diff --git a/ubuntu-post-install-24.04.sh b/ubuntu-post-install-24.04.sh index 8589543..c79410f 100644 --- a/ubuntu-post-install-24.04.sh +++ b/ubuntu-post-install-24.04.sh @@ -4850,6 +4850,167 @@ EOF fi fi + # ---- CADDY WEB SERVER ---- + if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_CADDY" ]; then + echo "" + echo "┌─────────────────────────────────────────────────────────────────┐" + echo "│ CADDY - Modern Web Server & Reverse Proxy │" + echo "│ Automatic HTTPS, reverse proxy for all your services │" + echo "│ Port: 80 (HTTP), 443 (HTTPS) │" + echo "└─────────────────────────────────────────────────────────────────┘" + prompt_yn "Install Caddy reverse proxy? (y/n):" "n" INSTALL_CADDY + fi + + if [ "$INSTALL_CADDY" = "y" ] || [ "$INSTALL_CADDY" = "Y" ]; then + CADDY_DIR="$DOCKER_DIR/caddy" + + # Check if Caddy is already installed + if [ -f "$CADDY_DIR/Caddyfile" ] || [ -f "$CADDY_DIR/docker-compose.yml" ]; then + echo "" + echo "⚠ Caddy appears to be already installed at $CADDY_DIR" + prompt_yn "Do you want to reconfigure it? (y/n):" "n" RECONFIGURE_CADDY + if [ "$RECONFIGURE_CADDY" != "y" ] && [ "$RECONFIGURE_CADDY" != "Y" ]; then + echo " Skipping Caddy installation" + INSTALL_CADDY="n" + fi + fi + + if [ "$INSTALL_CADDY" = "y" ] || [ "$INSTALL_CADDY" = "Y" ]; then + if [ "$DRY_RUN" = true ]; then + echo "[DRY-RUN] Would create $CADDY_DIR" + else + echo "Installing Caddy..." + mkdir -p "$CADDY_DIR/data" "$CADDY_DIR/config" + ensure_docker_dir_ownership "$CADDY_DIR" + + # Backup existing Caddyfile if it exists + if [ -f "$CADDY_DIR/Caddyfile" ]; then + mkdir -p "$CADDY_DIR/backups" + BACKUP_FILE="$CADDY_DIR/backups/Caddyfile.backup.$(date +%Y%m%d_%H%M%S)" + cp "$CADDY_DIR/Caddyfile" "$BACKUP_FILE" + echo " ✓ Backed up existing Caddyfile to: $BACKUP_FILE" + fi + + cd "$CADDY_DIR" + + cat > docker-compose.yml << 'CADDY_COMPOSE' +name: caddy + +services: + caddy: + image: caddy:latest + container_name: caddy + restart: unless-stopped + ports: + - "80:80" + - "443:443" + - "443:443/udp" # HTTP/3 + volumes: + - ./Caddyfile:/etc/caddy/Caddyfile + - ./data:/data + - ./config:/config + - /var/log/caddy:/var/log/caddy + environment: + - ACME_AGREE=true + labels: + - "io.podman.annotations.label/fail2ban.enable=true" +CADDY_COMPOSE + + # Create Caddyfile if it doesn't exist + if [ ! -f "Caddyfile" ]; then + cat > Caddyfile << 'CADDYFILE' +{ + # Global options + admin off + # Email for Let's Encrypt notifications + # email admin@yourdomain.com +} + +# Example configuration - edit this for your services +# Uncomment and modify these examples: + +# ── Authelia SSO snippet (auto-added by installer if Authelia is installed) ─── +# (authelia) { +# forward_auth authelia:9091 { +# uri /api/authz/forward-auth +# copy_headers Remote-User Remote-Groups Remote-Name Remote-Email +# } +# } +# +# Authelia login portal +# auth.yourdomain.com { +# reverse_proxy authelia:9091 +# } +# +# To protect any service with Authelia, add: import authelia +# Example: +# myservice.yourdomain.com { +# import authelia +# reverse_proxy localhost:PORT +# } + +# ActualBudget +# budget.yourdomain.com { +# log { +# output file /var/log/caddy/actualbudget-access.log +# format json +# level INFO +# } +# reverse_proxy localhost:5006 +# header { +# Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" +# X-Frame-Options "SAMEORIGIN" +# X-Content-Type-Options "nosniff" +# X-XSS-Protection "1; mode=block" +# Referrer-Policy "strict-origin-when-cross-origin" +# } +# } + +# Keycloak +# auth.yourdomain.com { +# log { +# output file /var/log/caddy/keycloak-access.log +# format json +# level INFO +# } +# reverse_proxy