remove size limit

.env.example

@@ -0,0 +1,7 @@
+LOCAL_DOMAIN=mikan
+PUBLIC_DOMAIN=
+LETSENCRYPT_EMAIL=admin@${LOCAL_DOMAIN}
+NGINX_IP=10.0.0.3
+DNSMASQ_IP=10.0.0.2
+SUBNET=10.0.0.0/24
+GATEWAY=10.0.0.1

.gitignore

@@ -1 +1,15 @@
-certs/
+# Environment
+.env
+
+# Certificates and secrets
+/nginx/certs/
+/ca/
+/acme/
+
+# Service data
+/services/*/data/
+
+# IDE
+.vscode/
+*.swp
+*~

README.md

@@ -1,2 +1,130 @@
-# local-dns
+# Local DNS Services with Docker
 
+This project provides a local development infrastructure with automatic DNS resolution for custom domains (e.g., `.mikan` or `.local`) and valid HTTPS certificates.
+
+## Features
+
+- Automatic DNS resolution for `*.yourdomain` and `*.yourdomain.local`
+- Valid HTTPS certificates for local domains using `mkcert`
+- Easy service deployment with `VIRTUAL_HOST` environment variables
+- Ready for future expansion: public domains, Let's Encrypt, Tailscale
+- Single-command service creation
+
+## Requirements
+
+- Docker and Docker Compose
+- `mkcert` installed on the host system
+
+## Quick Start
+
+1. Clone this repository and enter the directory:
+   ```bash
+   git clone <repository-url> local-dns
+   cd local-dns
+   ```
+
+2. Initialize the project:
+   ```bash
+   ./scripts/00-init.sh
+   ```
+   This creates a `.env` file from `.env.example` and sets up the directory structure.
+
+3. Generate TLS certificates:
+   ```bash
+   ./scripts/01-generate-cert.sh
+   ```
+   This creates trusted certificates for your local domain.
+
+4. Start the core infrastructure:
+   ```bash
+   docker compose up -d
+   ```
+
+5. Add your first service (example: Gitea on port 3000):
+   ```bash
+   ./scripts/add-service.sh gitea 3000
+   ```
+   Then edit `services/gitea/docker-compose.yml` to set the correct image and volumes.
+
+6. Start the new service:
+   ```bash
+   docker compose -f docker-compose.yml -f services/gitea/docker-compose.yml up -d
+   ```
+
+7. Visit `https://gitea.yourdomain` in your browser (replace `yourdomain` with your configured domain).
+
+## Configuration
+
+Edit the `.env` file to customize your setup:
+
+- `LOCAL_DOMAIN`: Your local domain suffix (default: `mikan`)
+- `PUBLIC_DOMAIN`: Optional public domain for Let's Encrypt certificates
+- `LETSENCRYPT_EMAIL`: Email for Let's Encrypt notifications
+- Network settings (`NGINX_IP`, `DNSMASQ_IP`, etc.)
+
+After changing `.env`, re-run the initialization and certificate scripts.
+
+## DNS Setup
+
+### Linux/macOS
+
+Use the included `dnsmasq` service for automatic DNS resolution:
+
+```bash
+docker compose -f docker-compose.yml -f docker-compose.dnsmasq.yml up -d
+```
+
+Then configure your system to use `10.0.0.2` as the primary DNS server.
+
+### Windows (WSL2)
+
+Windows reserves port 53, so `dnsmasq` cannot run on the host. Instead:
+
+1. Work inside WSL2
+2. Manually add entries to the Windows hosts file:
+   ```powershell
+   # Run PowerShell as Administrator
+   Add-Content -Path "C:\Windows\System32\drivers\etc\hosts" -Value "127.0.0.1 gitea.mikan"
+   Add-Content -Path "C:\Windows\System32\drivers\etc\hosts" -Value "127.0.0.1 gitea.mikan.local"
+   ```
+
+## Certificate Trust
+
+After running `./scripts/01-generate-cert.sh`, install the root certificate on your devices:
+
+- **Linux**: Depends on distribution (usually via `update-ca-certificates`)
+- **macOS**: 
+  ```bash
+  sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ca/rootCA.pem
+  ```
+- **Windows**: 
+  1. Copy `ca/rootCA.pem` to Windows
+  2. Open `certmgr.msc`
+  3. Import into "Trusted Root Certification Authorities"
+
+## Adding Public Domain Support
+
+To enable Let's Encrypt certificates for a public domain:
+
+1. Set in `.env`:
+   ```ini
+   PUBLIC_DOMAIN=yourdomain.com
+   LETSENCRYPT_EMAIL=you@yourdomain.com
+   ```
+
+2. Re-run initialization:
+   ```bash
+   ./scripts/00-init.sh
+   ./scripts/01-generate-cert.sh
+   ```
+
+3. New services will automatically request Let's Encrypt certificates for the public domain.
+
+## Service Management
+
+- **Add a service**: `./scripts/add-service.sh <name> <port>`
+- **Start all**: `docker compose up -d`
+- **Start with dnsmasq**: `docker compose -f docker-compose.yml -f docker-compose.dnsmasq.yml up -d`
+- **Stop all**: `docker compose down`
+
+All service data is stored in the `services/` directory and persists between restarts.

