diff options
| -rw-r--r-- | CLAUDE.md | 21 | ||||
| -rw-r--r-- | caddy/Caddyfile | 7 | ||||
| -rwxr-xr-x | git/hooks/hetzner-infra/post-receive | 1 | ||||
| -rw-r--r-- | proxy/Dockerfile | 6 | ||||
| -rw-r--r-- | proxy/deploy.sh | 10 | ||||
| -rw-r--r-- | proxy/docker-compose.yml | 9 | ||||
| -rw-r--r-- | proxy/entrypoint.sh | 13 | ||||
| -rw-r--r-- | proxy/install.sh | 12 | ||||
| -rw-r--r-- | proxy/renew-cert.sh | 22 | ||||
| -rw-r--r-- | proxy/squid.conf | 21 |
10 files changed, 121 insertions, 1 deletions
@@ -12,12 +12,13 @@ claude/ Claude Code セッション管理（sessions.txt, systemd unit, hetzner-admin/ サーバー管理 Web UI（app.py, Dockerfile, docker-compose.yml, deploy.sh） mail/ MTA（Postfix + OpenDKIM, docker-compose.yml, install.sh, dns/setup-route53.py） vpn/ strongSwan IKEv2 VPN（Dockerfile, docker-compose.yml, install.sh, renew-cert.sh） +proxy/ HTTPS フォワードプロキシ（Squid, Dockerfile, docker-compose.yml, install.sh, renew-cert.sh） server/ サーバー共通設定（authorized_keys, requirements.md） ``` ## デプロイの仕組み -- `git push origin master` → post-receive フック → `caddy/deploy.sh` / `cgit/deploy.sh` / `mail/deploy.sh` / `hetzner-admin/deploy.sh` / `vpn/deploy.sh` を実行 +- `git push origin master` → post-receive フック → `caddy/deploy.sh` / `cgit/deploy.sh` / `mail/deploy.sh` / `hetzner-admin/deploy.sh` / `vpn/deploy.sh` / `proxy/deploy.sh` を実行 - cgit の `lighttpd.conf` / `Dockerfile` 変更はイメージ再ビルドが必要（`deploy.sh` で `--build` するため push だけで反映される） - cgit の `cgitrc` はボリュームマウントのため push だけで反映される - フック・リポジトリの変更は push 後に `bash /app/infra/git/install.sh` を手動実行 @@ -108,6 +109,18 @@ ssh root@<server> 'bash /app/infra/vpn/renew-cert.sh' ssh root@<server> vi /app/infra/vpn/users.conf # 1行1ユーザー: "username password" docker compose -f /app/infra/vpn/docker-compose.yml restart + +# Proxy 初回セットアップ（サーバー上で実行） +# 前提: ファイアウォールで TCP 8443 を開放済み、DNS A レコードで proxy.yyamashita.com を設定済み +git push origin master +ssh root@<server> 'bash /app/infra/git/install.sh' # post-receive フック更新 +# → Caddy が proxy.yyamashita.com の証明書を取得するまで数分待つ +ssh root@<server> 'bash /app/infra/proxy/install.sh' +# → Caddy の証明書を流用 + コンテナ起動 +# → proxy.yyamashita.com:8443 (HTTPS) で接続可能 + +# Proxy 証明書更新（Let's Encrypt 更新後 90 日ごと） +ssh root@<server> 'bash /app/infra/proxy/renew-cert.sh' ``` ## VPN クライアント設定 @@ -126,3 +139,9 @@ docker compose -f /app/infra/vpn/docker-compose.yml restart - タイプ: IKEv2 EAP (Username/Password) - サーバー: `vpn.yyamashita.com` - ユーザー名・パスワード: `users.conf` の内容 + +## Proxy クライアント設定 + +- アドレス: `proxy.yyamashita.com:8443` +- プロトコル: HTTPS (CONNECT トンネリング) +- 認証: Basic 認証（VPN と同じユーザー名/パスワード） diff --git a/caddy/Caddyfile b/caddy/Caddyfile index 952d039..5ab87a7 100644 --- a/caddy/Caddyfile +++ b/caddy/Caddyfile @@ -41,6 +41,13 @@ blog.yyamashita.com { reverse_proxy microblog-app:3000 } +proxy.yyamashita.com { + tls { + key_type rsa4096 + } + respond "Proxy Server" 200 +} + vpn.yyamashita.com { tls { key_type rsa4096 diff --git a/git/hooks/hetzner-infra/post-receive b/git/hooks/hetzner-infra/post-receive index 6eeff49..dbb450d 100755 --- a/git/hooks/hetzner-infra/post-receive +++ b/git/hooks/hetzner-infra/post-receive @@ -6,4 +6,5 @@ bash /app/infra/cgit/deploy.sh bash /app/infra/mail/deploy.sh bash /app/infra/hetzner-admin/deploy.sh bash /app/infra/vpn/deploy.sh +bash /app/infra/proxy/deploy.sh echo "Deploy complete: hetzner-infra" diff --git a/proxy/Dockerfile b/proxy/Dockerfile new file mode 100644 index 0000000..f11141b --- /dev/null +++ b/proxy/Dockerfile @@ -0,0 +1,6 @@ +FROM alpine:3.21 +RUN apk add --no-cache squid openssl +COPY squid.conf /etc/squid/squid.conf +COPY entrypoint.sh /entrypoint.sh +RUN chmod +x /entrypoint.sh +ENTRYPOINT ["/entrypoint.sh"] diff --git a/proxy/deploy.sh b/proxy/deploy.sh new file mode 100644 index 0000000..3f5c6ba --- /dev/null +++ b/proxy/deploy.sh @@ -0,0 +1,10 @@ +#!