v1.2.1 - autoconf feature (beta)

.github/workflows/autotest.yml

@@ -23,6 +23,6 @@ jobs:
           format: 'table'
           exit-code: '1'
           ignore-unfixed: true
-          severity: 'CRITICAL,HIGH'
+          severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
 
 

Dockerfile

@@ -18,15 +18,23 @@ COPY fail2ban/ /opt/fail2ban
 COPY logs/ /opt/logs
 COPY lua/ /opt/lua
 COPY crowdsec/ /opt/crowdsec
+COPY autoconf/ /opt/autoconf
 
-RUN apk --no-cache add certbot libstdc++ libmaxminddb geoip pcre yajl fail2ban clamav apache2-utils rsyslog openssl lua libgd go jq mariadb-connector-c bash brotli && \
+RUN apk --no-cache add certbot libstdc++ libmaxminddb geoip pcre yajl fail2ban clamav apache2-utils rsyslog openssl lua libgd go jq mariadb-connector-c bash brotli py3-pip && \
-    chmod +x /opt/entrypoint/* /opt/scripts/* && \
+    pip3 install docker && \
+    chmod +x /opt/entrypoint/* /opt/scripts/* /opt/autoconf/autoconf.py && \
     mkdir /opt/entrypoint.d && \
     rm -f /var/log/nginx/* && \
     chown root:nginx /var/log/nginx && \
     chmod 750 /var/log/nginx && \
     touch /var/log/nginx/error.log /var/log/nginx/modsec_audit.log && \
-    chown nginx:nginx /var/log/nginx/*.log
+    chown nginx:nginx /var/log/nginx/*.log && \
+    mkdir /acme-challenge && \
+    chown root:nginx /acme-challenge && \
+    chmod 750 /acme-challenge
+
+# Fix CVE-2020-28928
+RUN apk --no-cache add "musl-utils>1.1.24-r2"
 
 VOLUME /www /http-confs /server-confs /modsec-confs /modsec-crs-confs /cache
 

Dockerfile-amd64

@@ -18,15 +18,23 @@ COPY fail2ban/ /opt/fail2ban
 COPY logs/ /opt/logs
 COPY lua/ /opt/lua
 COPY crowdsec/ /opt/crowdsec
+COPY autoconf/ /opt/autoconf
 
-RUN apk --no-cache add certbot libstdc++ libmaxminddb geoip pcre yajl fail2ban clamav apache2-utils rsyslog openssl lua libgd go jq mariadb-connector-c bash brotli && \
+RUN apk --no-cache add certbot libstdc++ libmaxminddb geoip pcre yajl fail2ban clamav apache2-utils rsyslog openssl lua libgd go jq mariadb-connector-c bash brotli py3-pip && \
-    chmod +x /opt/entrypoint/* /opt/scripts/* && \
+    pip3 install docker && \
+    chmod +x /opt/entrypoint/* /opt/scripts/* /opt/autoconf/autoconf.py && \
     mkdir /opt/entrypoint.d && \
     rm -f /var/log/nginx/* && \
     chown root:nginx /var/log/nginx && \
     chmod 750 /var/log/nginx && \
     touch /var/log/nginx/error.log /var/log/nginx/modsec_audit.log && \
-    chown nginx:nginx /var/log/nginx/*.log
+    chown nginx:nginx /var/log/nginx/*.log && \
+    mkdir /acme-challenge && \
+    chown root:nginx /acme-challenge && \
+    chmod 750 /acme-challenge
+
+# Fix CVE-2020-28928
+RUN apk --no-cache add "musl-utils>1.1.24-r2"
 
 VOLUME /www /http-confs /server-confs /modsec-confs /modsec-crs-confs /cache
 

Dockerfile-arm32v7

@@ -25,15 +25,23 @@ COPY fail2ban/ /opt/fail2ban
 COPY logs/ /opt/logs
 COPY lua/ /opt/lua
 COPY crowdsec/ /opt/crowdsec
+COPY autoconf/ /opt/autoconf
 
-RUN apk --no-cache add certbot libstdc++ libmaxminddb geoip pcre yajl fail2ban clamav apache2-utils rsyslog openssl lua libgd go jq mariadb-connector-c bash brotli && \
+RUN apk --no-cache add certbot libstdc++ libmaxminddb geoip pcre yajl fail2ban clamav apache2-utils rsyslog openssl lua libgd go jq mariadb-connector-c bash brotli py3-pip && \
-    chmod +x /opt/entrypoint/* /opt/scripts/* && \
+    pip3 install docker && \
+    chmod +x /opt/entrypoint/* /opt/scripts/* /opt/autoconf/autoconf.py && \
     mkdir /opt/entrypoint.d && \
     rm -f /var/log/nginx/* && \
     chown root:nginx /var/log/nginx && \
     chmod 750 /var/log/nginx && \
     touch /var/log/nginx/error.log /var/log/nginx/modsec_audit.log && \
-    chown nginx:nginx /var/log/nginx/*.log
+    chown nginx:nginx /var/log/nginx/*.log && \
+    mkdir /acme-challenge && \
+    chown root:nginx /acme-challenge && \
+    chmod 750 /acme-challenge
+
+# Fix CVE-2020-28928
+RUN apk --no-cache add "musl-utils>1.1.24-r2"
 
 VOLUME /www /http-confs /server-confs /modsec-confs /modsec-crs-confs /cache
 

Dockerfile-arm64v8

@@ -25,15 +25,23 @@ COPY fail2ban/ /opt/fail2ban
 COPY logs/ /opt/logs
 COPY lua/ /opt/lua
 COPY crowdsec/ /opt/crowdsec
+COPY autoconf/ /opt/autoconf
 
-RUN apk --no-cache add certbot libstdc++ libmaxminddb geoip pcre yajl fail2ban clamav apache2-utils rsyslog openssl lua libgd go jq mariadb-connector-c bash brotli && \
+RUN apk --no-cache add certbot libstdc++ libmaxminddb geoip pcre yajl fail2ban clamav apache2-utils rsyslog openssl lua libgd go jq mariadb-connector-c bash brotli py3-pip && \
-    chmod +x /opt/entrypoint/* /opt/scripts/* && \
+    pip3 install docker && \
+    chmod +x /opt/entrypoint/* /opt/scripts/* /opt/autoconf/autoconf.py && \
     mkdir /opt/entrypoint.d && \
     rm -f /var/log/nginx/* && \
     chown root:nginx /var/log/nginx && \
     chmod 750 /var/log/nginx && \
     touch /var/log/nginx/error.log /var/log/nginx/modsec_audit.log && \
-    chown nginx:nginx /var/log/nginx/*.log
+    chown nginx:nginx /var/log/nginx/*.log && \
+    mkdir /acme-challenge && \
+    chown root:nginx /acme-challenge && \
+    chmod 750 /acme-challenge
+
+# Fix CVE-2020-28928
+RUN apk --no-cache add "musl-utils>1.1.24-r2"
 
 VOLUME /www /http-confs /server-confs /modsec-confs /modsec-crs-confs /cache
 

Dockerfile-i386

@@ -18,15 +18,23 @@ COPY fail2ban/ /opt/fail2ban
 COPY logs/ /opt/logs
 COPY lua/ /opt/lua
 COPY crowdsec/ /opt/crowdsec
+COPY autoconf/ /opt/autoconf
 
-RUN apk --no-cache add certbot libstdc++ libmaxminddb geoip pcre yajl fail2ban clamav apache2-utils rsyslog openssl lua libgd go jq mariadb-connector-c bash brotli && \
+RUN apk --no-cache add certbot libstdc++ libmaxminddb geoip pcre yajl fail2ban clamav apache2-utils rsyslog openssl lua libgd go jq mariadb-connector-c bash brotli py3-pip && \
-    chmod +x /opt/entrypoint/* /opt/scripts/* && \
+    pip3 install docker && \
+    chmod +x /opt/entrypoint/* /opt/scripts/* /opt/autoconf/autoconf.py && \
     mkdir /opt/entrypoint.d && \
     rm -f /var/log/nginx/* && \
     chown root:nginx /var/log/nginx && \
     chmod 750 /var/log/nginx && \
     touch /var/log/nginx/error.log /var/log/nginx/modsec_audit.log && \
-    chown nginx:nginx /var/log/nginx/*.log
+    chown nginx:nginx /var/log/nginx/*.log && \
+    mkdir /acme-challenge && \
+    chown root:nginx /acme-challenge && \
+    chmod 750 /acme-challenge
+
+# Fix CVE-2020-28928
+RUN apk --no-cache add "musl-utils>1.1.24-r2"
 
 VOLUME /www /http-confs /server-confs /modsec-confs /modsec-crs-confs /cache
 

README.md

@@ -19,6 +19,7 @@ Non-exhaustive list of features :
 - Prevent bruteforce attacks with rate limiting
 - Detect bad files with ClamAV
 - Easy to configure with environment variables
+- Automatic configuration with container labels
 
