forked from sdr-enthusiasts/docker-reversewebproxy
-
Notifications
You must be signed in to change notification settings - Fork 0
/
docker-compose.yml
142 lines (141 loc) · 9.18 KB
/
docker-compose.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
version: '3.8'
services:
webproxy:
image: ghcr.io/sdr-enthusiasts/docker-reversewebproxy:latest
tty: true
container_name: webproxy
hostname: webproxy
restart: always
ports:
- 80:80
- 443:443
environment:
# ----------------------------------------------------------------------------------------
# if AUTOGENERATE is set to ON, it will automatically create a config based on the REVPROXY and REDIRECT parameters below
# if it is set to OFF, you should map the volume as shown in the "volumes" section below, and you can edit the "locations.conf" file in that directory.
#
# If you want to have the system auto-generate a locations.conf file that you will subsequently edit, you can set
# AUTOGENERATE=ON, then start the container once, stop the container again, and edit the system generated
# locations.conf file. Then, before restarting, please make sure to set AUTOGENERATE=OFF below.
- AUTOGENERATE=ON
# ----------------------------------------------------------------------------------------
# VERBOSELOGS indicates if the web server logs are written to the Docker Container logs
# (accessible with `docker logs webproxy`) or that they are discarded. Values are ON (default) or OFF
- VERBOSELOG=FILE # FOR GOACCESS STATS
# ----------------------------------------------------------------------------------------
# REVPROXY has the following format:
# urltarget,destination
# For example, for REVPROXY=readsb|http://10.0.0.191:8080,
# a user browsing to http://mydomain/readsb will be proxied to http://10.0.0.191:8080
# The user's browser will *never* see the internal IP address.
# Note - both the urltarget and the destination must be URLs or directories, and cannot be
# a file name
- REVPROXY=
readsb|http://10.0.0.191:8080,
piaware|http://10.0.0.191:8081,
tar1090|http://10.0.0.191:8082,
planefence|http://10.0.0.191:8083,
planefinder|http://10.0.0.191:8086,
ajax|http://10.0.0.191:8086/ajax,
assets|http://10.0.0.191:8086/assets,
graphs|http://10.0.0.191:8080/graphs,
radar|http://10.0.0.191:8080/radar,
acarshub|http://10.0.0.188:80
# ----------------------------------------------------------------------------------------
# REDIRECT has the following format:
# urltarget|redirection
# For example, for REDIRECT=/planefinder/setup.html|http://10.0.0.191:8086/setup.html,
# a user browing to http://mydomain/planefinder/setup.html will be redirected to http://10.0.0.191:8086/setup.html
# The user's browser will show the redirection address and try to reach it. If the destination is not reachable (for example
