BunkerWeb provides several features, among them are:<\/p>\n\n\n\n
- \n
- Easy Integration into Existing Environments<\/strong>: BunkerWeb seamlessly integrates with Linux, Docker, Swarm, and Kubernetes, making it simple to incorporate into your existing infrastructure and workflow.<\/li>\n\n\n\n
- Highly Customizable<\/strong>: With BunkerWeb, you have the flexibility to customize and fine-tune its features to meet your specific use case. You can easily enable, disable, and configure different functionalities according to your requirements.<\/li>\n\n\n\n
- Secure by Default<\/strong>: BunkerWeb prioritizes security by providing out-of-the-box and hassle-free minimal security measures for your web services. It is designed to ensure your applications and data are protected without requiring extensive configuration efforts.<\/li>\n\n\n\n
- Free as in “Freedom”<\/strong>: BunkerWeb is licensed under the free AGPLv3 license, offering you the freedom to use, modify, and distribute the software. This license promotes openness and community collaboration.<\/li>\n\n\n\n
- Security features such as:<\/strong>\n
- \n
- HTTPS Support with Let’s Encrypt Automation: BunkerWeb seamlessly integrates with Let’s Encrypt to automate the process of obtaining and renewing SSL\/TLS certificates, ensuring secure communication with HTTPS.<\/li>\n\n\n\n
- State-of-the-Art Web Security Measures: BunkerWeb implements various advanced web security measures, including HTTP security headers to enhance protection, prevention of information leaks, and robust TLS hardening configurations.<\/li>\n\n\n\n
- Integrated ModSecurity WAF with OWASP Core Rule Set: BunkerWeb includes an integrated ModSecurity Web Application Firewall (WAF) that leverages the OWASP Core Rule Set, providing an additional layer of defence against web-based attacks and vulnerabilities.<\/li>\n\n\n\n
- Automatic Behavior-Based Ban: BunkerWeb monitors and detects unusual behaviour from clients and automatically blocks them based on HTTP status codes, helping prevent malicious activities.<\/li>\n\n\n\n
- Connections and Requests Limit: BunkerWeb allows you to set limits on client connections and requests, helping to mitigate potential abuse or resource exhaustion.<\/li>\n\n\n\n
- Bot Blocking with Challenge Response: BunkerWeb offers the ability to block bots by presenting them with challenges to solve, such as cookies, JavaScript execution, captchas, hCaptcha, or reCAPTCHA, effectively filtering out automated malicious activities.<\/li>\n\n\n\n
- Blacklisting Known Bad IPs with External Blacklists and DNSBL: BunkerWeb enables the use of external blacklists and DNS-based blackhole lists (DNSBL) to automatically block connections from known malicious IP addresses.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
Now let’s learn how to run Nginx Web Server in Docker Container using BunkerWeb.<\/p>\n\n\n\n
#1. Install Docker and Docker Compose<\/h2>\n\n\n\n
This guide requires you to have Docker Engine and Docker Compose installed. To install Docker, follow the below guide:<\/p>\n\n\n\n
- \n
- How To Install Docker CE on Linux Systems<\/a><\/li>\n<\/ul>\n\n\n\n
