diff --git a/Dockerfile b/Dockerfile index d3dbd48..d91bd8d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -FROM ghcr.io/linuxserver/baseimage-alpine:3.22 +FROM ghcr.io/linuxserver/baseimage-alpine:3.23 # set version label ARG BUILD_DATE diff --git a/Dockerfile.aarch64 b/Dockerfile.aarch64 index 96646d8..3cb94e6 100644 --- a/Dockerfile.aarch64 +++ b/Dockerfile.aarch64 @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.22 +FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.23 # set version label ARG BUILD_DATE diff --git a/Jenkinsfile b/Jenkinsfile index 3de05f2..bf7dbd4 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -293,7 +293,7 @@ pipeline { -v ${WORKSPACE}:/mnt \ -e AWS_ACCESS_KEY_ID=\"${S3_KEY}\" \ -e AWS_SECRET_ACCESS_KEY=\"${S3_SECRET}\" \ - ghcr.io/linuxserver/baseimage-alpine:3 s6-envdir -fn -- /var/run/s6/container_environment /bin/bash -c "\ + ghcr.io/linuxserver/baseimage-alpine:3.23 s6-envdir -fn -- /var/run/s6/container_environment /bin/bash -c "\ apk add --no-cache python3 && \ python3 -m venv /lsiopy && \ pip install --no-cache-dir -U pip && \ diff --git a/README.md b/README.md index 940163b..97529e8 100644 --- a/README.md +++ b/README.md @@ -119,7 +119,7 @@ If you wish to use your own administrator key or provide a valid SSL certificate * **To use a custom Server E2EE Key:** * Place your RSA private key at this location. This is the core key for the API's end-to-end encryption and validates the server when a user sets the servers public key when configuring the extension. * **Path:** `/path/to/config/ssl/server_key.pem` - * **Generation Command:** `openssl genpkey -algorithm RSA -out /path/to/config/ssl/server_key.pem -pkeyopt rsa_keygen_bits:4096` + * **Generation Command:** `openssl genpkey -algorithm RSA -out /path/to/config/ssl/server_key.pem -pkeyopt rsa_keygen_bits:2048` * To obtain the corresponding public key (which is needed by the browser extension), you can extract it from your private key with this command: * **Extraction Command:** `openssl rsa -in server_key.pem -pubout` @@ -128,7 +128,7 @@ If you wish to use your own administrator key or provide a valid SSL certificate To help you get started creating a container from this image you can either use docker-compose or the docker cli. >[!NOTE] ->Unless a parameter is flaged as 'optional', it is *mandatory* and a value must be provided. +>Unless a parameter is flagged as 'optional', it is *mandatory* and a value must be provided. ### docker-compose (recommended, [click here for more info](https://docs.linuxserver.io/general/docker-compose)) @@ -349,6 +349,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64 ## Versions +* **11.02.26:** - Rebase to Alpine 3.23. * **19.01.26:** - Fix init race condition. * **17.01.26:** - Update docs to remove network and port requirement, add link to Firefox add on. * **08.01.26:** - Improve permission fixing. diff --git a/readme-vars.yml b/readme-vars.yml index 675a5b3..33cdcdf 100644 --- a/readme-vars.yml +++ b/readme-vars.yml @@ -29,7 +29,7 @@ opt_param_env_vars: - {env_var: "HOST_URL", env_value: "IP or subdomain.doman.com", desc: "On initial setup this will be used to fill in the default admin configuration file in the `/config` directory, if unset the string HOST_URL will need to be replaced."} # application setup block app_setup_block_enabled: true -app_setup_block: "This image hosts the server component for the SealSkin platform.\n\nDownload the browser extension from [for Chrome HERE](https://chromewebstore.google.com/detail/sealskin-isolation/lclgfmnljgacfdpmmmjmfpdelndbbfhk), [for Firefox HERE](https://addons.mozilla.org/en-US/firefox/addon/sealskin-isolation/).\n\nOn first init a file will be created `/config/admin.json` if you set `HOST_URL` you can use this file for credentials as is, if you did not you will need to edit it and change the URL/IP set in the file to use it. Once authenticated in the extension you can generate users and new config files to distribute or use.\n\n>[!NOTE]\n>If you are not using a legitimate ssl certificate (default self signed in `/config/ssl`) than you can only use the Chrome extension and must forward whatever port mapped to 8000 to the internet. Firefox enforces https in the extension space and Chrome allows us to fall back to E2EE over http.\n\n>[!NOTE]\n>Please remember to copy and delete the default `/config/admin.json` file from your server for security, keep it somewhere safe!