diff --git a/.env.example b/.env.example index fe6c634..50d8ae8 100644 --- a/.env.example +++ b/.env.example @@ -42,6 +42,9 @@ GODOXY_HTTPS_ADDR=:443 # API listening address GODOXY_API_ADDR=127.0.0.1:8888 +# Frontend listening port +GODOXY_FRONTEND_PORT=3000 + # Prometheus Metrics GODOXY_PROMETHEUS_ENABLED=true diff --git a/.github/workflows/docker-image-agent.yml b/.github/workflows/docker-image-agent.yml new file mode 100644 index 0000000..6e03e7a --- /dev/null +++ b/.github/workflows/docker-image-agent.yml @@ -0,0 +1,12 @@ +name: Docker Image CI (agent) + +on: + push: + tags: ["*"] + +jobs: + call-main-workflow: + uses: ./.github/workflows/docker-image.yml + with: + make_args: "agent=1" + image_name: ${{ github.repository }}-agent diff --git a/.github/workflows/docker-image-main.yml b/.github/workflows/docker-image-main.yml new file mode 100644 index 0000000..5469770 --- /dev/null +++ b/.github/workflows/docker-image-main.yml @@ -0,0 +1,9 @@ +name: Docker Image CI (main) + +on: + push: + tags: ["*"] + +jobs: + call-main-workflow: + uses: ./.github/workflows/docker-image.yml diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml index 1411cab..ab403e1 100644 --- a/.github/workflows/docker-image.yml +++ b/.github/workflows/docker-image.yml @@ -1,128 +1,139 @@ name: Docker Image CI on: - push: - tags: ["*"] + workflow_call: + inputs: + make_args: + description: "Arguments to pass to make" + type: string + required: false + default: "" + image_name: + description: "Image name" + type: string + required: false + default: ${{ github.repository }} env: - REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }} + REGISTRY: ghcr.io + IMAGE_NAME: ${{ inputs.image_name }} jobs: - build: - name: Build multi-platform Docker image - runs-on: ubuntu-22.04 + build: + name: Build multi-platform Docker image + runs-on: ubuntu-22.04 - permissions: - contents: read - packages: write - id-token: write - attestations: write + permissions: + contents: read + packages: write + id-token: write + attestations: write - strategy: - fail-fast: false - matrix: - platform: - - linux/amd64 - # - linux/arm/v6 - # - linux/arm/v7 - - linux/arm64 - steps: - - name: Prepare - run: | - platform=${{ matrix.platform }} - echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV + strategy: + fail-fast: false + matrix: + platform: + - linux/amd64 + # - linux/arm/v6 + # - linux/arm/v7 + - linux/arm64 + steps: + - name: Prepare + run: | + platform=${{ matrix.platform }} + echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV - - name: Docker meta - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + - name: Docker meta + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 - - name: Login to registry - uses: docker/login-action@v3 - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + - name: Login to registry + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} - - name: Build and push by digest - id: build - uses: docker/build-push-action@v6 - with: - platforms: ${{ matrix.platform }} - labels: ${{ steps.meta.outputs.labels }} - outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true - cache-from: type=gha - cache-to: type=gha,mode=max - build-args: | - VERSION=${{ github.ref_name }} + - name: Build and push by digest + id: build + uses: docker/build-push-action@v6 + with: + platforms: ${{ matrix.platform }} + labels: ${{ steps.meta.outputs.labels }} + outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true + cache-from: type=gha + cache-to: type=gha,mode=max + build-args: | + VERSION=${{ github.ref_name }} + MAKE_ARGS=${{ inputs.make_args }} - - name: Generate artifact attestation - uses: actions/attest-build-provenance@v1 - with: - subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}} - subject-digest: ${{ steps.build.outputs.digest }} - push-to-registry: true + - name: Generate artifact attestation + uses: actions/attest-build-provenance@v1 + with: + subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}} + subject-digest: ${{ steps.build.outputs.digest }} + push-to-registry: true - - name: Export digest - run: | - mkdir -p /tmp/digests - digest="${{ steps.build.outputs.digest }}" - touch "/tmp/digests/${digest#sha256:}" + - name: Export digest + run: | + mkdir -p /tmp/digests + digest="${{ steps.build.outputs.digest }}" + touch "/tmp/digests/${digest#sha256:}" - - name: Upload digest - uses: actions/upload-artifact@v4 - with: - name: digests-${{ env.PLATFORM_PAIR }} - path: /tmp/digests/* - if-no-files-found: error - retention-days: 1 - merge: - runs-on: ubuntu-22.04 - needs: - - build - permissions: - contents: read - packages: write - id-token: write - steps: - - name: Download digests - uses: actions/download-artifact@v4 - with: - path: /tmp/digests - pattern: digests-* - merge-multiple: true + - name: Upload digest + uses: actions/upload-artifact@v4 + with: + name: digests-${{ env.PLATFORM_PAIR }} + path: /tmp/digests/* + if-no-files-found: error + retention-days: 1 + merge: + runs-on: ubuntu-22.04 + needs: + - build + permissions: + contents: read + packages: write + id-token: write + steps: + - name: Download digests + uses: actions/download-artifact@v4 + with: + path: /tmp/digests + pattern: digests-* + merge-multiple: true - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 - - name: Docker meta - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + - name: Docker meta + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - - name: Login to registry - uses: docker/login-action@v3 - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + - name: Login to registry + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} - - name: Create manifest list and push - id: push - working-directory: /tmp/digests - run: | - docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ - $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *) + - name: Create manifest list and push + id: push + working-directory: /tmp/digests + run: | + docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ + $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *) - - name: Inspect image - run: | - docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} + - name: Inspect image + run: | + docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }} diff --git a/.gitignore b/.gitignore index 18745f6..2f07875 100755 --- a/.gitignore +++ b/.gitignore @@ -29,4 +29,7 @@ mtrace.json test.Dockerfile node_modules/ -tsconfig.tsbuildinfo \ No newline at end of file +tsconfig.tsbuildinfo + +!agent.compose.yml +!agent/pkg/** \ No newline at end of file diff --git a/Dockerfile b/Dockerfile index 1d52f7b..7e81ca4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Stage 1: Builder -FROM golang:1.23.5-alpine AS builder +FROM golang:1.23.6-alpine AS builder HEALTHCHECK NONE # package version does not matter @@ -21,18 +21,19 @@ COPY Makefile /src/ COPY cmd /src/cmd COPY internal /src/internal COPY pkg /src/pkg +COPY agent /src/agent ARG VERSION ENV VERSION=${VERSION} -ARG BUILD_FLAGS -ENV BUILD_FLAGS=${BUILD_FLAGS} +ARG MAKE_ARGS +ENV MAKE_ARGS=${MAKE_ARGS} RUN --mount=type=cache,target="/go/pkg/mod" \ --mount=type=cache,target="/root/.cache/go-build" \ - make build && \ - mkdir -p /app/error_pages /app/certs && \ - mv bin/godoxy /app/godoxy + make ${MAKE_ARGS} build create-docker-entrypoint && \ + mv bin /app/ && \ + mkdir -p /app/error_pages /app/certs # Stage 2: Final image FROM scratch @@ -53,12 +54,7 @@ COPY config.example.yml /app/config/config.yml COPY --from=builder /etc/ssl/certs /etc/ssl/certs ENV DOCKER_HOST=unix:///var/run/docker.sock -ENV GODOXY_DEBUG=0 - -EXPOSE 80 -EXPOSE 8888 -EXPOSE 443 WORKDIR /app -CMD ["/app/godoxy"] \ No newline at end of file +CMD ["/app/entrypoint.sh"] \ No newline at end of file diff --git a/Makefile b/Makefile index f6b8521..26a25ce 100755 --- a/Makefile +++ b/Makefile @@ -4,16 +4,27 @@ export GOOS = linux LDFLAGS = -X github.com/yusing/go-proxy/pkg.version=${VERSION} + +ifeq ($(agent), 1) + NAME = godoxy-agent + CMD_PATH = ./agent/cmd +else + NAME = godoxy + CMD_PATH = ./cmd +endif + ifeq ($(trace), 1) - debug = 1 - GODOXY_TRACE ?= 1 + debug = 1 + GODOXY_TRACE ?= 1 endif ifeq ($(debug), 1) CGO_ENABLED = 0 GODOXY_DEBUG = 1 - BUILD_FLAGS = -tags production -else ifeq ($(pprof), 1) + BUILD_FLAGS ?= -tags production +endif + +ifeq ($(pprof), 1) CGO_ENABLED = 1 GODEBUG = gctrace=1 inittrace=1 schedtrace=3000 GORACE = log_path=logs/pprof strip_path_prefix=$(shell pwd)/ @@ -23,12 +34,14 @@ else ifeq ($(pprof), 1) else CGO_ENABLED = 0 LDFLAGS += -s -w - BUILD_FLAGS = -pgo=auto -tags production + BUILD_FLAGS = -pgo=auto -tags production DOCKER_TAG = latest endif BUILD_FLAGS += -ldflags='$(LDFLAGS)' +export NAME +export CMD_PATH export CGO_ENABLED export GODOXY_DEBUG export GODOXY_TRACE @@ -45,14 +58,14 @@ get: build: mkdir -p bin - go build ${BUILD_FLAGS} -o bin/godoxy ./cmd + go build ${BUILD_FLAGS} -o bin/${NAME} ${CMD_PATH} if [ $(shell id -u) -eq 0 ]; \ - then setcap CAP_NET_BIND_SERVICE=+eip bin/godoxy; \ - else sudo setcap CAP_NET_BIND_SERVICE=+eip bin/godoxy; \ + then setcap CAP_NET_BIND_SERVICE=+eip bin/${NAME}; \ + else sudo setcap CAP_NET_BIND_SERVICE=+eip bin/${NAME}; \ fi run: - [ -f .env ] && godotenv -f .env go run ${BUILD_FLAGS} ./cmd + [ -f .env ] && godotenv -f .env go run ${BUILD_FLAGS} ${CMD_PATH} mtrace: bin/godoxy debug-ls-mtrace > mtrace.json @@ -76,18 +89,25 @@ push-docker-io: BUILDER=build docker buildx build \ --platform linux/arm64,linux/amd64 \ -f Dockerfile \ - -t docker.io/yusing/godoxy-nightly:${DOCKER_TAG} \ - -t docker.io/yusing/godoxy-nightly:${VERSION}-${BUILD_DATE} \ + -t docker.io/yusing/${NAME}-nightly:${DOCKER_TAG} \ + -t docker.io/yusing/${NAME}-nightly:${VERSION}-${BUILD_DATE} \ --build-arg VERSION="${VERSION}-nightly-${BUILD_DATE}" \ --build-arg BUILD_FLAGS="${BUILD_FLAGS}" \ + --build-arg MAKE_ARGS="agent=${agent}" \ --push . build-docker: - docker build -t godoxy-nightly \ + docker build -t ${NAME}-nightly \ --build-arg VERSION="${VERSION}-nightly-${BUILD_DATE}" \ --build-arg BUILD_FLAGS="${BUILD_FLAGS}" \ + --build-arg MAKE_ARGS="agent=${agent}" \ . +create-docker-entrypoint: + printf '#!/bin/sh\n/app/${NAME}\n' > bin/entrypoint.sh + chmod +x bin/entrypoint.sh + + # To generate schema # comment out this part from typescript-json-schema.js#L884 # diff --git a/README.md b/README.md index 28ee861..3890794 100755 --- a/README.md +++ b/README.md @@ -59,11 +59,21 @@ For full documentation, check out **[Wiki](https://github.com/yusing/go-proxy/wi ## Prerequisites -Setup DNS Records point to machine which runs `GoDoxy`, e.g. +1. Setup DNS Records point to machine which runs `GoDoxy`, e.g. - A Record: `*.y.z` -> `10.0.10.1` - AAAA Record: `*.y.z` -> `::ffff:a00:a01` +2. Create