cleanup build

linux-amd64.Dockerfile

@@ -4,30 +4,17 @@ ARG UPSTREAM_DIGEST_AMD64
 FROM golang:alpine as builder
 ARG VERSION
 RUN apk add --no-cache curl jq
-RUN mkdir /caddy && \
-    xcaddy_version=$(curl -u "${GITHUB_ACTOR}:${GITHUB_TOKEN}" -fsSL "https://api.github.com/repos/caddyserver/xcaddy/releases/latest" | jq -r .tag_name | sed s/v//g) && \
-    wget -O - "https://github.com/caddyserver/xcaddy/releases/download/v${xcaddy_version}/xcaddy_${xcaddy_version}_linux_arm64.tar.gz" | tar xzf - -C "/bin" && \
-    cd /caddy && \
-    xcaddy build v${VERSION} --output /caddy/caddy \
+RUN xcaddy_version=$(curl -u "${GITHUB_ACTOR}:${GITHUB_TOKEN}" -fsSL "https://api.github.com/repos/caddyserver/xcaddy/releases/latest" | jq -r .tag_name | sed s/v//g) && \
+    wget -O - "https://github.com/caddyserver/xcaddy/releases/download/v${xcaddy_version}/xcaddy_${xcaddy_version}_linux_amd64.tar.gz" | tar xzf - -C "/bin" && \
+    xcaddy build v${VERSION} --output /caddy-bin \
         --with github.com/caddy-dns/cloudflare && \
-    chmod 755 "/caddy/caddy"
+    chmod 755 "/caddy-bin"
 
 
 FROM ${UPSTREAM_IMAGE}@${UPSTREAM_DIGEST_AMD64}
 EXPOSE 8080 8443
 VOLUME ["${CONFIG_DIR}"]
-
 ENV CUSTOM_BUILD=""
-
-RUN apk add --no-cache nss-tools fail2ban cronie logrotate
-
-ARG VERSION
-COPY --from=builder /caddy/caddy "${APP_DIR}/caddy"
-RUN chmod -R u=rwX,go=rX "${APP_DIR}" && \
-    ln -s "${APP_DIR}/caddy" "/usr/local/bin/caddy" && \
-    cp -R /etc/fail2ban "${APP_DIR}/" && \
-    rm -rf /etc/fail2ban && \
-    ln -s "${CONFIG_DIR}/fail2ban" "/etc/fail2ban"
-
+COPY --from=builder /caddy-bin "${APP_DIR}/caddy"
 COPY root/ /
 RUN chmod -R +x /etc/cont-init.d/ /etc/services.d/

linux-arm64.Dockerfile

@@ -4,30 +4,17 @@ ARG UPSTREAM_DIGEST_ARM64
 FROM golang:alpine as builder
 ARG VERSION
 RUN apk add --no-cache curl jq
-RUN mkdir /caddy && \
-    xcaddy_version=$(curl -u "${GITHUB_ACTOR}:${GITHUB_TOKEN}" -fsSL "https://api.github.com/repos/caddyserver/xcaddy/releases/latest" | jq -r .tag_name | sed s/v//g) && \
+RUN xcaddy_version=$(curl -u "${GITHUB_ACTOR}:${GITHUB_TOKEN}" -fsSL "https://api.github.com/repos/caddyserver/xcaddy/releases/latest" | jq -r .tag_name | sed s/v//g) && \
     wget -O - "https://github.com/caddyserver/xcaddy/releases/download/v${xcaddy_version}/xcaddy_${xcaddy_version}_linux_arm64.tar.gz" | tar xzf - -C "/bin" && \
-    cd /caddy && \
-    xcaddy build v${VERSION} --output /caddy/caddy \
+    xcaddy build v${VERSION} --output /caddy-bin \
         --with github.com/caddy-dns/cloudflare && \
-    chmod 755 "/caddy/caddy"
+    chmod 755 "/caddy-bin"
 
