diff --git a/.github/workflows/docker-build-test.yaml b/.github/workflows/docker-build-test.yaml index c3d6bac..a4909e6 100644 --- a/.github/workflows/docker-build-test.yaml +++ b/.github/workflows/docker-build-test.yaml @@ -8,7 +8,7 @@ on: branches: - master paths-ignore: - - CI/*.yaml + - user_data.yaml env: # github.repository as / diff --git a/Docker/.env b/Docker/.env index 0ef3c76..f8c09ed 100644 --- a/Docker/.env +++ b/Docker/.env @@ -1,4 +1,16 @@ -PASSWORD="%SET_YOUR_PASSWORD%" -WEB_PORT=51821 +# NGINX and WireGuard Configuration for wg-easy +ALLOWED_NGINX_IPS="0.0.0.0/0" +# NGINX_DOMAIN is the domain for the web interface +NGINX_DOMAIN="" +WEB_INTERFACE_PORT=51821 WG_PORT=51820 -WG_HOST="%SET_YOUR_FQDN_OR_IP%" \ No newline at end of file +WG_ALLOWED_IPS="0.0.0.0/0, ::/0" +WG_DEFAULT_SUBNET="10.16.0.x" +WG_MTU=1420 +WG_UI_TRAFFIC_STATS="true" +WG_LANGUAGE="en" +WG_DEFAULT_DNS="8.8.8.8, 1.1.1.1" +# WG_HOST is the domain or IP address of the WireGuard server +WG_HOST="" +# Run - docker run ghcr.io/wg-easy/wg-easy:14 wgpw YOUR_PASSWORD +PASSWORD_HASH="" diff --git a/Docker/Dockerfile b/Docker/Dockerfile index feddd63..e760cd5 100644 --- a/Docker/Dockerfile +++ b/Docker/Dockerfile @@ -1,5 +1,5 @@ -ARG NGINX_FROM_IMAGE=nginx:1.27-alpine -FROM ${NGINX_FROM_IMAGE} as builder +ARG NGINX_FROM_IMAGE=nginx:1.27-alpine3.21 +FROM ${NGINX_FROM_IMAGE} AS builder ARG ENABLED_MODULES @@ -15,11 +15,11 @@ COPY ./ /modules/ RUN apk update \ && apk add linux-headers openssl-dev pcre2-dev zlib-dev openssl abuild \ musl-dev libxslt libxml2-utils make mercurial gcc unzip git \ - xz g++ coreutils \ + xz g++ coreutils curl \ # allow abuild as a root user \ && printf "#!/bin/sh\\nSETFATTR=true /usr/bin/abuild -F \"\$@\"\\n" > /usr/local/bin/abuild \ && chmod +x /usr/local/bin/abuild \ - && hg clone -r ${NGINX_VERSION}-${PKG_RELEASE} https://hg.nginx.org/pkg-oss/ \ + && git clone -b ${NGINX_VERSION}-${PKG_RELEASE} https://github.com/nginx/pkg-oss/ \ && cd pkg-oss \ && mkdir /tmp/packages \ && for module in $ENABLED_MODULES; do \ @@ -66,4 +66,4 @@ RUN --mount=type=bind,target=/tmp/packages/,source=/tmp/packages/,from=builder \ . /tmp/packages/modules.env \ && for module in $BUILT_MODULES; do \ apk add --no-cache --allow-untrusted /tmp/packages/nginx-module-${module}-${NGINX_VERSION}*.apk; \ - done + done \ No newline at end of file diff --git a/Docker/docker-compose.yaml b/Docker/compose.yaml similarity index 58% rename from Docker/docker-compose.yaml rename to Docker/compose.yaml index 150d7ee..0cb5ffc 100644 --- a/Docker/docker-compose.yaml +++ b/Docker/compose.yaml @@ -8,15 +8,18 @@ services: args: ENABLED_MODULES: headers-more environment: - - 'WG_PORT_PROXY=${WG_PORT}' + - WG_PORT_PROXY=${WG_PORT} + - NGINX_DOMAIN=${NGINX_DOMAIN} + - ALLOWED_NGINX_IPS=${ALLOWED_NGINX_IPS} image: nginx-hm:1.27-alpine ports: - - '80:80' - # - '443:443' + - '80:80/tcp' + - '443:443/tcp' - '${WG_PORT}:51819/udp' volumes: - '../nginx.conf:/etc/nginx/nginx.conf' - '../templates:/etc/nginx/templates/' + - '../certs:/etc/nginx/ssl/' networks: local-network: ipv4_address: 172.16.238.4 @@ -26,19 +29,19 @@ services: wg_easy: environment: - - LANG=en - - 'WG_HOST=${WG_HOST}' - - PASSWORD=${PASSWORD} - - 'PORT=${WEB_PORT}' - - 'WG_PORT=${WG_PORT}' - - WG_DEFAULT_ADDRESS=10.16.0.x - - WG_DEFAULT_DNS=1.1.1.1 - - WG_MTU=1420 + - LANG=${WG_LANGUAGE} + - WG_HOST=${WG_HOST} + - PASSWORD_HASH=${PASSWORD_HASH} + - PORT=${WEB_INTERFACE_PORT} + - WG_PORT=${WG_PORT} + - WG_DEFAULT_ADDRESS=${WG_DEFAULT_SUBNET} + - WG_DEFAULT_DNS=${WG_DEFAULT_DNS} + - WG_MTU=${WG_MTU} - WG_PERSISTENT_KEEPALIVE=25 - # - WG_ALLOWED_IPS=10.16.0.0/24 - - UI_TRAFFIC_STATS=true + - WG_ALLOWED_IPS=${WG_ALLOWED_IPS} + - UI_TRAFFIC_STATS=${WG_UI_TRAFFIC_STATS} - UI_CHART_TYPE=3 - image: 'ghcr.io/wg-easy/wg-easy:13@sha256:24eddefd4e5ae2cff930d4f9254f018d5f4cdd48daf559e7a73a14da6a9fbbb4' + image: 'ghcr.io/wg-easy/wg-easy:14@sha256:5f26407fd2ede54df76d63304ef184576a6c1bb73f934a58a11abdd852fab549' container_name: wg-easy volumes: - '/etc/wireguard:/etc/wireguard' @@ -46,7 +49,7 @@ services: local-network: ipv4_address: 172.16.238.5 ports: - - '172.16.238.1:${WEB_PORT}:${WEB_PORT}/tcp' + - '172.16.238.1:${WEB_INTERFACE_PORT}:${WEB_INTERFACE_PORT}/tcp' restart: unless-stopped cap_add: - NET_ADMIN @@ -65,11 +68,3 @@ networks: volumes: etc_wireguard: - -# volumes: -# grafana-storage: -# name: "grafana-storage" -# external: true -# grafana-config: -# name: "grafana-config" -# external: true diff --git a/README.md b/README.md index 98a831d..d703d00 100644 --- a/README.md +++ b/README.md @@ -13,6 +13,42 @@ ---
-![Static Badge](https://img.shields.io/badge/version-1.0-lightgreen?style=flat) +![Static Badge](https://img.shields.io/badge/version-1.0.1-lightgreen?style=flat)
+ +--- +
+  +
+ +## How It Works + +1. Clone this repository +2. Set your values for variables in the **.env** file. +3. Run - **docker-compose up -d** +4. Run - **docker ps** (to check the status) + +### Environment Variables Configuration + +1. **ALLOWED_NGINX_IPS** - The IPv4 address or subnet from which access will be allowed. Provide a single IPv4 address or a CIDR range, such as `192.168.1.1` or `192.168.1.0/24`. +2. **WEB_INTERFACE_PORT** - Port for access to the web interface wg-easy or endpoint - /wgui (Only for wg-easy). The default value is `51821`. +3. **WG_ALLOWED_IPS** - Specifies the IP ranges (in CIDR notation) that are allowed to communicate through the VPN. For example, use `0.0.0.0/0` to allow all traffic or a specific range like `192.168.1.0/24` for a local network. **Note:** Using `0.0.0.0/0` allows all traffic, which can pose security risks. It is recommended to restrict this to specific ranges whenever possible. +4. **WG_DEFAULT_SUBNET** - Specifies the subnet to use for the VPN. The format is `ip_address/prefix_length`. For example, `10.16.0.0/24` will create a subnet with a netmask of `255.255.255.0`. +5. **WG_MTU** - Specifies the Maximum Transmission Unit (MTU) for the VPN. The MTU is the maximum size of a packet that can be transmitted over the network. The default value is `1420`, which is suitable for most use cases. Adjust this value only if you experience connectivity issues or need to optimize for specific network conditions. +6. **WG_UI_TRAFFIC_STATS** - Specifies whether to display traffic statistics in the web interface. Set to `true` to enable, or `false` to disable. Defaults to `false` if not specified. +7. **WG_LANGUAGE** - Specifies the language for the web interface. The available options are `en` (English) and `es` (Spanish). +8. **WG_DEFAULT_DNS** - Specifies the DNS servers to