mirror of
https://github.com/Av0idD4rk/firegex.git
synced 2026-10-23 16:31:00 +00:00
75c54f0155
- Add Nginx stream proxy module for transparent TLS termination in NFProxy and NFRegex - Add backend routes and SQLite schema for certificate management (upload, view, delete) - Implement DNAT nftables redirection rules for deterministic TLS ports - Add frontend React components (TLSConfigModal, TLSServiceFields) for certificate configuration - Update Dockerfile and docker-entrypoint.sh to support Nginx stream module and sysctl forwarding
40 lines
1.1 KiB
Bash
40 lines
1.1 KiB
Bash
#!/bin/sh
|
|
|
|
chown nobody -R /execute/
|
|
|
|
# Create socket directory if SOCKET_DIR is set
|
|
if [ -n "$SOCKET_DIR" ]; then
|
|
mkdir -p "$SOCKET_DIR"
|
|
chown nobody:nobody "$SOCKET_DIR"
|
|
chmod 755 "$SOCKET_DIR"
|
|
fi
|
|
|
|
# Set host sysctls while running as root.
|
|
if [ -d "/sys_host" ]; then
|
|
echo "[*] Setting host sysctls..."
|
|
echo 1 > /sys_host/net.ipv4.conf.all.forwarding 2>/dev/null || true
|
|
echo 1 > /sys_host/net.ipv6.conf.all.forwarding 2>/dev/null || true
|
|
echo 1 > /sys_host/net.ipv4.conf.all.route_localnet 2>/dev/null || true
|
|
echo 1 > /sys_host/net.ipv4.ip_forward 2>/dev/null || true
|
|
fi
|
|
|
|
echo "[*] Attempting to start with capabilities..."
|
|
|
|
if capsh --caps="cap_net_admin,cap_setpcap,cap_setuid,cap_setgid,cap_sys_nice+eip" \
|
|
--keep=1 \
|
|
--user=nobody \
|
|
--addamb=cap_net_admin,cap_sys_nice \
|
|
-- -c "exit 0"
|
|
then
|
|
exec capsh --caps="cap_net_admin,cap_setpcap,cap_setuid,cap_setgid,cap_sys_nice+eip" \
|
|
--keep=1 \
|
|
--user=nobody \
|
|
--addamb=cap_net_admin,cap_sys_nice \
|
|
--shell=/usr/bin/python3 \
|
|
-- /execute/app.py DOCKER
|
|
else
|
|
echo "[!] capsh failed, running with root user"
|
|
exec python3 /execute/app.py DOCKER
|
|
fi
|
|
|