mirror of
https://github.com/hackerschoice/segfault.git
synced 2024-06-28 09:41:18 +00:00
753 lines
27 KiB
YAML
753 lines
27 KiB
YAML
version: "2.4"
|
|
services:
|
|
|
|
sf-redis:
|
|
image: redis
|
|
container_name: sf-redis
|
|
read_only: true
|
|
hostname: sf-redis
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
environment:
|
|
- SF_REDIS_AUTH=${SF_REDIS_AUTH}
|
|
network_mode: none
|
|
command: [ "redis-server", "/redis.conf", "--save", "\"\"", "--appendonly", "no", "--requirepass", "${SF_REDIS_AUTH}" ]
|
|
volumes:
|
|
- "${SF_BASEDIR:-.}/config/etc/redis/redis.conf:/redis.conf:ro"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
|
|
|
|
sf-encfsd:
|
|
build: encfsd
|
|
image: sf-encfsd
|
|
container_name: sf-encfsd
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
depends_on:
|
|
- sf-redis
|
|
cap_add:
|
|
- SYS_ADMIN
|
|
security_opt:
|
|
- apparmor:unconfined
|
|
# xfs_quota needs this :/ FIXME
|
|
privileged: true
|
|
# NOTE: _MUST_ not run in host's pid space because we use 'pgrep' to find lg's encfsd pid.
|
|
environment:
|
|
- SF_REDIS_AUTH=${SF_REDIS_AUTH}
|
|
- SF_SEED=${SF_SEED}
|
|
- SF_DEBUG
|
|
command: ["/encfsd.sh"]
|
|
network_mode: none
|
|
devices:
|
|
- "/dev/fuse:/dev/fuse"
|
|
volumes:
|
|
- "${SF_BASEDIR:-.}/config/db:/config/db:ro"
|
|
- "${SF_BASEDIR:-.}/config/etc/sf:/config/etc/sf:ro"
|
|
- "${SF_BASEDIR:-.}/data:/encfs/raw"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/encfs-sec:/encfs/sec:shared"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run:/sf/run:ro"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/encfsd/user:/sf/run/encfsd/user"
|
|
- "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
|
|
- "${SF_OVERLAYDIR:-/var/lib/docker/overlay2}:/var/lib/docker/overlay2:ro"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
|
|
- "/sys/fs/cgroup:/sys/fs/cgroup"
|
|
|
|
# Note: If this one fails to start then most likelly bad ENCFS password.
|
|
# level=fatal msg="no such file or directory": unknown
|
|
sf-destructor:
|
|
build: encfsd
|
|
image: sf-encfsd
|
|
container_name: sf-destructor
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
depends_on:
|
|
- sf-redis
|
|
- sf-encfsd
|
|
cap_add:
|
|
- SYS_ADMIN
|
|
security_opt:
|
|
- apparmor:unconfined
|
|
environment:
|
|
- SF_REDIS_AUTH=${SF_REDIS_AUTH:?}
|
|
- SF_DEBUG
|
|
pid: "service:sf-encfsd"
|
|
command: ["/destructor.sh"]
|
|
network_mode: none
|
|
devices:
|
|
- "/dev/fuse:/dev/fuse"
|
|
volumes:
|
|
- "${SF_BASEDIR:-.}/config/db:/config/db:ro"
|
|
- "${SF_BASEDIR:-.}/data:/encfs/raw"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/self-for-guest:/config/self-for-guest"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/encfs-sec:/encfs/sec:shared"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run:/sf/run"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
|
|
- "/var/run/docker.sock:/var/run/docker.sock"
|
|
- "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
|
|
|
|
sf-containerguard:
|
|
build: tools/cg
|
|
image: sf-containerguard
|
|
container_name: sf-containerguard
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
pid: "host"
|
|
cap_add:
|
|
- SYS_PTRACE # access to /proc/<PID>/root/dev/pts/* to send messages to user.
