mirror of
https://github.com/jokob-sk/NetAlertX.git
synced 2026-01-27 08:08:05 -05:00
jokob-sk
@@ -3,6 +3,9 @@
|
||||
> [!NOTE]
|
||||
> This is community-contributed. Due to environment, setup, or networking differences, results may vary. Please open a PR to improve it instead of creating an issue, as the maintainer is not actively maintaining it.
|
||||
|
||||
> [!NOTE]
|
||||
> NetAlertX requires access to both the **web UI** (default `20211`) and the **GraphQL backend `GRAPHQL_PORT`** (default `20212`) ports.
|
||||
> Ensure your reverse proxy allows traffic to both for proper functionality.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> You will need to specify 2 entries in your reverse proxy, one for the front end, one for the backend URL. The custom backend URL, including the `GRAPHQL_PORT`, needs to be aslo specified in the `BACKEND_API_URL` setting.This is the URL that points to the backend API server.
|
||||
@@ -11,6 +14,12 @@
|
||||
>
|
||||
> 
|
||||
|
||||
See also:
|
||||
|
||||
- [CADDY + AUTHENTIK](./REVERSE_PROXY_CADDY.md)
|
||||
- [TRAEFIK](./REVERSE_PROXY_TRAEFIK.md)
|
||||
|
||||
|
||||
## NGINX HTTP Configuration (Direct Path)
|
||||
|
||||
> Submitted by amazing [cvc90](https://github.com/cvc90) 🙏
|
||||
@@ -514,888 +523,4 @@ Mapping the updated file (on the local filesystem at `/appl/docker/netalertx/def
|
||||
...
|
||||
```
|
||||
|
||||
## Caddy + Authentik Outpost Proxy SSO
|
||||
> Submitted by [luckylinux](https://github.com/luckylinux) 🙏.
|
||||
|
||||
### Introduction
|
||||
|
||||
This Setup assumes:
|
||||
|
||||
1. Authentik Installation running on a separate Host at `https://authentik.MYDOMAIN.TLD`
|
||||
2. Container Management is done on Baremetal OR in a Virtual Machine (KVM/Xen/ESXi/..., no LXC Containers !):
|
||||
i. Docker and Docker Compose configured locally running as Root (needed for `network_mode: host`) OR
|
||||
ii. Podman (optionally `podman-compose`) configured locally running as Root (needed for `network_mode: host`)
|
||||
3. TLS Certificates are already pre-obtained and located at `/var/lib/containers/certificates/letsencrypt/MYDOMAIN.TLD`.
|
||||
I use the `certbot/dns-cloudflare` Podman Container on a separate Host to obtain the Certificates which I then distribute internally.
|
||||
This Container uses the Wildcard Top-Level Domain Certificate which is valid for `MYDOMAIN.TLD` and `*.MYDOMAIN.TLD`.
|
||||
4. Proxied Access
|
||||
i. NetAlertX Web Interface is accessible via Caddy Reverse Proxy at `https://netalertx.MYDOMAIN.TLD` (default HTTPS Port 443: `https://netalertx.MYDOMAIN.TLD:443`) with `REPORT_DASHBOARD_URL=https://netalertx.MYDOMAIN.TLD`
|
||||
ii. NetAlertX GraphQL Interface is accessible via Caddy Reverse Proxy at `https://netalertx.MYDOMAIN.TLD:20212` with `BACKEND_API_URL=https://netalertx.MYDOMAIN.TLD:20212`
|
||||
iii. Authentik Proxy Outpost is accessible via Caddy Reverse Proxy at `https://netalertx.MYDOMAIN.TLD:9443`
|
||||
5. Internal Ports
|
||||
i. NGINX Web Server is set to listen on internal Port 20211 set via `PORT=20211`
|
||||
ii. Python Web Server is set to listen on internal Port `GRAPHQL_PORT=20219`
|
||||
iii. Authentik Proxy Outpost is listening on internal Port `AUTHENTIK_LISTEN__HTTP=[::1]:6000` (unencrypted) and Port `AUTHENTIK_LISTEN__HTTPS=[::1]:6443` (encrypted)
|
||||
|
||||
8. Some further Configuration for Caddy is performed in Terms of Logging, SSL Certificates, etc
|
||||
|
||||
It's also possible to [let Caddy automatically request & keep TLS Certificates up-to-date](https://caddyserver.com/docs/automatic-https), although please keep in mind that:
|
||||
|
||||
1. You risk enumerating your LAN. Every Domain/Subdomain for which Caddy requests a TLS Certificate for you will result in that Host to be listed on [List of Letsencrypt Certificates issued](https://crt.sh/).
|
||||
2. You need to either:
|
||||
i. Open Port 80 for external Access ([HTTP challenge](https://caddyserver.com/docs/automatic-https#http-challenge)) in order for Letsencrypt to verify the Ownership of the Domain/Subdomain
|
||||
ii. Open Port 443 for external Access ([TLS-ALPN challenge](https://caddyserver.com/docs/automatic-https#tls-alpn-challenge)) in order for Letsencrypt to verify the Ownership of the Domain/Subdomain
|
||||
iii. Give Caddy the Credentials to update the DNS Records at your DNS Provider ([DNS challenge](https://caddyserver.com/docs/automatic-https#dns-challenge))
|
||||
|
||||
You can also decide to deploy your own Certificates & Certification Authority, either manually with OpenSSL, or by using something like [mkcert](https://github.com/FiloSottile/mkcert).
|
||||
|
||||
In Terms of IP Stack Used:
|
||||
- External: Caddy listens on both IPv4 and IPv6.
|
||||
- Internal:
|
||||
- Authentik Outpost Proxy listens on IPv6 `[::1]`
|
||||
- NetAlertX listens on IPv4 `0.0.0.0`
|
||||
|
||||
### Flow
|
||||
The Traffic Flow will therefore be as follows:
|
||||
|
||||
- Web GUI:
|
||||
i. Client accesses `http://authentik.MYDOMAIN.TLD:80`: default (built-in Caddy) Redirect to `https://authentik.MYDOMAIN.TLD:443`
|
||||
ii. Client accesses `https://authentik.MYDOMAIN.TLD:443` -> reverse Proxy to internal Port 20211 (NetAlertX Web GUI / NGINX - unencrypted)
|
||||
- GraphQL: Client accesses `https://authentik.MYDOMAIN.TLD:20212` -> reverse Proxy to internal Port 20219 (NetAlertX GraphQL - unencrypted)
|
||||
- Authentik Outpost: Client accesses `https://authentik.MYDOMAIN.TLD:9443` -> reverse Proxy to internal Port 6000 (Authentik Outpost Proxy - unencrypted)
|
||||
|
||||
An Overview of the Flow is provided in the Picture below:
|
||||
|
||||
|
||||
|
||||
### Security Considerations
|
||||
|
||||
#### Caddy should be run rootless
|
||||
|
||||
> [!WARNING]
|
||||
> By default Caddy runs as `root` which is a Security Risk.
|
||||
> In order to solve this, it's recommended to create an unprivileged User `caddy` and Group `caddy` on the Host:
|
||||
> ```
|
||||
> groupadd --gid 980 caddy
|
||||
> useradd --shell /usr/sbin/nologin --gid 980 --uid 980 -c "Caddy web server" --base-dir /var/lib/caddy
|
||||
> ```
|
||||
|
||||
At least using Quadlets with Usernames (NOT required with UID/GID), but possibly using Compose in certain Cases as well, a custom `/etc/passwd` and `/etc/group` might need to be bind-mounted inside the Container.
|
||||
`passwd`:
|
||||
```
|
||||
root:x:0:0:root:/root:/bin/sh
|
||||
bin:x:1:1:bin:/bin:/sbin/nologin
|
||||
daemon:x:2:2:daemon:/sbin:/sbin/nologin
|
||||
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
|
||||
sync:x:5:0:sync:/sbin:/bin/sync
|
||||
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
|
||||
halt:x:7:0:halt:/sbin:/sbin/halt
|
||||
mail:x:8:12:mail:/var/mail:/sbin/nologin
|
||||
news:x:9:13:news:/usr/lib/news:/sbin/nologin
|
||||
uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
|
||||
cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
|
||||
ftp:x:21:21::/var/lib/ftp:/sbin/nologin
|
||||
sshd:x:22:22:sshd:/dev/null:/sbin/nologin
|
||||
games:x:35:35:games:/usr/games:/sbin/nologin
|
||||
ntp:x:123:123:NTP:/var/empty:/sbin/nologin
|
||||
guest:x:405:100:guest:/dev/null:/sbin/nologin
|
||||
nobody:x:65534:65534:nobody:/:/sbin/nologin
|
||||
caddy:x:980:980:caddy:/var/lib/caddy:/bin/sh
|
||||
```
|
||||
|
||||
`group`:
|
||||
```
|
||||
root:x:0:root
|
||||
bin:x:1:root,bin,daemon
|
||||
daemon:x:2:root,bin,daemon
|
||||
sys:x:3:root,bin
|
||||
adm:x:4:root,daemon
|
||||
tty:x:5:
|
||||
disk:x:6:root
|
||||
lp:x:7:lp
|
||||
kmem:x:9:
|
||||
wheel:x:10:root
|
||||
floppy:x:11:root
|
||||
mail:x:12:mail
|
||||
news:x:13:news
|
||||
uucp:x:14:uucp
|
||||
cron:x:16:cron
|
||||
audio:x:18:
|
||||
cdrom:x:19:
|
||||
dialout:x:20:root
|
||||
ftp:x:21:
|
||||
sshd:x:22:
|
||||
input:x:23:
|
||||
tape:x:26:root
|
||||
video:x:27:root
|
||||
netdev:x:28:
|
||||
kvm:x:34:kvm
|
||||
games:x:35:
|
||||
shadow:x:42:
|
||||
www-data:x:82:
|
||||
users:x:100:games
|
||||
ntp:x:123:
|
||||
abuild:x:300:
|
||||
utmp:x:406:
|
||||
ping:x:999:
|
||||
nogroup:x:65533:
|
||||
nobody:x:65534:
|
||||
caddy:x:980:
|
||||
```
|
||||
|
||||
#### Authentication of GraphQL Endpoint
|
||||
|
||||
> [!WARNING]
|
||||
> Currently the GraphQL Endpoint is NOT authenticated !
|
||||
|
||||
### Environment Files
|
||||
Depending on the Preference of the User (Environment Variables defined in Compose/Quadlet or in external `.env` File[s]), it might be prefereable to place at least some Environment Variables in external `.env` and `.env.<application>` Files.
|
||||
|
||||
The following is proposed:
|
||||
|
||||
- `.env`: common Settings (empty by Default)
|
||||
- `.env.caddy`: Caddy Settings
|
||||
- `.env.server`: NetAlertX Server/Application Settings
|
||||
- `.env.outpost.proxy`: Authentik Proxy Outpost Settings
|
||||
|
||||
The following Contents is assumed.
