mirror of
https://github.com/jokob-sk/NetAlertX.git
synced 2025-12-07 09:36:05 -08:00
All services moved to deployed filesystem
This commit is contained in:
Adam Outler
@@ -1,11 +1,8 @@
|
||||
# DO NOT MODIFY THIS FILE DIRECTLY. IT IS AUTO-GENERATED BY .devcontainer/scripts/generate-dockerfile.sh
|
||||
|
||||
# ---/Dockerfile---
|
||||
# Builder stage performs venv creation and installs some tools which are not needed in the final image.
|
||||
# By separating the image, we are able to discard build tools and reduce the final image size.
|
||||
FROM alpine:3.22 AS builder
|
||||
|
||||
|
||||
ARG INSTALL_DIR=/app
|
||||
|
||||
ENV PYTHONUNBUFFERED=1
|
||||
@@ -17,8 +14,6 @@ RUN apk add --no-cache bash shadow python3 python3-dev gcc musl-dev libffi-dev o
|
||||
# Enable venv
|
||||
ENV PATH="/opt/venv/bin:$PATH"
|
||||
|
||||
|
||||
|
||||
RUN pip install openwrt-luci-rpc asusrouter asyncio aiohttp graphene flask flask-cors unifi-sm-api tplink-omada-client wakeonlan pycryptodome requests paho-mqtt scapy cron-converter pytz json2table dhcp-leases pyunifi speedtest-cli chardet python-nmap dnspython librouteros yattag zeroconf git+https://github.com/foreign-sub/aiofreepybox.git
|
||||
|
||||
|
||||
@@ -26,20 +21,12 @@ RUN pip install openwrt-luci-rpc asusrouter asyncio aiohttp graphene flask flask
|
||||
# The runner is used for both devcontainer, and as a base for the hardened stage.
|
||||
FROM alpine:3.22 AS runner
|
||||
|
||||
RUN addgroup -g 20211 netalertx && \
|
||||
adduser -u 20211 -G netalertx -D -h /app netalertx
|
||||
|
||||
ARG INSTALL_DIR=/app
|
||||
|
||||
|
||||
# Enable venv
|
||||
ENV PATH="/opt/venv/bin:/usr/bin:/sbin:/bin:$PATH"
|
||||
|
||||
|
||||
|
||||
ENV PORT=20211 LISTEN_ADDR=0.0.0.0 GRAPHQL_PORT=20212
|
||||
# NetAlertX app directories
|
||||
ENV NETALERTX_APP=/app
|
||||
ENV NETALERTX_APP=${INSTALL_DIR}
|
||||
ENV NETALERTX_CONFIG=${NETALERTX_APP}/config
|
||||
ENV NETALERTX_FRONT=${NETALERTX_APP}/front
|
||||
ENV NETALERTX_SERVER=${NETALERTX_APP}/server
|
||||
@@ -48,8 +35,6 @@ ENV NETALERTX_DB=${NETALERTX_APP}/db
|
||||
ENV NETALERTX_BACK=${NETALERTX_APP}/back
|
||||
ENV NETALERTX_LOG=${NETALERTX_APP}/log
|
||||
ENV NETALERTX_PLUGINS_LOG=${NETALERTX_LOG}/plugins
|
||||
ENV NETALERTX_NGINIX_CONFIG=${NETALERTX_APP}/services/nginx
|
||||
ENV NETALERTX_SERVICES=${NETALERTX_APP}/services
|
||||
|
||||
# NetAlertX log files
|
||||
ENV LOG_IP_CHANGES=${NETALERTX_LOG}/IP_changes.log
|
||||
@@ -65,84 +50,113 @@ ENV LOG_REPORT_OUTPUT_JSON=${NETALERTX_LOG}/report_output.json
|
||||
ENV LOG_STDOUT=${NETALERTX_LOG}/stdout.log
|
||||
ENV LOG_CROND=${NETALERTX_LOG}/crond.log
|
||||
|
||||
# Important configuration files
|
||||
ENV NGINX_CONFIG_FILE=${NETALERTX_NGINIX_CONFIG}/nginx.conf
|
||||
# System Services configuration files
|
||||
ENV SYSTEM_SERVICES=/services
|
||||
ENV SYSTEM_SERVICES_CONFIG=${SYSTEM_SERVICES}/config
|
||||
ENV SYSTEM_NGINIX_CONFIG=${SYSTEM_SERVICES_CONFIG}/nginx
|
||||