|
|
network_mode: none
|
|
volumes:
|
|
- "/var/run/docker.sock:/var/run/docker.sock"
|
|
- "/var/run/containerd/io.containerd.runtime.v2.task:/var/run/containerd/io.containerd.runtime.v2.task:ro"
|
|
- "${SF_BASEDIR:-.}/config:${SF_BASEDIR:-.}/config"
|
|
- "/sys/fs/cgroup:/sys/fs/cgroup"
|
|
|
|
sf-logpipe:
|
|
build: tools/logpipe
|
|
image: sf-logpipe
|
|
container_name: sf-logpipe
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
volumes:
|
|
- "${SF_BASEDIR:-.}/config/etc/logpipe/:/app/config/:ro"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/logpipe/:/app/sock/:rw"
|
|
|
|
sf-portd:
|
|
build: encfsd
|
|
image: sf-encfsd
|
|
container_name: sf-portd
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
depends_on:
|
|
- sf-redis
|
|
environment:
|
|
- SF_REDIS_AUTH=${SF_REDIS_AUTH}
|
|
- SF_DEBUG
|
|
command: ["/portd.sh"]
|
|
network_mode: none
|
|
volumes:
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/self-for-guest:/config/self-for-guest"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
|
|
- "/var/run/docker.sock:/var/run/docker.sock"
|
|
- "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
|
|
|
|
dns-doh:
|
|
image: crazymax/cloudflared
|
|
container_name: sf-dns-doh
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
networks:
|
|
dns-doh-net:
|
|
ipv4_address: ${SF_DOH_IP:?}
|
|
|
|
dnsmasq:
|
|
image: 4km3/dnsmasq:2.85-r2
|
|
container_name: sf-dnsmasq
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
depends_on:
|
|
- dns-doh
|
|
cap_add:
|
|
- NET_ADMIN
|
|
command: ["--no-resolv", "--domain-needed", "--server=${SF_DOH_IP}#5053", "--server=/onion/${SF_TOR_IP}#5353"]
|
|
networks:
|
|
vpn-net:
|
|
ipv4_address: ${SF_NET_VPN_DNS_IP:?}
|
|
dns-doh-net:
|
|
access-net:
|
|
ipv4_address: ${SF_NET_ACCESS_DNS_IP:?}
|
|
|
|
nordvpn:
|
|
image: hackerschoice/cryptostorm
|
|
container_name: sf-nordvpn
|
|
restart: "no"
|
|
cgroup_parent: sf.slice
|
|
depends_on:
|
|
- dnsmasq
|
|
- sf-redis
|
|
- router
|
|
dns: ${SF_NET_VPN_DNS_IP}
|
|
cap_add:
|
|
- NET_ADMIN #required
|
|
environment:
|
|
# - PRIVATE_KEY=${SF_NORDVPN_PRIVATE_KEY:-}
|
|
- CONFIG=${SF_NORDVPN_CONFIG:-}
|
|
- PROVIDER=NordVPN
|
|
- NETWORK=${SF_NET_LG}
|
|
- NET_VPN_ROUTER_IP=${SF_NET_VPN_ROUTER_IP}
|
|
- POST_UP=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-nordvpn.log up %i
|
|
- PRE_DOWN=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-nordvpn.log down %i
|
|
- RECONNECT=604800 # Re-Connect every 7 days
|
|
- SF_REDIS_AUTH=${SF_REDIS_AUTH}
|
|
- SF_DEBUG
|
|
networks:
|
|
vpn-net:
|
|
ipv4_address: ${SF_NORDVPN_IP}
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=1
|
|
- net.ipv4.conf.all.rp_filter=2
|
|
- net.ipv4.ip_forward=1
|
|
- net.ipv4.conf.all.src_valid_mark=1 # SNAT
|
|
- net.netfilter.nf_conntrack_frag6_timeout=10
|
|
- net.netfilter.nf_conntrack_generic_timeout=180 # default is 600
|
|
- net.netfilter.nf_conntrack_tcp_timeout_syn_sent=10 # default is 120
|
|
- net.netfilter.nf_conntrack_tcp_timeout_syn_recv=1 # default is 30
|
|
- net.netfilter.nf_conntrack_tcp_timeout_last_ack=5 # default is 30
|
|
- net.netfilter.nf_conntrack_tcp_timeout_fin_wait=10 # default is 120
|
|
- net.netfilter.nf_conntrack_tcp_timeout_close=1 # default is 10
|
|
- net.netfilter.nf_conntrack_tcp_timeout_close_wait=10 # default is 60
|
|
