Skip to content

Commit 78e26a6

Browse files
kittenkitten
committed
Add initial docker files
1 parent 0fb8b28 commit 78e26a6

File tree

6 files changed

+190
-0
lines changed

6 files changed

+190
-0
lines changed

‎.dockerignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
.*
2+
LICENSE
3+
README.md

‎.editorconfig‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# http://editorconfig.org
2+
root = true
3+
4+
[*]
5+
charset = utf-8
6+
end_of_line = lf
7+
indent_size = 2
8+
indent_style = tab
9+
max_line_length = 80
10+
trim_trailing_whitespace = true
11+
12+
[*.md]
13+
max_line_length = 0
14+
trim_trailing_whitespace = false
15+
16+
[COMMIT_EDITMSG]
17+
max_line_length = 0

‎Dockerfile‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
FROM buildpack-deps:jessie
2+
3+
RUN mkdir -p /conf
4+
5+
RUN apt-get update && apt-get install -y \
6+
libgmp-dev \
7+
iptables
8+
9+
ENV STRONGSWAN_VERSION 5.3.4
10+
11+
RUN mkdir -p /usr/src/strongswan \
12+
&& curl -SL "https://download.strongswan.org/strongswan-$STRONGSWAN_VERSION.tar.gz" \
13+
| tar -zxC /usr/src/strongswan --strip-components 1 \
14+
&& cd /usr/src/strongswan \
15+
&& ./configure --prefix=/usr --sysconfdir=/etc --enable-kernel-libipsec \
16+
&& make \
17+
&& make install \
18+
&& rm -rf /usr/src/strongswan
19+
20+
# Configuration files
21+
ADD ipsec.conf /etc/ipsec.conf
22+
ADD strongswan.conf /etc/strongswan.conf
23+
ADD run.sh /run.sh
24+
25+
# The password is later on replaced with a random string
26+
ENV VPN_USER user
27+
ENV VPN_PASSWORD password
28+
ENV VPN_PSK password
29+
30+
VOLUME ["/etc/ipsec.d"]
31+
EXPOSE 4500/udp 500/udp
32+
33+
CMD ["/run.sh"]

‎ipsec.conf‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# ipsec.conf - strongSwan IPsec configuration file
2+
3+
config setup
4+
uniqueids=never
5+
charondebug="cfg 2, dmn 2, ike 2, net 0"
6+
7+
conn %default
8+
ike=aes128-sha256-ecp256,aes256-sha384-ecp384,aes128-sha256-modp2048,aes256-sha384-modp4096,aes256-sha256-modp4096,aes128-sha256-modp1536,aes256-sha3$
9+
esp=aes128gcm16-ecp256,aes256gcm16-ecp384,aes128-sha256-ecp256,aes256-sha384-ecp384,aes128-sha256-modp2048,aes256-sha384-modp4096,aes256-sha256-modp4$
10+
dpdaction=clear
11+
dpddelay=300s
12+
rekey=no
13+
left=%defaultroute
14+
leftsubnet=0.0.0.0/0
15+
leftfirewall=yes
16+
right=%any
17+
rightsubnet=10.0.0.0/24
18+
rightsourceip=10.0.0.0/24
19+
ikelifetime=60m
20+
keylife=20m
21+
rekeymargin=3m
22+
keyingtries=1
23+
auto=add
24+
25+
###################################
26+
# PSK Connections
27+
###################################
28+
29+
conn IPSec-IKEv2-PSK
30+
keyexchange=ikev2
31+
authby=secret
32+
33+
conn CiscoIPSec
34+
keyexchange=ikev1
35+
leftauth=psk
36+
rightauth=psk
37+
rightauth2=xauth
38+
39+
###################################
40+
# XAuth and Pubkey Connections
41+
###################################
42+
43+
conn CiscoIPSec-XAuth
44+
keyexchange=ikev1
45+
rightauth=pubkey
46+
rightauth2=xauth
47+
auto=add
48+
49+
conn IPSec-IKEv2-EAP
50+
keyexchange=ikev2
51+
leftsendcert=always
52+
eap_identity=%any
53+
rightauth=eap-mschapv2