 Fooling automated tools/scanners :
 
@@ -35,6 +36,7 @@ Fooling automated tools/scanners :
   * [As a reverse proxy](#as-a-reverse-proxy)
   * [Behind a reverse proxy](#behind-a-reverse-proxy)
   * [Multisite](#multisite)
+  * [Automatic configuration](#automatic-configuration)
   * [Antibot challenge](#antibot-challenge)
 - [Tutorials and examples](#tutorials-and-examples)
 - [List of environment variables](#list-of-environment-variables)
@@ -95,7 +97,7 @@ docker run --network mynet \
            -e REMOTE_PHP_PATH=/app \
            bunkerity/bunkerized-nginx
 docker run --network mynet \
-           --name=myphp \
+           --name myphp \
            -v /path/to/web/files:/app \
            php:fpm
 ```
@@ -211,6 +213,45 @@ The */where/are/web/files* directory should have a structure like this :
     └── ...
 ```
 
+## Automatic configuration
+
+**This feature exposes, for now, a security risk because you need to mount the docker socket inside the container. You can test it but you should not use it in servers facing the internet.**  
+
+The downside of using environment variables is that you need to recreate a new container each time you want to add or remove aweb service. An alternative is to tell bunkerized-nginx to listen for Docker events by mounting the socket inside the container :  
+
+```shell
+docker network create mynet
+
+docker run -p 80:8080 \
+           -p 443:8443 \
+           --network mynet \
+           -v /where/to/save/certificates:/etc/letsencrypt \
+           -v /where/are/web/files:/www:ro \
+           -v /var/run/docker.sock:/var/run/docker.sock:ro \
+           -e SERVER_NAME= \
+           -e MULTISITE=yes \
+           -e AUTO_LETS_ENCRYPT=yes \
+           -e REDIRECT_HTTP_TO_HTTPS=yes \
+           bunkerity/bunkerized-nginx
+```
+
+Please note by setting `SERVER_NAME` to nothing bunkerized-nginx won't create any server block.
+
+You can now create a new container and use labels to dynamically configure bunkerized-nginx :
+
+```shell
+docker run --network mynet \
+           --name myapp \
+           -v /where/are/web/files/app.domain.com:/app \
+           -l bunkerized-nginx.SERVER_NAME=app.domain.com \
+           -l bunkerized-nginx.REMOTE_PHP=myapp \
+           -l bunkerized-nginx.REMOTE_PHP_PATH=/app \
+           bunkerity/bunkerized-nginx
+```
+
+Labels for automatic configuration are the same as environment variables but with the "bunkerized-nginx." prefix.
+
+
 ## Antibot challenge
 
 ```shell
@@ -268,11 +309,11 @@ Values : *yes* | *no*
 Default value : *yes*  
 Context : *global*, *multisite*  
 If set to yes, nginx will serve files from /www directory within the container.  
-A use case to not serving files is when you setup bunkerized-nginx as a reverse proxy via a custom configuration.
+A use case to not serving files is when you setup bunkerized-nginx as a reverse proxy.
 
 `DNS_RESOLVERS`  
 Values : *\<two IP addresses separated with a space\>*  
-Default value : *127.0.0.11 8.8.8.8*  
+Default value : *127.0.0.11*  
 Context : *global*  
 The IP addresses of the DNS resolvers to use when performing DNS lookups.
 
@@ -282,6 +323,12 @@ Default value : */www*
 Context : *global*  
 The default folder where nginx will search for web files. Don't change it unless you want to make your own image.
 
+`LOG_FORMAT`  
+Values : *\<any values accepted by the log_format directive\>*  
+Default value : *$remote_addr - $remote_user $host \[$time_local\] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"*  
+Context : *global*  
+The log format used by nginx to generate logs. More info [here](http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format).
+
 `HTTP_PORT`  
 Values : *\<any valid port greater than 1024\>*  
 Default value : *8080*  
@@ -371,6 +418,13 @@ Context : *global*, *multisite*
 Only valid when `USE_REVERSE_PROXY` is set to *yes*. Let's you define the proxy_pass destination to use when acting as a reverse proxy.  
 You can set multiple url/host by adding a suffix number to the variable name like this : `REVERSE_PROXY_HOST_1`, `REVERSE_PROXY_HOST_2`, `REVERSE_PROXY_HOST_3`, ...
 
+`REVERSE_PROXY_WS`  
+Values : *yes* | *no*  
+Default value : *no*  
+Context : *global*, *multisite*  
+Only valid when `USE_REVERSE_PROXY` is set to *yes*. Set it to *yes* when the corresponding `REVERSE_PROXY_HOST` is a WebSocket server.  
+You can set multiple url/host by adding a suffix number to the variable name like this : `REVERSE_PROXY_WS_1`, `REVERSE_PROXY_WS_2`, `REVERSE_PROXY_WS_3`, ...
+
 `PROXY_REAL_IP`  
 Values : *yes* | *no*  
 Default value : *no*  
@@ -539,7 +593,7 @@ The key used to uniquely identify a cached response when `USE_PROXY_CACHE` is se
 
 `PROXY_CACHE_VALID`  
 Values : \<*status=time list separated with space*\>  
-Default value : *200=10m 301=10m 301=1h any=1m*  
+Default value : *200=10m 301=10m 302=1h*  
 Context : *global*, *multisite*  
 Define the caching time depending on the HTTP status code (list of status=time separated with space) when `USE_PROXY_CACHE` is set to *yes*.
 
@@ -562,10 +616,16 @@ Conditions that must be met to bypass the cache when `USE_PROXY_CACHE` is set to
 `AUTO_LETS_ENCRYPT`  
 Values : *yes* | *no*  
 Default value : *no*  
-Context : *global*  
+Context : *global*, *multisite*  
 If set to yes, automatic certificate generation and renewal will be setup through Let's Encrypt. This will enable HTTPS on your website for free.  
 You will need to redirect the 80 port to 8080 port inside container and also set the `SERVER_NAME` environment variable.
 
+`EMAIL_LETS_ENCRYPT`  
+Values : *contact@yourdomain.com*  
+Default value : *contact@yourdomain.com*  
+Context : *global*, *multisite*  
+Define the contact email address declare in the certificate.
+
 ### HTTP
 
 `LISTEN_HTTP`  
@@ -745,7 +805,7 @@ Default value : *yes*
 Context : *global*, *multisite*  
 When set to *yes*, the *secure* will be automatically added to cookies when using HTTPS.
 
-`STRICT_TRANSPORT_POLICY`  
+`STRICT_TRANSPORT_SECURITY`  
 Values : *max-age=expireTime [; includeSubDomains] [; preload]*  
 Default value : *max-age=31536000*  
 Context : *global*, *multisite*  
@@ -810,7 +870,7 @@ Values : *yes* | *no*
 Default value : *yes*
 Context : *global*, *multisite*  
 If set to yes, block clients with "bad" user agent.  
-Blacklist can be found [here](https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-user-agents.list).
+Blacklist can be found [here](https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-user-agents.list) and [here](https://raw.githubusercontent.com/JayBizzle/Crawler-Detect/master/raw/Crawlers.txt).
 
