Signed-off-by: jokob-sk <jokob.sk@gmail.com>
This commit is contained in:
jokob-sk
2026-01-13 20:16:43 +11:00
parent 0eb2368712
commit 5eaeffca04
72 changed files with 336 additions and 336 deletions

View File

@@ -33,7 +33,7 @@ NSLOOKUP_RUN='before_name_updates'
AVAHISCAN_RUN='before_name_updates'
NBTSCAN_RUN='before_name_updates'
# Email
# Email
#-------------------------------------
# (add SMTP to LOADED_PLUGINS to load)
#-------------------------------------
@@ -48,20 +48,20 @@ SMTP_PASS='password'
SMTP_SKIP_TLS=False
# Webhook
# Webhook
#-------------------------------------
# (add WEBHOOK to LOADED_PLUGINS to load)
#-------------------------------------
WEBHOOK_RUN='disabled' # use 'on_notification' to enable
WEBHOOK_URL='http://n8n.local:5555/webhook-test/aaaaaaaa-aaaa-aaaa-aaaaa-aaaaaaaaaaaa'
WEBHOOK_PAYLOAD='json' # webhook payload data format for the "body > attachements > text" attribute
# in https://github.com/jokob-sk/NetAlertX/blob/main/docs/webhook_json_sample.json
WEBHOOK_PAYLOAD='json' # webhook payload data format for the "body > attachements > text" attribute
# supported values: 'json', 'html' or 'text'
# e.g.: for discord use 'html'
WEBHOOK_REQUEST_METHOD='GET'
# Apprise
# Apprise
#-------------------------------------
# (add APPRISE to LOADED_PLUGINS to load)
#-------------------------------------
@@ -71,7 +71,7 @@ APPRISE_URL='mailto://smtp-relay.sendinblue.com:587?from=user@gmail.com&name=app
# NTFY
#-------------------------------------
#-------------------------------------
# (add NTFY to LOADED_PLUGINS to load)
#-------------------------------------
NTFY_RUN='disabled' # use 'on_notification' to enable
@@ -81,7 +81,7 @@ NTFY_USER='user'
NTFY_PASSWORD='passw0rd'
# PUSHSAFER
# PUSHSAFER
#-------------------------------------
# (add PUSHSAFER to LOADED_PLUGINS to load)
#-------------------------------------
@@ -89,7 +89,7 @@ PUSHSAFER_RUN='disabled' # use 'on_notification' to enable
PUSHSAFER_TOKEN='ApiKey'
# MQTT
# MQTT
#-------------------------------------
# (add MQTT to LOADED_PLUGINS to load)
#-------------------------------------

View File

@@ -90,7 +90,7 @@ has_cap 7 || missing_admin="${missing_admin} SETUID"
if [ -n "${missing_admin}" ]; then
printf "%sSecurity context: Operational capabilities (%s) not granted.%s\n" "${GREY}" "${missing_admin# }" "${RESET}"
if echo "${missing_admin}" | grep -q "CHOWN"; then
printf "%sSee https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/missing-capabilities.md%s\n" "${GREY}" "${RESET}"
printf "%sSee https://docs.netalertx.com/docker-troubleshooting/missing-capabilities%s\n" "${GREY}" "${RESET}"
fi
fi
@@ -107,7 +107,7 @@ if [ "${storage_driver}" = "aufs" ] && [ "${runtime_uid}" -ne 0 ]; then
nbtscan fail when NetAlertX runs as a non-root PUID.
Set PUID=0 on AUFS hosts for full functionality:
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/aufs-capabilities.md
https://docs.netalertx.com/docker-troubleshooting/aufs-capabilities
══════════════════════════════════════════════════════════════════════════════
EOF
printf "%s" "${RESET}"

View File

@@ -257,8 +257,8 @@ def print_warning_message(results: list[MountCheckResult]):
"\n We recommend starting with the default docker-compose.yml as the\n"
" configuration can be quite complex.\n\n"
" Review the documentation for a correct setup:\n"
" https://github.com/jokob-sk/NetAlertX/blob/main/docs/DOCKER_COMPOSE.md\n"
" https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/mount-configuration-issues.md\n"
" https://docs.netalertx.com/DOCKER_COMPOSE\n"
" https://docs.netalertx.com/docker-troubleshooting/mount-configuration-issues\n"
"══════════════════════════════════════════════════════════════════════════════\n"
)

View File

@@ -25,7 +25,7 @@ if [ ! -d "${NETALERTX_DB}" ]; then
A database directory is required for proper operation, however there appear to be
insufficient permissions on this mount or it is otherwise inaccessible.
More info: https://github.com/jokob-sk/NetAlertX/blob/main/docs/FILE_PERMISSIONS.md
More info: https://docs.netalertx.com/FILE_PERMISSIONS
══════════════════════════════════════════════════════════════════════════════
EOF
>&2 printf "%s" "${RESET}"

