Makussu/bunkerweb
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Deployed 972a284 to 1.4 with MkDocs 1.2.3 and mike 1.1.2

Browse Source
This commit is contained in:
florian
2022-06-06 23:10:16 +01:00
parent 4ca05eb80e
commit 563f4761e6
15 changed files with 1767 additions and 1769 deletions
Download Patch File Download Diff File Expand all files Collapse all files

241
1.4/web-ui/index.html
View File

@@ -641,12 +641,12 @@ documentation for the current version.
<li>Choose a strong password for the login</li>
<li>Put the web UI under a "hard to guess" URI</li>
<li>Do not open the web UI on the Internet without any further restrictions</li>
<li>Apply settings listed in the <a href="/security-tuning/">security tuning section</a> of the documentation</li>
<li>Apply settings listed in the <a href="/1.4/security-tuning/">security tuning section</a> of the documentation</li>
</ul>
</div>
<div class="admonition info">
<p class="admonition-title">Multisite mode</p>
<p>The installation of the web UI implies enabling the <a href="/concepts/#multisite-mode">multisite mode</a>.</p>
<p>The installation of the web UI implies enabling the <a href="/1.4/concepts/#multisite-mode">multisite mode</a>.</p>
</div>
<div class="admonition info">
<p class="admonition-title">UI specific env variables</p>
@@ -658,36 +658,36 @@ documentation for the current version.
<div class="tabbed-set tabbed-alternate" data-tabs="1:2"><input checked="checked" id="__tabbed_1_1" name="__tabbed_1" type="radio" /><input id="__tabbed_1_2" name="__tabbed_1" type="radio" /><div class="tabbed-labels"><label for="__tabbed_1_1">Docker</label><label for="__tabbed_1_2">Linux</label></div>
<div class="tabbed-content">
<div class="tabbed-block">
<p>When using the <a href="/integrations/#docker">Docker integration</a>, we recommend you to connect the BunkerWeb and web UI using a dedicated network and use another dedicated network for the communications between BunkerWeb and your web applications. The web UI can be deployed using a dedicated container based on the <a href="https://hub.docker.com/r/bunkerity/bunkerweb-ui">bunkerweb-ui image</a>.</p>
<p>When using the <a href="/1.4/integrations/#docker">Docker integration</a>, we recommend you to connect the BunkerWeb and web UI using a dedicated network and use another dedicated network for the communications between BunkerWeb and your web applications. The web UI can be deployed using a dedicated container based on the <a href="https://hub.docker.com/r/bunkerity/bunkerweb-ui">bunkerweb-ui image</a>.</p>
<p>Let's start by creating the networks (replace 10.20.30.0/24 with an unused network of your choice) :
<div class="highlight"><pre><span></span><code>docker network create --subnet <span class="m">10</span>.20.30.0/24 bw-ui <span class="o">&amp;&amp;</span> <span class="se">\</span>
docker network create bw-services
</code></pre></div></p>
<code>shell
docker network create --subnet 10.20.30.0/24 bw-ui &amp;&amp; \
docker network create bw-services</code></p>
<p>You will also need two volumes, one for the BunkerWeb data and another one to share the configuration files between the web UI and BunkerWeb :
<div class="highlight"><pre><span></span><code>docker volume create bw-data <span class="o">&amp;&amp;</span> <span class="se">\</span>
docker volume create bw-confs
</code></pre></div></p>
<code>shell
docker volume create bw-data &amp;&amp; \
docker volume create bw-confs</code></p>
<p>You can now create the BunkerWeb container with specific settings and volumes related to the web UI, please note the special <code>bunkerweb.UI</code> label which is mandatory :
<div class="highlight"><pre><span></span><code>docker run -d <span class="se">\</span>
<code>shell
docker run -d \
--name mybunker
--network bw-services <span class="se">\</span>
-p <span class="m">80</span>:8080 <span class="se">\</span>
-p <span class="m">443</span>:8443 <span class="se">\</span>
-v bw-data:/data <span class="se">\</span>
-v bw-confs:/etc/nginx <span class="se">\</span>
-e <span class="nv">SERVER_NAME</span><span class="o">=</span>bwadm.example.com <span class="se">\</span>
-e <span class="nv">MULTISITE</span><span class="o">=</span>yes <span class="se">\</span>
-e <span class="s2">&quot;API_WHITELIST_IP=127.0.0.0/8 10.20.30.0/24&quot;</span> <span class="se">\</span>
-e bwadm.example.com_USE_UI<span class="o">=</span>yes <span class="se">\</span>