dnsmasq/dnsmasq.conf

@@ -0,0 +1,9 @@
+address=/.mikan/10.0.0.3
+address=/.mikan.local/10.0.0.3
+local=/.mikan/
+local=/.mikan.local/
+no-resolv
+server=1.1.1.1
+server=8.8.8.8
+log-queries
+log-facility=/dev/stdout

docker-compose.dnsmasq.yml

@@ -0,0 +1,26 @@
+version: '3.8'
+
+services:
+  dnsmasq:
+    image: jpillora/dnsmasq
+    container_name: dnsmasq
+    restart: unless-stopped
+    ports:
+      - "53:53/udp"
+      - "53:53/tcp"
+    volumes:
+      - ./dnsmasq/dnsmasq.conf:/etc/dnsmasq.conf:ro
+    cap_add:
+      - NET_ADMIN
+    networks:
+      devnet:
+        ipv4_address: ${DNSMASQ_IP}
+    healthcheck:
+      test: ["CMD", "nslookup", "localhost", "127.0.0.1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+
+networks:
+  devnet:
+    external: true

docker-compose.yml

@@ -1,55 +1,89 @@
-services:
-  dnsmasq:
-    image: jpillora/dnsmasq
-    container_name: dnsmasq
-    restart: always
-    ports:
-      - "53:53/udp"
-      - "53:53/tcp"
-    volumes:
-      - ./dnsmasq.conf:/etc/dnsmasq.conf:ro
-    cap_add:
-      - NET_ADMIN
-    networks:
-      - devnet
-
-  nginx-proxy:
-    image: nginxproxy/nginx-proxy:alpine
-    container_name: nginx-proxy
-    restart: always
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - /var/run/docker.sock:/tmp/docker.sock:ro
-      - ./certs:/etc/nginx/certs:ro
-      - ./vhost.d:/etc/nginx/vhost.d:ro
-      - ./html:/usr/share/nginx/html:rw
-    networks:
-      - devnet
-    labels:
-      - "com.github.nginx-proxy.nginx"
-
-  nginx-proxy-companion:
-    image: nginxproxy/acme-companion
-    container_name: nginx-proxy-companion
-    restart: always
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ./certs:/etc/nginx/certs:rw
-      - ./acme:/etc/acme.sh
-      - ./vhost.d:/etc/nginx/vhost.d
-      - ./html:/usr/share/nginx/html
-    networks:
-      - devnet
-    environment:
-      - NGINX_PROXY_CONTAINER=nginx-proxy
-
-networks:
-  devnet:
-    external: true
-
-volumes:
-  acme:
-  vhost.d:
-  html:
+version: '3.8'
+
+services:
+  nginx-proxy:
+    image: nginxproxy/nginx-proxy:alpine
+    container_name: nginx-proxy
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - /var/run/docker.sock:/tmp/docker.sock:ro
+      - ./nginx/certs:/etc/nginx/certs:ro
+      - ./nginx/vhost.d:/etc/nginx/vhost.d:ro
+      - ./nginx/html:/usr/share/nginx/html:rw
+      - ./nginx/proxy.conf:/etc/nginx/conf.d/proxy.conf
+    networks:
+      devnet:
+        ipv4_address: ${NGINX_IP}
+    environment:
+      - DEFAULT_HOST=welcome.${LOCAL_DOMAIN}
+      - HTTPS_METHOD=redirect
+      - SSL_POLICY=Mozilla-Modern
+      - DEFAULT_SSL_CERT=/etc/nginx/certs/default.crt
+      - DEFAULT_SSL_KEY=/etc/nginx/certs/default.key
+    labels:
+      - "com.github.nginx-proxy.nginx-proxy=true"
+
+  nginx-proxy-companion:
+    image: nginxproxy/acme-companion
+    container_name: nginx-proxy-companion
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./nginx/certs:/etc/nginx/certs:rw
+      - ./acme:/etc/acme.sh
+      - ./nginx/vhost.d:/etc/nginx/vhost.d:rw
+      - ./nginx/proxy.conf:/etc/nginx/conf.d/proxy.conf
+    networks:
+      - devnet
+    environment:
+      - DEFAULT_EMAIL=${LETSENCRYPT_EMAIL}
+      - NGINX_PROXY_CONTAINER=nginx-proxy
+      - ACME_CA_URI=https://acme-staging-v02.api.letsencrypt.org/directory
+    depends_on:
+      - nginx-proxy
+
+  welcome:
+    image: nginx:alpine
+    container_name: welcome
+    restart: unless-stopped
+    volumes:
+      - ./nginx/html:/usr/share/nginx/html:ro
+    environment:
+      - VIRTUAL_HOST=welcome.${LOCAL_DOMAIN},welcome.${LOCAL_DOMAIN}.local
+    networks:
+      - devnet
+    depends_on:
+      - nginx-proxy
+
+  dnsmasq:
+    image: jpillora/dnsmasq
+    container_name: dnsmasq
+    restart: unless-stopped
+    ports:
+      - "53:53/udp"
+      - "53:53/tcp"
+    volumes:
+      - ./dnsmasq/dnsmasq.conf:/etc/dnsmasq.conf:ro
+    cap_add:
+      - NET_ADMIN
+    networks:
+      devnet:
+        ipv4_address: ${DNSMASQ_IP}
+    healthcheck:
+      test: ["CMD", "nslookup", "localhost", "127.0.0.1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+
+networks:
+  devnet:
+    external: true
+    name: devnet
+
+volumes:
+  acme:
+  vhost.d:
+  html:

nginx/html/index.html

@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head><title>Добро пожаловать!</title></head>
+<body>
+  <h1>Сервисы .mikan</h1>
+  <p>Добавьте свои сервисы в папку <code>services/</code></p>
+</body>
+</html>

scripts/00-init.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$SCRIPT_DIR/.."
+
+if [ ! -f "$PROJECT_ROOT/.env" ]; then
+  echo "Файл .env не найден. Копирую из .env.example..."
+  cp "$PROJECT_ROOT/.env.example" "$PROJECT_ROOT/.env"
+fi
+
+export $(grep -v '^#' "$PROJECT_ROOT/.env" | xargs)
+
+# Создаём каталоги
+mkdir -p \
+  "$PROJECT_ROOT/dnsmasq" \
+  "$PROJECT_ROOT/nginx/{certs,vhost.d,html,conf.d}" \
+  "$PROJECT_ROOT/acme" \
+  "$PROJECT_ROOT/ca" \
+  "$PROJECT_ROOT/services"
+
+# Создаём общую Docker-сеть с фиксированными настройками
+echo "Проверка сети devnet..."
+if ! docker network inspect devnet &>/dev/null; then
+  echo "Создаём сеть devnet..."
+  docker network create \
+    --subnet="${SUBNET}" \
+    --gateway="${GATEWAY}" \
+    devnet
+else
+  echo "Сеть devnet уже существует."
+fi
+
+"$SCRIPT_DIR/02-apply-config.sh"
+
+echo "Проект инициализирован."
+echo "Домен: .$LOCAL_DOMAIN"
+if [ -n "$PUBLIC_DOMAIN" ]; then
+  echo "Публичный домен: $PUBLIC_DOMAIN"
+fi

