diff --git a/Bitwarden/docker-compose.yml b/Bitwarden/docker-compose.yml index bd25786..94e9615 100644 --- a/Bitwarden/docker-compose.yml +++ b/Bitwarden/docker-compose.yml @@ -8,4 +8,19 @@ services: container_name: vaultwarden volumes: - ./bitwarden/:/data/ - restart: unless-stopped \ No newline at end of file + networks: + - proxy + depends_on: + - traefik + labels: + ## Expose Bitwarden Through Trefik ## + - "traefik.enable=true" # <== Enable traefik to proxy this container + - "traefik.http.services.bitwarden.loadbalancer.server.port=80" + - "traefik.http.routers.bitwarden.rule=Host(`bitwarden.luke-else.co.uk`) || Host(`www.bitwarden.luke-else.co.uk`)" + - "traefik.http.routers.bitwarden.entrypoints=websecure" + - "traefik.http.routers.bitwarden.tls.certresolver=myresolver" + restart: unless-stopped + +networks: + proxy: + external: true \ No newline at end of file diff --git a/Database/docker-compose.yml b/Database/docker-compose.yml index 688d1ef..3de768f 100644 --- a/Database/docker-compose.yml +++ b/Database/docker-compose.yml @@ -6,33 +6,47 @@ services: mongodb: image: "mongo:latest" container_name: mongoDB + volumes: + - ./mongo/:/data/db + ports: + - "27017:27017" environment: MONGO_INITDB_ROOT_USERNAME: root MONGO_INITDB_ROOT_PASSWORD: rootpassword - ports: - - "27017:27017" - volumes: - - ./mongo/:/data/db restart: unless-stopped #MySQL (3306) + phpMyAdmin () mysql: image: "mysql" container_name: MySQL + volumes: + - ./mysql/:/var/lib/mysql + ports: + - "3306:3306" environment: MYSQL_ROOT_PASSWORD: rootpassword MYSQL_DATABASE: test_db - ports: - - "3306:3306" - volumes: - - ./mysql/:/var/lib/mysql restart: unless-stopped phpMyAdmin: image: "phpmyadmin/phpmyadmin:latest" container_name: phpMyAdmin + networks: + - proxy + depends_on: + - mysql + - traefik environment: PMA_HOST: mysql + labels: + ## Expose phpMyAdmin Through Trefik ## + - "traefik.enable=true" # <== Enable traefik to proxy this container + - "traefik.http.services.phpmyadmin.loadbalancer.server.port=80" + - "traefik.http.routers.phpmyadmin.rule=Host(`mysql.luke-else.co.uk`) || Host(`www.mysql.luke-else.co.uk`)" + - "traefik.http.routers.phpmyadmin.entrypoints=websecure" + - "traefik.http.routers.phpmyadmin.tls.certresolver=myresolver" restart: unless-stopped - depends_on: - - mysql \ No newline at end of file + +networks: + proxy: + external: true \ No newline at end of file diff --git a/Gitea/docker-compose.yml b/Development/Gitea/docker-compose.yml similarity index 50% rename from Gitea/docker-compose.yml rename to Development/Gitea/docker-compose.yml index 61681d9..b9fdea3 100644 --- a/Gitea/docker-compose.yml +++ b/Development/Gitea/docker-compose.yml @@ -1,11 +1,20 @@ version: '3.8' services: - -#gitea (222) + #gitea (222) gitea: image: gitea/gitea:latest container_name: gitea + volumes: + - ./gitea:/data + - /etc/timezone:/etc/timezone:ro + - /etc/localtime:/etc/localtime:ro + networks: + - proxy + depends_on: + - traefik + ports: + - "222:22" environment: - APP_NAME="gitea" - USER_UID=1000 @@ -19,10 +28,15 @@ services: - SSH_PORT=222 - SSH_LISTEN_PORT=22 - DB_TYPE=sqlite3 - ports: - - "222:22" - volumes: - - ./gitea:/data - - /etc/timezone:/etc/timezone:ro - - /etc/localtime:/etc/localtime:ro - restart: unless-stopped \ No newline at end of file + labels: + ## Expose Gitea Through Trefik ## + - "traefik.enable=true" # <== Enable traefik to proxy this container + - "traefik.http.services.gitea.loadbalancer.server.port=3000" + - "traefik.http.routers.gitea.rule=Host(`git.luke-else.co.uk`) || Host(`www.git.luke-else.co.uk`)" + - "traefik.http.routers.gitea.entrypoints=websecure" + - "traefik.http.routers.gitea.tls.certresolver=myresolver" + restart: unless-stopped + +networks: + proxy: + external: true \ No newline at end of file diff --git a/NextCloud/docker-compose.yml b/NextCloud/docker-compose.yml deleted file mode 100644 index 771ffba..0000000 --- a/NextCloud/docker-compose.yml +++ /dev/null @@ -1,29 +0,0 @@ -version: '3.8' - -services: - db: - image: mariadb - container_name: nextclouddb - restart: always - command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW - volumes: - - ./db:/var/lib/mysql - environment: - - MYSQL_ROOT_PASSWORD= - - MYSQL_PASSWORD= - - MYSQL_DATABASE=nextcloud - - MYSQL_USER=nextcloud - - nextcloud: - image: nextcloud - container_name: nextcloud - restart: always - links: - - db - volumes: - - ./nextcloud:/var/www/html - environment: - - MYSQL_PASSWORD= - - MYSQL_DATABASE=nextcloud - - MYSQL_USER=nextcloud - - MYSQL_HOST=db \ No newline at end of file diff --git a/ReverseProxy/docker-compose.yml b/ReverseProxy/docker-compose.yml deleted file mode 100644 index 3bbefe2..0000000 --- a/ReverseProxy/docker-compose.yml +++ /dev/null @@ -1,46 +0,0 @@ -version: '3.8' - -services: - - #nginx (80, 443, 8080) - nginx: - image: 'jc21/nginx-proxy-manager:latest' - container_name: nginx - ports: - # These ports are in format : - - '80:80' # Public HTTP Port - - '443:443' # Public HTTPS Port - - '8080:81' # Admin Web Port - # Add any other Stream port you want to expose - # - '21:21' # FTP - # Uncomment the next line if you uncomment anything in the section - # environment: - # Uncomment this if you want to change the location of - # the SQLite DB file within the container - # DB_SQLITE_FILE: "/data/database.sqlite" - - # Uncomment this if IPv6 is not enabled on your host - # DISABLE_IPV6: 'true' - volumes: - - ./nginx/data:/data - - ./nginx/letsencrypt:/etc/letsencrypt - restart: unless-stopped - - networks: - - websites - - gitea - - databases - - bitwarden - - nextcloud - -networks: - websites: - name: websites_default - gitea: - name: gitea_default - databases: - name: database_default - bitwarden: - name: bitwarden_default - nextcloud: - name: nextcloud_default \ No newline at end of file diff --git a/Traefik/docker-compose.yml b/Traefik/docker-compose.yml new file mode 100644 index 0000000..3c2f9df --- /dev/null +++ b/Traefik/docker-compose.yml @@ -0,0 +1,35 @@ +version: "3.8" +services: + traefik: + image: "traefik:latest" + container_name: "traefik" + command: + - "--api.dashboard=true" + - "--providers.docker=true" + - "--providers.docker.exposedbydefault=false" + - "--entrypoints.web.address=:80" + - "--entrypoints.websecure.address=:443" + - "--certificatesresolvers.myresolver.acme.tlschallenge=true" + - "--certificatesresolvers.myresolver.acme.email=contact@luke-else.co.uk" + - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json" + ports: + - "80:80" + - "443:443" + volumes: + - "./letsencrypt:/letsencrypt" + - "/var/run/docker.sock:/var/run/docker.sock:ro" + networks: + - proxy + labels: + - "traefik.enable=true" + - "traefik.http.routers.traefik.rule=Host(`traefik.luke-else.co.uk`) || Host('www.traefik.luke-else.co.uk')" + - "traefik.http.routers.traefik.entrypoints=websecure" + - "traefik.http.routers.traefik.service=api@internal" + - "traefik.http.routers.traefik.tls.certresolver=myresolver" + - "traefik.http.routers.traefik.middlewares=traefik-auth" + - "traefik.http.middlewares.traefik-auth.basicauth.users=user:$$2y$$05$$s/vPphFtSO2fWJR7SYkEb.90UwPDRM3aOKqgOF/rme/3fUQ5tvpTS" + restart: unless-stopped + +networks: + proxy: + name: proxy \ No newline at