|
||||
|
||||
`.env.caddy`:
|
||||
```
|
||||
# Define Application Hostname
|
||||
APPLICATION_HOSTNAME=netalertx.MYDOMAIN.TLD
|
||||
|
||||
# Define Certificate Domain
|
||||
# In this case: use Wildcard Certificate
|
||||
APPLICATION_CERTIFICATE_DOMAIN=MYDOMAIN.TLD
|
||||
APPLICATION_CERTIFICATE_CERT_FILE=fullchain.pem
|
||||
APPLICATION_CERTIFICATE_KEY_FILE=privkey.pem
|
||||
|
||||
# Define Outpost Hostname
|
||||
OUTPOST_HOSTNAME=netalertx.MYDOMAIN.TLD
|
||||
|
||||
# Define Outpost External Port (TLS)
|
||||
OUTPOST_EXTERNAL_PORT=9443
|
||||
```
|
||||
|
||||
`.env.server`:
|
||||
```
|
||||
PORT=20211
|
||||
PORT_SSL=443
|
||||
NETALERTX_NETWORK_MODE=host
|
||||
LISTEN_ADDR=0.0.0.0
|
||||
GRAPHQL_PORT=20219
|
||||
NETALERTX_DEBUG=1
|
||||
BACKEND_API_URL=https://netalertx.MYDOMAIN.TLD:20212
|
||||
```
|
||||
|
||||
`.env.outpost.proxy`:
|
||||
```
|
||||
AUTHENTIK_TOKEN=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||||
AUTHENTIK_LISTEN__HTTP=[::1]:6000
|
||||
AUTHENTIK_LISTEN__HTTPS=[::1]:6443
|
||||
```
|
||||
|
||||
### Compose Setup
|
||||
```
|
||||
version: "3.8"
|
||||
services:
|
||||
netalertx-caddy:
|
||||
container_name: netalertx-caddy
|
||||
|
||||
network_mode: host
|
||||
image: docker.io/library/caddy:latest
|
||||
pull: missing
|
||||
|
||||
env_file:
|
||||
- .env
|
||||
- .env.caddy
|
||||
|
||||
environment:
|
||||
CADDY_DOCKER_CADDYFILE_PATH: "/etc/caddy/Caddyfile"
|
||||
|
||||
volumes:
|
||||
- ./Caddyfile:/etc/caddy/Caddyfile:ro,z
|
||||
- /var/lib/containers/data/netalertx/caddy:/data/caddy:rw,z
|
||||
- /var/lib/containers/log/netalertx/caddy:/var/log:rw,z
|
||||
- /var/lib/containers/config/netalertx/caddy:/config/caddy:rw,z
|
||||
- /var/lib/containers/certificates/letsencrypt:/certificates:ro,z
|
||||
|
||||
# Set User
|
||||
user: "caddy:caddy"
|
||||
|
||||
# Automatically restart Container
|
||||
restart: unless-stopped
|
||||
|
||||
netalertx-server:
|
||||
container_name: netalertx-server # The name when you docker contiainer ls
|
||||
|
||||
network_mode: host # Use host networking for ARP scanning and other services
|
||||
|
||||
depends_on:
|
||||
netalertx-caddy:
|
||||
condition: service_started
|
||||
restart: true
|
||||
netalertx-outpost-proxy:
|
||||
condition: service_started
|
||||
restart: true
|
||||
|
||||
# Local built Image including latest Changes
|
||||
image: localhost/netalertx-dev:dev-20260109-232454
|
||||
|
||||
read_only: true # Make the container filesystem read-only
|
||||
|
||||
# It is most secure to start with user 20211, but then we lose provisioning capabilities.
|
||||
# user: "${NETALERTX_UID:-20211}:${NETALERTX_GID:-20211}"
|
||||
cap_drop: # Drop all capabilities for enhanced security
|
||||
- ALL
|
||||
cap_add: # Add only the necessary capabilities
|
||||
- NET_ADMIN # Required for scanning with arp-scan, nmap, nbtscan, traceroute, and zero-conf
|
||||
- NET_RAW # Required for raw socket operations with arp-scan, nmap, nbtscan, traceroute and zero-conf
|
||||
- NET_BIND_SERVICE # Required to bind to privileged ports with nbtscan
|
||||
- CHOWN # Required for root-entrypoint to chown /data + /tmp before dropping privileges
|
||||
- SETUID # Required for root-entrypoint to switch to non-root user
|
||||
- SETGID # Required for root-entrypoint to switch to non-root group
|
||||
volumes:
|
||||
|
||||
# Override NGINX Configuration Template
|
||||
- type: bind
|
||||
source: /var/lib/containers/config/netalertx/server/nginx/netalertx.conf.template
|
||||
target: /services/config/nginx/netalertx.conf.template
|
||||
read_only: true
|
||||
bind:
|
||||
selinux: Z
|
||||
|
||||
# Letsencrypt Certificates
|
||||
- type: bind
|
||||
source: /var/lib/containers/certificates/letsencrypt/MYDOMAIN.TLD
|
||||
target: /certificates
|
||||
read_only: true
|
||||
bind:
|
||||
selinux: Z
|
||||
|
||||
# Data Storage for NetAlertX
|
||||
- type: bind # Persistent Docker-managed Named Volume for storage
|
||||
source: /var/lib/containers/data/netalertx/server
|
||||
target: /data # consolidated configuration and database storage
|
||||
read_only: false # writable volume
|
||||
bind:
|
||||
selinux: Z
|
||||
|
||||
# Set the Timezone
|
||||
- type: bind # Bind mount for timezone consistency
|
||||
source: /etc/localtime
|
||||
target: /etc/localtime
|
||||
read_only: true
|
||||
bind:
|
||||
selinux: Z
|
||||
|
||||
# tmpfs mounts for writable directories in a read-only container and improve system performance
|
||||
# All writes now live under /tmp/* subdirectories which are created dynamically by entrypoint.d scripts
|
||||
# mode=1700 gives rwx------ permissions; ownership is set by /root-entrypoint.sh
|
||||
- type: tmpfs
|
||||
target: /tmp
|
||||
tmpfs-mode: 1700
|
||||
uid: 0
|
||||
gid: 0
|
||||
rw: true
|
||||
noexec: true
|
||||
nosuid: true
|
||||
nodev: true
|
||||
async: true
|
||||
noatime: true
|
||||
nodiratime: true
|
||||
bind:
|
||||
selinux: Z
|
||||
|
||||
env_file:
|
||||
- .env
|
||||
- .env.server
|
||||
|
||||
environment:
|
||||
PUID: ${NETALERTX_UID:-20211} # Runtime UID after priming (Synology/no-copy-up safe)
|
||||
PGID: ${NETALERTX_GID:-20211} # Runtime GID after priming (Synology/no-copy-up safe)
|
||||
LISTEN_ADDR: ${LISTEN_ADDR:-0.0.0.0} # Listen for connections on all interfaces
|
||||
PORT: ${PORT:-20211} # Application port
|
||||
PORT_SSL: ${PORT_SSL:-443}
|
||||
GRAPHQL_PORT: ${GRAPHQL_PORT:-20212} # GraphQL API port
|
||||
ALWAYS_FRESH_INSTALL: ${ALWAYS_FRESH_INSTALL:-false} # Set to true to reset your config and database on each container start
|
||||
NETALERTX_DEBUG: ${NETALERTX_DEBUG:-0} # 0=kill all services and restart if any dies. 1 keeps running dead services.
|
||||
BACKEND_API_URL: ${BACKEND_API_URL-"https://netalertx.MYDOMAIN.TLD:20212"}
|
||||
|
||||
# Resource limits to prevent resource exhaustion
|
||||
mem_limit: 4096m # Maximum memory usage
|
||||
mem_reservation: 2048m # Soft memory limit
|
||||
cpu_shares: 512 # Relative CPU weight for CPU contention scenarios
|
||||
pids_limit: 512 # Limit the number of processes/threads to prevent fork bombs
|
||||
logging:
|
||||
driver: "json-file" # Use JSON file logging driver
|
||||
options:
|
||||
max-size: "10m" # Rotate log files after they reach 10MB
|
||||
max-file: "3" # Keep a maximum of 3 log files
|
||||
|
||||
# Always restart the container unless explicitly stopped
|
||||
restart: unless-stopped
|
||||
|
||||
# To sign Out, you need to visit
|
||||
# {$OUTPOST_HOSTNAME}:{$OUTPOST_EXTERNAL_PORT}/outpost.goauthentik.io/sign_out
|
||||
netalertx-outpost-proxy:
|
||||
container_name: netalertx-outpost-proxy
|
||||
|
||||
network_mode: host
|
||||
|
||||
depends_on:
|
||||
netalertx-caddy:
|
||||
condition: service_started
|
||||
restart: true
|
||||
|
||||
restart: unless-stopped
|
||||
|
||||
image: ghcr.io/goauthentik/proxy:2025.10
|
||||
pull: missing
|
||||
|
||||
env_file:
|
||||
- .env
|
||||
- .env.outpost.proxy
|
||||
|
||||
environment:
|
||||
AUTHENTIK_HOST: "https://authentik.MYDOMAIN.TLD"
|
||||
AUTHENTIK_INSECURE: false
|
||||
AUTHENTIK_LISTEN__HTTP: "[::1]:6000"
|
||||
AUTHENTIK_LISTEN__HTTPS: "[::1]:6443"
|
||||
```
|
||||
|
||||
### Quadlet Setup
|
||||
`netalertx.pod`:
|
||||
```
|
||||
[Pod]
|
||||
# Name of the Pod
|
||||
PodName=netalertx
|
||||
|
||||
# Network Mode Host is required for ARP to work
|
||||
Network=host
|
||||
|
||||
# Automatically start Pod at Boot Time
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
```
|
||||
|
||||
`netalertx-caddy.container`:
|
||||
```
|
||||
[Unit]
|
||||
Description=NetAlertX Caddy Container
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
|
||||
[Container]
|
||||
ContainerName=netalertx-caddy
|
||||
|
||||
Pod=netalertx.pod
|
||||
StartWithPod=true
|
||||
|
||||
# Generic Environment Configuration
|
||||
EnvironmentFile=.env
|
||||
|
||||
# Caddy Specific Environment Configuration
|
||||
EnvironmentFile=.env.caddy
|
||||
|
||||
Environment=CADDY_DOCKER_CADDYFILE_PATH=/etc/caddy/Caddyfile
|
||||
|
||||
Image=docker.io/library/caddy:latest
|
||||
Pull=missing
|
||||
|
||||
# Run as rootless
|
||||
# Specifying User & Group by Name requires to mount a custom passwd & group File inside the Container
|
||||
# Otherwise an Error like the following will result: netalertx-caddy[593191]: Error: unable to find user caddy: no matching entries in passwd file
|
||||
# User=caddy
|
||||
# Group=caddy
|
||||
# Volume=/var/lib/containers/config/netalertx/caddy-rootless/passwd:/etc/passwd:ro,z
|
||||
# Volume=/var/lib/containers/config/netalertx/caddy-rootless/group:/etc/group:ro,z
|
||||
|
||||
# Run as rootless
|
||||
# Specifying User & Group by UID/GID will NOT require a custom passwd / group File to be bind-mounted inside the Container
|
||||
User=980
|
||||
Group=980
|
||||
|
||||
Volume=./Caddyfile:/etc/caddy/Caddyfile:ro,z
|
||||
Volume=/var/lib/containers/data/netalertx/caddy:/data/caddy:z
|
||||
Volume=/var/lib/containers/log/netalertx/caddy:/var/log:z
|
||||
Volume=/var/lib/containers/config/netalertx/caddy:/config/caddy:z
|
||||
Volume=/var/lib/containers/certificates/letsencrypt:/certificates:ro,z
|
||||
```
|
||||
|
||||
`netalertx-server.container`:
|
||||
```
|
||||
[Unit]
|
||||
Description=NetAlertX Server Container
|
||||
Requires=netalertx-caddy.service netalertx-outpost-proxy.service
|
||||
After=netalertx-caddy.service netalertx-outpost-proxy.service
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
|
||||
[Container]
