diff --git a/.editorconfig b/.editorconfig old mode 100755 new mode 100644 diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml old mode 100755 new mode 100644 diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml old mode 100755 new mode 100644 diff --git a/.github/ISSUE_TEMPLATE/issue.bug.yml b/.github/ISSUE_TEMPLATE/issue.bug.yml old mode 100755 new mode 100644 diff --git a/.github/ISSUE_TEMPLATE/issue.feature.yml b/.github/ISSUE_TEMPLATE/issue.feature.yml old mode 100755 new mode 100644 diff --git a/.github/workflows/call_issue_pr_tracker.yml b/.github/workflows/call_issue_pr_tracker.yml old mode 100755 new mode 100644 diff --git a/.github/workflows/call_issues_cron.yml b/.github/workflows/call_issues_cron.yml old mode 100755 new mode 100644 diff --git a/.github/workflows/permissions.yml b/.github/workflows/permissions.yml old mode 100755 new mode 100644 diff --git a/Dockerfile b/Dockerfile index 3016894..ebb6cae 100755 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.21 +FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.22 # set version label ARG BUILD_DATE @@ -49,37 +49,36 @@ RUN \ nginx-mod-stream \ nginx-mod-stream-geoip2 \ nginx-vim \ - php83-bcmath \ - php83-bz2 \ - php83-dom \ - php83-exif \ - php83-ftp \ - php83-gd \ - php83-gmp \ - php83-imap \ - php83-intl \ - php83-ldap \ - php83-mysqli \ - php83-mysqlnd \ - php83-opcache \ - php83-pdo_mysql \ - php83-pdo_odbc \ - php83-pdo_pgsql \ - php83-pdo_sqlite \ - php83-pear \ - php83-pecl-apcu \ - php83-pecl-mcrypt \ - php83-pecl-memcached \ - php83-pecl-redis \ - php83-pgsql \ - php83-posix \ - php83-soap \ - php83-sockets \ - php83-sodium \ - php83-sqlite3 \ - php83-tokenizer \ - php83-xmlreader \ - php83-xsl \ + php84-bcmath \ + php84-bz2 \ + php84-dom \ + php84-exif \ + php84-ftp \ + php84-gd \ + php84-gmp \ + php84-imap \ + php84-intl \ + php84-ldap \ + php84-mysqli \ + php84-mysqlnd \ + php84-opcache \ + php84-pdo_mysql \ + php84-pdo_odbc \ + php84-pdo_pgsql \ + php84-pdo_sqlite \ + php84-pear \ + php84-pecl-apcu \ + php84-pecl-memcached \ + php84-pecl-redis \ + php84-pgsql \ + php84-posix \ + php84-soap \ + php84-sockets \ + php84-sodium \ + php84-sqlite3 \ + php84-tokenizer \ + php84-xmlreader \ + php84-xsl \ whois && \ echo "**** install certbot plugins ****" && \ if [ -z ${CERTBOT_VERSION+x} ]; then \ @@ -89,7 +88,7 @@ RUN \ pip install -U --no-cache-dir \ pip \ wheel && \ - pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.21/ \ + pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.22/ \ certbot==${CERTBOT_VERSION} \ certbot-dns-acmedns \ certbot-dns-aliyun \ diff --git a/Dockerfile.aarch64 b/Dockerfile.aarch64 index 516f30e..8198789 100755 --- a/Dockerfile.aarch64 +++ b/Dockerfile.aarch64 @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.21 +FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.22 # set version label ARG BUILD_DATE @@ -49,37 +49,36 @@ RUN \ nginx-mod-stream \ nginx-mod-stream-geoip2 \ nginx-vim \ - php83-bcmath \ - php83-bz2 \ - php83-dom \ - php83-exif \ - php83-ftp \ - php83-gd \ - php83-gmp \ - php83-imap \ - php83-intl \ - php83-ldap \ - php83-mysqli \ - php83-mysqlnd \ - php83-opcache \ - php83-pdo_mysql \ - php83-pdo_odbc \ - php83-pdo_pgsql \ - php83-pdo_sqlite \ - php83-pear \ - php83-pecl-apcu \ - php83-pecl-mcrypt \ - php83-pecl-memcached \ - php83-pecl-redis \ - php83-pgsql \ - php83-posix \ - php83-soap \ - php83-sockets \ - php83-sodium \ - php83-sqlite3 \ - php83-tokenizer \ - php83-xmlreader \ - php83-xsl \ + php84-bcmath \ + php84-bz2 \ + php84-dom \ + php84-exif \ + php84-ftp \ + php84-gd \ + php84-gmp \ + php84-imap \ + php84-intl \ + php84-ldap \ + php84-mysqli \ + php84-mysqlnd \ + php84-opcache \ + php84-pdo_mysql \ + php84-pdo_odbc \ + php84-pdo_pgsql \ + php84-pdo_sqlite \ + php84-pear \ + php84-pecl-apcu \ + php84-pecl-memcached \ + php84-pecl-redis \ + php84-pgsql \ + php84-posix \ + php84-soap \ + php84-sockets \ + php84-sodium \ + php84-sqlite3 \ + php84-tokenizer \ + php84-xmlreader \ + php84-xsl \ whois && \ echo "**** install certbot plugins ****" && \ if [ -z ${CERTBOT_VERSION+x} ]; then \ @@ -89,7 +88,7 @@ RUN \ pip install -U --no-cache-dir \ pip \ wheel && \ - pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.21/ \ + pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.22/ \ certbot==${CERTBOT_VERSION} \ certbot-dns-acmedns \ certbot-dns-aliyun \ diff --git a/LICENSE b/LICENSE old mode 100755 new mode 100644 diff --git a/README.md b/README.md index f671c2f..9af3999 100644 --- a/README.md +++ b/README.md @@ -142,6 +142,14 @@ This will *ask* Google et al not to index and list your site. Be careful with th * Proxy sample files WILL be updated, however your renamed (enabled) proxy files will not. * You can check the new sample and adjust your active config as needed. +### QUIC support + +This image supports QUIC (also known as HTTP/3) but it must be explicitly enabled in each proxy conf, and the default conf, because if the listener is enabled and you don't expose 