2022-05-10 15:39:52 +00:00
|
|
|
version: "3.7"
|
2022-03-08 11:17:29 +00:00
|
|
|
services:
|
2022-03-08 18:15:37 +00:00
|
|
|
dns-doh:
|
|
|
|
image: crazymax/cloudflared
|
|
|
|
restart: always
|
|
|
|
networks:
|
|
|
|
dns-doh-net:
|
|
|
|
ipv4_address: 172.23.0.2
|
|
|
|
|
|
|
|
dnsmasq:
|
|
|
|
image: 4km3/dnsmasq:2.85-r2
|
|
|
|
cap_add:
|
|
|
|
- NET_ADMIN
|
2022-07-27 14:26:03 +00:00
|
|
|
command: ["--no-resolv", "--domain-needed", "--server=172.23.0.2#5053", "--server=/onion/10.11.255.251#5353"]
|
2022-03-08 18:15:37 +00:00
|
|
|
networks:
|
|
|
|
dns-doh-net:
|
|
|
|
ipv4_address: 172.23.0.3
|
|
|
|
guest-net:
|
2022-07-25 12:42:33 +00:00
|
|
|
ipv4_address: 10.11.255.252
|
2022-03-08 18:15:37 +00:00
|
|
|
restart: always
|
|
|
|
depends_on:
|
|
|
|
- dns-doh
|
|
|
|
|
2022-07-25 12:42:33 +00:00
|
|
|
nordlynx:
|
|
|
|
image: ghcr.io/bubuntux/nordlynx
|
|
|
|
depends_on:
|
|
|
|
- dnsmasq
|
|
|
|
dns: 172.23.0.3 #dnsmasq on dns-doh-net
|
|
|
|
cap_add:
|
|
|
|
- NET_ADMIN #required
|
|
|
|
environment:
|
2022-07-27 14:26:03 +00:00
|
|
|
- PRIVATE_KEY=${SF_NORDVPN_PRIVATE_KEY:-}
|
2022-07-25 12:42:33 +00:00
|
|
|
- POST_UP=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-nordlynx.log post_up %i
|
|
|
|
- POST_DOWN=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-nordlynx.log post_down %i
|
|
|
|
networks:
|
|
|
|
vpn:
|
|
|
|
ipv4_address: 172.20.0.254
|
|
|
|
dns-doh-net:
|
|
|
|
ipv4_address: 172.23.0.254
|
|
|
|
sysctls:
|
|
|
|
- net.ipv6.conf.all.disable_ipv6=1
|
|
|
|
- net.ipv4.conf.all.src_valid_mark=1
|
|
|
|
- net.ipv4.ip_forward=1
|
|
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
2022-07-27 14:26:03 +00:00
|
|
|
- "${SF_RUNDIR:-/dev/shm/sf/vpn}:/sf/run/vpn"
|
|
|
|
- "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
|
2022-07-25 12:42:33 +00:00
|
|
|
|
|
|
|
router:
|
|
|
|
build: router
|
2022-07-27 14:26:03 +00:00
|
|
|
image: sf-router
|
2022-07-25 12:42:33 +00:00
|
|
|
depends_on:
|
|
|
|
- router-fix-network
|
|
|
|
networks:
|
|
|
|
vpn:
|
|
|
|
ipv4_address: 172.20.0.2
|
|
|
|
guest-net:
|
|
|
|
ipv4_address: 10.11.255.253 # Will be replaced by init.sh with 10.11.0.1
|
|
|
|
cap_add:
|
|
|
|
- NET_ADMIN
|
|
|
|
environment:
|
2022-07-27 14:26:03 +00:00
|
|
|
- SF_DEBUG=${SF_DEBUG:-}
|
|
|
|
- SF_MAXOUT=${SF_MAXOUT:-}
|
|
|
|
- SF_MAXIN=${SF_MAXIN:-}
|
|
|
|
volumes:
|
|
|
|
- "${SF_BASEDIR:-.}/config/etc/tc:/config/tc:ro"
|
2022-07-25 12:42:33 +00:00
|
|
|
