From c421dc29b79d76e8fb3681ab4b373c6c1608377a Mon Sep 17 00:00:00 2001 From: mercury Date: Fri, 23 Jun 2023 01:31:55 +0400 Subject: [PATCH] migrate to alpine image --- app/bot.php | 61 ++++++------ config/nginx.conf | 8 +- config/nginx_default.conf | 8 +- config/php.ini | 6 +- config/sshd_config | 120 ++++++++++++++++++++++++ docker-compose.yml | 65 ++++++------- dockerfile/adguard.dockerfile | 15 +-- dockerfile/doh.dockerfile | 6 -- dockerfile/nginx.dockerfile | 5 + dockerfile/php.dockerfile | 32 +++++-- dockerfile/shadowsocks.dockerfile | 33 ++++--- dockerfile/telegram.dockerfile | 29 +++--- dockerfile/wireguard.dockerfile | 12 +-- makefile | 40 ++++---- scripts/start_ad.sh | 7 +- scripts/start_ng.sh | 5 +- scripts/{start_unit.sh => start_php.sh} | 2 +- scripts/start_proxy.sh | 7 +- scripts/start_ss.sh | 7 +- scripts/start_tg.sh | 13 ++- scripts/start_wg.sh | 5 +- 21 files changed, 300 insertions(+), 186 deletions(-) create mode 100644 config/sshd_config delete mode 100644 dockerfile/doh.dockerfile create mode 100644 dockerfile/nginx.dockerfile rename scripts/{start_unit.sh => start_php.sh} (90%) diff --git a/app/bot.php b/app/bot.php index 3f68378..f5600cb 100644 --- a/app/bot.php +++ b/app/bot.php @@ -307,7 +307,7 @@ class Bot public function generateSecret() { - $this->secretSet(trim($this->ssh('head -c 16 /dev/urandom | xxd -ps', 'tg'))); + $this->secretSet(exec('head -c 16 /dev/urandom | xxd -ps')); } public function setSecret() @@ -338,7 +338,7 @@ class Bot $this->ssh('pkill mtproto-proxy', 'tg'); if (preg_match('~^\w{32}$~', $secret)) { $p = getenv('TGPORT'); - $this->ssh("/MTProxy/objs/bin/mtproto-proxy -u nobody -H $p --nat-info 10.10.0.8:{$this->ip} -S $secret --aes-pwd /proxy-secret /proxy-multi.conf -M 1 >/dev/null 2>&1 &", 'tg'); + $this->ssh("/MTProxy/mtproto-proxy -u nobody -H $p --nat-info 10.10.0.8:{$this->ip} -S $secret --aes-pwd /proxy-secret /proxy-multi.conf -M 1 >/dev/null 2>&1 &", 'tg'); } } @@ -461,8 +461,8 @@ class Bot $c['password'] = $l['password'] = $pass; file_put_contents('/config/ssserver.json', json_encode($c, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES)); file_put_contents('/config/sslocal.json', json_encode($l, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES)); - $this->ssh('/ssserver -v -d -c /config.json', 'ss'); - $this->ssh('/sslocal -v -d -c /config.json', 'proxy'); + $this->ssh('/ss/ssserver -v -d -c /config.json', 'ss'); + $this->ssh('/ss/sslocal -v -d -c /config.json', 'proxy'); $this->menu('ss'); } @@ -492,8 +492,8 @@ class Bot } file_put_contents('/config/ssserver.json', json_encode($c, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES)); file_put_contents('/config/sslocal.json', json_encode($l, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES)); - $this->ssh('/ssserver -v -d -c /config.json', 'ss'); - $this->ssh('/sslocal -v -d -c /config.json', 'proxy'); + $this->ssh('/ss/ssserver -v -d -c /config.json', 'ss'); + $this->ssh('/ss/sslocal -v -d -c /config.json', 'proxy'); $this->menu('ss'); } @@ -801,9 +801,9 @@ class Bot if (!empty($json['ad'])) { $out[] = 'update adguard'; $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); - $this->ssh("/AdGuardHome/AdGuardHome -s stop 2>&1", 'ad'); + $this->stopAd(); yaml_emit_file('/config/adguard/AdGuardHome.yaml', $json['ad']); - $this->ssh("/AdGuardHome/AdGuardHome -s start 2>&1", 'ad'); + $this->startAd(); } // ss if (!empty($json['ss'])) { @@ -811,7 +811,7 @@ class Bot $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); $this->ssh('pkill ssserver', 'ss'); file_put_contents('/config/ssserver.json', json_encode($json['ss'], JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES)); - $this->ssh('/ssserver -v -d -c /config.json', 'ss'); + $this->ssh('/ss/ssserver -v -d -c /config.json', 'ss'); } // sl if (!empty($json['sl'])) { @@ -819,7 +819,7 @@ class Bot $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); $this->ssh('pkill sslocal', 'proxy'); file_put_contents('/config/sslocal.json', json_encode($json['sl'], JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES)); - $this->ssh('/sslocal -v -d -c /config.json', 'proxy'); + $this->ssh('/ss/sslocal -v -d -c /config.json', 'proxy'); } // mtproto if (!empty($json['mtproto'])) { @@ -1076,13 +1076,13 @@ class Bot if (preg_match('~test is successful~', $u)) { $u .