be3e69c10b
- Caddy: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy on all responses - Caddy: Block scanner paths (.env, .git, wp-config, etc.) with 403 - CI: Gitleaks secret scanning + pnpm audit for vulnerabilities - Dependabot: Weekly npm + GitHub Actions + monthly Docker updates - Docker: Non-root user in journal, planner, and brouter containers - Server: UFW firewall (22/80/443 only) + fail2ban (8 IPs already banned) - SECURITY.md: Vulnerability disclosure policy - Privacy page: Security practices section added Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
32 lines
1.2 KiB
Docker
32 lines
1.2 KiB
Docker
FROM eclipse-temurin:11-jre-jammy
|
|
|
|
WORKDIR /brouter
|
|
|
|
# Download latest BRouter release
|
|
ARG BROUTER_VERSION=1.7.8
|
|
RUN apt-get update && apt-get install -y --no-install-recommends wget unzip curl \
|
|
&& wget -q "https://github.com/abrensch/brouter/releases/download/v${BROUTER_VERSION}/brouter-${BROUTER_VERSION}.zip" \
|
|
&& unzip "brouter-${BROUTER_VERSION}.zip" \
|
|
&& mv "brouter-${BROUTER_VERSION}"/* . \
|
|
&& rmdir "brouter-${BROUTER_VERSION}" \
|
|
&& rm "brouter-${BROUTER_VERSION}.zip" \
|
|
&& apt-get purge -y wget unzip && apt-get autoremove -y && rm -rf /var/lib/apt/lists/*
|
|
|
|
# Create non-root user and directories for segments and profiles
|
|
RUN addgroup --system app && adduser --system --ingroup app app \
|
|
&& mkdir -p /data/segments /data/profiles
|
|
|
|
# Copy default profiles from release and rename JAR for simpler CMD
|
|
RUN cp -r profiles2/* /data/profiles/ 2>/dev/null || true \
|
|
&& mv brouter-*-all.jar brouter.jar
|
|
|
|
USER app
|
|
EXPOSE 17777
|
|
|
|
# BRouter server: <segmentdir> <profiledir> <customprofiledir> <port> <maxthreads>
|
|
CMD ["java", "-Xmx512M", "-Xms128M", "-Xmn32M", \
|
|
"-DmaxRunningTime=300", \
|
|
"-cp", "brouter.jar", \
|
|
"btools.server.RouteServer", \
|
|
"/data/segments", "/data/profiles", "/data/profiles", \
|
|
"17777", "4"]
|