443/UDP, it can break connections with some browsers. + +To enable QUIC, expose 443/UDP to your clients, then uncomment both QUIC listeners in all of your active proxy confs, as well as the default conf, and restart the container. + +You should also uncomment the `Alt-Svc` header in your `ssl.conf` so that browsers are aware that you offer QUIC connectivity. + ### Migration from the old `linuxserver/letsencrypt` image Please follow the instructions [on this blog post](https://www.linuxserver.io/blog/2020-08-21-introducing-swag#migrate). @@ -194,6 +202,7 @@ services: ports: - 443:443 - 80:80 #optional + - 443/udp:443/udp #optional restart: unless-stopped ``` @@ -221,6 +230,7 @@ docker run -d \ -e SWAG_AUTORELOAD_WATCHLIST= `#optional` \ -p 443:443 \ -p 80:80 `#optional` \ + -p 443/udp:443/udp `#optional` \ -v /path/to/swag/config:/config \ --restart unless-stopped \ lscr.io/linuxserver/swag:latest @@ -234,6 +244,7 @@ Containers are configured using parameters passed at runtime (such as those abov | :----: | --- | | `-p 443:443` | HTTPS port | | `-p 80` | HTTP port (required for HTTP validation and HTTP -> HTTPS redirect) | +| `-p 443/udp` | QUIC (HTTP/3) port. Must be enabled in the default and proxy confs. | | `-e PUID=1000` | for UserID - see below for explanation | | `-e PGID=1000` | for GroupID - see below for explanation | | `-e TZ=Etc/UTC` | specify a timezone to use, see this [list](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List). | @@ -420,6 +431,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64 ## Versions +* **18.07.25:** - Rebase to Alpine 3.22 with PHP 8.4. Add QUIC support. Drop PHP bindings for mcrypt as it is no longer maintained. * **05.05.25:** - Disable Certbot's built in log rotation. * **19.01.25:** - Add [Auto Reload](https://github.com/linuxserver/docker-mods/tree/swag-auto-reload) functionality to SWAG. * **17.12.24:** - Rebase to Alpine 3.21. diff --git a/readme-vars.yml b/readme-vars.yml index f2dbaec..273f27b 100644 --- a/readme-vars.yml +++ b/readme-vars.yml @@ -44,6 +44,7 @@ opt_param_env_vars: opt_param_usage_include_ports: true opt_param_ports: - {external_port: "80", internal_port: "80", port_desc: "HTTP port (required for HTTP validation and HTTP -> HTTPS redirect)"} + - {external_port: "443/udp", internal_port: "443/udp", port_desc: "QUIC (HTTP/3) port. Must be enabled in the default and proxy confs."} readonly_supported: true readonly_message: | * `/tmp` must be mounted to tmpfs @@ -138,6 +139,16 @@ app_setup_block: | * Proxy sample files WILL be updated, however your renamed (enabled) proxy files will not. * You can check the new sample and adjust your active config as needed. + ### QUIC support + + This image supports QUIC (also known as HTTP/3) but it must be explicitly enabled in each proxy conf, and the default conf, because if the listener is enabled and you don't expose 443/UDP, it can break connections with some browsers. + + To enable QUIC, expose 443/UDP to your clients, then uncomment both QUIC listeners in all of your active proxy confs, as well as the default conf, and restart the container. + + You should also uncomment the `Alt-Svc` header in your `ssl.conf` so that browsers are aware that you offer QUIC connectivity. + + It is [recommended](https://quic-go.net/docs/quic/optimizations/#udp-buffer-sizes) to increase the UDP send/recieve buffer **on the host** by setting the `net.core.rmem_max` and `net.core.wmem_max` sysctls. Suggested values are 4-16Mb (4194304-16777216 bytes). For persistence between reboots use `/etc/sysctl.d/`. + ### Migration from the old `linuxserver/letsencrypt` image Please follow the instructions [on this blog post](https://www.linuxserver.io/blog/2020-08-21-introducing-swag#migrate). @@ -207,6 +218,7 @@ init_diagram: | "swag:latest" <- Base Images # changelog changelogs: + - {date: "18.07.25:", desc: "Rebase to Alpine 3.22 with PHP 8.4. Add QUIC support. Drop PHP bindings for mcrypt as it is no longer maintained."} - {date: "05.05.25:", desc: "Disable Certbot's built in log rotation."} - {date: "19.01.25:", desc: "Add [Auto Reload](https://github.com/linuxserver/docker-mods/tree/swag-auto-reload) functionality to SWAG."} - {date: "17.12.24:", desc: "Rebase to Alpine 3.21."} diff --git a/root/defaults/nginx/site-confs/default.conf.sample b/root/defaults/nginx/site-confs/default.conf.sample index 8613f1e..e240496 100644 --- a/root/defaults/nginx/site-confs/default.conf.sample +++ b/root/defaults/nginx/site-confs/default.conf.sample @@ -1,4 +1,4 @@ -## Version 2024/12/17 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/site-confs/default.conf.sample +## Version 2025/07/18 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/site-confs/default.conf.sample # redirect all traffic to https server { @@ -13,7 +13,9 @@ server { # main server block server { listen 443 ssl default_server; +# listen 443 quic reuseport default_server; listen [::]:443 ssl default_server; +# listen [::]:443 quic reuseport default_server; server_name _;