View File

@@ -34,7 +34,7 @@ for path in $READ_WRITE_PATHS; do
The required path "${path}" could not be found. The application
cannot start without its complete directory structure.
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/file-permissions.md
https://docs.netalertx.com/docker-troubleshooting/file-permissions
══════════════════════════════════════════════════════════════════════════════
EOF
>&2 printf "%s" "${RESET}"
@@ -49,7 +49,7 @@ EOF
This prevents NetAlertX from reading the configuration and indicates a
permissions or mount issue — often seen when running with custom UID/GID.
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/file-permissions.md
https://docs.netalertx.com/docker-troubleshooting/file-permissions
══════════════════════════════════════════════════════════════════════════════
EOF
>&2 printf "%s" "${RESET}"
@@ -63,7 +63,7 @@ EOF
The application cannot read from "${path}". This will cause
unpredictable errors. Please correct the file system permissions.
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/file-permissions.md
https://docs.netalertx.com/docker-troubleshooting/file-permissions
══════════════════════════════════════════════════════════════════════════════
EOF
>&2 printf "%s" "${RESET}"
@@ -80,7 +80,7 @@ EOF
To fix this automatically, restart the container with root privileges
(e.g., remove the "user:" directive in your Docker Compose file).
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/file-permissions.md
https://docs.netalertx.com/docker-troubleshooting/file-permissions
══════════════════════════════════════════════════════════════════════════════
EOF
>&2 printf "%s" "${RESET}"

View File

@@ -27,7 +27,7 @@ if [ ! -d "${CONF_ACTIVE_DIR}" ]; then
--mount type=bind,src=/path/on/host,dst=${CONF_ACTIVE_DIR}
and ensure it is owned by the netalertx user (20211:20211) with 700 perms.
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/nginx-configuration-mount.md
https://docs.netalertx.com/docker-troubleshooting/nginx-configuration-mount
══════════════════════════════════════════════════════════════════════════════
EOF
>&2 printf "%s" "${RESET}"
@@ -49,7 +49,7 @@ if ! ( : >"${TMP_FILE}" ) 2>/dev/null; then
find ${CONF_ACTIVE_DIR} -type d -exec chmod 700 {} +
find ${CONF_ACTIVE_DIR} -type f -exec chmod 600 {} +
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/nginx-configuration-mount.md
https://docs.netalertx.com/docker-troubleshooting/nginx-configuration-mount
══════════════════════════════════════════════════════════════════════════════
EOF
>&2 printf "%s" "${RESET}"

View File

@@ -59,7 +59,7 @@ RESET=$(printf '\033[0m')
docker run --network=host --cap-add=NET_RAW --cap-add=NET_ADMIN --cap-add=NET_BIND_SERVICE
or set "network_mode: host" in docker-compose.yml.
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/network-mode.md
https://docs.netalertx.com/docker-troubleshooting/network-mode
══════════════════════════════════════════════════════════════════════════════
EOF
>&2 printf "%s" "${RESET}"

View File

@@ -12,7 +12,7 @@ if [ "${NETALERTX_DEBUG}" = "1" ]; then
fi
# Get bounding capabilities from /proc/self/status (what can be acquired)
BND_HEX=$(grep '^CapBnd:' /proc/self/status 2>/dev/null | awk '{print $2}' | tr -d '\t')
BND_HEX=$(grep '^CapBnd:' /proc/self/status 2>/dev/null | awk '{print $2}' | tr -d '\t')
if [ -z "$BND_HEX" ]; then
exit 0
@@ -32,10 +32,10 @@ if [ "$EXTRA" -ne 0 ]; then
══════════════════════════════════════════════════════════════════════════════
⚠️ Warning: Excessive capabilities detected (bounding caps: 0x$BND_HEX).
Only CHOWN, SETGID, SETUID, NET_ADMIN, NET_BIND_SERVICE, and NET_RAW are
Only CHOWN, SETGID, SETUID, NET_ADMIN, NET_BIND_SERVICE, and NET_RAW are
required in this container. Please remove unnecessary capabilities.
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/excessive-capabilities.md
https://docs.netalertx.com/docker-troubleshooting/excessive-capabilities
══════════════════════════════════════════════════════════════════════════════
EOF
fi

View File

@@ -15,7 +15,7 @@ if ! awk '$2 == "/" && $4 ~ /ro/ {found=1} END {exit !found}' /proc/mounts; then
⚠️ Warning: Container is running as read-write, not in read-only mode.
Please mount the root filesystem as --read-only or use read_only: true
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/read-only-filesystem.md
https://docs.netalertx.com/docker-troubleshooting/read-only-filesystem
══════════════════════════════════════════════════════════════════════════════
EOF

