You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+21-12Lines changed: 21 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -56,14 +56,25 @@ The architectures supported by this image are:
56
56
57
57
## Application Setup
58
58
59
-
This image hosts the server component for the SealSkin platform. Two ports are used to access the platform from the SealSkin browser extension 8000 the api port and 8443 for app sessions.
59
+
This image hosts the server component for the SealSkin platform.
60
60
61
-
Download the browser extension from [HERE](https://chromewebstore.google.com/detail/sealskin-isolation/lclgfmnljgacfdpmmmjmfpdelndbbfhk) or land on port 8000 and download the zip bundled with this server and install unpacked.
62
-
In the options for the extension enter manual configuration and using the "admin" user fill out the endpoint for the server and the keys obtained via first run container logs or generated yourself.
61
+
Download the browser extension from [for Chrome HERE](https://chromewebstore.google.com/detail/sealskin-isolation/lclgfmnljgacfdpmmmjmfpdelndbbfhk), [for Firefox HERE](https://addons.mozilla.org/en-US/firefox/addon/sealskin-isolation/).
63
62
64
-
## Basic requirements
63
+
On first init a file will be created `/config/admin.json` if you set `HOST_URL` you can use this file for credentials as is, if you did not you will need to edit it and change the URL/IP set in the file to use it. Once authenticated in the extension you can generate users and new config files to distribute or use.
65
64
66
-
Every variable listed in the run example is required in this current version including the container name, the only backend provider to launch containers is Docker. This container is designed to work on the default bridge network for the server and launch containers into that network and proxy their internal traffic. The storage paths are required for key and storage management while their mount paths are adapted from within the container to be run on the host for launched sessions. Everyting in the stack runs as the PUID and PGID down to the container desktop sessions, it is important that the user you use has access to the `/config` and `/storage` paths. Make note of your admin private key and server public key on first container init logs you will need that to configure the browser extension and administrate the server.
65
+
>[!NOTE]
66
+
>If you are not using a legitimate ssl certificate (default self signed in `/config/ssl`) than you can only use the Chrome extension and must forward whatever port mapped to 8000 to the internet. Firefox enforces https in the extension space and Chrome allows us to fall back to E2EE over http.
67
+
68
+
>[!NOTE]
69
+
>Please remember to copy and delete the default `/config/admin.json` file from your server for security, keep it somewhere safe!
70
+
71
+
## Basic Requirements
72
+
73
+
It is important to use the container name `sealskin` as this is how the container identifies itself and determines its ports, volumes, and network. The only backend provider to launch containers is Docker. The storage paths are required for key and storage management while their mount paths are adapted from within the container to be run on the host for launched sessions. Everyting in the stack runs as the PUID and PGID down to the container desktop sessions, it is important that the user you use has access to the `/config` and `/storage` paths.
74
+
75
+
### NVIDIA Support
76
+
77
+
Nvidia support only works on 580 and up full proprietary drivers (no MIT/GPL) with `nvidia-drm.modeset=1` kernel parameter set. You must ensure the card is initialized before running a container so on headless systems run `nvidia-modprobe --modeset` from the host even with this kernel parameter set, this only needs to be run once per boot on headless systems.
