diff --git a/.gitignore b/.gitignore index 5afb6e5..8af91a2 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,7 @@ gitea .env pmb-pf +stump venv zapp.db db/bu diff --git a/backend/requirements.txt b/backend/requirements.txt index aa2e006..47f7d3e 100644 --- a/backend/requirements.txt +++ b/backend/requirements.txt @@ -23,6 +23,6 @@ PyJWT==2.9.0 python-dotenv==1.0.1 SQLAlchemy==2.0.31 typing_extensions==4.12.2 -uWSGI==2.0.26 +uWSGI==2.0.28 Werkzeug==3.0.3 WTForms==3.1.2 diff --git a/compose.yaml b/compose.yaml index 8726f96..ba06d3a 100644 --- a/compose.yaml +++ b/compose.yaml @@ -31,7 +31,7 @@ services: #tty: true restart: always # Comment following line to use flask (1worker, dev), uncomment to use uwsgi (wsgi) - command: ["uwsgi", "--http", "0.0.0.0:8000", "--master", "-p", "4", "-w", "microblog:app"] + command: ["uwsgi", "--http", "0.0.0.0:8000", "--master", "-p", "4", "--buffer-size", "16384", "--limit-as", "2048", "-w", "microblog:app"] container_name: backend environment: - MYSQL_USER=flasku @@ -138,6 +138,22 @@ services: networks: - backnet + stump: + image: aaronleopold/stump + container_name: stump + # Replace my paths (prior to the colons) with your own + volumes: + - ./stump:/config + - /mnt/hub:/data + #ports: + # - 10801:10801 + environment: + - PUID=1000 + - PGID=1000 + restart: unless-stopped + networks: + - frontnet + sshtun: build: context: sshtun diff --git a/ls_rclone.sh b/ls_rclone.sh new file mode 100644 index 0000000..eb501d5 --- /dev/null +++ b/ls_rclone.sh @@ -0,0 +1,5 @@ +rclone ls :sftp: \ + --sftp-host=localhost \ + --sftp-port=11111 \ + --sftp-user=armbian \ + --sftp-key-file=/home/armbian/.ssh/armbian-brie-202604 diff --git a/proxy/Caddyfile b/proxy/Caddyfile new file mode 100644 index 0000000..dd55425 --- /dev/null +++ b/proxy/Caddyfile @@ -0,0 +1,73 @@ +# Global options +{ + # Disable auto HTTPS since we're using existing certificates + auto_https off +} + +# HTTP to HTTPS redirect +:80 { + redir https://{host}{uri} permanent +} + +# Main domain - oily.dad and www.oily.dad +oily.dad, www.oily.dad { + # Root directory (not strictly needed for reverse proxy) + root * /var/www/html + + # Use existing SSL certificates + tls /etc/letsencrypt/live/oily.dad/fullchain.pem /etc/letsencrypt/live/oily.dad/privkey.pem + + # Onion-Location header + header Onion-Location http://oilydada7ckiseinkbeathsefwgkvjrce743xy7x7iiybkuxh4vheead.onion{path} + + # Reverse proxy to backend + reverse_proxy http://backend:8000 { + # Preserve original host header + header_up Host {host} + header_up X-Real-IP {remote} + # X-Forwarded-For and X-Forwarded-Proto are set automatically by Caddy + } +} + +# Subdomain for Gitea - gut.oily.dad +gut.oily.dad { + # Root directory (not strictly needed for reverse proxy) + root * /var/www/html + + # Use existing SSL certificates + tls /etc/letsencrypt/live/oily.dad/fullchain.pem /etc/letsencrypt/live/oily.dad/privkey.pem + + # Reverse proxy to Gitea + reverse_proxy http://gitea:3000 { + # WebSocket support for Gitea + header_up Connection {>Connection} + header_up Upgrade {>Upgrade} + + # Preserve original headers + header_up Host {host} + header_up X-Real-IP {remote} + # X-Forwarded-For and X-Forwarded-Proto are set automatically by Caddy + } +} + +# Subdomain for Stump (comics/books) - book.oily.dad +book.oily.dad { + # Root directory (not strictly needed for reverse proxy) + root * /var/www/html + + # Use existing SSL certificates + tls /etc/letsencrypt/live/oily.dad/fullchain.pem /etc/letsencrypt/live/oily.dad/privkey.pem + + # Reverse proxy to Stump + reverse_proxy http://stump:10801 { + # WebSocket support for Stump (if needed) + header_up Connection {>Connection} + header_up Upgrade {>Upgrade} + + # Preserve original headers + header_up Host {host} + header_up X-Real-IP {remote} + # X-Forwarded-For and X-Forwarded-Proto are set automatically by Caddy + } +} + diff --git a/proxy/Dockerfile b/proxy/Dockerfile index bd58a93..0939ac6 100755 --- a/proxy/Dockerfile +++ b/proxy/Dockerfile @@ -1,2 +1,10 @@ -FROM nginx:alpine -COPY conf /etc/nginx/conf.d/default.conf +FROM caddy:alpine + +# Copy Caddyfile configuration +COPY Caddyfile /etc/caddy/Caddyfile + +# Create directory for www root +RUN mkdir -p /var/www/html + +# Caddy runs as non-root user by default +# Ports 80 and 443 are exposed by the base image diff --git a/proxy/baseconf b/proxy/baseconf deleted file mode 100755 index 04abcd7..0000000 --- a/proxy/baseconf +++ /dev/null @@ -1,12 +0,0 @@ -server { - listen 80; - server_name localhost; - location / { - proxy_pass