After the installation, ensure that docker has been started and enabled:<\/p>\n\n\n\n
sudo systemctl enable --now docker<\/code><\/pre>\n\n\n\nYou also need to add your system user to the docker group:<\/p>\n\n\n\n
sudo usermod -aG docker $USER\nnewgrp docker<\/code><\/pre>\n\n\n\nVerify the docker installation.<\/p>\n\n\n\n
$ docker version<\/mark>\nClient: Docker Engine - Community\n Version: 23.0.6\n API version: 1.42\n Go version: go1.19.9\n Git commit: ef23cbc\n Built: Fri May 5 21:18:22 2023\n OS\/Arch: linux\/amd64\n Context: default\n\nServer: Docker Engine - Community\n Engine:\n Version: 23.0.6\n API version: 1.42 (minimum version 1.12)\n Go version: go1.19.9\n Git commit: 9dbdbd4\n Built: Fri May 5 21:18:22 2023\n OS\/Arch: linux\/amd64\n......<\/code><\/pre>\n\n\n\nYou can also install docker-compose using the guide:<\/p>\n\n\n\n
- \n
- How To Install Docker Compose on Linux<\/a><\/li>\n<\/ul>\n\n\n\n
Once installed, verify with the command:<\/p>\n\n\n\n
$ docker-compose version<\/mark>\nDocker Compose version v2.18.0<\/code><\/pre>\n\n\n\n#2. Provision BunkerWeb Container<\/h2>\n\n\n\n
When dealing with BunkerWeb, there are several concepts we need to be aware of. These concepts include:<\/p>\n\n\n\n
- \n
- Integrations<\/strong><\/li>\n<\/ul>\n\n\n\n
The primary focus is on seamlessly integrating BunkerWeb into the target environment. The term “integration” is preferred over “installation” since BunkerWeb aims to harmoniously become a part of existing environments. The supported integrations are Docker, Docker autoconf, Swarm, Kubernetes, Linux and Ansible.<\/p>\n\n\n\n
- \n
- Settings<\/strong><\/li>\n<\/ul>\n\n\n\n
Once BunkerWeb is seamlessly integrated into your environment, the next step involves configuring it to effectively serve and safeguard your web applications.<\/p>\n\n\n\n
Configuration of BunkerWeb revolves around the utilization of “settings” or “variables.” Each setting is associated with a specific name, such as AUTO_LETS_ENCRYPT<\/em><\/strong> or USE_ANTIBOT<\/strong><\/em>, for instance. By assigning values to these settings, you can tailor BunkerWeb to meet your specific configuration requirements.<\/p>\n\n\n\n
- \n
- Multisite mode<\/strong><\/li>\n<\/ul>\n\n\n\n
When utilizing BunkerWeb, understanding the concept of multisite mode becomes essential. The primary objective of safeguarding web applications naturally incorporates the notion of “virtual host” or “vhost” (further information available here). This concept enables the seamless hosting of multiple web applications from a single instance or a cluster. By employing multisite mode, BunkerWeb empowers you to efficiently serve and protect multiple web applications simultaneously.<\/p>\n\n\n\n
When running BunkerWeb in docker containers, we observe the below architecture:<\/p>\n\n\n\n
![\"\"](\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2023\/05\/BunkerWeb-docker.png\" "\\"\\"")
<\/figure>\n\n\n\nThe utilization and configuration of the BunkerWeb container revolve around the following components:<\/p>\n\n\n\n
- \n
