## ROS2 系统安装

1. 设置编码
```shell
sudo apt update && sudo apt install -y locales
sudo locale-gen en_US en_US.UTF-8
sudo update-locale LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 
export LANG=en_US.UTF-8
```
2. 添加安装源
```shell
sudo apt update
sudo wget https://raw.githubusercontent.com/ros/rosdistro/master/ros.key -O /usr/share/keyrings/ros-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/ros-archive-keyring.gpg] https://mirrors.cloud.tencent.com/ros2/ubuntu $(source /etc/os-release && echo $UBUNTU_CODENAME) main" | sudo tee /etc/apt/sources.list.d/ros2.list > /dev/null
```
如遇报错“Failed to connect to raw.githubusercontent.com”，可[参考](https://www.guyuehome.com/37844)

3. 安装ROS2
```shell
sudo apt update
# sudo apt install ros-iron-desktop # 最新发行版
sudo apt install -y ros-humble-desktop # 长期支持版
sudo apt install -y ros-humble-desktop-full # 全家桶
```
4. 设置环境变量
```shell
echo "source /opt/ros/humble/setup.bash" >> ~/.bashrc
``` 
至此，ROS2就已经在系统中安装好了。

## 安装相关的开发工具
```shell
sudo apt install -y ros-dev-tools git # 开发工具
sudo rosdep init && rosdep update
```

## 开发环境配置

1. 创建工作空间
了解了工作空间的概念和结果，接下来我们可以使用如下命令创建一个工作空间，并且下载教程的代码：
```shell
mkdir -p ~/dev_ws/src
cd ~/dev_ws/src
git clone https://gitee.com/guyuehome/ros2_21_tutorials.git
```

2. 编译工作空间
依赖安装完成后，就可以使用如下命令编译工作空间啦，如果有缺少的依赖，或者代码有错误，编译过程中会有报错，否则编译过程应该不会出现任何错误：
```shell
cd ~/dev_ws/
rosdep install -i --from-path src --rosdistro humble -y
colcon build

# 跳过测试
colcon build --catkin-skip-building-tests
```

3. 设置环境变量
编译成功后，为了让系统能够找到我们的功能包和可执行文件，还需要设置环境变量：
```shell
source install/local_setup.sh # 仅在当前终端生效
echo "source ~/dev_ws/install/local_setup.sh" >> ~/.bashrc # 所有终端均生效
```
至此，我们就完成了工作空间的创建、编译和配置。



ROS2 开发环境搭建

配置免密登录
```shell
# 创建SSH密钥对。
ssh-keygen -t rsa -b 4096

# 获取SSH公钥。
cat ~/.ssh/id_rsa.pub

# 配置免密登录的服务器主机。
ssh-copy-id root@uing.vip
```

配置 root 用户登录
``` shell
vi /etc/ssh/sshd_config
# root 用户登录
# prohibit-password / without-password:禁止密码登录 root
# yes: 允许使用密码登录 root
# no: 禁止登录 root
# PermitRootLogin yes
# 能否使用密码登录SSH (包括其它用户)
# PasswordAuthentication no

echo "PermitRootLogin yes" | sudo tee /etc/ssh/sshd_config
systemctl restart sshd
```

解除（清除）信任主机公钥
```shell
ssh-keygen -R uing.vip
```

# SSH 跳板机连接方法
```bash
ssh username@目标机器IP -p 22 -J username@跳板机IP:22
```

产生64bit随机数
```bash
openssl rand -base64 64
```

---


### 遇到的问题

使用过时的密钥算法
```
Unable to negotiate with 192.168.2.21 port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss
```
解决
```shell
# 增加 -oHostKeyAlgorithms=+ssh-dss 选项
ssh -oHostKeyAlgorithms=+ssh-dss root@192.168.2.21
```



OpenSSH 笔记

## 自动HTTPS
当符合下面一些合理的标准时，Caddy会自动为所有站点启用HTTPS:

* 主机名
    - 不为空
    - 不是localhost
    - 不是一个IP地址
    - 不超过一个通配符（*）
    - 通配符必须是最左边的标签
* 没有显式指定端口为80
* 没有显式指定使用http协议
* TLS没有在站点的定义中被关闭
* 不是你自己提供的证书和密钥
* Caddy能够绑定到端口80和443（除非使用DNS验证）

Caddy还会将所有HTTP请求重定向到与HTTPS对应的地址，只要Caddyfile中没有定义主机名的纯文本变体。

---

## 安装部署
- docker-compose.yml
```yaml
version: "3"

services:
  caddy:
    container_name: caddy
    image: caddy:alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "80:80/udp"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./caddy/:/data/caddy/
```

