segfault/docker-compose.yml

version: "3.7"
services:

  sf-redis:
    image: redis
    read_only: true
    hostname: sf-redis
    restart: ${SF_RESTART:-on-failure}
    environment:
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
    networks:
      redis-net:
        ipv4_address: 172.20.2.254
    # Should use "sfbin/sf up" to generate SF_REDIS_AUTH
    command: [ "redis-server", "/redis.conf",  "--save", "\"\"", "--appendonly", "no", "--requirepass", "${SF_REDIS_AUTH}" ]
    volumes:
      - "${SF_BASEDIR:-.}/config/etc/redis/redis.conf:/redis.conf:ro"

  sf-encfsd:
    build: encfsd
    image: sf-encfsd
    restart: ${SF_RESTART:-on-failure}
    depends_on:
      - sf-redis
    cap_add:
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    environment:
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
      - SF_SEED=${SF_SEED}
      - SF_DEBUG
    command: ["/encfsd.sh"]
    networks:
      redis-net:
    devices:
      - "/dev/fuse:/dev/fuse"
    volumes:
      - "${SF_BASEDIR:-.}/data:/encfs/raw"
      - "${SF_SHMDIR:-/dev/shm/sf}/encfs-sec:/encfs/sec:shared"
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"

  sf-destructor:
    build: encfsd
    image: sf-encfsd
    restart: ${SF_RESTART:-on-failure}
    depends_on:
      - sf-redis
      - sf-encfsd
    cap_add:
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    environment:
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
      - SF_DEBUG
    pid: "service:sf-encfsd"
    command: ["/destructor.sh"]
    networks:
      redis-net:
    devices:
      - "/dev/fuse:/dev/fuse"
    volumes:
      - "${SF_BASEDIR:-.}/data:/encfs/raw"
      - "${SF_SHMDIR:-/dev/shm/sf}/encfs-sec:/encfs/sec:shared"
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"

  sf-portd:
    build: encfsd
    image: sf-encfsd
    restart: ${SF_RESTART:-on-failure}
    depends_on:
      - sf-redis
    environment:
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
      - SF_DEBUG
    command: ["/portd.sh"]
    networks:
      redis-net:
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}/self-for-guest:/config/self-for-guest"
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"

  dns-doh:
    image: crazymax/cloudflared
    restart: ${SF_RESTART:-on-failure}
    networks:
      dns-doh-net:
        ipv4_address: 172.23.0.2

  dnsmasq:
    image: 4km3/dnsmasq:2.85-r2
    restart: ${SF_RESTART:-on-failure}
    depends_on:
      - dns-doh
    cap_add:
      - NET_ADMIN
    command: ["--no-resolv", "--domain-needed", "--server=172.23.0.2#5053", "--server=/onion/172.20.0.111#5353"]
    networks:
      vpn-net:
        ipv4_address: 172.20.0.53
      dns-doh-net:
        ipv4_address: 172.23.0.53
      guest-net:
        ipv4_address: 10.11.255.53
      access-net:
        ipv4_address: 172.22.0.53

  nordvpn:
    image: hackerschoice/cryptostorm
    container_name: sf-nordvpn
    restart: ${SF_RESTART:-on-failure}
    depends_on:
      - dnsmasq
      - sf-redis
      - router
    dns: 172.20.0.53
    cap_add:
      - NET_ADMIN #required
    environment:
      - PRIVATE_KEY=${SF_NORDVPN_PRIVATE_KEY:-}
      - PROVIDER=NordVPN
      - POST_UP=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-nordvpn.log up %i
      - PRE_DOWN=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-nordvpn.log down %i
      - RECONNECT=604800 # Re-Connect every 7 days
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
      - SF_DEBUG
    networks:
      vpn-net:
        ipv4_address: 172.20.0.254
      redis-net:
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
      - net.ipv4.conf.all.rp_filter=2
      # - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.ip_forward=1
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}/run/vpn:/sf/run/vpn"  # Between all VPNs
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"