# because it is on a isolated subnet), the browser won't be able to render the page.
# This can be useful if you want to protect certain pages from view outside your internal network, while exposing
# others. See for example the planefinder setup in REVPROXY and REDIRECT.
# Note - both the urltarget and the redirection MAY BE a URL or a file names.
- REDIRECT=
/planefinder/setup.html|http://10.0.0.191:8086/setup.html,
/planefinder/logs.html|http://10.0.0.191:8086/logs.html
#
# ----------------------------------------------------------------------------------------
# The following settings will enable SSL to be part of the reverse proxy.
#
# SSL: enable SSL. Accepted values: [ENABLED|DISABLED]. Default: DISABLED
# SSL_EMAIL is used to request an SSL certificate from Let's Encrypt. The container
# will automatically renew them before the expire as long as you keep the container running.
#
# Change SSL_TOS=REJECT to SSL_TOS=ACCEPT to indicate you accept the T&S's for the SSL certificate
# set forth at https://letsencrypt.org/repository/#let-s-encrypt-subscriber-agreement
#
# If SSL_REDIRECT=ENABLED then all incoming non-SSL requests will automatically be redirected to a https:// request
#
# Put 1 or more domain names in SSL_DOMAIN. Note that *ALL OF THESE DOMAINS* must be reachable from the internet
# and render a website that is served from the container upon the start of the container,
# otherwise the request to get a certificate for them will fail!
#
# Also note that more than 5 (failed) requests will cause you to be locked out from getting new certificates for
# 1 week. We, nor LetsEncrypt, can "unlock" you. More info: https://letsencrypt.org/docs/rate-limits/
#
- SSL=ENABLED
- SSL_DOMAIN=
my.domain.com,
my.second.domain.com,
my.third.domain.com
- SSL_TOS=REJECT
- SSL_REDIRECT=ENABLED
#
# These settings will enable GeoIP inclusion or exclusion of requests based on country.
# Country names are two-letter abbreviations corresponding to the country suffix used in domain names.
# GEOIP_DEFAULT is "allow" (allow all except for country list)
# "block" (block all except for country list)
# <empty> no GeoIP blocking
# GEOIP_RESPONSECODE indicates which HTTP response is sent when a bot is blocked.
# Default code if omitted is 403 (Forbidden). Other codes that may be useful:
# 402 (payment required, hehe), 404 (doesnt exist), 418 (I am a teapot - used to tell requestors to go away), 410 (Gone), 500 (Internal Server Error),
# 503 (service unavailable), etc - see https://developer.mozilla.org/en-US/docs/Web/HTTP/Status
- GEOIP_RESPONSECODE=418
- GEOIP_DEFAULT=allow
- GEOIP_COUNTRIES=cn,ru
#
# BLOCKBOT blocks bots of which the User Agent contains all or part of these comma-separated strings:
- BLOCKBOT=
bot,LieBaoFast,UCBrowser,MQQBrowser,Mb2345Browser,
google,bing,yandex,msnbot,
AltaVista,Googlebot,Slurp,BlackWidow,Bot,ChinaClaw,Custo,DISCo,Download,Demon,eCatch,EirGrabber,EmailSiphon,EmailWolf,SuperHTTP,Surfbot,WebWhacker,
Express,WebPictures,ExtractorPro,EyeNetIE,FlashGet,GetRight,GetWeb!,Go!Zilla,Go-Ahead-Got-It,GrabNet,Grafula,HMView,Go!Zilla,Go-Ahead-Got-It,
rafula,HMView,HTTrack,Stripper,Sucker,Indy,InterGET,Ninja,JetCar,Spider,larbin,LeechFTP,Downloader,tool,Navroad,NearSite,NetAnts,tAkeOut,WWWOFFLE,
GrabNet,NetSpider,Vampire,NetZIP,Octopus,Offline,PageGrabber,Foto,pavuk,pcBrowser,RealDownload,ReGet,SiteSnagger,SmartDownload,SuperBot,WebSpider,
Teleport,VoidEYE,Collector,WebAuto,WebCopier,WebFetch,WebGo,WebLeacher,WebReaper,WebSauger,eXtractor,Quester,WebStripper,WebZIP,Wget,Widow,Zeus,
Twengabot,htmlparser,libwww,Python,perl,urllib,scan,email,PycURL,Pyth,PyQ,WebCollector,WebCopy,webcraw,PetalBot,ubermetrics,Firefox/45,
Vert.x-WebClient,jsonlite,rv:45.0,Nexgate Ruby Client,scoop.it,NetSystemsResearch
# BLOCKBOT_RESPONSECODE indicates which HTTP response is sent when a bot is blocked.
# Default code if omitted is 403 (Forbidden). Other codes that may be useful:
# 402 (payment required, hehe), 404 (doesnt exist), 418 (I am a teapot - used to tell requestors to go away), 410 (Gone), 500 (Internal Server Error),
# 503 (service unavailable), etc - see https://developer.mozilla.org/en-US/docs/Web/HTTP/Status
- BLOCKBOT_RESPONSECODE=403
tmpfs:
- /tmp:rw,nosuid,nodev,noexec,relatime,size=128M
volumes:
- /home/pi/.webproxy:/run/nginx # your prefer path
- "/etc/localtime:/etc/localtime:ro"
- "/etc/timezone:/etc/timezone:ro"
goaccess:
image: 'xavierh/goaccess-for-nginxproxymanager:latest'
container_name: goaccess
restart: always
ports:
- '7880:7880'
environment:
- PUID=0
- PGID=0
- TZ=Asia/Ho_Chi_Minh
- SKIP_ARCHIVED_LOGS=False #optional
- DEBUG=False #optional
- BASIC_AUTH=False #optional
- BASIC_AUTH_USERNAME=user #optional
- BASIC_AUTH_PASSWORD=pass #optional
- EXCLUDE_IPS=127.0.0.1 #optional - comma delimited
- LOG_TYPE=NCSA_COMBINED
- LOG_TYPE_FILE_PATTERN=access.log
- LANG=en_US.UTF-8
volumes:
- '/home/pi/.webproxy:/opt/log' # your prefer path