linuxserver/swag

This readme has been truncated from the full version found HERE

Application Setup

Validation and initial setup

• Before running this container, make sure that the url and subdomains are properly forwarded to this container's host, and that port 443 (and/or 80) is not being used by another service on the host (NAS gui, another webserver, etc.).
• If you need a dynamic dns provider, you can use the free provider duckdns.org where the URL will be yoursubdomain.duckdns.org and the SUBDOMAINS can be www,ftp,cloud with http validation, or wildcard with dns validation. You can use our duckdns image to update your IP on duckdns.org.
• For http validation, port 80 on the internet side of the router should be forwarded to this container's port 80
• For dns validation, make sure to enter your credentials into the corresponding ini (or json for some plugins) file under /config/dns-conf

1. Certs that only cover your main subdomain (ie. `yoursubdomain.duckdns.org`, leave the `SUBDOMAINS` variable empty)
2. Certs that cover sub-subdomains of your main subdomain (ie. `*.yoursubdomain.duckdns.org`, set the `SUBDOMAINS` variable to `wildcard`)

DOCKER_MODS=linuxserver/mods:universal-package-install
INSTALL_PIP_PACKAGES=certbot-dns-<plugin>

Security and password protection

• The container detects changes to url and subdomains, revokes existing certs and generates new ones during start.
• Per RFC7919, the container is shipping ffdhe4096 as the dhparams.pem.
• If you'd like to password protect your sites, you can use htpasswd. Run the following command on your host to generate the htpasswd file docker exec -it swag htpasswd -c /config/nginx/.htpasswd <username>
• You can add multiple user:pass to .htpasswd. For the first user, use the above command, for others, use the above command without the -c flag, as it will force deletion of the existing .htpasswd and creation of a new one
• You can also use ldap auth for security and access control. A sample, user configurable ldap.conf is provided, and it requires the separate image linuxserver/ldap-auth to communicate with an ldap server.

Site config and reverse proxy

• The default site config resides at /config/nginx/site-confs/default.conf. Feel free to modify this file, and you can add other conf files to this directory. However, if you delete the default file, a new default will be created on container start.
• Preset reverse proxy config files are added for popular apps. See the README.md file under /config/nginx/proxy_confs for instructions on how to enable them. The preset confs reside in and get imported from this repo.
• If you wish to hide your site from search engine crawlers, you may find it useful to add this configuration line to your site config, within the server block, above the line where ssl.conf is included

• If you wish to redirect http to https, you must expose port 80

Using certs in other containers

• This container includes auto-generated pfx and private-fullchain-bundle pem certs that are needed by other apps like Emby and Znc.

Using fail2ban

• This container includes fail2ban set up with 5 jails by default:

• To enable or disable other jails, modify the file /config/fail2ban/jail.local
• To modify filters and actions, instead of editing the .conf files, create .local files with the same name and edit those because .conf files get overwritten when the actions and filters are updated. .local files will append whatever's in the .conf files (ie. nginx-http-auth.conf --> nginx-http-auth.local)
• You can check which jails are active via docker exec -it swag fail2ban-client status
• You can check the status of a specific jail via docker exec -it swag fail2ban-client status <jail name>
• You can unban an IP via docker exec -it swag fail2ban-client set <jail name> unbanip <IP>
• A list of commands for fail2ban-client can be found here

Updating configs

• This container creates a number of configs for nginx, proxy samples, etc.
• Config updates are noted in the changelog but not automatically applied to your files.
• If you have modified a file with noted changes in the changelog:

• If you have NOT modified a file with noted changes in the changelog:

• Proxy sample updates are not listed in the changelog. See the changes here: https://github.com/linuxserver/reverse-proxy-confs/commits/master
• Proxy sample files WILL be updated, however your renamed (enabled) proxy files will not.
• You can check the new sample and adjust your active config as needed.

QUIC support

Migration from the old linuxserver/letsencrypt image

Usage

docker run -d \
  --name=swag \
  --cap-add=NET_ADMIN \
  -e PUID=1000 \
  -e PGID=1000 \
  -e TZ=Etc/UTC \
  -e URL=example.com \
  -e VALIDATION=http \
  -e SUBDOMAINS=www, `#optional` \
  -e CERTPROVIDER= `#optional` \
  -e CERT_PROFILE= `#optional` \
  -e DNSPLUGIN=cloudflare `#optional` \
  -e PROPAGATION= `#optional` \
  -e EMAIL= `#optional` \
  -e ONLY_SUBDOMAINS=false `#optional` \
  -e EXTRA_DOMAINS= `#optional` \
  -e STAGING=false `#optional` \
  -e DISABLE_F2B= `#optional` \
  -e SWAG_AUTORELOAD= `#optional` \
  -e SWAG_AUTORELOAD_WATCHLIST= `#optional` \
  -p 443:443 \
  -p 80:80 `#optional` \
  -p 443:443/udp `#optional` \
  -v /path/to/swag/config:/config \
  --restart unless-stopped \
  lscr.io/linuxserver/swag:latest