ENV NGINX_CONFIG_FILE=${SYSTEM_NGINIX_CONFIG}/nginx.conf
|
||||
ENV NETALERTX_CONFIG_FILE=${NETALERTX_CONFIG}/app.conf
|
||||
ENV NETALERTX_DB_FILE=${NETALERTX_DB}/app.db
|
||||
ENV PHP_FPM_CONFIG_FILE=/etc/php83/php-fpm.conf
|
||||
ENV PHP_WWW_CONF_FILE=/etc/php83/php-fpm.d/www.conf
|
||||
ENV SYSTEM_SERVICES=/services
|
||||
ENV SYSTEM_SERVICES_PHP_FOLDER=${SYSTEM_SERVICES_CONFIG}/php
|
||||
ENV SYSTEM_SERVICES_PHP_FPM_D=${SYSTEM_SERVICES_PHP_FOLDER}/php-fpm.d
|
||||
ENV SYSTEM_SERVICES_CROND=${SYSTEM_SERVICES_CONFIG}/crond
|
||||
ENV PHP_FPM_CONFIG_FILE=${SYSTEM_SERVICES_PHP_FOLDER}/php-fpm.conf
|
||||
|
||||
RUN apk add --no-cache bash libbsd zip lsblk gettext-envsubst sudo mtr tzdata curl arp-scan iproute2 \
|
||||
iproute2-ss nmap nmap-scripts traceroute nbtscan openrc dbus net-tools net-snmp-tools bind-tools awake \
|
||||
ca-certificates sqlite php83 php83-fpm php83-cgi php83-curl php83-sqlite3 php83-session python3 nginx sudo && \
|
||||
rm -rf /var/cache/apk/* && \
|
||||
rm -f /etc/nginx/http.d/default.conf
|
||||
ENV PYTHONPATH=${NETALERTX_SERVER}
|
||||
|
||||
|
||||
|
||||
RUN apk add --no-cache bash mtr libbsd zip lsblk sudo tzdata curl arp-scan iproute2 \
|
||||
iproute2-ss nmap nmap-scripts traceroute nbtscan net-tools net-snmp-tools bind-tools awake \
|
||||
ca-certificates sqlite php83 php83-fpm php83-cgi php83-curl php83-sqlite3 php83-session python3 \
|
||||
nginx sudo libcap shadow && \
|
||||
rm -rf /var/cache/apk/* && \
|
||||
rm -f /etc/nginx/http.d/default.conf
|
||||
|
||||
#Create netalertx user and group
|
||||
RUN addgroup -g 20211 netalertx && \
|
||||
adduser -u 20211 -D -h ${NETALERTX_APP} -G netalertx netalertx
|
||||
|
||||
# Install application, copy files, set permissions
|
||||
COPY --from=builder /opt/venv /opt/venv
|
||||
COPY --from=builder /usr/sbin/usermod /usr/sbin/groupmod /usr/sbin/
|
||||
COPY --chown=netalertx:netalertx install/alpine-docker/ /
|
||||
COPY --chown=netalertx:netalertx install/production-filesystem/ /
|
||||
COPY --chown=netalertx:netalertx --chmod=755 back ${NETALERTX_BACK}
|
||||
COPY --chown=netalertx:netalertx --chmod=755 front ${NETALERTX_FRONT}
|
||||
COPY --chown=netalertx:netalertx --chmod=755 server ${NETALERTX_SERVER}
|
||||
RUN install -d -o netalertx -g netalertx -m 755 ${NETALERTX_API} && \
|
||||
install -d -o netalertx -g netalertx -m 755 ${NETALERTX_LOG} && \
|
||||
sh -c "find ${NETALERTX_APP} -type f \( -name '*.sh' -o -name 'speedtest-cli' \) \
|
||||
-exec chmod 750 {} \;"
|
||||
-exec chmod 750 {} \;"
|
||||
|
||||
# setcap to allow network tools with raw packet access to run without root
|
||||
RUN setcap cap_net_raw,cap_net_admin+eip /usr/bin/nmap && \
|
||||
setcap cap_net_raw,cap_net_admin+eip /usr/bin/arp-scan && \
|
||||
setcap cap_net_raw,cap_net_admin+eip /usr/bin/traceroute && \
|
||||
setcap cap_net_raw,cap_net_admin+eip /opt/venv/bin/scapy
|
||||
|
||||
#initialize each service with the dockerfiles/init-*.sh scripts, once.