/usr/bin/env bash +set -euo pipefail +cd "$(dirname "$0")" + +if [ ! -f certs/server.crt ]; then + echo "Proxy: 未初期化のためスキップ (install.sh を実行してください)" + exit 0 +fi + +docker compose up -d --build diff --git a/proxy/docker-compose.yml b/proxy/docker-compose.yml new file mode 100644 index 0000000..81a7fa6 --- /dev/null +++ b/proxy/docker-compose.yml @@ -0,0 +1,9 @@ +services: + proxy: + build: . + restart: unless-stopped + network_mode: host + volumes: + - ./certs/server.crt:/etc/squid/certs/server.crt:ro + - ./certs/server.key:/etc/squid/certs/server.key:ro + - /app/infra/vpn/users.conf:/etc/proxy/users.conf:ro diff --git a/proxy/entrypoint.sh b/proxy/entrypoint.sh new file mode 100644 index 0000000..b7cc6e2 --- /dev/null +++ b/proxy/entrypoint.sh @@ -0,0 +1,13 @@ +#!/bin/sh +set -e + +# VPN と共有の users.conf から basic auth passwd ファイルを生成 +> /etc/squid/passwd +while IFS=' ' read -r user pass || [ -n "$user" ]; do + [ -z "$user" ] && continue + case "$user" in \#*) continue ;; esac + echo "${user}:$(openssl passwd -apr1 "$pass")" >> /etc/squid/passwd +done < /etc/proxy/users.conf +chmod 600 /etc/squid/passwd + +exec squid -N -f /etc/squid/squid.conf diff --git a/proxy/install.sh b/proxy/install.sh new file mode 100644 index 0000000..58a8e53 --- /dev/null +++ b/proxy/install.sh @@ -0,0 +1,12 @@ +#!/usr/bin/env bash +set -euo pipefail +cd "$(dirname "$0")" + +echo "=== Proxy Install: proxy.yyamashita.com ===" +bash "$(pwd)/renew-cert.sh" + +echo "" +echo "=== Proxy 起動完了 ===" +echo " アドレス: https://proxy.yyamashita.com:8443" +echo " 認証: VPN と同じユーザー名/パスワード (Basic 認証)" +echo " 証明書の更新: bash /app/infra/proxy/renew-cert.sh" diff --git a/proxy/renew-cert.sh b/proxy/renew-cert.sh new file mode 100644 index 0000000..8924d9b --- /dev/null +++ b/proxy/renew-cert.sh @@ -0,0 +1,22 @@ +#!/usr/bin/env bash +set -euo pipefail +cd "$(dirname "$0")" + +DOMAIN="proxy.yyamashita.com" +CADDY_DIR="/app/infra/caddy" +CADDY_CERT_BASE="/data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${DOMAIN}/${DOMAIN}" + +echo "証明書を更新中..." +mkdir -p certs + +if ! docker compose -f "$CADDY_DIR/docker-compose.yml" exec -T caddy \ + cat "${CADDY_CERT_BASE}.crt" > certs/server.crt; then + echo "Error: 証明書の取得に失敗しました。Caddyfile に ${DOMAIN} が設定されているか確認してください。" + exit 1 +fi +docker compose -f "$CADDY_DIR/docker-compose.yml" exec -T caddy \ + cat "${CADDY_CERT_BASE}.key" > certs/server.key +chmod 600 certs/server.key + +echo "証明書を更新しました。" +bash "$(pwd)/deploy.sh" diff --git a/proxy/squid.conf b/proxy/squid.conf new file mode 100644 index 0000000..29ebd05 --- /dev/null +++ b/proxy/squid.conf @@ -0,0 +1,21 @@ +https_port 8443 cert=/etc/squid/certs/server.crt key=/etc/squid/certs/server.key + +auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd +auth_param basic realm "Proxy" +auth_param basic credentialsttl 2 hours + +acl authenticated proxy_auth REQUIRED +http_access allow authenticated +http_access deny all + +forwarded_for delete +via off + +dns_nameservers 1.1.1.1 8.8.8.8 + +cache_dir null /tmp +cache deny all +access_log stdio:/dev/stdout +cache_log stdio:/dev/stderr +cache_store_log none +coredump_dir /tmp |