\n\n## Scripted installtion\n\nIncluded in this repository is a helper script to spin up sealskin with a legit certificate using Duck DNS, before using this script please navigate to [https://www.duckdns.org/](https://www.duckdns.org/), log in, make a sub domain, and get your token. \n\n```\nmkdir sealskin\ncd sealskin\nbash <(curl -sSL https://raw.githubusercontent.com/linuxserver/docker-sealskin/refs/heads/master/install.sh)\n```\n\nThis will setup pathing, ownership, docker config, and a legit wildcard SSL certificate for Duck DNS.\n\n## Basic Requirements\n\nIt is important to use the container name `sealskin` as this is how the container identifies itself and determines its ports, volumes, and network. The only backend provider to launch containers is Docker. The storage paths are required for key and storage management while their mount paths are adapted from within the container to be run on the host for launched sessions. Everyting in the stack runs as the PUID and PGID down to the container desktop sessions, it is important that the user you use has access to the `/config` and `/storage` paths.\n\n### NVIDIA Support\n\nNvidia support only works on 580 and up full proprietary drivers (no MIT/GPL) with `nvidia-drm.modeset=1` kernel parameter set. You must ensure the card is initialized before running a container so on headless systems run `nvidia-modprobe --modeset` from the host even with this kernel parameter set, this only needs to be run once per boot on headless systems.\n\n## Key & Certificate Management\n\nThe server requires several cryptographic keys to function. You can either let the server perform an automatic setup on its first run or manually provide your own keys for more control.\n\n### Automatic First-Run Setup (Recommended)\n\nThis is the simplest method. On the first launch with an empty `/config` volume:\n\n1. An init process automatically generates the mandatory server key (`server_key.pem`) and a self-signed SSL certificate for the proxy (`proxy_key.pem`, `proxy_cert.pem`).\n2. The application will then detect that no administrator exists, create a default user named `admin`, and output a configuration file admin.json into the `/config/` directory.\n\nYour only action is if the `HOST_URL` environment variable is not set to replace the `HOST_URL` string in the file with your IP/URL.\n\n### Manual Pre-Configuration (Advanced)\n\nIf you wish to use your own administrator key or provide a valid SSL certificate, you can place the necessary files in the `/config` volume **before** the first launch.\n\n* **To use a custom Admin Key:**\n 1. Generate your own RSA keypair.\n 2. Create a file containing only your **public key** PEM data at the following location:\n * **Path:** `/path/to/config/.config/sealskin/keys/admins/admin`\n 3. The server will detect this file and skip the automatic admin creation. You will use your corresponding private key to log in from the extension.\n\n* **To use a custom SSL Certificate:**\n * Place your SSL private key and certificate file at these locations. This will override the self-signed certificate generated by the init process.\n * **Key Path:** `/path/to/config/ssl/proxy_key.pem`\n * **Cert Path:** `/path/to/config/ssl/proxy_cert.pem`\n\n* **To use a custom Server E2EE Key:**\n * Place your RSA private key at this location. This is the core key for the API's end-to-end encryption and validates the server when a user sets the servers public key when configuring the extension.\n * **Path:** `/path/to/config/ssl/server_key.pem`\n * **Generation Command:** `openssl genpkey -algorithm RSA -out /path/to/config/ssl/server_key.pem -pkeyopt rsa_keygen_bits:4096`\n * To obtain the corresponding public key (which is needed by the browser extension), you can extract it from your private key with this command:\n * **Extraction Command:** `openssl rsa -in server_key.pem -pubout`\n" +app_setup_block: "This image hosts the server component for the SealSkin platform.\n\nDownload the browser extension from [for Chrome HERE](https://chromewebstore.google.com/detail/sealskin-isolation/lclgfmnljgacfdpmmmjmfpdelndbbfhk), [for Firefox HERE](https://addons.mozilla.org/en-US/firefox/addon/sealskin-isolation/).\n\nOn first init a file will be created `/config/admin.json` if you set `HOST_URL` you can use this file for credentials as is, if you did not you will need to edit it and change the URL/IP set in the file to use it. Once authenticated in the extension you can generate users and new config files to distribute or use.\n\n>[!NOTE]\n>If you are not using a legitimate ssl certificate (default self signed in `/config/ssl`) than you can only use the Chrome extension and must forward whatever port mapped to 8000 to the internet. Firefox enforces https in the extension space and Chrome allows us to fall back to E2EE over http.