vh/NetAlertX
1
0
Fork 0
mirror of https://github.com/jokob-sk/NetAlertX.git synced 2025-12-06 17:15:38 -08:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Validated launch on runner & hardend

Browse Source
This commit is contained in:
Adam Outler
2025-09-26 21:01:58 -04:00
parent 2419a268b2
commit 2def3f1dac
8 changed files with 84 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
.devcontainer/Dockerfile
View File

@@ -79,27 +79,19 @@ RUN apk add --no-cache bash libbsd zip lsblk gettext-envsubst sudo mtr tzdata cu
rm -rf /var/cache/apk/* && \
rm -f /etc/nginx/http.d/default.conf
# Install from previous build stage
# Install application, copy files, set permissions
COPY --from=builder /opt/venv /opt/venv
COPY --from=builder /usr/sbin/usermod /usr/sbin/groupmod /usr/sbin/
# Simple copy of directory structure instead of individual files or complicated directory structure with RUN mkdir
COPY --chown=netalertx:netalertx install/alpine-docker/ /
RUN chmod -R a+x ${SYSTEM_SERVICES} /build/ /entrypoint.sh && \
sh -c "find ${NETALERTX_APP} -type d -exec chmod 750 {} \;" && \
sh -c "find ${NETALERTX_APP} -type f -exec chmod 640 {} \;" && \
sh -c "find ${NETALERTX_APP} -type f \( -name '*.sh' -o -name 'speedtest-cli' \) -exec chmod 750 {} \;"
# Copy source
COPY --chown=netalertx:netalertx --chmod=755 back ${NETALERTX_BACK}
COPY --chown=netalertx:netalertx --chmod=755 front ${NETALERTX_FRONT}
COPY --chown=netalertx:netalertx --chmod=755 server ${NETALERTX_SERVER}
# create folders with netalertx user ownership and 755 permissions
RUN install -d -o netalertx -g netalertx -m 755 ${NETALERTX_API}
# Install runtime dependencies
RUN install -d -o netalertx -g netalertx -m 755 ${NETALERTX_API} && \
install -d -o netalertx -g netalertx -m 755 ${NETALERTX_LOG} && \
sh -c "find ${NETALERTX_APP} -type f \( -name '*.sh' -o -name 'speedtest-cli' \) \
-exec chmod 750 {} \;"
#initialize each service with the dockerfiles/init-*.sh scripts, once.
@@ -113,9 +105,7 @@ RUN sh /build/init-nginx.sh && \
# set netalertx to allow sudoers for any command, no password
RUN echo "netalertx ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
ENTRYPOINT ["/bin/sh","-c","sleep infinity"]
# Final hardened stage to improve security by setting correct permissions and removing sudo access
# When complete, if the image is compromised, there's not much that can be done with it.
FROM runner AS hardened
@@ -163,13 +153,16 @@ ENTRYPOINT ["/entrypoint.sh"]
# Prefer to place dev-only setup here; use setup.sh only for runtime fixes.
FROM runner AS netalertx-devcontainer
USER root
ENV INSTALL_DIR=/app
ENV PYTHONPATH=/workspaces/NetAlertX/test:/workspaces/NetAlertX/server:/app:/app/server:/opt/venv/lib/python3.12/site-packages
ENV HOME=/workspaces
COPY .devcontainer/resources/99-xdebug.ini /etc/php83/conf.d/99-xdebug.ini
# Install common tools, create user, and set up sudo
RUN apk add --no-cache git nano vim jq php83-pecl-xdebug py3-pip nodejs sudo gpgconf pytest pytest-cov shadow
RUN apk add --no-cache git nano vim jq php83-pecl-xdebug py3-pip nodejs sudo gpgconf pytest pytest-cov shadow github-cli fish
# Install debugpy in the virtualenv if present, otherwise into system python3
RUN /bin/sh -c '(/opt/venv/bin/python3 -m pip install --no-cache-dir debugpy) || (python3 -m pip install --no-cache-dir debugpy) || true'
@@ -177,7 +170,8 @@ RUN /opt/venv/bin/python -m pip install -U pytest pytest-cov
USER netalertx
WORKDIR /workspaces/NetAlertX
WORKDIR /workspaces/
RUN mkdir -p /workspaces && \
sudo chmod 777 /workspaces
ENTRYPOINT ["/bin/sh","-c","sleep infinity"]
USER netalertx