|
||||
ContainerName=netalertx-server
|
||||
|
||||
Pod=netalertx.pod
|
||||
StartWithPod=true
|
||||
|
||||
# Local built Image including latest Changes
|
||||
Image=localhost/netalertx-dev:dev-20260109-232454
|
||||
Pull=missing
|
||||
|
||||
# Make the container filesystem read-only
|
||||
ReadOnly=true
|
||||
|
||||
# Drop all capabilities for enhanced security
|
||||
DropCapability=ALL
|
||||
|
||||
# It is most secure to start with user 20211, but then we lose provisioning capabilities.
|
||||
# User=20211:20211
|
||||
|
||||
# Required for scanning with arp-scan, nmap, nbtscan, traceroute, and zero-conf
|
||||
AddCapability=NET_ADMIN
|
||||
|
||||
# Required for raw socket operations with arp-scan, nmap, nbtscan, traceroute and zero-conf
|
||||
AddCapability=NET_RAW
|
||||
|
||||
# Required to bind to privileged ports with nbtscan
|
||||
AddCapability=NET_BIND_SERVICE
|
||||
|
||||
# Required for root-entrypoint to chown /data + /tmp before dropping privileges
|
||||
AddCapability=CHOWN
|
||||
|
||||
# Required for root-entrypoint to switch to non-root user
|
||||
AddCapability=SETUID
|
||||
|
||||
# Required for root-entrypoint to switch to non-root group
|
||||
AddCapability=SETGID
|
||||
|
||||
# Override the Configuration Template
|
||||
Volume=/var/lib/containers/config/netalertx/server/nginx/netalertx.conf.template:/services/config/nginx/netalertx.conf.template:ro,Z
|
||||
|
||||
# Letsencrypt Certificates
|
||||
Volume=/var/lib/containers/certificates/letsencrypt/MYDOMAIN.TLD:/certificates:ro,Z
|
||||
|
||||
# Data Storage for NetAlertX
|
||||
Volume=/var/lib/containers/data/netalertx/server:/data:rw,Z
|
||||
|
||||
# Set the Timezone
|
||||
Volume=/etc/localtime:/etc/localtime:ro,Z
|
||||
|
||||
# tmpfs mounts for writable directories in a read-only container and improve system performance
|
||||
# All writes now live under /tmp/* subdirectories which are created dynamically by entrypoint.d scripts
|
||||
# mode=1700 gives rwx------ permissions; ownership is set by /root-entrypoint.sh
|
||||
# Mount=type=tmpfs,destination=/tmp,tmpfs-mode=1700,uid=0,gid=0,rw=true,noexec=true,nosuid=true,nodev=true,async=true,noatime=true,nodiratime=true,relabel=private
|
||||
Mount=type=tmpfs,destination=/tmp,tmpfs-mode=1700,rw=true,noexec=true,nosuid=true,nodev=true
|
||||
|
||||
# Environment Configuration
|
||||
EnvironmentFile=.env
|
||||
EnvironmentFile=.env.server
|
||||
|
||||
# Runtime UID after priming (Synology/no-copy-up safe)
|
||||
Environment=PUID=20211
|
||||
|
||||
# Runtime GID after priming (Synology/no-copy-up safe)
|
||||
Environment=PGID=20211
|
||||
|
||||
# Listen for connections on all interfaces (IPv4)
|
||||
Environment=LISTEN_ADDR=0.0.0.0
|
||||
|
||||
# Application port
|
||||
Environment=PORT=20211
|
||||
|
||||
# SSL Port
|
||||
Environment=PORT_SSL=443
|
||||
|
||||
# GraphQL API port
|
||||
Environment=GRAPHQL_PORT=20212
|
||||
|
||||
# Set to true to reset your config and database on each container start
|
||||
Environment=ALWAYS_FRESH_INSTALL=false
|
||||
|
||||
# 0=kill all services and restart if any dies. 1 keeps running dead services.
|
||||
Environment=NETALERTX_DEBUG=0
|
||||
|
||||
# Set the GraphQL URL for external Access (via Caddy Reverse Proxy)
|
||||
Environment=BACKEND_API_URL=https://netalertx-fedora.MYDOMAIN.TLD:20212
|
||||
|
||||
# Resource limits to prevent resource exhaustion
|
||||
# Maximum memory usage
|
||||
Memory=4g
|
||||
|
||||
# Limit the number of processes/threads to prevent fork bombs
|
||||
PidsLimit=512
|
||||
|
||||
# Relative CPU weight for CPU contention scenarios
|
||||
PodmanArgs=--cpus=2
|
||||
PodmanArgs=--cpu-shares=512
|
||||
|
||||
# Soft memory limit
|
||||
PodmanArgs=--memory-reservation=2g
|
||||
|
||||
# !! The following Keys are unfortunately not [yet] supported !!
|
||||
|
||||
# Relative CPU weight for CPU contention scenarios
|
||||
#CpuShares=512
|
||||
|
||||
# Soft memory limit
|
||||
#MemoryReservation=2g
|
||||
```
|
||||
|
||||
`netalertx-outpost-proxy.container`:
|
||||
```
|
||||
[Unit]
|
||||
Description=NetAlertX Authentik Proxy Outpost Container
|
||||
Requires=netalertx-caddy.service
|
||||
After=netalertx-caddy.service
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
|
||||
[Container]
|
||||
ContainerName=netalertx-outpost-proxy
|
||||
|
||||
Pod=netalertx.pod
|
||||
StartWithPod=true
|
||||
|
||||
# General Configuration
|
||||
EnvironmentFile=.env
|
||||
|
||||
# Authentik Outpost Proxy Specific Configuration
|
||||
EnvironmentFile=.env.outpost.proxy
|
||||
|
||||
Environment=AUTHENTIK_HOST=https://authentik.MYDOMAIN.TLD
|
||||
Environment=AUTHENTIK_INSECURE=false
|
||||
|
||||
# Overrides Value from .env.outpost.rac
|
||||
# Environment=AUTHENTIK_TOKEN=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||||
|
||||
# Optional setting to be used when `authentik_host` for internal communication doesn't match the public URL
|
||||
# Environment=AUTHENTIK_HOST_BROWSER=https://authentik.MYDOMAIN.TLD
|
||||
|
||||
# Container Image
|
||||
Image=ghcr.io/goauthentik/proxy:2025.10
|
||||
Pull=missing
|
||||
|
||||
# Network Configuration
|
||||
Network=container:supermicro-ikvm-pve031-caddy
|
||||
|
||||
# Security Configuration
|
||||
NoNewPrivileges=true
|
||||
```
|
||||
|
||||
### Firewall Setup
|
||||
|
||||
Depending on which GNU/Linux Distribution you are running, it might be required to open up some Firewall Ports in order to be able to access the Endpoints from outside the Host itself.
|
||||
|
||||
This is for instance the Case for Fedora Linux, where I had to open:
|
||||
|
||||
- Port 20212 for external GraphQL Access (both TCP & UDP are open, unsure if UDP is required)
|
||||
- Port 9443 for external Authentik Outpost Proxy Access (both TCP & UDP are open, unsure if UDP is required)
|
||||
|
||||
|
||||
|
||||
### Authentik Setup
|
||||
|
||||
In order to enable Single Sign On (SSO) with Authentik, you will need to create a Provider, an Application and an Outpost.
|
||||
|
||||
|
||||
|
||||
First of all, using the Left Sidebar, navigate to `Applications` → `Providers`, click on `Create` (Blue Button at the Top of the Screen), select `Proxy Provider`, then click `Next`:
|
||||
|
||||
|
||||
Fill in the required Fields:
|
||||
|
||||
- Name: choose a Name for the Provider (e.g. `netalertx`)
|
||||
- Authorization Flow: choose the Authorization Flow. I typically use `default-provider-authorization-implicit-consent (Authorize Application)`. If you select the `default-provider-authorization-explicit-consent (Authorize Application)` you will need to authorize Authentik every Time you want to log in NetAlertX, which can make the Experience less User-friendly
|
||||
- Type: Click on `Forward Auth (single application)`
|
||||
- External Host: set to `https://netalertx.MYDOMAIN.TLD`
|
||||
|
||||
Click `Finish`.
|
||||
|
||||
|
||||
|
||||
Now, using the Left Sidebar, navigate to `Applications` → `Applications`, click on `Create` (Blue Button at the Top of the Screen) and fill in the required Fields:
|
||||
|
||||
- Name: choose a Name for the Application (e.g. `netalertx`)
|
||||
- Slug: choose a Slug for the Application (e.g. `netalertx`)
|
||||
- Group: optionally you can assign this Application to a Group of Applications of your Choosing (for grouping Purposes within Authentik User Interface)
|
||||
- Provider: select the Provider you created the the `Providers` Section previosly (e.g. `netalertx`)
|
||||
|
||||
Then click `Create`.
|
||||
|
||||
|
||||
|
||||
Now, using the Left Sidebar, navigate to `Applications` → `Outposts`, click on `Create` (Blue Button at the Top of the Screen) and fill in the required Fields:
|
||||
|
||||
- Name: choose a Name for the Outpost (e.g. `netalertx`)
|
||||
- Type: `Proxy`
|
||||
- Integration: open the Dropdown and click on `---------`. Make sure it is NOT set to `Local Docker connection` !
|
||||
|
||||
In the `Available Applications` Section, select the Application you created in the Previous Step, then click the right Arrow (approx. located in the Center of the Screen), so that it gets copied in the `Selected Applications` Section.
|
||||
|
||||
Then click `Create`.
|
||||
|
||||
|
||||
|
||||
Wait a few Seconds for the Outpost to be created. Once it appears in the List, click on `Deployment Info` on the Right Side of the relevant Line.
|
||||
|
||||
|
||||
|
||||
Take note of that Token. You will need it for the Authentik Outpost Proxy Container, which will read it as the `AUTHENTIK_TOKEN` Environment Variable.
|
||||
|
||||
### NGINX Configuration inside NetAlertX Container
|
||||
> [!NOTE]
|
||||
> This is something that was implemented based on the previous Content of this Reverse Proxy Document.
|
||||
> Due to some Buffer Warnings/Errors in the Logs as well as some other Issues I was experiencing, I increased a lot the client_body_buffer_size and large_client_header_buffers Parameters, although these might not be required anymore.
|
||||
> Further Testing might be required.