- Environment Variables<\/strong>: BunkerWeb allows you to configure and customize its behaviour using environment variables. These variables provide a flexible way to adapt BunkerWeb to your specific use cases and requirements.<\/li>\n\n\n\n
- Volume<\/strong>: BunkerWeb utilizes volumes to cache critical data and facilitate the mounting of custom configuration files. This enables you to persist important information and easily incorporate your own tailored configuration files into the BunkerWeb container.<\/li>\n\n\n\n
- Networks<\/strong>: BunkerWeb employs networks to expose ports, allowing clients to access the web services served by BunkerWeb. Additionally, networks enable seamless connectivity to upstream web services, ensuring smooth communication between BunkerWeb and other components of your environment.<\/li>\n<\/ul>\n\n\n\n
Now we will begin by creating a network for BunkerWeb:<\/p>\n\n\n\n
docker network create bw-net<\/mark><\/code><\/pre>\n\n\n\nWe also need to create a volume for BunkerWeb. Begin by creating a path on your host:<\/p>\n\n\n\n
sudo mkdir \/bw-datastore<\/mark><\/mark>\nsudo chmod 775 -R \/bw-datastore<\/mark><\/mark>\nsudo chown -R $USER:docker \/bw-datastore<\/mark><\/mark><\/code><\/pre>\n\n\n\nFor Rhel-based<\/strong> systems, configure SELinux as shown:<\/p>\n\n\n\n
sudo chcon -R -t svirt_sandbox_file_t \/bw-datastore<\/mark><\/code><\/pre>\n\n\n\nNow create a docker volume:<\/p>\n\n\n\n
docker volume create --driver local \\\n --opt type=none \\\n --opt device= \/bw-datastore<\/mark> \\\n --opt o=bind bw-data<\/code><\/pre>\n\n\n\nView the volume;<\/p>\n\n\n\n
$ docker volume ls<\/mark>\nDRIVER VOLUME NAME\nlocal bw-data<\/code><\/pre>\n\n\n\n#3. Run BunkerWeb Docker Container<\/h2>\n\n\n\n
Now to run and verify that BunkerWeb is working perfectly, we need to deploy and application for the test. For this demo, we can use a sample app then create reverse proxy using Bunkerweb.<\/p>\n\n\n\n
Now we will proceed and run the BunkerWeb Docker container. This can be done in two ways:<\/p>\n\n\n\n
- \n
- Uisng Docker CLI<\/li>\n\n\n\n
- Using Docker Compose<\/li>\n<\/ul>\n\n\n\n
Option 1: Run BunkerWeb Using Docker CLI<\/h3>\n\n\n\n
Begin by spinning the demon app with the command:<\/p>\n\n\n\n
docker run -d \\\n --name myapp \\\n --network bw-net \\\n nginxdemos\/hello:plain-text<\/code><\/pre>\n\n\n\nThen spin the BunkerWeb container with the command bearing the below syntax:<\/p>\n\n\n\n
docker run -d \\\n --name mybunker<\/mark> \\\n --network bw-net<\/mark> \\\n -p 80:8080 \\\n -p 443:8443 \\\n -v bw-data:\/data \\\n -e SERVER_NAME=web.computingforgeeks.com<\/mark> \\\n -e USE_REVERSE_PROXY=yes \\\n -e REVERSE_PROXY_URL=\/ \\\n -e REVERSE_PROXY_HOST=http:\/\/myapp \\\n bunkerity\/bunkerweb:1.4.8<\/code><\/pre>\n\n\n\nIn the above command, we have set reverse proxy for the app we deployed earlier on the URL http:\/\/myapp<\/strong><\/em>.<\/p>\n\n\n\n
View if the containers are running:<\/p>\n\n\n\n