12
.devcontainer/resources/devcontainer-Dockerfile
View File

@@ -11,15 +11,11 @@ ENV PYTHONPATH=/workspaces/NetAlertX/test:/workspaces/NetAlertX/server:/app:/app
COPY .devcontainer/resources/99-xdebug.ini /etc/php83/conf.d/99-xdebug.ini
# Install common tools, create user, and set up sudo
RUN apk add --no-cache git nano vim jq php83-pecl-xdebug py3-pip nodejs sudo gpgconf pytest pytest-cov shadow github-cli
RUN apk add --no-cache git nano vim jq php83-pecl-xdebug py3-pip nodejs sudo gpgconf pytest pytest-cov
# Install debugpy in the virtualenv if present, otherwise into system python3
RUN /bin/sh -c '(/opt/venv/bin/python3 -m pip install --no-cache-dir debugpy) || (python3 -m pip install --no-cache-dir debugpy) || true'
RUN /opt/venv/bin/python -m pip install -U pytest pytest-cov
RUN sudo /env/bin/python -m pip install -U pytest pytest-cov
USER netalertx
WORKDIR /workspaces/NetAlertX
ENTRYPOINT ["/bin/sh","-c","sleep infinity"]
RUN ["/bin/sh","-c","sleep infinity"]

24
.devcontainer/scripts/setup.sh
View File

@@ -10,7 +10,7 @@ id
export APP_DIR="/app"
export APP_COMMAND="/workspaces/NetAlertX/.devcontainer/scripts/restart-backend.sh"
export PHP_FPM_BIN="/usr/sbin/php-fpm83"
export NGINX_BIN="/usr/sbin/nginx"
export NGINX_BIN="/workspaces/NetAlertX/.devcontainer/scripts/start-nginx.sh"
export CROND_BIN="/usr/sbin/crond -f"
@@ -33,6 +33,8 @@ export SOURCE_DIR="/workspaces/NetAlertX"
main() {
echo "=== NetAlertX Development Container Setup ==="
echo "Setting up ${SOURCE_DIR}..."
sudo chown $(id -u):$(id -g) /workspaces
sudo chown 755 /workspaces
configure_source
echo "--- Starting Development Services ---"
@@ -75,8 +77,10 @@ configure_source() {
sudo cp -R ${SOURCE_DIR}/log/ /tmp/log/ || true
sudo cp -R ${SOURCE_DIR}/api/ /tmp/api/ || true
sudo mkdir -p ${NETALERTX_API} ${NETALERTX_LOG}
sudo mount -t tmpfs -o size=256M tmpfs "${INSTALL_DIR}/log"
sudo mount -t tmpfs -o size=512M tmpfs "${INSTALL_DIR}/api"
# mount tmpfs with netalertx:netalertx ownership and 775 permissions
sudo mount -o uid=$(id -u netalertx),gid=$(id -g netalertx),mode=775 -t tmpfs -o size=256M tmpfs "${NETALERTX_LOG}"
sudo mount -o uid=$(id -u netalertx),gid=$(id -g netalertx),mode=775 -t tmpfs -o size=256M tmpfs "${NETALERTX_API}"
# mount tmpfs with root:root ownership and 755 permissions
sudo cp -R /tmp/log/* ${NETALERTX_LOG} 2>/dev/null || true
sudo cp -R /tmp/api/* ${NETALERTX_API} 2>/dev/null || true
sudo rm -Rf /tmp/log /tmp/api || true
@@ -86,6 +90,7 @@ configure_source() {
echo " -> Setting ownership and permissions"
chmod +x /workspaces/NetAlertX/.devcontainer/scripts/start-nginx.sh
sudo date +%s > "${INSTALL_DIR}/front/buildtimestamp.txt"
@@ -96,6 +101,8 @@ configure_source() {
touch ${INSTALL_DIR}/log/stderr.log \
${INSTALL_DIR}/log/execution_queue.log
echo 0>${INSTALL_DIR}/log/db_is_locked.log
mkdir -p /app/log/plugins
sudo chown -R netalertx:www-data ${INSTALL_DIR}
date +%s > /app/front/buildtimestamp.txt
@@ -141,10 +148,11 @@ start_services() {
configure_php() {
echo "[2/3] Configuring PHP-FPM..."
sudo killall php-fpm83 &>/dev/null || true
install -d -o nginx -g www-data /run/php/ &>/dev/null
install -d -o netalertx -g www-data /run/php/ &>/dev/null
sudo sed -i "/^;pid/c\pid = /run/php/php8.3-fpm.pid" /etc/php83/php-fpm.conf
sudo sed -i 's|^listen = .*|listen = 127.0.0.1:9000|' /etc/php83/php-fpm.d/www.conf
sudo sed -i 's|fastcgi_pass .*|fastcgi_pass 127.0.0.1:9000;|' /etc/nginx/http.d/*.conf
#increase max child process count to 10
sudo sed -i -e 's/pm.max_children = 5/pm.max_children = 10/' /etc/php83/php-fpm.d/www.conf
@@ -155,7 +163,7 @@ configure_php() {
if ! grep -q '^error_log\s*=' /etc/php83/php-fpm.conf; then
echo 'error_log = /app/log/app.php_errors.log' | sudo tee -a /etc/php83/php-fpm.conf
fi
sudo mkdir -p /etc/php83/conf.d
sudo cp /workspaces/NetAlertX/.devcontainer/resources/99-xdebug.ini /etc/php83/conf.d/99-xdebug.ini
@@ -163,6 +171,12 @@ configure_php() {
install -d -o netalertx -g www-data -m 755 var/log/php83;
sudo chmod 644 /etc/php83/conf.d/99-xdebug.ini || true
sudo install -d -o netalertx -g www-data -m 775 /run/php
sudo rm /var/lib/nginx/logs/ && sudo install -d -o netalertx -g www-data /var/lib/nginx/logs/
sudo rm /var/log/nginx && sudo install -d -o netalertx -g www-data /var/log/nginx
sudo chown -R netalertx:www-data /var/log/nginx
sudo chown -R netalertx:www-data /run/nginx
}