 `BLOCK_TOR_EXIT_NODE`  
 Values : *yes* | *no*  
@@ -833,6 +893,13 @@ Context : *global*, *multisite*
 Is set to yes, will block known abusers.  
 Blacklist can be found [here](https://iplists.firehol.org/?ipset=firehol_abusers_30d).
 
+`BLOCK_REFERRER`  
+Values : *yes* | *no*  
+Default value : *yes*  
+Context : *global*, *multisite*  
+Is set to yes, will block known bad referrer header.  
+Blacklist can be found [here](https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-referrers.list).
+
 ### DNSBL
 
 `USE_DNSBL`  

VERSION

@@ -1 +1 @@
-1.2.0
+1.2.1

autoconf/autoconf.py

@@ -0,0 +1,101 @@
+#!/usr/bin/python3
+
+import docker, datetime, subprocess, shutil, os
+
+def log(event) :
+	print("[" + str(datetime.datetime.now().replace(microsecond=0)) + "] AUTOCONF - " + event, flush=True)
+
+def replace_in_file(file, old_str, new_str) :
+	with open(file) as f :
+		data = f.read()
+	data = data[::-1].replace(old_str[::-1], new_str[::-1], 1)[::-1]
+	with open(file, "w") as f :
+		f.write(data)
+
+def generate(vars) :
+	vars_defaults = vars.copy()
+	vars_defaults.update(os.environ)
+	vars_defaults.update(vars)
+	subprocess.run(["/opt/entrypoint/site-config.sh", vars["SERVER_NAME"]], env=vars_defaults)
+	log("Generated config for " + vars["SERVER_NAME"])
+
+def activate(vars) :
+	replace_in_file("/etc/nginx/nginx.conf", "}", "include /etc/nginx/" + vars["SERVER_NAME"] + "/server.conf;\n}")
+	subprocess.run(["/usr/sbin/nginx", "-s", "reload"])
+	log("Activated config for " + vars["SERVER_NAME"])
+
+def deactivate(vars) :
+	replace_in_file("/etc/nginx/nginx.conf", "include /etc/nginx/" + vars["SERVER_NAME"] + "/server.conf;\n", "")
+	subprocess.run(["/usr/sbin/nginx", "-s", "reload"])
+	log("Deactivated config for " + vars["SERVER_NAME"])
+
+def remove(vars) :
+	shutil.rmtree("/etc/nginx/" + vars["SERVER_NAME"])
+	log("Removed config for " + vars["SERVER_NAME"])
+
+def process(id, event, vars) :
+	global containers
+	if event == "create" :
+		generate(vars)
+		containers.append(id)
+	elif event == "start" :
+		activate(vars)
+	elif event == "die" :
+		deactivate(vars)
+	elif event == "destroy" :
+		remove(vars)
+		containers.remove(id)
+
+containers = []
+
+client = docker.DockerClient(base_url='unix:///var/run/docker.sock')
+
+# Process containers created before
+for container in client.containers.list(all=True, filters={"label" : "bunkerized-nginx.SERVER_NAME"}) :
+
+	# Extract bunkerized-nginx.* labels
+	labels = container.labels.copy()
+	for label in container.labels :
+		if not label.startswith("bunkerized-nginx.") :
+			del labels[label]
+	# Remove bunkerized-nginx. on labels
+	vars = { k.replace("bunkerized-nginx.", "", 1) : v for k, v in labels.items()}
+
+	# Container is restarting or running
+	if container.status == "restarting" or container.status == "running" :
+		process(container.id, "create", vars)
+		process(container.id, "start", vars)
+
+	# Container is created or exited
+	if container.status == "created" or container.status == "exited" :
+		process(container.id, "create", vars)
+
+for event in client.events(decode=True) :
+
+	# Process only container events
+	if event["Type"] != "container" :
+		continue
+
+	# Check if a bunkerized-nginx.* label is present
+	present = False
+	for label in event["Actor"]["Attributes"] :
+		if label.startswith("bunkerized-nginx.") :
+			present = True
+			break
+	if not present :
+		continue
+
+	# Only process if we generated a config
+	if not event["id"] in containers and event["Action"] != "create" :
+		continue
+
+	# Extract bunkerized-nginx.* labels
+	labels = event["Actor"]["Attributes"].copy()
+	for label in event["Actor"]["Attributes"] :
+		if not label.startswith("bunkerized-nginx.") :
+			del labels[label]
+	# Remove bunkerized-nginx. on labels
+	vars = { k.replace("bunkerized-nginx.", "", 1) : v for k, v in labels.items()}
+
+	# Process the event
+	process(event["id"], event["Action"], vars)

confs/global/map-referrer.conf

@@ -0,0 +1 @@
+map $http_referer $bad_referrer { hostnames; default no; }

confs/global/map-user-agent.conf

@@ -1,4 +1 @@
-map $http_user_agent $bad_user_agent {
+map $http_user_agent $bad_user_agent { default no; }
-	default no;
-	%BLOCK_USER_AGENT%
-}

confs/global/multisite-default-server-https.conf

@@ -0,0 +1,11 @@
+listen 0.0.0.0:%HTTPS_PORT% default_server ssl %HTTP2%;
+ssl_certificate /etc/nginx/default-cert.pem;
+ssl_certificate_key /etc/nginx/default-key.pem;
+ssl_protocols %HTTPS_PROTOCOLS%;
+ssl_prefer_server_ciphers off;
+ssl_session_tickets off;
+ssl_session_timeout 1d;
+ssl_session_cache shared:MozSSL:10m;
+%SSL_DHPARAM%
+%SSL_CIPHERS%
+%LETS_ENCRYPT_WEBROOT%

confs/global/multisite-default-server-lets-encrypt-webroot.conf

@@ -0,0 +1,3 @@
+location ~ ^/.well-known/acme-challenge/ {
+	root /acme-challenge;
+}

confs/global/multisite-default-server.conf

@@ -0,0 +1,6 @@
+server {
+	%LISTEN_HTTP%
+	server_name _;
+	%USE_HTTPS%
+	%MULTISITE_DISABLE_DEFAULT_SERVER%
+}

confs/global/multisite-disable-default-server.conf

@@ -0,0 +1,3 @@
+location / {
+	return 444;
+}

confs/global/nginx-temp.conf

@@ -0,0 +1,20 @@
+daemon on;
+pid /tmp/nginx.pid;
+
+events {
+        worker_connections 1024;
+        use epoll;
+}
+
+http {
+	server {
+		listen 0.0.0.0:%HTTP_PORT% default_server;
+		server_name _;
+		location ~ ^/.well-known/acme-challenge/ {
+			root /acme-challenge;
+		}
+		location / {
+			return 444;
+		}
+	}
+}

confs/global/nginx.conf

@@ -48,7 +48,8 @@ http {
 	default_type application/octet-stream;
 
 	# write logs to local syslog
-	access_log syslog:server=unix:/dev/log,nohostname,facility=local0,severity=notice combined;
+	log_format logf '%LOG_FORMAT%';
+	access_log syslog:server=unix:/dev/log,nohostname,facility=local0,severity=notice logf;
 	error_log syslog:server=unix:/dev/log,nohostname,facility=local0 warn;
 
 	# temp paths
@@ -90,12 +91,18 @@ http {
 	# list of blocked user agents
 	%BLOCK_USER_AGENT%
 
+	# list of blocked referrers
+	%BLOCK_REFERRER%
+
 	# zone for proxy_cache
 	%PROXY_CACHE_PATH%
 
 	# custom http confs
 	include /http-confs/*.conf;
 
+	# default server when MULTISITE=yes
+	%MULTISITE_DEFAULT_SERVER%
+
 	# server config(s)
 	%INCLUDE_SERVER%
 }

confs/site/block-user-agent.conf

@@ -1,3 +0,0 @@
-if ($bad_user_agent = yes) {
-	return 444;
-}

confs/site/https.conf

@@ -9,3 +9,4 @@ ssl_session_cache shared:MozSSL:10m;
 %STRICT_TRANSPORT_SECURITY%
 %SSL_DHPARAM%
 %SSL_CIPHERS%
+%LETS_ENCRYPT_WEBROOT%

confs/site/lets-encrypt-webroot.conf