 
 FROM ${UPSTREAM_IMAGE}@${UPSTREAM_DIGEST_ARM64}
 EXPOSE 8080 8443
 VOLUME ["${CONFIG_DIR}"]
-
 ENV CUSTOM_BUILD=""
-
-RUN apk add --no-cache nss-tools fail2ban cronie logrotate
-
-ARG VERSION
-COPY --from=builder /caddy/caddy "${APP_DIR}/caddy"
-RUN chmod -R u=rwX,go=rX "${APP_DIR}" && \
-    ln -s "${APP_DIR}/caddy" "/usr/local/bin/caddy" && \
-    cp -R /etc/fail2ban "${APP_DIR}/" && \
-    rm -rf /etc/fail2ban && \
-    ln -s "${CONFIG_DIR}/fail2ban" "/etc/fail2ban"
-
+COPY --from=builder /caddy-bin "${APP_DIR}/caddy"
 COPY root/ /
 RUN chmod -R +x /etc/cont-init.d/ /etc/services.d/

root/app/Caddyfile

@@ -8,11 +8,34 @@
   abort @block
 }
 
-:8080 {
+(security_headers) {
+  header {
+    Strict-Transport-Security "max-age=31536000; includeSubDomains;"
+    X-Frame-Options "SAMEORIGIN"
+    X-Content-Type-Options "nosniff"
+    Referrer-Policy "strict-origin"
+    X-Robots-Tag "noindex, nofollow, nosnippet, noarchive"
+  }
+}
+
+(log_settings) {
   log {
     output file /config/logs/access.log
+    level WARN
   }
+}
+
+# Default http file server
+:8080 {
+  import log_settings
   root * /app/www
   file_server
   import block_world
 }
+
+# Default reverse proxy template for your domain
+# sub.yourdomain.com {
+#   import log_settings
+#   import security_headers
+#   reverse_proxy server:8080
+# }

root/etc/cont-init.d/01-config-app

@@ -11,44 +11,4 @@ if [[ ! -f "${CONFIG_DIR}/Caddyfile" ]]; then
     chown hotio:hotio "${CONFIG_DIR}/Caddyfile"
 fi
 
-if [[ ! -d "${CONFIG_DIR}/fail2ban" ]]; then
-    echo "Installing default \"fail2ban\"..."
-    cp -R "${APP_DIR}/fail2ban" "${CONFIG_DIR}/"
-    chown -R hotio:hotio "${CONFIG_DIR}/fail2ban"
-fi
-
-if [[ -f "${CONFIG_DIR}/fail2ban/fail2ban.sqlite3" ]]; then
-    chown hotio:hotio "${CONFIG_DIR}/fail2ban/fail2ban.sqlite3"
-fi
-
-if [[ ! -f "${APP_DIR}/templates/.copied" ]]; then
-    echo "Installing default \"templates\"..."
-    rm -rf "${CONFIG_DIR}/templates"
-    cp -R "${APP_DIR}/templates" "${CONFIG_DIR}/"
-    chown -R hotio:hotio "${CONFIG_DIR}/templates"
-    touch "${APP_DIR}/templates/.copied"
-fi
-
-if [[ ! -d "${CONFIG_DIR}/crontab" ]]; then
-    echo "Installing default \"crontab\"..."
-    cp -R "${APP_DIR}/crontab" "${CONFIG_DIR}/"
-    chown -R hotio:hotio "${CONFIG_DIR}/crontab"
-fi
-
-if [[ -f "${CONFIG_DIR}/crontab/default" ]]; then
-    echo "Loading user provided \"crontab\" to system..."
-    crontab "${CONFIG_DIR}/crontab/default"
-fi
-
-if [[ ! -d "${CONFIG_DIR}/logrotate" ]]; then
-    echo "Installing default \"logrotate\"..."
-    cp -R "${APP_DIR}/logrotate" "${CONFIG_DIR}/"
-    chown -R hotio:hotio "${CONFIG_DIR}/logrotate"
-fi
-
-if [[ -d "${CONFIG_DIR}/logrotate" ]]; then
-    echo "Copying \"logrotate\" folder to /tmp and chown as root..."
-    rm -rf "/tmp/logrotate"
-    cp -R "${CONFIG_DIR}/logrotate" "/tmp/"
-    chown -R root:root "/tmp/logrotate"
-fi
+ln -sf "${APP_DIR}/caddy" "/usr/local/bin/caddy"