diff options
Diffstat (limited to 'terminaldweller.com')
| -rw-r--r-- | terminaldweller.com/doh/docker-compose.yaml | 39 | ||||
| -rw-r--r-- | terminaldweller.com/doh/nginx.conf | 37 | ||||
| -rw-r--r-- | terminaldweller.com/doh/unbound/doh.conf | 43 | ||||
| -rw-r--r-- | terminaldweller.com/doh/unbound/root-auto-trust-anchor-file.conf | 4 | ||||
| -rw-r--r-- | terminaldweller.com/haproxy/haproxy.cfg | 13 | ||||
| -rw-r--r-- | terminaldweller.com/irc-slack/Dockerfile | 17 | ||||
| -rw-r--r-- | terminaldweller.com/irc-slack/docker-compose.yaml | 18 | ||||
| -rw-r--r-- | terminaldweller.com/prosody/config/prosody.cfg.lua | 208 | ||||
| -rw-r--r-- | terminaldweller.com/prosody/docker-compose.yaml | 40 |
9 files changed, 171 insertions, 248 deletions
diff --git a/terminaldweller.com/doh/docker-compose.yaml b/terminaldweller.com/doh/docker-compose.yaml new file mode 100644 index 0000000..1b4f81c --- /dev/null +++ b/terminaldweller.com/doh/docker-compose.yaml @@ -0,0 +1,39 @@ +version: "3" +services: + doh-server: + image: satishweb/doh-server + networks: + - dohnet + ports: + - "127.0.0.1:8053:8053" + restart: unless-stopped + environment: + - DEBUG="0" + - UPSTREAM_DNS_SERVER=udp:208.67.222.222:53 + - DOH_HTTP_PREFIX=/getnsrecord + - DOH_SERVER_LISTEN=:8053 + - DOH_SERVER_TIMEOUT=10 + - DOH_SERVER_TRIES=3 + - DOH_SERVER_VERBOSE=true + depends_on: + - nginx + nginx: + image: nginx:stable + ports: + - "443:443" + networks: + - dohnet + restart: unless-stopped + cap_drop: + - ALL + cap_add: + - CHOWN + - DAC_OVERRIDE + - SETGID + - SETUID + - NET_BIND_SERVICE + volumes: + - ./nginx.conf:/etc/nginx/nginx.conf:ro + - /etc/letsencrypt/archive/doh.terminaldweller.com/:/certs/:ro +networks: + dohnet: diff --git a/terminaldweller.com/doh/nginx.conf b/terminaldweller.com/doh/nginx.conf new file mode 100644 index 0000000..c398730 --- /dev/null +++ b/terminaldweller.com/doh/nginx.conf @@ -0,0 +1,37 @@ +events { + worker_connections 1024; +} +http { + include /etc/nginx/mime.types; + server_tokens off; + limit_req_zone $binary_remote_addr zone=one:10m rate=30r/m; + server { + listen 443 ssl http2; + keepalive_timeout 60; + charset utf-8; + ssl_certificate /certs/fullchain1.pem; + ssl_certificate_key /certs/privkey1.pem; + ssl_ciphers HIGH:!aNULL:!MD5:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_protocols TLSv1.3; + ssl_session_cache shared:SSL:50m; + ssl_session_timeout 1d; + ssl_session_tickets off; + ssl_prefer_server_ciphers on; + tcp_nopush on; + add_header X-Content-Type-Options "nosniff" always; + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + add_header Content-Security-Policy "default-src 'self';"; + add_header X-Frame-Options SAMEORIGIN always; + add_header X-XSS-Protection "1; mode=block" always; + add_header Referrer-Policy "no-referrer"; + fastcgi_hide_header X-Powered-By; + ssl_stapling on; + ssl_stapling_verify on; + ssl_trusted_certificate /certs/cert1.pem; + + error_page 401 403 404 /404.html; + location / { + proxy_pass http://doh-server:8053; + } + } +} diff --git a/terminaldweller.com/doh/unbound/doh.conf b/terminaldweller.com/doh/unbound/doh.conf new file mode 100644 index 0000000..4e6e291 --- /dev/null +++ b/terminaldweller.com/doh/unbound/doh.conf @@ -0,0 +1,43 @@ +server: + interface: 0.0.0.0@443 + tls-service-key: /etc/letsencrypt/archive/doh.terminaldweller.com/privkey1.pem + tls-service-pem: /etc/letsencrypt/archive/doh.terminaldweller.com/fullchain1.pem + tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt + https-port: 443 + tls-port: 443 + do-ip4: yes + do-ip6: yes + do-udp: yes + do-tcp: yes + prefer-ip6: no +# auto-trust-anchor-file: "/var/lib/unbound/root.key" + qname-minimisation: yes + harden-glue: yes + harden-dnssec-stripped: yes + use-caps-for-id: no + edns-buffer-size: 1232 + prefetch: yes + so-rcvbuf: 1m + + private-address: 127.0.0.0/8 + private-address: 192.168.0.0/16 + private-address: 169.254.0.0/16 + private-address: 172.16.0.0/12 + private-address: 10.0.0.0/8 + private-address: fd00::/8 + private-address: fe80::/10 + + access-control: 0.0.0.0/0 allow_snoop + +forward-zone: + name: "." + forward-tls-upstream: yes + forward-addr: 9.9.9.9@853#dns.quad9.net + forward-addr: 149.112.112.112@853#dns.quad9.net + forward-addr: 1.1.1.1@853#cloudflare-dns.com + forward-addr: 1.0.0.1@853#cloudflare-dns.com + + forward-addr: 2620:fe::fe@853#dns.quad9.net + forward-addr: 2620:fe::9@853#dns.quad9.net + forward-addr: 2606:4700:4700::1111@853#cloudflare-dns.com + forward-addr: 2606:4700:4700::1001@853#cloudflare-dns.com diff --git a/terminaldweller.com/doh/unbound/root-auto-trust-anchor-file.conf b/terminaldweller.com/doh/unbound/root-auto-trust-anchor-file.conf new file mode 100644 index 0000000..433eff9 --- /dev/null +++ b/terminaldweller.com/doh/unbound/root-auto-trust-anchor-file.conf @@ -0,0 +1,4 @@ +server: + # The following line will configure unbound to perform cryptographic + # DNSSEC validation using the root trust anchor. + auto-trust-anchor-file: "/var/lib/unbound/root.key" diff --git a/terminaldweller.com/haproxy/haproxy.cfg b/terminaldweller.com/haproxy/haproxy.cfg index 26265ae..feee75c 100644 --- a/terminaldweller.com/haproxy/haproxy.cfg +++ b/terminaldweller.com/haproxy/haproxy.cfg @@ -47,6 +47,7 @@ frontend http acl cargo-host hdr_sub(host) -i cargo.terminaldweller.com acl browsh-host hdr_sub(host) -i browsh.terminaldweller.com acl main-host hdr_sub(host) -i terminaldweller.com + acl doh2-host hdr_sub(shost) -i doh2.terminaldweller.com acl mila-api-acl url_beg /mila acl crypto-api-acl url_beg /crypto acl http ssl_fc,not @@ -67,6 +68,7 @@ frontend http #http-request redirect scheme https code 301 if http jabber-host !letsencrypt-acl http-request redirect scheme https code 301 if http rssgen-host !letsencrypt-acl http-request redirect scheme https code 301 if http main-host !letsencrypt-acl + http-request redirect scheme https code 301 if http doh2-host !letsencrypt-acl #Conditions use_backend blog-backend-cert if letsencrypt-acl blog-host @@ -82,6 +84,7 @@ frontend http use_backend searx-backend-cert if letsencrypt-acl cargo-host use_backend vpn6-cert-backend if letsencrypt-acl browsh-host use_backend searx-backend-cert if letsencrypt-acl main-host + use_backend doh2-backend-cert if letsencrypt-acl doh2-host # use_backend editor-backend-cert if letsencrypt-acl editor-host use_backend certbot-backend if letsencrypt-acl !jabber-host !blog-host !api-host use_backend blog-backend if blog-host @@ -117,6 +120,7 @@ frontend https acl rssgen-host-s req.ssl_sni -i rssgen.terminaldweller.com acl browsh-host-s req.ssl_sni -i browsh.terminaldweller.com acl main-host-s req.ssl_sni -i terminaldweller.com + acl doh2-host-s req.ssl_sni -i doh2.terminaldweller.com #Conditions use_backend mail-backend-s if mail-host-s #use_backend chat-backend-s if chat-host-s @@ -133,6 +137,7 @@ frontend https use_backend rssgen-backend-s if rssgen-host-s use_backend browsh-backend-s if browsh-host-s use_backend main-backend-s if main-host-s + use_backend doh2-backend-s if doh2-host-s #frontend jabber5222 # bind *:5222 @@ -403,3 +408,11 @@ backend main-backend-s mode tcp option tcp-check server main-host-s 185.130.47.208:7773 + +backend doh2-backend-cert + mode http + server doh2-backend-host 185.130.47.81:80 +backend doh2-backend-s + mode tcp + option tcp-check + server doh2-backend-s 185.130.47.81:443 diff --git a/terminaldweller.com/irc-slack/Dockerfile b/terminaldweller.com/irc-slack/Dockerfile new file mode 100644 index 0000000..8222d8b --- /dev/null +++ b/terminaldweller.com/irc-slack/Dockerfile @@ -0,0 +1,17 @@ +FROM alpine:3.15 as builder +RUN apk update && apk