From a63e6e4ca5d9cce04c2dbbc3ff8b4a2bdd2bfe00 Mon Sep 17 00:00:00 2001 From: knylbyte <40831653+knylbyte@users.noreply.github.com> Date: Wed, 15 Jul 2026 12:52:16 +0200 Subject: [PATCH] docs: updatet docker templates and added iptv-org-epg template (#790) --- README.md | 13 +- docker/README.md | 86 +++- .../crowdsec/crowdsec/acquis.d/appsec.yml | 1 + .../crowdsec/crowdsec/acquis.d/docker.yml | 1 + .../crowdsec/crowdsec/acquis.d/iptables.yml | 1 + .../crowdsec/crowdsec/acquis.d/mail.yml | 1 + .../crowdsec/crowdsec/acquis.d/sshd.yml | 1 + .../crowdsec/crowdsec/acquis.d/system.yml | 1 + .../crowdsec/crowdsec/acquis.d/traefik.yml | 1 + .../s02-enrich/tuliprox-cover-whitelist.yaml | 12 + .../crowdsec/docker-compose.yml | 9 +- .../config/crowdsec-firewall-bouncer.yaml | 1 + .../gluetun/.env.socks5-proxy | 7 +- .../{gluetun-01/.env.wg-01 => .env.wg} | 0 .../{gluetun-01 => }/docker-compose.yml | 26 +- .../gluetun/gluetun-02/.env.wg-02 | 10 - .../gluetun/gluetun-02/docker-compose.yml | 53 --- .../gluetun/gluetun-03/.env.wg-03 | 10 - .../gluetun/gluetun-03/docker-compose.yml | 53 --- .../iptv-org/data/channels.xml | 450 ++++++++++++++++++ .../iptv-org/docker-compose.yml | 32 ++ .../traefik/config/dynamic/gluetun-proxys.yml | 10 +- .../traefik/config/traefik.yml | 1 + .../traefik/docker-compose.yml | 2 +- .../tuliprox/docker-compose.yml | 2 +- docs/src/build-and-deploy.md | 4 +- .../s02-enrich/tuliprox-cover-whitelist.yaml | 12 + docs/src/examples-recipes.md | 32 +- 28 files changed, 634 insertions(+), 198 deletions(-) create mode 100644 docker/container-templates/crowdsec/crowdsec/config/parsers/s02-enrich/tuliprox-cover-whitelist.yaml rename docker/container-templates/gluetun/{gluetun-01/.env.wg-01 => .env.wg} (100%) rename docker/container-templates/gluetun/{gluetun-01 => }/docker-compose.yml (60%) delete mode 100644 docker/container-templates/gluetun/gluetun-02/.env.wg-02 delete mode 100644 docker/container-templates/gluetun/gluetun-02/docker-compose.yml delete mode 100644 docker/container-templates/gluetun/gluetun-03/.env.wg-03 delete mode 100644 docker/container-templates/gluetun/gluetun-03/docker-compose.yml create mode 100644 docker/container-templates/iptv-org/data/channels.xml create mode 100644 docker/container-templates/iptv-org/docker-compose.yml create mode 100644 docs/src/docker/container-templates/crowdsec/crowdsec/config/parsers/s02-enrich/tuliprox-cover-whitelist.yaml diff --git a/README.md b/README.md index 96956cd6d..1607ab46f 100644 --- a/README.md +++ b/README.md @@ -247,7 +247,7 @@ Generate all four formats simultaneously from the same source — one setup, eve ### 16. Operations & Deployment - **Docker**: Alpine and Scratch images — minimal image size -- **Docker Compose templates**: traefik, crowdsec, gluetun/socks5 templates ready to use +- **Docker Compose templates**: traefik, crowdsec, gluetun/socks5, iptv-org/epg templates ready to use - **Zero-downtime config reload**: `ArcSwap` for atomic configuration swaps without interruption - **Disk-based processing**: Playlist processing from disk instead of RAM — massively reduced memory consumption - **CLI mode**: One-shot processing without a server — ideal for scripting and CI/CD @@ -274,7 +274,7 @@ Generate all four formats simultaneously from the same source — one setup, eve - Runs on Raspberry Pi and tiny VPS instances - Minimal resource usage thanks to Rust and disk-based processing - **Runs 24/7 for months with rock-solid stability and near-zero maintenance** -- Traefik/Crowdsec/Gluetun templates ready to deploy +- Traefik/Crowdsec/Gluetun/IPTV-org-epg templates ready to deploy ### For Multi-User Operations @@ -294,10 +294,11 @@ Generate all four formats simultaneously from the same source — one setup, eve ## 🐋 Docker Container Templates -- traefik template -- crowdsec template -- gluetun/socks5 template -- tuliprox (incl. traefik) template +- [traefik](docker/container-templates/traefik/) template +- [crowdsec](docker/container-templates/crowdsec/) template +- [gluetun/socks5](docker/container-templates/gluetun/) template +- [iptv-org-epg](docker/container-templates/iptv-org/) template +- [tuliprox](docker/container-templates/tuliprox/) (incl. traefik) template `> ./docker/container-templates` diff --git a/docker/README.md b/docker/README.md index 132d25821..ac66bfc63 100644 --- a/docker/README.md +++ b/docker/README.md @@ -52,8 +52,8 @@ Set timezone in docker-compose.yml like ## Docker Container Templates — Deployment Guide This repository contains ready-to-use Docker Compose templates for a secure reverse proxy stack with VPN egress and CrowdSec protection. It includes -**Traefik**, **Gluetun** (WireGuard) with optional proxy sidecars, **CrowdSec** with Traefik integration, and an example **Tuliprox** app wired for -reverse proxying. +**Traefik**, **Gluetun** (WireGuard) with optional proxy sidecars, **CrowdSec** with Traefik integration, an **IPTV-org-epg** service, and an example +**Tuliprox** app wired for reverse proxying. > **Software baseline:** Traefik v3.5, a current Rust toolchain, and a current Docker/Compose setup. @@ -61,12 +61,13 @@ reverse proxying. ## Legend -| Template | Folder | Purpose | Notable Ports (internal unless published) | -| ------------ | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------ | -| **Traefik** | `container-templates/traefik/` | Reverse proxy & TLS (ACME/DNS), dashboard, dynamic security middlewares, optional CrowdSec bouncer. | 80 `web`, 443 `websecure` | -| **Gluetun** | `container-templates/gluetun/` | VPN egress via WireGuard; sidecars provide **SOCKS5**, **HTTP**, and **Shadowsocks** proxies bound to Gluetun’s network stack. | 1080/tcp (HTTP), 1388/tcp+udp (SOCKS5), 9388/tcp+udp (Shadowsocks) | -| **CrowdSec** | `container-templates/crowdsec/` | LAPI + bouncers (Traefik & firewall) to protect services. | LAPI on `127.0.0.1:8080` (host) | -| **Tuliprox** | `container-templates/tuliprox/` | Example application container with Traefik labels and `expose: 8901` for reverse proxying. | 8901 (internal) | +| Template | Folder | Purpose | Notable Ports (internal unless published) | +| ---------------- | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------ | +| **Traefik** | `container-templates/traefik/` | Reverse proxy & TLS (ACME/DNS), dashboard, dynamic security middlewares, optional CrowdSec bouncer. | 80 `web`, 443 `websecure` | +| **Gluetun** | `container-templates/gluetun/` | VPN egress via WireGuard; sidecars provide **SOCKS5**, **HTTP**, and **Shadowsocks** proxies bound to Gluetun’s network stack. | 1080/tcp (HTTP), 1388/tcp+udp (SOCKS5), 9388/tcp+udp (Shadowsocks) | +| **CrowdSec** | `container-templates/crowdsec/` | LAPI + bouncers (Traefik & firewall) to protect services. | LAPI on `127.0.0.1:8080` (host) | +| **Tuliprox** | `container-templates/tuliprox/` | Example application container with Traefik labels and `expose: 8901` for reverse proxying. | 8901 (internal) | +| **IPTV-org-epg** | `container-templates/iptv-org/` | Generates and serves a local XMLTV guide from a manually curated channel list. | 3000 (internal) | --- @@ -94,15 +95,9 @@ container-templates/ │ ├─ .env.http-proxy │ ├─ .env.socks5-proxy │ ├─ .env.ss-proxy -│ ├─ gluetun-01/ -│ │ ├─ .env.wg-01 +│ ├─ gluetun/ +│ │ ├─ .env.wg │ │ └─ docker-compose.yml -│ ├─ gluetun-02/ -│ │ ├─ .env.wg-02 -│ │ └─ docker-compose.yml -│ └─ gluetun-03/ -│ ├─ .env.wg-03 -│ └─ docker-compose.yml ├─ crowdsec/ │ ├─ .env.cs-bouncer-firewall │ ├─ .env.cs-bouncer-traefik @@ -118,7 +113,11 @@ container-templates/ │ ├─ firewall-bouncer/ │ │ └─ config/crowdsec-firewall-bouncer.yaml │ └─ docker-compose.yml -└─ tuliprox/ +├─ tuliprox/ +│ └─ docker-compose.yml +└─ iptv-org/ + ├─ data/ + │ └─ channels.xml └─ docker-compose.yml ``` @@ -207,15 +206,15 @@ docker logs -f traefik **Folder:** `container-templates/gluetun/` -Each instance (`gluetun-01`, `gluetun-02`, `gluetun-03`) has its own `.env.wg-0x` with WireGuard settings. Sidecars (e.g., `socks5-02`) use -`network_mode: service:gluetun-02` to share Gluetun’s network. Otherwise connect the provided proxies within your tuliprox instance through traefik. +Each instance (`gluetun`) has its own `.env.wg` with WireGuard settings. Sidecars (e.g., `socks5`) use +`network_mode: service:gluetun` to share Gluetun’s network. Otherwise connect the provided proxies within your tuliprox instance through traefik. -### Configure minimum one instance (example: gluetun-02) +### Configure minimum one instance (example: gluetun) 1. Edit WireGuard values: ```bash - nano container-templates/gluetun/gluetun-02/.env.wg-02 + nano container-templates/gluetun/.env.wg # WIREGUARD_PRIVATE_KEY=... # WIREGUARD_ADDRESSES=... # WIREGUARD_PUBLIC_KEY=... @@ -233,8 +232,8 @@ Each instance (`gluetun-01`, `gluetun-02`, `gluetun-03`) has its own `.env.wg-0x 3. Start: ```bash - docker compose -f container-templates/gluetun/gluetun-02/docker-compose.yml up -d - docker logs -f gluetun-02 + docker compose -f container-templates/gluetun/docker-compose.yml up -d + docker logs -f gluetun ``` ### Test from your Docker host @@ -344,6 +343,36 @@ labels: --- +## 5) IPTV-org-epg (EPG guide) + +**Folder:** `container-templates/iptv-org/` + +### Configure + +1. Copy the desired `` entries from the IPTV-org `sites` files to + `container-templates/iptv-org/data/channels.xml`. +2. Ensure every `xmltv_id` exactly matches the corresponding `@epg_channel_id` in Tuliprox. For example, + `xmltv_id="BBCOne.uk@LondonHD"` matches `@epg_channel_id = "BBCOne.uk@LondonHD"`. If necessary, adjust `xmltv_id` in + `channels.xml` or set the corresponding `@epg_channel_id` in `mapping.yml`. +3. Add the generated guide to the corresponding input in your `source.yml`: + + ```yaml + epg: + sources: + - url: http://iptv-org-epg:3000/guide.xml + ``` + +### Start + +```bash +docker compose -f container-templates/iptv-org/docker-compose.yml up -d +docker logs -f iptv-org-epg +``` + +The generated `guide.xml` is written to `container-templates/iptv-org/data/`. + +--- + ## Quick Start (end-to-end) ```bash @@ -358,9 +387,9 @@ echo "" > cf-token && chmod 600 cf-token # Fix .env and config/traefik.yml (ACME email, dnsChallenge provider, etc.) docker compose up -d -# 2) Gluetun (e.g., instance 02) -cd ../gluetun/gluetun-02 -# Fill .env.wg-02; optionally enable sidecars via ../.env.