localhost:8180 +# header { +# Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" +# X-Frame-Options "SAMEORIGIN" +# X-Content-Type-Options "nosniff" +# X-XSS-Protection "1; mode=block" +# Referrer-Policy "strict-origin-when-cross-origin" +# } +# } + +# Add more services here... +CADDYFILE + echo " ✓ Created example Caddyfile" + else + echo " ℹ Using existing Caddyfile" + fi + + echo " ✓ Caddy configured at $CADDY_DIR" + + prompt_yn "Start Caddy now? (y/n):" "y" START_CADDY + if [ "$START_CADDY" = "y" ] || [ "$START_CADDY" = "Y" ]; then + docker compose up -d 2>/dev/null && echo " ✓ Caddy started" || echo " ⚠ Failed to start Caddy" + fi + + echo "" + echo " Configuration file: $CADDY_DIR/Caddyfile" + echo " Edit Caddyfile to add your domains and services" + echo " Reload config: cd $CADDY_DIR && docker exec -w /etc/caddy caddy caddy reload" + echo "" + echo " ⚠ IMPORTANT: Edit the Caddyfile to configure your domains!" + echo " - Uncomment and modify the example configurations" + echo " - Add your domain names" + echo " - Configure services you want to expose" + echo "" + fi + fi + fi + # ---- AUTHELIA ---- if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_AUTHELIA" ]; then echo "" @@ -5149,167 +5310,6 @@ CADDY_AUTH_BLOCK fi # End AUTHELIA_RECONFIGURE check fi # End INSTALL_AUTHELIA check - # ---- CADDY WEB SERVER ---- - if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_CADDY" ]; then - echo "" - echo "┌─────────────────────────────────────────────────────────────────┐" - echo "│ CADDY - Modern Web Server & Reverse Proxy │" - echo "│ Automatic HTTPS, reverse proxy for all your services │" - echo "│ Port: 80 (HTTP), 443 (HTTPS) │" - echo "└─────────────────────────────────────────────────────────────────┘" - prompt_yn "Install Caddy reverse proxy? (y/n):" "n" INSTALL_CADDY - fi - - if [ "$INSTALL_CADDY" = "y" ] || [ "$INSTALL_CADDY" = "Y" ]; then - CADDY_DIR="$DOCKER_DIR/caddy" - - # Check if Caddy is already installed - if [ -f "$CADDY_DIR/Caddyfile" ] || [ -f "$CADDY_DIR/docker-compose.yml" ]; then - echo "" - echo "⚠ Caddy appears to be already installed at $CADDY_DIR" - prompt_yn "Do you want to reconfigure it? (y/n):" "n" RECONFIGURE_CADDY - if [ "$RECONFIGURE_CADDY" != "y" ] && [ "$RECONFIGURE_CADDY" != "Y" ]; then - echo " Skipping Caddy installation" - INSTALL_CADDY="n" - fi - fi - - if [ "$INSTALL_CADDY" = "y" ] || [ "$INSTALL_CADDY" = "Y" ]; then - if [ "$DRY_RUN" = true ]; then - echo "[DRY-RUN] Would create $CADDY_DIR" - else - echo "Installing Caddy..." - mkdir -p "$CADDY_DIR/data" "$CADDY_DIR/config" - ensure_docker_dir_ownership "$CADDY_DIR" - - # Backup existing Caddyfile if it exists - if [ -f "$CADDY_DIR/Caddyfile" ]; then - mkdir -p "$CADDY_DIR/backups" - BACKUP_FILE="$CADDY_DIR/backups/Caddyfile.backup.$(date +%Y%m%d_%H%M%S)" - cp "$CADDY_DIR/Caddyfile" "$BACKUP_FILE" - echo " ✓ Backed up existing Caddyfile to: $BACKUP_FILE" - fi - - cd "$CADDY_DIR" - - cat > docker-compose.yml << 'CADDY_COMPOSE' -name: caddy - -services: - caddy: - image: caddy:latest - container_name: caddy - restart: unless-stopped - ports: - - "80:80" - - "443:443" - - "443:443/udp" # HTTP/3 - volumes: - - ./Caddyfile:/etc/caddy/Caddyfile - - ./data:/data - - ./config:/config - - /var/log/caddy:/var/log/caddy - environment: - - ACME_AGREE=true - labels: - - "io.podman.annotations.label/fail2ban.enable=true" -CADDY_COMPOSE - - # Create Caddyfile if it doesn't exist - if [ ! -f "Caddyfile" ]; then - cat > Caddyfile << 'CADDYFILE' -{ - # Global options - admin off - # Email for Let's Encrypt notifications - # email admin@yourdomain.com -} - -# Example configuration - edit this