From e9797d2130f8230d9e22180ce522c2012277ee63 Mon Sep 17 00:00:00 2001 From: paul Date: Mon, 9 Dec 2024 17:06:03 +0100 Subject: [PATCH] feat: add Gitea private secure template and Passbolt template --- public/svgs/passbolt.svg | 1 + templates/compose/gitea-private-secure.yaml | 74 +++++++++++++++++++++ templates/compose/passbolt.yaml | 58 ++++++++++++++++ templates/service-templates.json | 28 ++++++++ 4 files changed, 161 insertions(+) create mode 100644 public/svgs/passbolt.svg create mode 100644 templates/compose/gitea-private-secure.yaml create mode 100644 templates/compose/passbolt.yaml diff --git a/public/svgs/passbolt.svg b/public/svgs/passbolt.svg new file mode 100644 index 000000000..02abdd425 --- /dev/null +++ b/public/svgs/passbolt.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/templates/compose/gitea-private-secure.yaml b/templates/compose/gitea-private-secure.yaml new file mode 100644 index 000000000..80a4464ed --- /dev/null +++ b/templates/compose/gitea-private-secure.yaml @@ -0,0 +1,74 @@ +# documentation: https://docs.gitea.com +# slogan: Gitea is a self-hosted, lightweight Git service, offering version control, collaboration, and code hosting. +# tags: version control, collaboration, code, hosting, lightweight +# logo: svgs/gitea.svg + +services: + gitea: + image: 'gitea/gitea:latest' + environment: + - SERVICE_FQDN_GITEA_3000 + - USER_UID=1000 + - USER_GID=1000 + # Domain configuration + - GITEA__server__ROOT_URL=${GITEA_SERVER_ROOT_URL} + - GITEA__server__DOMAIN=${GITEA_SERVER_DOMAIN} + # Basic Security + - GITEA__service__REQUIRE_SIGNIN_VIEW=${GITEA_SERVICE_REQUIRE_SIGNIN_VIEW:true} + - GITEA__service__REGISTER_MANUAL_CONFIRM=${GITEA_SERVICE_REGISTER_MANUAL_CONFIRM:true} + - GITEA__service__REGISTER_EMAIL_CONFIRM=${GITEA_SERVICE_REGISTER_EMAIL_CONFIRM:false} + - GITEA__service__ENABLE_NOTIFY_MAIL=${GITEA_SERVICE_ENABLE_NOTIFY_MAIL:true} + - GITEA__service__DEFAULT_ALLOW_CREATE_ORGANIZATION=${GITEA_SERVICE_DEFAULT_ALLOW_CREATE_ORGANIZATION:false} + - GITEA__service__DEFAULT_USER_IS_RESTRICTED=${GITEA_SERVICE_DEFAULT_USER_IS_RESTRICTED:true} + - GITEA__service__DEFAULT_USER_VISIBILITY=${GITEA_SERVICE_DEFAULT_USER_VISIBILITY:private} + + # Additional Security + - GITEA__security__INSTALL_LOCK=true # Lock the installation to prevent unauthorized access + - GITEA__security__MIN_PASSWORD_LENGTH=12 # Minimum password length + - GITEA__security__PASSWORD_COMPLEXITY=off # Disable password complexity checks + - GITEA__security__PASSWORD_CHECK_PWN=true # Check if the password has been leaked + - GITEA__security__DISABLE_GIT_HOOKS=true # Disable Git hooks to prevent code execution + - GITEA__security__ONLY_ALLOW_PUSH_IF_GITEA_ENVIRONMENT_SET=true + + # Brute Force