- net.netfilter.nf_conntrack_tcp_timeout_unacknowledged=30 # default is 300
|
|
- net.netfilter.nf_conntrack_tcp_timeout_established=10800 # 3h, default is 5 days
|
|
- net.netfilter.nf_conntrack_icmp_timeout=10 # default is 30
|
|
- net.netfilter.nf_conntrack_udp_timeout=10 # default is 30
|
|
# - net.nf_conntrack_udp_timeout_stream= # leave as default of 120
|
|
volumes:
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/vpn:/sf/run/vpn" # Between all VPNs
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
|
|
- "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
|
|
|
|
cryptostorm:
|
|
image: hackerschoice/cryptostorm
|
|
container_name: sf-cryptostorm
|
|
cgroup_parent: sf.slice
|
|
restart: "no"
|
|
depends_on:
|
|
- dnsmasq
|
|
- sf-redis
|
|
- router
|
|
dns: ${SF_NET_VPN_DNS_IP}
|
|
cap_add:
|
|
- NET_ADMIN #required
|
|
environment:
|
|
- CONFIG=${SF_CRYPTOSTORM_CONFIG:-}
|
|
- PROVIDER=CryptoStorm
|
|
- NETWORK=${SF_NET_LG}
|
|
- NET_VPN_ROUTER_IP=${SF_NET_VPN_ROUTER_IP}
|
|
- DNS=1.1.1.1 # Cryptostorm's DNS is often broken
|
|
- POST_UP=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-cryptostorm.log up %i
|
|
- PRE_DOWN=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-cryptostorm.log down %i
|
|
- RECONNECT=604800 # Re-Connect every 7 days
|
|
- SF_REDIS_AUTH=${SF_REDIS_AUTH}
|
|
- SF_DEBUG
|
|
networks:
|
|
vpn-net:
|
|
ipv4_address: ${SF_CRYPTOSTORM_IP}
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=1
|
|
- net.ipv4.conf.all.rp_filter=2
|
|
- net.ipv4.ip_forward=1
|
|
- net.ipv4.conf.all.src_valid_mark=1 # SNAT
|
|
- net.netfilter.nf_conntrack_frag6_timeout=10
|
|
- net.netfilter.nf_conntrack_generic_timeout=180 # default is 600
|
|
- net.netfilter.nf_conntrack_tcp_timeout_syn_sent=10 # default is 120
|
|
- net.netfilter.nf_conntrack_tcp_timeout_syn_recv=5 # default is 30, 5 because of reverse tunnels (CS)
|
|
- net.netfilter.nf_conntrack_tcp_timeout_last_ack=5 # default is 30
|
|
- net.netfilter.nf_conntrack_tcp_timeout_fin_wait=10 # default is 120
|
|
- net.netfilter.nf_conntrack_tcp_timeout_close=1 # default is 10
|
|
- net.netfilter.nf_conntrack_tcp_timeout_close_wait=10 # default is 60
|
|
- net.netfilter.nf_conntrack_tcp_timeout_unacknowledged=30 # default is 300
|
|
- net.netfilter.nf_conntrack_tcp_timeout_established=10800 # 3h, default is 5 days
|
|
- net.netfilter.nf_conntrack_icmp_timeout=10 # default is 30
|
|
- net.netfilter.nf_conntrack_udp_timeout=10 # default is 30
|
|
# - net.nf_conntrack_udp_timeout_stream= # leave as default of 120
|
|
volumes:
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/vpn:/sf/run/vpn" # Between all VPNs
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
|
|
- "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
|
|
# entrypoint: sleep infinity # FIXME-TESTING
|
|
|
|
|
|
mullvad:
|
|
image: hackerschoice/cryptostorm
|
|
container_name: sf-mullvad
|
|
restart: "no"
|
|
cgroup_parent: sf.slice
|
|
depends_on:
|
|
- dnsmasq
|
|
- sf-redis
|
|
- router
|
|
dns: ${SF_NET_VPN_DNS_IP}
|
|
cap_add:
|
|
- NET_ADMIN #required
|
|
environment:
|
|
- CONFIG=${SF_MULLVAD_CONFIG:-}
|
|
- PROVIDER=Mullvad
|
|
- NETWORK=${SF_NET_LG}
|
|
- NET_VPN_ROUTER_IP=${SF_NET_VPN_ROUTER_IP}
|
|
- IS_REDIRECTS_DNS=1
|
|
- POST_UP=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-mullvad.log up %i
|
|
