Skip to content

Commit 41e56a2

Browse files
rootyrooty
committed
init files
1 parent a8529cb commit 41e56a2

File tree

12 files changed

+772
-0
lines changed

12 files changed

+772
-0
lines changed

‎.github/dependabot.yml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# To get started with Dependabot version updates, you'll need to specify which
2+
# package ecosystems to update and where the package manifests are located.
3+
# Please see the documentation for all configuration options:
4+
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
5+
6+
version: 3
7+
updates:
8+
- package-ecosystem: "docker" # See documentation for possible values
9+
directory: "/" # Location of package manifests
10+
schedule:
11+
interval: "weekly"

‎.github/workflows/docker-image.yml

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Create and publish a Docker image
2+
3+
# Configures this workflow to run every time a change is pushed to the branch called `release`.
4+
on:
5+
push:
6+
#branches: ['release']
7+
8+
# Defines two custom environment variables for the workflow. These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
9+
env:
10+
REGISTRY: ghcr.io
11+
IMAGE_NAME: ${{ github.repository }}
12+
13+
# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
14+
jobs:
15+
build-and-push-image:
16+
runs-on: ubuntu-latest
17+
# Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
18+
permissions:
19+
contents: read
20+
packages: write
21+
attestations: write
22+
id-token: write
23+
#
24+
steps:
25+
- name: Checkout repository
26+
uses: actions/checkout@v4
27+
# Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
28+
- name: Log in to the Container registry
29+
uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
30+
with:
31+
registry: ${{ env.REGISTRY }}
32+
username: ${{ github.actor }}
33+
password: ${{ secrets.GITHUB_TOKEN }}
34+
# This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
35+
- name: Extract metadata (tags, labels) for Docker
36+
id: meta
37+
uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
38+
with:
39+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
40+
# This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
41+
# It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.
42+
# It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
43+
- name: Build and push Docker image
44+
id: push
45+
uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
46+
with:
47+
context: .
48+
push: true
49+
tags: |
50+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
51+
${{ steps.meta.outputs.tags }}
52+
labels: ${{ steps.meta.outputs.labels }}
53+
54+
# This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see "[AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds)."
55+
- name: Generate artifact attestation
56+
uses: actions/attest-build-provenance@v1
57+
with:
58+
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
59+
subject-digest: ${{ steps.push.outputs.digest }}
60+
push-to-registry: true

‎Dockerfile

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# syntax=docker/dockerfile:1
2+
FROM alpine:latest
3+
4+
LABEL org.opencontainers.image.source="https://github.com/rooty/proxy-vpn"
5+
LABEL org.opencontainers.image.description="OpenVPN+Proxy"
6+
LABEL org.opencontainers.image.licenses=MIT
7+
8+
# Install packages
9+
RUN apk --no-cache add \
10+
runit \
11+
curl \
12+
bash \
13+
wireguard-tools-wg-quick \
14+
openresolv \
15+
iptables \
16+
17+
# Bring in gettext so we can get `envsubst`, then throw
18+
# the rest away. To do this, we need to install `gettext`
19+
# then move `envsubst` out of the way so `gettext` can
20+
# be deleted completely, then move `envsubst` back.
21+
&& apk add --no-cache --virtual .gettext gettext \
22+
&& mv /usr/bin/envsubst /tmp/ \
23+
&& runDeps="$( \
24+
scanelf --needed --nobanner /tmp/envsubst \
25+
| awk '{ gsub(/,/, "\nso:", $2); print "so:" $2 }' \
26+
| sort -u \
27+
| xargs -r apk info --installed \
28+
| sort -u \
29+
)" \
30+
&& apk add --no-cache $runDeps \
31+
&& apk del .gettext \
32+
&& mv /tmp/envsubst /usr/local/bin/ \
33+
# Remove alpine cache
34+
&& rm -rf /var/cache/apk/* \
35+
# Make sure files/folders needed by the processes are accessable when they run under the nobody user
36+
&& chown -R nobody.nobody /run
37+
RUN curl -L -qs https://github.com/SenseUnit/dumbproxy/releases/download/v1.12.0/dumbproxy.linux-amd64 --output /usr/local/bin/dumbproxy && chmod +x /usr/local/bin/dumbproxy
38+
39+
# Add configuration files
40+
COPY --chown=nobody rootfs/ /
41+
42+
43+
# Add application
44+
WORKDIR /etc/openvpn
45+
46+
# Expose the port nginx is reachable on
47+
EXPOSE 8888
48+
49+
# Let runit start nginx & php-fpm
50+
# Ensure /bin/docker-entrypoint.sh is always executed
51+
ENTRYPOINT ["/bin/docker-entrypoint.sh"]
52+
53+
54+
# Configure a healthcheck to validate that everything is up&running
55+
#HEALTHCHECK --timeout=10s CMD curl --silent --fail http://127.0.0.1:8080/fpm-ping || exit 1