upgrade +RUN apk add go git make +ENV GOPROXY=https://goproxy.io +RUN git clone https://github.com/insomniacslk/irc-slack +WORKDIR irc-slack +RUN go mod download +RUN cd /irc-slack/cmd/irc-slack && make + +FROM alpine:3.15 as certbuilder +RUN apk add openssl +WORKDIR /certs +RUN openssl req -nodes -new -x509 -subj="/C=US/ST=Denial/L=springfield/O=Dis/CN=ircslack.terminaldweller.com" -keyout server.key -out server.cert + +FROM alpine:3.13 +COPY --from=certbuilder /certs /certs +COPY --from=builder /irc-slack/cmd/irc-slack/irc-slack /irc-slack/ diff --git a/terminaldweller.com/irc-slack/docker-compose.yaml b/terminaldweller.com/irc-slack/docker-compose.yaml new file mode 100644 index 0000000..f3ec3f0 --- /dev/null +++ b/terminaldweller.com/irc-slack/docker-compose.yaml @@ -0,0 +1,18 @@ +version: "3" +services: + ircslack: + image: ircslack + build: + context: . + networks: + - ircslacknet + restart: unless-stopped + ports: + - "6667:6667" + entrypoint: ["/irc-slack/irc-slack"] + command: ["--port", "6667", "--host", "0.0.0.0", "--cert", "/certs/server.cert", "--key", "/certs/server.key"] + cap_drop: + - ALL +networks: + ircslacknet: + driver: bridge diff --git a/terminaldweller.com/prosody/config/prosody.cfg.lua b/terminaldweller.com/prosody/config/prosody.cfg.lua deleted file mode 100644 index ba67de7..0000000 --- a/terminaldweller.com/prosody/config/prosody.cfg.lua +++ /dev/null @@ -1,208 +0,0 @@ -daemonize = false; --- Prosody XMPP Server Configuration --- --- Information on configuring Prosody can be found on our --- website at https://prosody.im/doc/configure --- --- Tip: You can check that the syntax of this file is correct --- when you have finished by running this command: --- prosodyctl check config --- If there are any errors, it will let you know what and where --- they are, otherwise it will keep quiet. --- --- Good luck, and happy Jabbering! - ----------- Server-wide settings ---------- --- Settings in this section apply to the whole server and are the default settings --- for any virtual hosts - --- This is a (by default, empty) list of accounts that are admins --- for the server. Note that you must create the accounts separately --- (see https://prosody.im/doc/creating_accounts for info) --- Example: admins = { "user1@example.com", "user2@example.net" } -admins = {"devi@chat.terminaldweller.com"} - --- Enable use of libevent for better performance under high load --- For more information see: https://prosody.im/doc/libevent --- use_libevent = true - --- Prosody will always look in its source directory for modules, but --- this option allows you to specify additional locations where Prosody --- will look for modules first. For community modules, see https://modules.prosody.im/ --- plugin_paths = {} - --- This is the list of modules Prosody will load on startup. --- It looks for mod_modulename.lua in the plugins folder, so make sure that exists too. --- Documentation for bundled modules can be found at: https://prosody.im/doc/modules -modules_enabled = { - - -- Generally required - "roster", -- Allow users to have a roster. Recommended ;) - "saslauth", -- Authentication for clients and servers. Recommended if you want to log in. - "tls", -- Add support for secure TLS on c2s/s2s connections - "dialback", -- s2s dialback support - "disco", -- Service discovery - -- Not essential, but recommended - "carbons", -- Keep multiple clients in sync - "pep", -- Enables users to publish their avatar, mood, activity, playing music and more - "private", -- Private XML storage (for room bookmarks, etc.) - "blocklist", -- Allow users to block communications with other users - "vcard4", -- User profiles (stored in PEP) - "vcard_legacy", -- Conversion between legacy vCard and PEP Avatar, vcard - "limits", -- Enable bandwidth limiting for XMPP connections - -- Nice to have - "version", -- Replies to server version requests - "uptime", -- Report how long server has been running - "time", -- Let others know the time here on this server - "ping", -- Replies to XMPP pings with pongs - -- "register"; -- Allow users to register on this server using a client and change passwords - -- "mam"; -- Store messages in an archive and allow users to access it - -- "csi_simple"; -- Simple Mobile optimizations - -- Admin interfaces - "admin_adhoc", -- Allows administration via an XMPP client that supports ad-hoc commands - -- "admin_telnet"; -- Opens telnet console interface on localhost port 5582 - - -- HTTP modules - "bosh" -- Enable BOSH clients, aka "Jabber over HTTP" - -- "websocket"; -- XMPP over WebSockets - -- "http_files"; -- Serve static files from a directory over HTTP - - -- Other specific functionality - -- "groups"; -- Shared roster support - -- "server_contact_info"; -- Publish contact information for this service - -- "announce"; -- Send announcement to all online users - -- "welcome"; -- Welcome users who register accounts - -- "watchregistrations"; -- Alert admins of registrations - -- "motd"; -- Send a message to users when they log in - -- "legacyauth"; -- Legacy authentication. Only used by some old clients and bots. - -- "proxy65"; -- Enables a file transfer proxy service which clients behind NAT can use -} - --- These modules are auto-loaded, but should you want --- to disable them then uncomment them here: -modules_disabled = { - -- "offline"; -- Store offline messages - "c2s" -- Handle client connections - -- "s2s"; -- Handle server-to-server connections - -- "posix"; -- POSIX functionality, sends server to background, enables syslog, etc. -} - --- Disable account creation by default, for security --- For more information see https://prosody.im/doc/creating_accounts -allow_registration = false - --- Force clients to use encrypted connections? This option will --- prevent clients from authenticating unless they are using encryption. - -c2s_require_encryption = true - --- Force servers to use encrypted connections? This option will --- prevent servers from authenticating unless they are using encryption. - -s2s_require_encryption = true - --- Force certificate authentication for server-to-server connections? - -s2s_secure_auth = false - --- Some servers have invalid or self-signed certificates. You can list --- remote domains here that will not be required to authenticate using --- certificates. They will be authenticated using DNS instead, even --- when s2s_secure_auth is enabled. - --- s2s_insecure_domains = { "insecure.example" } - --- Even if you disable s2s_secure_auth, you can still require valid --- certificates for some domains by specifying a list here. - --- s2s_secure_domains = { "jabber.org" } - --- Enable rate limits for incoming client and server connections - -limits = {c2s = {rate = "10kb/s"}, s2sin = {rate = "30kb/s"}} - --- Required for init scripts and prosodyctl -pidfile = "/var/run/prosody/prosody.pid" - --- Select the authentication backend to use. The 'internal' providers --- use Prosody's configured data storage to store the authentication data. - -authentication = "internal_hashed" - --- Select the storage backend to use. By default Prosody uses flat files --- in its configured data directory, but it also supports more backends --- through modules. An "sql" backend is included by default, but requires --- additional dependencies. See https://prosody.im/doc/storage for more info. - --- storage = "sql" -- Default is "internal" - --- For the "sql" backend, you can uncomment *one* of the below to configure: --- sql = { driver = "SQLite3", database = "prosody.sqlite" } -- Default. 