$ docker ps<\/mark>\nCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES\n1a4dbded0a42 bunkerity\/bunkerweb:1.4.8 \"\/opt\/bunkerweb\/help\u2026\" 3 seconds ago Up 2 seconds (health: starting) 80\/tcp, 0.0.0.0:80->8080\/tcp, :::80->8080\/tcp, 0.0.0.0:443->8443\/tcp, :::443->8443\/tcp mybunker\nb669d3fa1eb4 nginxdemos\/hello:plain-text \"\/docker-entrypoint.\u2026\" 4 minutes ago Up 4 minutes 80\/tcp myapp<\/code><\/pre>\n\n\n\nOption 2: Run BunkerWeb Using Docker Compose<\/h3>\n\n\n\n
It is also possible to run the BunkerWeb and the test app containers using a single Docker Compose file. First, create the file:<\/p>\n\n\n\n
vim docker-compose.yml<\/code><\/pre>\n\n\n\nIn the file, add the lines below, replacing where required:<\/p>\n\n\n\n
version: '3'\n\nservices:\n mybunker:\n container_name: mybunker<\/mark>\n image: bunkerity\/bunkerweb:1.4.8\n ports:\n - 80:8080\n - 443:8443\n volumes:\n - bw-data:\/data\n environment:\n - SERVER_NAME=web.computingforgeeks.com<\/mark>\n - USE_REVERSE_PROXY=yes\n - REVERSE_PROXY_URL=\/\n - REVERSE_PROXY_HOST=http:\/\/myapp\n networks:\n - bw-net\n\n myapp:\n container_name: myapp<\/mark>\n image: nginxdemos\/hello:plain-text\n networks:\n - bw-net\n\nvolumes:\n bw-data:\n\nnetworks:\n bw-net:\n name: bw-net<\/code><\/pre>\n\n\n\nSave the file and run the containers with the command:<\/p>\n\n\n\n
docker-compose up -d<\/code><\/pre>\n\n\n\nView if the containers are running:<\/p>\n\n\n\n
$ docker-compose ps<\/mark>\nNAME IMAGE COMMAND SERVICE CREATED STATUS PORTS\nthor-myapp-1 nginxdemos\/hello:plain-text \"\/docker-entrypoint.\u2026\" myapp 22 seconds ago Up 21 seconds 80\/tcp\nthor-mybunker-1 bunkerity\/bunkerweb:1.4.8 \"\/opt\/bunkerweb\/help\u2026\" mybunker 22 seconds ago Up 21 seconds (healthy) 80\/tcp, 0.0.0.0:80->8080\/tcp, :::80->8080\/tcp, 0.0.0.0:443->8443\/tcp, :::443->8443\/tcp<\/code><\/pre>\n\n\n\nTest Access to Appication<\/h3>\n\n\n\n
If the containers are running, we can test if BunkerWeb is handling the requests as desired. We can use cURL as shown:<\/p>\n\n\n\n
curl web.computingforgeeks.com<\/code><\/pre>\n\n\n\nSample Output:<\/p>\n\n\n\n
![\"\"](\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2023\/05\/Nginx-Web-Server-in-Docker-Container-using-BunkerWeb-1.png\" "\\"\\"")
<\/figure>\n\n\n\nYou can also load the page on your browser using the URL http:\/\/web.computingforgeeks.com<\/a><\/p>\n\n\n\n
![\"\"](\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2023\/05\/Nginx-Web-Server-in-Docker-Container-using-BunkerWeb.png\" "\\"\\"")
<\/figure>\n\n\n\n#4. Run BunkerWeb Containers With Multiple Applications<\/h2>\n\n\n\n
There are scenarios where you have several applications that need a reverse proxy. BunkerWeb is capable of handling the traffic and proxy the requests as required.<\/p>\n\n\n\n
- \n
- For Docker CLI<\/strong><\/li>\n<\/ul>\n\n\n\n
Begin by spinning the apps:<\/p>\n\n\n\n
##APP1\n<\/mark><\/em>docker run -d \\\n --name myapp1 \\\n --network bw-net \\\n nginxdemos\/hello:plain-text\n\n##APP2\n<\/mark><\/em>docker run -d \\\n --name myapp2 \\\n --network bw-net \\\n nginxdemos\/hello:plain-text\n\n##APP3\n<\/mark><\/em>docker run -d \\\n --name myapp3 \\\n --network bw-net \\\n nginxdemos\/hello:plain-text<\/code><\/pre>\n\n\n\nProceed and spin BunkerWeb:<\/p>\n\n\n\n