67
78
68
79
## Key & Certificate Management
69
80
@@ -115,7 +126,6 @@ services:
115
126
sealskin:
116
127
image: lscr.io/linuxserver/sealskin:latest
117
128
container_name: sealskin
118
-
network_mode: bridge
119
129
environment:
120
130
- PUID=1000
121
131
- PGID=1000
@@ -126,8 +136,8 @@ services:
126
136
- /path/to/sealskin/storage:/storage
127
137
- /var/run/docker.sock:/var/run/docker.sock
128
138
ports:
129
-
- 8000:8000
130
139
- 8443:8443
140
+
- 8000:8000#optional
131
141
restart: unless-stopped
132
142
```
133
143
@@ -136,13 +146,12 @@ services:
136
146
```bash
137
147
docker run -d \
138
148
--name=sealskin \
139
-
--net=bridge \
140
149
-e PUID=1000 \
141
150
-e PGID=1000 \
142
151
-e TZ=Etc/UTC \
143
152
-e HOST_URL=IP|subdomain.doman.com `#optional` \
144
-
-p 8000:8000 \
145
153
-p 8443:8443 \
154
+
-p 8000:8000 `#optional` \
146
155
-v /path/to/sealskin/config:/config \
147
156
-v /path/to/sealskin/storage:/storage \
148
157
-v /var/run/docker.sock:/var/run/docker.sock \
@@ -156,9 +165,8 @@ Containers are configured using parameters passed at runtime (such as those abov
156
165
157
166
| Parameter | Function |
158
167
| :----: | --- |
159
-
|`--net=bridge`| Use default bridge network |
160
-
|`-p 8000:8000`| API communication port. |
161
-
|`-p 8443:8443`| App session port. |
168
+
|`-p 8443:8443`| HTTPS Sessions and API communication port. |
169
+
|`-p 8000`| HTTP Fallback API communication port. |
162
170
|`-e PUID=1000`| for UserID - see below for explanation |
163
171
|`-e PGID=1000`| for GroupID - see below for explanation |
164
172
|`-e TZ=Etc/UTC`| specify a timezone to use, see this [list](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List). |
@@ -329,5 +337,6 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
329
337
330
338
## Versions
331
339
340
+
***17.01.26:** - Update docs to remove network and port requirement, add link to Firefox add on.
- {external_port: "8443", internal_port: "8443", port_desc: "HTTPS Sessions and API communication port."}
24
+
opt_param_usage_include_ports: true
25
+
opt_param_ports:
26
+
- {external_port: "8000", internal_port: "8000", port_desc: "HTTP Fallback API communication port."}
28
27
opt_param_usage_include_env: true
29
28
opt_param_env_vars:
30
29
- {env_var: "HOST_URL", env_value: "IP|subdomain.doman.com", desc: "On initial setup this will be used to fill in the default admin configuration file in the `/config` directory, if unset the string HOST_URL will need to be replaced."}
31
30
# application setup block
32
31
app_setup_block_enabled: true
33
-
app_setup_block: "This image hosts the server component for the SealSkin platform. Two ports are used to access the platform from the SealSkin browser extension 8000 the api port and 8443 for app sessions.\n\nDownload the browser extension from [HERE](https://chromewebstore.google.com/detail/sealskin-isolation/lclgfmnljgacfdpmmmjmfpdelndbbfhk) or land on port 8000 and download the zip bundled with this server and install unpacked.\nIn the options for the extension enter manual configuration and using the \"admin\" user fill out the endpoint for the server and the keys obtained via first run container logs or generated yourself.\n\n## Basic requirements\n\nEvery variable listed in the run example is required in this current version including the container name, the only backend provider to launch containers is Docker. This container is designed to work on the default bridge network for the server and launch containers into that network and proxy their internal traffic. The storage paths are required for key and storage management while their mount paths are adapted from within the container to be run on the host for launched sessions. Everyting in the stack runs as the PUID and PGID down to the container desktop sessions, it is important that the user you use has access to the `/config` and `/storage` paths. Make note of your admin private key and server public key on first container init logs you will need that to configure the browser extension and administrate the server. \n\n## Key & Certificate Management\n\nThe server requires several cryptographic keys to function. You can either let the server perform an automatic setup on its first run or manually provide your own keys for more control.\n\n### Automatic First-Run Setup (Recommended)\n\nThis is the simplest method. On the first launch with an empty `/config` volume:\n\n1. An init process automatically generates the mandatory server key (`server_key.pem`) and a self-signed SSL certificate for the proxy (`proxy_key.pem`, `proxy_cert.pem`).\n2. The application will then detect that no administrator exists, create a default user named `admin`, and output a configuration file admin.json into the `/config/` directory.\n\nYour only action is if the `HOST_URL` environment variable is not set to replace the `HOST_URL` string in the file with your IP/URL.\n\n### Manual Pre-Configuration (Advanced)\n\nIf you wish to use your own administrator key or provide a valid SSL certificate, you can place the necessary files in the `/config` volume **before** the first launch.\n\n* **To use a custom Admin Key:**\n 1. Generate your own RSA keypair.\n 2. Create a file containing only your **public key** PEM data at the following location:\n * **Path:** `/path/to/config/.config/sealskin/keys/admins/admin`\n 3. The server will detect this file and skip the automatic admin creation. You will use your corresponding private key to log in from the extension.\n\n* **To use a custom SSL Certificate:**\n * Place your SSL private key and certificate file at these locations. This will override the self-signed certificate generated by the init process.\n * **Key Path:** `/path/to/config/ssl/proxy_key.pem`\n * **Cert Path:** `/path/to/config/ssl/proxy_cert.pem`\n\n* **To use a custom Server E2EE Key:**\n * Place your RSA private key at this location. This is the core key for the API's end-to-end encryption and validates the server when a user sets the servers public key when configuring the extension.\n * **Path:** `/path/to/config/ssl/server_key.pem`\n * **Generation Command:** `openssl genpkey -algorithm RSA -out /path/to/config/ssl/server_key.pem -pkeyopt rsa_keygen_bits:4096`\n * To obtain the corresponding public key (which is needed by the browser extension), you can extract it from your private key with this command:\n * **Extraction Command:** `openssl rsa -in server_key.pem -pubout`\n"
32
+
app_setup_block: |
33
+
This image hosts the server component for the SealSkin platform.