@@ -0,0 +1,3 @@
+location ~ ^/.well-known/acme-challenge/ {
+	root /acme-challenge;
+}

confs/site/main-lua.conf

@@ -5,6 +5,8 @@ access_by_lua_block {
 
 local use_whitelist_ip		= %USE_WHITELIST_IP%
 local use_whitelist_reverse	= %USE_WHITELIST_REVERSE%
+local use_user_agent		= %USE_USER_AGENT%
+local use_referrer		= %USE_REFERRER%
 local use_country		= %USE_COUNTRY%
 local use_blacklist_ip		= %USE_BLACKLIST_IP%
 local use_blacklist_reverse	= %USE_BLACKLIST_REVERSE%
@@ -35,11 +37,6 @@ if use_whitelist_reverse and whitelist.reverse_cached_ok() then
 	ngx.exit(ngx.OK)
 end
 
--- check if country is allowed
-if use_country and ngx.var.allowed_country == "no" then
-	ngx.exit(ngx.HTTP_FORBIDDEN)
-end
-
 -- check if already in blacklist cache
 if use_blacklist_ip and blacklist.ip_cached_ko() then
 	ngx.exit(ngx.HTTP_FORBIDDEN)
@@ -81,6 +78,21 @@ if use_blacklist_reverse and not blacklist.reverse_cached() then
 	end
 end
 
+-- check if user-agent is allowed
+if use_user_agent and ngx.var.bad_user_agent == "yes" then
+	ngx.exit(ngx.HTTP_FORBIDDEN)
+end
+
+-- check if referrer is allowed
+if use_referrer and ngx.var.bad_referrer == "yes" then
+	ngx.exit(ngx.HTTP_FORBIDDEN)
+end
+
+-- check if country is allowed
+if use_country and ngx.var.allowed_country == "no" then
+	ngx.exit(ngx.HTTP_FORBIDDEN)
+end
+
 -- check if IP is in DNSBLs (only if not in cache)
 if use_dnsbl and not dnsbl.cached() then
 	if dnsbl.check() then

confs/site/reverse-proxy.conf

@@ -1,3 +1,4 @@
 location %REVERSE_PROXY_URL% {
 	proxy_pass %REVERSE_PROXY_HOST%;
+	%REVERSE_PROXY_WS%
 }

confs/site/server.conf

@@ -24,7 +24,6 @@ server {
 	%REFERRER_POLICY%
 	%FEATURE_POLICY%
 	%PERMISSIONS_POLICY%
-	%BLOCK_USER_AGENT%
 	%BLOCK_TOR_EXIT_NODE%
 	%BLOCK_PROXIES%
 	%BLOCK_ABUSERS%

entrypoint/defaults.sh

@@ -1,6 +1,7 @@
 #!/bin/bash
 
 MULTISITE="${MULTISITE-no}"
+LOG_FORMAT="${LOG_FORMAT-\$remote_addr - \$remote_user \$host [\$time_local] \"\$request\" \$status \$body_bytes_sent \"\$http_referer\" \"\$http_user_agent\"}"
 HTTP_PORT="${HTTP_PORT-8080}"
 HTTPS_PORT="${HTTPS_PORT-8443}"
 MAX_CLIENT_SIZE="${MAX_CLIENT_SIZE-10m}"
@@ -20,7 +21,7 @@ PROXY_CACHE_PATH_PARAMS="${PROXY_CACHE_PATH_PARAMS-max_size=100m}"
 PROXY_CACHE_METHODS="${PROXY_CACHE_METHODS-GET HEAD}"
 PROXY_CACHE_MIN_USES="${PROXY_CACHE_MIN_USES-2}"
 PROXY_CACHE_KEY="${PROXY_CACHE_KEY-\$scheme\$host\$request_uri}"
-PROXY_CACHE_VALID="${PROXY_CACHE_VALID-200=10m 301=10m 301=1h any=1m}"
+PROXY_CACHE_VALID="${PROXY_CACHE_VALID-200=10m 301=10m 302=1h}"
 PROXY_NO_CACHE="${PROXY_NO_CACHE-\$http_authorization}"
 PROXY_CACHE_BYPASS="${PROXY_CACHE_BYPASS-\$http_authorization}"
 USE_GZIP="${USE_GZIP-no}"
@@ -44,6 +45,7 @@ DISABLE_DEFAULT_SERVER="${DISABLE_DEFAULT_SERVER-no}"
 SERVER_NAME="${SERVER_NAME-www.bunkerity.com}"
 ALLOWED_METHODS="${ALLOWED_METHODS-GET|POST|HEAD}"
 BLOCK_USER_AGENT="${BLOCK_USER_AGENT-yes}"
+BLOCK_REFERRER="${BLOCK_REFERRER-yes}"
 BLOCK_TOR_EXIT_NODE="${BLOCK_TOR_EXIT_NODE-yes}"
 BLOCK_PROXIES="${BLOCK_PROXIES-yes}"
 BLOCK_ABUSERS="${BLOCK_ABUSERS-yes}"
@@ -77,9 +79,9 @@ USE_CUSTOM_HTTPS="${USE_CUSTOM_HTTPS-no}"
 ROOT_FOLDER="${ROOT_FOLDER-/www}"
 LOGROTATE_MINSIZE="${LOGROTATE_MINSIZE-10M}"
 LOGROTATE_MAXAGE="${LOGROTATE_MAXAGE-7}"
-DNS_RESOLVERS="${DNS_RESOLVERS-127.0.0.11 8.8.8.8}"
+DNS_RESOLVERS="${DNS_RESOLVERS-127.0.0.11}"
 USE_WHITELIST_IP="${USE_WHITELIST_IP-yes}"
-WHITELIST_IP_LIST="${WHITELIST_IP_LIST-23.21.227.69 40.88.21.235 50.16.241.113 50.16.241.114 50.16.241.117 50.16.247.234 52.204.97.54 52.5.190.19 54.197.234.188 54.208.100.253 54.208.102.37 107.21.1.8}"
+WHITELIST_IP_LIST="${WHITELIST_IP_LIST-127.0.0.1 23.21.227.69 40.88.21.235 50.16.241.113 50.16.241.114 50.16.241.117 50.16.247.234 52.204.97.54 52.5.190.19 54.197.234.188 54.208.100.253 54.208.102.37 107.21.1.8}"
 USE_WHITELIST_REVERSE="${USE_WHITELIST_REVERSE-yes}"
 WHITELIST_REVERSE_LIST="${WHITELIST_REVERSE_LIST-.googlebot.com .google.com .search.msn.com .crawl.yahoot.net .crawl.baidu.jp .crawl.baidu.com .yandex.com .yandex.ru .yandex.net}"
 USE_BLACKLIST_IP="${USE_BLACKLIST_IP-yes}"

entrypoint/entrypoint.sh

@@ -64,13 +64,20 @@ rsyslogd
 crond
 
 # start nginx
+if [ -f "/tmp/nginx.pid" ] ; then
+	nginx -s quit
+fi
 echo "[*] Running nginx ..."
 su -s "/usr/sbin/nginx" nginx
 
+# list of log files to display
+LOGS="/var/log/access.log /var/log/error.log"
+
 # start fail2ban
 if [ "$USE_FAIL2BAN" = "yes" ] ; then
 	echo "[*] Running fail2ban ..."
 	fail2ban-server > /dev/null
+	LOGS="$LOGS /var/log/fail2ban.log"
 fi
 
 # start crowdsec
@@ -90,11 +97,15 @@ if [ "$1" == "test" ] ; then
 	exit 1
 fi
 
-# display logs
+# start the autoconf manager
-LOGS="/var/log/access.log /var/log/error.log"
+if [ -S "/var/run/docker.sock" ] ; then
-if [ "$USE_FAIL2BAN" = "yes" ] ; then
+	echo "[*] Running autoconf ..."
-	LOGS="$LOGS /var/log/fail2ban.log"
+	touch /var/log/autoconf.log
+	/opt/autoconf/autoconf.py > /var/log/autoconf.log 2>&1 &
+	LOGS="$LOGS /var/log/autoconf.log"
 fi
+
+# display logs
 tail -F $LOGS &
 wait $!
 

entrypoint/global-config.sh

@@ -20,6 +20,12 @@ if [ "$ADDITIONAL_MODULES" != "" ] ; then
 	apk add $ADDITIONAL_MODULES
 fi
 
+# start nginx with temp conf for let's encrypt challenges
+if [ "$(has_value AUTO_LETS_ENCRYPT yes)" != "" ] ; then
+	replace_in_file "/etc/nginx/nginx-temp.conf" "%HTTP_PORT%" "$HTTP_PORT"
+	nginx -c /etc/nginx/nginx-temp.conf
+fi
+
 # include server block(s)
 if [ "$MULTISITE" = "yes" ] ; then
 	includes=""
@@ -31,6 +37,51 @@ else
 	replace_in_file "/etc/nginx/nginx.conf" "%INCLUDE_SERVER%" "include /etc/nginx/server.conf;"
 fi
 
+# setup default server block if multisite
+if [ "$MULTISITE" = "yes" ] ; then
+	replace_in_file "/etc/nginx/nginx.conf" "%MULTISITE_DEFAULT_SERVER%" "include /etc/nginx/multisite-default-server.conf;"
+	if [ "$(has_value LISTEN_HTTP yes)" != "" ] ; then
+		replace_in_file "/etc/nginx/multisite-default-server.conf" "%LISTEN_HTTP%" "listen 0.0.0.0:${HTTP_PORT} default_server;"
+	else
+		replace_in_file "/etc/nginx/multisite-default-server.conf" "%LISTEN_HTTP%" ""
+	fi
+	if [ "$(has_value AUTO_LETS_ENCRYPT yes)" != "" ] || [ "$(has_value USE_CUSTOM_HTTPS yes)" != "" ] || [ "$(has_value GENERATE_SELF_SIGNED_SSL yes)" != "" ] ; then
+		replace_in_file "/etc/nginx/multisite-default-server.conf" "%USE_HTTPS%" "include /etc/nginx/multisite-default-server-https.conf;"
+		replace_in_file "/etc/nginx/multisite-default-server-https.conf" "%HTTPS_PORT%" "$HTTPS_PORT"
+		if [ "$(has_value HTTP2 yes)" != "" ] ; then
+			replace_in_file "/etc/nginx/multisite-default-server-https.conf" "%HTTP2%" "http2"
