{"id":18111493,"url":"https://github.com/navarrothiago/d-stunnel","last_synced_at":"2026-05-17T02:04:46.770Z","repository":{"id":124684060,"uuid":"538786037","full_name":"navarrothiago/d-stunnel","owner":"navarrothiago","description":"Original project: https://git.charlesreid1.com/docker/d-stunnel.git","archived":false,"fork":false,"pushed_at":"2022-09-20T03:01:17.000Z","size":39,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-10-31T16:21:10.160Z","etag":null,"topics":["docker","openssl","proxy","stunnel","tls"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/navarrothiago.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-09-20T02:58:04.000Z","updated_at":"2022-09-20T14:48:59.000Z","dependencies_parsed_at":null,"dependency_job_id":"50ed003f-b809-42ce-b95d-580f518fc40b","html_url":"https://github.com/navarrothiago/d-stunnel","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/navarrothiago/d-stunnel","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/navarrothiago%2Fd-stunnel","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/navarrothiago%2Fd-stunnel/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/navarrothiago%2Fd-stunnel/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/navarrothiago%2Fd-stunnel/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/navarrothiago","download_url":"https://codeload.github.com/navarrothiago/d-stunnel/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/navarrothiago%2Fd-stunnel/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33125184,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-16T18:38:32.183Z","status":"online","status_checked_at":"2026-05-17T02:00:05.366Z","response_time":107,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","openssl","proxy","stunnel","tls"],"created_at":"2024-11-01T01:05:46.996Z","updated_at":"2026-05-17T02:04:46.735Z","avatar_url":"https://github.com/navarrothiago.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# d-stunnel\n\nDockerfile to build an stunnel docker container.\n\nYou can edit the Dockerfile and use it to create the docker container,\nor you can use one of the template Dockerfiles.\n\n## TL;DR\n\nRun `make x` to make a docker container that runs service x.\n\nThe repo has several pre-configured stunnel configurations:\n* rsync\n* ssh\n\nTo create a Docker container to run service x, add the following:\n* Makefile rule to build service x\n* `build_x.sh` script \n* `run_x.sh` script\n* `Dockerfile_x_stunnel` Dockerfile to build the container\n* `start_x_stunnel.sh` script (used by the Docker container)\n\nThen do the following:\n\n## Stunnel Setup: Certificates\n\n### Creating Self-Signed Certificate\n\nThe `generate_cert.sh` script will run the commands required to generate a self-signed certificate.\nThis is not signed by any certificate authority and will usually cause big red errors on modern browsers.\n\n```plain\n$ ./generate_cert.sh\n```\n\nThis will result in a private key `key.pem` and a server certificate `cert.pem`,\nwhich are both concatenated into `stunnel.pem`. \n\nLet's Encrypt provides a free certificate authority signing service, so that's a better way to go.\n\n### Creating Certificate with Lets Encrypt\n\nLet's Encrypt provides you with an SSL certificate that is signed by \na nonprofit certificate authority, so it is free for everyone.\n\nThe Let's Encrypt procedure results in a set of four key files,\ncontained in `/etc/letsencrypt/live/domain.com/`:\n\n```plain\n$ ls /etc/letsencrypt/live/domain.com/\nREADME\ncert.pem@\t --\u003e /etc/letsencrypt/archive/domain.com/cert2.pem\nchain.pem@\t --\u003e /etc/letsencrypt/archive/domain.com/chain2.pem\nfullchain.pem@\t --\u003e /etc/letsencrypt/archive/domain.com/fullchain2.pem\nprivkey.pem@\t --\u003e /etc/letsencrypt/archive/domain.com/privkey2.pem\n```\n\nWe will use the following two keys (descriptions from README): \n\n```plain\n`privkey.pem`  : the private key for your certificate.\n`fullchain.pem`: the certificate file used in most server software.\n```\n\n### Getting Certificates into Docker Container\n\nCopy these to the directory where you will be spawning the Docker containers. \nWe make copies because the Let's Encrypt keys are owned by root and we want to keep them that way, \nbut we also want a portable key solution.\n\n```plain\n$ sudo cp /etc/letsencrypt/live/domain.com/{privkey.pem,fullchain.pem} /home/zappa/docker/stunnel/.