for your services -# Uncomment and modify these examples: - -# ── Authelia SSO snippet (auto-added by installer if Authelia is installed) ─── -# (authelia) { -# forward_auth authelia:9091 { -# uri /api/authz/forward-auth -# copy_headers Remote-User Remote-Groups Remote-Name Remote-Email -# } -# } -# -# Authelia login portal -# auth.yourdomain.com { -# reverse_proxy authelia:9091 -# } -# -# To protect any service with Authelia, add: import authelia -# Example: -# myservice.yourdomain.com { -# import authelia -# reverse_proxy localhost:PORT -# } - -# ActualBudget -# budget.yourdomain.com { -# log { -# output file /var/log/caddy/actualbudget-access.log -# format json -# level INFO -# } -# reverse_proxy localhost:5006 -# header { -# Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" -# X-Frame-Options "SAMEORIGIN" -# X-Content-Type-Options "nosniff" -# X-XSS-Protection "1; mode=block" -# Referrer-Policy "strict-origin-when-cross-origin" -# } -# } - -# Keycloak -# auth.yourdomain.com { -# log { -# output file /var/log/caddy/keycloak-access.log -# format json -# level INFO -# } -# reverse_proxy localhost:8180 -# header { -# Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" -# X-Frame-Options "SAMEORIGIN" -# X-Content-Type-Options "nosniff" -# X-XSS-Protection "1; mode=block" -# Referrer-Policy "strict-origin-when-cross-origin" -# } -# } - -# Add more services here... -CADDYFILE - echo " ✓ Created example Caddyfile" - else - echo " ℹ Using existing Caddyfile" - fi - - echo " ✓ Caddy configured at $CADDY_DIR" - - prompt_yn "Start Caddy now? (y/n):" "y" START_CADDY - if [ "$START_CADDY" = "y" ] || [ "$START_CADDY" = "Y" ]; then - docker compose up -d 2>/dev/null && echo " ✓ Caddy started" || echo " ⚠ Failed to start Caddy" - fi - - echo "" - echo " Configuration file: $CADDY_DIR/Caddyfile" - echo " Edit Caddyfile to add your domains and services" - echo " Reload config: cd $CADDY_DIR && docker exec -w /etc/caddy caddy caddy reload" - echo "" - echo " ⚠ IMPORTANT: Edit the Caddyfile to configure your domains!" - echo " - Uncomment and modify the example configurations" - echo " - Add your domain names" - echo " - Configure services you want to expose" - echo "" - fi - fi - fi - # ---- FAIL2BAN ---- if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_FAIL2BAN" ]; then echo "" diff --git a/ubuntu-post-install-26.04.sh b/ubuntu-post-install-26.04.sh index 52da507..7c90f0f 100644 --- a/ubuntu-post-install-26.04.sh +++ b/ubuntu-post-install-26.04.sh @@ -4850,6 +4850,147 @@ EOF fi fi + # ---- CADDY WEB SERVER ---- + if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_CADDY" ]; then + echo "" + echo "┌─────────────────────────────────────────────────────────────────┐" + echo "│ CADDY - Modern Web Server & Reverse Proxy │" + echo "│ Automatic HTTPS, reverse proxy for all your services │" + echo "│ Port: 80 (HTTP), 443 (HTTPS) │" + echo "└─────────────────────────────────────────────────────────────────┘" + prompt_yn "Install Caddy reverse proxy? (y/n):" "n" INSTALL_CADDY + fi + + if [ "$INSTALL_CADDY" = "y" ] || [ "$INSTALL_CADDY" = "Y" ]; then + CADDY_DIR="$DOCKER_DIR/caddy" + + # Check if Caddy is already installed + if [ -f "$CADDY_DIR/Caddyfile" ] || [ -f "$CADDY_DIR/docker-compose.yml" ]; then + echo "" + echo "⚠ Caddy appears to be already installed at $CADDY_DIR" + prompt_yn "Do you want to reconfigure it? (y/n):" "n" RECONFIGURE_CADDY + if [ "$RECONFIGURE_CADDY" != "y" ] && [ "$RECONFIGURE_CADDY" != "Y" ]; then + echo " Skipping Caddy installation" + INSTALL_CADDY="n" + fi + fi + + if [ "$INSTALL_CADDY" = "y" ] || [ "$INSTALL_CADDY" = "Y" ]; then + if [ "$DRY_RUN" = true ]; then + echo "[DRY-RUN] Would create $CADDY_DIR" + else + echo "Installing Caddy..." + mkdir -p "$CADDY_DIR/data" "$CADDY_DIR/config" + ensure_docker_dir_ownership "$CADDY_DIR" + + # Backup existing Caddyfile if it exists + if [ -f "$CADDY_DIR/Caddyfile" ]; then + mkdir -p "$CADDY_DIR/backups" + BACKUP_FILE="$CADDY_DIR/backups/Caddyfile.backup.