- PRE_DOWN=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-mullvad.log down %i
|
|
- RECONNECT=604800 # Re-Connect every 7 days
|
|
- SF_REDIS_AUTH=${SF_REDIS_AUTH}
|
|
- SF_DEBUG
|
|
networks:
|
|
vpn-net:
|
|
ipv4_address: ${SF_MULLVAD_IP}
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=1
|
|
- net.ipv4.conf.all.rp_filter=2
|
|
- net.ipv4.ip_forward=1
|
|
- net.ipv4.conf.all.src_valid_mark=1 # SNAT
|
|
- net.netfilter.nf_conntrack_frag6_timeout=10
|
|
- net.netfilter.nf_conntrack_generic_timeout=180 # default is 600
|
|
- net.netfilter.nf_conntrack_tcp_timeout_syn_sent=10 # default is 120
|
|
- net.netfilter.nf_conntrack_tcp_timeout_syn_recv=1 # default is 30
|
|
- net.netfilter.nf_conntrack_tcp_timeout_last_ack=5 # default is 30
|
|
- net.netfilter.nf_conntrack_tcp_timeout_fin_wait=10 # default is 120
|
|
- net.netfilter.nf_conntrack_tcp_timeout_close=1 # default is 10
|
|
- net.netfilter.nf_conntrack_tcp_timeout_close_wait=10 # default is 60
|
|
- net.netfilter.nf_conntrack_tcp_timeout_unacknowledged=30 # default is 300
|
|
- net.netfilter.nf_conntrack_tcp_timeout_established=10800 # 3h, default is 5 days
|
|
- net.netfilter.nf_conntrack_icmp_timeout=10 # default is 30
|
|
- net.netfilter.nf_conntrack_udp_timeout=10 # default is 30
|
|
# - net.nf_conntrack_udp_timeout_stream= # leave as default of 120
|
|
volumes:
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/vpn:/sf/run/vpn" # Between all VPNs
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
|
|
- "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
|
|
|
|
novpn:
|
|
build: router
|
|
image: sf-router
|
|
hostname: sf-novpn
|
|
container_name: sf-novpn
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
depends_on:
|
|
- dnsmasq
|
|
- sf-redis
|
|
- router
|
|
cap_add:
|
|
- NET_ADMIN #required
|
|
environment:
|
|
- SF_REDIS_AUTH=${SF_REDIS_AUTH}
|
|
- NET_LG=${SF_NET_LG:?}
|
|
- NET_VPN_ROUTER_IP=${SF_NET_VPN_ROUTER_IP:?}
|
|
- SF_NOVPN_IP=${SF_NOVPN_IP}
|
|
- PROVIDER=NoVPN
|
|
- SF_DIRECT
|
|
- SF_DEBUG
|
|
networks:
|
|
vpn-net:
|
|
ipv4_address: ${SF_NOVPN_IP}
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=1
|
|
- net.ipv4.conf.all.rp_filter=2
|
|
- net.ipv4.ip_forward=1
|
|
- net.netfilter.nf_conntrack_frag6_timeout=10
|
|
- net.netfilter.nf_conntrack_generic_timeout=180 # default is 600
|
|
- net.netfilter.nf_conntrack_tcp_timeout_syn_sent=10 # default is 120
|
|
- net.netfilter.nf_conntrack_tcp_timeout_syn_recv=1 # default is 30
|
|
- net.netfilter.nf_conntrack_tcp_timeout_last_ack=5 # default is 30
|
|
- net.netfilter.nf_conntrack_tcp_timeout_fin_wait=10 # default is 120
|
|
- net.netfilter.nf_conntrack_tcp_timeout_close=1 # default is 10
|
|
- net.netfilter.nf_conntrack_tcp_timeout_close_wait=10 # default is 60
|
|
- net.netfilter.nf_conntrack_tcp_timeout_unacknowledged=30 # default is 300
|
|
- net.netfilter.nf_conntrack_tcp_timeout_established=10800 # 3h, default is 5 days
|
|
- net.netfilter.nf_conntrack_icmp_timeout=10 # default is 30
|
|
- net.netfilter.nf_conntrack_udp_timeout=10 # default is 30
|
|
# - net.nf_conntrack_udp_timeout_stream= # leave as default of 120
|
|
volumes:
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/vpn:/sf/run/vpn" # Between all VPNs
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
|
|
- "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
|
|
entrypoint: ["/init-novpn.sh"]
