Skip to content

Commit 6c1b5ee

Browse files
krizcoldkrizcold
committed
First release
1 parent 8491177 commit 6c1b5ee

File tree

6 files changed

+432
-0
lines changed

6 files changed

+432
-0
lines changed

‎Dockerfile‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM nginx:alpine
2+
3+
# Create required nginx cache directories
4+
RUN mkdir -p /var/cache/nginx/{client_temp,proxy_temp,fastcgi_temp,uwsgi_temp,scgi_temp} && \
5+
chown -R nginx:nginx /var/cache/nginx && \
6+
chmod -R 755 /var/cache/nginx
7+
8+
COPY nginx.conf /etc/nginx/nginx.conf
9+
COPY entrypoint.sh /entrypoint.sh
10+
RUN chmod +x /entrypoint.sh
11+
12+
ENTRYPOINT ["/entrypoint.sh"]

‎entrypoint.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/sh
2+
3+
# Simple replacement of placeholders
4+
sed -i "s/BACKEND_HOST_PLACEHOLDER/$BACKEND_HOST/g" /etc/nginx/nginx.conf
5+
sed -i "s/BACKEND_PORT_PLACEHOLDER/$BACKEND_PORT/g" /etc/nginx/nginx.conf
6+
sed -i "s/LISTEN_PORT_PLACEHOLDER/$LISTEN_PORT/g" /etc/nginx/nginx.conf
7+
sed -i "s/AUTH_HASH_PLACEHOLDER/$AUTH_HASH/g" /etc/nginx/nginx.conf
8+
9+
# Start NGINX
10+
exec nginx -g "daemon off;"

‎nginx.conf‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
pid /var/run/nginx.pid;
2+
error_log /var/log/nginx/error.log warn;
3+
4+
events {
5+
worker_connections 1024;
6+
}
7+
8+
http {
9+
include /etc/nginx/mime.types;
10+
default_type application/octet-stream;
11+
12+
sendfile on;
13+
tcp_nopush on;
14+
tcp_nodelay on;
15+
keepalive_timeout 65;
16+
17+
# Use container cache directories
18+
client_body_temp_path /var/cache/nginx/client_temp;
19+
proxy_temp_path /var/cache/nginx/proxy_temp;
20+
fastcgi_temp_path /var/cache/nginx/fastcgi_temp;
21+
uwsgi_temp_path /var/cache/nginx/uwsgi_temp;
22+
scgi_temp_path /var/cache/nginx/scgi_temp;
23+
24+
server {
25+
listen LISTEN_PORT_PLACEHOLDER;
26+
27+
location /health {
28+
return 200 "OK";
29+
}
30+
31+
location / {
32+
if ($arg_hash != "AUTH_HASH_PLACEHOLDER") {
33+
return 403;
34+
}
35+
36+
proxy_pass http://BACKEND_HOST_PLACEHOLDER:BACKEND_PORT_PLACEHOLDER;
37+
proxy_http_version 1.1;
38+
proxy_set_header Host $host;
39+
proxy_set_header X-Real-IP $remote_addr;
40+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
41+
proxy_set_header Upgrade $http_upgrade;
42+
proxy_set_header Connection "upgrade";
43+
}
44+
}
45+
}