|
||||
RUN sh /build/init-nginx.sh && \
|
||||
sh /build/init-php-fpm.sh && \
|
||||
sh /build/init-crond.sh && \
|
||||
sh /build/init-backend.sh && \
|
||||
rm -rf /build/*
|
||||
|
||||
RUN /bin/sh /build/init-nginx.sh && \
|
||||
/bin/sh /build/init-php-fpm.sh && \
|
||||
/bin/sh /build/init-crond.sh && \
|
||||
/bin/sh /build/init-backend.sh && \
|
||||
rm -rf /build
|
||||
|
||||
# set netalertx to allow sudoers for any command, no password
|
||||
RUN echo "netalertx ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
|
||||
|
||||
ENTRYPOINT ["/bin/sh","-c","sleep infinity"]
|
||||
|
||||
# Final hardened stage to improve security by setting correct permissions and removing sudo access
|
||||
# When complete, if the image is compromised, there's not much that can be done with it.
|
||||
FROM runner AS hardened
|
||||
|
||||
|
||||
# create readonly user and group with no shell access
|
||||
RUN addgroup -g 20212 readonly && \
|
||||
adduser -u 20212 -G readonly -D -h /app readonly
|
||||
|
||||
adduser -u 20212 -G readonly -D -h /app readonly && \
|
||||
usermod -s /sbin/nologin readonly
|
||||
|
||||
|
||||
# remove netalertx from sudoers
|
||||
RUN sh -c "sed -i '/netalertx ALL=(ALL) NOPASSWD: ALL/d' /etc/sudoers"
|
||||
|
||||
RUN chown -R readonly:readonly ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER} ${SYSTEM_SERVICES} ${NETALERTX_SERVICES}
|
||||
RUN chmod -R 004 ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER}
|
||||
RUN chmod 005 ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER}
|
||||
RUN chmod -R 005 ${SYSTEM_SERVICES} ${NETALERTX_SERVICES}
|
||||
RUN chown -R readonly:readonly ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER} ${SYSTEM_SERVICES} ${SYSTEM_SERVICES} && \
|
||||
chmod -R 004 ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER} && \
|
||||
find ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER} -type d -exec chmod 005 {} + && \
|
||||
chmod -R 005 ${SYSTEM_SERVICES} ${SYSTEM_SERVICES}/* && \
|
||||
chown -R netalertx:netalertx ${NETALERTX_CONFIG} ${NETALERTX_DB} ${NETALERTX_API} ${NETALERTX_LOG} && \
|
||||
chmod -R 600 ${NETALERTX_CONFIG} ${NETALERTX_DB} ${NETALERTX_API} ${NETALERTX_LOG} && \
|
||||
chmod 700 ${NETALERTX_CONFIG} ${NETALERTX_DB} ${NETALERTX_API} ${NETALERTX_LOG} ${NETALERTX_PLUGINS_LOG} && \
|
||||
chown readonly:readonly / && \
|
||||
chown -R netalertx:netalertx /var/log/nginx /var/lib/nginx /run && \
|
||||
find / -path /proc -prune -o -path /sys -prune -o -path /dev -prune -o \
|
||||
-path /run -prune -o -path /var/log -prune -o -path /tmp -prune -o \
|
||||
-group 0 -o -user 0 -exec chown readonly:readonly {} +
|
||||
|
||||
RUN chown -R netalertx:netalertx ${NETALERTX_CONFIG} ${NETALERTX_DB} ${NETALERTX_API} ${NETALERTX_LOG} && \
|
||||
chmod -R 600 ${NETALERTX_CONFIG} ${NETALERTX_DB} {NETALERTX_API} ${NETALERTX_LOG} && \
|
||||
chmod 700 ${NETALERTX_CONFIG} ${NETALERTX_DB} ${NETALERTX_API} ${NETALERTX_LOG} ${NETALERTX_PLUGINS_LOG}
|
||||
#
|
||||
# remove sudo and alpine installers pacakges
|
||||