scripts/02-apply-config.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$SCRIPT_DIR/.."
+
+if [ ! -f "$PROJECT_ROOT/.env" ]; then
+  echo "Файл .env не найден. Запустите сначала ./scripts/00-init.sh"
+  exit 1
+fi
+
+export $(grep -v '^#' "$PROJECT_ROOT/.env" | xargs)
+
+cat > "$PROJECT_ROOT/dnsmasq/dnsmasq.conf" <<EOF
+address=/.$LOCAL_DOMAIN/$NGINX_IP
+address=/.$LOCAL_DOMAIN.local/$NGINX_IP
+local=/.$LOCAL_DOMAIN/
+local=/.$LOCAL_DOMAIN.local/
+no-resolv
+server=1.1.1.1
+server=8.8.8.8
+log-queries
+log-facility=/dev/stdout
+EOF
+
+mkdir -p "$PROJECT_ROOT/nginx/html"
+cat > "$PROJECT_ROOT/nginx/html/index.html" <<EOF
+<!DOCTYPE html>
+<html>
+<head><title>Добро пожаловать!</title></head>
+<body>
+  <h1>Сервисы .$LOCAL_DOMAIN</h1>
+  <p>Добавьте свои сервисы в папку <code>services/</code></p>
+</body>
+</html>
+EOF
+
+echo "Конфигурация применена для .$LOCAL_DOMAIN"

scripts/add-service.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$SCRIPT_DIR/.."
+
+if [ -f "$ROOT_DIR/.env" ]; then
+  export $(grep -v '^#' "$ROOT_DIR/.env" | xargs)
+fi
+
+LOCAL_DOMAIN=${LOCAL_DOMAIN:-mikan}
+
+if [ $# -lt 1 ]; then
+  echo "Usage: $0 <service_name> [extra_domains...]"
+  exit 1
+fi
+
+SERVICE_NAME=$1
+shift
+EXTRA_DOMAINS=("$@")
+
+DOMAINS_FILE="$ROOT_DIR/domains.txt"
+
+if [ ! -f "$DOMAINS_FILE" ]; then
+  touch "$DOMAINS_FILE"
+fi
+
+PRIMARY="${SERVICE_NAME}.${LOCAL_DOMAIN}"
+ALIAS="${SERVICE_NAME}.local"
+
+{
+  echo "$PRIMARY"
+  echo "$ALIAS"
+  for domain in "${EXTRA_DOMAINS[@]}"; do
+    echo "$domain"
+  done
+} >> "$DOMAINS_FILE"
+
+sort -u "$DOMAINS_FILE" | grep -v '^$' > "$DOMAINS_FILE.tmp" && mv "$DOMAINS_FILE.tmp" "$DOMAINS_FILE"
+
+exec "$SCRIPT_DIR/regenerate-cert.sh"