\n$ sudo chown zappa:zappa /home/zappa/docker/stunnel/*.pem\n$ sudo chmod 600 /home/zappa/docker/stunnel/*.pem\n```\n\nThe Dockerfile is configured to copy these two .pem files into the Docker container when it is being built.\n\n\n\n## Stunnel Configuration Files\n\nSeveral stunnel configuation files available, client and server files provided to make Docker easy to set up on either end.\n\nThese config files work independent of Docker:\n\n```\nstunnel.client.http_over_8000.conf\nstunnel.server.http_over_8000.conf\n\nstunnel.client.ssh_over_443.conf\nstunnel.server.ssh_over_443.conf\n```\n\nSee [Stunnel/HTTPS](https://charlesreid1.com/wiki/Stunnel/HTTPS), \n[Stunnel/Client](https://charlesreid1.com/wiki/Stunnel/Client), and \n[Stunnel/Server](https://charlesreid1.com/wiki/Stunnel/Server) for details about how to run stunnel and configure it.\n\nThese config files are known configurations that work but are just examples. \nCopy your final stunnel config file to `stunnel.conf` before running the stunnel Docker container.\n\n\n\n\n## Running Stunnel Docker Container\n\nYou can run the stunnel Docker container by editing the `run.sh` script, verifying it is ok, and running:\n\n```\n$ ./run.sh\n```\n\nThis will start the container and give you a bash shell in the container machine.\n\n### Docker Container Test\n\nNow, stunnel is supposed to start automatically when the container is created.\nWe can test if the Docker container and the stunnel command actually worked \nby starting a bash shell in the docker container. When you get the shell, \nrun the stunnel command.\n\n```plain\n$ docker run -ti cmr_stunnel /bin/bash\nroot@c9b9b1f0ce80:/# stunnel\nstunnel: LOG5[ui]: stunnel 5.30 on x86_64-pc-linux-gnu platform\nstunnel: LOG5[ui]: Compiled with OpenSSL 1.0.2e 3 Dec 2015\nstunnel: LOG5[ui]: Running  with OpenSSL 1.0.2g  1 Mar 2016\nstunnel: LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel\nstunnel: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP\nstunnel: LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf\nstunnel: LOG5[ui]: UTF-8 byte order mark not detected\nstunnel: LOG5[ui]: FIPS mode disabled\nstunnel: LOG4[ui]: Insecure file permissions on /etc/stunnel/stunnel.key.pem\nstunnel: LOG4[ui]: Service [http] needs authentication to prevent MITM attacks\nstunnel: LOG5[ui]: Configuration successful\nroot@c9b9b1f0ce80:/#\n```\n\n\n\n## Networking\n\n### Binding Stunnel Server Listening Port \n\nSee [this very nice guide to Docker container networking](https://www.ctl.io/developers/blog/post/docker-networking-rules/).\n\nIn essence, we want to bind a host port to a container port using the `-p` flag with the docker run command:\n\nThe syntax is\n\n```plain\n-p \u003chost port\u003e:\u003ccontainer port\u003e\n```\n\nIf you're forwarding SSH traffic over port 443, for example, you'll want to add the following to the docker run command:\n\n```plain\n-p 443:443 -p 22:22\n```\n\nThat way, incoming traffic on 443 can come in, and outgoing forwarded traffic on 22 can get out.\n\n\n### Sharing Network Interface\n\nThe other key piece of networking with stunnel in a Docker container is for the container to share the network interface of the host,\nto prevent the host from needing a dedicated listener to Docker's ports. \n\nDo this by adding the following flag to the docker run command:\n\n```plain\n\t--network=host \\\n```\n\n\n## Final Run Script\n\nHere is the run script to run the docker container `cmr_stunnel` with the configuration mentioned above (server listening on 443, forwarding SSH traffic to port 22):\n\n```\n#!/bin/sh\n#\n# Run the docker container\n#\n# http://charlesreid1.com/wiki/Docker/Basics\n\ndocker run \\\n\t--network=host \\\n\t-p 443:443 -p 22:22 \\\n\t-ti cmr_stunnel \\\n\t/bin/bash\n```\n\n`docker port` will only display ports bound to the host while the container is running.\n\nNote that you may or may not need to SSH as root, depending. Make sure you try both.\n\n\n\n## More Examples\n\nAlso see the charlesreid1.com wiki:\n\n[Stunnel/SSH](https://charlesreid1.com/wiki/Stunnel/SSH)\n\n[Stunnel/Scp](https://charlesreid1.com/wiki/Stunnel/Scp)\n\n[Stunnel/HTTP](https://charlesreid1.com/wiki/Stunnel/HTTP)\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnavarrothiago%2Fd-stunnel","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnavarrothiago%2Fd-stunnel","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnavarrothiago%2Fd-stunnel/lists"}