENV="/root/.ashrc"
|
||||
|
||||
@@ -1,9 +1,3 @@
|
||||
arg SYSTEM
|
||||
arg RELEASE
|
||||
from ${SYSTEM}:${RELEASE}
|
||||
ENV DEBIAN_FRONTEND noninteractive
|
||||
run apt update && \
|
||||
apt install -y linux-headers-generic iproute2 net-tools iptables xtables-addons-common xtables-addons-dkms wireguard ssh git && \
|
||||
apt clean autoclean && \
|
||||
apt autoremove -y && \
|
||||
mkdir /root/.ssh
|
||||
from alpine:latest
|
||||
run apk add iproute2 linux-headers iptables xtables-addons wireguard-tools openssh \
|
||||
&& mkdir /root/.ssh
|
||||
|
||||
@@ -1,33 +1,33 @@
|
||||
IP ?= 127.0.0.1
|
||||
SERVICE ?= unit
|
||||
hosts: unhosts # маппинг доменов на локалку
|
||||
echo "$(IP) test.ru" >> /mnt/c/Windows/System32/drivers/etc/hosts
|
||||
unhosts:
|
||||
sed -i '/test.ru/d' /mnt/c/Windows/System32/drivers/etc/hosts
|
||||
b:
|
||||
docker compose build
|
||||
u: # запуск контейнеров
|
||||
IP=$(shell ip -4 addr | sed -ne 's|^.* inet \([^/]*\)/.* scope global.*$$|\1|p' | awk '{print $1}' | head -1) RELEASE=$(shell lsb_release -rs) SYSTEM=$(shell lsb_release -is | tr '[:upper:]' '[:lower:]') docker compose up -d --build --force-recreate
|
||||
# sleep 1
|
||||
# docker compose logs unit wg ss proxy
|
||||
IP=$(shell ip -4 addr | sed -ne 's|^.* inet \([^/]*\)/.* scope global.*$$|\1|p' | awk '{print $1}' | head -1) docker compose up -d --build --force-recreate
|
||||
d: # остановка контейнеров
|
||||
docker compose down
|
||||
dv: # остановка контейнеров
|
||||
docker compose down -v
|
||||
r: d u
|
||||
ps: # список контейнеров
|
||||
docker compose ps
|
||||
l: # логи из контейнеров
|
||||
docker compose logs $(SERVICE)
|
||||
unit: # консоль сервиса
|
||||
docker compose exec unit bash
|
||||
docker compose logs
|
||||
php: # консоль сервиса
|
||||
docker compose exec php /bin/sh
|
||||
wg: # консоль сервиса
|
||||
docker compose exec wg bash
|
||||
docker compose exec wg /bin/sh
|
||||
ss: # консоль сервиса
|
||||
docker compose exec ss bash
|
||||
docker compose exec ss /bin/sh
|
||||
ng: # консоль сервиса
|
||||
docker compose exec ng bash
|
||||
doh: # консоль сервиса
|
||||
docker compose exec doh bash
|
||||
docker compose exec ng /bin/sh
|
||||
ad: # консоль сервиса
|
||||
docker compose exec ad bash
|
||||
docker compose exec ad /bin/sh
|
||||
proxy: # консоль сервиса
|
||||
docker compose exec proxy bash
|
||||
docker compose exec proxy /bin/sh
|
||||
tg: # консоль сервиса
|
||||
docker compose exec tg bash
|
||||
docker compose exec tg /bin/sh
|
||||
clean:
|
||||
docker image prune
|
||||
docker builder prune
|
||||
cleanall:
|
||||
docker image prune -a
|
||||
docker builder prune -a
|
||||
|
||||
+3
-4
@@ -1,6 +1,5 @@
|
||||
cat /ssh/key.pub > /root/.ssh/authorized_keys
|
||||
echo 'HostKeyAlgorithms +ssh-rsa' >> /etc/ssh/sshd_config
|
||||
echo 'PubkeyAcceptedKeyTypes +ssh-rsa' >> /etc/ssh/sshd_config
|
||||
service ssh start
|
||||
/AdGuardHome/AdGuardHome -s install -c /opt/adguardhome/AdGuardHome.yaml -h 0.0.0.0 -w /opt/adguardhome/
|
||||
ssh-keygen -A
|
||||
exec /usr/sbin/sshd -D -e "$@" &
|
||||
/AdGuardHome/AdGuardHome --pidfile /AdGuardHome/pid -c /opt/adguardhome/AdGuardHome.yaml -h 0.0.0.0 -w /opt/adguardhome/
|
||||
tail -f /dev/null
|
||||
|
||||
+2
-3
@@ -1,7 +1,6 @@
|
||||
cat /ssh/key.pub > /root/.ssh/authorized_keys
|
||||
echo 'HostKeyAlgorithms +ssh-rsa' >> /etc/ssh/sshd_config
|
||||
echo 'PubkeyAcceptedKeyTypes +ssh-rsa' >> /etc/ssh/sshd_config
