sish. stack draft.

README.md

@@ -68,6 +68,7 @@ Not every stack is tested to fully work.
 | Radarr                  | ✅           | `linuxserver/radarr`                         | Movie downloader and manager.                               | [Website](https://radarr.video), [Github](https://github.com/Radarr/Radarr), [Wiki](https://wiki.servarr.com/radarr)                                                                                                        |
 | Redis                   | ✅           | `redis`                                      | Redis storage server.                                       | [Website](https://redis.io), [Github](https://github.com/redis/redis-io)                                                                                                                                                    |
 | Shadowsocks Client      | ✅           | `ghcr.io/shadowsocks/sslocal-rust:latest`    | Shadowsocks client (and SOCKS/HTTP/tunnel server).          | [Website](https://shadowsocks.org), [Github](https://github.com/shadowsocks/shadowsocks-rust), [Configuration](https://github.com/shadowsocks/shadowsocks-rust#getting-started)                                             |
+| Sish                    | ✅           | `antoniomika/sish`                           | Localhost tunneling solution over SSH                       | [Docs](https://docs.ssi.sh/getting-started), [Github](https://github.com/antoniomika/sish)                                                                                                                                  |
 | Shinobi                 | ✅           | `shinobisystems/shinobi`                     | Shinobi surveillance system                                 | [Website](https://shinobi.video), [Github](https://github.com/ShinobiCCTV/Shinobi)                                                                                                                                          |
 | Sonarr                  | ✅           | `linuxserver/sonarr`                         | TV Shows, series and anime downloader and manager.          | [Website](https://sonarr.tv), [Github](https://github.com/Sonarr/Sonarr), [Wiki](https://wiki.servarr.com/sonarr)                                                                                                           |
 | Speedtest               | ✅           | `adolfintel/speedtest`                       | Libre speed test implementation.                            | [Website](https://librespeed.org), [Github](https://github.com/librespeed/speedtest)                                                                                                                                        |

sish/.env.dist

@@ -0,0 +1,16 @@
+# see https://hub.docker.com/r/antoniomika/sish
+IMAGE_VERSION=latest
+
+HTTP_BIND_ADDR=127.0.0.1
+HTTP_BIND_PORT=8395
+
+SSH_BIND_ADDR=0.0.0.0
+SSH_BIND_PORT=2222
+
+PUBKEYS_PATH=./pubkeys
+
+BASE_DOMAIN=si.sh
+
+# Service settings
+LOG_MAX_SIZE=5m
+LOG_MAX_FILE=5

sish/docker-compose.yml

@@ -0,0 +1,28 @@
+# https://hub.docker.com/r/antoniomika/sish
+
+services:
+  sish:
+    image: 'antoniomika/sish:${IMAGE_VERSION:-latest}'
+    container_name: sish
+    depends_on:
+    volumes:
+      - '${PUBKEYS_PATH:-./pubkeys}:/pubkeys'
+    # see https://docs.ssi.sh/getting-started#docker
+    command: |
+      --ssh-address=${SSH_BIND_ADDR:-0.0.0.0}:${SSH_BIND_PORT:-2222}
+      --http-address=:${HTTP_BIND_PORT:-8395}
+      --authentication=true
+      --authentication-keys-directory=/pubkeys
+      --bind-random-ports=false
+      --bind-random-subdomains=false
+      --domain=${BASE_DOMAIN:-si.sh}
+    #network_mode: host
+    ports:
+      - '${SSH_BIND_ADDR:-0.0.0.0}:${SSH_BIND_PORT:-2222}:${SSH_BIND_PORT:-2222}'
+      - '${HTTP_BIND_ADDR:-127.0.0.1}:${HTTP_BIND_PORT:-8395}:${HTTP_BIND_PORT:-8395}'
+    restart: unless-stopped
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "${LOG_MAX_SIZE:-5m}"
+        max-file: "${LOG_MAX_FILE:-5}"

sish/nginx/sish.conf

@@ -0,0 +1,36 @@
+upstream sish {
+    server 127.0.0.1:8395;
+}
+
+server {
+    server_name *.sish.domain.tld;
+
+    location / {
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Server $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Port $server_port;
+
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "Upgrade";
+
+        proxy_read_timeout      60s;
+        proxy_send_timeout      60s;
+
+        client_max_body_size 512M;
+
+        proxy_pass http://sish;
+    }
+
+    #listen [::]:443 ssl http2 ipv6only=on;
+    listen 443 ssl http2;
+
+    include /etc/nginx/ssl/sish.domain.tld.conf;
+
+    error_log /var/log/nginx/sish.domain.tld_error.log;
+    access_log /var/log/nginx/sish.domain.tld.in_access.log;
+}