+		else
+			replace_in_file "/etc/nginx/multisite-default-server-https.conf" "%HTTP2%" ""
+		fi
+		replace_in_file "/etc/nginx/multisite-default-server-https.conf" "%HTTPS_PROTOCOLS%" "$HTTPS_PROTOCOLS"
+		if [ "$(echo $HTTPS_PROTOCOLS | grep TLSv1.2)" != "" ] ; then
+			replace_in_file "/etc/nginx/multisite-default-server-https.conf" "%SSL_DHPARAM%" "ssl_dhparam /etc/nginx/dhparam;"
+			replace_in_file "/etc/nginx/multisite-default-server-https.conf" "%SSL_CIPHERS%" "ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;"
+		else
+			replace_in_file "/etc/nginx/multisite-default-server-https.conf" "%SSL_DHPARAM%" ""
+			replace_in_file "/etc/nginx/multisite-default-server-https.conf" "%SSL_CIPHERS%" ""
+		fi
+		openssl req -nodes -x509 -newkey rsa:4096 -keyout /etc/nginx/default-key.pem -out /etc/nginx/default-cert.pem -days $SELF_SIGNED_SSL_EXPIRY -subj "/C=$SELF_SIGNED_SSL_COUNTRY/ST=$SELF_SIGNED_SSL_STATE/L=$SELF_SIGNED_SSL_CITY/O=$SELF_SIGNED_SSL_ORG/OU=$SELF_SIGNED_SSL_OU/CN=$SELF_SIGNED_SSL_CN"
+		if [ "$(has_value AUTO_LETS_ENCRYPT yes)" != "" ] ; then
+			replace_in_file "/etc/nginx/multisite-default-server-https.conf" "%LETS_ENCRYPT_WEBROOT%" "include /etc/nginx/multisite-default-server-lets-encrypt-webroot.conf;"
+		else
+			replace_in_file "/etc/nginx/multisite-default-server-https.conf" "%LETS_ENCRYPT_WEBROOT%" ""
+		fi
+	else
+		replace_in_file "/etc/nginx/multisite-default-server.conf" "%USE_HTTPS%" ""
+	fi
+	if [ "$DISABLE_DEFAULT_SERVER" = "yes" ] ; then
+		replace_in_file "/etc/nginx/multisite-default-server.conf" "%MULTISITE_DISABLE_DEFAULT_SERVER%" "include /etc/nginx/multisite-disable-default-server.conf;"
+	else
+		replace_in_file "/etc/nginx/multisite-default-server.conf" "%MULTISITE_DISABLE_DEFAULT_SERVER%" ""
+	fi
+else
+	replace_in_file "/etc/nginx/nginx.conf" "%MULTISITE_DEFAULT_SERVER%" ""
+fi
+
+# custom log format
+replace_in_file "/etc/nginx/nginx.conf" "%LOG_FORMAT%" "$LOG_FORMAT"
+
 # proxy_cache zone
 if [ "$(has_value USE_PROXY_CACHE yes)" != "" ] ; then
 	replace_in_file "/etc/nginx/nginx.conf" "%PROXY_CACHE_PATH%" "proxy_cache_path /tmp/proxy_cache keys_zone=proxycache:${PROXY_CACHE_PATH_ZONE_SIZE} ${PROXY_CACHE_PATH_PARAMS};"
@@ -40,12 +91,14 @@ fi
 
 # let's encrypt setup
 if [ "$AUTO_LETS_ENCRYPT" = "yes" ] ; then
-	FIRST_SERVER_NAME=$(echo "$SERVER_NAME" | cut -d " " -f 1)
+	if [ "$MULTISITE" = "no" ] ; then
-	DOMAINS_LETS_ENCRYPT=$(echo "$SERVER_NAME" | sed "s/ /,/g")
+		FIRST_SERVER_NAME=$(echo "$SERVER_NAME" | cut -d " " -f 1)
-	EMAIL_LETS_ENCRYPT="${EMAIL_LETS_ENCRYPT-contact@$FIRST_SERVER_NAME}"
+		DOMAINS_LETS_ENCRYPT=$(echo "$SERVER_NAME" | sed "s/ /,/g")
-	if [ ! -f /etc/letsencrypt/live/${FIRST_SERVER_NAME}/fullchain.pem ] ; then
+		EMAIL_LETS_ENCRYPT="${EMAIL_LETS_ENCRYPT-contact@$FIRST_SERVER_NAME}"
-		echo "[*] Performing Let's Encrypt challenge ..."
+		if [ ! -f /etc/letsencrypt/live/${FIRST_SERVER_NAME}/fullchain.pem ] ; then
-		certbot certonly --standalone -n --preferred-challenges http -d "$DOMAINS_LETS_ENCRYPT" --email "$EMAIL_LETS_ENCRYPT" --agree-tos --http-01-port $HTTP_PORT
+			echo "[*] Performing Let's Encrypt challenge for $SERVER_NAME ..."
+			/opt/scripts/certbot-new.sh "$DOMAINS_LETS_ENCRYPT" "$EMAIL_LETS_ENCRYPT"
+		fi
 	fi
 	echo "0 0 * * * /opt/scripts/certbot-renew.sh > /dev/null 2>&1" >> /etc/crontabs/root
 fi
@@ -93,6 +146,21 @@ else
 	replace_in_file "/etc/nginx/nginx.conf" "%BLOCK_USER_AGENT%" ""
 fi
 
+# block bad refferer
+if [ "$(has_value BLOCK_REFERRER yes)" != "" ] ; then
+	replace_in_file "/etc/nginx/nginx.conf" "%BLOCK_REFERRER%" "include /etc/nginx/map-referrer.conf;"
+	echo "0 0 * * * /opt/scripts/referrers.sh" >> /etc/crontabs/root
+	if [ -f "/cache/map-referrer.conf" ] ; then
+		echo "[*] Copying cached map-referrer.conf ..."
+		cp /cache/map-referrer.conf /etc/nginx/map-referrer.conf
+	else
+		echo "[*] Downloading bad referrer list (in background) ..."
+		/opt/scripts/referrers.sh &
+	fi
+else
+	replace_in_file "/etc/nginx/nginx.conf" "%BLOCK_REFERRER%" ""
+fi
+
 # block TOR exit nodes
 if [ "$(has_value BLOCK_TOR_EXIT_NODE yes)" != "" ] ; then
 	echo "0 * * * * /opt/scripts/exit-nodes.sh" >> /etc/crontabs/root
@@ -186,8 +254,16 @@ fi
 list=$(spaces_to_lua "$DNSBL_LIST")
 replace_in_file "/usr/local/lib/lua/dnsbl.lua" "%DNSBL_LIST%" "$list"
 
+# disable default site
+if [ "$DISABLE_DEFAULT_SERVER" = "yes" ] && [ "$MULTISITE" = "yes" ] ; then
+	replace_in_file "/etc/nginx/multisite-default-server.conf" "%MULTISITE_DISABLE_DEFAULT_SERVER%" "include /etc/nginx/multisite-disable-default-server.conf;"
+else
+	replace_in_file "/etc/nginx/multisite-default-server.conf" "%MULTISITE_DISABLE_DEFAULT_SERVER%" ""
+fi
+
 # fail2ban setup
 if [ "$(has_value USE_FAIL2BAN yes)" != "" ] ; then
+	echo "" > /etc/nginx/fail2ban-ip.conf
 	rm -rf /etc/fail2ban/jail.d/*.conf
 	cp /opt/fail2ban/nginx-action.local /etc/fail2ban/action.d/nginx-action.local
 	cp /opt/fail2ban/nginx-filter.local /etc/fail2ban/filter.d/nginx-filter.local

entrypoint/site-config.sh

@@ -53,9 +53,16 @@ if [ "$USE_REVERSE_PROXY" = "yes" ] ; then
 			value=$(echo "$var" | sed "s/${name}=//")
 			host=$(echo "$name" | sed "s/URL/HOST/")
 			host_value=$(env | grep "^${host}=" | sed "s/${host}=//")
+			ws=$(echo "$name" | sed "s/URL/WS/")
+			ws_value=$(env | grep "^${ws}=" | sed "s/${ws}=//")
 			cp "${NGINX_PREFIX}reverse-proxy.conf" "${NGINX_PREFIX}reverse-proxy-${i}.conf"
 			replace_in_file "${NGINX_PREFIX}reverse-proxy-${i}.conf" "%REVERSE_PROXY_URL%" "$value"
 			replace_in_file "${NGINX_PREFIX}reverse-proxy-${i}.conf" "%REVERSE_PROXY_HOST%" "$host_value"
+			if [ "$ws_value" = "yes" ] ; then
+				replace_in_file "${NGINX_PREFIX}reverse-proxy-${i}.conf" "%REVERSE_PROXY_WS%" "proxy_http_version 1.1;\nproxy_set_header Upgrade \$http_upgrade;\nproxy_set_header Connection \"Upgrade\";\n"
+			else
+				replace_in_file "${NGINX_PREFIX}reverse-proxy-${i}.conf" "%REVERSE_PROXY_WS%" ""
+			fi
 			i=$(($i + 1))
 		fi
 	done
@@ -131,7 +138,7 @@ if [ "$REMOTE_PHP" != "" ] ; then
 	replace_in_file "${NGINX_PREFIX}server.conf" "%FASTCGI_PATH%" "include ${NGINX_PREFIX}fastcgi.conf;"
 	replace_in_file "${NGINX_PREFIX}php.conf" "%REMOTE_PHP%" "$REMOTE_PHP"
 	if [ "$MULTISITE" = "yes" ] ; then
-		cp /etc/nginx/fastcgi.conf ${NGINX_PREFIX}fastcgi.conf
+		cp /etc/nginx/fastcgi.conf ${NGINX_PREFIX}fastcgi.conf && chown root:nginx ${NGINX_PREFIX}fastcgi.conf
 	fi
 	replace_in_file "${NGINX_PREFIX}fastcgi.conf" "\$document_root" "${REMOTE_PHP_PATH}/"
 else
@@ -228,14 +235,10 @@ else
 fi
 
