2f44da2c34
Implement Phase 3 of Custom DNS Provider Plugin Support with comprehensive
security controls for external plugin loading.
Add CHARON_PLUGIN_SIGNATURES env var for SHA-256 signature allowlisting
Support permissive (unset), strict ({}), and allowlist modes
Add directory permission verification (reject world-writable)
Configure container with non-root user and read-only plugin mount option
Add 22+ security tests for permissions, signatures, and allowlist logic
Create plugin-security.md operator documentation
Security controls:
Signature verification with sha256: prefix requirement
World-writable directory rejection
Non-root container execution (charon user UID 1000)
Read-only mount support for production deployments
Documented TOCTOU mitigation with atomic deployment workflow
63 lines
2.0 KiB
YAML
63 lines
2.0 KiB
YAML
services:
|
|
charon:
|
|
image: charon:local
|
|
container_name: charon
|
|
restart: unless-stopped
|
|
ports:
|
|
- "80:80" # HTTP (Caddy proxy)
|
|
- "443:443" # HTTPS (Caddy proxy)
|
|
- "443:443/udp" # HTTP/3 (Caddy proxy)
|
|
- "8080:8080" # Management UI (Charon)
|
|
- "2345:2345" # Delve Debugger
|
|
environment:
|
|
- CHARON_ENV=development
|
|
- CHARON_DEBUG=1
|
|
- TZ=America/New_York
|
|
# Generate with: openssl rand -base64 32
|
|
- CHARON_ENCRYPTION_KEY=your-32-byte-base64-key-here
|
|
- CHARON_HTTP_PORT=8080
|
|
- CHARON_DB_PATH=/app/data/charon.db
|
|
- CHARON_FRONTEND_DIR=/app/frontend/dist
|
|
- CHARON_CADDY_ADMIN_API=http://localhost:2019
|
|
- CHARON_CADDY_CONFIG_DIR=/app/data/caddy
|
|
- CHARON_CADDY_BINARY=caddy
|
|
- CHARON_IMPORT_CADDYFILE=/import/Caddyfile
|
|
- CHARON_IMPORT_DIR=/app/data/imports
|
|
- CHARON_ACME_STAGING=false
|
|
- FEATURE_CERBERUS_ENABLED=true
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
cap_add:
|
|
- SYS_PTRACE
|
|
security_opt:
|
|
- seccomp:unconfined
|
|
volumes:
|
|
- charon_data:/app/data
|
|
- caddy_data:/data
|
|
- caddy_config:/config
|
|
- crowdsec_data:/app/data/crowdsec
|
|
- plugins_data:/app/plugins # Read-write for development/hot-loading
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro # For local container discovery
|
|
- ./backend:/app/backend:ro # Mount source for debugging
|
|
# Mount your existing Caddyfile for automatic import (optional)
|
|
# - <PATH_TO_YOUR_CADDYFILE>:/import/Caddyfile:ro
|
|
# - <PATH_TO_YOUR_SITES_DIR>:/import/sites:ro # If your Caddyfile imports other files
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/api/v1/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 40s
|
|
|
|
volumes:
|
|
charon_data:
|
|
driver: local
|
|
caddy_data:
|
|
driver: local
|
|
caddy_config:
|
|
driver: local
|
|
crowdsec_data:
|
|
driver: local
|
|
plugins_data:
|
|
driver: local
|