RUN apk del sudo libcap apk-tools && \
|
||||
rm -rf /var/cache/apk/*
|
||||
# remove all users and groups except readonly and netalertx without userdel/groupdel binaries
|
||||
# RUN awk -F: '($1 != "readonly" && $1 != "netalertx") {print $1}' /etc/passwd | xargs -r -n 1 deluser -r && \
|
||||
# awk -F: '($1 != "readonly" && $1 != "netalertx") {print $1}' /etc/group | xargs -r -n 1 delgroup
|
||||
# Remove all sudoers
|
||||
RUN rm -Rf /etc/sudoers.d/* /etc/shadow /etc/gshadow /etc/sudoers \
|
||||
/lib/apk /lib/firmware /lib/modules-load.d /lib/sysctl.d /mnt /home/ /root \
|
||||
/srv /media && \
|
||||
sed -i -n -e '/^readonly:/p' -e '/^netalertx:/p' /etc/passwd && \
|
||||
sed -i -n -e '/^readonly:/p' -e '/^netalertx:/p' /etc/group && \
|
||||
echo -ne '#!/bin/sh\n"$@"\n' > /usr/bin/sudo && chmod +x /usr/bin/sudo
|
||||
|
||||
|
||||
RUN chown readonly:readonly /
|
||||
RUN chown -R netalertx:netalertx /var/log/nginx /var/lib/nginx /run
|
||||
RUN echo -ne '#!/bin/bash\nexit 0\n' > /usr/bin/sudo && chmod +x /usr/bin/sudo
|
||||
|
||||
RUN find / -path /proc -prune -o -path /sys -prune -o -path /dev -prune -o -path /run -prune -o -path /var/log -prune -o -path /tmp -prune -o -group 0 -o -user 0 -exec chown readonly:readonly {} +
|
||||
|
||||
|
||||
USER netalertx
|
||||
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
|
||||
CMD /usr/local/bin/healthcheck.sh
|
||||
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
|
||||
CMD /usr/local/bin/healthcheck.sh
|
||||
|
||||
#ENTRYPOINT [ "/bin/sh" ]
|
||||
ENTRYPOINT [ "/bin/sh", "/entrypoint.sh" ]
|
||||
|
||||
# ---/resources/devcontainer-Dockerfile---
|
||||
|
||||
@@ -153,25 +167,17 @@ ENTRYPOINT ["/entrypoint.sh"]
|
||||
# Prefer to place dev-only setup here; use setup.sh only for runtime fixes.
|
||||
|
||||
FROM runner AS netalertx-devcontainer
|
||||
USER root
|
||||
ENV INSTALL_DIR=/app
|
||||
ENV PYTHONPATH=/workspaces/NetAlertX/test:/workspaces/NetAlertX/server:/app:/app/server:/opt/venv/lib/python3.12/site-packages
|
||||
ENV HOME=/workspaces
|
||||
|
||||
COPY .devcontainer/resources/99-xdebug.ini /etc/php83/conf.d/99-xdebug.ini
|
||||
|
||||
# Install common tools, create user, and set up sudo
|
||||
RUN apk add --no-cache git nano vim jq php83-pecl-xdebug py3-pip nodejs sudo gpgconf pytest pytest-cov shadow github-cli fish
|
||||
|
||||
RUN apk add --no-cache git nano vim jq php83-pecl-xdebug py3-pip nodejs sudo gpgconf pytest pytest-cov
|
||||
|
||||
# Install debugpy in the virtualenv if present, otherwise into system python3
|
||||
RUN /bin/sh -c '(/opt/venv/bin/python3 -m pip install --no-cache-dir debugpy) || (python3 -m pip install --no-cache-dir debugpy) || true'
|
||||
RUN /opt/venv/bin/python -m pip install -U pytest pytest-cov
|
||||
RUN python -m pip install -U pytest pytest-cov
|
||||
|
||||
USER netalertx
|
||||
|
||||
WORKDIR /workspaces/
|
||||
RUN mkdir -p /workspaces && \
|
||||
sudo chmod 777 /workspaces
|
||||
|
||||
USER netalertx
|
||||
ENTRYPOINT ["/bin/sh","-c","sleep infinity"]
|
||||
|
||||
Reference in New Issue
Block a user