|
||||
|
||||
```
|
||||
# Set number of worker processes automatically based on number of CPU cores.
|
||||
worker_processes auto;
|
||||
|
||||
# Enables the use of JIT for regular expressions to speed-up their processing.
|
||||
pcre_jit on;
|
||||
|
||||
# Configures default error logger.
|
||||
error_log /tmp/log/nginx-error.log warn;
|
||||
|
||||
pid /tmp/run/nginx.pid;
|
||||
|
||||
events {
|
||||
# The maximum number of simultaneous connections that can be opened by
|
||||
# a worker process.
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
|
||||
# Mapping of temp paths for various nginx modules.
|
||||
client_body_temp_path /tmp/nginx/client_body;
|
||||
proxy_temp_path /tmp/nginx/proxy;
|
||||
fastcgi_temp_path /tmp/nginx/fastcgi;
|
||||
uwsgi_temp_path /tmp/nginx/uwsgi;
|
||||
scgi_temp_path /tmp/nginx/scgi;
|
||||
|
||||
# Includes mapping of file name extensions to MIME types of responses
|
||||
# and defines the default type.
|
||||
include /services/config/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
# Name servers used to resolve names of upstream servers into addresses.
|
||||
# It's also needed when using tcpsocket and udpsocket in Lua modules.
|
||||
#resolver 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001];
|
||||
|
||||
# Don't tell nginx version to the clients. Default is 'on'.
|
||||
server_tokens off;
|
||||
|
||||
# Specifies the maximum accepted body size of a client request, as
|
||||
# indicated by the request header Content-Length. If the stated content
|
||||
# length is greater than this size, then the client receives the HTTP
|
||||
# error code 413. Set to 0 to disable. Default is '1m'.
|
||||
client_max_body_size 1m;
|
||||
|
||||
# Sendfile copies data between one FD and other from within the kernel,
|
||||
# which is more efficient than read() + write(). Default is off.
|
||||
sendfile on;
|
||||
|
||||
# Causes nginx to attempt to send its HTTP response head in one packet,
|
||||
# instead of using partial frames. Default is 'off'.
|
||||
tcp_nopush on;
|
||||
|
||||
|
||||
# Enables the specified protocols. Default is TLSv1 TLSv1.1 TLSv1.2.
|
||||
# TIP: If you're not obligated to support ancient clients, remove TLSv1.1.
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
|
||||
# Path of the file with Diffie-Hellman parameters for EDH ciphers.
|
||||
# TIP: Generate with: `openssl dhparam -out /etc/ssl/nginx/dh2048.pem 2048`
|
||||
#ssl_dhparam /etc/ssl/nginx/dh2048.pem;
|
||||
|
||||
# Specifies that our cipher suits should be preferred over client ciphers.
|
||||
# Default is 'off'.
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
# Enables a shared SSL cache with size that can hold around 8000 sessions.
|
||||
# Default is 'none'.
|
||||
ssl_session_cache shared:SSL:2m;
|
||||
|
||||
# Specifies a time during which a client may reuse the session parameters.
|
||||
# Default is '5m'.
|
||||
ssl_session_timeout 1h;
|
||||
|
||||
# Disable TLS session tickets (they are insecure). Default is 'on'.
|
||||
ssl_session_tickets off;
|
||||
|
||||
|
||||
# Enable gzipping of responses.
|
||||
gzip on;
|
||||
|
||||
# Set the Vary HTTP header as defined in the RFC 2616. Default is 'off'.
|
||||
gzip_vary on;
|
||||
|
||||
|
||||
# Specifies the main log format.
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
# Sets the path, format, and configuration for a buffered log write.
|
||||
access_log /tmp/log/nginx-access.log main;
|
||||
|
||||
|
||||
# Virtual host config (unencrypted)
|
||||
server {
|
||||
listen ${LISTEN_ADDR}:${PORT} default_server;
|
||||
root /app/front;
|
||||
index index.php;
|
||||
add_header X-Forwarded-Prefix "/app" always;
|
||||
|
||||
server_name netalertx-server;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
client_body_buffer_size 512k;
|
||||
large_client_header_buffers 64 128k;
|
||||
|
||||
location ~* \.php$ {
|
||||
# Set Cache-Control header to prevent caching on the first load
|
||||
add_header Cache-Control "no-store";
|
||||
fastcgi_pass unix:/tmp/run/php.sock;
|
||||
include /services/config/nginx/fastcgi_params;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
||||
fastcgi_connect_timeout 75;
|
||||
fastcgi_send_timeout 600;
|
||||
fastcgi_read_timeout 600;
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Caddyfile
|
||||
```
|
||||
# Example and Guide
|
||||
# https://caddyserver.com/docs/caddyfile/options
|
||||
|
||||
# General Options
|
||||
{
|
||||
# (Optional) Debug Mode
|
||||
# debug
|
||||
|
||||
# (Optional ) Enable / Disable Admin API
|
||||
admin off
|
||||
|
||||
# TLS Options
|
||||
# (Optional) Disable Certificates Management (only if SSL/TLS Certificates are managed by certbot or other external Tools)
|
||||
auto_https disable_certs
|
||||
}
|
||||
|
||||
# (Optional Enable Admin API)
|
||||
# localhost {
|
||||
# reverse_proxy /api/* localhost:9001
|
||||
# }
|
||||
|
||||
# NetAlertX Web GUI (HTTPS Port 443)
|
||||
# (Optional) Only if SSL/TLS Certificates are managed by certbot or other external Tools and Custom Logging is required
|
||||
{$APPLICATION_HOSTNAME}:443 {
|
||||
tls /certificates/{$APPLICATION_CERTIFICATE_DOMAIN}/{$APPLICATION_CERTIFICATE_CERT_FILE:fullchain.pem} /certificates/{$APPLICATION_CERTIFICATE_DOMAIN}/{$APPLICATION_CERTIFICATE_KEY_FILE:privkey.pem}
|
||||
|
||||
log {
|
||||
output file /var/log/{$APPLICATION_HOSTNAME}/access_web.json {
|
||||
roll_size 100MiB
|
||||
roll_keep 5000
|
||||
roll_keep_for 720h
|
||||
roll_uncompressed
|
||||
}
|
||||
|
||||
format json
|
||||
}
|
||||
|
||||
route {
|
||||
# Always forward outpost path to actual outpost
|
||||
reverse_proxy /outpost.goauthentik.io/* https://{$OUTPOST_HOSTNAME}:{$OUTPOST_EXTERNAL_PORT} {
|
||||
header_up Host {http.reverse_proxy.upstream.hostport}
|
||||
}
|
||||
|
||||
# Forward authentication to outpost
|
||||
forward_auth https://{$OUTPOST_HOSTNAME}:{$OUTPOST_EXTERNAL_PORT} {
|
||||
uri /outpost.goauthentik.io/auth/caddy
|
||||
|
||||
# Capitalization of the headers is important, otherwise they will be empty
|
||||
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
|
||||
|
||||
# (Optional)
|
||||
# If not set, trust all private ranges, but for Security Reasons, this should be set to the outposts IP
|
||||
trusted_proxies private_ranges
|
||||
}
|
||||
}
|
||||
|
||||
# IPv4 Reverse Proxy to NetAlertX Web GUI (internal unencrypted Host)
|
||||
reverse_proxy http://0.0.0.0:20211
|
||||
|
||||
# IPv6 Reverse Proxy to NetAlertX Web GUI (internal unencrypted Host)
|
||||
# reverse_proxy http://[::1]:20211
|
||||
}
|
||||
|
||||
# NetAlertX GraphQL Endpoint (HTTPS Port 20212)
|
||||
# (Optional) Only if SSL/TLS Certificates are managed by certbot or other external Tools and Custom Logging is required
|
||||
{$APPLICATION_HOSTNAME}:20212 {
|
||||
tls /certificates/{$APPLICATION_CERTIFICATE_DOMAIN}/{$APPLICATION_CERTIFICATE_CERT_FILE:fullchain.pem} /certificates/{$APPLICATION_CERTIFICATE_DOMAIN}/{$APPLICATION_CERTIFICATE_KEY_FILE:privkey.pem}
|
||||
|
||||
log {
|
||||
output file /var/log/{$APPLICATION_HOSTNAME}/access_graphql.json {
|
||||
roll_size 100MiB
|
||||
roll_keep 5000
|
||||
roll_keep_for 720h
|
||||
roll_uncompressed
|
||||
}
|
||||
|
||||
format json
|
||||
}
|
||||
|
||||
# IPv4 Reverse Proxy to NetAlertX GraphQL Endpoint (internal unencrypted Host)
|
||||
reverse_proxy http://0.0.0.0:20219
|
||||
|
||||
# IPv6 Reverse Proxy to NetAlertX GraphQL Endpoint (internal unencrypted Host)
|
||||
# reverse_proxy http://[::1]:6000
|
||||
}
|
||||
|
||||
# Authentik Outpost
|
||||
# (Optional) Only if SSL/TLS Certificates are managed by certbot or other external Tools and Custom Logging is required
|
||||
{$OUTPOST_HOSTNAME}:{$OUTPOST_EXTERNAL_PORT} {
|
||||
tls /certificates/{$APPLICATION_CERTIFICATE_DOMAIN}/{$APPLICATION_CERTIFICATE_CERT_FILE:fullchain.pem} /certificates/{$APPLICATION_CERTIFICATE_DOMAIN}/{$APPLICATION_CERTIFICATE_KEY_FILE:privkey.pem}
|
||||
|
||||
log {
|
||||
output file /var/log/outpost/{$OUTPOST_HOSTNAME}/access.json {
|
||||
roll_size 100MiB
|
||||
roll_keep 5000
|
||||
roll_keep_for 720h
|
||||
roll_uncompressed
|
||||
}
|
||||
|
||||
format json
|
||||
}
|
||||
|
||||
# IPv4 Reverse Proxy to internal unencrypted Host
|
||||
# reverse_proxy http://0.0.0.0:6000
|
||||
|
||||
# IPv6 Reverse Proxy to internal unencrypted Host
|
||||
reverse_proxy http://[::1]:6000
|
||||
}
|
||||
```
|
||||
|
||||
### Login
|
||||
Now try to login by visiting `https://netalertx.MYDOMAIN.TLD`.
|
||||
|
||||
You should be greeted with a Login Screen by Authentik.
|
||||
|
||||
If you are already logged in Authentik, log out first. You can do that by visiting `https://netalertx.MYDOMAIN.TLD/outpost.goauthentik.io/sign_out`, then click on `Log out of authentik` (2nd Button). Or you can just sign out from your Authentik Admin Panel at `https://authentik.MYDOMAIN.TLD`.
|
||||
|
||||
If everything works as expected, then you can now set `SETPWD_enable_password=false` to disable double Authentication.
|
||||
|
||||
|
||||
|
||||
892
docs/REVERSE_PROXY_CADDY.md
Normal file
892
docs/REVERSE_PROXY_CADDY.md
Normal file
@@ -0,0 +1,892 @@
|
||||
## Caddy + Authentik Outpost Proxy SSO
|
||||
> Submitted by [luckylinux](https://github.com/luckylinux) 🙏.
|
||||
|
||||
> [!NOTE]
|
||||
> This is community-contributed. Due to environment, setup, or networking differences, results may vary. Please open a PR to improve it instead of creating an issue, as the maintainer is not actively maintaining it.
|
||||
|
||||
> [!NOTE]
|
||||
> NetAlertX requires access to both the **web UI** (default `20211`) and the **GraphQL backend `GRAPHQL_PORT`** (default `20212`) ports.
|
||||
> Ensure your reverse proxy allows traffic to both for proper functionality.
|
||||
|
||||
### Introduction
|
||||
|
||||
This Setup assumes:
|
||||
|
||||
1. Authentik Installation running on a separate Host at `https://authentik.MYDOMAIN.TLD`
|
||||
2. Container Management is done on Baremetal OR in a Virtual Machine (KVM/Xen/ESXi/..., no LXC Containers !):
|
||||
i. Docker and Docker Compose configured locally running as Root (needed for `network_mode: host`) OR
|
||||
ii. Podman (optionally `podman-compose`) configured locally running as Root (needed for `network_mode: host`)
|
||||
3. TLS Certificates are already pre-obtained and located at `/var/lib/containers/certificates/letsencrypt/MYDOMAIN.TLD`.
|
||||
I use the `certbot/dns-cloudflare` Podman Container on a separate Host to obtain the Certificates which I then distribute internally.