|
|
|
|
router:
|
|
build: router
|
|
image: sf-router
|
|
hostname: sf-router
|
|
container_name: sf-router
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
depends_on:
|
|
- router-fix-network
|
|
networks:
|
|
incoming-net:
|
|
ipv4_address: ${SF_NET_DIRECT_ROUTER_IP}
|
|
vpn-net:
|
|
ipv4_address: ${SF_NET_VPN_ROUTER_IP}
|
|
guest-net:
|
|
ipv4_address: ${SF_NET_LG_ROUTER_IP_DUMMY} # Will be replaced by init.sh with x.x.x.1
|
|
access-net:
|
|
ipv4_address: ${SF_NET_ACCESS_ROUTER_IP}
|
|
dmz-net:
|
|
ipv4_address: ${SF_NET_DMZ_ROUTER_IP}
|
|
cap_add:
|
|
- NET_ADMIN
|
|
sysctls:
|
|
- net.ipv4.conf.all.src_valid_mark=1 # SNAT
|
|
- net.ipv4.conf.all.rp_filter=2
|
|
- net.netfilter.nf_conntrack_frag6_timeout=10
|
|
- net.netfilter.nf_conntrack_generic_timeout=180 # default is 600
|
|
- net.netfilter.nf_conntrack_tcp_timeout_syn_sent=10 # default is 120
|
|
- net.netfilter.nf_conntrack_tcp_timeout_syn_recv=5 # default is 30, 5 because of reverse tunnels (sf-router)
|
|
- net.netfilter.nf_conntrack_tcp_timeout_last_ack=5 # default is 30
|
|
- net.netfilter.nf_conntrack_tcp_timeout_fin_wait=10 # default is 120
|
|
- net.netfilter.nf_conntrack_tcp_timeout_close=1 # default is 10
|
|
- net.netfilter.nf_conntrack_tcp_timeout_close_wait=10 # default is 60
|
|
- net.netfilter.nf_conntrack_tcp_timeout_unacknowledged=30 # default is 300
|
|
- net.netfilter.nf_conntrack_tcp_timeout_established=10800 # 3h, default is 5 days
|
|
- net.netfilter.nf_conntrack_icmp_timeout=10 # default is 30
|
|
- net.netfilter.nf_conntrack_udp_timeout=10 # default is 30
|
|
# - net.nf_conntrack_udp_timeout_stream= # leave as default of 120
|
|
ports:
|
|
- "${SF_SSH_PORT:-22}:22"
|
|
- "${SF_SSH_PORT2:-443}:22"
|
|
environment:
|
|
- SF_DEBUG
|
|
- SF_MAXOUT
|
|
- SF_MAXIN
|
|
- NET_LG=${SF_NET_LG:?}
|
|
- NET_LG_ROUTER_IP=${SF_NET_LG_ROUTER_IP:?}
|
|
- NET_LG_ROUTER_IP_DUMMY=${SF_NET_LG_ROUTER_IP_DUMMY:?}
|
|
- NET_VPN=${SF_NET_VPN:?}
|
|
- NET_ONION=${SF_NET_ONION:?}
|
|
- MULLVAD_ROUTE=${SF_MULLVAD_ROUTE:-10.124.0.0/22}
|
|
- TOR_IP=${SF_TOR_IP:?}
|
|
- NOVPN_IP=${SF_NOVPN_IP:?}
|
|
- GSNC_IP=${SF_GSNC_IP:?}
|
|
- SSHD_IP=${SF_SSHD_IP:?}
|
|
- NGINX_IP=${SF_NGINX_IP:?}
|
|
- RPC_IP=${SF_RPC_IP:?}
|
|
- NET_DIRECT_ROUTER_IP=${SF_NET_DIRECT_ROUTER_IP:?}
|
|
- NET_DIRECT_BRIDGE_IP=${SF_NET_DIRECT_BRIDGE_IP:?}
|
|
- NET_VPN_ROUTER_IP=${SF_NET_VPN_ROUTER_IP:?}
|
|
- NET_VPN_DNS_IP=${SF_NET_VPN_DNS_IP:?}
|
|
- NET_ACCESS_ROUTER_IP=${SF_NET_ACCESS_ROUTER_IP:?}
|
|
- NET_DMZ_ROUTER_IP=${SF_NET_DMZ_ROUTER_IP:?}
|
|
- SF_DIRECT
|
|
- SF_NORDVPN_IP=${SF_NORDVPN_IP:?}
|
|
- SF_CRYPTOSTORM_IP=${SF_CRYPTOSTORM_IP:?}
|
|
- SF_MULLVAD_IP=${SF_MULLVAD_IP:?}
|
|
- SF_GUEST_MTU=${SF_GUEST_MTU:-1420}
|
|
volumes:
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run:/sf/run"
|
|
- "${SF_BASEDIR:-.}/config/db:/config/db:ro"
|
|
- "${SF_BASEDIR:-.}/config/etc/sf:/config/host/etc/sf:ro"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
|
|
- "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
|
|
entrypoint: ["/init.sh"]
|
|
|
|
# The master for modifying other containers
|
|
# - Set default routes
|
|
# - Retrieve dmesg
|
|
# - Set WireGuard routes for FOB
|
|
master:
|
|
build: master
|
|
image: sf-master
|
|
hostname: sf-master
|
|
container_name: sf-master
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