‎safe-terminal-app-classic.yml‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
name: yunderaterminal
2+
3+
services:
4+
yunderaterminal:
5+
image: nginx:alpine
6+
container_name: yunderaterminal
7+
restart: unless-stopped
8+
expose:
9+
- "3000"
10+
user: "root"
11+
command: ["nginx", "-c", "/custom-config/nginx.conf", "-g", "daemon off;"]
12+
volumes:
13+
- type: bind
14+
source: /DATA/AppData/yunderaterminal/nginx
15+
target: /custom-config
16+
read_only: true
17+
- type: bind
18+
source: /DATA/AppData/yunderaterminal
19+
target: /DATA/AppData/yunderaterminal
20+
depends_on:
21+
- ttyd
22+
networks:
23+
- pcs
24+
privileged: true
25+
cap_add:
26+
- SYS_ADMIN
27+
- NET_ADMIN
28+
29+
ttyd:
30+
image: tsl0922/ttyd:latest
31+
container_name: yunderaterminaltty
32+
restart: unless-stopped
33+
user: "root"
34+
command: ["ttyd", "--writable", "--client-option", "enableZmodem=true", "--client-option", "enableSixel=false", "--client-option", "enableTrzsz=false", "--terminal-type", "xterm-256color", "chroot", "/host", "bash"]
35+
volumes:
36+
- type: bind
37+
source: /
38+
target: /host
39+
networks:
40+
- pcs
41+
privileged: true
42+
cap_add:
43+
- SYS_ADMIN
44+
- NET_ADMIN
45+
46+
networks:
47+
pcs:
48+
external: true
49+
50+
x-casaos:
51+
architectures:
52+
- amd64
53+
- arm64
54+
main: yunderaterminal
55+
author: yundera
56+
developer: yundera
57+
icon: https://cdn-icons-png.flaticon.com/512/2933/2933245.png
58+
tagline:
59+
en_us: "Secure hash-locked terminal access (Classic)"
60+
category: Utilities
61+
description:
62+
en_us: "A secure terminal with hash-based authentication using classic nginx approach"
63+
title:
64+
en_us: "Yundera Terminal Classic"
65+
store_app_id: yunderaterminal-classic
66+
is_uncontrolled: false
67+
index: /?hash=$AUTH_HASH
68+
webui_port: 3000
69+
volumes:
70+
- /DATA/AppData/$AppID/nginx
71+
pre-install-cmd: |
72+
mkdir -p /DATA/AppData/yunderaterminal/nginx 2>/dev/null
73+
mkdir -p /DATA/AppData/yunderaterminal/nginx-cache/{client_temp,proxy_temp,fastcgi_temp,uwsgi_temp,scgi_temp} 2>/dev/null
74+
chown -R ubuntu:988 /DATA/AppData/yunderaterminal/ 2>/dev/null || true
75+
chmod -R 755 /DATA/AppData/yunderaterminal/ 2>/dev/null || true
76+
77+
NGINX_DIR="/DATA/AppData/yunderaterminal/nginx"
78+
cat > "$NGINX_DIR/nginx.conf" << 'NGINX_EOF'
79+
pid /DATA/AppData/yunderaterminal/nginx-cache/nginx.pid;
80+
error_log /DATA/AppData/yunderaterminal/nginx-cache/error.log;
81+
82+
events {
83+
worker_connections 1024;
84+
}
85+
86+
http {
87+
include /etc/nginx/mime.types;
88+
default_type application/octet-stream;
89+
90+
client_body_temp_path /DATA/AppData/yunderaterminal/nginx-cache/client_temp;
91+
proxy_temp_path /DATA/AppData/yunderaterminal/nginx-cache/proxy_temp;
92+
fastcgi_temp_path /DATA/AppData/yunderaterminal/nginx-cache/fastcgi_temp;
93+
uwsgi_temp_path /DATA/AppData/yunderaterminal/nginx-cache/uwsgi_temp;
94+
scgi_temp_path /DATA/AppData/yunderaterminal/nginx-cache/scgi_temp;
95+
96+
sendfile on;
97+
tcp_nopush on;
98+
tcp_nodelay on;
99+
keepalive_timeout 65;
100+
101+
server {
102+
listen 3000;
103+
server_name _;
104+
105+
location / {
106+
if (\$arg_hash != "$AUTH_HASH") {
107+
return 403 "Access denied: Invalid or missing authentication hash. Please access through CasaOS dashboard.";
108+
}
109+
110+
proxy_pass http://yunderaterminaltty:7681;
111+
proxy_http_version 1.1;
112+
proxy_set_header Upgrade \$http_upgrade;
113+
proxy_set_header Connection "upgrade";
114+
proxy_set_header Host \$host;
115+
proxy_set_header X-Real-IP \$remote_addr;
116+
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
117+
proxy_set_header X-Forwarded-Proto \$scheme;
118+
119+
proxy_buffering off;
120+
proxy_cache off;
121+
proxy_read_timeout 86400;
122+
proxy_send_timeout 86400;
123+
proxy_connect_timeout 60s;
124+
125+
proxy_set_header X-Forwarded-Host \$host;
126+
proxy_set_header X-Forwarded-Server \$host;
127+
}
128+
}
129+
}
130+
NGINX_EOF

‎safe-terminal-app-nginxhashlock.yml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
name: yunderaterminal
2+
3+
services:
4+
yunderaterminal:
5+
image: krizcold/nginxhashlock:latest
6+
container_name: yunderaterminal
7+
restart: unless-stopped
8+
expose:
9+
- "3000"
10+
user: "root"
11+
environment:
12+
AUTH_HASH: $AUTH_HASH
13+
BACKEND_HOST: "ttyd"
14+
BACKEND_PORT: "7681"
15+
LISTEN_PORT: "3000"
16+
depends_on:
17+
- ttyd
18+
networks:
19+
- pcs
20+
privileged: true
21+
cap_add:
22+
- SYS_ADMIN
23+
- NET_ADMIN
24+
25+
ttyd:
26+
image: tsl0922/ttyd:latest
27+
container_name: yunderaterminaltty
28+
restart: unless-stopped
29+
user: "root"
30+
command: ["ttyd", "--writable", "--client-option", "enableZmodem=true", "--client-option", "enableSixel=false", "--client-option", "enableTrzsz=false", "--terminal-type", "xterm-256color", "chroot", "/host", "bash"]
31+
volumes:
32+
- type: bind
33+
source: /
34+
target: /host
35+
networks:
36+
- pcs
37+
privileged: true
38+
cap_add:
39+
- SYS_ADMIN
40+
- NET_ADMIN
41+
42+
networks:
43+
pcs:
44+
external: true
45+
46+
x-casaos:
47+
architectures:
48+
- amd64
49+
- arm64
50+
main: yunderaterminal
51+
author: yundera
52+
developer: yundera
53+
icon: https://cdn-icons-png.flaticon.com/512/2933/2933245.png
54+
tagline:
55+
en_us: "Secure hash-locked terminal access"
56+
category: Utilities
57+
description:
58+
en_us: "A secure terminal with hash-based authentication using nginxhashlock"
59+
title:
60+
en_us: "Yundera Terminal"
61+
store_app_id: yunderaterminal
62+
is_uncontrolled: false
63+
# nginxhashlock handles the hash validation automatically
64+
index: /?hash=$AUTH_HASH
65+
webui_port: 3000
66+
pre-install-cmd: |
67+
mkdir -p /DATA/AppData/yunderaterminal 2>/dev/null || true
68+
chmod -R 755 /DATA/AppData/yunderaterminal/ 2>/dev/null || true

0 commit comments

Comments
 (0)