first commit

2026-10-16 15:55:14 +02:00
commit 65e8b9440d
62 changed files with 4799 additions and 0 deletions
@@ -0,0 +1,48 @@
+#!/bin/sh
+# Erzeugt ein selbstsigniertes Zertifikat aus den CERT_*-Werten der .env.
+# Neu erzeugt wird, wenn es fehlt, die CERT_*-Werte geaendert wurden oder es
+# in weniger als CERT_RENEW_DAYS Tagen ablaeuft.
+# Eigene Zertifikate: fullchain.pem + privkey.pem ins Zertifikatsverzeichnis legen
+# und die Datei .selfsigned dort loeschen - dann wird nichts ueberschrieben.
+set -eu
+
+DIR=/etc/nginx/certs
+CRT=$DIR/fullchain.pem
+KEY=$DIR/privkey.pem
+MARK=$DIR/.selfsigned
+
+CN=${CERT_CN:-localhost}
+DAYS=${CERT_DAYS:-825}
+RENEW=${CERT_RENEW_DAYS:-30}
+SAN=${CERT_SAN:-DNS:$CN}
+SUBJ="/C=${CERT_COUNTRY:-DE}/ST=${CERT_STATE:-Bayern}/L=${CERT_CITY:-Muenchen}/O=${CERT_ORG:-NetClip}/OU=${CERT_OU:-IT}/CN=$CN"
+CONF="$SUBJ|$SAN|$DAYS|${CERT_KEY_BITS:-2048}"
+
+mkdir -p "$DIR"
+
+if [ -f "$CRT" ] && [ -f "$KEY" ] && [ ! -f "$MARK" ]; then
+    echo "cert: eigenes Zertifikat in $DIR gefunden, wird verwendet"
+    exit 0
+fi
+
+need=0
+if [ ! -f "$CRT" ] || [ ! -f "$KEY" ]; then
+    need=1
+elif [ "$(cat "$MARK")" != "$CONF" ]; then
+    echo "cert: CERT_*-Werte geaendert"
+    need=1
+elif ! openssl x509 -checkend $((RENEW * 86400)) -noout -in "$CRT" >/dev/null; then
+    echo "cert: Zertifikat laeuft in weniger als $RENEW Tagen ab"
+    need=1
+fi
+
+if [ "$need" = 1 ]; then
+    echo "cert: erzeuge selbstsigniertes Zertifikat fuer $CN ($SAN), $DAYS Tage gueltig"
+    openssl req -x509 -nodes -newkey "rsa:${CERT_KEY_BITS:-2048}" -sha256 \
+        -days "$DAYS" -subj "$SUBJ" -addext "subjectAltName=$SAN" \
+        -keyout "$KEY" -out "$CRT"
+    chmod 600 "$KEY"
+    printf '%s' "$CONF" > "$MARK"
+fi
+
+openssl x509 -noout -subject -enddate -in "$CRT" | sed 's/^/cert: /'
@@ -0,0 +1,5 @@
+FROM nginx:alpine
+RUN apk add --no-cache openssl
+COPY 40-selfsigned-cert.sh /docker-entrypoint.d/
+COPY templates/ /etc/nginx/templates/
+RUN chmod +x /docker-entrypoint.d/40-selfsigned-cert.sh
@@ -0,0 +1,42 @@
+# Wird beim Start per envsubst nach /etc/nginx/conf.d/default.conf geschrieben.
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+server {
+    listen 80;
+    server_name _;
+    return 301 https://$host:${HTTPS_PORT}$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    http2 on;
+    server_name _;
+
+    ssl_certificate     /etc/nginx/certs/fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/privkey.pem;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_session_cache   shared:SSL:1m;
+
+    # Muss >= MAX_CLIP_MB des Servers sein (plus etwas Luft fuer die Verschluesselung)
+    client_max_body_size ${NGINX_MAX_BODY};
+    # Uploads/Downloads direkt durchreichen statt zwischenzuspeichern
+    proxy_request_buffering off;
+    proxy_buffering off;
+
+    location / {
+        proxy_pass http://netclip:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade           $http_upgrade;
+        proxy_set_header Connection        $connection_upgrade;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        # WebSocket-Verbindungen bleiben lange offen (Clients pingen alle 30 s)
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+}