Web UI

Overview

Usage

The web UI has its own set of environment variables to configure it :

ADMIN_USERNAME and ADMIN_PASSWORD : credentials for accessing the web UI
ABSOLUTE_URI : the full public URI that points to the web UI
API_URI : path of the bunkerized-nginx API (must match the corresponding API_URI of the bunkerized-nginx instance)
DOCKER_HOST : Docker API endpoint address (default = unix:///var/run/docker.sock)

Since the web UI is a web service itself, we can use bunkerized-nginx as a reverse proxy in front of it.

Using the web UI in a Docker environment exposes a security risk because you need to mount the Docker API socket into the web UI container. It's highly recommended to use a middleware like tecnativa/docker-socket-proxy to reduce the risk as much as possible.

You need to apply the security best practices because the web UI contains code and that code might be vulnerable : complex admin password, hard to guess public URI, network isolation from others services, HTTPS only, ...

Docker

First of all, we will need to setup two networks one for ui communication and the other one for the services :

$ docker network create ui-net
$ docker network create services-net

We also need a volume to shared the generated configuration from the web UI to the bunkerized-nginx instances :

$ docker volume create bunkerized-vol

Next we will create the "Docker API proxy" container that will be in the front of the Docker socket and deny access to sensitive things :

$ docker run -d \
         --name my-docker-proxy \
         --network ui-net \
         -v /var/run/docker.sock:/var/run/docker.sock:ro \
         -e CONTAINERS=1 \
         -e SWARM=1 \
         -e SERVICES=1 \
         tecnativa/docker-socket-proxy

We can now create the web UI container based on bunkerized-nginx-ui image :

$ docker run -d \
         --name my-bunkerized-ui \
         --network ui-net \
         -v bunkerized-vol:/etc/nginx \
         -e ABSOLUTE_URI=https://admin.example.com/admin-changeme/ \
         -e DOCKER_HOST=tcp://my-docker-proxy:2375 \
         -e API_URI=/ChangeMeToSomethingHardToGuess \
         -e ADMIN_USERNAME=admin \
         -e ADMIN_PASSWORD=changeme \
         bunkerity/bunkerized-nginx-ui

Last but not least, you need to start the bunkerized-nginx and configure it as a reverse proxy for the web UI web service :

$ docker create \
         --name my-bunkerized \
         --network ui-net \
         -p 80:8080 \
         -p 443:8443 \
         -v bunkerized-vol:/etc/nginx \
         -v "${PWD}/certs:/etc/letsencrypt" \
         -e SERVER_NAME=admin.example.com \
         -e MULTISITE=yes \
         -e USE_API=yes \
         -e API_URI=/ChangeMeToSomethingHardToGuess \
         -e AUTO_LETS_ENCRYPT=yes \
         -e REDIRECT_HTTP_TO_HTTPS=yes \
         -e admin.example.com_USE_REVERSE_PROXY=yes \
         -e admin.example.com_REVERSE_PROXY_URL=/admin-changeme/ \
         -e admin.example.com_REVERSE_PROXY_HOST=http://my-bunkerized-ui:5000 \
         -e "admin.example.com_REVERSE_PROXY_HEADERS=X-Script-Name /admin-changeme" \
         -e admin.example.com_USE_MODSECURITY=no \
         -l bunkerized-nginx.UI \
         bunkerity/bunkerized-nginx
$ docker network connect services-net my-bunkerized
$ docker start my-bunkerized

The web UI should now be accessible at https://admin.example.com/admin-changeme/.

docker-compose equivalent :

version: '3'

services:

  my-bunkerized:
    image: bunkerity/bunkerized-nginx
    restart: always
    depends_on:
      - my-bunkerized-ui
    networks:
      - services-net
      - ui-net
    ports:
      - 80:8080
      - 443:8443
    volumes:
      - ./letsencrypt:/etc/letsencrypt
      - bunkerized-vol:/etc/nginx
    environment:
      - SERVER_NAME=admin.example.com                                         # replace with your domain
      - MULTISITE=yes
      - USE_API=yes
      - API_URI=/ChangeMeToSomethingHardToGuess                               # change it to something hard to guess + must match API_URI from myui service
      - AUTO_LETS_ENCRYPT=yes
      - REDIRECT_HTTP_TO_HTTPS=yes
      - admin.example.com_USE_REVERSE_PROXY=yes
      - admin.example.com_REVERSE_PROXY_URL=/admin-changeme/                  # change it to something hard to guess
      - admin.example.com_REVERSE_PROXY_HOST=http://my-bunkerized-ui:5000
      - admin.example.com_REVERSE_PROXY_HEADERS=X-Script-Name /admin-changeme # must match REVERSE_PROXY_URL
      - admin.example.com_USE_MODSECURITY=no
    labels:
      - "bunkerized-nginx.UI"

  my-bunkerized-ui:
    image: bunkerity/bunkerized-nginx-ui
    restart: always
    depends_on:
      - my-docker-proxy
    networks:
      - ui-net
    volumes:
      - bunkerized-vol:/etc/nginx
    environment:
      - ABSOLUTE_URI=https://admin.example.com/admin-changeme/ # change it to your full URI
      - DOCKER_HOST=tcp://my-docker-proxy:2375
      - API_URI=/ChangeMeToSomethingHardToGuess                # must match API_URI from bunkerized-nginx
      - ADMIN_USERNAME=admin                                   # change it to something hard to guess
      - ADMIN_PASSWORD=changeme                                # change it to a good password

  my-docker-proxy:
    image: tecnativa/docker-socket-proxy
    restart: always
    networks:
      - ui-net
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - CONTAINERS=1
      - SWARM=1
      - SERVICES=1

networks:
  ui-net:
  services-net:
    name: services-net

volumes:
  bunkerized-vol:

Linux

First of all, you need to edit the web UI configuration file located at /opt/bunkerized-nginx/ui/variables.env :

ABSOLUTE_URI=https://admin.example.com/admin-changeme/
DOCKER_HOST=
ADMIN_USERNAME=admin
ADMIN_PASSWORD=changeme

Make sure that the web UI service is automatically started on boot :

$ systemctl enable bunkerized-nginx-ui

Now you can start the web UI service :

$ systemctl start bunkerized-nginx-ui

Edit the bunkerized-nginx configurations located at /opt/bunkerized-nginx/variables.env :

HTTP_PORT=80
HTTPS_PORT=443
DNS_RESOLVERS=8.8.8.8 8.8.4.4
SERVER_NAME=admin.example.com
MULTISITE=yes
AUTO_LETS_ENCRYPT=yes
REDIRECT_HTTP_TO_HTTPS=yes
admin.example.com_USE_REVERSE_PROXY=yes
admin.example.com_REVERSE_PROXY_URL=/admin-changeme/
# Local bunkerized-nginx-ui
admin.example.com_REVERSE_PROXY_HOST=http://127.0.0.1:5000
# Remote bunkerized-nginx-ui
#REVERSE_PROXY_HOST=http://service.example.local:5000
admin.example.com_REVERSE_PROXY_HEADERS=X-Script-Name /admin-changeme
admin.example.com_USE_MODSECURITY=no

And run the bunkerized-nginx command to apply changes :

$ bunkerized-nginx