'database' is the filename. --- sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" } --- sql = { driver = "PostgreSQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" } - --- Archiving configuration --- If mod_mam is enabled, Prosody will store a copy of every message. This --- is used to synchronize conversations between multiple clients, even if --- they are offline. This setting controls how long Prosody will keep --- messages in the archive before removing them. - -archive_expires_after = "1w" -- Remove archived messages after 1 week - --- You can also configure messages to be stored in-memory only. For more --- archiving options, see https://prosody.im/doc/modules/mod_mam - --- Logging configuration --- For advanced logging see https://prosody.im/doc/logging -log = {{levels = {min = "info"}, to = "console"}} - --- Uncomment to enable statistics --- For more info see https://prosody.im/doc/statistics --- statistics = "internal" - --- Certificates --- Every virtual host and component needs a certificate so that clients and --- servers can securely verify its identity. Prosody will automatically load --- certificates/keys from the directory specified here. --- For more information, including how to use 'prosodyctl' to auto-import certificates --- (from e.g. Let's Encrypt) see https://prosody.im/doc/certificates - --- Location of directory to find certificates in (relative to main config file): -certificates = "certs" - --- HTTPS currently only supports a single certificate, specify it here: --- https_certificate = "/etc/prosody/certs/localhost.crt" - ------------ Virtual hosts ----------- --- You need to add a VirtualHost entry for each domain you wish Prosody to serve. --- Settings under each VirtualHost entry apply *only* to that host. - -VirtualHost "chat.terminaldweller.com" -enabled = true -ssl = { - key = "/etc/letsencrypt/live/chat.terminaldweller.com/privkey.pem", - certificate = "/etc/letsencrypt/live/chat.terminaldweller.com/fullchain.pem" -} - --- VirtualHost "example.com" --- certificate = "/path/to/example.crt" - ------- Components ------ --- You can specify components to add hosts that provide special services, --- like multi-user conferences, and transports. --- For more information on components, see https://prosody.im/doc/components - ----Set up a MUC (multi-user chat) room server on conference.example.com: -Component "conference.chat.terminaldweller.com" "muc" -restrict_room_creationi = "admin" ---- Store MUC messages in an archive and allow users to access it --- modules_enabled = { "muc_mam" } - ----Set up an external component (default component port is 5347) --- --- External components allow adding various services, such as gateways/ --- transports to other networks like ICQ, MSN and Yahoo. For more info --- see: https://prosody.im/doc/components#adding_an_external_component --- --- Component "gateway.example.com" --- component_secret = "password" diff --git a/terminaldweller.com/prosody/docker-compose.yaml b/terminaldweller.com/prosody/docker-compose.yaml deleted file mode 100644 index 3641974..0000000 --- a/terminaldweller.com/prosody/docker-compose.yaml +++ /dev/null @@ -1,40 +0,0 @@ -version: "3.4" -services: - postgres: - image: postgres:alpine3.14 - ports: - "127.0.0.1:5432:5432" - volumes: - - postgresdata:/var/lib/postgresql/data/prosody - networks: - - xmppnet - cap_drop: - - ALL - prosody: - image: prosody/prosody:0.11.9 - restart: unless-stopped - ports: - - "5080:80/tcp" - - "5222:5222/tcp" - - "5280:5280/tcp" - - "5281:5281/tcp" - - "5347:5347/tcp" - - "5582:5582/tcp" - volumes: - - ./config/prosody.cfg.lua:/etc/prosody:ro - - ./log:/var/log/prosody - - ./modules:/usr/lib/prosody-modules - environment: - - LOCAL=chat - - DOMAIN=terminaldweller.com - - PASSWORD=letstryxmpp - networks: - - xmppnet - cap_add: - cap_drop: - - ALL -networks: - xmppnet: - driver: bridge -volumes: - postgresdata: |