http://backend:8000; - } - location /gutty{ - proxy_pass http://gitea:3000; - } - - -} diff --git a/proxy/conf b/proxy/conf deleted file mode 100755 index 25ca6b9..0000000 --- a/proxy/conf +++ /dev/null @@ -1,53 +0,0 @@ -#server { -# listen 80; -# server_name localhost; -# location / { -# proxy_pass http://backend:8000; -# } - - -# always redirect to https -server { - listen 80 default_server; - server_name _; - return 301 https://$host$request_uri; -} - -server { - listen 443 ssl http2; - # use the certificates - ssl_certificate /etc/letsencrypt/live/oily.dad/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/oily.dad/privkey.pem; - server_name oily.dad www.oily.dad; - root /var/www/html; - index index.php index.html index.htm; - - add_header Onion-Location http://oilydada7ckiseinkbeathsefwgkvjrce743xy7x7iiybkuxh4vheead.onion$request_uri; - - location / { - proxy_pass http://backend:8000/; - } -} - -server { - listen 443 ssl http2; - # use the certificates - ssl_certificate /etc/letsencrypt/live/oily.dad/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/oily.dad/privkey.pem; - server_name gut.oily.dad; - root /var/www/html; - index index.php index.html index.htm; - - location / { - client_max_body_size 512M; - #proxy_pass http://localhost:3000; - proxy_set_header Connection $http_connection; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_pass http://gitea:3000/; - } -} - diff --git a/proxy/giteaconf b/proxy/giteaconf deleted file mode 100644 index 6291d31..0000000 --- a/proxy/giteaconf +++ /dev/null @@ -1,17 +0,0 @@ -server { - - listen 80; - server_name localhost; - - location / { - client_max_body_size 512M; - #proxy_pass http://localhost:3000; - proxy_pass http://gitea:3000; - proxy_set_header Connection $http_connection; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - } -} diff --git a/proxy/sslconf b/proxy/sslconf deleted file mode 100755 index 25ca6b9..0000000 --- a/proxy/sslconf +++ /dev/null @@ -1,53 +0,0 @@ -#server { -# listen 80; -# server_name localhost; -# location / { -# proxy_pass http://backend:8000; -# } - - -# always redirect to https -server { - listen 80 default_server; - server_name _; - return 301 https://$host$request_uri; -} - -server { - listen 443 ssl http2; - # use the certificates - ssl_certificate /etc/letsencrypt/live/oily.dad/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/oily.dad/privkey.pem; - server_name oily.dad www.oily.dad; - root /var/www/html; - index index.php index.html index.htm; - - add_header Onion-Location http://oilydada7ckiseinkbeathsefwgkvjrce743xy7x7iiybkuxh4vheead.onion$request_uri; - - location / { - proxy_pass http://backend:8000/; - } -} - -server { - listen 443 ssl http2; - # use the certificates - ssl_certificate /etc/letsencrypt/live/oily.dad/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/oily.dad/privkey.pem; - server_name gut.oily.dad; - root /var/www/html; - index index.php index.html index.htm; - - location / { - client_max_body_size 512M; - #proxy_pass http://localhost:3000; - proxy_set_header Connection $http_connection; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_pass http://gitea:3000/; - } -} - diff --git a/sshtun/Dockerfile b/sshtun/Dockerfile index 602bacd..da7e01b 100644 --- a/sshtun/Dockerfile +++ b/sshtun/Dockerfile @@ -1,15 +1,20 @@ -FROM debian:12-slim +FROM debian:13-slim -RUN apt update && apt install -y openssh-server socat +RUN apt update +RUN apt install -y \ + openssh-server \ + socat -RUN adduser --disabled-password --gecos "" finn +RUN adduser --disabled-password --gecos "" armbian -RUN mkdir /home/finn/.ssh - -# only one pubkey -- wildcard to conceal filename -COPY ./oilykey/*.pub /home/finn/.ssh/authorized_keys - -RUN mkdir /var/run/sshd +# ssh: +RUN mkdir /home/armbian/.ssh +# only one pubkey -- wildcard just to conceal filename +COPY ./oilykey/*.pub /home/armbian/.ssh/authorized_keys +COPY ./oilykey/* /home/armbian/.ssh/ +RUN chown -R armbian:armbian /home/armbian/.ssh/ +RUN chmod 600 /home/armbian/.ssh/* +#RUN mkdir /var/run/sshd RUN echo "PermitRootLogin no" >> /etc/ssh/sshd_config RUN echo "PasswordAuthentication no" >> /etc/ssh/sshd_config diff --git a/sshtun/manual_rclone.sh b/sshtun/manual_rclone.sh new file mode 100755 index 0000000..1bf13af --- /dev/null +++ b/sshtun/manual_rclone.sh @@ -0,0 +1,8 @@ +rclone mount :sftp: /armbian/briemount \ + --sftp-host=localhost \ + --sftp-port=11111 \ + --sftp-user=armbian \ + --sftp-key-file=/home/armbian/.ssh/armbian-brie-202604 \ + --vfs-cache-mode off \ + --allow-other \ + --daemon