services:
  dokuwiki:
    image: lscr.io/linuxserver/dokuwiki:latest
    container_name: dokuwiki
    ports:
      - 30080:80
    volumes:
      - ./data:/config
    environment:
      - TZ=Asia/Tokyo
      - PUID=1000
      - PGID=1000
    restart: always

$conf['basedir'] = '/dokuwiki/';

services:
  gitlab:
    #image: gitlab/gitlab-ce:17.9.1-ce.0
    #image: gitlab/gitlab-ce:17.11.7-ce.0
    #image: gitlab/gitlab-ce:18.2.8-ce.0
    image: gitlab/gitlab-ce:18.5.2-ce.0
    container_name: gitlab
    ports:
      - "22022:22"
      - "22080:80"
      - "22443:443"
    volumes:
      - ./gitlab/config:/etc/gitlab
      - ./gitlab/logs:/var/log/gitlab
      - ./gitlab/data:/var/opt/gitlab
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://ydlprog.ddns.net/gitlab/'
        gitlab_rails['gitlab_shell_ssh_port'] = 22022
    restart: always

docker exec -it gitlab grep "Password" /etc/gitlab/initial_root_password

# DB設定
DB_ROOT_PASSWORD=rootpass
DB_USER=user
DB_PASSWORD=password

# Port設定
HTTP_PORT=80
HTTPS_PORT=443

services:
  db:
    image: mariadb:latest
    container_name: wordpress_db
    volumes:
      - ./data/mariadb:/var/lib/mysql
    restart: always
    environment:
      MYSQL_DATABASE: wordpress
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
      MYSQL_USER: ${DB_USER}
      MYSQL_PASSWORD: ${DB_PASSWORD}

  wordpress:
    depends_on:
      - db
    image: wordpress:latest
    container_name: wordpress_web
    ports:
      - "${HTTP_PORT}:80"
      - "${HTTPS_PORT}:443"
    volumes:
      - ./data/html:/var/www/html
    restart: always
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_NAME: wordpress
      WORDPRESS_DB_USER: ${DB_USER}
      WORDPRESS_DB_PASSWORD: ${DB_PASSWORD}

# docker compose up -d

# BEGIN WordPress
# The directives (lines) between "BEGIN WordPress" and "END WordPress" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

php_value upload_max_filesize 512M
php_value post_max_size 512M

# END WordPress

# mkdir -p /home/docker/samba/shares
# chmod -R 777 /home/docker/samba/shares
# chown -R nobody:nogroup /home/docker/samba/shares

services:
  samba:
    image: dperson/samba:latest
    container_name: samba
    volumes:
      - /home/docker/samba/shares:/home/shares/samba
    ports:
      - "139:139"
      - "445:445"
    stdin_open: true
    tty: true
    environment:
      - TZ=Asia/Tokyo
      - USERID=65534    # nobody
      - GROUPID=65534   # nogroup
      - USER1=foo;123
      - USER2=bar;abc
        # name;path;browse;readonly;guest;users
      - SHARE1=pub;/home/shares/samba/pub;yes;no;no;foo,bar
      - SHARE2=foo;/home/shares/samba/foo;yes;no;no;foo
      - SHARE3=bar;/home/shares/samba/bar;yes;no;no;bar
    restart: always

foo:123
bar:abc

services:
  sftp:
    image: atmoz/sftp:latest
    container_name: sftp
    volumes:
      - /home/docker/sftp/users.conf:/etc/sftp/users.conf:ro
      - /home/docker/sftp/data/foo:/home/foo/upload
      - /home/docker/sftp/data/bar:/home/bar/upload
    ports:
      - "2222:22"
    # 接続に時間ががかる対策
    # https://github.com/atmoz/sftp/issues/341
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    # 自動起動
    restart: always

# mkdir -p /home/docker/sftp/data
# chmod -R 777 data

# docker compose up -d
# chmod -R 777 data/*

#! /bin/bash

ContainerName='sftp-server'

# 共有フォルダの作成
mkdir -p /home/docker/sftp/data
chmod 777 data

echo コンテナ削除
docker stop ${ContainerName}
docker rm ${ContainerName}

echo コンテナ作成と起動
docker compose up -d
chmod 777 data/*

echo Finish!

# openssl passwd -6 パスワード
$6$cMfxL7iiNcFzXg6Y$7PL3BcJ5C4zSbC00OUMN2s0F21wI7NzF4hMH/qW9npR.SoT10uB4wd/QVcrurLsAn7ob4TJieCt24lzrlf1LH.

foo:$6$cMfxL7iiNcFzXg6Y$7PL3BcJ5C4zSbC00OUMN2s0F21wI7NzF4hMH/qW9npR.SoT10uB4wd/QVcrurLsAn7ob4TJieCt24lzrlf1LH.:e
bar:abc

#! /bin/bash

# ユーザ名が引数で指定されているか判定
if [ -n "$1" ]; then
    USER="$1"
else
    echo
    echo "sftp用ユーザの追加"
    echo
    echo "  USAGE: ./add_sftp_usr.sh UserName"
    echo
    exit 1
fi

# パスワード生成
PASSWD=$(pwgen 16 1 -cnysB)↲
echo
echo "--- Password ---"
echo "${PASSWD}"

# パスワードのハッシュ生成
HASH=`openssl passwd -6 ${PASSWD}`
# echo "--- Hash ---"
# echo "${HASH}"
echo

# users.confに追加
printf "%s\n" "${USER}:${HASH}:e" >> users.conf

# ./add_sftp_usr.sh foo

--- Password ---
9;*P,mA{/s;p3~+k↲

# apt -y install certbot

# certbot certonly --standalone -d ドメイン名
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address or hit Enter to skip.
 (Enter 'c' to cancel): メールアドレス

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at:
https://letsencrypt.org/documents/LE-SA-v1.6-August-18-2025.pdf
You must agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: n
Account registered.
Requesting a certificate for ドメイン名

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/ドメイン名/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/ドメイン名/privkey.pem
This certificate expires on 2026-02-12.
These files will be updated when the certificate renews.