|
||||
service ssh start
|
||||
ssh-keygen -A
|
||||
exec /usr/sbin/sshd -D -e "$@" &
|
||||
sed "s/ss:[0-9]\+/ss:$SSPORT/" /nginx_default.conf > change_port
|
||||
cat change_port > /nginx_default.conf
|
||||
sed "s/ss:[0-9]\+/ss:$SSPORT/" /etc/nginx/nginx.conf > change_port
|
||||
|
||||
@@ -5,5 +5,5 @@ php init.php
|
||||
php cron.php &
|
||||
unitd --log /logs/unit_error
|
||||
curl -X PUT --data-binary @/config/unit.json --unix-socket /var/run/control.unit.sock http://localhost/config
|
||||
kill -TERM $(/bin/cat /var/run/unit.pid)
|
||||
pkill unitd
|
||||
unitd --no-daemon --log /logs/unit_error
|
||||
@@ -1,7 +1,6 @@
|
||||
cat /ssh/key.pub > /root/.ssh/authorized_keys
|
||||
echo 'HostKeyAlgorithms +ssh-rsa' >> /etc/ssh/sshd_config
|
||||
echo 'PubkeyAcceptedKeyTypes +ssh-rsa' >> /etc/ssh/sshd_config
|
||||
service ssh start
|
||||
ssh-keygen -A
|
||||
exec /usr/sbin/sshd -D -e "$@" &
|
||||
sed -n "s/\"server_port\": \([0-9]\+\),/\1/p" /config.json > current_port
|
||||
CURRENT_PORT=$(cat current_port | tr -d " ")
|
||||
if [ "$CURRENT_PORT" -ne "443" ]
|
||||
@@ -9,5 +8,5 @@ then
|
||||
sed "s/\"server_port\": [0-9]\+/\"server_port\": $SSPORT/" /config.json > change_port
|
||||
cat change_port > /config.json
|
||||
fi
|
||||
/sslocal -v -d -c /config.json
|
||||
sslocal -v -d -c /config.json
|
||||
tail -f /dev/null
|
||||
|
||||
+3
-4
@@ -1,8 +1,7 @@
|
||||
cat /ssh/key.pub > /root/.ssh/authorized_keys
|
||||
echo 'HostKeyAlgorithms +ssh-rsa' >> /etc/ssh/sshd_config
|
||||
echo 'PubkeyAcceptedKeyTypes +ssh-rsa' >> /etc/ssh/sshd_config
|
||||
service ssh start
|
||||
ssh-keygen -A
|
||||
exec /usr/sbin/sshd -D -e "$@" &
|
||||
sed "s/\"server_port\": [0-9]\+/\"server_port\": $SSPORT/" /config.json > change_port
|
||||
cat change_port > /config.json
|
||||
/ssserver -v -d -c /config.json
|
||||
ssserver -v -d -c /config.json
|
||||
tail -f /dev/null
|
||||
|
||||
+6
-7
@@ -1,13 +1,12 @@
|
||||
echo 'root:dummy_passwd'|chpasswd
|
||||
cat /ssh/key.pub > /root/.ssh/authorized_keys
|
||||
echo 'HostKeyAlgorithms +ssh-rsa' >> /etc/ssh/sshd_config
|
||||
echo 'PubkeyAcceptedKeyTypes +ssh-rsa' >> /etc/ssh/sshd_config
|
||||
service ssh start
|
||||
ssh-keygen -A
|
||||
exec /usr/sbin/sshd -D -e "$@" &
|
||||
curl -s https://core.telegram.org/getProxySecret -o proxy-secret
|
||||
curl -s https://core.telegram.org/getProxyConfig -o proxy-multi.conf
|
||||
if [ $(cat /mtprotosecret | wc -c) -eq 0 ]
|
||||
if [ $(cat /mtprotosecret | wc -c) -gt 0 ]
|
||||
then
|
||||
head -c 16 /dev/urandom | xxd -ps > /mtprotosecret
|
||||
SECRET=$(cat /mtprotosecret)
|
||||
mtproto-proxy -u nobody -H $TGPORT --nat-info 10.10.0.8:$IP -S $SECRET --aes-pwd /proxy-secret /proxy-multi.conf -M 1
|
||||
fi
|
||||
SECRET=$(cat /mtprotosecret)
|
||||
mtproto-proxy -u nobody -H $TGPORT --nat-info 10.10.0.8:$IP -S $SECRET --aes-pwd /proxy-secret /proxy-multi.conf -M 1
|
||||
tail -f /dev/null
|
||||
|
||||
+2
-3
@@ -13,7 +13,6 @@ sed "s/ListenPort = [0-9]\+/ListenPort = $WGPORT/" /etc/wireguard/wg0.conf > cha
|
||||
cat change_port > /etc/wireguard/wg0.conf
|
||||
wg-quick up wg0
|
||||
cat /ssh/key.pub > /root/.ssh/authorized_keys
|
||||
echo 'HostKeyAlgorithms +ssh-rsa' >> /etc/ssh/sshd_config
|
||||
echo 'PubkeyAcceptedKeyTypes +ssh-rsa' >> /etc/ssh/sshd_config
|
||||
service ssh start
|
||||
ssh-keygen -A
|
||||
exec /usr/sbin/sshd -D -e "$@" &
|
||||
tail -f /dev/null
|
||||
|
||||
Reference in New Issue
Block a user