  cryptostorm:
    image: hackerschoice/cryptostorm
    container_name: sf-cryptostorm
    restart: ${SF_RESTART:-on-failure}
    depends_on:
      - dnsmasq
      - sf-redis
      - router
    dns: 172.20.0.53
    cap_add:
      - NET_ADMIN #required
    environment:
      - CONFIG=${SF_CRYPTOSTORM_CONFIG:-}
      - PROVIDER=CryptoStorm
      - DNS=1.1.1.1 # Cryptostorm's DNS is often broken
      - POST_UP=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-cryptostorm.log up %i
      - PRE_DOWN=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-cryptostorm.log down %i
      - RECONNECT=604800 # Re-Connect every 7 days
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
      - SF_DEBUG
    networks:
      vpn-net:
        ipv4_address: 172.20.0.253
      redis-net:
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
      - net.ipv4.conf.all.rp_filter=2
      - net.ipv4.ip_forward=1
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}/run/vpn:/sf/run/vpn"  # Between all VPNs
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"

  mullvad:
    image: hackerschoice/cryptostorm
    container_name: sf-mullvad
    restart: ${SF_RESTART:-on-failure}
    depends_on:
      - dnsmasq
      - sf-redis
      - router
    dns: 172.20.0.53
    cap_add:
      - NET_ADMIN #required
    environment:
      - CONFIG=${SF_MULLVAD_CONFIG:-}
      - PROVIDER=Mullvad
      - POST_UP=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-mullvad.log up %i
      - PRE_DOWN=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-mullvad.log down %i
      - RECONNECT=604800 # Re-Connect every 7 days
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
      - SF_DEBUG
    networks:
      vpn-net:
        ipv4_address: 172.20.0.252
      redis-net:
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
      - net.ipv4.conf.all.rp_filter=2
      - net.ipv4.ip_forward=1
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}/run/vpn:/sf/run/vpn"  # Between all VPNs
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"

  router:
    build: router
    image: sf-router
    hostname: sf-router
    container_name: sf-router
    depends_on:
      - router-fix-network
    networks:
      incoming-net:
        ipv4_address: 172.28.0.2
      vpn-net:
        ipv4_address: 172.20.0.2
      guest-net:
        ipv4_address: 10.11.255.253 # Will be replaced by init.sh with 10.11.0.1
      access-net:
        ipv4_address: 172.22.0.254
      dmz-net:
        ipv4_address: 172.20.1.254
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1 # SNAT
      - net.ipv4.conf.all.rp_filter=2
    ports:
      - "${SF_SSH_PORT:-22}:22"
      - "${SF_SSH_PORT2:-443}:22"
    environment:
      - SF_DEBUG
      - SF_MAXOUT
      - SF_MAXIN
    restart: ${SF_RESTART:-on-failure}
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}/run/vpn:/sf/run/vpn"
      - "${SF_BASEDIR:-.}/config/etc/sf:/config/host/etc/sf:ro"
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
    entrypoint: ["/init.sh"]

  router-fix-network:
    build: router
    image: sf-router
    network_mode: host # host's stack
    cap_add:
      - NET_ADMIN
    environment:
      - SF_DEBUG
    restart: ${SF_RESTART:-on-failure}:1
    entrypoint: ["/fix-network.sh"]

  tor:
    build: tor
    image: sf-tor
    hostname: sf-tor
    networks:
      vpn-net:
        ipv4_address: 172.20.0.111
    cap_add:
      - NET_ADMIN    
    restart: ${SF_RESTART:-on-failure}
    dns: 172.20.0.53
    depends_on:
      - dnsmasq
      - nginx
    volumes:
      - "${SF_BASEDIR:-.}/config/${SF_FQDN:-SF_FQDN-NOT-SET.hack.segfault.net}/tor/hidden:/var/lib/tor/hidden"
      - "${SF_BASEDIR:-.}/config/etc/tor:/config/host/etc/tor:ro"
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest"