11
.devcontainer/scripts/start-nginx.sh Executable file
View File

@@ -0,0 +1,11 @@
#create /services/nginx directory for nginx system files
sudo install -d /services/nginx -m 755 -o netalertx -g netalertx
sudo install -d /services/nginx -m 755 -o netalertx -g netalertx
sudo chown -R netalertx:netalertx /var/lib/nginx
cp /workspaces/NetAlertX/install/alpine-docker/app/services/nginx/nginx.conf /services/nginx/nginx.conf
sed -i 's|/app/services/nginx/netalertx.conf|/services/nginx/netalertx.conf|' /services/nginx/nginx.conf
cp /workspaces/NetAlertX/install/alpine-docker/app/services/nginx/netalertx.conf /services/nginx/netalertx.conf
cp /workspaces/NetAlertX/install/alpine-docker/app/services/nginx/fastcgi_params /services/nginx/fastcgi_params
nginx -c "/services/nginx/nginx.conf" -g "daemon off;" 2>&1 >/app/log/app_front.log

1
.vscode/launch.json vendored
View File

@@ -29,6 +29,7 @@
"pathMappings": {
"/app": "${workspaceFolder}"
}
}
]
}

3
.vscode/settings.json vendored
View File

@@ -10,4 +10,7 @@
"python.defaultInterpreterPath": "/opt/venv/bin/python",
// Let the Python extension invoke pytest via the interpreter; avoid hardcoded paths
// Removed python.testing.pytestPath and legacy pytest.command overrides
"terminal.integrated.defaultProfile.linux": "bash",
"terminal.integrated.profiles.linux": { "bash": { "path": "/bin/fish" } }
}

10
.vscode/tasks.json vendored
View File

@@ -27,23 +27,25 @@
{
"label": "Re-Run Startup Script",
"type": "shell",
"command": "${workspaceFolder:NetAlertX}/.devcontainer/scripts/setup.sh",
"command": "test ! -d /workspaces && echo not in container && exit 1; ${workspaceFolder:NetAlertX}/.devcontainer/scripts/setup.sh",
"presentation": {
"echo": true,
"reveal": "always",
"panel": "shared",
"showReuseMessage": false
},
"problemMatcher": [],
"icon": {
"id": "beaker",
"color": "terminal.ansiBlue"
}
},
{
"label": "Start Backend (Python)",
"type": "shell",
"command": "/workspaces/NetAlertX/.devcontainer/scripts/restart-backend.sh",
"command": "test ! -d /workspaces && echo not in container && exit 1; /workspaces/NetAlertX/.devcontainer/scripts/restart-backend.sh",
"presentation": {
"echo": true,
"reveal": "always",
@@ -60,7 +62,7 @@
{
"label": "Start Frontend (nginx and PHP-FPM)",
"type": "shell",
"command": "killall php-fpm83 nginx 2>/dev/null || true; sleep 1; php-fpm83 & nginx",
"command": "test ! -d /workspaces && echo not in container && exit 1; killall php-fpm83 nginx 2>/dev/null || true; sleep 1; php-fpm83 & nginx",
"presentation": {
"echo": true,
"reveal": "always",
@@ -77,7 +79,7 @@
{
"label": "Stop Frontend & Backend Services",
"type": "shell",
"command": "pkill -f 'php-fpm83|nginx|crond|python3' || true",
"command": "test ! -d /workspaces && echo not in container && exit 1; pkill -f 'php-fpm83|nginx|crond|python3' || true",
"presentation": {
"echo": true,
"reveal": "always",