- Caddyfile
```Caddyfile
:80 {
  redir https://{host}{uri}
}

uing.vip {
  log {
    output stdout
    format console
    level  ERROR
  }
  root * /var/www/uing.vip
  handle_errors {
    rewrite * /404.html
    file_server
  }
  file_server
}

gitea.uing.vip {
  log {
    output stdout
    format console
    level  ERROR
  }
  reverse_proxy gitea:3000
}

https://example.com {
  reverse_proxy localhost:8080 {
    header_up Host {host}
    header_up X-Real-IP {remote_host}
    header_up X-Forwarded-For {remote_host}
    header_up X-Forwarded-Proto {scheme}
  }
}
```

## 如果需要接入 Cloudflare CDN 上

1. 打开 https://dash.cloudflare.com/ 注册登录
2. 添加网站，更改域名的 DNS
3. 打开 https://dash.cloudflare.com/profile/api-tokens
4. API 令牌 -> 创建 API 令牌 -> 编辑区域 DNS -> 选择模板 -> 区域资源 -> 对应网站
3.  获取到的API KEY -> docker-compose.yml -> caddy 容器 -> 替换 CF_API_TOKEN 环境变量 -> 替换 DOMAIN 环境变量（也可以是二级或三级域名）
5. https://dash.cloudflare.com -> 对应网站
6. SSL/TLS -> 源服务器 -> 源证书 ->  经过身份验证的源服务器拉取 -> 打开
7. SSL/TLS -> 概述 -> 您的 SSL/TLS 加密模式为 -> 完全（严格）

- docker-compose.yml
```yaml
version: "3"
services:
  caddy:
    container_name: caddy
    build: 
      dockerfile: ./caddy-cloudflare-Dockerfile
    restart: unless-stopped
    ports:
      - "80:80"
      - "80:80/udp"
      - "443:443"
      - "443:443/udp"
    environment:
      - CF_API_TOKEN=XXX
      - DOMAIN=XXX
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./caddy:/data/caddy
```

- Caddyfile
```Caddyfile
{env.DOMAIN} {
  log {
    output stdout
    format console
    level  ERROR
  }
  reverse_proxy gitea:3000
}
```

- caddy-cloudflare-Dockerfile
```Dockerfile
FROM caddy:builder-alpine AS builder
RUN xcaddy build --with github.com/caddy-dns/cloudflare

FROM caddy:alpine
COPY --from=builder /usr/bin/caddy /usr/bin/caddy
```

## 接入到 DNS
- [Alibaba Cloud DNS](https://github.com/caddy-dns/alidns)
- [DNSPOD](https://github.com/caddy-dns/dnspod)
- [其它 DNS...](https://github.com/orgs/caddy-dns/repositories)

## 相关连接
- [Caddy Docs](https://caddyserver.com/docs)
- [Caddy v2中文文档](https://caddy2.dengxiaolong.com/docs/)
- [Caddy中文文档(V1)](https://dengxiaolong.com/caddy/zh/)
- [Cloudflare module for Caddy](https://github.com/caddy-dns/cloudflare)

Caddy2 - 能够自动申请证书的 HTTPS/HTTP 服务器

- docker-compose.yml
```yaml
version: "3"

services:
  caddy:
    container_name: caddy
    image: caddy:alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "80:80/udp"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
  harbor:
    container_name: harbor
    build:
      dockerfile: ./harbor-Dockerfile
    privileged: true
    volumes:
      - ./harbor/data:/data
      - ./harbor/harbor:/opt/harbor
```

- Caddyfile
```Caddyfile
registry.uing.vip {
  log {
    output stdout
    format console
    level  ERROR
  }
  reverse_proxy harbor:9000
}
```

- harbor-Dockerfile
```Dockerfile
FROM docker:dind
MAINTAINER cainiao <565499699@qq.com>

COPY harbor/harbor-entrypoint.sh /usr/local/bin/harbor-entrypoint.sh
COPY harbor/supervisord.conf /etc/supervisord.conf
COPY harbor/harbor.yml /harbor.yml

RUN apk add --no-cache supervisor && chmod a+x /usr/local/bin/harbor-entrypoint.sh

ENTRYPOINT ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"]
```