= $this->ssh("nginx -s reload 2>&1", 'ng'); $this->update($this->input['chat'], $this->input['message_id'], $u); - $u .= $this->ssh("/AdGuardHome/AdGuardHome -s stop 2>&1", 'ad'); + $u .= $this->stopAd(); $this->update($this->input['chat'], $this->input['message_id'], $u); $c = yaml_parse_file('/config/adguard/AdGuardHome.yaml'); $c['tls']['enabled'] = false; $c['tls']['server_name'] = ''; yaml_emit_file('/config/adguard/AdGuardHome.yaml', $c); - $u .= $this->ssh("/AdGuardHome/AdGuardHome -s start 2>&1", 'ad'); + $u .= $this->startAd(); $this->update($this->input['chat'], $this->input['message_id'], $u); unlink('/certs/cert_private'); unlink('/certs/cert_public'); @@ -1142,13 +1142,13 @@ class Bot $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); $out[] = 'Restart Adguard Home'; $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); - $out[] = $this->ssh("/AdGuardHome/AdGuardHome -s stop 2>&1", 'ad'); + $out[] = $this->stopAd(); $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); $c = yaml_parse_file('/config/adguard/AdGuardHome.yaml'); $c['tls']['enabled'] = true; $c['tls']['server_name'] = $conf['domain']; yaml_emit_file('/config/adguard/AdGuardHome.yaml', $c); - $out[] = $this->ssh("/AdGuardHome/AdGuardHome -s start 2>&1", 'ad'); + $out[] = $this->startAd(); $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); } else { file_put_contents('/config/nginx.conf', $nginx); @@ -1334,7 +1334,7 @@ class Bot { $out[] = 'Restart Adguard Home'; $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); - $out[] = $this->ssh("/AdGuardHome/AdGuardHome -s stop 2>&1", 'ad'); + $out[] = $this->stopAd(); $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); $c = yaml_parse_file('/config/adguard/AdGuardHome.yaml'); $c['users'][0]['password'] = password_hash($pass, PASSWORD_DEFAULT); @@ -1342,7 +1342,7 @@ class Bot $p = $this->getPacConf(); $p['adpswd'] = $pass; $this->setPacConf($p); - $out[] = $this->ssh("/AdGuardHome/AdGuardHome -s start 2>&1", 'ad'); + $out[] = $this->startAd(); $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); sleep(3); $this->menu('adguard'); @@ -1352,11 +1352,11 @@ class Bot { $out[] = 'Restart Adguard Home'; $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); - $out[] = $this->ssh("/AdGuardHome/AdGuardHome -s stop 2>&1", 'ad'); + $out[] = $this->stopAd(); $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); $c = yaml_parse_file('/config/AdGuardHome.yaml'); yaml_emit_file('/config/adguard/AdGuardHome.yaml', $c); - $out[] = $this->ssh("/AdGuardHome/AdGuardHome -s start 2>&1", 'ad'); + $out[] = $this->startAd(); $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); sleep(3); $this->menu('adguard'); @@ -1420,12 +1420,12 @@ DNS-over-HTTPS with IP: { $out[] = 'Restart Adguard Home'; $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); - $out[] = $this->ssh("/AdGuardHome/AdGuardHome -s stop 2>&1", 'ad'); + $out[] = $this->stopAd(); $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); $c = yaml_parse_file('/config/adguard/AdGuardHome.yaml'); $c['dns']['upstream_dns'][] = $url; yaml_emit_file('/config/adguard/AdGuardHome.yaml', $c); - $out[] = $this->ssh("/AdGuardHome/AdGuardHome -s start 2>&1", 'ad'); + $out[] = $this->startAd(); $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); sleep(3); $this->menu('adguard'); @@ -1435,17 +1435,24 @@ DNS-over-HTTPS with IP: { $out[] = 'Restart Adguard Home'; $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); - $out[] = $this->ssh("/AdGuardHome/AdGuardHome -s stop 2>&1", 'ad'); - $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); + $this->stopAd(); $c = yaml_parse_file('/config/adguard/AdGuardHome.yaml'); unset($c['dns']['upstream_dns'][$k]); yaml_emit_file('/config/adguard/AdGuardHome.yaml', $c); - $out[] = $this->ssh("/AdGuardHome/AdGuardHome -s start 2>&1", 'ad'); - $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out)); - sleep(3); + $this->startAd(); $this->menu('adguard'); } + public function startAd() + { + return $this->ssh('/AdGuardHome/AdGuardHome --pidfile /AdGuardHome/pid -c /opt/adguardhome/AdGuardHome.yaml -h 0.0.0.0 -w /opt/adguardhome/ > /dev/null 2>&1 &', 'ad', false); + } + + public function stopAd() + { + return $this->ssh('kill -15 $(cat /AdGuardHome/pid)', 'ad'); + } + public function selfsslInstall() { $this->setSSL('self'); @@ -3077,7 +3084,7 @@ DNS-over-HTTPS with IP: $this->send($this->input['chat'], "disconnect: \n" . var_export($args, true) . "\n", $this->input['message_id']); } - public function ssh($cmd, $service = 'wg') + public function ssh($cmd, $service = 'wg', $wait = true) { try { $c = ssh2_connect($service, 22); @@ -3092,7 +3099,7 @@ DNS-over-HTTPS with IP: if (empty($s)) { throw new Exception("exec fail: \n$cmd\n" . var_export($s, true)); } - stream_set_blocking($s, true); + stream_set_blocking($s, $wait); $data = ""; while ($buf = fread($s, 4096)) { $data .= $buf; diff --git a/config/nginx.conf b/config/nginx.conf index ef14685..7298c76 100644 --- a/config/nginx.conf +++ b/config/nginx.conf @@ -1,8 +1,6 @@ user nginx; worker_processes auto; -load_module modules/ngx_stream_js_module.so; - error_log /logs/nginx_error; pid /var/run/nginx.pid; @@ -36,11 +34,11 @@ http { } location /pac { access_log /logs/nginx_pac_access; - proxy_pass http://unit; + proxy_pass http://php; } location /tlgrm { access_log /logs/nginx_tlgrm_access; - proxy_pass http://unit; + proxy_pass http://php; } location /v2ray { access_log /logs/nginx_v2ray_access; @@ -86,7 +84,7 @@ http { # } # location /pac { # access_log /logs/nginx_pac_access; - # proxy_pass http://unit; + # proxy_pass http://php; # } # location ~\.well-known { # access_log /logs/nginx_certbot_access; diff --git a/config/nginx_default.conf b/config/nginx_default.conf index ef14685..7298c76 100644 --- a/config/nginx_default.conf +++ b/config/nginx_default.conf @@ -1,8 +1,6 @@ user nginx; worker_processes auto; -load_module modules/ngx_stream_js_module.so; - error_log /logs/nginx_error; pid /var/run/nginx.pid; @@ -36,11 +34,11 @@ http { } location /pac { access_log /logs/nginx_pac_access; - proxy_pass http://unit; + proxy_pass http://php; } location /tlgrm { access_log /logs/nginx_tlgrm_access; - proxy_pass http://unit; + proxy_pass http://php; } location /v2ray { access_log /logs/nginx_v2ray_access; @@ -86,7 +84,7 @@ http { # } # location /pac { # access_log /logs/nginx_pac_access; - # proxy_pass http://unit; + # proxy_pass http://php; # } # location ~\.well-known { # access_log /logs/nginx_certbot_access; diff --git a/config/php.ini b/config/php.ini index 49c3f22..5528d5e 100644 --- a/config/php.ini +++ b/config/php.ini @@ -1948,9 +1948,9 @@ ldap.max_links = -1 ; List of headers files to preload, wildcard patterns allowed. ;ffi.preload= -extension=ssh2 -extension=yaml -zend_extension=opcache +; extension=ssh2 +; extension=yaml +; zend_extension=opcache opcache.enable=1 opcache.jit_buffer_size=128M opcache.enable_cli=1 diff --git a/config/sshd_config b/config/sshd_config new file mode 100644 index 0000000..e5a5eca --- /dev/null +++ b/config/sshd_config @@ -0,0 +1,120 @@ +# $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +#PermitRootLogin