77
Dockerfile
View File

@@ -1,8 +1,5 @@
# Builder stage performs venv creation and installs some tools which are not needed in the final image.
# By separating the image, we are able to discard build tools and reduce the final image size.
FROM alpine:3.22 AS builder
ARG INSTALL_DIR=/app
ENV PYTHONUNBUFFERED=1
@@ -14,8 +11,6 @@ RUN apk add --no-cache bash shadow python3 python3-dev gcc musl-dev libffi-dev o
# Enable venv
ENV PATH="/opt/venv/bin:$PATH"
RUN pip install openwrt-luci-rpc asusrouter asyncio aiohttp graphene flask flask-cors unifi-sm-api tplink-omada-client wakeonlan pycryptodome requests paho-mqtt scapy cron-converter pytz json2table dhcp-leases pyunifi speedtest-cli chardet python-nmap dnspython librouteros yattag zeroconf git+https://github.com/foreign-sub/aiofreepybox.git
@@ -23,18 +18,10 @@ RUN pip install openwrt-luci-rpc asusrouter asyncio aiohttp graphene flask flask
# The runner is used for both devcontainer, and as a base for the hardened stage.
FROM alpine:3.22 AS runner
RUN addgroup -g 20211 netalertx && \
adduser -u 20211 -G netalertx -D -h /app netalertx
ARG INSTALL_DIR=/app
# Enable venv
ENV PATH="/opt/venv/bin:/usr/bin:/sbin:/bin:$PATH"
ENV PORT=20211 LISTEN_ADDR=0.0.0.0 GRAPHQL_PORT=20212
# NetAlertX app directories
ENV NETALERTX_APP=/app
ENV NETALERTX_CONFIG=${NETALERTX_APP}/config
@@ -70,34 +57,27 @@ ENV PHP_FPM_CONFIG_FILE=/etc/php83/php-fpm.conf
ENV PHP_WWW_CONF_FILE=/etc/php83/php-fpm.d/www.conf
ENV SYSTEM_SERVICES=/services
#Create netalertx user and group
RUN addgroup -g 20211 netalertx && \
adduser -u 20211 -G netalertx -D -h /app netalertx
RUN apk add --no-cache bash libbsd zip lsblk gettext-envsubst sudo mtr tzdata curl arp-scan iproute2 \
iproute2-ss nmap nmap-scripts traceroute nbtscan openrc dbus net-tools net-snmp-tools bind-tools awake \
ca-certificates sqlite php83 php83-fpm php83-cgi php83-curl php83-sqlite3 php83-session python3 nginx sudo && \
rm -rf /var/cache/apk/* && \
rm -f /etc/nginx/http.d/default.conf
# Install from previous build stage
# Install application, copy files, set permissions
COPY --from=builder /opt/venv /opt/venv
COPY --from=builder /usr/sbin/usermod /usr/sbin/groupmod /usr/sbin/
# Simple copy of directory structure instead of individual files or complicated directory structure with RUN mkdir
COPY --chown=netalertx:netalertx install/alpine-docker/ /
RUN chmod -R a+x ${SYSTEM_SERVICES} /build/ /entrypoint.sh && \
sh -c "find ${NETALERTX_APP} -type d -exec chmod 750 {} \;" && \
sh -c "find ${NETALERTX_APP} -type f -exec chmod 640 {} \;" && \
sh -c "find ${NETALERTX_APP} -type f \( -name '*.sh' -o -name 'speedtest-cli' \) -exec chmod 750 {} \;"
# Copy source
COPY --chown=netalertx:netalertx --chmod=755 back ${NETALERTX_BACK}
COPY --chown=netalertx:netalertx --chmod=755 front ${NETALERTX_FRONT}
COPY --chown=netalertx:netalertx --chmod=755 server ${NETALERTX_SERVER}
# create folders with netalertx user ownership and 755 permissions
RUN install -d -o netalertx -g netalertx -m 755 ${NETALERTX_API}
# Install runtime dependencies
RUN install -d -o netalertx -g netalertx -m 755 ${NETALERTX_API} && \
install -d -o netalertx -g netalertx -m 755 ${NETALERTX_LOG} && \
