Containerization

[Zarci]

Is your feature request related to a problem? Please describe.
I am working on integrating this project into CICD pipelines & dockerfile (great project BTW 💯 )

Describe the solution you'd like
A GitHub actions workflow to build the project into a docker image would be awesome to see.

Describe alternatives you've considered
I currently scrape the github api with $(curl -s https://api.github.com/repos/D00Movenok/BounceBack/releases/latest | jq -r '.tag_name' | sed 's/^v//'); and unzip the release folder but would prefer a more uniform solution.

[Zarci]

Here is my current docker file.

FROM alpine:latest AS build

WORKDIR /tmp

RUN apk add --no-cache curl unzip jq

ARG BOUNCEBACK_VERSION=""
RUN if [ -z "$BOUNCEBACK_VERSION" ]; then \
        BOUNCEBACK_VERSION=$(curl -s https://api.github.com/repos/D00Movenok/BounceBack/releases/latest | jq -r '.tag_name' | sed 's/^v//'); \
    fi && \
    echo "Downloading BounceBack version: ${BOUNCEBACK_VERSION}" && \
    curl -sL "https://github.com/D00Movenok/BounceBack/releases/download/v${BOUNCEBACK_VERSION}/BounceBack_${BOUNCEBACK_VERSION}_linux_amd64.zip" -o bounceback.zip && \
    curl -sL "https://github.com/D00Movenok/BounceBack/releases/download/v${BOUNCEBACK_VERSION}/BounceBack_checksums.txt" -o checksums.txt

RUN grep "linux_amd64.zip" checksums.txt | awk '{print $1 "  bounceback.zip"}' | sha256sum -c

RUN unzip bounceback.zip && \
    mv BounceBack_*_linux_amd64 bounceback

# Stage 2
FROM alpine:latest

WORKDIR /app

RUN apk add --no-cache ca-certificates bash

COPY --from=build /tmp/bounceback/ .

RUN mkdir -p /app/data /app/logs /app/certs

# Collect banned IPs at build time
# RUN bash scripts/collect_banned_ips.sh > data/banned_ips.txt || touch data/banned_ips.txt

CMD ["./bounceback"]

[D00Movenok]

Hi! That's a good suggestion.

The only thing is, we need to figure out how to move the standard wordlists/configs from Docker to a directory on the system (via volume) for editing.

I don't want to have the config/dictionary files embedded in the executable and unpacked in the target directory if it is empty. The only option I can think of is pulling them separately from repo (for example, using Curl).

If you have any ideas on how to implement this, I will be glad to discuss them.

[Zarci]

Yeah I agree.

I ended up using a docker compose file to the data directory as seen below and just let the build process only handle the GO.

<project root>/
|
| - compose.yml
| - data/
| |
| word-lists.txt

This is so that the process is just git clone, cd <repo>, docker compose up -d to deploy

you could then use the ghcr to generate a docker image that gets built by an github actions workflow this way the CICD(docker compose) can just pull the :latest container instead of building it.

Here is my current compose:
Note: I added some extra services to handle ssl.

services:
  # Certbot service for Let's Encrypt certificate management
  certbot:
    image: certbot/certbot:latest
    container_name: certbot-letsencrypt
    volumes:
      - ./letsencrypt:/etc/letsencrypt
      - ./webroot:/var/www/certbot
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew --webroot --webroot-path=/var/www/certbot --quiet; sleep 12h & wait $${!}; done;'"
    networks:
      - redirector

  # Nginx service for HTTP-01 ACME challenge and cert management
  nginx:
    image: nginx:alpine
    container_name: nginx-certbot
    restart: unless-stopped
    ports:
      - "80:80"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./webroot:/var/www/certbot:ro
    networks:
      - redirector
    depends_on:
      - certbot

  bounceback:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: bounceback
    restart: unless-stopped
    ports:
      - "443:8443"
    volumes:
      - ./config.yml:/app/config.yml:ro
      - ./data:/app/data
      - ./logs:/app/logs
      - ./letsencrypt:/etc/letsencrypt:ro
    environment:
      - TZ=UTC
    networks:
      - redirector
    depends_on:
      - nginx

networks:
  redirector:
    driver: bridge