|
||||
This Container uses the Wildcard Top-Level Domain Certificate which is valid for `MYDOMAIN.TLD` and `*.MYDOMAIN.TLD`.
|
||||
4. Proxied Access
|
||||
i. NetAlertX Web Interface is accessible via Caddy Reverse Proxy at `https://netalertx.MYDOMAIN.TLD` (default HTTPS Port 443: `https://netalertx.MYDOMAIN.TLD:443`) with `REPORT_DASHBOARD_URL=https://netalertx.MYDOMAIN.TLD`
|
||||
ii. NetAlertX GraphQL Interface is accessible via Caddy Reverse Proxy at `https://netalertx.MYDOMAIN.TLD:20212` with `BACKEND_API_URL=https://netalertx.MYDOMAIN.TLD:20212`
|
||||
iii. Authentik Proxy Outpost is accessible via Caddy Reverse Proxy at `https://netalertx.MYDOMAIN.TLD:9443`
|
||||
5. Internal Ports
|
||||
i. NGINX Web Server is set to listen on internal Port 20211 set via `PORT=20211`
|
||||
ii. Python Web Server is set to listen on internal Port `GRAPHQL_PORT=20219`
|
||||
iii. Authentik Proxy Outpost is listening on internal Port `AUTHENTIK_LISTEN__HTTP=[::1]:6000` (unencrypted) and Port `AUTHENTIK_LISTEN__HTTPS=[::1]:6443` (encrypted)
|
||||
|
||||
8. Some further Configuration for Caddy is performed in Terms of Logging, SSL Certificates, etc
|
||||
|
||||
It's also possible to [let Caddy automatically request & keep TLS Certificates up-to-date](https://caddyserver.com/docs/automatic-https), although please keep in mind that:
|
||||
|
||||
1. You risk enumerating your LAN. Every Domain/Subdomain for which Caddy requests a TLS Certificate for you will result in that Host to be listed on [List of Letsencrypt Certificates issued](https://crt.sh/).
|
||||
2. You need to either:
|
||||
i. Open Port 80 for external Access ([HTTP challenge](https://caddyserver.com/docs/automatic-https#http-challenge)) in order for Letsencrypt to verify the Ownership of the Domain/Subdomain
|
||||
ii. Open Port 443 for external Access ([TLS-ALPN challenge](https://caddyserver.com/docs/automatic-https#tls-alpn-challenge)) in order for Letsencrypt to verify the Ownership of the Domain/Subdomain
|
||||
iii. Give Caddy the Credentials to update the DNS Records at your DNS Provider ([DNS challenge](https://caddyserver.com/docs/automatic-https#dns-challenge))
|
||||
|
||||
You can also decide to deploy your own Certificates & Certification Authority, either manually with OpenSSL, or by using something like [mkcert](https://github.com/FiloSottile/mkcert).
|
||||
|
||||
In Terms of IP Stack Used:
|
||||
- External: Caddy listens on both IPv4 and IPv6.
|
||||
- Internal:
|
||||
- Authentik Outpost Proxy listens on IPv6 `[::1]`
|
||||
- NetAlertX listens on IPv4 `0.0.0.0`
|
||||
|
||||
### Flow
|
||||
The Traffic Flow will therefore be as follows:
|
||||
|
||||
- Web GUI:
|
||||
i. Client accesses `http://authentik.MYDOMAIN.TLD:80`: default (built-in Caddy) Redirect to `https://authentik.MYDOMAIN.TLD:443`
|
||||
ii. Client accesses `https://authentik.MYDOMAIN.TLD:443` -> reverse Proxy to internal Port 20211 (NetAlertX Web GUI / NGINX - unencrypted)
|
||||
- GraphQL: Client accesses `https://authentik.MYDOMAIN.TLD:20212` -> reverse Proxy to internal Port 20219 (NetAlertX GraphQL - unencrypted)
|
||||
- Authentik Outpost: Client accesses `https://authentik.MYDOMAIN.TLD:9443` -> reverse Proxy to internal Port 6000 (Authentik Outpost Proxy - unencrypted)
|
||||
|
||||
An Overview of the Flow is provided in the Picture below:
|
||||
|
||||
|
||||
|
||||
### Security Considerations
|
||||
|
||||
#### Caddy should be run rootless
|
||||
|
||||
> [!WARNING]
|
||||
> By default Caddy runs as `root` which is a Security Risk.
|
||||
> In order to solve this, it's recommended to create an unprivileged User `caddy` and Group `caddy` on the Host:
|
||||
> ```
|
||||
> groupadd --gid 980 caddy
|
||||
> useradd --shell /usr/sbin/nologin --gid 980 --uid 980 -c "Caddy web server" --base-dir /var/lib/caddy
|
||||
> ```
|
||||
|
||||
At least using Quadlets with Usernames (NOT required with UID/GID), but possibly using Compose in certain Cases as well, a custom `/etc/passwd` and `/etc/group` might need to be bind-mounted inside the Container.
|
||||
`passwd`:
|
||||
```
|
||||
root:x:0:0:root:/root:/bin/sh
|
||||
bin:x:1:1:bin:/bin:/sbin/nologin
|
||||
daemon:x:2:2:daemon:/sbin:/sbin/nologin
|
||||
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
|
||||
sync:x:5:0:sync:/sbin:/bin/sync
|
||||
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
|
||||
halt:x:7:0:halt:/sbin:/sbin/halt
|
||||
mail:x:8:12:mail:/var/mail:/sbin/nologin
|
||||
news:x:9:13:news:/usr/lib/news:/sbin/nologin
|
||||
uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
|
||||
cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
|
||||
ftp:x:21:21::/var/lib/ftp:/sbin/nologin
|
||||
sshd:x:22:22:sshd:/dev/null:/sbin/nologin
|
||||
games:x:35:35:games:/usr/games:/sbin/nologin
|
||||
ntp:x:123:123:NTP:/var/empty:/sbin/nologin
|
||||
guest:x:405:100:guest:/dev/null:/sbin/nologin
|
||||
nobody:x:65534:65534:nobody:/:/sbin/nologin
|
||||
caddy:x:980:980:caddy:/var/lib/caddy:/bin/sh
|
||||
```
|
||||
|
||||
`group`:
|
||||
```
|
||||
root:x:0:root
|
||||
bin:x:1:root,bin,daemon
|
||||
daemon:x:2:root,bin,daemon
|
||||
sys:x:3:root,bin
|
||||
adm:x:4:root,daemon
|
||||
tty:x:5:
|
||||
disk:x:6:root
|
||||
lp:x:7:lp
|
||||
kmem:x:9:
|
||||
wheel:x:10:root
|
||||
floppy:x:11:root
|
||||
mail:x:12:mail
|
||||
news:x:13:news
|
||||
uucp:x:14:uucp
|
||||
cron:x:16:cron
|
||||
audio:x:18:
|
||||
cdrom:x:19:
|
||||
dialout:x:20:root
|
||||
ftp:x:21:
|
||||
sshd:x:22:
|
||||
input:x:23:
|
||||
tape:x:26:root
|
||||
video:x:27:root
|
||||
netdev:x:28:
|
||||
kvm:x:34:kvm
|
||||
games:x:35:
|
||||
shadow:x:42:
|
||||
www-data:x:82:
|
||||
users:x:100:games
|
||||
ntp:x:123:
|
||||
abuild:x:300:
|
||||
utmp:x:406:
|
||||
ping:x:999:
|
||||
nogroup:x:65533:
|
||||
nobody:x:65534:
|
||||
caddy:x:980:
|
||||
```
|
||||
|
||||
#### Authentication of GraphQL Endpoint
|
||||
|
||||
> [!WARNING]
|
||||
> Currently the GraphQL Endpoint is NOT authenticated !
|
||||
|
||||
### Environment Files
|
||||
Depending on the Preference of the User (Environment Variables defined in Compose/Quadlet or in external `.env` File[s]), it might be prefereable to place at least some Environment Variables in external `.env` and `.env.<application>` Files.
|
||||
|
||||
The following is proposed:
|
||||
|
||||
- `.env`: common Settings (empty by Default)
|
||||
- `.env.caddy`: Caddy Settings
|
||||
- `.env.server`: NetAlertX Server/Application Settings
|
||||
- `.env.outpost.proxy`: Authentik Proxy Outpost Settings
|
||||
|
||||
The following Contents is assumed.
|
||||
|
||||
`.env.caddy`:
|
||||
```
|
||||
# Define Application Hostname
|
||||
APPLICATION_HOSTNAME=netalertx.MYDOMAIN.TLD
|
||||
|
||||
# Define Certificate Domain
|
||||
# In this case: use Wildcard Certificate
|
||||
APPLICATION_CERTIFICATE_DOMAIN=MYDOMAIN.TLD
|
||||
APPLICATION_CERTIFICATE_CERT_FILE=fullchain.pem
|
||||
APPLICATION_CERTIFICATE_KEY_FILE=privkey.pem
|
||||
|
||||
# Define Outpost Hostname
|
||||
OUTPOST_HOSTNAME=netalertx.MYDOMAIN.TLD
|
||||
|
||||
# Define Outpost External Port (TLS)
|
||||
OUTPOST_EXTERNAL_PORT=9443
|
||||
```
|
||||
|
||||
`.env.server`:
|
||||
```
|
||||
PORT=20211
|
||||
PORT_SSL=443
|
||||
NETALERTX_NETWORK_MODE=host
|
||||
LISTEN_ADDR=0.0.0.0
|
||||
GRAPHQL_PORT=20219
|
||||
NETALERTX_DEBUG=1
|
||||
BACKEND_API_URL=https://netalertx.MYDOMAIN.TLD:20212
|
||||
```
|
||||
|
||||
`.env.outpost.proxy`:
|
||||
```
|
||||
AUTHENTIK_TOKEN=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||||
AUTHENTIK_LISTEN__HTTP=[::1]:6000
|
||||
AUTHENTIK_LISTEN__HTTPS=[::1]:6443
|
||||
```
|
||||
|
||||
### Compose Setup
|
||||
```
|
||||
version: "3.8"
|
||||
services:
|
||||
netalertx-caddy:
|
||||
container_name: netalertx-caddy
|
||||
|
||||
network_mode: host
|
||||
image: docker.io/library/caddy:latest
|
||||
pull: missing
|
||||
|
||||
env_file:
|
||||
- .env
|
||||
- .env.caddy
|
||||
|
||||
environment:
|
||||
CADDY_DOCKER_CADDYFILE_PATH: "/etc/caddy/Caddyfile"
|
||||
|
||||
volumes:
|
||||
- ./Caddyfile:/etc/caddy/Caddyfile:ro,z
|
||||
- /var/lib/containers/data/netalertx/caddy:/data/caddy:rw,z
|
||||
- /var/lib/containers/log/netalertx/caddy:/var/log:rw,z
|
||||
- /var/lib/containers/config/netalertx/caddy:/config/caddy:rw,z
|
||||
- /var/lib/containers/certificates/letsencrypt:/certificates:ro,z
|
||||
|
||||
# Set User
|
||||
user: "caddy:caddy"
|
||||
|
||||
# Automatically restart Container
|
||||
restart: unless-stopped
|
||||
|
||||
netalertx-server:
|
||||
container_name: netalertx-server # The name when you docker contiainer ls
|
||||
|
||||
network_mode: host # Use host networking for ARP scanning and other services
|
||||
|
||||
depends_on:
|
||||
netalertx-caddy:
|
||||
condition: service_started
|
||||
restart: true
|
||||
netalertx-outpost-proxy:
|
||||
condition: service_started
|
||||
restart: true
|
||||
|
||||
# Local built Image including latest Changes
|
||||
image: localhost/netalertx-dev:dev-20260109-232454
|
||||
|
||||
read_only: true # Make the container filesystem read-only
|
||||
|
||||
# It is most secure to start with user 20211, but then we lose provisioning capabilities.
|
||||
# user: "${NETALERTX_UID:-20211}:${NETALERTX_GID:-20211}"
|
||||
cap_drop: # Drop all capabilities for enhanced security
|
||||
- ALL
|
||||
cap_add: # Add only the necessary capabilities
|
||||
- NET_ADMIN # Required for scanning with arp-scan, nmap, nbtscan, traceroute, and zero-conf
|
||||
- NET_RAW # Required for raw socket operations with arp-scan, nmap, nbtscan, traceroute and zero-conf
|
||||
- NET_BIND_SERVICE # Required to bind to privileged ports with nbtscan
|
||||
- CHOWN # Required for root-entrypoint to chown /data + /tmp before dropping privileges
|
||||
- SETUID # Required for root-entrypoint to switch to non-root user
|
||||
- SETGID # Required for root-entrypoint to switch to non-root group
|
||||
volumes:
|
||||
|
||||
# Override NGINX Configuration Template
|
||||
- type: bind
|
||||
source: /var/lib/containers/config/netalertx/server/nginx/netalertx.conf.template
|
||||
target: /services/config/nginx/netalertx.conf.template
|
||||
read_only: true
|
||||
bind:
|
||||
selinux: Z
|
||||
|
||||
# Letsencrypt Certificates
|
||||
- type: bind
|
||||
source: /var/lib/containers/certificates/letsencrypt/MYDOMAIN.TLD
|
||||
target: /certificates
|
||||
read_only: true
|
||||
bind:
|
||||
selinux: Z
|
||||
|
||||
# Data Storage for NetAlertX
|
||||
- type: bind # Persistent Docker-managed Named Volume for storage
|
||||
source: /var/lib/containers/data/netalertx/server
|
||||
target: /data # consolidated configuration and database storage
|
||||
read_only: false # writable volume
|
||||
bind:
|
||||
selinux: Z
|
||||
|
||||
# Set the Timezone
|
||||
- type: bind # Bind mount for timezone consistency
|
||||
source: /etc/localtime
|
||||
target: /etc/localtime
|
||||
read_only: true
|
||||
bind:
|
||||
selinux: Z
|
||||
|
||||
# tmpfs mounts for writable directories in a read-only container and improve system performance
|
||||
# All writes now live under /tmp/* subdirectories which are created dynamically by entrypoint.d scripts
|
||||
# mode=1700 gives rwx------ permissions; ownership is set by /root-entrypoint.sh
|
||||
- type: tmpfs
|
||||
target: /tmp
|
||||
tmpfs-mode: 1700
|
||||
uid: 0
|
||||
gid: 0
|
||||
rw: true
|
||||
noexec: true
|
||||
nosuid: true
|
||||
nodev: true
|
||||
async: true
|
||||
noatime: true
|
||||
nodiratime: true
|
||||
bind:
|
||||
selinux: Z
|
||||
|
||||
env_file:
|
||||
- .env
|
||||
- .env.server
|
||||
|
||||
environment:
|
||||
PUID: ${NETALERTX_UID:-20211} # Runtime UID after priming (Synology/no-copy-up safe)
|
||||
PGID: ${NETALERTX_GID:-20211} # Runtime GID after priming (Synology/no-copy-up safe)
|
||||
LISTEN_ADDR: ${LISTEN_ADDR:-0.0.0.0} # Listen for connections on all interfaces
|
||||
PORT: ${PORT:-20211} # Application port
|
||||
PORT_SSL: ${PORT_SSL:-443}
|
||||
GRAPHQL_PORT: ${GRAPHQL_PORT:-20212} # GraphQL API port
|
||||
ALWAYS_FRESH_INSTALL: ${ALWAYS_FRESH_INSTALL:-false} # Set to true to reset your config and database on each container start
|
||||
NETALERTX_DEBUG: ${NETALERTX_DEBUG:-0} # 0=kill all services and restart if any dies. 1 keeps running dead services.
|
||||
BACKEND_API_URL: ${BACKEND_API_URL-"https://netalertx.MYDOMAIN.TLD:20212"}
|
||||
|
||||
# Resource limits to prevent resource exhaustion
|
||||
mem_limit: 4096m # Maximum memory usage
|
||||
mem_reservation: 2048m # Soft memory limit
|
||||
cpu_shares: 512 # Relative CPU weight for CPU contention scenarios
|
||||
pids_limit: 512 # Limit the number of processes/threads to prevent fork bombs
|
||||
logging:
|
||||
driver: "json-file" # Use JSON file logging driver
|
||||
options:
|
||||
max-size: "10m" # Rotate log files after they reach 10MB
|
||||
max-file: "3" # Keep a maximum of 3 log files
|
||||
|
||||
# Always restart the container unless explicitly stopped
|
||||
restart: unless-stopped
|
||||
|
||||
# To sign Out, you need to visit
|
||||
# {$OUTPOST_HOSTNAME}:{$OUTPOST_EXTERNAL_PORT}/outpost.goauthentik.io/sign_out
|
||||
netalertx-outpost-proxy:
|
||||
container_name: netalertx-outpost-proxy
|
||||
|
||||
network_mode: host
|
||||
|
||||
depends_on:
|
||||
netalertx-caddy:
|
||||
condition: service_started
|
||||
restart: true
|
||||
|
||||
restart: unless-stopped
|
||||
|
||||
image: ghcr.io/goauthentik/proxy:2025.10
|
||||
pull: missing
|
||||
|
||||
env_file:
|
||||
- .env
|
||||
- .env.outpost.proxy
|
||||
|
||||
environment:
|
||||
AUTHENTIK_HOST: "https://authentik.MYDOMAIN.TLD"
|
||||
AUTHENTIK_INSECURE: false
|
||||
AUTHENTIK_LISTEN__HTTP: "[::1]:6000"
|
||||
AUTHENTIK_LISTEN__HTTPS: "[::1]:6443"
|
||||
```
|
||||
|
||||
### Quadlet Setup
|
||||
`netalertx.pod`:
|
||||
```
|
||||
[Pod]
|
||||
# Name of the Pod
|
||||
PodName=netalertx
|
||||
|
||||
# Network Mode Host is required for ARP to work
|
||||
Network=host
|
||||
|
||||
# Automatically start Pod at Boot Time
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
```
|
||||
|
||||
`netalertx-caddy.container`:
|
||||
```
|
||||
[Unit]
|
||||
Description=NetAlertX Caddy Container
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
|
||||
[Container]
|
||||
ContainerName=netalertx-caddy
|
||||
|
||||
Pod=netalertx.pod
|
||||
StartWithPod=true
|
||||
|
||||
# Generic Environment Configuration
|
||||
EnvironmentFile=.env
|
||||
|
||||
# Caddy Specific Environment Configuration
|
||||
EnvironmentFile=.env.caddy
|
||||
|
||||
Environment=CADDY_DOCKER_CADDYFILE_PATH=/etc/caddy/Caddyfile
|
||||
|
||||
Image=docker.io/library/caddy:latest
|
||||
Pull=missing
|
||||
|
||||
# Run as rootless
|
||||
# Specifying User & Group by Name requires to mount a custom passwd & group File inside the Container
|
||||
# Otherwise an Error like the following will result: netalertx-caddy[593191]: Error: unable to find user caddy: no matching entries in passwd file
|
||||
# User=caddy
|
||||
# Group=caddy
|
||||
# Volume=/var/lib/containers/config/netalertx/caddy-rootless/passwd:/etc/passwd:ro,z
|
||||
# Volume=/var/lib/containers/config/netalertx/caddy-rootless/group:/etc/group:ro,z
|
||||
|
||||
# Run as rootless
|
||||
# Specifying User & Group by UID/GID will NOT require a custom passwd / group File to be bind-mounted inside the Container
|
||||
User=980
|
||||
Group=980
|
||||
|
||||
Volume=./Caddyfile:/etc/caddy/Caddyfile:ro,z
|
||||
Volume=/var/lib/containers/data/netalertx/caddy:/data/caddy:z
|
||||
Volume=/var/lib/containers/log/netalertx/caddy:/var/log:z
|
||||
Volume=/var/lib/containers/config/netalertx/caddy:/config/caddy:z
|
||||
Volume=/var/lib/containers/certificates/letsencrypt:/certificates:ro,z
|
||||
```
|
||||
|
||||
`netalertx-server.container`:
|
||||
```
|
||||
[Unit]
|
||||
Description=NetAlertX Server Container
|
||||
Requires=netalertx-caddy.service netalertx-outpost-proxy.service
|
||||
After=netalertx-caddy.service netalertx-outpost-proxy.service
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
|
||||
[Container]
|
||||
ContainerName=netalertx-server
|
||||
|
||||
Pod=netalertx.pod
|
||||
StartWithPod=true
|
||||
|
||||
# Local built Image including latest Changes
|
||||
Image=localhost/netalertx-dev:dev-20260109-232454
|
||||
Pull=missing
|
||||
|
||||
# Make the container filesystem read-only
|
||||
ReadOnly=true
|
||||
|
||||
# Drop all capabilities for enhanced security
|
||||
DropCapability=ALL
|
||||
|
||||
# It is most secure to start with user 20211, but then we lose provisioning capabilities.
|
||||
# User=20211:20211
|
||||
|
||||
# Required for scanning with arp-scan, nmap, nbtscan, traceroute, and zero-conf
|
||||
AddCapability=NET_ADMIN
|
||||
|
||||
# Required for raw socket operations with arp-scan, nmap, nbtscan, traceroute and zero-conf
|
||||
AddCapability=NET_RAW
|
||||
|
||||
# Required to bind to privileged ports with nbtscan
|
||||
AddCapability=NET_BIND_SERVICE
|
||||
|
||||
# Required for root-entrypoint to chown /data + /tmp before dropping privileges
|
||||
AddCapability=CHOWN
|
||||
|
||||
# Required for root-entrypoint to switch to non-root user
|
||||
AddCapability=SETUID
|
||||
|
||||
# Required for root-entrypoint to switch to non-root group
|
||||
AddCapability=SETGID
|
||||
|
||||
# Override the Configuration Template
|
||||
Volume=/var/lib/containers/config/netalertx/server/nginx/netalertx.conf.template:/services/config/nginx/netalertx.conf.template:ro,Z
|
||||
|
||||
# Letsencrypt Certificates
|
||||
Volume=/var/lib/containers/certificates/letsencrypt/MYDOMAIN.TLD:/certificates:ro,Z
|
||||
|
||||
# Data Storage for NetAlertX
|
||||
Volume=/var/lib/containers/data/netalertx/server:/data:rw,Z
|
||||
|
||||
# Set the Timezone
|
||||
Volume=/etc/localtime:/etc/localtime:ro,Z
|
||||
|
||||
# tmpfs mounts for writable directories in a read-only container and improve system performance
|
||||
# All writes now live under /tmp/* subdirectories which are created dynamically by entrypoint.d scripts
|
||||
# mode=1700 gives rwx------ permissions; ownership is set by /root-entrypoint.sh
|
||||
# Mount=type=tmpfs,destination=/tmp,tmpfs-mode=1700,uid=0,gid=0,rw=true,noexec=true,nosuid=true,nodev=true,async=true,noatime=true,nodiratime=true,relabel=private
|
||||
Mount=type=tmpfs,destination=/tmp,tmpfs-mode=1700,rw=true,noexec=true,nosuid=true,nodev=true