use for the VPN. Separate multiple DNS servers with commas. For example, `8.8.8.8, 1.1.1.1`. +9. **WG_PORT** - Specifies the port to use for the VPN. The default value is `51820`, but it can be changed freely to suit your network configuration. +10. **NGINX_DOMAIN** - The domain for the web interface. For example, `example.com`. + + > This is the domain for the web interface. It is used to configure the server block in NGINX. +11. **PASSWORD_HASH** - The hashed password for the web interface. Default is empty. + + > This is the hashed password for the web interface. It is used to secure the access to the web interface. The password can be hashed using the `wgpw` command-line tool provided by the `wg-easy` package. For example, to hash a password, you can run `wgpw mypassword`. + + > **Note:** Make sure to store the hashed password securely and do not commit it to version control. + + +🚨 File [**user_data.yaml**](user_data.yaml) contains data for cloud-init. It has default user - oricorio, defualt hashed password - changepass +🚨 If you use [**user_data.yaml**](user_data.yaml) for deploy your server than change password and/or disable password login is set **lock_passwd: false** diff --git a/nginx.conf b/nginx.conf index 0a403de..295ab26 100644 --- a/nginx.conf +++ b/nginx.conf @@ -10,27 +10,23 @@ events { } http { - server { - access_log /var/log/nginx/access.log combined; - listen 80; - server_name %INSERT_YOUR_SERVER_NAME%; - - proxy_buffers 48 16k; - proxy_buffer_size 16k; - - location / { - root /usr/share/nginx/html; - index index.html; - } - - location /web/ { - proxy_pass http://wg_easy:51821/; - proxy_connect_timeout 3s; - # Uncomment the following line if needed; - # allow %INSERT_YOU_IPS%; - # deny all; - } - } + server_tokens off; + proxy_buffers 48 16k; + proxy_buffer_size 16k; + proxy_busy_buffers_size 24k; + + proxy_cache_path /tmp/cache levels=1:2 keys_zone=cache:60m max_size=1G use_temp_path=off; + proxy_cache_methods GET HEAD; + + proxy_redirect off; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Host $host; + # proxy_set_header Connection ""; + + # include /etc/nginx/conf.d/domain_https.conf; + include /etc/nginx/conf.d/domain_http.conf; server { listen 80 default_server; diff --git a/templates/domain_http.conf.template b/templates/domain_http.conf.template new file mode 100644 index 0000000..b5f6956 --- /dev/null +++ b/templates/domain_http.conf.template @@ -0,0 +1,37 @@ + server { + access_log /var/log/nginx/access.log combined; + listen 80; + server_name $NGINX_DOMAIN; + + location = / { + root /usr/share/nginx/html; + index index.html; + return 444; + } + + location /wgui/ { + proxy_pass http://wg_easy:51821/; + proxy_connect_timeout 3s; + proxy_http_version 1.1; + proxy_set_header X-NginX-Proxy true; + + proxy_request_buffering off; + proxy_buffering off; + + # proxy_cache cache; + # proxy_cache_key $host$uri$is_args$args; + # proxy_cache_valid 200 301 302 30m; + # proxy_cache_valid 404 10m; + + # Uncomment the following line if needed; + allow $ALLOWED_NGINX_IPS; + deny all; + } + + # include prometheus config + include /etc/nginx/conf.d/prom.conf; + + # redirect server error pages to the static page /50x.html + # + error_page 500 502 503 504 /50x.html; + } diff --git a/templates/domain_https.conf.template