Initial server source import

2026-09-30 20:30:56 +03:00
commit 170dd941b9
498 changed files with 261563 additions and 0 deletions
@@ -0,0 +1,61 @@
+FROM caddy:2.10.2-alpine@sha256:4c6e91c6ed0e2fa03efd5b44747b625fec79bc9cd06ac5235a779726618e530d AS caddy-edge-e2e
+
+FROM debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171 AS fail2ban-edge-e2e
+
+COPY --from=caddy-edge-e2e --chown=0:0 --chmod=0444 /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+
+RUN <<'SH'
+set -eu
+rm -f /etc/apt/sources.list /etc/apt/sources.list.d/debian.sources
+printf '%s\n' \
+    'Types: deb' \
+    'URIs: http://snapshot.debian.org/archive/debian/20260914T000000Z/' \
+    'Suites: bookworm bookworm-updates' \
+    'Components: main' \
+    'Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg' \
+    'Check-Valid-Until: no' \
+    '' \
+    'Types: deb' \
+    'URIs: http://snapshot.debian.org/archive/debian-security/20260914T000000Z/' \
+    'Suites: bookworm-security' \
+    'Components: main' \
+    'Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg' \
+    'Check-Valid-Until: no' \
+    > /etc/apt/sources.list.d/debian.sources
+printf '#!/bin/sh\nexit 101\n' > /usr/sbin/policy-rc.d
+chmod 0755 /usr/sbin/policy-rc.d
+export DEBIAN_FRONTEND=noninteractive
+apt-get -o Acquire::Retries=3 -o Acquire::https::Timeout=30 -o APT::Update::Error-Mode=any update
+apt-get install -y --no-install-recommends fail2ban=1.0.2-2
+rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/* /var/log/apt/*
+find /etc/fail2ban/jail.d -type f -delete
+install -d -o 0 -g 0 -m 0755 \
+    /etc/caddy /etc/caddy/denylist /etc/caddy/tls /etc/fail2ban/action.d /etc/fail2ban/fail2ban.d \
+    /etc/fail2ban/filter.d /etc/fail2ban/jail.d /etc/truf-edge/denylist \
+    /run/fail2ban /var/lib/fail2ban /var/lib/truf-edge /var/log/caddy /var/log/truf-edge
+SH
+
+COPY --from=caddy-edge-e2e --chown=0:0 --chmod=0555 /usr/bin/caddy /usr/bin/caddy
+RUN cp /usr/bin/caddy /usr/bin/caddy-edge-e2e \
+    && rm /usr/bin/caddy \
+    && mv /usr/bin/caddy-edge-e2e /usr/bin/caddy \
+    && chmod 0555 /usr/bin/caddy
+COPY --chown=0:0 --chmod=0444 deploy/edge/Caddyfile /etc/caddy/Caddyfile
+RUN chmod 0644 /etc/caddy/Caddyfile \
+    && sed -i 's/^[[:space:]]*admin off$/\tadmin 127.0.0.1:2019/' /etc/caddy/Caddyfile \
+    && chmod 0444 /etc/caddy/Caddyfile \
+    && grep -Fx '	admin 127.0.0.1:2019' /etc/caddy/Caddyfile >/dev/null
+COPY --chown=0:0 --chmod=0444 deploy/fail2ban/filter.d-truf-admin-auth.conf /etc/fail2ban/filter.d/truf-admin-auth.conf
+COPY --chown=0:0 --chmod=0444 deploy/fail2ban/jail.d-truf-admin-auth.local /etc/fail2ban/jail.d/truf-admin-auth.local
+COPY --chown=0:0 --chmod=0444 deploy/fail2ban/action.d-truf-caddy-admin-denylist.conf /etc/fail2ban/action.d/truf-caddy-admin-denylist.conf
+COPY --chown=0:0 --chmod=0444 deploy/fail2ban/fail2ban.d-truf-persistence.local /etc/fail2ban/fail2ban.d/truf-persistence.local
+COPY --chown=0:0 --chmod=0444 deploy/fail2ban/fail2ban.d-edge-e2e.local /etc/fail2ban/fail2ban.d/edge-e2e.local
+COPY --chown=0:0 --chmod=0555 deploy/fail2ban/truf_caddy_admin_denylist.py /usr/local/sbin/truf-caddy-admin-denylist
+COPY --chown=0:0 --chmod=0555 deploy/fail2ban/edge_e2e_docker_shim.py /usr/local/bin/docker
+
+RUN fail2ban-server --version 2>&1 | grep -F 'v1.0.2' >/dev/null \
+    && test "$(find /etc/fail2ban/jail.d -type f | wc -l)" -eq 1
+
+USER 0:0
+ENTRYPOINT ["/usr/bin/fail2ban-server", "-f", "-x"]
+CMD []