79 lines
2.5 KiB
Bash
79 lines
2.5 KiB
Bash
|
#!/bin/bash
|
||
|
|
|
||
|
|
HOST_BASE="/opt/gbo/tenants/$PARAM_TENANT/proxy"
|
||
|
|
HOST_DATA="$HOST_BASE/data"
|
||
|
|
HOST_CONF="$HOST_BASE/conf"
|
||
|
|
HOST_LOGS="$HOST_BASE/logs"
|
||
|
|
|
||
|
|
mkdir -p "$HOST_DATA" "$HOST_CONF" "$HOST_LOGS"
|
||
|
|
chmod -R 750 "$HOST_BASE"
|
||
|
|
|
||
|
|
lxc launch images:debian/12 "$PARAM_TENANT"-proxy -c security.privileged=true
|
||
|
|
sleep 15
|
||
|
|
|
||
|
|
lxc exec "$PARAM_TENANT"-proxy -- bash -c "
|
||
|
|
apt-get update && apt-get install -y curl libcap2-bin
|
||
|
|
curl -sL \"https://github.com/caddyserver/caddy/releases/download/v2.10.0-beta.3/caddy_2.10.0-beta.3_linux_amd64.tar.gz\" | tar -C /usr/local/bin -xz caddy
|
||
|
|
chmod 755 /usr/local/bin/caddy
|
||
|
|
setcap 'cap_net_bind_service=+ep' /usr/local/bin/caddy
|
||
|
|
useradd --system --no-create-home --shell /usr/sbin/nologin caddy
|
||
|
|
"
|
||
|
|
|
||
|
|
CADDY_UID=$(lxc exec "$PARAM_TENANT"-proxy -- id -u caddy)
|
||
|
|
CADDY_GID=$(lxc exec "$PARAM_TENANT"-proxy -- id -g caddy)
|
||
|
|
HOST_CADDY_UID=$((100000 + CADDY_UID))
|
||
|
|
HOST_CADDY_GID=$((100000 + CADDY_GID))
|
||
|
|
chown -R "$HOST_CADDY_UID:$HOST_CADDY_GID" "$HOST_BASE"
|
||
|
|
|
||
|
|
lxc config device add "$PARAM_TENANT"-proxy proxydata disk source="$HOST_DATA" path=/var/lib/caddy
|
||
|
|
lxc config device add "$PARAM_TENANT"-proxy proxyconf disk source="$HOST_CONF" path=/etc/caddy
|
||
|
|
lxc config device add "$PARAM_TENANT"-proxy proxylogs disk source="$HOST_LOGS" path=/var/log/caddy
|
||
|
|
|
||
|
|
lxc exec "$PARAM_TENANT"-proxy -- bash -c "
|
||
|
|
mkdir -p /var/lib/caddy /etc/caddy /var/log/caddy
|
||
|
|
chown -R caddy:caddy /var/lib/caddy /etc/caddy /var/log/caddy
|
||
|
|
|
||
|
|
cat > /etc/caddy/Caddyfile <<EOF
|
||
|
|
:80 {
|
||
|
|
respond \"Welcome to $PARAM_TENANT Proxy\"
|
||
|
|
log {
|
||
|
|
output file /var/log/caddy/access.log
|
||
|
|
}
|
||
|
|
}
|
||
|
|
EOF
|
||
|
|
|
||
|
|
cat > /etc/systemd/system/caddy.service <<EOF
|
||
|
|
[Unit]
|
||
|
|
Description=Caddy
|
||
|
|
After=network.target
|
||
|
|
|
||
|
|
[Service]
|
||
|
|
User=caddy
|
||
|
|
Group=caddy
|
||
|
|
ExecStart=/usr/local/bin/caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
|
||
|
|
ExecReload=/usr/local/bin/caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile
|
||
|
|
TimeoutStopSec=5s
|
||
|
|
LimitNOFILE=1048576
|
||
|
|
LimitNPROC=512
|
||
|
|
PrivateTmp=true
|
||
|
|
ProtectSystem=full
|
||
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
||
|
|
|
||
|
|
[Install]
|
||
|
|
WantedBy=multi-user.target
|
||
|
|
EOF
|
||
|
|
|
||
|
|
systemctl daemon-reload
|
||
|
|
systemctl enable caddy
|
||
|
|
systemctl start caddy
|
||
|
|
"
|
||
|
|
|
||
|
|
lxc config device remove "$PARAM_TENANT"-proxy http-proxy 2>/dev/null || true
|
||
|
|
lxc config device add "$PARAM_TENANT"-proxy http-proxy proxy \
|
||
|
|
listen=tcp:0.0.0.0:"$PARAM_HTTP_PORT" \
|
||
|
|
connect=tcp:127.0.0.1:"$PARAM_HTTP_PORT"
|
||
|
|
|
||
|
|
lxc config device remove "$PARAM_TENANT"-proxy https-proxy 2>/dev/null || true
|
||
|
|
lxc config device add "$PARAM_TENANT"-proxy https-proxy proxy \
|
||
|
|
listen=tcp:0.0.0.0:"$PARAM_HTTPS_PORT" \
|
||
|
|
connect=tcp:127.0.0.1:"$PARAM_HTTPS_PORT"
|