 # disable default server
-if [ "$DISABLE_DEFAULT_SERVER" = "yes" ] ; then
+if [ "$DISABLE_DEFAULT_SERVER" = "yes" ] && [ "$MULTISITE" != "yes" ] ; then
 	replace_in_file "${NGINX_PREFIX}server.conf" "%DISABLE_DEFAULT_SERVER%" "include ${NGINX_PREFIX}disable-default-server.conf;"
-	if [ "$MULTISITE" == "yes" ] ; then
+	SERVER_NAME_PIPE=$(echo $SERVER_NAME | sed "s/ /|/g")
-		replace_in_file "${NGINX_PREFIX}disable-default-server.conf" "%SERVER_NAME%" "$1"
+	replace_in_file "${NGINX_PREFIX}disable-default-server.conf" "%SERVER_NAME%" "$SERVER_NAME_PIPE"
-	else
-		SERVER_NAME_PIPE=$(echo $SERVER_NAME | sed "s/ /|/g")
-		replace_in_file "${NGINX_PREFIX}disable-default-server.conf" "%SERVER_NAME%" "$SERVER_NAME_PIPE"
-	fi
 else
 	replace_in_file "${NGINX_PREFIX}server.conf" "%DISABLE_DEFAULT_SERVER%" ""
 fi
@@ -259,9 +262,16 @@ fi
 
 # block bad UA
 if [ "$BLOCK_USER_AGENT" = "yes" ] ; then
-	replace_in_file "${NGINX_PREFIX}server.conf" "%BLOCK_USER_AGENT%" "include ${NGINX_PREFIX}block-user-agent.conf;"
+	replace_in_file "${NGINX_PREFIX}main-lua.conf" "%USE_USER_AGENT%" "true"
 else
-	replace_in_file "${NGINX_PREFIX}server.conf" "%BLOCK_USER_AGENT%" ""
+	replace_in_file "${NGINX_PREFIX}main-lua.conf" "%USE_USER_AGENT%" "false"
+fi
+
+# block bad referrer
+if [ "$BLOCK_REFERRER" = "yes" ] ; then
+	replace_in_file "${NGINX_PREFIX}main-lua.conf" "%USE_REFERRER%" "true"
+else
+	replace_in_file "${NGINX_PREFIX}main-lua.conf" "%USE_REFERRER%" "false"
 fi
 
 # block TOR exit nodes
@@ -308,15 +318,27 @@ if [ "$AUTO_LETS_ENCRYPT" = "yes" ] || [ "$USE_CUSTOM_HTTPS" = "yes" ] || [ "$GE
 		replace_in_file "${NGINX_PREFIX}https.conf" "%STRICT_TRANSPORT_SECURITY%" ""
 	fi
 	if [ "$AUTO_LETS_ENCRYPT" = "yes" ] ; then
-		FIRST_SERVER_NAME=$(echo "$SERVER_NAME" | cut -d " " -f 1)
+		if [ "$MULTISITE" = "no" ] ; then
+			FIRST_SERVER_NAME=$(echo "$SERVER_NAME" | cut -d " " -f 1)
+		else
+			FIRST_SERVER_NAME="$1"
+			if [ ! -f /etc/letsencrypt/live/${1}/fullchain.pem ] ; then
+				echo "[*] Performing Let's Encrypt challenge for $1 ..."
+				EMAIL_LETS_ENCRYPT="${EMAIL_LETS_ENCRYPT-contact@$1}"
+				/opt/scripts/certbot-new.sh "$1" "$EMAIL_LETS_ENCRYPT"
+			fi
+		fi
 		replace_in_file "${NGINX_PREFIX}https.conf" "%HTTPS_CERT%" "/etc/letsencrypt/live/${FIRST_SERVER_NAME}/fullchain.pem"
 		replace_in_file "${NGINX_PREFIX}https.conf" "%HTTPS_KEY%" "/etc/letsencrypt/live/${FIRST_SERVER_NAME}/privkey.pem"
+		replace_in_file "${NGINX_PREFIX}https.conf" "%LETS_ENCRYPT_WEBROOT%" "include ${NGINX_PREFIX}lets-encrypt-webroot.conf;"
 	elif [ "$USE_CUSTOM_HTTPS" = "yes" ] ; then
 		replace_in_file "${NGINX_PREFIX}https.conf" "%HTTPS_CERT%" "$CUSTOM_HTTPS_CERT"
 		replace_in_file "${NGINX_PREFIX}https.conf" "%HTTPS_KEY%" "$CUSTOM_HTTPS_KEY"
+		replace_in_file "${NGINX_PREFIX}https.conf" "%LETS_ENCRYPT_WEBROOT%" ""
 	elif [ "$GENERATE_SELF_SIGNED_SSL" = "yes" ] ; then
 		replace_in_file "${NGINX_PREFIX}https.conf" "%HTTPS_CERT%" "/etc/nginx/self-signed-ssl/cert.pem"
 		replace_in_file "${NGINX_PREFIX}https.conf" "%HTTPS_KEY%" "/etc/nginx/self-signed-ssl/key.pem"
+		replace_in_file "${NGINX_PREFIX}https.conf" "%LETS_ENCRYPT_WEBROOT%" ""
 	fi
 else
 	replace_in_file "${NGINX_PREFIX}server.conf" "%USE_HTTPS%" ""
@@ -517,8 +539,7 @@ fi
 
 # fail2ban
 if [ "$USE_FAIL2BAN" = "yes" ] ; then
-	echo "" > ${NGINX_PREFIX}fail2ban-ip.conf
+	replace_in_file "${NGINX_PREFIX}server.conf" "%USE_FAIL2BAN%" "include /etc/nginx/fail2ban-ip.conf;"
-	replace_in_file "${NGINX_PREFIX}server.conf" "%USE_FAIL2BAN%" "include ${NGINX_PREFIX}fail2ban-ip.conf;"
 else
 	replace_in_file "${NGINX_PREFIX}server.conf" "%USE_FAIL2BAN%" ""
 fi

examples/autoconf-php/docker-compose.yml

@@ -0,0 +1,53 @@
+version: '3'
+
+services:
+
+  mywww:
+    image: bunkerity/bunkerized-nginx
+    restart: always
+    ports:
+      - 80:8080
+      - 443:8443
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./letsencrypt:/etc/letsencrypt
+      - ./web-files:/www:ro
+    environment:
+      - SERVER_NAME=                                   # must be left blank if you don't want to setup "static" conf
+      - MULTISITE=yes
+      - AUTO_LETS_ENCRYPT=yes
+      - REDIRECT_HTTP_TO_HTTPS=yes
+      - DISABLE_DEFAULT_SERVER=yes
+      - USE_CLIENT_CACHE=yes
+      - USE_GZIP=yes
+      - USE_BROTLI=yes
+
+  myapp1:
+    image: php:fpm
+    restart: always
+    volumes:
+      - ./web-files/app1.website.com:/app
+    labels:
+      - "bunkerized-nginx.SERVER_NAME=app1.website.com" # replace with your domain
+      - "bunkerized-nginx.REMOTE_PHP=myapp1"
+      - "bunkerized-nginx.REMOTE_PHP_PATH=/app"
+
+  myapp2:
+    image: php:fpm
+    restart: always
+    volumes:
+      - ./web-files/app2.website.com:/app
+    labels:
+      - "bunkerized-nginx.SERVER_NAME=app2.website.com" # replace with your domain
+      - "bunkerized-nginx.REMOTE_PHP=myapp2"
+      - "bunkerized-nginx.REMOTE_PHP_PATH=/app"
+
+  myapp3:
+    image: php:fpm
+    restart: always
+    volumes:
+      - ./web-files/app3.website.com:/app
+    labels:
+      - "bunkerized-nginx.SERVER_NAME=app3.website.com" # replace with your domain
+      - "bunkerized-nginx.REMOTE_PHP=myapp3"
+      - "bunkerized-nginx.REMOTE_PHP_PATH=/app"

examples/autoconf-php/web-files/app1.website.com/index.php

@@ -0,0 +1,5 @@
+<?php
+
+echo "Hello from app1 !";
+
+?>

examples/autoconf-php/web-files/app2.website.com/index.php

@@ -0,0 +1,5 @@
+<?php
+
+echo "Hello from app2 !";
+
+?>

examples/autoconf-php/web-files/app3.website.com/index.php

@@ -0,0 +1,5 @@
+<?php
+
+echo "Hello from app3 !";
+
+?>

examples/autoconf-reverse-proxy/docker-compose.yml

@@ -0,0 +1,53 @@
+version: '3'
+
+services:
+
+  mywww:
+    image: bunkerity/bunkerized-nginx
+    restart: always
+    ports:
+      - 80:8080
+      - 443:8443
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./letsencrypt:/etc/letsencrypt
+    environment:
+      - SERVER_NAME=                                              # must be left blank if you don't want to setup "static" conf
+      - MULTISITE=yes
+      - AUTO_LETS_ENCRYPT=yes
+      - REDIRECT_HTTP_TO_HTTPS=yes
+      - DISABLE_DEFAULT_SERVER=yes
+      - USE_CLIENT_CACHE=yes
+      - USE_GZIP=yes
+      - USE_BROTLI=yes
+      - USE_REVERSE_PROXY=yes
+
+  myapp1:
+    build: js-app
+    restart: always
+    environment:
+      - NODE_ENV=production
+    labels:
+      - "bunkerized-nginx.SERVER_NAME=app1.website.com"            # replace with your domain
+      - "bunkerized-nginx.REVERSE_PROXY_URL=/"
+      - "bunkerized-nginx.REVERSE_PROXY_HOST=http://myapp1:3000"
+