scripts/cert_renew_restart.py

@@ -1,91 +0,0 @@
-# cert_renew_restart.py
-import subprocess
-import shutil
-from pathlib import Path
-from common import *
-
-def generate_mkcert_command():
-    """Генерирует команду для mkcert с указанием всех доменов"""
-    services = read_services_config()
-    domains = [f"{service['name']}.local" for service in services['services']]
-    domains.append("*.local")
-    
-    # Создаем PowerShell команду
-    domains_str = " ".join([f'"{domain}"' for domain in domains])
-    powershell_cmd = f'mkcert {domains_str}'
-    return powershell_cmd
-
-def copy_and_rename_certificates():
-    """Копирует и переименовывает сертификаты из Windows в WSL"""
-    # Определяем пути
-    windows_certs_path = Path("C:/store/certs")
-    wsl_certs_path = Path.home() / "projects" / "docker" / "network" / "certs"
-    
-    # Создаем директорию для сертификатов в WSL
-    wsl_certs_path.mkdir(parents=True, exist_ok=True)
-    
-    # Находим сгенерированные mkcert файлы
-    cert_files = list(windows_certs_path.glob("_wildcard.local+*.pem"))
-    if not cert_files:
-        print("Сертификаты не найдены в C:/store/certs")
-        return False
-    
-    # Предполагаем, что mkcert генерирует файлы в формате _wildcard.domain+N.pem
-    cert_file = cert_files[0]
-    key_file = cert_files[0].with_name(cert_file.name.replace(".pem", "-key.pem"))
-    
-    if not key_file.exists():
-        print(f"Файл ключа не найден: {key_file}")
-        return False
-    
-    # Копируем и переименовываем
-    target_cert = wsl_certs_path / "wildcard.local.pem"
-    target_key = wsl_certs_path / "wildcard.local.key"
-    
-    shutil.copy2(cert_file, target_cert)
-    shutil.copy2(key_file, target_key)
-    
-    # Создаем копии для default
-    default_cert = wsl_certs_path / "default.crt"
-    default_key = wsl_certs_path / "default.key"
-    
-    shutil.copy2(target_cert, default_cert)
-    shutil.copy2(target_key, default_key)
-    
-    print(f"Сертификаты скопированы в {wsl_certs_path}")
-    return True
-
-def main():
-    print("Обновление сертификатов и перезапуск сервисов...")
-    
-    # Настройка проекта
-    setup_project()
-    
-    # Выводим команду для генерации сертификатов
-    mkcert_cmd = generate_mkcert_command()
-    print("\nДля генерации сертификатов выполните в PowerShell (от администратора):")
-    print(f"cd C:\\store\\certs")
-    print(mkcert_cmd)
-    print()
-    
-    # Ждем подтверждения пользователя
-    input("Нажмите Enter после генерации сертификатов в PowerShell...")
-    
-    # Копируем сертификаты
-    if not copy_and_rename_certificates():
-        print("Не удалось скопировать сертификаты")
-        sys.exit(1)
-    
-    # Перезапускаем nginx-proxy для загрузки новых сертификатов
-    print("Перезапуск nginx-proxy...")
-    if not run_docker_command("docker-compose restart nginx-proxy"):
-        print("Не удалось перезапустить nginx-proxy")
-        # Если restart не сработал, пробуем поднять контейнеры
-        if not run_docker_command("docker-compose up -d"):
-            print("Не удалось поднять контейнеры")
-            sys.exit(1)
-    
-    print("Сертификаты обновлены и сервисы перезапущены!")
-
-if __name__ == "__main__":
-    main()