|
||||
|
||||
# Environment Configuration
|
||||
EnvironmentFile=.env
|
||||
EnvironmentFile=.env.server
|
||||
|
||||
# Runtime UID after priming (Synology/no-copy-up safe)
|
||||
Environment=PUID=20211
|
||||
|
||||
# Runtime GID after priming (Synology/no-copy-up safe)
|
||||
Environment=PGID=20211
|
||||
|
||||
# Listen for connections on all interfaces (IPv4)
|
||||
Environment=LISTEN_ADDR=0.0.0.0
|
||||
|
||||
# Application port
|
||||
Environment=PORT=20211
|
||||
|
||||
# SSL Port
|
||||
Environment=PORT_SSL=443
|
||||
|
||||
# GraphQL API port
|
||||
Environment=GRAPHQL_PORT=20212
|
||||
|
||||
# Set to true to reset your config and database on each container start
|
||||
Environment=ALWAYS_FRESH_INSTALL=false
|
||||
|
||||
# 0=kill all services and restart if any dies. 1 keeps running dead services.
|
||||
Environment=NETALERTX_DEBUG=0
|
||||
|
||||
# Set the GraphQL URL for external Access (via Caddy Reverse Proxy)
|
||||
Environment=BACKEND_API_URL=https://netalertx-fedora.MYDOMAIN.TLD:20212
|
||||
|
||||
# Resource limits to prevent resource exhaustion
|
||||
# Maximum memory usage
|
||||
Memory=4g
|
||||
|
||||
# Limit the number of processes/threads to prevent fork bombs
|
||||
PidsLimit=512
|
||||
|
||||
# Relative CPU weight for CPU contention scenarios
|
||||
PodmanArgs=--cpus=2
|
||||
PodmanArgs=--cpu-shares=512
|
||||
|
||||
# Soft memory limit
|
||||
PodmanArgs=--memory-reservation=2g
|
||||
|
||||
# !! The following Keys are unfortunately not [yet] supported !!
|
||||
|
||||
# Relative CPU weight for CPU contention scenarios
|
||||
#CpuShares=512
|
||||
|
||||
# Soft memory limit
|
||||
#MemoryReservation=2g
|
||||
```
|
||||
|
||||
`netalertx-outpost-proxy.container`:
|
||||
```
|
||||
[Unit]
|
||||
Description=NetAlertX Authentik Proxy Outpost Container
|
||||
Requires=netalertx-caddy.service
|
||||
After=netalertx-caddy.service
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
|
||||
[Container]
|
||||
ContainerName=netalertx-outpost-proxy
|
||||
|
||||
Pod=netalertx.pod
|
||||
StartWithPod=true
|
||||
|
||||
# General Configuration
|
||||
EnvironmentFile=.env
|
||||
|
||||
# Authentik Outpost Proxy Specific Configuration
|
||||
EnvironmentFile=.env.outpost.proxy
|
||||
|
||||
Environment=AUTHENTIK_HOST=https://authentik.MYDOMAIN.TLD
|
||||
Environment=AUTHENTIK_INSECURE=false
|
||||
|
||||
# Overrides Value from .env.outpost.rac
|
||||
# Environment=AUTHENTIK_TOKEN=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||||
|
||||
# Optional setting to be used when `authentik_host` for internal communication doesn't match the public URL
|
||||
# Environment=AUTHENTIK_HOST_BROWSER=https://authentik.MYDOMAIN.TLD
|
||||
|
||||
# Container Image
|
||||
Image=ghcr.io/goauthentik/proxy:2025.10
|
||||
Pull=missing
|
||||
|
||||
# Network Configuration
|
||||
Network=container:supermicro-ikvm-pve031-caddy
|
||||
|
||||
# Security Configuration
|
||||
NoNewPrivileges=true
|
||||
```
|
||||
|
||||
### Firewall Setup
|
||||
|
||||
Depending on which GNU/Linux Distribution you are running, it might be required to open up some Firewall Ports in order to be able to access the Endpoints from outside the Host itself.
|
||||
|
||||
This is for instance the Case for Fedora Linux, where I had to open:
|
||||
|
||||
- Port 20212 for external GraphQL Access (both TCP & UDP are open, unsure if UDP is required)
|
||||
- Port 9443 for external Authentik Outpost Proxy Access (both TCP & UDP are open, unsure if UDP is required)
|
||||
|
||||
|
||||
|
||||
### Authentik Setup
|
||||
|
||||
In order to enable Single Sign On (SSO) with Authentik, you will need to create a Provider, an Application and an Outpost.
|
||||
|
||||
|
||||
|
||||
First of all, using the Left Sidebar, navigate to `Applications` → `Providers`, click on `Create` (Blue Button at the Top of the Screen), select `Proxy Provider`, then click `Next`:
|
||||
|
||||
|
||||
Fill in the required Fields:
|
||||
|
||||
- Name: choose a Name for the Provider (e.g. `netalertx`)
|
||||
- Authorization Flow: choose the Authorization Flow. I typically use `default-provider-authorization-implicit-consent (Authorize Application)`. If you select the `default-provider-authorization-explicit-consent (Authorize Application)` you will need to authorize Authentik every Time you want to log in NetAlertX, which can make the Experience less User-friendly
|
||||
- Type: Click on `Forward Auth (single application)`
|
||||
- External Host: set to `https://netalertx.MYDOMAIN.TLD`
|
||||
|
||||
Click `Finish`.
|
||||
|
||||
|
||||
|
||||
Now, using the Left Sidebar, navigate to `Applications` → `Applications`, click on `Create` (Blue Button at the Top of the Screen) and fill in the required Fields:
|
||||
|
||||
- Name: choose a Name for the Application (e.g. `netalertx`)
|
||||
- Slug: choose a Slug for the Application (e.g. `netalertx`)
|
||||
- Group: optionally you can assign this Application to a Group of Applications of your Choosing (for grouping Purposes within Authentik User Interface)
|
||||
- Provider: select the Provider you created the the `Providers` Section previosly (e.g. `netalertx`)
|
||||
|
||||
Then click `Create`.
|
||||
|
||||
|
||||
|
||||
Now, using the Left Sidebar, navigate to `Applications` → `Outposts`, click on `Create` (Blue Button at the Top of the Screen) and fill in the required Fields:
|
||||
|
||||
- Name: choose a Name for the Outpost (e.g. `netalertx`)
|
||||
- Type: `Proxy`
|
||||
- Integration: open the Dropdown and click on `---------`. Make sure it is NOT set to `Local Docker connection` !
|
||||
|
||||
In the `Available Applications` Section, select the Application you created in the Previous Step, then click the right Arrow (approx. located in the Center of the Screen), so that it gets copied in the `Selected Applications` Section.
|
||||
|
||||
Then click `Create`.
|
||||
|
||||
|
||||
|
||||
Wait a few Seconds for the Outpost to be created. Once it appears in the List, click on `Deployment Info` on the Right Side of the relevant Line.
|
||||
|
||||
|
||||
|
||||
Take note of that Token. You will need it for the Authentik Outpost Proxy Container, which will read it as the `AUTHENTIK_TOKEN` Environment Variable.
|
||||
|
||||
### NGINX Configuration inside NetAlertX Container
|
||||
> [!NOTE]
|
||||
> This is something that was implemented based on the previous Content of this Reverse Proxy Document.
|
||||
> Due to some Buffer Warnings/Errors in the Logs as well as some other Issues I was experiencing, I increased a lot the client_body_buffer_size and large_client_header_buffers Parameters, although these might not be required anymore.
|
||||
> Further Testing might be required.
|
||||
|
||||
```
|
||||
# Set number of worker processes automatically based on number of CPU cores.
|
||||
worker_processes auto;
|
||||
|
||||
# Enables the use of JIT for regular expressions to speed-up their processing.
|
||||
pcre_jit on;
|
||||
|
||||
# Configures default error logger.
|
||||
error_log /tmp/log/nginx-error.log warn;
|
||||
|
||||
pid /tmp/run/nginx.pid;
|
||||
|
||||
events {
|
||||
# The maximum number of simultaneous connections that can be opened by
|
||||
# a worker process.
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
|
||||
# Mapping of temp paths for various nginx modules.
|
||||
client_body_temp_path /tmp/nginx/client_body;
|
||||
proxy_temp_path /tmp/nginx/proxy;
|
||||
fastcgi_temp_path /tmp/nginx/fastcgi;
|
||||
uwsgi_temp_path /tmp/nginx/uwsgi;
|
||||
scgi_temp_path /tmp/nginx/scgi;
|
||||
|
||||
# Includes mapping of file name extensions to MIME types of responses
|
||||
# and defines the default type.
|
||||
include /services/config/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
# Name servers used to resolve names of upstream servers into addresses.
|
||||
# It's also needed when using tcpsocket and udpsocket in Lua modules.
|
||||
#resolver 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001];
|
||||
|
||||
# Don't tell nginx version to the clients. Default is 'on'.
|
||||
server_tokens off;
|
||||
|
||||
# Specifies the maximum accepted body size of a client request, as
|
||||
# indicated by the request header Content-Length. If the stated content
|
||||
# length is greater than this size, then the client receives the HTTP
|
||||
# error code 413. Set to 0 to disable. Default is '1m'.
|
||||
client_max_body_size 1m;
|
||||
|
||||
# Sendfile copies data between one FD and other from within the kernel,
|
||||
# which is more efficient than read() + write(). Default is off.
|
||||
sendfile on;
|
||||
|
||||
# Causes nginx to attempt to send its HTTP response head in one packet,
|
||||
# instead of using partial frames. Default is 'off'.
|
||||
tcp_nopush on;
|
||||
|
||||
|
||||
# Enables the specified protocols. Default is TLSv1 TLSv1.1 TLSv1.2.
|
||||
# TIP: If you're not obligated to support ancient clients, remove TLSv1.1.
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
|
||||
# Path of the file with Diffie-Hellman parameters for EDH ciphers.
|
||||
# TIP: Generate with: `openssl dhparam -out /etc/ssl/nginx/dh2048.pem 2048`
|
||||
#ssl_dhparam /etc/ssl/nginx/dh2048.pem;
|
||||
|
||||
# Specifies that our cipher suits should be preferred over client ciphers.
|
||||
# Default is 'off'.
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
# Enables a shared SSL cache with size that can hold around 8000 sessions.
|
||||
# Default is 'none'.
|
||||
ssl_session_cache shared:SSL:2m;
|
||||
|
||||
# Specifies a time during which a client may reuse the session parameters.
|
||||
# Default is '5m'.
|
||||
ssl_session_timeout 1h;
|
||||
|
||||
# Disable TLS session tickets (they are insecure). Default is 'on'.
|
||||
ssl_session_tickets off;
|
||||
|
||||
|
||||
# Enable gzipping of responses.
|
||||
gzip on;
|
||||
|
||||
# Set the Vary HTTP header as defined in the RFC 2616. Default is 'off'.
|
||||
gzip_vary on;