depends_on:
|
|
- sf-redis
|
|
network_mode: none
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- SYS_ADMIN # For nsenter
|
|
- SYSLOG # For dmesg
|
|
pid: "host" # For nsenter
|
|
environment:
|
|
- SF_DEBUG
|
|
- SF_FQDN=${SF_FQDN:-SF_FQDN-NOT-SET.hack.segfault.net}
|
|
- WG_EP_IP=${SF_IP}
|
|
- SF_REDIS_AUTH=${SF_REDIS_AUTH}
|
|
- SF_RPC_IP=${SF_RPC_IP:?}
|
|
- SF_TOR_IP=${SF_TOR_IP:?}
|
|
- WG_IPS=${SF_WG_IPS:-172.16.0.x/16,fd:16::x/104}
|
|
- SF_MULLVAD_ROUTE=${SF_MULLVAD_ROUTE:?}
|
|
- SF_DNS=${SF_NET_VPN_DNS_IP}
|
|
- SF_NET_LG_ROUTER_IP=${SF_NET_LG_ROUTER_IP:?}
|
|
- SF_HOST_MTU=${SF_HOST_MTU:-1500}
|
|
volumes:
|
|
- "${SF_SHMDIR:-/dev/shm/sf}:/dev/shm/sf"
|
|
- "${SF_BASEDIR:-.}/config/db:/config/db"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
|
|
- "${SF_BASEDIR:-.}/config/etc/sf:/config/host/etc/sf:ro"
|
|
- "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
|
|
- "/var/run/docker.sock:/var/run/docker.sock"
|
|
# - /research/segfault/master/cgi-bin:/cgi-bin:ro # FIXME-2022
|
|
entrypoint: ["/init-master.sh"]
|
|
|
|
rpc:
|
|
image: nginx
|
|
container_name: sf-rpc
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
depends_on:
|
|
- master
|
|
networks:
|
|
guest-net:
|
|
ipv4_address: ${SF_RPC_IP}
|
|
dns: 255.255.255.255
|
|
entrypoint: ["nginx", "-g", "daemon off;"]
|
|
volumes:
|
|
- "${SF_SHMDIR:-/dev/shm/sf}:/dev/shm/sf"
|
|
- "${SF_BASEDIR:-.}/config/db:/config/db"
|
|
- "${SF_BASEDIR:-.}/config/etc/nginx/nginx-rpc.conf:/etc/nginx/nginx.conf:ro"
|
|
|
|
wg:
|
|
build: router
|
|
image: sf-router
|
|
hostname: sf-wg
|
|
container_name: sf-wg
|
|
restart: ${SF_RESTART:-on-failure}:1 # Try 1 restart
|
|
cgroup_parent: sf.slice
|
|
depends_on:
|
|
- router-fix-network
|
|
networks:
|
|
incoming-net:
|
|
ipv4_address: ${SF_NET_DIRECT_WG_IP}
|
|
cap_add:
|
|
- NET_ADMIN
|
|
sysctls:
|
|
- net.ipv4.conf.all.src_valid_mark=1 # SNAT
|
|
- net.ipv4.conf.all.rp_filter=2
|
|
- net.netfilter.nf_conntrack_frag6_timeout=10
|
|
- net.netfilter.nf_conntrack_generic_timeout=180 # default is 600
|
|
- net.netfilter.nf_conntrack_tcp_timeout_syn_sent=10 # default is 120
|
|
- net.netfilter.nf_conntrack_tcp_timeout_syn_recv=1 # default is 30
|
|
- net.netfilter.nf_conntrack_tcp_timeout_last_ack=5 # default is 30
|
|
- net.netfilter.nf_conntrack_tcp_timeout_fin_wait=10 # default is 120
|
|
- net.netfilter.nf_conntrack_tcp_timeout_close=1 # default is 10
|
|
- net.netfilter.nf_conntrack_tcp_timeout_close_wait=10 # default is 60
|
|
- net.netfilter.nf_conntrack_tcp_timeout_unacknowledged=30 # default is 300
|
|
- net.netfilter.nf_conntrack_tcp_timeout_established=10800 # 3h, default is 5 days
|
|
- net.netfilter.nf_conntrack_icmp_timeout=10 # default is 30
|
|
- net.netfilter.nf_conntrack_udp_timeout=10 # default is 30
|
|
# - net.nf_conntrack_udp_timeout_stream= # leave as default of 120
|
|
environment:
|
|
- SF_DEBUG
|
|
volumes:
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/vpn:/sf/run/vpn"
|
|
- "${SF_BASEDIR:-.}/config/etc/sf:/config/host/etc/sf:ro"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
|
|
- "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
|
|
entrypoint: ["/init-wg.sh"]
|
|
|
|
router-fix-network:
|
|
build: router
|
|
image: sf-router
|
|
container_name: sf-fix-network
|
|
restart: ${SF_RESTART:-on-failure}:1 # Try 1 restart