docker run -d \\\n --name mybunker \\\n --network bw-net \\\n -p 80:8080 \\\n -p 443:8443 \\\n -v bw-data:\/data \\\n -e MULTISITE=yes \\\n -e \"SERVER_NAME=myapp1.computingforgeeks.com myapp2.computingforgeeks.com myapp3.computingforgeeks.com\" \\\n -e USE_REVERSE_PROXY=yes \\\n -e REVERSE_PROXY_URL=\/ \\\n -e myapp1.computingforgeeks.com_REVERSE_PROXY_HOST=http:\/\/myapp1 \\\n -e myapp2.computingforgeeks.com_REVERSE_PROXY_HOST=http:\/\/myapp2 \\\n -e myapp3.computingforgeeks.com_REVERSE_PROXY_HOST=http:\/\/myapp3 \\\n bunkerity\/bunkerweb:1.4.8<\/code><\/pre>\n\n\n\nView if the containers are running:<\/p>\n\n\n\n
$ docker ps<\/mark>\nCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES\n56cb582c7d5e bunkerity\/bunkerweb:1.4.8 \"\/opt\/bunkerweb\/help\u2026\" 5 seconds ago Up 4 seconds (health: starting) 80\/tcp, 0.0.0.0:80->8080\/tcp, :::80->8080\/tcp, 0.0.0.0:443->8443\/tcp, :::443->8443\/tcp mybunker\n42d995f8acb6 nginxdemos\/hello:plain-text \"\/docker-entrypoint.\u2026\" 20 seconds ago Up 19 seconds 80\/tcp myapp3\n6ab7df943bf2 nginxdemos\/hello:plain-text \"\/docker-entrypoint.\u2026\" 24 seconds ago Up 23 seconds 80\/tcp myapp2\n4e84d030f8c9 nginxdemos\/hello:plain-text \"\/docker-entrypoint.\u2026\" 28 seconds ago Up 27 seconds 80\/tcp myapp1<\/code><\/pre>\n\n\n\n- \n
- Using Docker Compose<\/strong><\/li>\n<\/ul>\n\n\n\n
You can spin all your apps and BunkerWeb with a single file:<\/p>\n\n\n\n
vim docker-compose.yml<\/code><\/pre>\n\n\n\nAdd the lines below to it:<\/p>\n\n\n\n
version: '3'\n\nservices:\n mybunker:\n container_name: mybunker\n image: bunkerity\/bunkerweb:1.4.8\n ports:\n - 80:8080\n - 443:8443\n volumes:\n - bw-data:\/data\n environment:\n - MULTISITE=yes\n - SERVER_NAME=myapp1.computingforgeeks.com myapp2.computingforgeeks.com myapp3.computingforgeeks.com\n - USE_REVERSE_PROXY=yes\n - REVERSE_PROXY_URL=\/\n - myapp1.computingforgeeks.com_REVERSE_PROXY_HOST=http:\/\/myapp1\n - myapp2.computingforgeeks.com_REVERSE_PROXY_HOST=http:\/\/myapp2\n - myapp3.computingforgeeks.com_REVERSE_PROXY_HOST=http:\/\/myapp3\n networks:\n - bw-net\n\n myapp1:\n container_name: myapp1\n image: nginxdemos\/hello:plain-text\n networks:\n - bw-net\n\n myapp2:\n container_name: myapp2\n image: nginxdemos\/hello:plain-text\n networks:\n - bw-net\n\n myapp3:\n container_name: myapp3\n image: nginxdemos\/hello:plain-text\n networks:\n - bw-net\n\nvolumes:\n bw-data:\n\nnetworks:\n bw-net:\n name: bw-net<\/code><\/pre>\n\n\n\nRun the containers:<\/p>\n\n\n\n
docker-compose up -d<\/code><\/pre>\n\n\n\nView if the containers are up:<\/p>\n\n\n\n
$ docker ps<\/mark>\nCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES\n385de3ddfa7b nginxdemos\/hello:plain-text \"\/docker-entrypoint.\u2026\" 21 seconds ago Up 19 seconds 80\/tcp myapp1\n0e3f8980f23b nginxdemos\/hello:plain-text \"\/docker-entrypoint.\u2026\" 21 seconds ago Up 19 seconds 80\/tcp myapp3\n25dd1f4be099 nginxdemos\/hello:plain-text \"\/docker-entrypoint.\u2026\" 21 seconds ago Up 19 seconds 80\/tcp myapp2\n4c3fdf996b05 bunkerity\/bunkerweb:1.4.8 \"\/opt\/bunkerweb\/help\u2026\" 21 seconds ago Up 19 seconds (healthy) 80\/tcp, 0.0.0.0:80->8080\/tcp, :::80->8080\/tcp, 0.0.0.0:443->8443\/tcp, :::443->8443\/tcp mybunker<\/code><\/pre>\n\n\n\nTest Access to the Applications<\/h3>\n\n\n\n