‎README.md

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# proxy-vpn
2+
![GitHub Actions Workflow Status](https://img.shields.io/github/actions/workflow/status/rooty/proxy-vpn/docker-image.yml)
3+
4+
## Features
5+
6+
- Supports CONNECT method and forwarding of HTTPS connections
7+
- Supports TLS operation mode (HTTP(S) proxy over TLS)
8+
- Supports client authentication with client TLS certificates
9+
- Supports HTTP/2
10+
11+
## Usage
12+
For run OpenVPN prepare 2 files
13+
- login/password file: auth
14+
- client VPN config: client.ovpn
15+
16+
17+
### Example auth file
18+
```
19+
login
20+
pasword
21+
```
22+
23+
### Example client.ovpn file
24+
```
25+
client
26+
dev tun
27+
reneg-sec 0
28+
persist-tun
29+
persist-key
30+
ping 5
31+
nobind
32+
allow-compression no
33+
remote-random
34+
remote-cert-tls server
35+
auth-nocache
36+
route-metric 1
37+
cipher AES-256-CBC
38+
auth sha512
39+
<ca>
40+
-----BEGIN CERTIFICATE-----
41+
.......................
42+
.......................
43+
-----END CERTIFICATE-----
44+
-----BEGIN CERTIFICATE-----
45+
.......................
46+
.......................
47+
-----END CERTIFICATE-----
48+
</ca>
49+
<cert>
50+
51+
-----BEGIN CERTIFICATE-----
52+
.......................
53+
.......................
54+
-----END CERTIFICATE-----
55+
</cert>
56+
<key>
57+
-----BEGIN PRIVATE KEY-----
58+
.......................
59+
.......................
60+
-----END PRIVATE KEY-----
61+
62+
</key>
63+
remote server.example.com
64+
proto udp
65+
66+
port 1194
67+
```
68+
### Exmaple compose.yaml file
69+
```yaml
70+
services:
71+
proxy:
72+
image: ghcr.io/rooty/proxy-vpn:latest
73+
restart: always
74+
privileged: true
75+
devices:
76+
- /dev/net/tun
77+
dns:
78+
- 8.8.8.8
79+
volumes:
80+
- '/path/to/file.ovpn':/etc/openvpn/client.ovpn:ro
81+
- '/path/to/file.auth':/etc/openvpn/auth:ro
82+
ports:
83+
- 127.0.0.1:8888:8888
84+
networks:
85+
- vpn-net
86+
```
87+
88+

‎compose.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
services:
2+
proxy-de:
3+
image: ghcr.io/rooty/proxy-vpn:latest
4+
restart: always
5+
privileged: true
6+
devices:
7+
- /dev/net/tun
8+
dns:
9+
- 8.8.8.8
10+
volumes:
11+
- /path/to/file.ovpn:/etc/openvpn/client.ovpn:ro
12+
- /path/to/file.auth:/etc/openvpn/auth:ro
13+
ports:
14+
- 127.0.0.1:8888:8888
15+
networks:
16+
- vpn-net

‎rootfs/bin/docker-entrypoint.sh

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#!/bin/sh
2+
3+
shutdown() {
4+
echo "shutting down container"
5+
6+
# first shutdown any service started by runit
7+
for _srv in $(ls -1 /etc/service); do
8+
sv force-stop $_srv
9+
done
10+
11+
# shutdown runsvdir command
12+
kill -HUP $RUNSVDIR
13+
wait $RUNSVDIR
14+
15+
# give processes time to stop
16+
sleep 0.5
17+
18+
# kill any other processes still running in the container
19+
for _pid in $(ps -eo pid | grep -v PID | tr -d ' ' | grep -v '^1$' | head -n -6); do
20+
timeout 5 /bin/sh -c "kill $_pid && wait $_pid || kill -9 $_pid"
21+
done
22+
exit
23+
}
24+
25+
26+
27+
echo "Starting startup scripts in /docker-entrypoint-init.d ..."
28+
for script in $(find /docker-entrypoint-init.d/ -executable -type f | sort); do
29+
30+
echo >&2 "*** Running: $script"
31+
$script
32+
retval=$?
33+
if [ $retval != 0 ];
34+
then
35+
echo >&2 "*** Failed with return value: $?"
36+
exit $retval
37+
fi
38+
39+
done
40+
echo "Finished startup scripts in /docker-entrypoint-init.d"
41+
42+
echo "Starting runit..."
43+
exec runsvdir -P /etc/service &
44+
45+
RUNSVDIR=$!
46+
echo "Started runsvdir, PID is $RUNSVDIR"
47+
echo "wait for processes to start...."
48+
49+
sleep 5
50+
for _srv in $(ls -1 /etc/service); do
51+
sv status $_srv
52+
done
53+
54+
# If there are additional arguments, execute them
55+
if [ $# -gt 0 ]; then
56+
exec "$@"
57+
fi
58+
59+
# catch shutdown signals
60+
trap shutdown SIGTERM SIGHUP SIGQUIT SIGINT
61+
wait $RUNSVDIR
62+
63+
shutdown

0 commit comments

Comments
 (0)