* files +# 2) Gluetun +cd ../gluetun +# Fill .env.wg and configure the main-container proxies in the local .env.* proxy files docker compose up -d # 3) Tuliprox @@ -371,6 +400,11 @@ docker compose up -d cd ../crowdsec # Fill .env.cs-bouncer-* docker compose up -d + +# 5) IPTV-org-epg +cd ../iptv-org +# Fill data/channels.xml and match every xmltv_id with @epg_channel_id +docker compose up -d ``` --- diff --git a/docker/container-templates/crowdsec/crowdsec/acquis.d/appsec.yml b/docker/container-templates/crowdsec/crowdsec/acquis.d/appsec.yml index 5fee9b92d..1cb9cbf8e 100644 --- a/docker/container-templates/crowdsec/crowdsec/acquis.d/appsec.yml +++ b/docker/container-templates/crowdsec/crowdsec/acquis.d/appsec.yml @@ -1,3 +1,4 @@ +--- appsec_config: crowdsecurity/appsec-default labels: type: appsec diff --git a/docker/container-templates/crowdsec/crowdsec/acquis.d/docker.yml b/docker/container-templates/crowdsec/crowdsec/acquis.d/docker.yml index 2b680f909..b004bd15a 100644 --- a/docker/container-templates/crowdsec/crowdsec/acquis.d/docker.yml +++ b/docker/container-templates/crowdsec/crowdsec/acquis.d/docker.yml @@ -1,3 +1,4 @@ +--- # Docker-JSON filenames: - /var/lib/docker/containers/**/*.log diff --git a/docker/container-templates/crowdsec/crowdsec/acquis.d/iptables.yml b/docker/container-templates/crowdsec/crowdsec/acquis.d/iptables.yml index 6b68023bf..bf2ed560a 100644 --- a/docker/container-templates/crowdsec/crowdsec/acquis.d/iptables.yml +++ b/docker/container-templates/crowdsec/crowdsec/acquis.d/iptables.yml @@ -1,3 +1,4 @@ +--- # iptables filenames: - /var/log/messages diff --git a/docker/container-templates/crowdsec/crowdsec/acquis.d/mail.yml b/docker/container-templates/crowdsec/crowdsec/acquis.d/mail.yml index f7d04195c..eed672b79 100644 --- a/docker/container-templates/crowdsec/crowdsec/acquis.d/mail.yml +++ b/docker/container-templates/crowdsec/crowdsec/acquis.d/mail.yml @@ -1,3 +1,4 @@ +--- # Mail filenames: - /var/log/mail.log diff --git a/docker/container-templates/crowdsec/crowdsec/acquis.d/sshd.yml b/docker/container-templates/crowdsec/crowdsec/acquis.d/sshd.yml index 29fd18169..93456df9c 100644 --- a/docker/container-templates/crowdsec/crowdsec/acquis.d/sshd.yml +++ b/docker/container-templates/crowdsec/crowdsec/acquis.d/sshd.yml @@ -1,3 +1,4 @@ +--- filenames: - /var/log/ssh.log # Alpine - /var/log/auth.log # Debian/Ubuntu diff --git a/docker/container-templates/crowdsec/crowdsec/acquis.d/system.yml b/docker/container-templates/crowdsec/crowdsec/acquis.d/system.yml index 4425fb85a..a52f6f6e3 100644 --- a/docker/container-templates/crowdsec/crowdsec/acquis.d/system.yml +++ b/docker/container-templates/crowdsec/crowdsec/acquis.d/system.yml @@ -1,3 +1,4 @@ +--- # System & Auth filenames: - /var/log/messages diff --git a/docker/container-templates/crowdsec/crowdsec/acquis.d/traefik.yml b/docker/container-templates/crowdsec/crowdsec/acquis.d/traefik.yml index 784993bc9..4658e5dba 100644 --- a/docker/container-templates/crowdsec/crowdsec/acquis.d/traefik.yml +++ b/docker/container-templates/crowdsec/crowdsec/acquis.d/traefik.yml @@ -1,3 +1,4 @@ +--- filenames: - /var/log/traefik/* labels: diff --git a/docker/container-templates/crowdsec/crowdsec/config/parsers/s02-enrich/tuliprox-cover-whitelist.yaml b/docker/container-templates/crowdsec/crowdsec/config/parsers/s02-enrich/tuliprox-cover-whitelist.yaml new file mode 100644 index 000000000..9a2cad4fe --- /dev/null +++ b/docker/container-templates/crowdsec/crowdsec/config/parsers/s02-enrich/tuliprox-cover-whitelist.yaml @@ -0,0 +1,12 @@ +--- +name: local/tuliprox-cover-parser-whitelist +description: Ignore expected Tuliprox Xtream image fetches before scenarios +filter: 'evt.Meta.log_type == "http_access-log"' +whitelist: + reason: "Ignore expected Tuliprox 4xx/5xx Xtream image GETs" + expression: + - > + evt.Meta.traefik_router_name in ["tuliprox@docker", "tuliprox-secure@docker"] && + evt.Meta.http_verb == "GET" && + evt.Meta.http_status matches "^[45][0-9][0-9]$" && + evt.Meta.http_path matches "^(/[^/?