entrypoint: ["/init.sh"]
|
|
|
|
|
|
|
|
router-fix-network:
|
|
|
|
image: sf-router
|
|
|
|
network_mode: host # host's stack
|
|
|
|
cap_add:
|
|
|
|
- NET_ADMIN
|
|
|
|
environment:
|
2022-07-27 14:26:03 +00:00
|
|
|
- SF_DEBUG=${SF_DEBUG:-}
|
2022-07-25 12:42:33 +00:00
|
|
|
entrypoint: ["/fix-network.sh"]
|
|
|
|
|
2022-03-08 18:15:37 +00:00
|
|
|
tor:
|
2022-05-20 15:59:45 +00:00
|
|
|
build: tor
|
2022-07-27 14:26:03 +00:00
|
|
|
image: sf-tor
|
2022-03-08 18:15:37 +00:00
|
|
|
networks:
|
|
|
|
guest-net:
|
2022-07-25 12:42:33 +00:00
|
|
|
ipv4_address: 10.11.255.251
|
2022-05-20 15:59:45 +00:00
|
|
|
nginx-net:
|
2022-07-27 14:26:03 +00:00
|
|
|
cap_add:
|
|
|
|
- NET_ADMIN
|
2022-03-08 18:15:37 +00:00
|
|
|
restart: always
|
2022-07-25 12:42:33 +00:00
|
|
|
dns: 10.11.255.252
|
2022-03-08 18:15:37 +00:00
|
|
|
depends_on:
|
|
|
|
- dnsmasq
|
2022-05-20 15:59:45 +00:00
|
|
|
- nginx
|
|
|
|
volumes:
|
2022-07-27 14:26:03 +00:00
|
|
|
- "${SF_BASEDIR:-.}/config/${SF_FQDN:-SF_FQDN-NOT-SET.hack.segfault.net}/tor/hidden_service:/var/lib/tor/hidden_service"
|
|
|
|
- "${SF_BASEDIR:-.}/config/etc/tor:/config/tor:ro"
|
2022-03-08 18:15:37 +00:00
|
|
|
|
2022-05-10 15:39:52 +00:00
|
|
|
segfault:
|
2022-03-08 18:15:37 +00:00
|
|
|
build: host
|
2022-07-27 14:26:03 +00:00
|
|
|
image: sf-host
|
|
|
|
# /bin/segfaultsh need to know the container name; set it to sf-host statically
|
|
|
|
container_name: sf-host
|
2022-03-08 18:15:37 +00:00
|
|
|
depends_on:
|
|
|
|
- dnsmasq
|
|
|
|
restart: always
|
2022-05-10 15:39:52 +00:00
|
|
|
init: true
|
2022-03-08 18:15:37 +00:00
|
|
|
dns: 255.255.255.255
|
2022-07-27 14:26:03 +00:00
|
|
|
# SSHD clears all environment variables before spwaning a shell (segfaultsh).
|
|
|
|
# Add any variables to docker_sshd.sh as well.
|
|
|
|
environment:
|
|
|
|
- SF_DNS=${SF_DNS:-10.11.255.252}
|
|
|
|
- SF_BASEDIR=${SF_BASEDIR}
|
|
|
|
- SF_RUNDIR=${SF_RUNDIR:-/dev/shm/sf}
|
|
|
|
- SF_USER=${SF_USER:-root}
|
|
|
|
- SF_USER_PASSWORD=${SF_USER_PASSWORD:-segfault}
|
|
|
|
- SF_FQDN=${SF_FQDN:-SF_FQDN-NOT-SET.hack.segfault.net}
|
|
|
|
- SF_ENCFS_SECDIR=${SF_ENCFS_SECDIR:-/dev/shm/encfs-sec}
|
|
|
|
- SF_DEBUG=${SF_DEBUG:-}
|
2022-05-20 15:59:45 +00:00
|
|
|
ports:
|
|
|
|
- "${SF_SSH_PORT:-22}:2222"
|
2022-03-08 18:15:37 +00:00
|
|
|
volumes:
|
2022-07-27 14:26:03 +00:00
|
|
|
- "${SF_BASEDIR:-.}/config/etc/ssh:/config/etc/ssh"
|
|
|
|
- "${SF_BASEDIR:-.}/config/db:/config/db"
|