b/templates/domain_https.conf.template new file mode 100644 index 0000000..60ac7d4 --- /dev/null +++ b/templates/domain_https.conf.template @@ -0,0 +1,51 @@ + server { + access_log /var/log/nginx/access.log combined; + listen 443 ssl; + http2 on; + server_name $NGINX_DOMAIN; + + ssl_certificate /etc/nginx/ssl/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/privkey.pem; + + location = / { + root /usr/share/nginx/html; + index index.html; + return 444; + } + + location /wgui/ { + proxy_pass http://wg_easy:51821/; + proxy_connect_timeout 3s; + proxy_http_version 1.1; + proxy_set_header X-NginX-Proxy true; + + proxy_request_buffering off; + proxy_buffering off; + + # proxy_cache cache; + # proxy_cache_key $host$uri$is_args$args; + # proxy_cache_valid 200 301 302 30m; + # proxy_cache_valid 404 10m; + + # Uncomment the following line if needed; + allow $ALLOWED_NGINX_IPS; + deny all; + } + + # include prometheus config + include /etc/nginx/conf.d/prom.conf; + + # redirect server error pages to the static page /50x.html + # + error_page 500 502 503 504 /50x.html; + } + + server { + access_log /var/log/nginx/access.log combined; + listen 80; + server_name $NGINX_DOMAIN; + + location / { + return 301 https://$NGINX_DOMAIN$request_uri; + } + } diff --git a/templates/prom.conf.template b/templates/prom.conf.template new file mode 100644 index 0000000..8f56f2a --- /dev/null +++ b/templates/prom.conf.template @@ -0,0 +1,3 @@ +location /prometheus/ { + return 444; +} \ No newline at end of file diff --git a/CI/user_data.yaml b/user_data.yaml similarity index 88% rename from CI/user_data.yaml rename to user_data.yaml index 2a7ab9e..2862546 100644 --- a/CI/user_data.yaml +++ b/user_data.yaml @@ -10,6 +10,11 @@ cloud_config_modules: # cloud_final_modules: # - apt-configure +# uncomment if you need to set fqdn +manage_etc_hosts: true +# fqdn: netes-master1.example.org +# hostname: netes-master1 + output: {all: "| tee -a /var/log/cloud-init.log"} ssh_pwauth: true @@ -22,11 +27,11 @@ groups: system_info: distro: ubuntu default_user: - name: ubuntu + name: oricorio gecos: Default (ubuntu user) - # passwd: $6$w/HjOZlmeVGZ9GbC$cYqBM9POpFhxlg4n.eKUpidxkgf5RQ1XNS/hNdXt3GSKhNZNuLA6UYBph2k6Eo4OgQffSI5CitQS.2c3r2G0y/ + # mkpasswd --method=SHA-512 --rounds=4096 + passwd: $6$rounds=4096$BJsgS8j5q3UcqoOI$wcwUucZeeitef..i5EKwXKK/haawgdTgpZKiczxvw1JPNED5otLShw2NeUHtslDdRIb88t5B8I3I1ESC3Z5Lx1 # plain_text_passwd: changepass - plain_text_passwd: changepass sudo: ALL=(ALL) NOPASSWD:ALL groups: [users, docker] shell: /bin/bash @@ -111,6 +116,7 @@ apt: package_update: true packages: + - whois - wget - tree - apt-transport-https @@ -134,6 +140,7 @@ packages: - curl - gnupg - lsb-release + - bash-completion runcmd: - sudo systemctl restart systemd-resolved.service @@ -143,8 +150,8 @@ runcmd: - apt-get update - apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose docker-compose-plugin docker-buildx-plugin - update-grub - - mkdir /home/ubuntu/app - - git clone https://github.com/Operator2024/wireguard-vpn.git /home/ubuntu/app - - chown -R ubuntu:ubuntu /home/ubuntu/app + - mkdir /home/oricorio/app + - git clone https://github.com/Operator2024/wireguard-vpn.git /home/oricorio/app + - chown -R oricorio:oricorio /home/oricorio/app final_message: "The system is finally up, after $UPTIME seconds"