- harbor/harbor-entrypoint.sh
```bash
#!/bin/sh

if [ -f /opt/harbor/docker-compose.yml ]; then
    cd /opt/harbor/ && docker-compose up
else
    cd /opt
    apk add --no-cache --virtual .build_tools ncurses bash wget
    
    wget -O harbor-online-installer.tgz \
        https://github.com/goharbor/harbor/releases/download/v2.8.4/harbor-online-installer-v2.8.4.tgz \
        && tar xzf harbor-online-installer.tgz \
        && rm -f harbor-online-installer.tgz
    
    cd /opt/harbor
    
    cp -f /harbor.yml .
    bash ./install.sh

    apk del .build_tools
    
    docker-compose logs -f
fi
``` 

- harbor/supervisord.conf
```ini
[supervisord]
nodaemon=true

[program:dockerd]
command=/usr/local/bin/dockerd-entrypoint.sh
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
autostar=true
autorestart=true

[program:harbor]
command=/usr/local/bin/harbor-entrypoint.sh
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
autostar=true
autorestart=true
startsecs=3
```

- harbor/harbor.yml
```yaml
# Configuration file of Harbor

# The IP address or hostname to access admin UI and registry service.
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname: registry.uing.vip

# http related config
http:
  # port for http, default is 80. If https enabled, this port will redirect to https port
  port: 80

# # https related config
# https:
#   # https port for harbor, default is 443
#   port: 443
#   # The path of cert and key files for nginx
#   certificate: /your/certificate/path
#   private_key: /your/private/key/path


# # Uncomment following will enable tls communication between all harbor components
# internal_tls:
#   # set enabled to true means internal tls is enabled
#   enabled: true
#   # put your cert and key files on dir
#   dir: /etc/harbor/tls/internal
#   # enable strong ssl ciphers (default: false)
#   strong_ssl_ciphers: false

# Uncomment external_url if you want to enable external proxy
# And when it enabled the hostname will no longer used
external_url: https://registry.uing.vip

# The initial password of Harbor admin
# It only works in first time to install harbor
# Remember Change the admin password from UI after launching Harbor.
harbor_admin_password: XXXXXXXXXXXX

# Harbor DB configuration
database:
  # The password for the root user of Harbor DB. Change this before any production use.
  password: root123
  # The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained.
  max_idle_conns: 100
  # The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections.
  # Note: the default number of connections is 1024 for postgres of harbor.
  max_open_conns: 900
  # The maximum amount of time a connection may be reused. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's age.
  # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
  conn_max_lifetime: 5m
  # The maximum amount of time a connection may be idle. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's idle time.
  # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
  conn_max_idle_time: 0

# The default data volume
data_volume: /data

# Harbor Storage settings by default is using /data dir on local filesystem
# Uncomment storage_service setting If you want to using external storage
# storage_service:
#   # ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore
#   # of registry's containers.  This is usually needed when the user hosts a internal storage with self signed certificate.
#   ca_bundle:

#   # storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss
#   # for more info about this configuration please refer https://docs.docker.com/registry/configuration/
#   filesystem:
#     maxthreads: 100
#   # set disable to true when you want to disable registry redirect
#   redirect:
#     disable: false

# Trivy configuration
#
# Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases.
# It is downloaded by Trivy from the GitHub release page https://github.com/aquasecurity/trivy-db/releases and cached
# in the local file system. In addition, the database contains the update timestamp so Trivy can detect whether it
# should download a newer version from the Internet or use the cached one. Currently, the database is updated every
# 12 hours and published as a new release to GitHub.
trivy:
  # ignoreUnfixed The flag to display only fixed vulnerabilities
  ignore_unfixed: false
  # skipUpdate The flag to enable or disable Trivy DB downloads from GitHub
  #
  # You might want to enable this flag in test or CI/CD environments to avoid GitHub rate limiting issues.
  # If the flag is enabled you have to download the `trivy-offline.tar.gz` archive manually, extract `trivy.db` and
  # `metadata.json` files and mount them in the `/home/scanner/.cache/trivy/db` path.
  skip_update: false
  #
  # The offline_scan option prevents Trivy from sending API requests to identify dependencies.
  # Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it.
  # For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't
  # exist in the local repositories. It means a number of detected vulnerabilities might be fewer in offline mode.
  # It would work if all the dependencies are in local.
  # This option doesn't affect DB download. You need to specify "skip-update" as well as "offline-scan" in an air-gapped environment.
  offline_scan: false
  #
  # Comma-separated list of what security issues to detect. Possible values are `vuln`, `config` and `secret`. Defaults to `vuln`.
  security_check: vuln
  #
  # insecure The flag to skip verifying registry certificate
  insecure: false
  # github_token The GitHub access token to download Trivy DB
  #
  # Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough
  # for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000
  # requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult
  # https://docs.github.com/rest/overview/resources-in-the-rest-api#rate-limiting
  #
  # You can create a GitHub token by following the instructions in
  # https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line
  #
  # github_token: xxx

jobservice:
  # Maximum number of job workers in job service
  max_job_workers: 10
  # The jobLoggers backend name, only support "STD_OUTPUT", "FILE" and/or "DB"
  job_loggers:
    - STD_OUTPUT
    - FILE
    # - DB
  # The jobLogger sweeper duration (ignored if `jobLogger` is `stdout`)
  logger_sweeper_duration: 1 #days

notification:
  # Maximum retry count for webhook job
  webhook_job_max_retry: 3
  # HTTP client timeout for webhook job
  webhook_job_http_client_timeout: 3 #seconds

# Log configurations
log:
  # options are debug, info, warning, error, fatal
  level: info
  # configs for logs in local storage
  local:
    # Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.
    rotate_count: 50
    # Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.
    # If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G
    # are all valid.
    rotate_size: 200M
    # The directory on your host that store log
    location: /var/log/harbor

  # Uncomment following lines to enable external syslog endpoint.
  # external_endpoint:
  #   # protocol used to transmit log to external endpoint, options is tcp or udp
  #   protocol: tcp
  #   # The host of external endpoint
  #   host: localhost
  #   # Port of external endpoint
  #   port: 5140

#This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!
_version: 2.9.0

# Uncomment external_database if using external database.
# external_database:
#   harbor:
#     host: harbor_db_host
#     port: harbor_db_port
#     db_name: harbor_db_name
#     username: harbor_db_username
#     password: harbor_db_password
#     ssl_mode: disable
#     max_idle_conns: 2
#     max_open_conns: 0

# Uncomment redis if need to customize redis db
# redis:
#   # db_index 0 is for core, it's unchangeable
#   # registry_db_index: 1
#   # jobservice_db_index: 2
#   # trivy_db_index: 5
#   # it's optional, the db for harbor business misc, by default is 0, uncomment it if you want to change it.
#   # harbor_db_index: 6
#   # it's optional, the db for harbor cache layer, by default is 0, uncomment it if you want to change it.
#   # cache_db_index: 7

# Uncomment redis if need to customize redis db
# redis:
#   # db_index 0 is for core, it's unchangeable
#   # registry_db_index: 1
#   # jobservice_db_index: 2
#   # trivy_db_index: 5
#   # it's optional, the db for harbor business misc, by default is 0, uncomment it if you want to change it.
#   # harbor_db_index: 6
#   # it's optional, the db for harbor cache layer, by default is 0, uncomment it if you want to change it.
#   # cache_layer_db_index: 7

# Uncomment external_redis if using external Redis server
# external_redis:
#   # support redis, redis+sentinel
#   # host for redis: <host_redis>:<port_redis>
#   # host for redis+sentinel:
#   #  <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
#   host: redis:6379
#   password: 
#   # Redis AUTH command was extended in Redis 6, it is possible to use it in the two-arguments AUTH <username> <password> form.
#   # there's a known issue when using external redis username ref:https://github.com/goharbor/harbor/issues/18892
#   # if you care about the image pull/push performance, please refer to this https://github.com/goharbor/harbor/wiki/Harbor-FAQs#external-redis-username-password-usage
#   # username:
#   # sentinel_master_set must be set to support redis+sentinel
#   #sentinel_master_set:
#   # db_index 0 is for core, it's unchangeable
#   registry_db_index: 1
#   jobservice_db_index: 2
#   trivy_db_index: 5
#   idle_timeout_seconds: 30
#   # it's optional, the db for harbor business misc, by default is 0, uncomment it if you want to change it.
#   # harbor_db_index: 6
#   # it's optional, the db for harbor cache layer, by default is 0, uncomment it if you want to change it.
#   # cache_layer_db_index: 7

# Uncomment uaa for trusting the certificate of uaa instance that is hosted via self-signed cert.
# uaa:
#   ca_file: /path/to/ca

# Global proxy
# Config http proxy for components, e.g. http://my.proxy.com:3128
# Components doesn't need to connect to each others via http proxy.
# Remove component from `components` array if want disable proxy
# for it. If you want use proxy for replication, MUST enable proxy
# for core and jobservice, and set `http_proxy` and `https_proxy`.
# Add domain to the `no_proxy` field, when you want disable proxy
# for some special registry.
proxy:
  http_proxy:
  https_proxy:
  no_proxy:
  components:
    - core
    - jobservice
    - trivy

# metric:
#   enabled: false
#   port: 9090
#   path: /metrics

# Trace related config
# only can enable one trace provider(jaeger or otel) at the same time,
# and when using jaeger as provider, can only enable it with agent mode or collector mode.
# if using jaeger collector mode, uncomment endpoint and uncomment username, password if needed
# if using jaeger agetn mode uncomment agent_host and agent_port
# trace:
#   enabled: true
#   # set sample_rate to 1 if you wanna sampling 100% of trace data; set 0.5 if you wanna sampling 50% of trace data, and so forth
#   sample_rate: 1
#   # # namespace used to differenciate different harbor services
#   # namespace:
#   # # attributes is a key value dict contains user defined attributes used to initialize trace provider
#   # attributes:
#   #   application: harbor
#   # # jaeger should be 1.26 or newer.
#   # jaeger:
#   #   endpoint: http://hostname:14268/api/traces
#   #   username:
#   #   password:
#   #   agent_host: hostname
#   #   # export trace data by jaeger.thrift in compact mode
#   #   agent_port: 6831
#   # otel:
#   #   endpoint: hostname:4318
#   #   url_path: /v1/traces
#   #   compression: false
#   #   insecure: true
#   #   # timeout is in seconds
#   #   timeout: 10

# Enable purge _upload directories
upload_purging:
  enabled: true
  # remove files in _upload directories which exist for a period of time, default is one week.
  age: 168h
  # the interval of the purge operations
  interval: 24h
  dryrun: false

# Cache layer configurations
# If this feature enabled, harbor will cache the resource
# `project/project_metadata/repository/artifact/manifest` in the redis
# which can especially help to improve the performance of high concurrent
# manifest pulling.
# NOTICE
# If you are deploying Harbor in HA mode, make sure that all the harbor
# instances have the same behaviour, all with caching enabled or disabled,
# otherwise it can lead to potential data inconsistency.
cache:
  # not enabled by default
  enabled: false
  # keep cache for one day by default
  expire_hours: 24

# Harbor core configurations
# Uncomment to enable the following harbor core related configuration items.
# core:
#   # The provider for updating project quota(usage), there are 2 options, redis or db,
#   # by default is implemented by db but you can switch the updation via redis which
#   # can improve the performance of high concurrent pushing to the same project,
#   # and reduce the database connections spike and occupies.
#   # By redis will bring up some delay for quota usage updation for display, so only
#   # suggest switch provider to redis if you were ran into the db connections spike aroud
#   # the scenario of high concurrent pushing to same project, no improvment for other scenes.
#   quota_update_provider: redis # Or db