scripts/common.py

@@ -1,112 +0,0 @@
-# common.py
-import subprocess
-import sys
-import os
-import platform
-import json
-from pathlib import Path
-
-def get_host_ip():
-    """Получает IP-адрес хоста в локальной сети"""
-    try:
-        # Для WSL2 получаем IP хоста (Windows)
-        if 'microsoft' in platform.uname().release.lower():
-            # В WSL2 получаем IP хоста из файла resolv.conf
-            with open('/etc/resolv.conf', 'r') as f:
-                for line in f:
-                    if line.startswith('nameserver'):
-                        return line.split()[1]
-        # Для других систем используем подключение к внешнему серверу
-        else:
-            import socket
-            s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-            s.connect(("8.8.8.8", 80))
-            ip = s.getsockname()[0]
-            s.close()
-            return ip
-    except Exception as e:
-        print(f"Не удалось получить IP-адрес хоста: {e}")
-        # Возвращаем IP по умолчанию, если не удалось получить
-        return "192.168.31.60"
-
-def read_services_config():
-    """Читает конфигурацию сервисов из файла"""
-    config_path = Path.home() / "projects" / "docker" / "network" / "services.json"
-    default_config = {
-        "services": [
-            {"name": "gitea", "port": 3000},
-            {"name": "youtrack", "port": 8080},
-            {"name": "n8n", "port": 5678}
-        ]
-    }
-    
-    if config_path.exists():
-        with open(config_path, 'r', encoding='utf-8') as f:
-            return json.load(f)
-    else:
-        # Создаем файл конфигурации по умолчанию
-        config_path.parent.mkdir(parents=True, exist_ok=True)
-        with open(config_path, 'w', encoding='utf-8') as f:
-            json.dump(default_config, f, indent=2, ensure_ascii=False)
-        return default_config
-
-def generate_dnsmasq_config():
-    """Генерирует конфигурационный файл dnsmasq"""
-    host_ip = get_host_ip()
-    services = read_services_config()
-    
-    config_content = f"""# Локальные домены → твой ПК
-"""
-    for service in services['services']:
-        config_content += f"address=/{service['name']}.local/{host_ip}\n"
-    
-    config_content += f"""address=/.local/{host_ip}
-
-# Кэш DNS
-cache-size=500
-
-# Лог (опционально)
-log-queries
-log-facility=/var/log/dnsmasq.log
-
-# Не перехватывать внешние запросы — делегируем
-no-resolv
-server=8.8.8.8
-server=1.1.1.1
-"""
-    
-    # Путь к конфигурационному файлу
-    config_path = Path.home() / "projects" / "docker" / "network" / "dnsmasq.conf"
-    config_path.parent.mkdir(parents=True, exist_ok=True)
-    
-    with open(config_path, 'w', encoding='utf-8') as f:
-        f.write(config_content.strip())
-    
-    print(f"Конфигурационный файл dnsmasq обновлен: {config_path}")
-
-def run_docker_command(cmd):
-    """Выполняет команду Docker и возвращает результат"""
-    try:
-        result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
-        if result.returncode != 0:
-            print(f"Ошибка выполнения команды: {cmd}")
-            print(f"Ошибка: {result.stderr}")
-            return False
-        return True
-    except Exception as e:
-        print(f"Ошибка выполнения команды: {e}")
-        return False
-
-def setup_project():
-    """Настройка проекта: генерация конфигов и переход в директорию"""
-    # Генерируем конфигурационный файл dnsmasq
-    generate_dnsmasq_config()
-    
-    # Переходим в директорию проекта
-    project_path = Path.home() / "projects" / "docker" / "local-dns"
-    if not project_path.exists():
-        print(f"Директория проекта не найдена: {project_path}")
-        sys.exit(1)
-    
-    os.chdir(project_path)
-    return project_path

scripts/restart_services.py

@@ -1,22 +0,0 @@
-# restart_services.py
-from common import *
-
-def main():
-    print("Перезапуск сервисов...")
-    
-    # Настройка проекта
-    setup_project()
-    
-    # Перезапускаем контейнеры
-    print("Перезапуск контейнеров...")
-    if not run_docker_command("docker-compose restart"):
-        print("Не удалось перезапустить контейнеры")
-        # Если restart не сработал, пробуем поднять контейнеры
-        if not run_docker_command("docker-compose up -d"):
-            print("Не удалось поднять контейнеры")
-            sys.exit(1)
-    
-    print("Сервисы перезапущены!")
-
-if __name__ == "__main__":
-    main()

vhost.d/_local

@@ -1,2 +0,0 @@
-ssl_certificate /etc/nginx/certs/wildcard.local.pem;
-ssl_certificate_key /etc/nginx/certs/wildcard.local.key;