+  myapp2:
+    build: js-app
+    restart: always
+    environment:
+      - NODE_ENV=production
+    labels:
+      - "bunkerized-nginx.SERVER_NAME=app2.website.com"            # replace with your domain
+      - "bunkerized-nginx.REVERSE_PROXY_URL=/"
+      - "bunkerized-nginx.REVERSE_PROXY_HOST=http://myapp2:3000"
+
+  myapp3:
+    build: js-app
+    restart: always
+    environment:
+      - NODE_ENV=production
+    labels:
+      - "bunkerized-nginx.SERVER_NAME=app3.website.com"            # replace with your domain
+      - "bunkerized-nginx.REVERSE_PROXY_URL=/"
+      - "bunkerized-nginx.REVERSE_PROXY_HOST=http://myapp3:3000"

examples/autoconf-reverse-proxy/js-app/Dockerfile

@@ -0,0 +1,11 @@
+FROM node
+
+COPY app/ /home/node/app
+
+RUN cd /home/node/app && npm install && chown -R root:node /home/node/app && chmod -R 770 /home/node/app
+
+WORKDIR /home/node/app
+
+USER node
+
+CMD ["node", "index.js"]

examples/autoconf-reverse-proxy/js-app/app/index.js

@@ -0,0 +1,13 @@
+const express = require('express')
+const app = express()
+const port = 3000
+var os = require("os");
+
+app.get('/', (req, res) => {
+  res.send('Container id = ' + os.hostname())
+})
+
+app.listen(port, () => {
+  console.log(`Example app listening at http://localhost:${port}`)
+})
+

examples/autoconf-reverse-proxy/js-app/app/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "js-app",
+  "version": "1.0.0",
+  "description": "demo",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "express": "^4.17.1"
+  }
+}

examples/moodle/docker-compose.yml

@@ -33,7 +33,7 @@ services:
     environment:
       - MOODLE_USERNAME=admin                # replace with your moodle admin username
       - MOODLE_PASSWORD=password             # replace with your moodle admin password
-      - MOODLE_EMAIL=moodle@website.com      # replace with your moodle admin email
+      - MOODLE_EMAIL=moodle@website.com       # replace with your moodle admin email
       - MOODLE_SITE_NAME=My Moodle           # replace with your moodle site name
       - MOODLE_DATABASE_HOST=mydb
       - MOODLE_DATABASE_NAME=moodle

examples/multisite-basic/server-confs/app3.website.com/reverse-proxy.conf

@@ -1,6 +0,0 @@
-proxy_set_header Host $host;
-proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-location / {
-	proxy_pass http://myapp3:3000;
-}

examples/prestashop/docker-compose.yml

@@ -0,0 +1,53 @@
+version: '3'
+
+services:
+
+  mywww:
+    image: bunkerity/bunkerized-nginx
+    restart: always
+    ports:
+      - 80:8080
+      - 443:8443
+    volumes:
+      - ./prestashop-files:/www:ro
+      - ./letsencrypt:/etc/letsencrypt
+      - ./server-confs:/server-confs:ro         # custom confs at server context for prestashop
+    environment:
+      - SERVER_NAME=www.website.com             # replace with your domain
+      - AUTO_LETS_ENCRYPT=yes
+      - REDIRECT_HTTP_TO_HTTPS=yes
+      - DISABLE_DEFAULT_SERVER=yes
+      - MAX_CLIENT_SIZE=50m
+      - USE_CLIENT_CACHE=yes
+      - USE_GZIP=yes
+      - USE_BROTLI=yes
+      - REMOTE_PHP=myprestashop
+      - REMOTE_PHP_PATH=/var/www/html
+
+  myprestashop:
+    image: prestashop/prestashop:1.7-fpm
+    restart: always
+    volumes:
+      - ./prestashop-files:/var/www/html
+    environment:
+      - DB_SERVER=mydb
+      - DB_NAME=prestashop
+      - DB_USER=user
+      - DB_PASSWD=db-user-pwd                    # replace with a stronger password (must match MYSQL_PASSWORD)
+      - PS_INSTALL_AUTO=1
+      - PS_DOMAIN=www.website.com                # replace with your domain
+      - PS_FOLDER_ADMIN=myadmin                  # replace with your admin folder
+      - PS_ENABLE_SSL=1
+      - ADMIN_MAIL=admin@website.com             # replace with your mail
+      - ADMIN_PASSWD=admin                       # replace with a stronger password
+
+  mydb:
+    image: mariadb
+    restart: always
+    volumes:
+      - ./db-data:/var/lib/mysql
+    environment:
+      - MYSQL_ROOT_PASSWORD=db-root-pwd         # replace with a stronger password
+      - MYSQL_DATABASE=prestashop
+      - MYSQL_USER=user
+      - MYSQL_PASSWORD=db-user-pwd              # replace with a stronger password (must match DB_PASSWD)

examples/prestashop/server-confs/prestashop.conf

@@ -0,0 +1,84 @@
+# remove ports in redirects
+port_in_redirect off;
+
+# Redirect 404 errors to prestashop
+error_page 404 /index.php?controller=404;
+
+# Force pdf files to be downloaded
+location ~* \.pdf$ {
+	add_header Content-Disposition Attachment;
+}
+
+# Force files inupload directory to be downloaded
+location ~ ^/upload/ {
+	add_header Content-Disposition Attachment;
+}
+
+# Images
+rewrite ^/([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+.jpg$ /img/p/$1/$1$2$3.jpg last;
+rewrite ^/([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+.jpg$ /img/p/$1/$2/$1$2$3$4.jpg last;
+rewrite ^/([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+.jpg$ /img/p/$1/$2/$3/$1$2$3$4$5.jpg last;
+rewrite ^/([0-9])([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+.jpg$ /img/p/$1/$2/$3/$4/$1$2$3$4$5$6.jpg last;
+rewrite ^/([0-9])([0-9])([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+.jpg$ /img/p/$1/$2/$3/$4/$5/$1$2$3$4$5$6$7.jpg last;
+rewrite ^/([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+.jpg$ /img/p/$1/$2/$3/$4/$5/$6/$1$2$3$4$5$6$7$8.jpg last;
+rewrite ^/([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+.jpg$ /img/p/$1/$2/$3/$4/$5/$6/$7/$1$2$3$4$5$6$7$8$9.jpg last;
+rewrite ^/([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])(-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+.jpg$ /img/p/$1/$2/$3/$4/$5/$6/$7/$8/$1$2$3$4$5$6$7$8$9$10.jpg last;
+rewrite ^/c/([0-9]+)(-[.*_a-zA-Z0-9-]*)(-[0-9]+)?/.+.jpg$ /img/c/$1$2$3.jpg last;
+rewrite ^/c/([a-zA-Z_-]+)(-[0-9]+)?/.+.jpg$ /img/c/$1$2.jpg last;
+
+# AlphaImageLoader for IE and fancybox
+rewrite ^images_ie/?([^/]+)\.(jpe?g|png|gif)$ js/jquery/plugins/fancybox/images/$1.$2 last;
+
+# Web service API
+rewrite ^/api/?(.*)$ /webservice/dispatcher.php?url=$1 last;
+
+# Installation sandbox
+rewrite ^(/install(?:-dev)?/sandbox)/(.*) /$1/test.php last;
+
+# [REQUIRED EDIT] Change this block to your admin folder
+location /myadmin/ {
+	if (!-e $request_filename) {
+		rewrite ^/.*$ /myadmin/index.php last;
+	}
+}
+
+# File security
+# .htaccess .DS_Store .htpasswd etc
+location ~ /\. {
+	deny all;
+}
+# Source code directories
+location ~ ^/(app|bin|cache|classes|config|controllers|docs|localization|override|src|tests|tools|translations|travis-scripts|vendor|var)/ {
+	deny all;
+}
+# vendor in modules directory