  gsnc:
    build: gsnc
    image: sf-gsnc
    networks:
      access-net:
        ipv4_address: 172.22.0.21
    dns: 172.22.0.53
    cap_add:
      - NET_ADMIN # need to set default route
    depends_on:
      - dnsmasq
      - router
    restart: ${SF_RESTART:-on-failure}
    environment:
      - SF_SSH_PORT=${SF_SSH_PORT:-22}
      - SF_FQDN=${SF_FQDN:-SF_FQDN-NOT-SET.hack.segfault.net}
      - SF_DEBUG
      - SF_SEED=${SF_SEED}
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest"
    entrypoint: ["/sf-gsnc.sh", "172.22.0.22"]

  segfault:
    build: host
    image: sf-host
    # /bin/segfaultsh need to know the container name; set it to sf-host statically
    container_name: sf-host
    networks:
      # WARNING: sshd's port forward/socks can access those networks.
      access-net:
        ipv4_address: 172.22.0.22
      redis-net:
    dns: 172.22.0.53
    cap_add:
      - NET_ADMIN # need to set default route
    depends_on:
      - dnsmasq
      - router
      - sf-encfsd
    restart: ${SF_RESTART:-on-failure}
    init: true
    # SSHD clears all environment variables before spwaning a shell (segfaultsh).
    # Add any variables to docker_sshd.sh as well.
    environment:
      - SF_DNS=10.11.255.53
      - SF_TOR=172.20.0.111
      - SF_BASEDIR=${SF_BASEDIR}
      - SF_SHMDIR=${SF_SHMDIR:-/dev/shm/sf}
      - SF_USER=${SF_USER:-root}
      - SF_USER_PASSWORD=${SF_USER_PASSWORD:-segfault}
      - SF_FQDN=${SF_FQDN:-SF_FQDN-NOT-SET.hack.segfault.net}
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
      - SF_SEED=${SF_SEED}
      - SF_DEBUG
    volumes:
      - "${SF_BASEDIR:-.}/config:/config/host"
      - "${SF_BASEDIR:-.}/data/share:/sf/share:ro"
      - "${SF_BASEDIR:-.}/sfbin/wait_semaphore.sh:/sf/bin/wait_semaphore.sh:ro"
      - "${SF_SHMDIR:-/dev/shm/sf}/encfs-sec/www-root:/sec/www-root:slave"
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest"
      - "${SF_SHMDIR:-/dev/shm/sf}/self-for-guest:/config/self-for-guest"
      - "/var/run/docker.sock:/var/run/docker.sock"

  nginx:
    image: nginx
    restart: ${SF_RESTART:-on-failure}
    depends_on:
      - sf-encfsd
    entrypoint: ["/sf/bin/wait_semaphore.sh", "/sec/.IS-ENCRYPTED", "nginx", "-g", "daemon off;"]
    networks:
      dmz-net:
        ipv4_address: 172.20.1.80
    dns: 255.255.255.255
    cap_add:
      - NET_ADMIN # need to set default route
    volumes:
      - "${SF_BASEDIR:-.}/sfbin/wait_semaphore.sh:/sf/bin/wait_semaphore.sh:ro"
      - "${SF_SHMDIR:-/dev/shm/sf}/encfs-sec/www-root:/sec:slave,ro"
      - "${SF_BASEDIR:-.}/config/etc/nginx/nginx.conf:/etc/nginx/nginx.conf:ro"

networks:
  vpn-net:
    name: sf-vpn
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: 172.20.0.0/24

  incoming-net:
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: 172.28.0.0/24

  access-net:
    name: sf-access
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: 172.22.0.0/24

  dmz-net:
    name: sf-dmz
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.1.0/24

  redis-net:
    name: sf-redis-net
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.2.0/24

  dns-doh-net:
    name: sf-dns-doh
    driver: bridge
    ipam:
      config:
        - subnet: 172.23.0.0/24

  # User's shell
  guest-net:
    name: sf-guest
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 10.11.0.0/16
        # default gw is always 10.11.0.1 and is the host side of the bridge (?)