Skip to content

Commit 23280e0

Browse files
kepan1nkepan1n
committed
Initial public release
0 parents  commit 23280e0

41 files changed

Lines changed: 4105 additions & 0 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.env.example‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# OpenZiti Docker Compose Configuration (example)
2+
3+
# Docker Image Settings
4+
ZITI_IMAGE=openziti/quickstart
5+
ZITI_VERSION=latest
6+
7+
# Admin Credentials
8+
# Leave ZITI_PWD blank to auto-generate (if your init flow supports it)
9+
ZITI_USER=admin
10+
ZITI_PWD=CHANGE_ME_STRONG_PASSWORD
11+
12+
# Network Interface (0.0.0.0 = all interfaces)
13+
ZITI_INTERFACE=0.0.0.0
14+
15+
# Container Names
16+
ZITI_CONTROLLER_CONTAINER=ziti-controller
17+
ZITI_ROUTER_CONTAINER=ziti-edge-router
18+
19+
# Persistent Data Paths (inside containers)
20+
ZITI_HOME=/persistent
21+
ZITI_PKI=/persistent/pki
22+
23+
# Controller Configuration
24+
ZITI_CTRL_NAME=ziti-controller
25+
ZITI_CTRL_EDGE_ADVERTISED_ADDRESS=ziti.example.com
26+
ZITI_CTRL_ADVERTISED_ADDRESS=ziti.example.com
27+
ZITI_CTRL_EDGE_ADVERTISED_PORT=1280
28+
ZITI_CTRL_ADVERTISED_PORT=6262
29+
30+
# Optional: Override controller IP if behind NAT
31+
ZITI_CTRL_EDGE_IP_OVERRIDE=203.0.113.10
32+
33+
# Edge Router Configuration
34+
ZITI_ROUTER_NAME=ziti-edge-router
35+
ZITI_ROUTER_ADVERTISED_ADDRESS=router.example.com
36+
ZITI_ROUTER_PORT=3022
37+
ZITI_ROUTER_ROLES=public
38+
39+
# Optional: Override router IP if behind NAT
40+
ZITI_ROUTER_IP_OVERRIDE=203.0.113.10
41+
42+
# Enrollment Duration (in minutes)
43+
ZITI_EDGE_IDENTITY_ENROLLMENT_DURATION=10080
44+
ZITI_ROUTER_ENROLLMENT_DURATION=10080
45+
46+
# VPN service defaults (used by scripts/init-ziti.sh)
47+
VPN_CIDR=10.0.0.0/16
48+
VPN_PORT_LOW=1
49+
VPN_PORT_HIGH=65535
50+
VPN_SERVICE_NAME=vpn-10-0-0-0-16
51+
52+
# LDAP/Active Directory Configuration
53+
LDAP_SERVER=ldaps://ad.example.local:636
54+
LDAP_BIND_DN="CN=svc-ziti,OU=ServiceAccounts,DC=example,DC=local"
55+
LDAP_BIND_PASSWORD=CHANGE_ME
56+
LDAP_BASE_DN=DC=example,DC=local
57+
LDAP_GROUP_DN="CN=VPN Users,OU=Groups,DC=example,DC=local"
58+
LDAP_SYNC_INTERVAL=1800

‎.github/workflows/ci.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
pull_request:
6+
7+
jobs:
8+
shell-and-python-checks:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Checkout
12+
uses: actions/checkout@v4
13+
14+
- name: Setup Python
15+
uses: actions/setup-python@v5
16+
with:
17+
python-version: '3.11'
18+
19+
- name: Install shellcheck
20+
run: sudo apt-get update && sudo apt-get install -y shellcheck
21+
22+
- name: Shellcheck scripts
23+
run: |
24+
set -e
25+
shellcheck startup.sh install.sh scripts/*.sh
26+
27+
- name: Python syntax check
28+
run: |
29+
set -e
30+
python -m py_compile bot/telegram_jwt_bot.py
31+
32+
- name: Python deps install test
33+
run: |
34+
set -e
35+
python -m pip install --upgrade pip
36+
pip install -r bot/requirements.txt