#]+)*/resource/(live/[^/]+/[^/]+/[0-9]+/(logo|logo_small)|movie/[^/]+/[^/]+/[0-9]+/(logo|logo_small|nfo_cover_big|nfo_movie_image|nfo_backdrop_path_[0-9]+)|series/[^/]+/[^/]+/[0-9]+/(logo|logo_small|cover|backdrop_path_[0-9]+|nfo_s_[0-9]+_(cover|cover_tmdb|cover_big)|nfo_ep_[0-9]+_[0-9]+_movie_image))$" diff --git a/docker/container-templates/crowdsec/docker-compose.yml b/docker/container-templates/crowdsec/docker-compose.yml index 60fde768d..87f351293 100644 --- a/docker/container-templates/crowdsec/docker-compose.yml +++ b/docker/container-templates/crowdsec/docker-compose.yml @@ -8,15 +8,16 @@ services: - 127.0.0.1:8080:8080 security_opt: - apparmor=docker-default # security_opts are optional - restart: on-failure + restart: unless-stopped environment: TZ: America/Chicago GID: "${GID:-1000}" COLLECTIONS: > crowdsecurity/linux - crowdsecurity/iptables + crowdsecurity/iptables crowdsecurity/http-cve crowdsecurity/base-http-scenarios + crowdsecurity/nginx crowdsecurity/traefik crowdsecurity/whitelist-good-actors crowdsecurity/sshd @@ -53,7 +54,7 @@ services: depends_on: crowdsec: condition: service_healthy - restart: on-failure + restart: unless-stopped security_opt: - apparmor=docker-default # security_opts are optional env_file: @@ -62,7 +63,7 @@ services: firewall-bouncer: image: ghcr.io/knylbyte/cs-firewall-bouncer:latest container_name: cs-bouncer-firewall - restart: on-failure + restart: unless-stopped network_mode: host cap_add: - NET_ADMIN diff --git a/docker/container-templates/crowdsec/firewall-bouncer/config/crowdsec-firewall-bouncer.yaml b/docker/container-templates/crowdsec/firewall-bouncer/config/crowdsec-firewall-bouncer.yaml index 56f79784c..b54b4c870 100644 --- a/docker/container-templates/crowdsec/firewall-bouncer/config/crowdsec-firewall-bouncer.yaml +++ b/docker/container-templates/crowdsec/firewall-bouncer/config/crowdsec-firewall-bouncer.yaml @@ -1,3 +1,4 @@ +--- mode: iptables update_frequency: 10s log_mode: stdout # file, stdout, syslog diff --git a/docker/container-templates/gluetun/.env.socks5-proxy b/docker/container-templates/gluetun/.env.socks5-proxy index da55169bb..86e4674a2 100644 --- a/docker/container-templates/gluetun/.env.socks5-proxy +++ b/docker/container-templates/gluetun/.env.socks5-proxy @@ -1,3 +1,4 @@ -PROXY_USER="" -PROXY_PASSWORD="" -PROXY_PORT=1388 \ No newline at end of file +SOCKS5_ENABLED=ON +SOCKS5_LISTENING_ADDRESS=:1388 +SOCKS5_USER="" +SOCKS5_PASSWORD="" \ No newline at end of file diff --git a/docker/container-templates/gluetun/gluetun-01/.env.wg-01 b/docker/container-templates/gluetun/.env.wg similarity index 100% rename from docker/container-templates/gluetun/gluetun-01/.env.wg-01 rename to docker/container-templates/gluetun/.env.wg diff --git a/docker/container-templates/gluetun/gluetun-01/docker-compose.yml b/docker/container-templates/gluetun/docker-compose.yml similarity index 60% rename from docker/container-templates/gluetun/gluetun-01/docker-compose.yml rename to docker/container-templates/gluetun/docker-compose.yml index 0b807212b..93506c674 100644 --- a/docker/container-templates/gluetun/gluetun-01/docker-compose.yml +++ b/docker/container-templates/gluetun/docker-compose.yml @@ -1,8 +1,8 @@ services: - gluetun-01: + gluetun: image: qmcgaw/gluetun:latest - container_name: gluetun-01 - restart: on-failure + container_name: gluetun + restart: unless-stopped security_opt: - apparmor=docker-default # security_opts are optional networks: @@ -17,9 +17,10 @@ services: cap_add: - NET_ADMIN env_file: - - ../.env.http-proxy - - ../.env.ss-proxy - - .env.wg-01 + - .env.http-proxy + - .env.socks5-proxy + - .env.ss-proxy + - .env.wg volumes: - ./conf:/gluetun/ devices: @@ -34,19 +35,6 @@ services: timeout: 5s retries: 1 - socks5-01: - image: serjs/go-socks5-proxy:latest - container_name: socks5-01 - restart: on-failure - security_opt: - - apparmor=docker-default # security_opts are optional - network_mode: service:gluetun-01 - env_file: ../.env.socks5-proxy - depends_on: - gluetun-01: - condition: service_healthy - restart: true - networks: proxy-net: external: true diff --git a/docker/container-templates/gluetun/gluetun-02/.env.wg-02 b/docker/container-templates/gluetun/gluetun-02/.env.wg-02 deleted file mode 100644 index aafb6199b..000000000 --- a/docker/container-templates/gluetun/gluetun-02/.env.wg-02 +++ /dev/null @@ -1,10 +0,0 @@ -VPN_SERVICE_PROVIDER=custom -VPN_TYPE=wireguard -WIREGUARD_PRIVATE_KEY= -WIREGUARD_ADDRESSES= -WIREGUARD_PUBLIC_KEY= -WIREGUARD_ENDPOINT_IP= -WIREGUARD_ENDPOINT_PORT=51820 -WIREGUARD_MTU=1420 -WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s - diff --git a/docker/container-templates/gluetun/gluetun-02/docker-compose.yml b/docker/container-templates/gluetun/gluetun-02/docker-compose.yml deleted file mode 100644 index b1fb9995a..000000000 --- a/docker/container-templates/gluetun/gluetun-02/docker-compose.yml +++ /dev/null @@ -1,53 +0,0 @@ -services: - gluetun-02: - image: qmcgaw/gluetun:latest - container_name: gluetun-02 - restart: on-failure - security_opt: - - apparmor=docker-default # security_opts are optional - networks: - - proxy-net - expose: - - 1080/tcp # HTTP - - 1388/tcp # SOCKS5 - - 1388/udp # SOCKS5 - - 9388/tcp # SHADOWSOCKS - - 9388/udp # SHADOWSOCKS - # - 8888/tcp # METRICS - cap_add: - - NET_ADMIN - env_file: - - ../.env.http-proxy - - ../.env.ss-proxy - - .env.wg-02 - volumes: - - ./conf:/gluetun/ - devices: - - /dev/net/tun:/dev/net/tun - environment: - - TZ=America/Chicago - - UPDATER_PERIOD=24h - healthcheck: - test: ["CMD", "/gluetun-entrypoint", "healthcheck"] - start_period: 10s - interval: 5s - timeout: 5s - retries: 1 - - socks5-02: - image: serjs/go-socks5-proxy:latest - container_name: socks5-02 - restart: on-failure - security_opt: - - apparmor=docker-default # security_opts are optional - network_mode: service:gluetun-02 - env_file: ../.env.socks5-proxy - depends_on: - gluetun-02: - condition: service_healthy - restart: true - -networks: - proxy-net: - external: true - name: proxy-net diff --git a/docker/container-templates/gluetun/gluetun-03/.env.wg-03 b/docker/container-templates/gluetun/gluetun-03/.env.wg-03 deleted file mode 100644 index 67bfeb347..000000000 --- a/docker/container-templates/gluetun/gluetun-03/.env.wg-03 +++ /dev/null @@ -1,10 +0,0 @@ -VPN_SERVICE_PROVIDER=mullvad -VPN_TYPE=wireguard -WIREGUARD_PRIVATE_KEY= -WIREGUARD_ADDRESSES= -WIREGUARD_PUBLIC_KEY= -WIREGUARD_ENDPOINT_IP= -WIREGUARD_ENDPOINT_PORT=51820 -WIREGUARD_MTU=1420 -WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s -OWNED_ONLY=yes diff --git a/docker/container-templates/gluetun/gluetun-03/docker-compose.yml b/docker/container-templates/gluetun/gluetun-03/docker-compose.yml deleted file mode 100644 index 72efaaf90..000000000 --- a/docker/container-templates/gluetun/gluetun-03/docker-compose.yml +++ /dev/null @@ -1,53 +0,0 @@ -services: - gluetun-03: - image: qmcgaw/gluetun:latest - container_name: gluetun-03 - restart: on-failure - security_opt: - - apparmor=docker-default # security_opts are optional - networks: - - proxy-net - expose: - - 1080/tcp # HTTP - - 1388/tcp # SOCKS5 - - 1388/udp # SOCKS5 - - 9388/tcp # SHADOWSOCKS - - 9388/udp # SHADOWSOCKS - # - 8888/tcp # METRICS - cap_add: - - NET_ADMIN - env_file: - - ../.env.http-proxy - - ../.env.ss-proxy - - .env.wg-03 - volumes: - - ./conf:/gluetun/ - devices: - - /dev/net/tun:/dev/net/tun - environment: - - TZ=America/Chicago - - UPDATER_PERIOD=24h - healthcheck: - test: ["CMD", "/gluetun-entrypoint", "healthcheck"] - start_period: 10s - interval: 5s - timeout: 5s - retries: 1 - - socks5-03: - image: serjs/go-socks5-proxy:latest - container_name: socks5-03 - restart: on-failure - security_opt: - - apparmor=docker-default # security_opts are optional - network_mode: service:gluetun-03 - env_file: ../.env.socks5-proxy - depends_on: - gluetun-03: - condition: service_healthy - restart: true - -networks: - proxy-net: - external: true - name: proxy-net diff --git a/docker/container-templates/iptv-org/data/channels.xml b/docker/container-templates/iptv-org/data/channels.xml new file mode 100644 index 000000000..ecc044008 --- /dev/null +++ b/docker/container-templates/iptv-org/data/channels.xml @@ -0,0 +1,450 @@ + + + + + + Al Jazeera HD + Animal Plnt+1 + Animal Planet + Arirang TV HD + ARY Digital + QTV Religious + ATN + B4U Movies + B4U Music + Babenation + babes&brazzers + BabyTV + BBC Four HD + BBC Four HD + BBC NEWS HD + BBC One CI HD + BBC One EastHD + BBC One EMidHD + BBC One Lon HD + BBC One NE HD + BBC One NI HD + BBC One NI HD + BBC One NW HD + BBC One ScotHD + BBC One SE HD + BBC One Sth HD + BBC One SW HD + BBC One Wal HD + BBC One Wst HD + BBC One WM HD + BBC One Yks HD + BBC One Y&L HD + BBC Parl HD + BBC RB 1 HD + BBCScotlandHD + BBC Three HD + BBC Two HD + BBC Two NI HD + BBC Two NI HD + BBC Two Wal HD + Best Direct + BLAZE + Bloomberg HD + Boomerang+1 + Boomerang + Cartoonito + Cartoon Net HD + CN+1 + Cartoon Netwrk + CBBC HD + CBBC HD + CBeebies HD + CBeebies HD + TRUE CRIME+1 + Challenge + Challenge + Channel 4 HD + Channel 4 HD + Channel 4+1 + Channel 4 HD + Channel 4 HD + Channel 4 HD + Channel 4 HD + Channel 4 HD + Channel 4+1 + Channel 4+1 + Channel 4+1 + Channel 4+1 + 5 HD + 5+1 + Channels 24 + CHSTV + Chl Line-up + Clubland TV + CNBC HD + CNN HD + COLORS + ColorsCineplex + ColorsGujarati + COLORS HD + ColorsRishtey + ComedyCentral + ComedyCentHD + ComedyCent+1 + ComedyCentral + ComedyXtra + ComedyXtra + Court TV + Crime+Inv HD + Crime+Inv+1 + Crime+Inv + Cruise1st.tv + Cúla4 HD + U&Dave HD + U&Dave + DAYSTAR HD + Deen TV + Discovery + Discovery + Discovery HD + Discovery+1 + Disc.History+1 + Disc.History + Disc.Science + Disc.Sci+1 + Disc.Turbo+1 + Disc.Turbo + DMAX + DMAX + DMAX+1 + DM News English + U&Drama + Dunamis TV + E4 + E4 HD + E4+1 + E4 + E4 Extra + E4 Extra + Eman Channel + Euronews + EWTN Catholic + Faith UK + Faith World TV + Film4 + Film4 HD + Film4+1 + Film4 + Food Network + Food Netwrk+1 + Food Network + FRANCE 24 HD + GB News HD + Gemporia HD + GEO News + GEO TV + GOD Channel + Great! Action+1 + Great! Action + Great! Mystery + Great! Mystery + G! Mystery+1 + Great! Action + Great! Romance + G! Romance+1 + Great! TV + Great! TV+1 + Great! TV + HGTV + High Street TV 1 + High Street TV 2 + Shop Unlimited + HobbyMakerHD + LEGEND XTRA+1 + LEGEND XTRA + HUM EUROPE + Ideal World HD + ID+1 + ID + ID + iON TV + IQRA Bangla + IQRA TV + Islam Channel + Islam Ch Urdu + Islam TV + ITV1 HD + ITV1 HD + ITV1 HD + ITV1 HD + ITV1 HD + ITV1 HD + ITV1 HD + ITV1 HD + ITV1 HD + ITV1 HD + ITV1 HD + ITV1 HD + ITV1 HD + ITV1 HD + ITV1 HD + ITV1 HD + ITV1+1 + ITV1+1 + ITV1+1 + ITV1+1 + ITV1 HD + ITV1 Wales HD + ITV2 HD + ITV2+1 + ITV3 HD + ITV3+1 + ITV4 HD + ITV4+1 + ITV Quiz HD + JewelleryMaker + Kanshi TV + NTD + LEGEND + LFCTV HD + LoveWorld HD + Madani Chnl + HUM News + APNA MA TV + More4 + More4 HD + More4+1 + More4 + Movies24 + Movies24+ + MTA1 World HD + MTV + MTV HD + MTV + MTV 90s + Club MTV + MstHveIdeasHD + MUTV HD + Nat Geo HD + Nat Geo+1 + Nat Geo + NatGeoWild HD + Nat Geo Wild + NDTV World + New Vision TV + NHK World HD + Nickelodeon + NickelodeonHD + Nickelodeon+1 + Nickelodeon + Nick Jr. + Nick Jr. HD + Nick Jr+1 + Nick Jr. + Nick Jr. Too + Nick Jr. Too + Nicktoons + Nicktoons + Noor TV + NOW 70s + NOW 80s + NOW 90s & 00s + NOW ROCK + NTV + Oireachtas TV + Panjab TV + PBC + PBS America + PCNE Chinese HD + Pitaara + PoliticsPunjab + Premier 1 HD + Premier 1 HD + Premier 2 HD + Premier 2 HD + PTC PUNJABI + QUEST HD + QUEST HD + QUEST+1 + Quest Red + Quest Red+1 + Quest Red + QVC HD + QVC Beauty + QVC Extra + QVC Style HD + Racing TV HD + TRUE CRIME X + Really + Really + revelation + Rewind TV + RTÉ2 HD + RTÉ2+1 + RTÉ KIDSjr + RTÉ News + RTÉ One HD + RTÉ One+1 + S4C HD + S4C + Sangat + Sanskar + Sikh Channel + Sky Arts HD + Sky Arts + Sky Atlantic + Sky Atlantic HD + Sky Atlantic+1 + Sky Atlantic + Sky Action HD + Sky Comedy HD + Sky Drama HD + Sky Family HD + Sky Greats HD + SkyAnimationHD + SkyPremiereHD + Sky ScFi/HorHD + SkyDirectorsHD + Sky Thriller HD + Sky Comedy + Sky Comedy HD + Sky Comedy + Sky Crime HD + Sky Crime + Sky Crime HD + Sky Crime+1 + Sky Crime + SkyDocumntrs + SkyDocmntrsHD + SkyDocumntrs + Sky History2 + Sky HistoryHD + Sky History + Sky Kids HD + Sky One + Sky One HD + Sky One + Sky Mix HD + Sky Mix HD + Sky Nature HD + Sky Nature + Sky News HD + Sky News + Sky News HD + Sky News + SkyNewsArabia + Sky Sci-Fi HD + Sky Sci-Fi + SkyShowcase+1 + SkySp+ + SkySp+ HD + SkySp Cricket + SkySpCricket HD + SkySp F1 + SkySp F1 HD + SkySp F'ball + SkySp F'ball HD + SkySp Golf HD + SkySp Golf + SkySp Golf HD + SkySpMainEvHD + SkySpMainEv + SkySpMainEvHD + SkySp Mix HD + SkySp Mix + SkySp News HD + SkySp News + SkySp News HD + SkySp News + SkySp Action + SkySp ActionHD + SkySp PL HD + SkySp PL + SkySp PL HD + SkySp Racing HD + SkySp Racing HD + SkySp Tennis + SkySp Tennis HD + Sky Witness HD + Sky Witness + Sky Witness HD + Sky Witness+1 + Sky Witness + SONY TV HD + SONY TV + SONY MAX 2 + SONY MAX HD + SONY MAX + SONY SAB + STV HD + STV HD + STV HD + STV HD + STV + STV + Takbeer TV + TalkingPictures + TBN UK + Television X + TG4 HD + That's TV + Tiny Pop + TJC HD + TLC + TLC HD + TLC+1 + TLC + TNTSports1 HD + TNTSports1 HD + TNT Sports 1 + TNTSports2 HD + TNT Sports 2 + TNTSports3 HD + TNT Sports 3 + TNTSports4 HD + TNT Sports 4 + TNTSBoxOff2HD + TNTSBoxOffHD + Together + Travelxp + TRT World HD + TRT World + TRUE CRIME + TRUE CRIME + TRUE CRIME X + TVC News + TV One + TV Warehouse + U&Alibi HD + U&Alibi+1 + U&Alibi + U&Dave HD + U&Dave + U&DaveJaVu + U&Drama+1 + U&Drama + U&Eden+1 + U&Eden + U&Gold HD + U&Gold+1 + U&Gold + U&Gold + Utsav Bharat + Utsav Gold HD + Utsav Gold + Utsav Plus HD + Utsav Plus + UTV HD + U&W+1 + U&W + U&Yesterday+1 + U&Yesterday + Virgin Four HD + Virgin One HD + Virgin One+1 + Virgin Three + Virgin Two HD + U&W + Xpanded TV + XXX Girl Girl + Zee Cinema + Zee Punjabi + Zee TV HD + Zee TV + \ No newline at end of file diff --git a/docker/container-templates/iptv-org/docker-compose.yml b/docker/container-templates/iptv-org/docker-compose.yml new file mode 100644 index 000000000..4334772a4 --- /dev/null +++ b/docker/container-templates/iptv-org/docker-compose.yml @@ -0,0 +1,32 @@ +--- +services: + iptv-org-epg: + container_name: iptv-org-epg + image: ghcr.io/knylbyte/epg:latest + restart: unless-stopped + security_opt: + - apparmor=docker-default + networks: + - proxy-net + expose: + - 3000 + volumes: + - ./data:/epg/public + # If you want to use your own channel list instead of SITE, + # create a local ./channels.xml and activate the line below. + # - ./channels.xml:/epg/public/channels.xml:ro + environment: + TZ: Europe/Paris # time zone for correct scheduling + CRON_SCHEDULE: "0 0,12 * * *" # daily 12:00 a.m. + RUN_AT_STARTUP: true # execute once directly at startup + MAX_CONNECTIONS: 1 # performance/output options (supported by the grabber) + GZIP: false # additionally generate guide.xml.gz if "true" + DAYS: 7 # overwrite number of days + CURL: false # output requests as curl + TIMEOUT: 30000 # request-Timeout (ms) + FILL_GAPS: true # fill gaps in the EPG data + +networks: + proxy-net: + external: true + name: proxy-net diff --git a/docker/container-templates/traefik/config/dynamic/gluetun-proxys.yml b/docker/container-templates/traefik/config/dynamic/gluetun-proxys.yml index c4f5ba3ce..eb7e7dd6a 100644 --- a/docker/container-templates/traefik/config/dynamic/gluetun-proxys.yml +++ b/docker/container-templates/traefik/config/dynamic/gluetun-proxys.yml @@ -27,21 +27,21 @@ tcp: gluetun-http-proxy: loadBalancer: servers: - - address: "gluetun-01:1080" + - address: "gluetun:1080" # - address: "gluetun-02:1080" # optional second gluetun instance, but does not work right now because traefik does not support sticking of TCP connections -> https://traefik.io/glossary/what-are-sticky-sessions # - address: "gluetun-03:1080" # optional third gluetun instance, but does not work right now because traefik does not support sticking of TCP connections -> https://traefik.io/glossary/what-are-sticky-sessions socks5h-tcp: loadbalancer: servers: - - address: "gluetun-01:1388" + - address: "gluetun:1388" # - address: "gluetun-02:1388" # optional second gluetun instance, but does not work right now because traefik does not support sticking of TCP connections -> https://traefik.io/glossary/what-are-sticky-sessions # - address: "gluetun-03:1388" # optional third gluetun instance, but does not work right now because traefik does not support sticking of TCP connections -> https://traefik.io/glossary/what-are-sticky-sessions shadowsocks-tcp: loadBalancer: servers: - - address: "gluetun-01:9388" + - address: "gluetun:9388" # - address: "gluetun-02:9388" # optional second gluetun instance, but does not work right now because traefik does not support sticking of TCP connections -> https://traefik.io/glossary/what-are-sticky-sessions # - address: "gluetun-03:9388" # optional third gluetun instance, but does not work right now because traefik does not support sticking of TCP connections -> https://traefik.io/glossary/what-are-sticky-sessions @@ -59,13 +59,13 @@ udp: socks5h-udp: loadbalancer: servers: - - address: "gluetun-01:1388" + - address: "gluetun:1388" # - address: "gluetun-02:1388" # optional second gluetun instance, but does not work right now because traefik does not support sticking of TCP connections -> https://traefik.io/glossary/what-are-sticky-sessions # - address: "gluetun-03:1388" # optional third gluetun instance, but does not work right now because traefik does not support sticking of TCP connections -> https://traefik.io/glossary/what-are-sticky-sessions shadowsocks-udp: loadBalancer: servers: - - address: "gluetun-01:9388" + - address: "gluetun:9388" # - address: "gluetun-02:9388" # optional second gluetun instance, but does not work right now because traefik does not support sticking of TCP connections -> https://traefik.io/glossary/what-are-sticky-sessions # - address: "gluetun-03:9388" # optional third gluetun instance, but does not work right now because traefik does not support sticking of TCP connections -> https://traefik.io/glossary/what-are-sticky-sessions diff --git a/docker/container-templates/traefik/config/traefik.yml b/docker/container-templates/traefik/config/traefik.yml index e03dee721..5c067cc13 100644 --- a/docker/container-templates/traefik/config/traefik.yml +++ b/docker/container-templates/traefik/config/traefik.yml @@ -1,3 +1,4 @@ +--- api: dashboard: true debug: false diff --git a/docker/container-templates/traefik/docker-compose.yml b/docker/container-templates/traefik/docker-compose.yml index 8933cb935..f66954ac1 100644 --- a/docker/container-templates/traefik/docker-compose.yml +++ b/docker/container-templates/traefik/docker-compose.yml @@ -5,7 +5,7 @@ services: traefik: image: traefik:latest container_name: traefik - restart: on-failure + restart: unless-stopped security_opt: - apparmor=docker-default # security_opts are optional secrets: diff --git a/docker/container-templates/tuliprox/docker-compose.yml b/docker/container-templates/tuliprox/docker-compose.yml index 59fdfaea3..a6bb6c58c 100644 --- a/docker/container-templates/tuliprox/docker-compose.yml +++ b/docker/container-templates/tuliprox/docker-compose.yml @@ -2,7 +2,7 @@ services: tuliprox: container_name: tuliprox image: ghcr.io/euzu/tuliprox:latest - restart: on-failure + restart: unless-stopped networks: - proxy-net expose: diff --git a/docs/src/build-and-deploy.md b/docs/src/build-and-deploy.md index 0fcaa72fa..ddc6b352e 100644 --- a/docs/src/build-and-deploy.md +++ b/docs/src/build-and-deploy.md @@ -325,7 +325,7 @@ and CrowdSec protection. 