prohibit-password +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#PubkeyAuthentication yes + +# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 +# but this is overridden so installations will only check .ssh/authorized_keys +AuthorizedKeysFile .ssh/authorized_keys + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +#PasswordAuthentication yes +#PermitEmptyPasswords no + +# Change to no to disable s/key passwords +#KbdInteractiveAuthentication yes + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the KbdInteractiveAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via KbdInteractiveAuthentication may bypass +# the setting of "PermitRootLogin prohibit-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and KbdInteractiveAuthentication to 'no'. +#UsePAM no + +#AllowAgentForwarding yes +# Feel free to re-enable these if your use case requires them. +AllowTcpForwarding no +GatewayPorts no +X11Forwarding no +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +#PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#UseDNS no +#PidFile /run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# override default of no subsystems +Subsystem sftp internal-sftp + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server +HostKeyAlgorithms +ssh-rsa +PubkeyAcceptedKeyTypes +ssh-rsa +PasswordAuthentication no diff --git a/docker-compose.yml b/docker-compose.yml index 62a14bd..f7c0d3b 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -19,21 +19,22 @@ services: ng: build: context: dockerfile - dockerfile: doh.dockerfile + dockerfile: nginx.dockerfile volumes: - - ./config/.profile:/root/.bashrc:ro + - ./config/.profile:/root/.ashrc:ro - ./config/nginx.conf:/etc/nginx/nginx.conf - ./config/nginx_default.conf:/nginx_default.conf - ./scripts/start_ng.sh:/start_ng.sh - ./certs/:/certs/ - - ./ssh/:/ssh/ + - ./ssh:/ssh + - ./config/sshd_config:/etc/ssh/sshd_config - ./logs/:/logs/ ports: - 80:80 - 443:443 hostname: nginx depends_on: - unit: + php: condition: service_healthy ad: condition: service_started @@ -48,12 +49,12 @@ services: default: ipv4_address: 10.10.0.2 logging: *default-logging - unit: + php: build: dockerfile: dockerfile/php.dockerfile volumes: - - ./config/.profile:/root/.bashrc:ro - - ./config/php.ini:/usr/local/etc/php/php.ini + - ./config/.profile:/root/.ashrc:ro + - ./config/php.ini:/etc/php82/php.ini - ./config/clients.json:/config/clients.json - ./config/pac.json:/config/pac.json - ./config/unit.json:/config/unit.json @@ -67,10 +68,10 @@ services: - type: volume target: /config/adguard source: adguard - - ./ssh/:/ssh/ + - ./ssh:/ssh - ./app:/app - ./logs/:/logs/ - - ./scripts/start_unit.sh:/start_unit.sh + - ./scripts/start_php.sh:/start_php.sh - ./scripts/check_file.sh:/check_file.sh - ./version:/version environment: @@ -80,10 +81,10 @@ services: WGPORT: ${WGPORT} SSPORT: ${SSPORT} TGPORT: ${TGPORT} - hostname: unit + hostname: php restart: unless-stopped stop_grace_period: 1s - command: ["/bin/sh", "/start_unit.sh"] + command: ["/bin/sh", "/start_php.sh"] working_dir: /app networks: default: @@ -92,24 +93,22 @@ services: - "host.docker.internal:host-gateway" logging: *default-logging healthcheck: - test: ["CMD", "bash", "/check_file.sh"] + test: ["CMD", "/bin/sh", "/check_file.sh"] interval: 5s timeout: 5s retries: 5 proxy: build: dockerfile: dockerfile/shadowsocks.dockerfile - args: - RELEASE: ${RELEASE} - SYSTEM: ${SYSTEM} volumes: - - ./config/.profile:/root/.bashrc:ro + - ./config/.profile:/root/.ashrc:ro - ./config/sslocal.json:/config.json - ./ssh:/ssh + - ./config/sshd_config:/etc/ssh/sshd_config - ./scripts/start_proxy.sh:/start_proxy.sh hostname: proxy depends_on: - unit: + php: condition: service_healthy networks: default: @@ -123,20 +122,18 @@ services: wg: build: dockerfile: dockerfile/wireguard.dockerfile - args: - RELEASE: ${RELEASE} - SYSTEM: ${SYSTEM} volumes: - - ./config/.profile:/root/.bashrc:ro + - ./config/.profile:/root/.ashrc:ro - ./config/wg0.conf:/etc/wireguard/wg0.conf - ./scripts/start_wg.sh:/start_wg.sh - ./scripts/reset_wg.sh:/reset_wg.sh - ./scripts/block_torrent.sh:/block_torrent.sh - ./scripts/unblock_torrent.sh:/unblock_torrent.sh - ./ssh:/ssh + - ./config/sshd_config:/etc/ssh/sshd_config hostname: wireguard depends_on: - unit: + php: condition: service_healthy ports: - ${WGPORT}:${WGPORT}/udp @@ -155,23 +152,21 @@ services: ad: build: dockerfile: dockerfile/adguard.dockerfile - args: - RELEASE: ${RELEASE} - SYSTEM: ${SYSTEM} ports: - 853:853 volumes: - - ./config/.profile:/root/.bashrc:ro + - ./config/.profile:/root/.ashrc:ro - type: volume target: /opt/adguardhome source: adguard - ./ssh:/ssh + - ./config/sshd_config:/etc/ssh/sshd_config - ./certs/:/certs/ - ./logs/:/logs/ - ./scripts/start_ad.sh:/start_ad.sh hostname: adguard depends_on: - unit: + php: condition: service_healthy environment: TZ: ${TZ} @@ -184,17 +179,15 @@ services: ss: build: dockerfile: dockerfile/shadowsocks.dockerfile - args: - RELEASE: ${RELEASE} - SYSTEM: ${SYSTEM} volumes: - - ./config/.profile:/root/.bashrc:ro + - ./config/.profile:/root/.ashrc:ro - ./config/ssserver.json:/config.json - ./ssh:/ssh + - ./config/sshd_config:/etc/ssh/sshd_config - ./scripts/start_ss.sh:/start_ss.sh hostname: shadowsocks depends_on: - unit: + php: condition: service_healthy ports: - ${SSPORT}:${SSPORT}/tcp @@ -211,17 +204,15 @@ services: tg: build: dockerfile: dockerfile/telegram.dockerfile - args: - RELEASE: ${RELEASE} - SYSTEM: ${SYSTEM} volumes: - - ./config/.profile:/root/.bashrc:ro + - ./config/.profile:/root/.ashrc:ro - ./ssh:/ssh + - ./config/sshd_config:/etc/ssh/sshd_config - ./scripts/start_tg.sh:/start_tg.sh - ./config/mtprotosecret:/mtprotosecret hostname: telegram depends_on: - unit: + php: condition: service_healthy ports: - ${TGPORT}:${TGPORT} diff --git a/dockerfile/adguard.dockerfile b/dockerfile/adguard.dockerfile index bafbef4..5fd4b99 100644 --- a/dockerfile/adguard.dockerfile +++ b/dockerfile/adguard.dockerfile @@ -1,16 +1,11 @@ -arg SYSTEM -arg RELEASE -from ${SYSTEM}:${RELEASE} -ENV DEBIAN_FRONTEND noninteractive -run apt update && \ -apt install -y git net-tools lsof ssh wget && \ -apt clean autoclean && \ -apt autoremove -y && \ +from alpine:latest +run apk add --no-cache --update openssh && \ wget https://github.com/ameshkov/dnslookup/releases/download/v1.8.1/dnslookup-linux-amd64-v1.8.1.tar.gz && \ -tar -xf dnslookup-linux-amd64-v1.8.1.tar.gz -run wget https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.32/AdGuardHome_linux_amd64.tar.gz && \ +tar -xf dnslookup-linux-amd64-v1.8.1.tar.gz && \ +wget https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.107.32/AdGuardHome_linux_amd64.tar.gz && \ tar -xf AdGuardHome_linux_amd64.tar.gz && \ mkdir -p /opt/adguardhome && \ mkdir /root/.ssh copy config/AdGuardHome.yaml /opt/adguardhome/AdGuardHome.yaml env PATH="$PATH:/linux-amd64" +env ENV="/root/.ashrc" diff --git a/dockerfile/doh.dockerfile b/dockerfile/doh.dockerfile deleted file mode 100644 index ec735fd..0000000 --- a/dockerfile/doh.dockerfile +++ /dev/null @@ -1,6 +0,0 @@ -from nginx:stable -run apt update && \ -apt install -y git net-tools lsof ssh && \ -apt clean autoclean && \ -apt autoremove -y && \ -mkdir /root/.ssh diff --git a/dockerfile/nginx.dockerfile b/dockerfile/nginx.dockerfile new file mode 100644 index 0000000..bccbb11 --- /dev/null +++ b/dockerfile/nginx.dockerfile @@ -0,0 +1,5 @@ +from alpine:latest +run apk add nginx openssh \ + && mkdir /root/.ssh \ + && mkdir /var/cache/nginx +env ENV="/root/.ashrc" diff --git a/dockerfile/php.dockerfile b/dockerfile/php.dockerfile index a341bca..f03af95 100644 --- a/dockerfile/php.dockerfile +++ b/dockerfile/php.dockerfile @@ -1,10 +1,24 @@ -from nginx/unit:1.29.1-php8.1 -run apt update && apt install -y qrencode wget libssh2-1-dev ssh libicu-dev libyaml-dev certbot && \ -apt clean autoclean && \ -apt autoremove -y && \ -pecl install https://pecl.php.net/get/ssh2-1.3.1.tgz && \ -pecl install https://pecl.php.net/get/yaml-2.2.2.tgz && \ -docker-php-ext-install intl && \ -wget https://github.com/ameshkov/dnslookup/releases/download/v1.8.1/dnslookup-linux-amd64-v1.8.1.tar.gz && \ -tar -xf dnslookup-linux-amd64-v1.8.1.tar.gz +from alpine:latest +run apk add --no-cache --update php82 \ + php82-mbstring \ + php82-session \ + php82-curl \ + php82-opcache \ + php82-openssl \ + php82-iconv \ + php82-intl \ + php82-pecl-ssh2 \ + php82-pecl-yaml \ + unit \ + unit-php82 \ + xxd \ + certbot \ + libqrencode \ + openssh \ + curl \ + && wget https://github.com/ameshkov/dnslookup/releases/download/v1.8.1/dnslookup-linux-amd64-v1.8.1.tar.gz \ + && tar -xf dnslookup-linux-amd64-v1.8.1.tar.gz \ + && rm dnslookup-linux-amd64-v1.8.1.tar.gz \ + && ln -s /usr/bin/php82 /usr/bin/php env PATH="$PATH:/linux-amd64" +env ENV="/root/.ashrc" \ No newline at end of file diff --git a/dockerfile/shadowsocks.dockerfile b/dockerfile/shadowsocks.dockerfile index 8055673..8468aae 100644 --- a/dockerfile/shadowsocks.dockerfile +++ b/dockerfile/shadowsocks.dockerfile @@ -1,15 +1,18 @@ -arg SYSTEM -arg RELEASE -from ${SYSTEM}:${RELEASE} -ENV DEBIAN_FRONTEND noninteractive -run apt update && \ -apt install -y ssh git net-tools xz-utils wget && \ -apt clean autoclean && \ -apt autoremove -y && \ -mkdir /root/.ssh && \ -touch /root/.ssh/authorized_keys && \ -wget https://github.com/shadowsocks/shadowsocks-rust/releases/download/v1.15.2/shadowsocks-v1.15.2.x86_64-unknown-linux-gnu.tar.xz && \ -tar -xf shadowsocks-v1.15.2.x86_64-unknown-linux-gnu.tar.xz && \ -wget https://github.com/teddysun/v2ray-plugin/releases/download/v5.2.0/v2ray-plugin-linux-amd64-v5.2.0.tar.gz && \ -tar -xf v2ray-plugin-linux-amd64-v5.2.0.tar.gz && \ -mv v2ray-plugin_linux_amd64 /usr/local/bin/v2ray-plugin +from alpine:latest +run apk add openssh git xz \ + && mkdir /root/.ssh \ + && mkdir /ss \ + && wget https://github.com/shadowsocks/shadowsocks-rust/releases/download/v1.15.2/shadowsocks-v1.15.2.x86_64-unknown-linux-musl.tar.xz \ + && tar -xf shadowsocks-v1.15.2.x86_64-unknown-linux-musl.tar.xz \ + && wget https://github.com/teddysun/v2ray-plugin/releases/download/v5.2.0/v2ray-plugin-linux-amd64-v5.2.0.tar.gz \ + && tar -xf v2ray-plugin-linux-amd64-v5.2.0.tar.gz \ + && mv sslocal /ss/ \ + && mv ssserver /ss/ \ + && mv ssmanager /ss/ \ + && mv ssservice /ss/ \ + && mv ssurl /ss/ \ + && mv v2ray-plugin_linux_amd64 /ss/v2ray-plugin \ + && rm v2ray-plugin-linux-amd64-v5.2.0.tar.gz\ + && rm shadowsocks-v1.15.2.x86_64-unknown-linux-musl.tar.xz +env ENV="/root/.ashrc" +env PATH="$PATH:/ss" diff --git a/dockerfile/telegram.dockerfile b/dockerfile/telegram.dockerfile index 0b12220..0e603d5 100644 --- a/dockerfile/telegram.dockerfile +++ b/dockerfile/telegram.dockerfile @@ -1,14 +1,15 @@ -arg SYSTEM -arg RELEASE -from ${SYSTEM}:${RELEASE} -ENV DEBIAN_FRONTEND noninteractive -run apt update && \ -apt install -y git curl build-essential libssl-dev zlib1g-dev xxd ssh && \ -apt clean autoclean && \ -apt autoremove -y && \ -mkdir /root/.ssh -run git clone https://github.com/TelegramMessenger/MTProxy -copy config/Makefile /MTProxy/Makefile -run cd /MTProxy && make -env PATH="$PATH:/MTProxy/objs/bin" - +from alpine:3.6 +run apk add --no-cache --virtual .build-deps alpine-sdk linux-headers openssl-dev \ + && git clone --single-branch --depth 1 https://github.com/TelegramMessenger/MTProxy.git /mtproxy/sources \ + && mkdir /mtproxy/patches && wget -P /mtproxy/patches