Initial commit.
This commit is contained in:
commit
f7d9b59b1a
20
client_privateinternetaccess_FR.conf
Normal file
20
client_privateinternetaccess_FR.conf
Normal file
@ -0,0 +1,20 @@
|
||||
client
|
||||
dev tun
|
||||
proto udp
|
||||
remote france.privateinternetaccess.com 1197
|
||||
resolv-retry infinite
|
||||
nobind
|
||||
persist-key
|
||||
persist-tun
|
||||
cipher aes-256-cbc
|
||||
auth sha256
|
||||
tls-client
|
||||
remote-cert-tls server
|
||||
auth-user-pass /etc/openvpn/keys_privateinternetaccess/password
|
||||
comp-lzo
|
||||
verb 1
|
||||
reneg-sec 0
|
||||
# Those are the 4096 RSA versions
|
||||
ca /etc/openvpn/keys_privateinternetaccess/ca.crt
|
||||
crl-verify /etc/openvpn/keys_privateinternetaccess/crl.pem
|
||||
disable-occ
|
||||
62
docker-compose.yml
Normal file
62
docker-compose.yml
Normal file
@ -0,0 +1,62 @@
|
||||
# needs at least docker-compose 1.18.0 (1.10.0 for sysctls option and 1.18.0 for custom network name)
|
||||
version: "2.1"
|
||||
|
||||
services:
|
||||
|
||||
vpn-client:
|
||||
image: vpn-client:$VERSION_VPN_CLIENT
|
||||
build: "https://git.scimetis.net/yohan/docker-VPN-client.git"
|
||||
restart: always
|
||||
volumes:
|
||||
- ./keys_privateinternetaccess:/etc/openvpn/keys_privateinternetaccess:Z
|
||||
- ./client_privateinternetaccess_FR.conf:/etc/openvpn/openvpn.conf:Z
|
||||
cap_add:
|
||||
- NET_ADMIN
|
||||
sysctls:
|
||||
net.ipv4.ip_forward: 1
|
||||
devices:
|
||||
- "/dev/net/tun:/dev/net/tun"
|
||||
dns: 80.67.169.12
|
||||
networks:
|
||||
openvpn-FR-network:
|
||||
ipv4_address: 172.31.1.2
|
||||
|
||||
l2tp-client:
|
||||
image: l2tp-client:$VERSION_L2TP_CLIENT
|
||||
build: "https://git.scimetis.net/yohan/docker-l2tp-client.git"
|
||||
restart: always
|
||||
cap_add:
|
||||
- NET_ADMIN
|
||||
devices:
|
||||
- "/dev/net/tun:/dev/net/tun"
|
||||
- "/dev/ppp:/dev/ppp"
|
||||
networks:
|
||||
openvpn-FR-network:
|
||||
ipv4_address: 172.31.1.3
|
||||
|
||||
proxy:
|
||||
image: proxy:$VERSION_PROXY
|
||||
build: "https://git.scimetis.net/yohan/docker-proxy.git"
|
||||
restart: always
|
||||
ports:
|
||||
- 3130:3128/tcp
|
||||
volumes:
|
||||
- ./users:/etc/squid/users:Z
|
||||
- ./entrypoint.sh:/root/entrypoint.sh:Z
|
||||
entrypoint: /root/entrypoint.sh
|
||||
cap_add:
|
||||
- SYS_PTRACE
|
||||
- NET_ADMIN
|
||||
environment:
|
||||
subnet: 172.31.1
|
||||
networks:
|
||||
openvpn-FR-network:
|
||||
ipv4_address: 172.31.1.4
|
||||
|
||||
networks:
|
||||
openvpn-FR-network:
|
||||
name: openvpn-FR-network
|
||||
ipam:
|
||||
config:
|
||||
- subnet: 172.31.1.0/24
|
||||
|
||||
28
entrypoint.sh
Executable file
28
entrypoint.sh
Executable file
@ -0,0 +1,28 @@
|
||||
#!/bin/bash
|
||||
# stop service and clean up here
|
||||
function shut_down() {
|
||||
/etc/init.d/squid stop
|
||||
reset
|
||||
echo "exited $0"
|
||||
exit 0
|
||||
}
|
||||
|
||||
# USE the trap if you need to also do manual cleanup after the service is stopped,
|
