45 lines
1.7 KiB
Markdown
45 lines
1.7 KiB
Markdown
|
# Deployment: Docker
|
||
|
|
|
||
|
|
Uses `docker-compose.yml` from the repository root.
|
||
|
|
|
||
|
|
## Services
|
||
|
|
|
||
|
|
| Service | Container | Ports | Notes |
|
||
|
|
|---|---|---|---|
|
||
|
|
| `app-ui` | `ovp-ui` | 80 | Nginx + built UI; proxies `/api/` and `/profiles-api/` |
|
||
|
|
| `app-api` | `ovp-api` | 5001 | Flask monitoring API |
|
||
|
|
| `app-gatherer` | `ovp-gatherer` | - | Parses `openvpn-status.log` |
|
||
|
|
| `app-profiler` | `ovp-profiler` | 8000, 1194/udp | FastAPI + OpenVPN; needs `NET_ADMIN` and `/dev/net/tun` |
|
||
|
|
|
||
|
|
Volumes: `ovp_logs`, `ovp_config`, `ovp_pki`, `ovp_client_config`, `db_data`.
|
||
|
|
|
||
|
|
## Steps
|
||
|
|
|
||
|
|
1. Set a random JWT secret and the initial admin (compose reads them from the environment / `.env`):
|
||
|
|
```bash
|
||
|
|
cat > .env <<EOT
|
||
|
|
JWT_SECRET=$(openssl rand -hex 32)
|
||
|
|
OVPMON_INITIAL_ADMIN_USER=<login>
|
||
|
|
OVPMON_INITIAL_ADMIN_PASSWORD=<strong password>
|
||
|
|
EOT
|
||
|
|
chmod 600 .env
|
||
|
|
```
|
||
|
|
Pass the two `OVPMON_INITIAL_ADMIN_*` variables to `app-api` (`environment:`) for the first start.
|
||
|
|
2. `docker-compose up -d --build`
|
||
|
|
3. Open `http://<host>`, sign in, **PKI Configuration → Initialize PKI**.
|
||
|
|
4. Remove `OVPMON_INITIAL_ADMIN_*` from `.env` and recreate `app-api`.
|
||
|
|
|
||
|
|
## Hardening
|
||
|
|
|
||
|
|
- Publish only what is needed: in production drop the `5001:5001` and `8000:8000` mappings (Nginx already reaches them on `ovp-net`).
|
||
|
|
- Terminate TLS in front of `app-ui` (reverse proxy or mount a cert into the UI container); see [Nginx configuration](Nginx_Configuration.md).
|
||
|
|
- `ovp-profiler` is privileged (`NET_ADMIN`, TUN): restrict access to its port to the UI network.
|
||
|
|
- Back up the `db_data` and `ovp_pki` volumes.
|
||
|
|
|
||
|
|
## Operations
|
||
|
|
|
||
|
|
```bash
|
||
|
|
docker-compose ps
|
||
|
|
docker-compose logs -f app-api app-profiler
|
||
|
|
docker-compose up -d --build app-ui # after UI changes
|
||
|
|
```
|