|
||||
|
||||
|
||||
# Specifies the main log format.
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
# Sets the path, format, and configuration for a buffered log write.
|
||||
access_log /tmp/log/nginx-access.log main;
|
||||
|
||||
|
||||
# Virtual host config (unencrypted)
|
||||
server {
|
||||
listen ${LISTEN_ADDR}:${PORT} default_server;
|
||||
root /app/front;
|
||||
index index.php;
|
||||
add_header X-Forwarded-Prefix "/app" always;
|
||||
|
||||
server_name netalertx-server;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
client_body_buffer_size 512k;
|
||||
large_client_header_buffers 64 128k;
|
||||
|
||||
location ~* \.php$ {
|
||||
# Set Cache-Control header to prevent caching on the first load
|
||||
add_header Cache-Control "no-store";
|
||||
fastcgi_pass unix:/tmp/run/php.sock;
|
||||
include /services/config/nginx/fastcgi_params;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
||||
fastcgi_connect_timeout 75;
|
||||
fastcgi_send_timeout 600;
|
||||
fastcgi_read_timeout 600;
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Caddyfile
|
||||
```
|
||||
# Example and Guide
|
||||
# https://caddyserver.com/docs/caddyfile/options
|
||||
|
||||
# General Options
|
||||
{
|
||||
# (Optional) Debug Mode
|
||||
# debug
|
||||
|
||||
# (Optional ) Enable / Disable Admin API
|
||||
admin off
|
||||
|
||||
# TLS Options
|
||||
# (Optional) Disable Certificates Management (only if SSL/TLS Certificates are managed by certbot or other external Tools)
|
||||
auto_https disable_certs
|
||||
}
|
||||
|
||||
# (Optional Enable Admin API)
|
||||
# localhost {
|
||||
# reverse_proxy /api/* localhost:9001
|
||||
# }
|
||||
|
||||
# NetAlertX Web GUI (HTTPS Port 443)
|
||||
# (Optional) Only if SSL/TLS Certificates are managed by certbot or other external Tools and Custom Logging is required
|
||||
{$APPLICATION_HOSTNAME}:443 {
|
||||
tls /certificates/{$APPLICATION_CERTIFICATE_DOMAIN}/{$APPLICATION_CERTIFICATE_CERT_FILE:fullchain.pem} /certificates/{$APPLICATION_CERTIFICATE_DOMAIN}/{$APPLICATION_CERTIFICATE_KEY_FILE:privkey.pem}
|
||||
|
||||
log {
|
||||
output file /var/log/{$APPLICATION_HOSTNAME}/access_web.json {
|
||||
roll_size 100MiB
|
||||
roll_keep 5000
|
||||
roll_keep_for 720h
|
||||
roll_uncompressed
|
||||
}
|
||||
|
||||
format json
|
||||
}
|
||||
|
||||
route {
|
||||
# Always forward outpost path to actual outpost
|
||||
reverse_proxy /outpost.goauthentik.io/* https://{$OUTPOST_HOSTNAME}:{$OUTPOST_EXTERNAL_PORT} {
|
||||
header_up Host {http.reverse_proxy.upstream.hostport}
|
||||
}
|
||||
|
||||
# Forward authentication to outpost
|
||||
forward_auth https://{$OUTPOST_HOSTNAME}:{$OUTPOST_EXTERNAL_PORT} {
|
||||
uri /outpost.goauthentik.io/auth/caddy
|
||||
|
||||
# Capitalization of the headers is important, otherwise they will be empty
|
||||
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
|
||||
|
||||
# (Optional)
|
||||
# If not set, trust all private ranges, but for Security Reasons, this should be set to the outposts IP
|
||||
trusted_proxies private_ranges
|
||||
}
|
||||
}
|
||||
|
||||
# IPv4 Reverse Proxy to NetAlertX Web GUI (internal unencrypted Host)
|
||||
reverse_proxy http://0.0.0.0:20211
|
||||
|
||||
# IPv6 Reverse Proxy to NetAlertX Web GUI (internal unencrypted Host)
|
||||
# reverse_proxy http://[::1]:20211
|
||||
}
|
||||
|
||||
# NetAlertX GraphQL Endpoint (HTTPS Port 20212)
|
||||
# (Optional) Only if SSL/TLS Certificates are managed by certbot or other external Tools and Custom Logging is required
|
||||
{$APPLICATION_HOSTNAME}:20212 {
|
||||
tls /certificates/{$APPLICATION_CERTIFICATE_DOMAIN}/{$APPLICATION_CERTIFICATE_CERT_FILE:fullchain.pem} /certificates/{$APPLICATION_CERTIFICATE_DOMAIN}/{$APPLICATION_CERTIFICATE_KEY_FILE:privkey.pem}
|
||||
|
||||
log {
|
||||
output file /var/log/{$APPLICATION_HOSTNAME}/access_graphql.json {
|
||||
roll_size 100MiB
|
||||
roll_keep 5000
|
||||
roll_keep_for 720h
|
||||
roll_uncompressed
|
||||
}
|
||||
|
||||
format json
|
||||
}
|
||||
|
||||
# IPv4 Reverse Proxy to NetAlertX GraphQL Endpoint (internal unencrypted Host)
|
||||
reverse_proxy http://0.0.0.0:20219
|
||||
|
||||
# IPv6 Reverse Proxy to NetAlertX GraphQL Endpoint (internal unencrypted Host)
|
||||
# reverse_proxy http://[::1]:6000
|
||||
}
|
||||
|
||||
# Authentik Outpost
|
||||
# (Optional) Only if SSL/TLS Certificates are managed by certbot or other external Tools and Custom Logging is required
|
||||
{$OUTPOST_HOSTNAME}:{$OUTPOST_EXTERNAL_PORT} {
|
||||
tls /certificates/{$APPLICATION_CERTIFICATE_DOMAIN}/{$APPLICATION_CERTIFICATE_CERT_FILE:fullchain.pem} /certificates/{$APPLICATION_CERTIFICATE_DOMAIN}/{$APPLICATION_CERTIFICATE_KEY_FILE:privkey.pem}
|
||||
|
||||
log {
|
||||
output file /var/log/outpost/{$OUTPOST_HOSTNAME}/access.json {
|
||||
roll_size 100MiB
|
||||
roll_keep 5000
|
||||
roll_keep_for 720h
|
||||
roll_uncompressed
|
||||
}
|
||||
|
||||
format json
|
||||
}
|
||||
|
||||
# IPv4 Reverse Proxy to internal unencrypted Host
|
||||
# reverse_proxy http://0.0.0.0:6000
|
||||
|
||||
# IPv6 Reverse Proxy to internal unencrypted Host
|
||||
reverse_proxy http://[::1]:6000
|
||||
}
|
||||
```
|
||||
|
||||
### Login
|
||||
Now try to login by visiting `https://netalertx.MYDOMAIN.TLD`.
|
||||
|
||||
You should be greeted with a Login Screen by Authentik.
|
||||
|
||||
If you are already logged in Authentik, log out first. You can do that by visiting `https://netalertx.MYDOMAIN.TLD/outpost.goauthentik.io/sign_out`, then click on `Log out of authentik` (2nd Button). Or you can just sign out from your Authentik Admin Panel at `https://authentik.MYDOMAIN.TLD`.
|
||||
|
||||
If everything works as expected, then you can now set `SETPWD_enable_password=false` to disable double Authentication.
|
||||
|
||||
|
||||
86
docs/REVERSE_PROXY_TRAEFIK.md
Normal file
86
docs/REVERSE_PROXY_TRAEFIK.md
Normal file
@@ -0,0 +1,86 @@
|
||||
# Guide: Routing NetAlertX API via Traefik v3
|
||||
|
||||
> [!NOTE]
|
||||
> NetAlertX requires access to both the **web UI** (default `20211`) and the **GraphQL backend `GRAPHQL_PORT`** (default `20212`) ports.
|
||||
> Ensure your reverse proxy allows traffic to both for proper functionality.
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> This is community-contributed. Due to environment, setup, or networking differences, results may vary. Please open a PR to improve it instead of creating an issue, as the maintainer is not actively maintaining it.
|
||||
|
||||
|
||||
Traefik v3 requires the following setup to route traffic properly. This guide shows a working configuration using a dedicated `PathPrefix`.
|
||||
|
||||
---
|
||||
|
||||
## 1. Configure NetAlertX Backend URL
|
||||
|
||||
1. Open the NetAlertX UI: **Settings → Core → General**.
|
||||
2. Set the `BACKEND_API_URL` to include a custom path prefix, for example:
|
||||
|
||||
```
|
||||
https://netalertx.yourdomain.com/netalertx-api
|
||||
```
|
||||
|
||||
This tells the frontend where to reach the backend API.
|
||||
|
||||
---
|
||||
|
||||
## 2. Create a Traefik Router for the API
|
||||
|
||||
Define a router specifically for the API with a higher priority and a `PathPrefix` rule:
|
||||
|
||||
```yaml
|
||||
netalertx-api:
|
||||
rule: "Host(`netalertx.yourdomain.com`) && PathPrefix(`/netalertx-api`)"
|
||||
service: netalertx-api-service
|
||||
middlewares:
|
||||
- netalertx-stripprefix
|
||||
priority: 100
|
||||
```
|
||||
|
||||
**Notes:**
|
||||
|
||||
* `Host(...)` ensures requests are only routed for your domain.
|
||||
* `PathPrefix(...)` routes anything under `/netalertx-api` to the backend.
|
||||
* Priority `100` ensures this router takes precedence over other routes.
|
||||
|
||||
---
|
||||
|
||||
## 3. Add a Middleware to Strip the Prefix
|
||||
|
||||
NetAlertX expects requests at the root (`/`). Use Traefik’s `StripPrefix` middleware:
|
||||
|
||||
```yaml
|
||||
middlewares:
|
||||
netalertx-stripprefix:
|
||||
stripPrefix:
|
||||
prefixes:
|
||||
- "/netalertx-api"
|
||||
```
|
||||
|
||||
This removes `/netalertx-api` before forwarding the request to the backend container.
|
||||
|
||||
---
|
||||
|
||||
## 4. Map the API Service to the Backend Container
|
||||
|
||||
Point the service to the internal GraphQL/Backend port (20212):
|
||||
|
||||
```yaml
|
||||
netalertx-api-service:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://<INTERNAL_IP>:20212"
|
||||
```
|
||||
|
||||
Replace `<INTERNAL_IP>` with your NetAlertX container’s internal address.
|
||||
|
||||
---
|
||||
|
||||
✅ With this setup:
|
||||
|
||||
* `https://netalertx.yourdomain.com` → Web interface (port 20211)
|
||||
* `https://netalertx.yourdomain.com/netalertx-api` → API/GraphQL backend (port 20212)
|
||||
|
||||
This cleanly separates API requests from frontend requests while keeping everything under the same domain.
|
||||
@@ -57,7 +57,10 @@ nav:
|
||||
- Authelia: AUTHELIA.md
|
||||
- Performance: PERFORMANCE.md
|
||||
- Reverse DNS: REVERSE_DNS.md
|
||||
- Reverse Proxy: REVERSE_PROXY.md
|
||||
- Reverse Proxy:
|
||||
- Reverse Proxy Overview: REVERSE_PROXY.md
|
||||
- Caddy and Authentik: REVERSE_PROXY_CADDY.md
|
||||
- Traefik: REVERSE_PROXY_TRAEFIK.md
|
||||
- Webhooks (n8n): WEBHOOK_N8N.md
|
||||
- Workflows: WORKFLOWS.md
|
||||
- Workflow Examples: WORKFLOW_EXAMPLES.md
|
||||
|
||||
Reference in New Issue
Block a user