$(date +%Y%m%d_%H%M%S)" + cp "$CADDY_DIR/Caddyfile" "$BACKUP_FILE" + echo " ✓ Backed up existing Caddyfile to: $BACKUP_FILE" + fi + + cd "$CADDY_DIR" + + cat > docker-compose.yml << 'CADDY_COMPOSE' +name: caddy + +services: + caddy: + image: caddy:latest + container_name: caddy + restart: unless-stopped + ports: + - "80:80" + - "443:443" + - "443:443/udp" # HTTP/3 + volumes: + - ./Caddyfile:/etc/caddy/Caddyfile + - ./data:/data + - ./config:/config + - /var/log/caddy:/var/log/caddy + environment: + - ACME_AGREE=true + labels: + - "io.podman.annotations.label/fail2ban.enable=true" +CADDY_COMPOSE + + # Create Caddyfile if it doesn't exist + if [ ! -f "Caddyfile" ]; then + cat > Caddyfile << 'CADDYFILE' +{ + # Global options + admin off + # Email for Let's Encrypt notifications + # email admin@yourdomain.com +} + +# Example configuration - edit this for your services +# Uncomment and modify these examples: + +# ActualBudget +# budget.yourdomain.com { +# log { +# output file /var/log/caddy/actualbudget-access.log +# format json +# level INFO +# } +# reverse_proxy localhost:5006 +# header { +# Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" +# X-Frame-Options "SAMEORIGIN" +# X-Content-Type-Options "nosniff" +# X-XSS-Protection "1; mode=block" +# Referrer-Policy "strict-origin-when-cross-origin" +# } +# } + +# Keycloak +# auth.yourdomain.com { +# log { +# output file /var/log/caddy/keycloak-access.log +# format json +# level INFO +# } +# reverse_proxy localhost:8180 +# header { +# Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" +# X-Frame-Options "SAMEORIGIN" +# X-Content-Type-Options "nosniff" +# X-XSS-Protection "1; mode=block" +# Referrer-Policy "strict-origin-when-cross-origin" +# } +# } + +# Add more services here... +CADDYFILE + echo " ✓ Created example Caddyfile" + else + echo " ℹ Using existing Caddyfile" + fi + + echo " ✓ Caddy configured at $CADDY_DIR" + + prompt_yn "Start Caddy now? (y/n):" "y" START_CADDY + if [ "$START_CADDY" = "y" ] || [ "$START_CADDY" = "Y" ]; then + docker compose up -d 2>/dev/null && echo " ✓ Caddy started" || echo " ⚠ Failed to start Caddy" + fi + + echo "" + echo " Configuration file: $CADDY_DIR/Caddyfile" + echo " Edit Caddyfile to add your domains and services" + echo " Reload config: cd $CADDY_DIR && docker exec -w /etc/caddy caddy caddy reload" + echo "" + echo " ⚠ IMPORTANT: Edit the Caddyfile to configure your domains!" + echo " - Uncomment and modify the example configurations" + echo " - Add your domain names" + echo " - Configure services you want to expose" + echo "" + fi + fi + fi + # ---- AUTHELIA ---- if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_AUTHELIA" ]; then echo "" @@ -5149,147 +5290,6 @@ CADDY_AUTH_BLOCK fi # End AUTHELIA_RECONFIGURE check fi # End INSTALL_AUTHELIA check - # ---- CADDY WEB SERVER ---- - if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_CADDY" ]; then - echo "" - echo "┌─────────────────────────────────────────────────────────────────┐" - echo "│ CADDY - Modern Web Server & Reverse Proxy │" - echo "│ Automatic HTTPS, reverse proxy for all your services │" - echo "│ Port: 80 (HTTP), 443 (HTTPS) │" - echo "└─────────────────────────────────────────────────────────────────┘" - prompt_yn "Install Caddy reverse proxy? (y/n):" "n" INSTALL_CADDY - fi - - if [ "$INSTALL_CADDY" = "y" ] || [ "$INSTALL_CADDY" = "Y" ]; then - CADDY_DIR="$DOCKER_DIR/caddy" - - # Check if Caddy is already installed - if [ -f "$CADDY_DIR/Caddyfile" ] || [ -f "$CADDY_DIR/docker-compose.yml" ]; then - echo "" - echo "⚠ Caddy appears to be already installed at $CADDY_DIR" - prompt_yn "Do you want to reconfigure it? (y/n):" "n" RECONFIGURE_CADDY - if [ "$RECONFIGURE_CADDY" != "y" ] && [ "$RECONFIGURE_CADDY" != "Y" ]; then - echo " Skipping Caddy installation" - INSTALL_CADDY="n" - fi - fi - - if [ "$INSTALL_CADDY" = "y" ] || [ "$INSTALL_CADDY" = "Y" ]; then - if [ "$DRY_RUN" = true ]; then - echo "[DRY-RUN] Would create $CADDY_DIR" - else - echo "Installing Caddy..." - mkdir -p "$CADDY_DIR/data" "$CADDY_DIR/config" - ensure_docker_dir_ownership "$CADDY_DIR" - - # Backup existing Caddyfile if it exists - if [ -f "$CADDY_DIR/Caddyfile" ]; then - mkdir -p "$CADDY_DIR/backups" - BACKUP_FILE="$CADDY_DIR/backups/Caddyfile.backup.$(date +%Y%m%d_%H%M%S)" - cp "$CADDY_DIR/Caddyfile" "$BACKUP_FILE" - echo " ✓ Backed up existing Caddyfile to: $BACKUP_FILE" - fi - - cd "$CADDY_DIR" - - cat > docker-compose.yml << 'CADDY_COMPOSE' -name: caddy - -services: - caddy: - image: caddy:latest - container_name: caddy - restart: unless-stopped - ports: - - "80:80" - - "443:443" - - "443:443/udp" # HTTP/3 - volumes: - - ./Caddyfile:/etc/caddy/Caddyfile - - ./data:/data - - ./config:/config - - /var/log/caddy:/var/log/caddy - environment: - - ACME_AGREE=true - labels: - - "io.podman.annotations.label/fail2ban.enable=true" -CADDY_COMPOSE - - # Create Caddyfile if it doesn't exist - if [ ! -f "Caddyfile" ]; then - cat > Caddyfile << 'CADDYFILE' -{ - # Global options - admin off - # Email for Let's Encrypt notifications - # email admin@yourdomain.com -} - -# Example configuration - edit this for your services -# Uncomment and modify these examples: - -# ActualBudget -# budget.yourdomain.com { -# log { -# output file /var/log/caddy/actualbudget-access.log -# format json -# level INFO -# } -# reverse_proxy localhost:5006 -# header { -# Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" -# X-Frame-Options "SAMEORIGIN" -# X-Content-Type-Options "nosniff" -# X-XSS-Protection "1; mode=block" -# Referrer-Policy "strict-origin-when-cross-origin" -# } -# } - -# Keycloak -# auth.yourdomain.com { -# log { -# output file /var/log/caddy/keycloak-access.log -# format json -# level INFO -# } -# reverse_proxy localhost:8180 -# header { -# Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" -# X-Frame-Options "SAMEORIGIN" -# X-Content-Type-Options "nosniff" -# X-XSS-Protection "1; mode=block" -# Referrer-Policy "strict-origin-when-cross-origin" -# } -# } - -# Add more services here... -CADDYFILE - echo " ✓ Created example Caddyfile" - else - echo " ℹ Using existing Caddyfile" - fi - - echo " ✓ Caddy configured at $CADDY_DIR" - - prompt_yn "Start Caddy now? (y/n):" "y" START_CADDY - if [ "$START_CADDY" = "y" ] || [ "$START_CADDY" = "Y" ]; then - docker compose up -d 2>/dev/null && echo " ✓ Caddy started" || echo " ⚠ Failed to start Caddy" - fi - - echo "" - echo " Configuration file: $CADDY_DIR/Caddyfile" - echo " Edit Caddyfile to add your domains and services" - echo " Reload config: cd $CADDY_DIR && docker exec -w /etc/caddy caddy caddy reload" - echo "" - echo " ⚠ IMPORTANT: Edit the Caddyfile to configure your domains!" - echo " - Uncomment and modify the example configurations" - echo " - Add your domain names" - echo " - Configure services you want to expose" - echo "" - fi - fi - fi - # ---- FAIL2BAN ---- if [ "$WHIPTAIL_USED" != true ] && [ -z "$INSTALL_FAIL2BAN" ]; then echo ""