VPS一键部署Docker版Firefox浏览器完美教程

• Docker + docker-compose

• Firefox（在容器内运行）

• Web VNC（noVNC + Xfce 桌面）

• 自动开机启动

• 使用 https://<你的IP>:6901 打开图形界面

#!/bin/bash
# Debian 12/13 一键安装 Firefox 浏览器环境（Docker 版）
# 适用于已安装 Docker 的环境

set -e

# 颜色定义（可选，如果支持颜色）
if [ -t 1 ]; then
    RED='\033[0;31m'
    GREEN='\033[0;32m'
    YELLOW='\033[1;33m'
    NC='\033[0m'
else
    RED=''
    GREEN=''
    YELLOW=''
    NC=''
fi

# 日志函数
log_info() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

log_warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# 检查 Docker 是否安装和运行
check_docker() {
    if ! command -v docker >/dev/null 2>&1; then
        log_error "Docker 未安装，请先安装 Docker"
        exit 1
    fi
    
    if ! docker info >/dev/null 2>&1; then
        log_error "Docker 守护进程未运行，请启动 Docker 服务"
        log_info "尝试执行: sudo systemctl start docker"
        exit 1
    fi
    
    log_info "Docker 已安装并运行"
}

# 检查 Docker Compose 是否可用
check_docker_compose() {
    if ! command -v docker-compose >/dev/null 2>&1; then
        if ! docker compose version >/dev/null 2>&1; then
            log_warn "Docker Compose 未安装，将使用 docker run 方式运行"
            return 1
        else
            log_info "Docker Compose Plugin 可用"
            return 0
        fi
    else
        log_info "Docker Compose 可用"
        return 0
    fi
}

# 使用 Docker Compose 部署 Firefox
setup_firefox_compose() {
    local CONTAINER_DIR="/opt/firefox"
    
    log_info "设置 Firefox 容器..."
    
    # 创建目录
    mkdir -p "$CONTAINER_DIR"
    cd "$CONTAINER_DIR"

    # 生成 docker-compose.yml
    cat > docker-compose.yml <<'EOF'
version: "3.8"
services:
  firefox:
    image: lscr.io/linuxserver/firefox:latest
    container_name: firefox
    restart: unless-stopped
    shm_size: "2gb"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Asia/Shanghai
      - FIREFOX_CLI=false
    volumes:
      - ./config:/config
      - ./downloads:/config/Downloads
    ports:
      - "6901:3000"
    security_opt:
      - seccomp:unconfined
EOF

    # 创建数据目录
    mkdir -p config downloads
    chmod -R 755 config downloads

    log_info "拉取 Firefox 镜像..."
    docker compose pull

    log_info "启动 Firefox 容器..."
    docker compose up -d
    
    # 等待容器启动
    log_info "等待容器启动..."
    sleep 10
    
    # 检查容器状态
    if docker compose ps | grep -q "Up"; then
        log_info "Firefox 容器启动成功"
    else
        log_error "Firefox 容器启动失败，请检查日志"
        docker compose logs
        exit 1
    fi
}

# 显示安装信息
show_info() {
    log_info "Firefox 安装完成 ✅"
    
    IP=$(hostname -I | awk '{print $1}')
    
    echo "========================================="
    echo "           访问信息"
    echo "========================================="
    echo "Web 界面: http://${IP}:6901"
    echo "默认用户: abc"
    echo "默认密码: abc"
    echo ""
    echo "========================================="
    echo "           文件目录"
    echo "========================================="
    echo "配置目录: /opt/firefox/config"
    echo "下载目录: /opt/firefox/downloads"
    echo "========================================="
}

# 显示管理命令
show_commands() {
    echo ""
    echo "========================================="
    echo "           管理命令"
    echo "========================================="
    echo "查看状态: docker ps | grep firefox"
    echo "查看日志: docker logs firefox"
    echo "停止服务: docker stop firefox"
    echo "启动服务: docker start firefox"
    echo "重启服务: docker restart firefox"
    echo ""
    
    if [ -f "/opt/firefox/docker-compose.yml" ]; then
        echo "使用 Docker Compose 管理:"
        echo "cd /opt/firefox"
        echo "docker compose ps    # 查看状态"
        echo "docker compose logs  # 查看日志"
        echo "docker compose down  # 停止服务"
        echo "docker compose up -d # 启动服务"
    fi
}

# 主函数
main() {
    echo "========================================="
    echo "   Firefox 浏览器一键安装脚本"
    echo "   适用于已安装 Docker 的环境"
    echo "========================================="
    
    # 检查 Docker
    check_docker
    
    # 检查 Docker Compose
    if check_docker_compose; then
        setup_firefox_compose
    else
        log_warn "使用 docker run 方式部署（Docker Compose 不可用）"
        setup_firefox_run
    fi
    
    show_info
    show_commands
    
    echo ""
    log_warn "重要提示：首次登录后请立即修改默认密码！"
    log_warn "如需修改端口，请编辑 /opt/firefox/docker-compose.yml"
    
    echo ""
    log_info "安装脚本可以安全删除: rm -f /tmp/install-firefox.sh"
}

main "$@"

server {
    listen 80;
    listen [::]:80;  # 添加 IPv6 支持
    server_name fx.example.com;
    
    # 安全头即使在 HTTP 跳转时也添加
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;  # 添加 IPv6 SSL 支持
    http2 on
    server_name fx.example.com;

    # SSL 证书路径
    ssl_certificate /etc/nginx/ssl/fx.example.com/fullchain.cer;
    ssl_certificate_key /etc/nginx/ssl/fx.example.com/fx.example.com.key;

    # SSL 优化配置
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1h;
    ssl_session_tickets off;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    
    # DH 参数（增强安全性）
    ssl_dhparam /etc/nginx/dhparam.pem;  # 可选：生成命令见下文

    # 安全头
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy no-referrer-when-downgrade always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

    # 反向代理到 Firefox 容器
    location / {
        proxy_pass http://127.0.0.1:6901;
        proxy_http_version 1.1;
        
        # 基础代理头
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;

        # WebSocket 支持（VNC 必需）
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # 超时设置（VNC 需要较长超时）
        proxy_connect_timeout 7d;
        proxy_send_timeout 7d;
        proxy_read_timeout 7d;
        
        # 缓冲区优化
        proxy_buffering off;
        proxy_request_buffering off;
    }

    # 阻止常见漏洞扫描
    location ~* /(\.git|\.env|backup|admin) {
        deny all;
        return 404;
    }

    # 日志配置
    access_log /var/log/nginx/fx.example.com.access.log;
    error_log /var/log/nginx/fx.example.com.error.log;
}