-e bwadm.example.com_USE_REVERSE_PROXY<span class="o">=</span>yes <span class="se">\</span>
-e bwadm.example.com_REVERSE_PROXY_URL<span class="o">=</span>/changeme <span class="se">\</span>
-e bwadm.example.com_REVERSE_PROXY_HOST<span class="o">=</span>http://myui:7000 <span class="se">\</span>
-e <span class="s2">&quot;bwadm.example.com_REVERSE_PROXY_HEADER=X-Script-Name /changeme&quot;</span> <span class="se">\</span>
-e bwadm.example.com_REVERSE_PROXY_INTERCEPT_ERRORS<span class="o">=</span>no <span class="se">\</span>
-l bunkerweb.UI <span class="se">\</span>
bunkerity/bunkerweb:1.4.0 <span class="o">&amp;&amp;</span> <span class="se">\</span>
docker network connect bw-ui mybunker
</code></pre></div></p>
--network bw-services \
-p 80:8080 \
-p 443:8443 \
-v bw-data:/data \
-v bw-confs:/etc/nginx \
-e SERVER_NAME=bwadm.example.com \
-e MULTISITE=yes \
-e "API_WHITELIST_IP=127.0.0.0/8 10.20.30.0/24" \
-e bwadm.example.com_USE_UI=yes \
-e bwadm.example.com_USE_REVERSE_PROXY=yes \
-e bwadm.example.com_REVERSE_PROXY_URL=/changeme \
-e bwadm.example.com_REVERSE_PROXY_HOST=http://myui:7000 \
-e "bwadm.example.com_REVERSE_PROXY_HEADER=X-Script-Name /changeme" \
-e bwadm.example.com_REVERSE_PROXY_INTERCEPT_ERRORS=no \
-l bunkerweb.UI \
bunkerity/bunkerweb:1.4.0 &amp;&amp; \
docker network connect bw-ui mybunker</code></p>
<p>Important things to note :</p>
<ul>
<li><code>bwadm.example.com</code> is the dedicated (sub)domain for accessing the web UI</li>
@@ -697,103 +697,99 @@ docker network connect bw-ui mybunker
</ul>
<p>The web UI will need to access the Docker API in order to get metadata about the running containers. It can be done easily by mounting the <strong>docker.sock</strong> file into the container. But there is a security risk : if the web UI is exploited, all your container(s) and the host will be impacted because, at the moment, Docker doesn't provide any restriction feature. We highly recommend using something like a <a href="https://github.com/Tecnativa/docker-socket-proxy">docker socket proxy</a> to mitigate that risk (only a subset of read-only API endpoints will be available to the web UI container).</p>
<p>To connect the docker socket proxy and the web UI, you will need another network :
<div class="highlight"><pre><span></span><code>docker network create bw-docker
</code></pre></div></p>
<code>shell
docker network create bw-docker</code></p>
<p>Once the network is created, you can now create the docker socket proxy container :
<div class="highlight"><pre><span></span><code>docker run -d <span class="se">\</span>
--name mydocker <span class="se">\</span>
--network bw-docker <span class="se">\</span>
--privileged <span class="se">\</span>
-v /var/run/docker.sock:/var/run/docker.sock:ro <span class="se">\</span>
tecnativa/docker-socket-proxy
</code></pre></div></p>
<code>shell
docker run -d \
--name mydocker \
--network bw-docker \
--privileged \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
tecnativa/docker-socket-proxy</code></p>
<p>We can finally create the web UI container :
<div class="highlight"><pre><span></span><code>docker run -d <span class="se">\</span>
--name myui <span class="se">\</span>
--network bw-ui <span class="se">\</span>
-v bw-data:/data <span class="se">\</span>
-v bw-confs:/etc/nginx <span class="se">\</span>
-e <span class="nv">DOCKER_HOST</span><span class="o">=</span>tcp://mydocker:2375 <span class="se">\</span>
-e <span class="nv">ADMIN_USERNAME</span><span class="o">=</span>admin <span class="se">\</span>
-e <span class="nv">ADMIN_PASSWORD</span><span class="o">=</span>changeme <span class="se">\</span>
-e <span class="nv">ABSOLUTE_URI</span><span class="o">=</span>http<span class="o">(</span>s<span class="o">)</span>://bwadm.example.com/changeme/
bunkerity/bunkerweb-ui:1.4.0 <span class="o">&amp;&amp;</span> <span class="se">\</span>
docker network connect bw-docker myui
</code></pre></div></p>
<code>shell
docker run -d \
--name myui \
--network bw-ui \
-v bw-data:/data \
-v bw-confs:/etc/nginx \
-e DOCKER_HOST=tcp://mydocker:2375 \
-e ADMIN_USERNAME=admin \
-e ADMIN_PASSWORD=changeme \
-e ABSOLUTE_URI=http(s)://bwadm.example.com/changeme/
bunkerity/bunkerweb-ui:1.4.0 &amp;&amp; \
docker network connect bw-docker myui</code></p>
<p>Important things to note :</p>
<ul>
