diff --git a/docker-compose.yml b/docker-compose.yml index c893c44..1a1123c 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -5,12 +5,14 @@ services: network_mode: host ports: - 80:80 + - 443:80 - 2001:2001 #dataplaneapi build: context: ./ dockerfile: haproxy/Dockerfile volumes: - ./haproxy/haproxy.cfg:/etc/haproxy/haproxy.cfg + - ./haproxy/haproxy.pem:/etc/haproxy/certs/haproxy.pem - ./haproxy/dataplaneapi.hcl:/etc/haproxy/dataplaneapi.hcl - ./haproxy/errors/:/etc/haproxy/errors/ - ./haproxy/map/:/etc/haproxy/map/ @@ -39,12 +41,12 @@ services: - POW_TYPE=argon2 - TOR_CONTROL_PORT_PASSWORD=changeme - # nginx: - # ports: - # - 81:80 - # image: "nginx:latest" - # volumes: - # - ./nginx:/usr/share/nginx/html + nginx: + ports: + - 81:80 + image: "nginx:latest" + volumes: + - ./nginx:/usr/share/nginx/html # tor: # build: diff --git a/haproxy/Dockerfile b/haproxy/Dockerfile index eb41edc..cbef997 100644 --- a/haproxy/Dockerfile +++ b/haproxy/Dockerfile @@ -1,96 +1,89 @@ +FROM golang:latest AS dataplaneapi-builder -# -# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh" -# -# PLEASE DO NOT EDIT IT DIRECTLY. -# +ENV DATAPLANE_MINOR 2.7.5 +ENV DATAPLANE_URL https://github.com/haproxytech/dataplaneapi.git -FROM debian:buster-slim +RUN git clone "${DATAPLANE_URL}" "${GOPATH}/src/github.com/haproxytech/dataplaneapi" +RUN cd "${GOPATH}/src/github.com/haproxytech/dataplaneapi" && \ + git checkout "v${DATAPLANE_MINOR}" && \ + make build && cp build/dataplaneapi /dataplaneapi -# roughly, https://salsa.debian.org/haproxy-team/haproxy/-/blob/732b97ae286906dea19ab5744cf9cf97c364ac1d/debian/haproxy.postinst#L5-6 -RUN set -eux; \ - groupadd --gid 99 --system haproxy; \ - useradd \ - --gid haproxy \ - --home-dir /var/lib/haproxy \ - --no-create-home \ - --system \ - --uid 99 \ - haproxy +FROM debian:bullseye-slim AS openssl-builder -ENV HAPROXY_URL http://www.haproxy.org/download/2.7/src/snapshot/haproxy-ss-LATEST.tar.gz -ENV DATAPLANEAPI_URL https://github.com/haproxytech/dataplaneapi/releases/download/v2.7.5/dataplaneapi_2.7.5_Linux_x86_64.tar.gz +ENV OPENSSL_SHA256 4e23619f73688144f2cd808e9567504c3bf10cb67ad9551280530fd54ca913e1 +ENV OPENSSL_URL https://github.com/quictls/openssl/archive/refs/tags/OpenSSL_1_1_1t-quic1.tar.gz -# see https://sources.debian.net/src/haproxy/jessie/debian/rules/ for some helpful navigation of the possible "make" arguments -RUN set -eux; \ - \ - savedAptMark="$(apt-mark showmanual)"; \ - apt-get update && apt-get install -y --no-install-recommends \ - ca-certificates \ - gcc \ - libc6-dev \ - liblua5.3-dev \ - libpcre2-dev \ - libssl-dev \ - make \ - wget \ - zlib1g-dev \ - luarocks \ - ; \ - rm -rf /var/lib/apt/lists/*; \ - \ - wget -O dataplaneapi_Linux_x86_64.tar.gz "$DATAPLANEAPI_URL"; \ - tar -zxvf dataplaneapi_Linux_x86_64.tar.gz; \ - chmod +x build/dataplaneapi; \ - cp build/dataplaneapi /usr/local/bin/; \ - \ - wget -O haproxy.tar.gz "$HAPROXY_URL"; \ -# echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c; \ - mkdir -p /usr/src/haproxy; \ - tar -xzf haproxy.tar.gz -C /usr/src/haproxy --strip-components=1; \ - rm haproxy.tar.gz; \ - \ - makeOpts=' \ - TARGET=linux-glibc \ - USE_GETADDRINFO=1 \ - USE_LUA=1 LUA_INC=/usr/include/lua5.3 \ - USE_OPENSSL=1 \ - USE_PCRE2=1 USE_PCRE2_JIT=1 \ - USE_ZLIB=1 \ - '; \ -# https://salsa.debian.org/haproxy-team/haproxy/-/commit/53988af3d006ebcbf2c941e34121859fd6379c70 - dpkgArch="$(dpkg --print-architecture)"; \ - case "$dpkgArch" in \ - armel) makeOpts="$makeOpts ADDLIB=-latomic" ;; \ - esac; \ - \ - nproc="$(nproc)"; \ - eval "make -C /usr/src/haproxy -j '$nproc' all $makeOpts"; \ - eval "make -C /usr/src/haproxy install-bin $makeOpts"; \ - \ - mkdir -p /etc/haproxy; \ - cp -R /usr/src/haproxy/examples/errorfiles /etc/haproxy/errors; \ - rm -rf /usr/src/haproxy; \ - \ - apt-mark auto '.