\n\n>[!NOTE]\n>Please remember to copy and delete the default `/config/admin.json` file from your server for security, keep it somewhere safe!\n\n## Scripted installtion\n\nIncluded in this repository is a helper script to spin up sealskin with a legit certificate using Duck DNS, before using this script please navigate to [https://www.duckdns.org/](https://www.duckdns.org/), log in, make a sub domain, and get your token. \n\n```\nmkdir sealskin\ncd sealskin\nbash <(curl -sSL https://raw.githubusercontent.com/linuxserver/docker-sealskin/refs/heads/master/install.sh)\n```\n\nThis will setup pathing, ownership, docker config, and a legit wildcard SSL certificate for Duck DNS.\n\n## Basic Requirements\n\nIt is important to use the container name `sealskin` as this is how the container identifies itself and determines its ports, volumes, and network. The only backend provider to launch containers is Docker. The storage paths are required for key and storage management while their mount paths are adapted from within the container to be run on the host for launched sessions. Everyting in the stack runs as the PUID and PGID down to the container desktop sessions, it is important that the user you use has access to the `/config` and `/storage` paths.\n\n### NVIDIA Support\n\nNvidia support only works on 580 and up full proprietary drivers (no MIT/GPL) with `nvidia-drm.modeset=1` kernel parameter set. You must ensure the card is initialized before running a container so on headless systems run `nvidia-modprobe --modeset` from the host even with this kernel parameter set, this only needs to be run once per boot on headless systems.\n\n## Key & Certificate Management\n\nThe server requires several cryptographic keys to function. You can either let the server perform an automatic setup on its first run or manually provide your own keys for more control.\n\n### Automatic First-Run Setup (Recommended)\n\nThis is the simplest method. On the first launch with an empty `/config` volume:\n\n1. An init process automatically generates the mandatory server key (`server_key.pem`) and a self-signed SSL certificate for the proxy (`proxy_key.pem`, `proxy_cert.pem`).\n2. The application will then detect that no administrator exists, create a default user named `admin`, and output a configuration file admin.json into the `/config/` directory.\n\nYour only action is if the `HOST_URL` environment variable is not set to replace the `HOST_URL` string in the file with your IP/URL.\n\n### Manual Pre-Configuration (Advanced)\n\nIf you wish to use your own administrator key or provide a valid SSL certificate, you can place the necessary files in the `/config` volume **before** the first launch.\n\n* **To use a custom Admin Key:**\n 1. Generate your own RSA keypair.\n 2. Create a file containing only your **public key** PEM data at the following location:\n * **Path:** `/path/to/config/.config/sealskin/keys/admins/admin`\n 3. The server will detect this file and skip the automatic admin creation. You will use your corresponding private key to log in from the extension.\n\n* **To use a custom SSL Certificate:**\n * Place your SSL private key and certificate file at these locations. This will override the self-signed certificate generated by the init process.\n * **Key Path:** `/path/to/config/ssl/proxy_key.pem`\n * **Cert Path:** `/path/to/config/ssl/proxy_cert.pem`\n\n* **To use a custom Server E2EE Key:**\n * Place your RSA private key at this location. This is the core key for the API's end-to-end encryption and validates the server when a user sets the servers public key when configuring the extension.\n * **Path:** `/path/to/config/ssl/server_key.pem`\n * **Generation Command:** `openssl genpkey -algorithm RSA -out /path/to/config/ssl/server_key.pem -pkeyopt rsa_keygen_bits:2048`\n * To obtain the corresponding public key (which is needed by the browser extension), you can extract it from your private key with this command:\n * **Extraction Command:** `openssl rsa -in server_key.pem -pubout`\n" # init diagram init_diagram: | "sealskin:latest": { @@ -73,6 +73,7 @@ init_diagram: | "sealskin:latest" <- Base Images # changelog changelogs: + - {date: "11.02.26:", desc: "Rebase to Alpine 3.23."} - {date: "19.01.26:", desc: "Fix init race condition."} - {date: "17.01.26:", desc: "Update docs to remove network and port requirement, add link to Firefox add on."} - {date: "08.01.26:", desc: "Improve permission fixing."}