NEXT STEPS:
- The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

services:
  nginx:
    image: nginx:latest
    container_name: revproxy
    ports:
      - "80:80"
      - "443:443"
    restart: always

# docker compose up -d

# mkdir -p nginx/conf.d
# docker cp revproxy:/etc/nginx/nginx.conf nginx/
# docker cp revproxy:/etc/nginx/conf.d/default.conf nginx/conf.d

services:
  nginx:
    image: nginx:latest
    container_name: revproxy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/docker/nginx.conf:ro
      - ./nginx/conf.d/default.conf:/etc/nginx/conf.d/default.conf:ro
      - /etc/letsencrypt/live/ドメイン名:/etc/letsencrypt:ro
    restart: always

# http
server {
    listen              80;
    listen              [::]:80;
    server_name         _;

    # httpアクセスは全てhttpsへリダイレクト
    location / {
        return 301 https://$host$request_uri;
    }
}

# https
server {
    listen              443 ssl;
    listen              [::]:443 ssl;
    ssl_certificate     /etc/nginx/server.crt;
    ssl_certificate_key /etc/nginx/server.key;
    server_name         _;

    # エラーページ
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    # リバースプロキシ設定
    proxy_redirect                          off;
    proxy_set_header Host                   $host;
    proxy_set_header X-Real-IP              $remote_addr;
    proxy_set_header X-Forwarded-Host       $host;
    proxy_set_header X-Forwarded-Server     $host;
    proxy_set_header X-Forwarded-Proto      $scheme;
    proxy_set_header X-Forwarded-For        $proxy_add_x_forwarded_for;

    # WordPressへリバースプロキシ
    location / {
        client_max_body_size 512M;↲
        proxy_pass http://172.17.0.1:21080/;
    }

    # GitLabへリバースプロキシ
    location /gitlab {
        client_max_body_size 1000M;
        proxy_pass http://172.17.0.1:22080/gitlab;
    }
}

# apt -y install docker.io docker-compose

# cat /etc/hostname

# vi /etc/hostname

# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: eno1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether ??:??:??:??:??:?? brd ff:ff:ff:ff:ff:ff
    altname enp2s0
    altname enx????????????
3: enp4s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether ??:??:??:??:??:?? brd ff:ff:ff:ff:ff:ff
    altname enx????????????
    inet 192.168.103.213/24 brd 192.168.103.255 scope global dynamic noprefixroute enp4s0
       valid_lft 85836sec preferred_lft 75036sec
    inet6 240d:1a:3ce:ba00:4943:9310:ce3f:d58d/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 86341sec preferred_lft 86341sec
    inet6 fe80::12b:5152:6c1e:fc50/64 scope link 
       valid_lft forever preferred_lft forever
4: wlp3s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether ??:??:??:??:??:?? brd ff:ff:ff:ff:ff:ff
    altname wlx????????????

# lshw -C network
  *-network DISABLED
       description: Ethernet interface
       product: RTL8111/8168/8211/8411 PCI Express Gigabit Ethernet Controller
       vendor: Realtek Semiconductor Co., Ltd.
       logical name: eno1
  *-network DISABLED
       description: Wireless interface
       product: Wi-Fi 6 AX200
       vendor: Intel Corporation
       logical name: wlp3s0
  *-network
       description: Ethernet interface
       product: Ethernet Controller I226-V
       vendor: Intel Corporation
       logical name: enp4s0

# cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug enp4s0
iface enp4s0 inet dhcp

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug enp4s0
iface enp4s0 inet static
    address         192.168.103.103
    netmask         255.255.255.0
    network         192.168.103.0
    broadcast       192.168.103.255
    gateway         192.168.103.1
    dns-nameservers 192.168.103.1

# systemctl restart ifup@enp4s0

# cp /etc/ssh/sshd_config /etc/ssh/sshd_config.org

# ss -atnu
Netid       State        Recv-Q       Send-Q               Local Address:Port                Peer Address:Port       
tcp         LISTEN       0            128                        0.0.0.0:22                       0.0.0.0:*          
tcp         ESTAB        0            52                 192.168.103.103:22               192.168.103.126:61628      
tcp         LISTEN       0            128                           [::]:22                          [::]:*    

$ ssh-keygen 
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/hoge/.ssh/id_ed25519): 
Enter passphrase for "/home/hoge/.ssh/id_ed25519" (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/hoge/.ssh/id_ed25519
Your public key has been saved in /home/hoge/.ssh/id_ed25519.pub
The key fingerprint is:
SHA256:mmhImSeMBGgMLZSzXxm0tO12/aaOgY38qwUWBENo6Ug hoge@ylocalhost
The key's randomart image is:
+--[ED25519 256]--+
|Bo. =*..         |
|+E.+..*          |
|oo*  ooo         |
|.= + o. . .      |
|. B o  =S. .     |
| . = .+o*   .    |
|  . o o+ +   o   |
|   .    o o o    |
|       ..+oo     |
+----[SHA256]-----+

$ rm .ssh/id_ed25519
$ mv .ssh/id_ed25519.pub .ssh/authorized_keys