sh -c "find ${NETALERTX_APP} -type f \( -name '*.sh' -o -name 'speedtest-cli' \) \
-exec chmod 750 {} \;"
#initialize each service with the dockerfiles/init-*.sh scripts, once.
RUN sh /build/init-nginx.sh && \
@@ -106,19 +86,15 @@ RUN sh /build/init-nginx.sh && \
sh /build/init-backend.sh && \
rm -rf /build/*
# set netalertx to allow sudoers for any command, no password
RUN echo "netalertx ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
RUN date +%s > ${INSTALL_DIR}/front/buildtimestamp.txt
ENTRYPOINT ["/bin/sh","-c","sleep infinity"]
# Final hardened stage to improve security by setting correct permissions and removing sudo access
# When complete, if the image is compromised, there's not much that can be done with it.
FROM runner AS hardened
# create readonly user and group with no shell access
RUN addgroup -g 20212 readonly && \
adduser -u 20212 -G readonly -D -h /app readonly
@@ -126,28 +102,23 @@ RUN addgroup -g 20212 readonly && \
# remove netalertx from sudoers
RUN sh -c "sed -i '/netalertx ALL=(ALL) NOPASSWD: ALL/d' /etc/sudoers"
RUN chown -R readonly:readonly ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER} ${SYSTEM_SERVICES} ${NETALERTX_SERVICES}
RUN chmod -R 004 ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER}
RUN chmod 005 ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER}
RUN chmod -R 005 ${SYSTEM_SERVICES} ${NETALERTX_SERVICES}
RUN chown -R netalertx:netalertx ${NETALERTX_CONFIG} ${NETALERTX_DB} ${NETALERTX_API} ${NETALERTX_LOG} && \
RUN chown -R readonly:readonly ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER} ${SYSTEM_SERVICES} ${NETALERTX_SERVICES} && \
chmod -R 004 ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER} && \
chmod 005 ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER} && \
chmod -R 005 ${SYSTEM_SERVICES} ${NETALERTX_SERVICES} && \
chown -R netalertx:netalertx ${NETALERTX_CONFIG} ${NETALERTX_DB} ${NETALERTX_API} ${NETALERTX_LOG} && \
chmod -R 600 ${NETALERTX_CONFIG} ${NETALERTX_DB} {NETALERTX_API} ${NETALERTX_LOG} && \
chmod 700 ${NETALERTX_CONFIG} ${NETALERTX_DB} ${NETALERTX_API} ${NETALERTX_LOG} ${NETALERTX_PLUGINS_LOG}
RUN chown readonly:readonly /
RUN chown -R netalertx:netalertx /var/log/nginx /var/lib/nginx /run
RUN echo -ne '#!/bin/bash\nexit 0\n' > /usr/bin/sudo && chmod +x /usr/bin/sudo
RUN find / -path /proc -prune -o -path /sys -prune -o -path /dev -prune -o -path /run -prune -o -path /var/log -prune -o -path /tmp -prune -o -group 0 -o -user 0 -exec chown readonly:readonly {} +
chmod 700 ${NETALERTX_CONFIG} ${NETALERTX_DB} ${NETALERTX_API} ${NETALERTX_LOG} ${NETALERTX_PLUGINS_LOG} && \
chown readonly:readonly / && \
chown -R netalertx:netalertx /var/log/nginx /var/lib/nginx /run && \
echo -ne '#!/bin/bash\nexit 0\n' > /usr/bin/sudo && chmod +x /usr/bin/sudo && \
find / -path /proc -prune -o -path /sys -prune -o -path /dev -prune -o \
-path /run -prune -o -path /var/log -prune -o -path /tmp -prune -o \
-group 0 -o -user 0 -exec chown readonly:readonly {} +
USER netalertx
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
CMD /usr/local/bin/healthcheck.sh
ENTRYPOINT ["/entrypoint.sh"]
CMD /usr/local/bin/healthcheck.sh
ENTRYPOINT ["/entrypoint.sh"]