Protection + - GITEA__security__LOGIN_REMEMBER_DAYS=7 + - GITEA__security__MAX_FAILED_LOGIN_ATTEMPTS=5 + - GITEA__security__BLOCK_LOGIN_FAILURES_THRESHOLD=true # Block login attempts after reaching the threshold + - GITEA__security__BLOCK_LOGIN_FAILURES_DURATION=15m # Block login attempts for 15 minutes after reaching the threshold + + # Session Security + - GITEA__session__PROVIDER=file # Use file-based session provider + - GITEA__session__SAME_SITE=strict # Set SameSite attribute to strict to prevent cross-site request forgery + - GITEA__session__COOKIE_SECURE=true # Ensure cookies are only sent over HTTPS + + # API Protection + - GITEA__api__ENABLE_SWAGGER=false # Disable Swagger API documentation to prevent leaking information + - GITEA__api__MAX_RESPONSE_ITEMS=50 # Limit the number of items returned in API responses + + # Other Restrictions + - GITEA__repository__DEFAULT_PRIVATE=true # Default repository visibility to private + - GITEA__repository__DEFAULT_BRANCH=main # Default branch for new repositories + - GITEA__repository__DISABLE_HTTP_GIT=false + - GITEA__repository__USE_COMPAT_SSH_URI=true # Use compatible SSH URI format + + # Attack Protection + - GITEA__other__SHOW_FOOTER_VERSION=false # Hide version information in footer + - GITEA__other__SHOW_FOOTER_TEMPLATE_LOAD_TIME=false # Hide template load time in footer + + ports: + - '22222:22' + volumes: + - 'gitea-data:/data' + - 'gitea-timezone:/etc/timezone:ro' + - 'gitea-localtime:/etc/localtime:ro' + healthcheck: + test: + - CMD + - curl + - '-f' + - 'http://127.0.0.1:3000' + interval: 2s + timeout: 10s + retries: 15 + security_opt: + - no-new-privileges:true \ No newline at end of file diff --git a/templates/compose/passbolt.yaml b/templates/compose/passbolt.yaml new file mode 100644 index 000000000..45fec7656 --- /dev/null +++ b/templates/compose/passbolt.yaml @@ -0,0 +1,58 @@ +# documentation: https://help.passbolt.com/hosting/install/ce/docker?utm_source=coolify.io +# slogan: Open source password manager for teams. +# tags: "password manager", "security", "open source", "team" +# logo: svgs/passbolt.svg +# port: 80 + +services: + passbolt: + image: 'passbolt/passbolt:latest-ce' + environment: + - SERVICE_FQDN_PASSBOLT_80 + - 'APP_FULL_BASE_URL=${APP_FULL_BASE_URL}' + - + DATASOURCES_DEFAULT_HOST: passbolt-db + - + DATASOURCES_DEFAULT_USERNAME: '${SERVICE_USER_MYSQL}' + - + DATASOURCES_DEFAULT_PASSWORD: '${SERVICE_PASSWORD_MYSQL}' + - + DATASOURCES_DEFAULT_DATABASE: '${MYSQL_DATABASE:-passbolt}' + - 'TZ=${TZ:-Europe/Paris}' + volumes: + - 'passbolt-gpg:/etc/passbolt/gpg' + - 'passbolt-jwt:/etc/passbolt/jwt' + depends_on: + passbolt-db: + condition: service_healthy + healthcheck: + test: + - CMD + - curl + - '-f' + - 