<li><code>http(s)://bwadmin.example.com/changeme/</code> is the full base URL of the web UI (must match the sub(domain) and /changeme URL used when creating the BunkerWeb container)</li>
<li>Replace the username <code>admin</code> and password <code>changeme</code> with strong ones</li>
</ul>
<p>Here is the docker-compose equivalent :
<div class="highlight"><pre><span></span><code><span class="nt">version</span><span class="p">:</span><span class="w"> </span><span class="s">&#39;3&#39;</span><span class="w"></span>
<span class="nt">services</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="nt">mybunker</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="nt">image</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bunkerity/bunkerweb:1.4.0</span><span class="w"></span>
<span class="w"> </span><span class="nt">networks</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bw-services</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bw-ui</span><span class="w"></span>
<span class="w"> </span><span class="nt">ports</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">80:8080</span><span class="w"></span>
<span class="w"> </span><span class="nt">volumes</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bw-data:/data</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bw-confs:/etc/nginx</span><span class="w"></span>
<span class="w"> </span><span class="nt">environment</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">SERVER_NAME=bwadm.example.com</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">MULTISITE=yes</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">API_WHITELIST_IP=127.0.0.0/8 10.20.30.0/24</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bwadm.example.com_USE_UI=yes</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bwadm.example.com_USE_REVERSE_PROXY=yes</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bwadm.example.com_REVERSE_PROXY_URL=/changeme/</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bwadm.example.com_REVERSE_PROXY_HOST=http://myui:7000</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bwadm.example.com_REVERSE_PROXY_HEADERS=X-Script-Name /changeme</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bwadm.example.com_REVERSE_PROXY_INTERCEPT_ERRORS=no</span><span class="w"></span>
<span class="w"> </span><span class="nt">labels</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="s">&quot;bunkerweb.UI&quot;</span><span class="w"></span>
<span class="w"> </span><span class="nt">myui</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="nt">image</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bunkerity/bunkerweb-ui:1.4.0</span><span class="w"></span>
<span class="w"> </span><span class="nt">depends_on</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">mydocker</span><span class="w"></span>
<span class="w"> </span><span class="nt">networks</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bw-ui</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bw-docker</span><span class="w"></span>
<span class="w"> </span><span class="nt">volumes</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bw-data:/data</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bw-confs:/etc/nginx</span><span class="w"></span>
<span class="w"> </span><span class="nt">environment</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">DOCKER_HOST=tcp://mydocker:2375</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ADMIN_USERNAME=admin</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ADMIN_PASSWORD=changeme</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ABSOLUTE_URI=http(s)://bwadm.example.com/changeme/</span><span class="w"></span>
<span class="w"> </span><span class="nt">mydocker</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="nt">image</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">tecnativa/docker-socket-proxy</span><span class="w"></span>
<span class="w"> </span><span class="nt">networks</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">bw-docker</span><span class="w"></span>
<span class="w"> </span><span class="nt">volumes</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">/var/run/docker.sock:/var/run/docker.sock:ro</span><span class="w"></span>