|
|
cgroup_parent: sf.slice
|
|
network_mode: host # host's stack
|
|
privileged: true # For 'sysctl -w' in fix-network.sh
|
|
cap_add:
|
|
- NET_ADMIN
|
|
environment:
|
|
- SF_DEBUG
|
|
- NET_LG_ROUTER_IP=${SF_NET_LG_ROUTER_IP:?}
|
|
- NET_DIRECT_WG_IP=${SF_NET_DIRECT_WG_IP:?}
|
|
- NET_DIRECT_ROUTER_IP=${SF_NET_DIRECT_ROUTER_IP:?}
|
|
- NET_DIRECT_BRIDGE_IP=${SF_NET_DIRECT_BRIDGE_IP:?}
|
|
volumes:
|
|
- "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
|
|
entrypoint: ["/fix-network.sh"]
|
|
|
|
tor:
|
|
build: tor
|
|
image: sf-tor
|
|
container_name: sf-tor
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
hostname: sf-tor
|
|
networks:
|
|
vpn-net:
|
|
ipv4_address: ${SF_TOR_IP}
|
|
cap_add:
|
|
- NET_ADMIN
|
|
environment:
|
|
- SF_DEBUG
|
|
- SF_TOR_VIA_VPN
|
|
- NET_LG=${SF_NET_LG:?}
|
|
- SSHD_IP=${SF_SSHD_IP:?}
|
|
- NGINX_IP=${SF_NGINX_IP:?}
|
|
- NET_VPN_ROUTER_IP=${SF_NET_VPN_ROUTER_IP:?}
|
|
dns: ${SF_NET_VPN_DNS_IP}
|
|
depends_on:
|
|
- dnsmasq
|
|
- nginx
|
|
volumes:
|
|
- "${SF_BASEDIR:-.}/config/${SF_FQDN:-SF_FQDN-NOT-SET.hack.segfault.net}/tor/hidden:/var/lib/tor/hidden"
|
|
- "${SF_BASEDIR:-.}/config/etc/tor:/config/host/etc/tor:ro"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest"
|
|
|
|
gsnc:
|
|
build: gsnc
|
|
image: sf-gsnc
|
|
container_name: sf-gsnc
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
networks:
|
|
access-net:
|
|
ipv4_address: ${SF_GSNC_IP}
|
|
dns: ${SF_NET_ACCESS_DNS_IP}
|
|
cap_add:
|
|
- NET_ADMIN # need to set default route via sf-router
|
|
depends_on:
|
|
- dnsmasq
|
|
- router
|
|
environment:
|
|
- SF_SSH_PORT=${SF_SSH_PORT:-22}
|
|
- SF_FQDN=${SF_FQDN:-SF_FQDN-NOT-SET.hack.segfault.net}
|
|
- SF_DEBUG
|
|
- SF_SEED=${SF_SEED}
|
|
- SSHD_IP=${SF_SSHD_IP}
|
|
volumes:
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest"
|
|
entrypoint: ["/sf-gsnc.sh", "${SF_SSHD_IP}"]
|
|
|
|
segfault:
|
|
build: host
|
|
image: sf-host
|
|
# /bin/segfaultsh need to know the container name; set it to sf-host statically
|
|
container_name: sf-host
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
networks:
|
|
# WARNING: sshd's port forward/socks can access those networks.
|
|
access-net:
|
|
ipv4_address: ${SF_SSHD_IP}
|
|
dns: ${SF_NET_ACCESS_DNS_IP}
|
|
cap_add:
|
|
- NET_ADMIN # need to set default route via sf-router
|
|
- SYS_ADMIN # Move non-priv sshd to guest's network Namespace (setns())
|
|
- SYS_PTRACE # needed for debugging (/bin/sf_trace)
|
|
pid: host # Move non-priv sshd to guest's network NameSpace.
|
|
depends_on:
|
|
- dnsmasq
|
|
- router
|
|
- sf-encfsd
|
|
init: true
|
|
# SSHD clears all environment variables before spwaning a shell (segfaultsh).
|
|
# Add any variables to docker_sshd.sh as well.
|
|
environment:
|
|
- SF_CG_PARENT=${SF_CG_PARENT:-sf-guest.slice}
|
|
- SF_DNS=${SF_NET_VPN_DNS_IP} # passed to sf-guest
|
|
- SF_TOR_IP=${SF_TOR_IP}
|
|
- SF_BASEDIR=${SF_BASEDIR}
|
|
- SF_SHMDIR=${SF_SHMDIR:-/dev/shm/sf}
|
|
- SF_USER=${SF_USER:-root}
|
|
- SF_USER_PASSWORD=${SF_USER_PASSWORD:-segfault}
|
|
- SF_FQDN=${SF_FQDN:-SF_FQDN-NOT-SET.hack.segfault.net}
|
|
- SF_REDIS_AUTH=${SF_REDIS_AUTH}
|
|
- SF_RPC_IP=${SF_RPC_IP}
|
|
- SF_NET_LG_ROUTER_IP=${SF_NET_LG_ROUTER_IP:?}
|
|
- SF_SEED=${SF_SEED}
|
|
- SF_HM_SIZE_LG=8
|
|
- SF_DIRECT
|
|
- SF_DEBUG
|
|
- SF_BACKING_FS
|
|