‎run.sh‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
#!/bin/bash
2+
3+
sysctl -w net.ipv4.conf.all.rp_filter=2
4+
5+
iptables --table nat --append POSTROUTING --jump MASQUERADE
6+
echo 1 > /proc/sys/net/ipv4/ip_forward
7+
for each in /proc/sys/net/ipv4/conf/*
8+
do
9+
echo 0 > $each/accept_redirects
10+
echo 0 > $each/send_redirects
11+
done
12+
13+
if [ "$VPN_PASSWORD" = "password" ] || [ "$VPN_PASSWORD" = "" ]; then
14+
# Generate a random password
15+
P1=`cat /dev/urandom | tr -cd abcdefghjkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789 | head -c 3`
16+
P2=`cat /dev/urandom | tr -cd abcdefghjkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789 | head -c 3`
17+
P3=`cat /dev/urandom | tr -cd abcdefghjkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789 | head -c 3`
18+
VPN_PASSWORD="$P1$P2$P3"
19+
echo "No VPN_PASSWORD set! Generated a random password: $VPN_PASSWORD"
20+
fi
21+
22+
if [ "$VPN_PSK" = "password" ] || [ "$VPN_PSK" = "" ]; then
23+
# Generate a random password
24+
P1=`cat /dev/urandom | tr -cd abcdefghjkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789 | head -c 3`
25+
P2=`cat /dev/urandom | tr -cd abcdefghjkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789 | head -c 3`
26+
P3=`cat /dev/urandom | tr -cd abcdefghjkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789 | head -c 3`
27+
VPN_PSK="$P1$P2$P3"
28+
echo "No VPN_PSK set! Generated a random PSK key: $VPN_PSK"
29+
fi
30+
31+
cat > /etc/ipsec.secrets <<EOF
32+
# This file holds shared secrets or RSA private keys for authentication.
33+
# RSA private key for this host, authenticating it to any other host
34+
# which knows the public part. Suitable public keys, for ipsec.conf, DNS,
35+
# or configuration of other implementations, can be extracted conveniently
36+
# with "ipsec showhostkey".
37+
38+
: PSK "$VPN_PSK"
39+
40+
$VPN_USER : EAP "$VPN_PASSWORD"
41+
$VPN_USER : XAUTH "$VPN_PASSWORD"
42+
EOF
43+
44+
if [ -f "/etc/ipsec.d/ipsec.secrets" ]; then
45+
echo "Overwriting standard /etc/ipsec.secrets with /etc/ipsec.d/ipsec.secrets"
46+
cp -f /etc/ipsec.d/ipsec.secrets /etc/ipsec.secrets
47+
fi
48+
49+
if [ -f "/etc/ipsec.d/ipsec.conf" ]; then
50+
echo "Overwriting standard /etc/ipsec.conf with /etc/ipsec.d/ipsec.conf"
51+
cp -f /etc/ipsec.d/ipsec.conf /etc/ipsec.conf
52+
fi
53+
54+
if [ -f "/conf/strongswan.conf" ]; then
55+
echo "Overwriting standard /etc/strongswan.conf with /etc/ipsec.d/strongswan.conf"
56+
cp -f /conf/strongswan.conf /etc/strongswan.conf
57+
fi
58+
59+
ipsec start --nofork

‎strongswan.conf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# /etc/strongswan.conf - strongSwan configuration file
2+
# strongswan.conf - strongSwan configuration file
3+
#
4+
# Refer to the strongswan.conf(5) manpage for details
5+
6+
charon {
7+
load_modular = yes
8+
plugins {
9+
include strongswan.d/charon/*.conf
10+
attr {
11+
dns = 8.8.8.8, 8.8.4.4
12+
}
13+
kernel-netlink {
14+
fwmark = !0x42
15+
}
16+
socket-default {
17+
fwmark = 0x42
18+
}
19+
kernel-libipsec {
20+
allow_peer_ts = yes
21+
}
22+
}
23+
}
24+
25+
include strongswan.d/*.conf

0 commit comments

Comments
 (0)