```

---

## 遇到的问题

1. 权限问题（could not change group /var/run/docker.sock to docker: group docker not found），请用 root 权限执行 docker-compose up -d
```log
[+] Running 1/0
 ✔ Container harbor  Created                                                                                                 0.0s
Attaching to harbor
harbor  | Certificate request self-signature ok
harbor  | subject=CN = docker:dind server
harbor  | /certs/server/cert.pem: OK
harbor  | Certificate request self-signature ok
harbor  | subject=CN = docker:dind client
harbor  | /certs/client/cert.pem: OK
harbor  | [WARN  tini (12)] Tini is not running as PID 1 and isn't registered as a child subreaper.
harbor  | Zombie processes will not be re-parented to Tini, so zombie reaping won't work.
harbor  | To fix the problem, use the -s option or set the environment variable TINI_SUBREAPER to register Tini as a child subreaper, or run Tini as PID 1.
harbor  | time="2023-08-30T10:38:50.129710991Z" level=info msg="Starting up"
harbor  | time="2023-08-30T10:38:50.131978924Z" level=warning msg="could not change group /var/run/docker.sock to docker: group docker not found"
harbor  | time="2023-08-30T10:38:50.132116243Z" level=info msg="containerd not running, starting managed containerd"
harbor  | failed to start containerd: libcontainerd: failed to save daemon pid to disk: process with PID 57 is still running
harbor  | Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
harbor exited with code 1
```


Harbor - 私有化容器仓库

## docker-compose 安装部署

```bash
mkdir jenkins_home
chown -R 1000:1000 ./jenkins_home
```

- docker-compose.yml
```yaml
version: "3"

services:
  caddy:
    container_name: caddy
    image: caddy:alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "80:80/udp"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
  jenkins:
    container_name: jenkins
    image: jenkins/jenkins:lts-jdk11
    restart: unless-stopped
    volumes:
      # chown -R 1000:1000 ./jenkins_home
      - ./jenkins_home:/var/jenkins_home
```

- Caddyfile
```Caddyfile
jenkins.uing.vip {
  log {
    output stdout
    format console
    level  ERROR
  }
  reverse_proxy jenkins:8080
}
```