https://raw.githubusercontent.com/alexdoesh/mtproxy/master/patches/randr_compat.patch \ + && cd /mtproxy/sources && patch -p0 -i /mtproxy/patches/randr_compat.patch \ + && make \ + && mkdir /MTProxy \ + && mkdir /root/.ssh \ + && cp /mtproxy/sources/objs/bin/mtproto-proxy /MTProxy \ + && rm -rf /mtproxy \ + && apk del .build-deps\ + && apk add --no-cache --update curl openssh \ + && ln -s /usr/lib/libcrypto.so.41 /usr/lib/libcrypto.so.1.0.0 +env PATH="$PATH:/MTProxy" +env ENV="/root/.ashrc" diff --git a/dockerfile/wireguard.dockerfile b/dockerfile/wireguard.dockerfile index f487e5c..19b4911 100644 --- a/dockerfile/wireguard.dockerfile +++ b/dockerfile/wireguard.dockerfile @@ -1,9 +1,3 @@ -arg SYSTEM -arg RELEASE -from ${SYSTEM}:${RELEASE} -ENV DEBIAN_FRONTEND noninteractive -run apt update && \ -apt install -y linux-headers-generic iproute2 net-tools iptables xtables-addons-common xtables-addons-dkms wireguard ssh git && \ -apt clean autoclean && \ -apt autoremove -y && \ -mkdir /root/.ssh +from alpine:latest +run apk add iproute2 linux-headers iptables xtables-addons wireguard-tools openssh \ + && mkdir /root/.ssh diff --git a/makefile b/makefile index ad42262..30b9830 100644 --- a/makefile +++ b/makefile @@ -1,33 +1,33 @@ -IP ?= 127.0.0.1 -SERVICE ?= unit -hosts: unhosts # маппинг доменов на локалку - echo "$(IP) test.ru" >> /mnt/c/Windows/System32/drivers/etc/hosts -unhosts: - sed -i '/test.ru/d' /mnt/c/Windows/System32/drivers/etc/hosts +b: + docker compose build u: # запуск контейнеров - IP=$(shell ip -4 addr | sed -ne 's|^.* inet \([^/]*\)/.* scope global.*$$|\1|p' | awk '{print $1}' | head -1) RELEASE=$(shell lsb_release -rs) SYSTEM=$(shell lsb_release -is | tr '[:upper:]' '[:lower:]') docker compose up -d --build --force-recreate -# sleep 1 -# docker compose logs unit wg ss proxy + IP=$(shell ip -4 addr | sed -ne 's|^.* inet \([^/]*\)/.* scope global.*$$|\1|p' | awk '{print $1}' | head -1) docker compose up -d --build --force-recreate d: # остановка контейнеров docker compose down +dv: # остановка контейнеров + docker compose down -v r: d u ps: # список контейнеров docker compose ps l: # логи из контейнеров - docker compose logs $(SERVICE) -unit: # консоль сервиса - docker compose exec unit bash + docker compose logs +php: # консоль сервиса + docker compose exec php /bin/sh wg: # консоль сервиса - docker compose exec wg bash + docker compose exec wg /bin/sh ss: # консоль сервиса - docker compose exec ss bash + docker compose exec ss /bin/sh ng: # консоль сервиса - docker compose exec ng bash -doh: # консоль сервиса - docker compose exec doh bash + docker compose exec ng /bin/sh ad: # консоль сервиса - docker compose exec ad bash + docker compose exec ad /bin/sh proxy: # консоль сервиса - docker compose exec proxy bash + docker compose exec proxy /bin/sh tg: # консоль сервиса - docker compose exec tg bash + docker compose exec tg /bin/sh +clean: + docker image prune + docker builder prune +cleanall: + docker image prune -a + docker builder prune -a diff --git a/scripts/start_ad.sh b/scripts/start_ad.sh index 38bc07b..fde312e 100644 --- a/scripts/start_ad.sh +++ b/scripts/start_ad.sh @@ -1,6 +1,5 @@ cat /ssh/key.pub > /root/.ssh/authorized_keys -echo 'HostKeyAlgorithms +ssh-rsa' >> /etc/ssh/sshd_config -echo 'PubkeyAcceptedKeyTypes +ssh-rsa' >> /etc/ssh/sshd_config -service ssh start -/AdGuardHome/AdGuardHome -s install -c /opt/adguardhome/AdGuardHome.yaml -h 0.0.0.0 -w /opt/adguardhome/ +ssh-keygen -A +exec /usr/sbin/sshd -D -e "$@" & +/AdGuardHome/AdGuardHome --pidfile /AdGuardHome/pid -c /opt/adguardhome/AdGuardHome.yaml -h 0.0.0.0 -w /opt/adguardhome/ tail -f /dev/null diff --git a/scripts/start_ng.sh b/scripts/start_ng.sh index b1411d5..ba224fb 100644 --- a/scripts/start_ng.sh +++ b/scripts/start_ng.sh @@ -1,7 +1,6 @@ cat /ssh/key.pub > /root/.ssh/authorized_keys -echo 'HostKeyAlgorithms +ssh-rsa' >> /etc/ssh/sshd_config -echo 'PubkeyAcceptedKeyTypes +ssh-rsa' >> /etc/ssh/sshd_config -service ssh start +ssh-keygen -A +exec /usr/sbin/sshd -D -e "$@" & sed "s/ss:[0-9]\+/ss:$SSPORT/" /nginx_default.conf > change_port cat change_port > /nginx_default.conf sed "s/ss:[0-9]\+/ss:$SSPORT/" /etc/nginx/nginx.conf > change_port diff --git a/scripts/start_unit.sh b/scripts/start_php.sh similarity index 90% rename from scripts/start_unit.sh rename to scripts/start_php.sh index c75de82..434821b 100644 --- a/scripts/start_unit.sh +++ b/scripts/start_php.sh @@ -5,5 +5,5 @@ php init.php php cron.php & unitd --log /logs/unit_error curl -X PUT --data-binary @/config/unit.json --unix-socket /var/run/control.unit.sock http://localhost/config -kill -TERM $(/bin/cat /var/run/unit.pid) +pkill unitd unitd --no-daemon --log /logs/unit_error diff --git a/scripts/start_proxy.sh b/scripts/start_proxy.sh index b2879ab..05f9847 100644 --- a/scripts/start_proxy.sh +++ b/scripts/start_proxy.sh @@ -1,7 +1,6 @@ cat /ssh/key.pub > /root/.ssh/authorized_keys -echo 'HostKeyAlgorithms +ssh-rsa' >> /etc/ssh/sshd_config -echo 'PubkeyAcceptedKeyTypes +ssh-rsa' >> /etc/ssh/sshd_config -service ssh start +ssh-keygen -A +exec /usr/sbin/sshd -D -e "$@" & sed -n "s/\"server_port\": \([0-9]\+\),/\1/p" /config.json > current_port CURRENT_PORT=$(cat current_port | tr -d " ") if [ "$CURRENT_PORT" -ne "443" ] @@ -9,5 +8,5 @@ then sed "s/\"server_port\": [0-9]\+/\"server_port\": $SSPORT/" /config.json > change_port cat change_port > /config.json fi -/sslocal -v -d -c /config.json +sslocal -v -d -c /config.json tail -f /dev/null diff --git a/scripts/start_ss.sh b/scripts/start_ss.sh index 819a245..da97e6b 100644 --- a/scripts/start_ss.sh +++ b/scripts/start_ss.sh @@ -1,8 +1,7 @@ cat /ssh/key.pub > /root/.ssh/authorized_keys -echo 'HostKeyAlgorithms +ssh-rsa' >> /etc/ssh/sshd_config -echo 'PubkeyAcceptedKeyTypes +ssh-rsa' >> /etc/ssh/sshd_config -service ssh start +ssh-keygen -A +exec /usr/sbin/sshd -D -e "$@" & sed "s/\"server_port\": [0-9]\+/\"server_port\": $SSPORT/" /config.json > change_port cat change_port > /config.json -/ssserver -v -d -c /config.json +ssserver -v -d -c /config.json tail -f /dev/null diff --git a/scripts/start_tg.sh b/scripts/start_tg.sh index 18febc3..bddf545 100644 --- a/scripts/start_tg.sh +++ b/scripts/start_tg.sh @@ -1,13 +1,12 @@ +echo 'root:dummy_passwd'|chpasswd cat /ssh/key.pub > /root/.ssh/authorized_keys -echo 'HostKeyAlgorithms +ssh-rsa' >> /etc/ssh/sshd_config -echo 'PubkeyAcceptedKeyTypes +ssh-rsa' >> /etc/ssh/sshd_config -service ssh start +ssh-keygen -A +exec /usr/sbin/sshd -D -e "$@" & curl -s https://core.telegram.org/getProxySecret -o proxy-secret curl -s https://core.telegram.org/getProxyConfig -o proxy-multi.conf -if [ $(cat /mtprotosecret | wc -c) -eq 0 ] +if [ $(cat /mtprotosecret | wc -c) -gt 0 ] then - head -c 16 /dev/urandom | xxd -ps > /mtprotosecret + SECRET=$(cat /mtprotosecret) + mtproto-proxy -u nobody -H $TGPORT --nat-info 10.10.0.8:$IP -S $SECRET --aes-pwd /proxy-secret /proxy-multi.conf -M 1 fi -SECRET=$(cat /mtprotosecret) -mtproto-proxy -u nobody -H $TGPORT --nat-info 10.10.0.8:$IP -S $SECRET --aes-pwd /proxy-secret /proxy-multi.conf -M 1 tail -f /dev/null diff --git a/scripts/start_wg.sh b/scripts/start_wg.sh index 28feac0..749037d 100644 --- a/scripts/start_wg.sh +++ b/scripts/start_wg.sh @@ -13,7 +13,6 @@ sed "s/ListenPort = [0-9]\+/ListenPort = $WGPORT/" /etc/wireguard/wg0.conf > cha cat change_port > /etc/wireguard/wg0.conf wg-quick up wg0 cat /ssh/key.pub > /root/.ssh/authorized_keys -echo 'HostKeyAlgorithms +ssh-rsa' >> /etc/ssh/sshd_config -echo 'PubkeyAcceptedKeyTypes +ssh-rsa' >> /etc/ssh/sshd_config -service ssh start +ssh-keygen -A +exec /usr/sbin/sshd -D -e "$@" & tail -f /dev/null