+location ~ ^/modules/.*/vendor/ {
+	deny all;
+}
+# Prevent exposing other sensitive files
+location ~ \.(yml|log|tpl|twig|sass)$ {
+	deny all;
+}
+
+# Prevent injection of php files
+location /upload {
+	location ~ \.php$ {
+		deny all;
+	}
+}
+location /img {
+	location ~ \.php$ {
+		deny all;
+	}
+}
+
+# [REQUIRED EDIT] PHP FPM part
+location ~ \.php$ {
+	try_files $fastcgi_script_name /index.php$uri&$args =404;
+	fastcgi_split_path_info ^(.+\.php)(/.+)$;
+	include fastcgi_params;
+	fastcgi_param PATH_INFO	   $fastcgi_path_info;
+	fastcgi_param PATH_TRANSLATED /var/www/html/$fastcgi_path_info;
+	fastcgi_param SCRIPT_FILENAME /var/www/html/$fastcgi_script_name;
+	fastcgi_pass myprestashop:9000;
+}

examples/reverse-proxy-websocket/docker-compose.yml

@@ -0,0 +1,29 @@
+version: '3'
+
+services:
+
+  myreverse:
+    image: bunkerity/bunkerized-nginx:dev
+    restart: always
+    ports:
+      - 80:8080
+      - 443:8443
+    volumes:
+      - ./letsencrypt:/etc/letsencrypt
+    environment:
+      - SERVER_NAME=www.website.com                          # replace with your domain
+      - SERVE_FILES=no
+      - DISABLE_DEFAULT_SERVER=yes
+      - REDIRECT_HTTP_TO_HTTPS=yes
+      - AUTO_LETS_ENCRYPT=yes
+      - USE_PROXY_CACHE=yes
+      - USE_GZIP=yes
+      - USE_BROTLI=yes
+      - USE_REVERSE_PROXY=yes
+      - REVERSE_PROXY_URL=/ws/
+      - REVERSE_PROXY_HOST=http://myws:8010/
+      - REVERSE_PROXY_WS=yes
+
+  myws:
+    image: ksdn117/web-socket-test
+    restart: always

examples/tomcat/server-confs/reverse-proxy.conf

@@ -1,6 +0,0 @@
-proxy_set_header Host $host;
-proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-location / {
-	proxy_pass http://mytomcat:8080/sample;
-}

lua/dns.lua

@@ -10,7 +10,7 @@ function M.get_reverse()
 	end
 	local rdns = ""
 	local answers, err = r:reverse_query(ip)
-	if not answers.errcode then
+	if answers ~= nil and not answers.errcode then
 		for ak, av in ipairs(answers) do
 			if av.ptrdname then
 				rdns = av.ptrdname
@@ -28,9 +28,11 @@ function M.get_ips(fqdn)
 	end
 	local ips = {}
 	local answers, err, tries = r:query(fqdn, nil, {})
-	for ak, av in ipairs(answers) do
+	if answers ~= nil then
-		if av.address then
+		for ak, av in ipairs(answers) do
-			table.insert(ips, av.address)
+			if av.address then
+				table.insert(ips, av.address)
+			end
 		end
 	end
 	return ips

scripts/abusers.sh

@@ -10,5 +10,5 @@ while read entry ; do
 done
 cp /etc/nginx/block-abusers.conf /cache
 if [ -f /tmp/nginx.pid ] ; then
-	/usr/sbin/nginx -s reload
+	/usr/sbin/nginx -s reload > /dev/null 2>&1
 fi

scripts/certbot-new.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+# generate certificate
+certbot certonly --webroot -w /acme-challenge -n -d "$1" --email "$2" --agree-tos
+
+# fix rights
+chown -R root:nginx /etc/letsencrypt
+chmod -R 740 /etc/letsencrypt
+find /etc/letsencrypt -type d -exec chmod 750 {} \;

scripts/certbot-renew.sh

@@ -1,35 +1,14 @@
 #!/bin/sh
 
-function replace_in_file() {
+# ask new certificates if needed
-	# escape slashes
-	pattern=$(echo "$2" | sed "s/\//\\\\\//g")
-	replace=$(echo "$3" | sed "s/\//\\\\\//g")
-	sed -i "s/$pattern/$replace/g" "$1"
-}
-
-# disable HTTP
-servers="$(find /etc/nginx -name server.conf)"
-for f in $servers ; do
-	replace_in_file "$f" "listen" "#listen"
-done
-if [ -f /tmp/nginx.pid ] ; then
-	/usr/sbin/nginx -s reload
-	sleep 10
-fi
-
-# ask a new certificate if needed
 certbot renew
 
-# enable HTTP again
+# fix rights
-for f in $servers ; do
-	replace_in_file "$f" "#listen" "listen"
-done
-
 chown -R root:nginx /etc/letsencrypt
 chmod -R 740 /etc/letsencrypt
 find /etc/letsencrypt -type d -exec chmod 750 {} \;
 
 # reload nginx
 if [ -f /tmp/nginx.pid ] ; then
-	/usr/sbin/nginx -s reload
+	/usr/sbin/nginx -s reload > /dev/null 2>&1
 fi

scripts/exit-nodes.sh

@@ -10,5 +10,5 @@ while read entry ; do
 done
 cp /etc/nginx/block-tor-exit-node.conf /cache
 if [ -f /tmp/nginx.pid ] ; then
-	/usr/sbin/nginx -s reload
+	/usr/sbin/nginx -s reload > /dev/null 2>&1
 fi

scripts/geoip.sh

@@ -7,6 +7,6 @@ if [ -f /etc/nginx/geoip.mmdb.gz ] ; then
 	gunzip -f /etc/nginx/geoip.mmdb.gz
 	cp /etc/nginx/geoip.mmdb /cache
 	if [ -f /tmp/nginx.pid ] ; then
-		/usr/sbin/nginx -s reload
+		/usr/sbin/nginx -s reload > /dev/null 2>&1
 	fi
 fi

scripts/logrotate.sh

@@ -7,5 +7,5 @@ pkill -HUP rsyslogd
 fail2ban-client flushlogs
 
 if [ -f /tmp/nginx.pid ] ; then
-        /usr/sbin/nginx -s reload
+        /usr/sbin/nginx -s reload > /dev/null 2>&1
 fi

scripts/proxies.sh

@@ -10,5 +10,5 @@ while read entry ; do
 done
 cp /etc/nginx/block-proxies.conf /cache
 if [ -f /tmp/nginx.pid ] ; then
-	/usr/sbin/nginx -s reload
+	/usr/sbin/nginx -s reload > /dev/null 2>&1
 fi

scripts/referrers.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+
+BLACKLIST="$(curl -s https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-referrers.list)"
+DATA=""
+IFS=$'\n'
+for ref in $BLACKLIST ; do
+        DATA="${DATA}\"~${ref}\" yes;\n"
+done
+
+echo -e "map \$http_referer \$bad_referrer { hostnames; default no; $DATA }" > /etc/nginx/map-referrer.conf
+cp /etc/nginx/map-referrer.conf /cache
+
+if [ -f /tmp/nginx.pid ] ; then
+	/usr/sbin/nginx -s reload > /dev/null 2>&1
+fi

scripts/user-agents.sh

@@ -1,26 +1,17 @@
 #!/bin/sh
 
-# replace pattern in file
+BLACKLIST="$(curl -s https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-user-agents.list)
-function replace_in_file() {
+$(curl -s https://raw.githubusercontent.com/JayBizzle/Crawler-Detect/master/raw/Crawlers.txt)"
-        # escape slashes
-        pattern=$(echo "$2" | sed "s/\//\\\\\//g")
-        replace=$(echo "$3" | sed "s/\//\\\\\//g")
-        replace=$(echo "$replace" | sed "s/\\ /\\\\ /g")
-        sed -i "s/$pattern/$replace/g" "$1"
-}
-
-BLACKLIST="$(curl -s https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-user-agents.list)"
 DATA=""
 IFS=$'\n'
 for ua in $BLACKLIST ; do
-        DATA="${DATA}~*(?:\\\\b)${ua}\(?:\\\\b) yes;\n"
+        DATA="${DATA}~*${ua} yes;\n"
 done
 DATA_ESCAPED=$(echo "$DATA" | sed 's: :\\\\ :g' | sed 's:\\\\ yes;: yes;:g' | sed 's:\\\\\\ :\\\\ :g')
 
-cp /opt/confs/global/map-user-agent.conf /etc/nginx/map-user-agent.conf
+echo -e "map \$http_user_agent \$bad_user_agent { default no; $DATA_ESCAPED }" > /etc/nginx/map-user-agent.conf
-replace_in_file "/etc/nginx/map-user-agent.conf" "%BLOCK_USER_AGENT%" "$DATA_ESCAPED"
 cp /etc/nginx/map-user-agent.conf /cache
 
 if [ -f /tmp/nginx.pid ] ; then
-	/usr/sbin/nginx -s reload
+	/usr/sbin/nginx -s reload > /dev/null 2>&1
 fi