‎.gitignore‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Secrets
2+
.env
3+
bot/.env
4+
*.pem
5+
*.key
6+
*.pfx
7+
*.p12
8+
*.cer
9+
*.crt
10+
*.csr
11+
12+
# Runtime data
13+
data/
14+
logs/
15+
16+
# demo renders
17+
assets/renders/
18+
19+
# local dev
20+
node_modules/
21+
package-lock.json
22+
package.json
23+
assets/super-install-demo.ttyrec
24+
25+
# Bot venv/cache
26+
bot/venv/
27+
__pycache__/
28+
*.pyc
29+
30+
# Backups and local artifacts
31+
*.tar.gz
32+
*.bak
33+
*.log
34+
tmp/
35+
temp/
36+
37+
# Binaries/distributables
38+
clients/
39+
certs/
40+
41+
# OS/editor
42+
.DS_Store
43+
*.swp
44+
*.swo
45+
*~

‎DEPLOYMENT.md‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
# DEPLOYMENT
2+
3+
Этот документ — практичная шпаргалка по развёртыванию стека на «чистом» сервере.
4+
5+
> Важно: Telegram-бот **не отправляет JWT/файлы в Telegram**. Он отправляет их **на почту (SMTP) как вложения**, а в Telegram пишет только статус.
6+
7+
---
8+
9+
## 1) Подготовка сервера
10+
11+
- Ubuntu/Debian
12+
- Доступ в интернет (docker pull)
13+
- DNS записи на controller/router
14+
- Открыты/проброшены порты OpenZiti (по вашему дизайну)
15+
16+
Минимально чаще всего нужны:
17+
18+
- Controller Edge API: `1280/tcp`
19+
- Router Edge: `3022/tcp`
20+
- ZAC: `8443/tcp`
21+
22+
---
23+
24+
## 2) Развёртывание из git
25+
26+
```bash
27+
git clone <your-repo-url> /opt/openziti-ad-telegram
28+
cd /opt/openziti-ad-telegram
29+
30+
cp .env.example .env
31+
cp bot/.env.example bot/.env
32+
```
33+
34+
Заполнить:
35+
36+
- `.env`: OpenZiti, DNS/IP, AD/LDAP, admin credentials
37+
- `bot/.env`: Telegram token, SMTP, whitelist chat IDs
38+
39+
---
40+
41+
## 3) Сертификаты
42+
43+
Положить сертификаты в `/opt/openziti-ad-telegram/certs/`:
44+
45+
- `fullchain.cer`
46+
- `cert.key`
47+
- `chain.cer`
48+
49+
Проверка/применение:
50+
51+
```bash
52+
cd /opt/openziti-ad-telegram
53+
./scripts/auto-update-certs.sh
54+
```
55+
56+
---
57+
58+
## 4) Автоустановка
59+
60+
```bash
61+
sudo ./install.sh
62+
```
63+
64+
Опции:
65+
66+
```bash
67+
sudo SETUP_BOT=false ./install.sh
68+
sudo SETUP_LDAP_TIMER=false ./install.sh
69+
sudo INSTALL_DIR=/srv/openziti ./install.sh
70+
```
71+
72+
---
73+
74+
## 5) Запуск стека
75+
76+
```bash
77+
cd /opt/openziti-ad-telegram
78+
sudo ./startup.sh
79+
```
80+
81+
Проверка:
82+
83+
```bash
84+
docker compose ps
85+
docker compose logs -f
86+
curl -k https://<controller-host>:1280/version
87+
```
88+
89+
---
90+
91+
## 6) LDAP sync (вручную)
92+
93+
```bash
94+
cd /opt/openziti-ad-telegram
95+
docker compose exec -T ziti-controller bash /scripts/sync-ldap-users.sh
96+
```
97+
98+
---
99+
100+
## 7) Проверка systemd (если ставили `install.sh`)
101+
102+
```bash
103+
systemctl status ziti-telegram-bot.service
104+
systemctl status ziti-ldap-sync.timer
105+
journalctl -u ziti-telegram-bot.service -f
106+
```
107+
108+
---
109+
110+
## 8) Git hygiene
111+
112+
Перед push:
113+
114+
```bash
115+
git status
116+
```
117+
118+
Не должно быть в индексе:
119+
120+
- `.env`, `bot/.env`
121+
- `certs/*`
122+
- `data/*`, `logs/*`

0 commit comments

Comments
 (0)