mirror of
https://github.com/koush/scrypted.git
synced 2026-09-16 08:40:39 +01:00
82 lines
3.6 KiB
Docker
82 lines
3.6 KiB
Docker
ARG BASE="noble-lite"
|
|
FROM ghcr.io/koush/scrypted-common:${BASE}
|
|
|
|
ENV SCRYPTED_DOCKER_FLAVOR="router"
|
|
|
|
# tools
|
|
RUN apt -y update && apt -y install nano net-tools dnsutils dnsmasq vlan bridge-utils netplan.io nftables isc-dhcp-client cron
|
|
RUN rm -f /etc/systemd/system/multi-user.target.wants/dnsmasq.service
|
|
RUN rm -f /etc/systemd/system/sysinit.target.wants/systemd-resolved.service
|
|
|
|
# go + caddy
|
|
RUN GO_VERSION=1.25.1 && ARCH=$(dpkg --print-architecture) && \
|
|
if [ "$ARCH" = "amd64" ]; then GOARCH="amd64"; \
|
|
elif [ "$ARCH" = "arm64" ]; then GOARCH="arm64"; \
|
|
elif [ "$ARCH" = "armhf" ]; then GOARCH="armv6l"; \
|
|
else echo "Unsupported architecture: $ARCH" && exit 1; fi && \
|
|
curl -LO "https://go.dev/dl/go${GO_VERSION}.linux-${GOARCH}.tar.gz" && \
|
|
tar -C /usr/local -xzf "go${GO_VERSION}.linux-${GOARCH}.tar.gz" && \
|
|
rm "go${GO_VERSION}.linux-${GOARCH}.tar.gz"
|
|
ENV PATH=$PATH:/usr/local/go/bin
|
|
RUN apt install -y debian-keyring debian-archive-keyring apt-transport-https
|
|
RUN curl -1sLf 'https://dl.cloudsmith.io/public/caddy/xcaddy/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-xcaddy-archive-keyring.gpg
|
|
RUN curl -1sLf 'https://dl.cloudsmith.io/public/caddy/xcaddy/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-xcaddy.list
|
|
RUN apt -y update
|
|
RUN apt -y install xcaddy
|
|
RUN xcaddy build --with github.com/caddy-dns/cloudflare --output /usr/local/bin/caddy
|
|
|
|
# nftables
|
|
COPY ./router/scrypted-nftables.service /etc/systemd/system
|
|
RUN systemctl enable scrypted-nftables
|
|
RUN bash -c 'echo include \"/etc/nftables.d/*.conf\"\; > /etc/nftables.conf'
|
|
RUN mkdir -p /etc/nftables.d
|
|
COPY ./router/01-scrypted.conf /etc/nftables.d
|
|
|
|
# ipv6 forwarding
|
|
COPY ./router/scrypted-ip-forwarding.service /etc/systemd/system
|
|
RUN systemctl enable scrypted-ip-forwarding
|
|
|
|
# install turn server, but disable it too set it up on a per interface basis.
|
|
RUN apt -y update && apt -y install coturn && systemctl disable coturn && rm /usr/lib/systemd/system/coturn.service
|
|
|
|
# install usbmuxd for iphone tethering
|
|
# ensure the pairing info stays in persistent storage
|
|
RUN apt -y update && apt -y install usbmuxd && rm /usr/lib/systemd/system/usbmuxd.service && ln -sf /server/volume/plugins/\@scrypted/router/usbmuxd /var/lib/lockdown
|
|
|
|
# journald to RAM only, prevent disk writes from caddy logs
|
|
RUN mkdir -p /etc/systemd/journald.conf.d && \
|
|
printf '[Journal]\nStorage=volatile\nRuntimeMaxUse=50M\n' > /etc/systemd/journald.conf.d/ram.conf
|
|
|
|
# crowdsec intrusion prevention
|
|
RUN curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | bash
|
|
RUN apt -y install crowdsec || true
|
|
RUN apt -y install crowdsec-firewall-bouncer || true
|
|
|
|
COPY ./router/crowdsec/crowdsec-acquis.yaml /etc/crowdsec/acquis.yaml
|
|
|
|
RUN cscli hub update && \
|
|
cscli collections install crowdsecurity/linux crowdsecurity/caddy
|
|
|
|
COPY ./router/crowdsec/crowdsec-persist.sh /usr/local/bin/crowdsec-persist.sh
|
|
RUN chmod +x /usr/local/bin/crowdsec-persist.sh
|
|
COPY ./router/crowdsec/crowdsec-persist.service /etc/systemd/system/crowdsec-persist.service
|
|
RUN systemctl enable crowdsec-persist
|
|
|
|
RUN systemctl enable crowdsec crowdsec-firewall-bouncer
|
|
|
|
WORKDIR /
|
|
# cache bust
|
|
ADD "https://www.random.org/cgi-bin/randbyte?nbytes=10&format=h" skipcache
|
|
ARG SCRYPTED_INSTALL_VERSION="latest"
|
|
RUN test -n "$SCRYPTED_INSTALL_VERSION"
|
|
RUN npx -y scrypted@latest install-server ${SCRYPTED_INSTALL_VERSION}
|
|
|
|
COPY ./router/scrypted-dhcp-watcher.service /etc/systemd/system/scrypted-dhcp-watcher.service
|
|
RUN systemctl enable scrypted-dhcp-watcher
|
|
|
|
COPY ./router/scrypted.service /etc/systemd/system/scrypted.service
|
|
RUN systemctl enable scrypted
|
|
|
|
WORKDIR /
|
|
CMD ["/sbin/init"]
|