From 1ec1aa6307a8dffc5aa5369c3db70f8c71709e66 Mon Sep 17 00:00:00 2001 From: auto-ci Date: Sun, 8 Mar 2026 14:08:46 -0400 Subject: [PATCH] Clarify README SOCKS auth and secret usage --- README.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 5f590e3..b87c17d 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ Welcome to darkproxy... The stack now uses safer defaults for production: -* Sensitive passwords are loaded from Docker secrets instead of inline values. +* Service admin/web passwords are loaded from Docker secrets instead of inline values. * Admin/monitoring ports are bound to `127.0.0.1` on the host. * 3proxy SOCKS auth is currently disabled (`auth none`) for trusted/internal use. * Pi-hole ARP cache parsing is disabled in Docker (`FTLCONF_database_network_parseARPcache=false`) to prevent recurring netlink `neigh`/ARP errors. @@ -16,6 +16,12 @@ printf 'YOUR_STRONG_PIHOLE_PASSWORD\n' > secrets/pihole_webpassword.txt printf 'YOUR_STRONG_GRAFANA_PASSWORD\n' > secrets/grafana_admin_password.txt ``` +SOCKS auth note: + +* Current default is `auth none` in `3proxy/first-instanse.cfg`. +* `secrets/3proxy_users.txt` is not used in this mode. +* Only re-add `PROXY_USERS` compose wiring if you intentionally switch back to `auth strong`. + Pi-hole note: disabling ARP parsing avoids noisy `Failed to read ARP cache` messages in containerized setups where neighbor-table netlink operations are not supported. This only affects Pi-hole's network-table enrichment, not DNS