2. **Gluetun (VPN & Proxy Sidecar):** - Provide your Wireguard details in `gluetun-01/.env.wg-01` and set a user/pass in `.env.socks5-proxy`. Once started ( + Provide your Wireguard details in `gluetun/.env.wg` and set a user/pass in `gluetun/.env.socks5-proxy`. Once started ( `docker-compose up -d`), it securely routes all traffic attached to its network through the VPN. @@ -335,7 +335,7 @@ and CrowdSec protection. ```yaml proxy: - url: socks5://socks5-01:1388 + url: socks5://gluetun:1388 username: "" password: "" ``` diff --git a/docs/src/docker/container-templates/crowdsec/crowdsec/config/parsers/s02-enrich/tuliprox-cover-whitelist.yaml b/docs/src/docker/container-templates/crowdsec/crowdsec/config/parsers/s02-enrich/tuliprox-cover-whitelist.yaml new file mode 100644 index 000000000..9a2cad4fe --- /dev/null +++ b/docs/src/docker/container-templates/crowdsec/crowdsec/config/parsers/s02-enrich/tuliprox-cover-whitelist.yaml @@ -0,0 +1,12 @@ +--- +name: local/tuliprox-cover-parser-whitelist +description: Ignore expected Tuliprox Xtream image fetches before scenarios +filter: 'evt.Meta.log_type == "http_access-log"' +whitelist: + reason: "Ignore expected Tuliprox 4xx/5xx Xtream image GETs" + expression: + - > + evt.Meta.traefik_router_name in ["tuliprox@docker", "tuliprox-secure@docker"] && + evt.Meta.http_verb == "GET" && + evt.Meta.http_status matches "^[45][0-9][0-9]$" && + evt.Meta.http_path matches "^(/[^/?#]+)*/resource/(live/[^/]+/[^/]+/[0-9]+/(logo|logo_small)|movie/[^/]+/[^/]+/[0-9]+/(logo|logo_small|nfo_cover_big|nfo_movie_image|nfo_backdrop_path_[0-9]+)|series/[^/]+/[^/]+/[0-9]+/(logo|logo_small|cover|backdrop_path_[0-9]+|nfo_s_[0-9]+_(cover|cover_tmdb|cover_big)|nfo_ep_[0-9]+_[0-9]+_movie_image))$" diff --git a/docs/src/examples-recipes.md b/docs/src/examples-recipes.md index 7e7f81ab5..8dd24a201 100644 --- a/docs/src/examples-recipes.md +++ b/docs/src/examples-recipes.md @@ -212,13 +212,15 @@ In the repository under `docker/container-templates/`, you will find ready-to-us ### Components of the Stack -1. **Traefik (Reverse Proxy):** Handles incoming port 443 traffic, auto-renews Let's Encrypt certificates (via Cloudflare DNS-01 challenge), and +1. **Traefik (Reverse Proxy Ingress):** Handles incoming port 443 traffic, auto-renews Let's Encrypt certificates (via Cloudflare DNS-01 challenge), and applies strict Content-Security-Policy headers. -2. **Gluetun (VPN Egress):** A WireGuard/OpenVPN client container. It connects to Mullvad/ProtonVPN. We attach a **Socks5 Sidecar** to its network - namespace. Tuliprox can then be configured to route its upstream provider requests through this Socks5 proxy, completely hiding your server's IP +2. **Gluetun (VPN Egress):** A WireGuard/OpenVPN client container. It connects e.g. to Mullvad or Proton VPN. + Tuliprox can then be configured to route its upstream provider requests through this Socks5 proxy, completely hiding your server's IP from the IPTV provider. 3. **CrowdSec (WAF & Bouncer):** Analyzes Traefik access logs in real-time. If someone tries to brute-force your Tuliprox Web UI or run path-traversal attacks, CrowdSec instructs the Traefik Bouncer plugin to drop their IP at the edge. +4. **IPTV-org-epg (EPG guide):** Generates a local XMLTV guide for the selected channels and makes it available to + Tuliprox. ### How to wire it up @@ -230,7 +232,7 @@ docker network create crowdsec-net ``` **2. Configure Gluetun & Socks5:** -In `container-templates/gluetun/gluetun-01/.env.wg-01`, add your Wireguard details. +In `container-templates/gluetun/.env.wg`, add your Wireguard details. In `container-templates/gluetun/.env.socks5-proxy`, set user/pass for the proxy. Start it: `docker-compose up -d`. It exposes port 1388 internally. @@ -239,7 +241,7 @@ In your `config.yml`, point the global proxy setting to the Socks5 container: ```yaml proxy: - url: socks5://socks5-01:1388 + url: socks5://gluetun:1388 username: "" password: "" ``` @@ -263,3 +265,23 @@ In your Tuliprox `docker-compose.yml`, add the Traefik labels to route traffic s This architecture ensures your IPTV provider only sees the VPN IP, your clients only see your secure `tv.yourdomain.com` domain, and malicious bots are blocked instantly by CrowdSec before they even reach the Rust backend. + +>**⚠️ Important:** make sure you add +>[tuliprox-cover-whitelist.yaml](../../docker/container-templates/crowdsec/crowdsec/config/parsers/s02-enrich/tuliprox-cover-whitelist.yaml) +> to `crowdsec/config/parsers/s02-enrich/tuliprox-cover-whitelist.yaml` in your Crowdsec instance. +> Otherwise, you could quickly end up banning yourself. + +**5. Configure IPTV-org-epg:** +Copy the desired channel entries from the IPTV-org `sites` files to +`container-templates/iptv-org/data/channels.xml`. For every channel, `xmltv_id` must exactly match the +corresponding `@epg_channel_id` in Tuliprox. For example, `xmltv_id="BBCOne.uk@LondonHD"` matches +`@epg_channel_id = "BBCOne.uk@LondonHD"`. If necessary, adjust `xmltv_id` in `channels.xml` or set the corresponding +`@epg_channel_id` in `mapping.yml`. + +Start it: `docker-compose up -d`. Add the generated guide to the corresponding input in your `source.yml`: + +```yaml +epg: + sources: + - url: http://iptv-org-epg:3000/guide.xml +```