34
+
35
+
Download the browser extension from [for Chrome HERE](https://chromewebstore.google.com/detail/sealskin-isolation/lclgfmnljgacfdpmmmjmfpdelndbbfhk), [for Firefox HERE](https://addons.mozilla.org/en-US/firefox/addon/sealskin-isolation/).
36
+
37
+
On first init a file will be created `/config/admin.json` if you set `HOST_URL` you can use this file for credentials as is, if you did not you will need to edit it and change the URL/IP set in the file to use it. Once authenticated in the extension you can generate users and new config files to distribute or use.
38
+
39
+
>[!NOTE]
40
+
>If you are not using a legitimate ssl certificate (default self signed in `/config/ssl`) than you can only use the Chrome extension and must forward whatever port mapped to 8000 to the internet. Firefox enforces https in the extension space and Chrome allows us to fall back to E2EE over http.
41
+
42
+
>[!NOTE]
43
+
>Please remember to copy and delete the default `/config/admin.json` file from your server for security, keep it somewhere safe!
44
+
45
+
## Basic Requirements
46
+
47
+
It is important to use the container name `sealskin` as this is how the container identifies itself and determines its ports, volumes, and network. The only backend provider to launch containers is Docker. The storage paths are required for key and storage management while their mount paths are adapted from within the container to be run on the host for launched sessions. Everyting in the stack runs as the PUID and PGID down to the container desktop sessions, it is important that the user you use has access to the `/config` and `/storage` paths.
48
+
49
+
### NVIDIA Support
50
+
51
+
Nvidia support only works on 580 and up full proprietary drivers (no MIT/GPL) with `nvidia-drm.modeset=1` kernel parameter set. You must ensure the card is initialized before running a container so on headless systems run `nvidia-modprobe --modeset` from the host even with this kernel parameter set, this only needs to be run once per boot on headless systems.
52
+
53
+
## Key & Certificate Management
54
+
55
+
The server requires several cryptographic keys to function. You can either let the server perform an automatic setup on its first run or manually provide your own keys for more control.
56
+
57
+
### Automatic First-Run Setup (Recommended)
58
+
59
+
This is the simplest method. On the first launch with an empty `/config` volume:
60
+
61
+
1. An init process automatically generates the mandatory server key (`server_key.pem`) and a self-signed SSL certificate for the proxy (`proxy_key.pem`, `proxy_cert.pem`).
62
+
2. The application will then detect that no administrator exists, create a default user named `admin`, and output a configuration file admin.json into the `/config/` directory.
63
+
64
+
Your only action is if the `HOST_URL` environment variable is not set to replace the `HOST_URL` string in the file with your IP/URL.
65
+
66
+
### Manual Pre-Configuration (Advanced)
67
+
68
+
If you wish to use your own administrator key or provide a valid SSL certificate, you can place the necessary files in the `/config` volume **before** the first launch.
69
+
70
+
* **To use a custom Admin Key:**
71
+
1. Generate your own RSA keypair.
72
+
2. Create a file containing only your **public key** PEM data at the following location:
* Place your RSA private key at this location. This is the core key for the API's end-to-end encryption and validates the server when a user sets the servers public key when configuring the extension.
0 commit comments