end of file diff --git a/Websites/docker-compose.yml b/Websites/docker-compose.yml index 7ea3b3e..74ea8ce 100644 --- a/Websites/docker-compose.yml +++ b/Websites/docker-compose.yml @@ -4,10 +4,21 @@ services: #Websites luke-else.co.uk (8000) snexo.co.uk (8001) luke-else.co.uk: - image: "php:apache" + image: "nginx:latest" container_name: luke-else.co.uk volumes: - - ./luke-else.co.uk/:/var/www/html + - ./luke-else.co.uk/:/usr/share/nginx/html + networks: + - proxy + depends_on: + - traefik + labels: + ## Expose luke-else Through Trefik ## + - "traefik.enable=true" # <== Enable traefik to proxy this container + - "traefik.http.services.personal.loadbalancer.server.port=80" + - "traefik.http.routers.personal.rule=Host(`luke-else.co.uk`) || Host(`www.luke-else.co.uk`)" + - "traefik.http.routers.personal.entrypoints=websecure" + - "traefik.http.routers.personal.tls.certresolver=myresolver" restart: unless-stopped snexo.co.uk: @@ -15,4 +26,19 @@ services: container_name: snexo.co.uk volumes: - ./snexo.co.uk/:/var/www/html - restart: unless-stopped \ No newline at end of file + networks: + - proxy + depends_on: + - traefik + labels: + ## Expose Snexo Through Trefik ## + - "traefik.enable=true" # <== Enable traefik to proxy this container + - "traefik.http.services.snexo.loadbalancer.server.port=80" + - "traefik.http.routers.snexo.rule=Host(`snexo.co.uk`) || Host(`www.snexo.co.uk`)" + - "traefik.http.routers.snexo.entrypoints=websecure" + - "traefik.http.routers.snexo.tls.certresolver=myresolver" + restart: unless-stopped + +networks: + proxy: + external: true \ No newline at end of file diff --git a/spindown.sh b/spindown.sh new file mode 100644 index 0000000..fe60bde --- /dev/null +++ b/spindown.sh @@ -0,0 +1,21 @@ +#Script file for spinning down all docker-containers + +cd ./Websites/ +docker-compose down +cd .. + + cd ./Development/Gitea/ + docker-compose down + cd ../.. + +cd ./Database/ +docker-compose down +cd .. + +cd ./Bitwarden/ +docker-compose down +cd .. + +cd ./Traefik/ +docker-compose down +cd .. \ No newline at end of file diff --git a/spinup.sh b/spinup.sh new file mode 100644 index 0000000..6943f04 --- /dev/null +++ b/spinup.sh @@ -0,0 +1,21 @@ +#Script file for spinning up all docker-containers + +cd ./Traefik/ +docker-compose up -d +cd .. + +cd ./Websites/ +docker-compose up -d +cd .. + + cd ./Development/Gitea/ + docker-compose up -d + cd ../.. + +cd ./Database/ +docker-compose up -d +cd .. + +cd ./Bitwarden/ +docker-compose up -d +cd .. \ No newline at end of file diff --git a/todo.md b/todo.md new file mode 100644 index 0000000..d7eb9da --- /dev/null +++ b/todo.md @@ -0,0 +1,35 @@ +# ToDo Items + +## General +- Setup non root user +- UFW should be setup to keep VPS secure and only allow for: + - https + - http + - ssh + - ftp + - 27017 + - 3306 +- Install SSH keys +- Setup unattended upgrades +- Install docker, docker-compose and apache utils. + + +## Traefik +- Setup htaccess -> ``` echo $(htpasswd -nb user password) | sed -e s/\\$/\\$\\$/g ``` +- Ensure email address is correct + +## Gitea +- Ensure that ports are assigned correctly for the system + +## Websites +- Ensure website files are copied over +- Ensure that ports are assigned correctly for the system + +## Bitwarden +- Ensure that all data is fully encrypted during transfer. +- Ensure that ports are assigned correctly for the system + +## Database +- Ensure that mysql root password, user and default database are updated. +- Ensure that mongo root password, and user are updated. +- Ensure database ports are correctly assigned and do not have to pass through traefik.