To test if you are able to access the sites, first, modify your \/etc\/hosts file:<\/p>\n\n\n\n
$ sudo vim \/etc.hosts<\/mark>\n192.168.200.51 myapp1.computingforgeeks.com myapp2.computingforgeeks.com myapp3.computingforgeeks.com<\/code><\/pre>\n\n\n\nNow you can use cURL as shown below to verify if BunkerWeb is working:<\/p>\n\n\n\n
curl myapp1.computingforgeeks.com \ncurl myapp2.computingforgeeks.com \ncurl myapp3.computingforgeeks.com<\/code><\/pre>\n\n\n\nSample Output:<\/p>\n\n\n\n
![\"\"](\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2023\/05\/Nginx-Web-Server-in-Docker-Container-using-BunkerWeb-2.png\" "\\"\\"")
<\/figure>\n\n\n\nYou can also use a web browser with the required URL for example:<\/p>\n\n\n\n
APP1:<\/p>\n\n\n\n
![\"\"](\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2023\/05\/Nginx-Web-Server-in-Docker-Container-using-BunkerWeb-3.png\" "\\"\\"")
<\/figure>\n\n\n\nAPP2<\/p>\n\n\n\n
![\"\"](\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2023\/05\/Nginx-Web-Server-in-Docker-Container-using-BunkerWeb-4.png\" "\\"\\"")
<\/figure>\n\n\n\nAPP3<\/p>\n\n\n\n
![\"\"](\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2023\/05\/Nginx-Web-Server-in-Docker-Container-using-BunkerWeb-5.png\" "\\"\\"")
<\/figure>\n\n\n\n#5. Configure HTTPS on BunkerWeb<\/h2>\n\n\n\n
It is also important to secure traffic using HTTPS. BunkerWeb allows you to use Let’s Encrypt, Custom certificate and Self-signed certs when protecting your traffic.<\/p>\n\n\n\n
To enable HTTPS, you can use the below environment variables:<\/p>\n\n\n\n
- Using Docker Compose<\/strong><\/li>\n<\/ul>\n\n\n\n
- For Docker CLI<\/strong><\/li>\n<\/ul>\n\n\n\n
- Volume<\/strong>: BunkerWeb utilizes volumes to cache critical data and facilitate the mounting of custom configuration files. This enables you to persist important information and easily incorporate your own tailored configuration files into the BunkerWeb container.<\/li>\n\n\n\n
- Environment Variables<\/strong>: BunkerWeb allows you to configure and customize its behaviour using environment variables. These variables provide a flexible way to adapt BunkerWeb to your specific use cases and requirements.<\/li>\n\n\n\n
- Multisite mode<\/strong><\/li>\n<\/ul>\n\n\n\n
- Settings<\/strong><\/li>\n<\/ul>\n\n\n\n
- Integrations<\/strong><\/li>\n<\/ul>\n\n\n\n
- How To Install Docker Compose on Linux<\/a><\/li>\n<\/ul>\n\n\n\n
- How To Install Docker CE on Linux Systems<\/a><\/li>\n<\/ul>\n\n\n\n
- Highly Customizable<\/strong>: With BunkerWeb, you have the flexibility to customize and fine-tune its features to meet your specific use case. You can easily enable, disable, and configure different functionalities according to your requirements.<\/li>\n\n\n\n
![\"\"](\"https:\/\/computingforgeeks.com\/wp-content\/uploads\/2023\/05\/Nginx-Web-Server-in-Docker-Container-using-BunkerWeb-6.png\" "\\"\\"")
<\/figure>\n\n\n\n