shell alias: + + ```shell + # for main server + alias godoxy="docker exec godoxy /app/godoxy" + + # for agent server + alias godoxy-agent="docker exec godoxy-agent /app/godoxy-agent" + ``` + ## Setup **NOTE:** GoDoxy is designed to be (and only works when) running in `host` network mode, do not change it. To change listening ports, modify `.env`. diff --git a/agent.compose.yml b/agent.compose.yml new file mode 100644 index 0000000..b9e903e --- /dev/null +++ b/agent.compose.yml @@ -0,0 +1,12 @@ +services: + godoxy-agent: + image: ghcr.io/yusing/godoxy-agent:latest + container_name: godoxy-agent + restart: always + network_mode: host # do not change this + environment: + GODOXY_AGENT_NAME: "agent-1" + GODOXY_AGENT_PORT: "8890" + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - ./certs:/app/certs # store Agent CA cert and Agent SSL cert diff --git a/compose.example.yml b/compose.example.yml index 0c4d68c..0b34db9 100755 --- a/compose.example.yml +++ b/compose.example.yml @@ -4,14 +4,17 @@ services: image: ghcr.io/yusing/go-proxy-frontend:latest container_name: godoxy-frontend restart: unless-stopped - network_mode: host + network_mode: host # do not change this env_file: .env depends_on: - app + environment: + PORT: ${GODOXY_FRONTEND_PORT:-3000} + # modify below to fit your needs labels: proxy.aliases: godoxy - proxy.godoxy.port: 3000 + proxy.godoxy.port: ${GODOXY_FRONTEND_PORT:-3000} # proxy.godoxy.middlewares.cidr_whitelist: | # status: 403 # message: IP not allowed @@ -24,7 +27,7 @@ services: image: ghcr.io/yusing/go-proxy:latest container_name: godoxy restart: always - network_mode: host + network_mode: host # do not change this env_file: .env volumes: - /var/run/docker.sock:/var/run/docker.sock diff --git a/go.mod b/go.mod index 5e3ca43..3c6c491 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/yusing/go-proxy -go 1.23.5 +go 1.23.6 require ( github.com/PuerkitoBio/goquery v1.10.1 diff --git a/next-release.md b/next-release.md index 436e943..2910166 100644 --- a/next-release.md +++ b/next-release.md @@ -1,6 +1,36 @@ -GoDoxy v0.9.1 expected changes +## GoDoxy v0.10.0 -- Support Ntfy notifications -- Prometheus metrics server now inside API server under `/v1/metrics` - - `GODOXY_PROMETHEUS_ADDR` removed - - `GODOXY_PROMETHEUS_ENABLED` added, default `false` +### Agent Mode + +listen only on Agent API server, authenticate with mTLS. Maintain secure connection between GoDoxy main and GoDoxy agent server + +Main benefits: + +- No more exposing docker socket: drops the need of `docker-socket-proxy` +- No more exposing app ports: fewer attack surface + ```yaml + services: + app: + ... + # ports: # this part is not needed on agent server + # - 6789 + ``` +- Secure: no one can connect to it except GoDoxy main server because of mTLS +- Fetch info from agent server, e.g. CPU usage, Memory usage, container list, container logs, etc... (to be ready for beszel and dockge like features in WebUI) + +### How to setup + +1. Agent server generates CA cert, SSL certificate and Client certificate on first run. +2. Follow the output on screen to run `godoxy new-agent : ...` on GoDoxy main server to store generated certs +3. Add config output to GoDoxy main server in `config.yml` under `providers.agents` + ```yaml + providers: + agents: + - 12.34.5.6:8889 + ``` + +### How does it work + +1. Main server and agent server negotiate mTLS +2. Agent server verify main server's client cert and check if server version matches agent version +3. Agent server now acts as a http proxy and docker socket proxy