View File

@@ -22,7 +22,7 @@ if [ "${PORT_APP}" -eq "${PORT_GQL}" ]; then
The Application port (\$PORT) and the GraphQL API port (\$GRAPHQL_PORT)
are configured to use the same port. This will cause a conflict.
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/port-conflicts.md
https://docs.netalertx.com/docker-troubleshooting/port-conflicts
══════════════════════════════════════════════════════════════════════════════
EOF
fi
@@ -53,7 +53,7 @@ if echo "$LISTENING_PORTS" | grep -q ":${PORT_APP}$"; then
The main application (defined by \$PORT) may fail to start.
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/port-conflicts.md
https://docs.netalertx.com/docker-troubleshooting/port-conflicts
══════════════════════════════════════════════════════════════════════════════
EOF
fi
@@ -67,7 +67,7 @@ if echo "$LISTENING_PORTS" | grep -q ":${PORT_GQL}$"; then
The GraphQL API (defined by \$APP_CONF_OVERRIDE or \$GRAPHQL_PORT)
may fail to start.
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/port-conflicts.md
https://docs.netalertx.com/docker-troubleshooting/port-conflicts
══════════════════════════════════════════════════════════════════════════════
EOF
fi

View File

@@ -65,14 +65,14 @@ RESET='\033[0m'
NAX='
_ _ _ ___ _ _ __ __
| \ | | | | / _ \| | | | \ \ / /
| \| | ___| |_/ /_\ \ | ___ _ __| |_ \ V /
| . |/ _ \ __| _ | |/ _ \ __| __|/ \
| |\ | __/ |_| | | | | __/ | | |_/ /^\ \
| \| | ___| |_/ /_\ \ | ___ _ __| |_ \ V /
| . |/ _ \ __| _ | |/ _ \ __| __|/ \
| |\ | __/ |_| | | | | __/ | | |_/ /^\ \
\_| \_/\___|\__\_| |_/_|\___|_| \__\/ \/
'
printf "%b%s%b" "${RED}" "${NAX}" "${RESET}"
echo ' Network intruder and presence detector.
echo ' Network intruder and presence detector.
https://netalertx.com
'
@@ -99,7 +99,6 @@ for script in "${ENTRYPOINT_CHECKS}"/*; do
>&2 cat <<EOF
══════════════════════════════════════════════════════════════════════════════
❌ NetAlertX startup aborted: critical failure in ${script_name}.
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/troubleshooting.md
══════════════════════════════════════════════════════════════════════════════
EOF
>&2 printf "%s" "${RESET}"
@@ -322,7 +321,7 @@ while [ -n "${SERVICES}" ]; do
FAILED_STATUS=$status
FAILED_NAME="${name}"
remove_service "${pid}"
if [ "${NETALERTX_DEBUG:-0}" -eq 1 ]; then
echo "⚠️ Service ${name} exited with status ${status}. Debug mode active - continuing."
else

View File

@@ -79,7 +79,7 @@ if [ "${STORAGE_DRIVER}" = "aufs" ]; then
AUFS strips file capabilities (setcap) during image extraction which breaks
layer-2 scanners (arp-scan, etc.) when running as non-root.
Action: set PUID=0 (root) on AUFS hosts or migrate to a supported driver.
Details: https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/aufs-capabilities.md
Details: https://docs.netalertx.com/docker-troubleshooting/aufs-capabilities
EOF
fi
@@ -99,7 +99,7 @@ ${body}
══════════════════════════════════════════════════════════════════════════════
EOF
>&2 printf "%s" "${RESET}"
}
_validate_id() {
@@ -107,10 +107,10 @@ _validate_id() {
name="$2"
if ! printf '%s' "${value}" | grep -qxE '[0-9]+'; then
_error_msg "INVALID ${name} VALUE (non-numeric)" \
" Startup halted because the provided ${name} environmental variable
" Startup halted because the provided ${name} environmental variable
contains non-digit characters.
Action: set a numeric ${name} (for example: ${name}=1000) in your environment
Action: set a numeric ${name} (for example: ${name}=1000) in your environment
or docker-compose file. Default: 20211."
exit 1
fi
@@ -123,7 +123,7 @@ _cap_bits_warn_missing_setid() {
cap_hex=$(awk '/CapEff/ {print $2}' /proc/self/status 2>/dev/null || echo "")
[ -n "${cap_hex}" ] || return
cap_dec=$((0x${cap_hex}))
has_setgid=0; has_setuid=0; has_net_caps=0
# Bit masks (use numeric constants to avoid editor/HL issues and improve clarity)
@@ -160,7 +160,7 @@ if [ "$(id -u)" -ne 0 ]; then
Because the container is not running as root, it cannot fix these
permissions automatically.
Action:
1. Update Host Volume permissions (e.g. 'chmod 755 ${path}' on host).
2. Or, run container as root (user: 0) and let PUID/PGID logic handle it."