'http://127.0.0.1:80' + interval: 2s + timeout: 10s + retries: 15 + command: + - /usr/bin/wait-for.sh + - '-t' + - '0' + - 'passbolt-db:3306' + - '--' + - /docker-entrypoint.sh + + passbolt-db: + image: mariadb:10.11 + volumes: + - passbolt-mysql-data:/var/lib/mysql + environment: + - MYSQL_ROOT_PASSWORD=${SERVICE_PASSWORD_ROOT} + - MYSQL_DATABASE=${MYSQL_DATABASE:-passbolt} + - MYSQL_USER=${SERVICE_USER_MYSQL} + - MYSQL_PASSWORD=${SERVICE_PASSWORD_MYSQL} + healthcheck: + test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${SERVICE_PASSWORD_ROOT}"] + interval: 5s + timeout: 20s + retries: 10 diff --git a/templates/service-templates.json b/templates/service-templates.json index 2e1e3bbf9..52fd4d895 100644 --- a/templates/service-templates.json +++ b/templates/service-templates.json @@ -1001,6 +1001,20 @@ "logo": "svgs/gitea.svg", "minversion": "0.0.0" }, + "gitea-private-secure": { + "documentation": "https://docs.gitea.com?utm_source=coolify.io", + "slogan": "Gitea is a self-hosted, lightweight Git service, offering version control, collaboration, and code hosting.", + "compose": "c2VydmljZXM6CiAgZ2l0ZWE6CiAgICBpbWFnZTogJ2dpdGVhL2dpdGVhOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9HSVRFQV8zMDAwCiAgICAgIC0gVVNFUl9VSUQ9MTAwMAogICAgICAtIFVTRVJfR0lEPTEwMDAKICAgICAgIyBEb21haW4gY29uZmlndXJhdGlvbgogICAgICAtIEdJVEVBX19zZXJ2ZXJfX1JPT1RfVVJMPSR7R0lURUFfU0VSVkVSX1JPT1RfVVJMfQogICAgICAtIEdJVEVBX19zZXJ2ZXJfX0RPTUFJTj0ke0dJVEVBX1NFUlZFUl9ET01BSU59CiAgICAgICMgQmFzaWMgU2VjdXJpdHkKICAgICAgLSBHSVRFQV9fc2VydmljZV9fUkVRVUlSRV9TSUdOSU5fVklFVz0ke0dJVEVBX1NFUlZJQ0VfUkVRVUlSRV9TSUdOSU5fVklFVzp0cnVlfQogICAgICAtIEdJVEVBX19zZXJ2aWNlX19SRUdJU1RFUl9NQU5VQUxfQ09ORklSTT0ke0dJVEVBX1NFUlZJQ0VfUkVHSVNURVJfTUFOVUFMX0NPTkZJUk06dHJ1ZX0KICAgICAgLSBHSVRFQV9fc2VydmljZV9fUkVHSVNURVJfRU1BSUxfQ09ORklSTT0ke0dJVEVBX1NFUlZJQ0VfUkVHSVNURVJfRU1BSUxfQ09ORklSTTpmYWxzZX0KICAgICAgLSBHSVRFQV9fc2VydmljZV9fRU5BQkxFX05PVElGWV9NQUlMPSR7R0lURUFfU0VSVklDRV9FTkFCTEVfTk9USUZZX01BSUw6dHJ1ZX0KICAgICAgLSBHSVRFQV9fc2VydmljZV9fREVGQVVMVF9BTExPV19DUkVBVEVfT1JHQU5JWkFUSU9OPSR7R0lURUFfU0VSVklDRV9ERUZBVUxUX0FMTE9XX0NSRUFURV9PUkdBTklaQVRJT046ZmFsc2V9CiAgICAgIC0gR0lURUFfX3NlcnZpY2VfX0RFRkFVTFRfVVNFUl9JU19SRVNUUklDVEVEPSR7R0lURUFfU0VSVklDRV9ERUZBVUxUX1VTRVJfSVNfUkVTVFJJQ1RFRDp0cnVlfQogICAgICAtIEdJVEVBX19zZXJ2aWNlX19ERUZBVUxUX1VTRVJfVklTSUJJTElUWT0ke0dJVEVBX1NFUlZJQ0VfREVGQVVMVF9VU0VSX1ZJU0lCSUxJVFk6cHJpdmF0ZX0KICAgICAgCiAgICAgICMgQWRkaXRpb25hbCBTZWN1cml0eQogICAgICAtIEdJVEVBX19zZWN1cml0eV9fSU5TVEFMTF9MT0NLPXRydWUgIyBMb2NrIHRoZSBpbnN0YWxsYXRpb24gdG8gcHJldmVudCB1bmF1dGhvcml6ZWQgYWNjZXNzCiAgICAgIC0gR0lURUFfX3NlY3VyaXR5X19NSU5fUEFTU1dPUkRfTEVOR1RIPTEyICMgTWluaW11bSBwYXNzd29yZCBsZW5ndGgKICAgICAgLSBHSVRFQV9fc2VjdXJpdHlfX1BBU1NXT1JEX0NPTVBMRVhJVFk