<span class="nt">networks</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="nt">bw-services</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="nt">bw-ui</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="nt">ipam</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="nt">driver</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">default</span><span class="w"></span>
<span class="w"> </span><span class="nt">config</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">subnet</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">10.20.30.0/24</span><span class="w"></span>
<span class="w"> </span><span class="nt">bw-docker</span><span class="p">:</span><span class="w"></span>
<span class="nt">volumes</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="nt">bw-data</span><span class="p">:</span><span class="w"></span>
<span class="w"> </span><span class="nt">bw-confs</span><span class="p">:</span><span class="w"></span>
</code></pre></div></p>
```yaml
version: '3'</p>
<p>services:</p>
<p>mybunker:
image: bunkerity/bunkerweb:1.4.0
networks:
- bw-services
- bw-ui
ports:
- 80:8080
volumes:
- bw-data:/data
- bw-confs:/etc/nginx
environment:
- SERVER_NAME=bwadm.example.com
- MULTISITE=yes
- API_WHITELIST_IP=127.0.0.0/8 10.20.30.0/24
- bwadm.example.com_USE_UI=yes
- bwadm.example.com_USE_REVERSE_PROXY=yes
- bwadm.example.com_REVERSE_PROXY_URL=/changeme/
- bwadm.example.com_REVERSE_PROXY_HOST=http://myui:7000
- bwadm.example.com_REVERSE_PROXY_HEADERS=X-Script-Name /changeme
- bwadm.example.com_REVERSE_PROXY_INTERCEPT_ERRORS=no
labels:
- "bunkerweb.UI"</p>
<p>myui:
image: bunkerity/bunkerweb-ui:1.4.0
depends_on:
- mydocker
networks:
- bw-ui
- bw-docker
volumes:
- bw-data:/data
- bw-confs:/etc/nginx
environment:
- DOCKER_HOST=tcp://mydocker:2375
- ADMIN_USERNAME=admin
- ADMIN_PASSWORD=changeme
- ABSOLUTE_URI=http(s)://bwadm.example.com/changeme/</p>
<p>mydocker:
image: tecnativa/docker-socket-proxy
networks:
- bw-docker
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro</p>
<p>networks:
bw-services:
bw-ui:
ipam:
driver: default
config:
- subnet: 10.20.30.0/24
bw-docker:</p>
<p>volumes:
bw-data:
bw-confs:
```</p>
</div>
<div class="tabbed-block">
<p>The installation of the web UI using the <a href="/integrations/#linux">Linux integration</a> is pretty straightforward because it is installed with BunkerWeb.</p>
<p>The installation of the web UI using the <a href="/1.4/integrations/#linux">Linux integration</a> is pretty straightforward because it is installed with BunkerWeb.</p>
<p>The first thing to do is to edit the BunkerWeb configuration located at <strong>/opt/bunkerweb/variables.env</strong> to add settings related to the web UI :
<div class="highlight"><pre><span></span><code>HTTP_PORT=80
<code>conf
HTTP_PORT=80
HTTPS_PORT=443
DNS_RESOLVERS=8.8.8.8 8.8.4.4
...
@@ -807,29 +803,28 @@ bwadm.example.com_REVERSE_PROXY_URL=/changeme
bwadm.example.com_REVERSE_PROXY_HOST=http://myui:7000
bwadm.example.com_REVERSE_PROXY_HEADER=X-Script-Name /changeme
bwadm.example.com_REVERSE_PROXY_INTERCEPT_ERRORS=no
...
</code></pre></div></p>
...</code></p>
<p>Important things to note :</p>
<ul>
<li><code>bwadm.example.com</code> is the dedicated (sub)domain for accessing the web UI</li>
<li>replace the <code>/changeme</code> URL with a custom one of your choice</li>
</ul>
<p>Once the configuration file is edited, you will need to reload BunkerWeb :
<div class="highlight"><pre><span></span><code>systemctl reload bunkerweb
</code></pre></div></p>
<code>shell
systemctl reload bunkerweb</code></p>
<p>You can edit the <strong>/opt/bunkerweb/ui.env</strong> file containing the settings of the web UI :
<div class="highlight"><pre><span></span><code>ADMIN_USERNAME=admin
<code>conf
ADMIN_USERNAME=admin
ADMIN_PASSWORD=changeme
ABSOLUTE_URI=http(s)://bwadm.example.com/changeme/
</code></pre></div></p>
ABSOLUTE_URI=http(s)://bwadm.example.com/changeme/</code></p>
<p>Important things to note :</p>
<ul>
<li><code>http(s)://bwadmin.example.com/changeme/</code> is the full base URL of the web UI (must match the sub(domain) and /changeme URL used in <strong>/opt/bunkerweb/variables.env</strong>)</li>
<li>replace the username <code>admin</code> and password <code>changeme</code> with strong ones</li>
</ul>
<p>Restart the BunkerWeb UI service and you are now ready to access it :
<div class="highlight"><pre><span></span><code>systemctl restart bunkerweb-ui
</code></pre></div></p>
<code>shell
systemctl restart bunkerweb-ui</code></p>
</div>
</div>
</div>