# - SF_DEBUG_SSHD=1 # FIXME-TESTING sshd debug
|
|
volumes:
|
|
- "${SF_BASEDIR:-.}/config:/config/host"
|
|
- "${SF_BASEDIR:-.}/data/share:/sf/share:ro"
|
|
- "${SF_BASEDIR:-.}/data/ext:/sf/ext:ro"
|
|
- "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run:/sf/run"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/encfs-sec/www-root:/sec/www-root:slave"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/self-for-guest:/config/self-for-guest"
|
|
- "/var/run/docker.sock:/var/run/docker.sock"
|
|
- "/var/lib/lxcfs:/var/lib/lxcfs:ro"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
|
|
# - /research/segfault/host/fs-root/bin/segfaultsh:/bin/segfaultsh:ro # FIXME-TESTING
|
|
# - /research/segfault/host:/host:ro # FIXME-TESTING sshd debug
|
|
|
|
nginx:
|
|
image: nginx
|
|
container_name: sf-nginx
|
|
restart: ${SF_RESTART:-on-failure}
|
|
cgroup_parent: sf.slice
|
|
depends_on:
|
|
- sf-encfsd
|
|
entrypoint: ["/sf/bin/wait_semaphore.sh", "/sec/.IS-ENCRYPTED", "nginx", "-g", "daemon off;"]
|
|
networks:
|
|
dmz-net:
|
|
ipv4_address: ${SF_NGINX_IP}
|
|
dns: 255.255.255.255
|
|
volumes:
|
|
- "${SF_BASEDIR:-.}/sfbin/wait_semaphore.sh:/sf/bin/wait_semaphore.sh:ro"
|
|
- "${SF_SHMDIR:-/dev/shm/sf}/encfs-sec/www-root:/sec:slave,ro"
|
|
- "${SF_BASEDIR:-.}/config/etc/nginx/nginx.conf:/etc/nginx/nginx.conf:ro"
|
|
|
|
networks:
|
|
# Force docker0
|
|
default:
|
|
driver: bridge
|
|
driver_opts:
|
|
com.docker.network.driver.mtu: ${SF_HOST_MTU:-1500}
|
|
|
|
vpn-net:
|
|
name: sf-vpn
|
|
driver: bridge
|
|
driver_opts:
|
|
com.docker.network.driver.mtu: ${SF_HOST_MTU:-1500}
|
|
ipam:
|
|
config:
|
|
- subnet: ${SF_NET_VPN:?}
|
|
|
|
incoming-net:
|
|
# Note: 'name' must be the first in alphabetic order. Docker forwards
|
|
# the host's port to the _first_ network (in alphanetic order). sf-router
|
|
# expects all host traffic to arrive at SF_NET_DIRECT_ROUTE_IP.
|
|
name: A-sf-direct
|
|
driver: bridge
|
|
driver_opts:
|
|
com.docker.network.driver.mtu: ${SF_HOST_MTU:-1500}
|
|
ipam:
|
|
config:
|
|
- subnet: ${SF_NET_DIRECT:?}
|
|
|
|
access-net:
|
|
# sf-host and gsnc
|
|
name: sf-access
|
|
driver: bridge
|
|
driver_opts:
|
|
com.docker.network.driver.mtu: ${SF_HOST_MTU:-1500}
|
|
ipam:
|
|
config:
|
|
- subnet: ${SF_NET_ACCESS:?}
|
|
|
|
dmz-net:
|
|
name: sf-dmz
|
|
driver: bridge
|
|
driver_opts:
|
|
com.docker.network.driver.mtu: ${SF_HOST_MTU:-1500}
|
|
ipam:
|
|
config:
|
|
- subnet: ${SF_NET_DMZ:?}
|
|
|
|
dns-doh-net:
|
|
name: sf-dns-doh
|
|
driver: bridge
|
|
driver_opts:
|
|
com.docker.network.driver.mtu: ${SF_HOST_MTU:-1500}
|
|
ipam:
|
|
config:
|
|
- subnet: ${SF_NET_DOH:?}
|
|
|
|
# User's shell
|
|
guest-net:
|
|
name: sf-guest
|
|
driver: bridge
|
|
driver_opts:
|
|
com.docker.network.driver.mtu: ${SF_GUEST_MTU:-1420}
|
|
# Can not use 'internal'. This will only remvoe the host's bridge
|
|
# but this also means we can not route via 10.11.0.* even if we can
|
|
# ping the router.
|
|
# internal: true
|
|
ipam:
|
|
config:
|
|
- subnet: ${SF_NET_LG:?}
|
|
# gateway: 10.11.0.1 # Set's the IP of the host's bridge.
|
|
|
|
# 255 hosts. BUG-ARP-CACHE
|
|
# default gw is always 10.11.0.1 and is the host side of the bridge (?)
|
|
# The init.sh script in sf-router will overwrite it's own interface with 10.11.0.1
|
|
# so that the sf-router receives all traffic.
|