||||
# or need to start multiple services in the one container
|
||||
trap "shut_down" SIGINT SIGTERM SIGKILL
|
||||
|
||||
/bin/ip route change default via ${subnet}.2 dev eth0
|
||||
bash -c '> /etc/resolv.conf'
|
||||
echo "nameserver 80.67.169.12" >> /etc/resolv.conf
|
||||
echo "100 toengine" >> /etc/iproute2/rt_tables
|
||||
iptables -t mangle -A OUTPUT -p tcp --sport 3128 -j MARK --set-mark 01
|
||||
ip rule add fwmark 01 lookup toengine
|
||||
ip route add default via ${subnet}.1 table toengine
|
||||
# start service in background here
|
||||
/etc/init.d/squid start
|
||||
while pidof squid > /dev/null
|
||||
do
|
||||
sleep 3
|
||||
done
|
||||
shut_down
|
||||
|
||||
35
start_or_update.sh
Executable file
35
start_or_update.sh
Executable file
@ -0,0 +1,35 @@
|
||||
#!/bin/bash
|
||||
# The commands below fix iptables -j MARK not working:
|
||||
#type=AVC msg=audit(1546362201.768:148429): avc: denied { module_request } for pid=11415 comm="iptables" kmod="ipt_MARK" scontext=system_u:system_r:container_t:s0:c283,c766 tcontext=system_u:system_r:kernel_t:s0 tclass=system
|
||||
#
|
||||
# Was caused by:
|
||||
# The boolean domain_kernel_load_modules was set incorrectly.
|
||||
# Description:
|
||||
# Allow domain to kernel load modules
|
||||
#
|
||||
# Allow access by executing:
|
||||
# # setsebool -P domain_kernel_load_modules 1
|
||||
|
||||
sudo modprobe ipt_MARK
|
||||
sudo modprobe l2tp_ppp
|
||||
MODULE_FILE=/etc/modules-load.d/docker.conf
|
||||
sudo bash -c "test -f $MODULE_FILE || touch $MODULE_FILE"
|
||||
sudo bash -c "grep -q ipt_MARK $MODULE_FILE \
|
||||
|| { echo '# Loading ipt_MARK at boot is needed to use iptables -j MARK in docker containers' >> $MODULE_FILE; \
|
||||
echo 'ipt_MARK' >> $MODULE_FILE; }"
|
||||
sudo bash -c "grep -q l2tp_ppp $MODULE_FILE \
|
||||
|| { echo '# Loading l2tp_ppp at boot is needed to use xl2tpd with kernel drivers in docker containers' >> $MODULE_FILE; \
|
||||
echo 'l2tp_ppp' >> $MODULE_FILE; }"
|
||||
|
||||
sudo chown root:13 users
|
||||
sudo chown root:root entrypoint.sh
|
||||
sudo chmod +x entrypoint.sh
|
||||
sudo chown -R root. client_privateinternetaccess_FR.conf keys_privateinternetaccess
|
||||
|
||||
# --force-recreate is used to recreate container when crontab file has changed
|
||||
unset VERSION_PROXY VERSION_VPN_CLIENT VERSION_L2TP_CLIENT
|
||||
VERSION_PROXY=$(git ls-remote ssh://git@git.scimetis.net:2222/yohan/docker-proxy.git| head -1 | cut -f 1|cut -c -10) \
|
||||
VERSION_VPN_CLIENT=$(git ls-remote ssh://git@git.scimetis.net:2222/yohan/docker-VPN-client.git| head -1 | cut -f 1|cut -c -10) \
|
||||
VERSION_L2TP_CLIENT=$(git ls-remote ssh://git@git.scimetis.net:2222/yohan/docker-l2tp-client.git| head -1 | cut -f 1|cut -c -10) \
|
||||
sudo -E bash -c 'docker-compose up -d --force-recreate'
|
||||
|
||||
Loading…
Reference in New Issue
Block a user