2022-07-25 12:42:33 +00:00
|
|
|
- "${SF_ENCFS_SECDIR:-/dev/shm/encfs-sec}/onion-www:/onion:slave"
|
2022-03-08 18:15:37 +00:00
|
|
|
- "/var/run/docker.sock:/var/run/docker.sock"
|
|
|
|
|
2022-07-25 12:42:33 +00:00
|
|
|
nginx-encfs:
|
|
|
|
build: encfs
|
2022-07-27 14:26:03 +00:00
|
|
|
image: sf-encfs
|
2022-07-25 12:42:33 +00:00
|
|
|
restart: always
|
|
|
|
cap_add:
|
|
|
|
- SYS_ADMIN
|
|
|
|
security_opt:
|
|
|
|
- apparmor:unconfined
|
|
|
|
environment:
|
|
|
|
- SF_ENCFS_PASS
|
|
|
|
command: ["/mount.sh", "server"]
|
2022-07-27 14:26:03 +00:00
|
|
|
network_mode: none
|
2022-07-25 12:42:33 +00:00
|
|
|
devices:
|
|
|
|
- "/dev/fuse:/dev/fuse"
|
|
|
|
volumes:
|
2022-07-27 14:26:03 +00:00
|
|
|
- "${SF_BASEDIR:-.}/config/etc/encfs:/config"
|
|
|
|
- "${SF_BASEDIR:-.}/data/onion-www:/encfs/raw"
|
2022-07-25 12:42:33 +00:00
|
|
|
- "${SF_ENCFS_SECDIR:-/dev/shm/encfs-sec}/onion-www:/encfs/sec:shared"
|
|
|
|
|
2022-05-20 15:59:45 +00:00
|
|
|
nginx:
|
|
|
|
image: nginx
|
|
|
|
restart: always
|
2022-07-25 12:42:33 +00:00
|
|
|
depends_on:
|
|
|
|
- nginx-encfs
|
2022-05-20 15:59:45 +00:00
|
|
|
dns: 255.255.255.255
|
2022-07-27 14:26:03 +00:00
|
|
|
# ports:
|
|
|
|
# - 8080:80 # FIXME: testing..
|
2022-05-20 15:59:45 +00:00
|
|
|
networks:
|
|
|
|
nginx-net:
|
|
|
|
volumes:
|
2022-07-25 12:42:33 +00:00
|
|
|
- "${SF_ENCFS_SECDIR:-/dev/shm/encfs-sec}/onion-www:/srv/www:slave,ro"
|
2022-07-27 14:26:03 +00:00
|
|
|
- "${SF_BASEDIR:-.}/config/etc/nginx/nginx.conf:/etc/nginx/nginx.conf:ro"
|
2022-05-20 15:59:45 +00:00
|
|
|
|
2022-03-08 11:17:29 +00:00
|
|
|
networks:
|
2022-07-25 12:42:33 +00:00
|
|
|
vpn:
|
|
|
|
driver: bridge
|
|
|
|
ipam:
|
|
|
|
driver: default
|
|
|
|
config:
|
|
|
|
- subnet: 172.20.0.0/24
|
|
|
|
|
2022-05-20 15:59:45 +00:00
|
|
|
nginx-net:
|
|
|
|
driver: bridge
|
|
|
|
|
2022-03-08 18:15:37 +00:00
|
|
|
dns-doh-net:
|
|
|
|
driver: bridge
|
|
|
|
ipam:
|
|
|
|
config:
|
|
|
|
- subnet: 172.23.0.0/24
|
|
|
|
|
2022-07-25 12:42:33 +00:00
|
|
|
# User's shell
|
2022-03-08 18:15:37 +00:00
|
|
|
guest-net:
|
2022-05-10 15:39:52 +00:00
|
|
|
name: sf_guest-net
|
2022-03-08 18:15:37 +00:00
|
|
|
driver: bridge
|
|
|
|
ipam:
|
2022-07-25 12:42:33 +00:00
|
|
|
driver: default
|
2022-03-08 18:15:37 +00:00
|
|
|
config:
|
2022-07-25 12:42:33 +00:00
|
|
|
- subnet: 10.11.0.0/16
|
|
|
|
# default gw is always 10.11.0.1 and is the host side of the bridge (?)
|
2022-03-08 18:15:37 +00:00
|
|
|
|