linuxserver/docker-swag
Docker Swag
This project is a Docker-based web gateway and Nginx reverse proxy manager. It functions as a containerized network edge designed to route incoming HTTP and HTTPS traffic to backend services using subdomains and subfolders.
The system automates the procurement and renewal of Let's Encrypt SSL certificates via the ACME protocol and various DNS plugins. It includes a mechanism to export and share these certificates through persistent volumes so other containers can utilize the same encryption keys.
Security is handled through a combination of server intrusion prevention, using Fail2Ban to monitor logs and ban malicious IP addresses, and layered authentication middleware. Access to resources can be restricted using local password files, LDAP, or external identity providers, while HTTP traffic is automatically redirected to HTTPS.
The deployment is managed via container orchestration, supporting read-only filesystem modes and template-based proxy routing for internal network addresses.
Features
- Reverse Proxy Orchestrators - Functions as a managed reverse proxy orchestrator directing traffic to backend services via Nginx.
- Reverse Proxies - Acts as a containerized network edge that routes incoming traffic to backend services using subdomains and subfolders.
- Template-Based Routing - Uses pre-defined templates to map subdomains and subfolders to internal container addresses.
- Automated TLS Reverse Proxies - Provides a containerized Nginx reverse proxy with automated TLS certificate management.
- ACME Clients - Implements an ACME client to automate the procurement and renewal of SSL certificates.
- Automated Certificate Issuance - Automates the issuance and renewal of certificates through integrated DNS provider plugins.
- SSL Certificate Automation - Automates the process of obtaining and renewing Let's Encrypt SSL certificates.
- Secure Web Gateways - Acts as a secure web gateway protecting internal services with authentication and HTTPS redirection.
- Container Network Gateways - Provides a containerized network gateway for routing external traffic into a Docker network.
- Containerized Network Edges - Deploys a centralized containerized entry point for routing traffic to home or business servers.
- Authentication Middleware - Provides middleware that intercepts proxy requests to verify identities via local passwords or LDAP.
- Automated IP Banning - Includes an automated system to ban IP addresses based on malicious patterns detected in server logs.
- Brute Force Protections - Uses Fail2Ban to monitor logs and automatically ban malicious IP addresses to prevent brute force attacks.
- Password Access Restrictions - Restricts access to proxied sites using local password files or external directory authentication.
- Intrusion Prevention Systems - Monitors server logs to detect and automatically block malicious IP addresses.
- HTTPS Enforcements - Automatically redirects incoming HTTP traffic from port 80 to secure HTTPS on port 443.
- Resource Access Control - Implements access restriction to web services and pages using basic authentication, LDAP, and external identity providers.
- Certificate Sharing - Provides a mechanism to export and share certificates through persistent volumes so other containers can utilize the same keys.