9b2ZmICMgRGlzYWJsZSBwYXNzd29yZCBjb21wbGV4aXR5IGNoZWNrcwogICAgICAtIEdJVEVBX19zZWN1cml0eV9fUEFTU1dPUkRfQ0hFQ0tfUFdOPXRydWUgIyBDaGVjayBpZiB0aGUgcGFzc3dvcmQgaGFzIGJlZW4gbGVha2VkCiAgICAgIC0gR0lURUFfX3NlY3VyaXR5X19ESVNBQkxFX0dJVF9IT09LUz10cnVlICMgRGlzYWJsZSBHaXQgaG9va3MgdG8gcHJldmVudCBjb2RlIGV4ZWN1dGlvbgogICAgICAtIEdJVEVBX19zZWN1cml0eV9fT05MWV9BTExPV19QVVNIX0lGX0dJVEVBX0VOVklST05NRU5UX1NFVD10cnVlCiAgICAgIAogICAgICAjIEJydXRlIEZvcmNlIFByb3RlY3Rpb24KICAgICAgLSBHSVRFQV9fc2VjdXJpdHlfX0xPR0lOX1JFTUVNQkVSX0RBWVM9NwogICAgICAtIEdJVEVBX19zZWN1cml0eV9fTUFYX0ZBSUxFRF9MT0dJTl9BVFRFTVBUUz01CiAgICAgIC0gR0lURUFfX3NlY3VyaXR5X19CTE9DS19MT0dJTl9GQUlMVVJFU19USFJFU0hPTEQ9dHJ1ZSAjIEJsb2NrIGxvZ2luIGF0dGVtcHRzIGFmdGVyIHJlYWNoaW5nIHRoZSB0aHJlc2hvbGQKICAgICAgLSBHSVRFQV9fc2VjdXJpdHlfX0JMT0NLX0xPR0lOX0ZBSUxVUkVTX0RVUkFUSU9OPTE1bSAjIEJsb2NrIGxvZ2luIGF0dGVtcHRzIGZvciAxNSBtaW51dGVzIGFmdGVyIHJlYWNoaW5nIHRoZSB0aHJlc2hvbGQKICAgICAgCiAgICAgICMgU2Vzc2lvbiBTZWN1cml0eQogICAgICAtIEdJVEVBX19zZXNzaW9uX19QUk9WSURFUj1maWxlICMgVXNlIGZpbGUtYmFzZWQgc2Vzc2lvbiBwcm92aWRlciAKICAgICAgLSBHSVRFQV9fc2Vzc2lvbl9fU0FNRV9TSVRFPXN0cmljdCAjIFNldCBTYW1lU2l0ZSBhdHRyaWJ1dGUgdG8gc3RyaWN0IHRvIHByZXZlbnQgY3Jvc3Mtc2l0ZSByZXF1ZXN0IGZvcmdlcnkKICAgICAgLSBHSVRFQV9fc2Vzc2lvbl9fQ09PS0lFX1NFQ1VSRT10cnVlICMgRW5zdXJlIGNvb2tpZXMgYXJlIG9ubHkgc2VudCBvdmVyIEhUVFBTCiAgICAgIAogICAgICAjIEFQSSBQcm90ZWN0aW9uCiAgICAgIC0gR0lURUFfX2FwaV9fRU5BQkxFX1NXQUdHRVI9ZmFsc2UgIyBEaXNhYmxlIFN3YWdnZXIgQVBJIGRvY3VtZW50YXRpb24gdG8gcHJldmVudCBsZWFraW5nIGluZm9ybWF0aW9uCiAgICAgIC0gR0lURUFfX2FwaV9fTUFYX1JFU1BPTlNFX0lURU1TPTUwICMgTGltaXQgdGhlIG51bWJlciBvZiBpdGVtcyByZXR1cm5lZCBpbiBBUEkgcmVzcG9uc2VzCiAgICAgIAogICAgICAjIE90aGVyIFJlc3RyaWN0aW9ucwogICAgICAtIEdJVEVBX19yZXBvc2l0b3J5X19ERUZBVUxUX1BSSVZBVEU9dHJ1ZSAjIERlZmF1bHQgcmVwb3NpdG9yeSB2aXNpYmlsaXR5IHRvIHByaXZhdGUgIAogICAgICAtIEdJVEVBX19yZXBvc2l0b3J5X19ERUZBVUxUX0JSQU5DSD1tYWluICMgRGVmYXVsdCBicmFuY2ggZm9yIG5ldyByZXBvc2l0b3JpZXMKICAgICAgLSBHSVRFQV9fcmVwb3NpdG9yeV9fRElTQUJMRV9IVFRQX0dJVD1mYWxzZQogICAgICAtIEdJVEVBX19yZXBvc2l0b3J5X19VU0VfQ09NUEFUX1NTSF9VUkk9dHJ1ZSAjIFVzZSBjb21wYXRpYmxlIFNTSCBVUkkgZm9ybWF0CiAgICAgIAogICAgICAjIEF0dGFjayBQcm90ZWN0aW9uCiAgICAgIC0gR0lURUFfX290aGVyX19TSE9XX0ZPT1RFUl9WRVJTSU9OPWZhbHNlICMgSGlkZSB2ZXJzaW9uIGluZm9ybWF0aW9uIGluIGZvb3RlcgogICAgICAtIEdJVEVBX19vdGhlcl9fU0hPV19GT09URVJfVEVNUExBVEVfTE9BRF9USU1FPWZhbHNlICMgSGlkZSB0ZW1wbGF0ZSBsb2FkIHRpbWUgaW4gZm9vdGVyCiAgICAgIAogICAgcG9ydHM6CiAgICAgIC0gJzIyMjIyOjIyJwogICAgdm9sdW1lczoKICAgICAgLSAnZ2l0ZWEtZGF0YTovZGF0YScKICAgICAgLSAnZ2l0ZWEtdGltZXpvbmU6L2V0Yy90aW1lem9uZTpybycKICAgICAgLSAnZ2l0ZWEtbG9jYWx0aW1lOi9ldGMvbG9jYWx0aW1lOnJvJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjMwMDAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICAgIHNlY3VyaXR5X29wdDoKICAgICAgLSBuby1uZXctcHJpdmlsZWdlczp0cnVl", + "tags": [ + "version control", + "collaboration", + "code", + "private hosting", + "lightweight" + ], + "logo": "svgs/gitea.svg", + "minversion": "0.0.0" + }, "gitlab": { "documentation": "https://docs.gitlab.com/ee/install/docker.html?utm_source=coolify.io", "slogan": "The all-in-one DevOps platform for seamless collaboration and continuous delivery.", @@ -2125,6 +2139,20 @@ "minversion": "0.0.0", "port": "8000" }, + "passbolt": { + "documentation": "https://help.passbolt.com/hosting/install/ce/docker?utm_source=coolify.io", + "slogan": "Open source password manager for teams.", + "compose": "c2VydmljZXM6CiAgcGFzc2JvbHQ6CiAgICBpbWFnZTogJ3Bhc3Nib2x0L3Bhc3Nib2x0OmxhdGVzdC1jZScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9QQVNTQk9MVF84MAogICAgICAtICdBUFBfRlVMTF9CQVNFX1VSTD0ke0FQUF9GVUxMX0JBU0VfVVJMfScKICAgICAgLQogICAgICAgIERBVEFTT1VSQ0VTX0RFRkFVTFRfSE9TVDogcGFzc2JvbHQtZGIKICAgICAgLQogICAgICAgIERBVEFTT1VSQ0VTX0RFRkFVTFRfVVNFUk5BTUU6ICcke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0KICAgICAgICBEQVRBU09VUkNFU19ERUZBVUxUX1BBU1NXT1JEOiAnJHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgLQogICAgICAgIERBVEFTT1VSQ0VTX0RFRkFVTFRfREFUQUJBU0U6ICcke01ZU1FMX0RBVEFCQVNFOi1wYXNzYm9sdH0nCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9QYXJpc30nCiAgICB2b2x1bWVzOgogICAgICAtICdwYXNzYm9sdC1ncGc6L2V0Yy9wYXNzYm9sdC9ncGcnCiAgICAgIC0gJ3Bhc3Nib2x0LWp3dDovZXRjL3Bhc3Nib2x0L2p3dCcKICAgIGRlcGVuZHNfb246CiAgICAgIHBhc3Nib2x0LWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICAgIGNvbW1hbmQ6CiAgICAgIC0gL3Vzci9iaW4vd2FpdC1mb3Iuc2gKICAgICAgLSAnLXQnCiAgICAgIC0gJzAnCiAgICAgIC0gJ3Bhc3Nib2x0LWRiOjMzMDYnCiAgICAgIC0gJy0tJwogICAgICAtIC9kb2NrZXItZW50cnlwb2ludC5zaAoKICBwYXNzYm9sdC1kYjoKICAgIGltYWdlOiBtYXJpYWRiOjEwLjExCiAgICB2b2x1bWVzOgogICAgICAtIHBhc3Nib2x0LW15c3FsLWRhdGE6L3Zhci9saWIvbXlzcWwKICAgIGVudmlyb25tZW50OgogICAgICAtIE1ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9CiAgICAgIC0gTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotcGFzc2JvbHR9CiAgICAgIC0gTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0KICAgICAgLSBNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDogWyJDTUQiLCAibXlzcWxhZG1pbiIsICJwaW5nIiwgIi1oIiwgImxvY2FsaG9zdCIsICItdSIsICJyb290IiwgIi1wJHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9Il0KICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=", + "tags": [ + "password manager", + "security", + "open source", + "team" + ], + "logo": "svgs/passbolt.svg", + "minversion": "0.0.0", + "port": "80" + }, "penpot": { "documentation": "https://help.penpot.app/technical-guide/getting-started/#install-with-docker?utm_source=coolify.io", "slogan": "Penpot is the first Open Source design and prototyping platform for product teams.",