*' > /dev/null; \ - [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark; \ - find /usr/local -type f -executable -exec ldd '{}' ';' \ - | awk '/=>/ { print $(NF-1) }' \ - | sort -u \ - | xargs -r dpkg-query --search \ - | cut -d: -f1 \ - | sort -u \ - | xargs -r apt-mark manual \ - ; \ - apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \ - \ -# smoke test - haproxy -v +ENV DEBIAN_FRONTEND noninteractive + +RUN apt-get update && \ + apt-get install -y --no-install-recommends build-essential ca-certificates curl && \ + curl -sfSL "${OPENSSL_URL}" -o openssl.tar.gz && \ + mkdir -p /tmp/openssl && \ + tar -xzf openssl.tar.gz -C /tmp/openssl --strip-components=1 && \ + rm -f openssl.tar.gz && \ + cd /tmp/openssl && \ + ./config --libdir=lib --prefix=/opt/quictls && \ + make -j $(nproc) && \ + make install && \ + rm -rf /tmp/openssl + +FROM debian:bullseye-slim + +MAINTAINER Dinko Korunic + +LABEL Name HAProxy +LABEL Release Community Edition +LABEL Vendor HAProxy +LABEL Version 2.8.0 +LABEL RUN /usr/bin/docker -d IMAGE + +ENV HAPROXY_BRANCH 2.8 +ENV HAPROXY_MINOR 2.8.0 +ENV HAPROXY_SHA256 61cdafb5db7e9174d0757b8e4bcde938352306fb7cc8ff2b5f55c26dd48a6cf7 +ENV HAPROXY_SRC_URL http://www.haproxy.org/download + +ENV HAPROXY_UID haproxy +ENV HAPROXY_GID haproxy + +ENV DEBIAN_FRONTEND noninteractive + +COPY --from=dataplaneapi-builder /dataplaneapi /usr/local/bin/dataplaneapi +COPY --from=openssl-builder /opt/quictls /opt/quictls + +RUN apt-get update && \ + apt-get install -y --no-install-recommends procps zlib1g "libpcre2-*" liblua5.3-0 libatomic1 tar curl socat ca-certificates && \ + apt-get install -y --no-install-recommends gcc make libc6-dev libpcre2-dev zlib1g-dev liblua5.3-dev && \ + curl -sfSL "${HAPROXY_SRC_URL}/${HAPROXY_BRANCH}/src/haproxy-${HAPROXY_MINOR}.tar.gz" -o haproxy.tar.gz && \ + echo "$HAPROXY_SHA256 *haproxy.tar.gz" | sha256sum -c - && \ + groupadd "$HAPROXY_GID" && \ + useradd -g "$HAPROXY_GID" "$HAPROXY_UID" && \ + mkdir -p /tmp/haproxy && \ + tar -xzf haproxy.tar.gz -C /tmp/haproxy --strip-components=1 && \ + rm -f haproxy.tar.gz && \ + make -C /tmp/haproxy -j"$(nproc)" TARGET=linux-glibc CPU=generic USE_PCRE2=1 USE_PCRE2_JIT=1 USE_OPENSSL=1 \ + USE_TFO=1 USE_LINUX_TPROXY=1 USE_LUA=1 USE_GETADDRINFO=1 \ + USE_PROMEX=1 USE_SLZ=1 \ + SSL_INC=/opt/quictls/include SSL_LIB=/opt/quictls/lib USE_QUIC=1 \ + LDFLAGS="-L/opt/quictls/lib -Wl,-rpath,/opt/quictls/lib" \ + all && \ + make -C /tmp/haproxy TARGET=linux-glibc install-bin install-man && \ + ln -s /usr/local/sbin/haproxy /usr/sbin/haproxy && \ + mkdir -p /var/lib/haproxy && \ + chown "$HAPROXY_UID:$HAPROXY_GID" /var/lib/haproxy && \ + mkdir -p /usr/local/etc/haproxy && \ + ln -s /usr/local/etc/haproxy /etc/haproxy && \ + cp -R /tmp/haproxy/examples/errorfiles /usr/local/etc/haproxy/errors && \ + rm -rf /tmp/haproxy && \ + apt-get purge -y --auto-remove gcc make libc6-dev libpcre2-dev zlib1g-dev liblua5.3-dev && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists/* && \ + chmod +x /usr/local/bin/dataplaneapi && \ + ln -s /usr/local/bin/dataplaneapi /usr/bin/dataplaneapi && \ + touch /usr/local/etc/haproxy/dataplaneapi.hcl && \ + chown "$HAPROXY_UID:$HAPROXY_GID" /usr/local/etc/haproxy/dataplaneapi.hcl && \ + echo "/opt/quictls/lib" > /etc/ld.so.conf.d/quictls.conf && \ + ldconfig -# https://www.haproxy.org/download/1.8/doc/management.txt -# "4. Stopping and restarting HAProxy" -# "when the SIGTERM signal is sent to the haproxy process, it immediately quits and all established connections are closed" -# "graceful stop is triggered when the SIGUSR1 signal is sent to the haproxy process" STOPSIGNAL SIGUSR1 ADD haproxy/docker-entrypoint.sh /usr/local/bin/ @@ -98,7 +91,6 @@ RUN ln -s usr/local/bin/docker-entrypoint.sh / # backwards compat RUN apt update && apt install -y git lua5.3 liblua5.3-dev argon2 libargon2-dev luarocks RUN git config --global url."https://".insteadOf git:// RUN luarocks install argon2 -ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"] -# no USER for backwards compatibility (to try to avoid breaking existing users) +ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"] CMD ["haproxy", "-f", "/etc/haproxy/haproxy.cfg"] diff --git a/haproxy/haproxy.cfg b/haproxy/haproxy.cfg index db560b5..056eab5 100644 --- a/haproxy/haproxy.cfg +++ b/haproxy/haproxy.cfg @@ -47,6 +47,9 @@ frontend http-in # Clearnet http (you'll have to figure out https yourself) bind *:80 + bind *:443 ssl crt /etc/haproxy/certs/haproxy.pem alpn h3,h2,http/1.1 + bind quic4@*:443 ssl crt /etc/haproxy/certs/haproxy.pem + http-response set-header alt-svc "h3=\":443\";ma=900;" # Or instead, for Tor, to use circuit IDs as "IP": #bind 127.0.0.1:80 accept-proxy @@ -76,8 +79,8 @@ frontend http-in # acl for lua check whitelisted IPs/subnets and some excluded paths acl is_excluded src,map_ip(/etc/haproxy/map/whitelist.map) -m found - acl is_excluded src -m found -f /etc/haproxy/map/crawler-whitelist.map - acl is_excluded path /favicon.ico /.basedflare/pow-icon #add more + # acl is_excluded src -m found -f /etc/haproxy/map/crawler-whitelist.map + # acl is_excluded path /favicon.ico /.basedflare/pow-icon #add more # acl ORs for when ddos_mode_enabled acl ddos_mode_enabled_override str("true"),map(/etc/haproxy/map/ddos_global.map) -m found @@ -126,7 +129,7 @@ frontend http-in acl can_cache var(txn.path) -i -m end .png .jpg .jpeg .jpe .ico .webmanifest .xml .apng .bmp .webp .pjpeg .jfif .gif .mp4 .webm .mov .mkv .svg .m4a .aac .flac .mp3 .ogg .wav .opus .txt .pdf .sid # optional alt-svc header (done after cache so not set in cached responses - http-response set-header Alt-Svc %[var(txn.xcn),map(/etc/haproxy/map/alt-svc.map)] + # http-response set-header Alt-Svc %[var(txn.xcn),map(/etc/haproxy/map/alt-svc.map)] # header checks for no caching # acl auth_cookie_set res.hdr(Set-Cookie),lower -m found diff --git a/haproxy/map/ddos.map b/haproxy/map/ddos.map index 7033bab..997ee00 100644 --- a/haproxy/map/ddos.map +++ b/haproxy/map/ddos.map @@ -1,2 +1,4 @@ 127.0.0.1 1 127.0.0.1/captcha 2 +localhost 1 +localhost/captcha 2 diff --git a/haproxy/map/ddos_config.map b/haproxy/map/ddos_config.map index 86331df..ed87f3a 100644 --- a/haproxy/map/ddos_config.map +++ b/haproxy/map/ddos_config.map @@ -1 +1 @@ -127.0.0.1 {"pd":"argon2","pt":23,"cip":false,"cex":43200} +127.0.0.1 {"pd":23,"pt":"argon2","cip":false,"cex":43200} diff --git a/haproxy/map/hosts.map b/haproxy/map/hosts.map index 746aa2e..fc61161 100644 --- a/haproxy/map/hosts.map +++ b/haproxy/map/hosts.map @@ -1 +1,2 @@ 127.0.0.1 127.0.0.1:81 +localhost 127.0.0.1:81