blade/darkproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix primary SOCKS onion routing and document port usage
Configuration validation / lint (push) Has been cancelled
Details
Configuration validation / smoke (push) Has been cancelled
Details

Browse Source
This commit is contained in:
auto-ci
2026-03-08 13:53:02 -04:00
parent 22e16773ef
commit 74fe9ed02c
4 changed files with 81 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
3proxy/first-instanse.cfg
+5 -3
View File
@@ -1,8 +1,8 @@
# regular 3proxy configuration
fakeresolve
flush
auth strong
users $/run/secrets/PROXY_USERS
nserver 10.5.0.6
nscache 65536
auth none
admin -p8161 -a127.0.0.1
# strict required by 3proxy-eagle log lines
log
@@ -33,10 +33,12 @@ allow * * *.meshname
parent 1000 socks5+ 127.0.0.1 1085
allow * * *.meship
parent 1000 socks5+ 127.0.0.1 1085
flush
## onion sites
allow * * *.onion
parent 1000 socks5+ 10.5.0.7 9050
flush
## clearnet via another proxy or change to tor (9050)
allow *
README.md
+25 -5
View File
@@ -6,20 +6,16 @@ The stack now uses safer defaults for production:
* Sensitive passwords are loaded from Docker secrets instead of inline values.
* Admin/monitoring ports are bound to `127.0.0.1` on the host.
* 3proxy now requires authentication (`auth strong`).
* 3proxy SOCKS auth is currently disabled (`auth none`) for trusted/internal use.
* Pi-hole ARP cache parsing is disabled in Docker (`FTLCONF_database_network_parseARPcache=false`) to prevent recurring netlink `neigh`/ARP errors.
Before starting in production, set these secret files:
```sh
printf 'proxyuser:CL:YOUR_STRONG_PROXY_PASSWORD\n' > secrets/3proxy_users.txt
printf 'YOUR_STRONG_PIHOLE_PASSWORD\n' > secrets/pihole_webpassword.txt
printf 'YOUR_STRONG_GRAFANA_PASSWORD\n' > secrets/grafana_admin_password.txt
```
SOCKS clients must now authenticate to 3proxy with credentials from
`secrets/3proxy_users.txt`.
Pi-hole note: disabling ARP parsing avoids noisy `Failed to read ARP cache`
messages in containerized setups where neighbor-table netlink operations are not
supported. This only affects Pi-hole's network-table enrichment, not DNS
@@ -40,6 +36,30 @@ This container runs the following vontainers in the stack.
* Socks5 server for I2P
- Tor container
## SOCKS ports on host
Use these host ports depending on the traffic type:
* `127.0.0.1:2000` -> direct Tor SOCKS (`darktor:9050`), recommended primary endpoint.
- Supports `.onion` and clearnet via `--socks5-hostname`.
* `127.0.0.1:2010` -> `dark3proxy` SOCKS (`dark3proxy:1080`) for advanced policy routing.
- Intended for stack routing rules; use `:2000` when you specifically need reliable `.onion` access.
* `127.0.0.1:2004` -> additional direct Tor SOCKS (`darktor:9050`).
* `127.0.0.1:2006/udp` -> Tor DNSPort (`darktor:9053`).
Quick checks:
```sh
# Onion over primary SOCKS
curl --socks5-hostname 127.0.0.1:2000 -I http://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion
# Clearnet over primary SOCKS
curl --socks5-hostname 127.0.0.1:2000 -I https://example.com
# Clearnet over dark3proxy SOCKS
curl --socks5-hostname 127.0.0.1:2010 -I https://example.com
```
The system offers a DNS that resolves many darknet and clearnet IP's. The
stack now handles:
docker-compose.lock.yml
+35 -25
View File
@@ -1,7 +1,6 @@
services:
dark3proxy:
container_name: dark3proxy
image: host60/darkproxy-dark3proxy:v1.0
build:
context: ./3proxy/.
dns:
@@ -14,8 +13,8 @@ services:
sysctls:
- "net.ipv6.conf.all.disable_ipv6=0"
ports:
- 100.117.196.19:2000:1080 # socks port
- 100.117.196.19:2002:8161 # 3proxy-eagle web page
- "2010:1080" # dark3proxy SOCKS (advanced routing)
- "2002:8161" # 3proxy-eagle web page
networks:
darkproxy:
ipv4_address: 10.5.0.8
@@ -29,12 +28,14 @@ services:
- NET_ADMIN
devices:
- /dev/net/tun:/dev/net/tun
volumes:
- "./i2pd_yggdrasil_docker/src/entrypoint.sh:/entrypoint.sh:ro"
ports:
# I2P Service Ports
# - "2827:2827" # BOB Bridge
# - "4444:4444" # HTTP Proxy
# - "4447:4447" # SOCKS Proxy
- "100.117.196.19:2001:7070" # Webconsole
- "2001:7070" # Webconsole
# - "7650:7650" # I2PControl
# - "7654:7654" # I2CP
# - "7656:7656" # SAM Bridge (TCP)
@@ -45,6 +46,13 @@ services:
- "10654:10654" # Yggdrasil Listener
environment:
tz: /run/secrets/tz
# Lower-intensity peer selection for faster readiness in lock workflow.
YGG_PEER_PARALLEL: "2"
YGG_PEER_PINGS: "3"
YGG_PEER_BEST: "4"
YGG_PEER_MAX_FROM_COUNTRY: "1"
YGG_PEER_PING_INTERVAL: "0.3"
YGG_CONNECT_WAIT_SECONDS: "20"
secrets:
- tz
restart: unless-stopped
@@ -53,7 +61,7 @@ services:
interval: 30s
timeout: 10s
retries: 3
start_period: 60s
start_period: 15m
sysctls:
- "net.ipv6.conf.all.disable_ipv6=0"
mac_address: ce:22:b8:0e:6e:78
@@ -62,24 +70,23 @@ services:
ipv4_address: 10.5.0.2
tor_yggdrasil:
image: host60/tor_yggdrasil:v1.0
build:
context: ./tor_yggdrasil_docker
dockerfile: Dockerfile
# image: tor_yggdrasil:latest
# container_name: tor_over_yggdrasil
container_name: darktor
entrypoint: ["tor"]
command: ["-f", "/etc/tor/torrc"]
# platform removed; image is amd64-only
cap_add:
- NET_ADMIN # Required for network tunnel management
security_opt:
- no-new-privileges:true # Security enhancement - prevent privilege esca>
devices:
- /dev/net/tun:/dev/net/tun # TUN device for Yggdrasil network interface
volumes:
- "./tor_yggdrasil_docker/torrc:/etc/tor/torrc:ro"
ports:
# - "127.0.0.1:9050:9050/tcp" # SOCKS5 proxy port (Tor) for application-l>
- "10655:10655/tcp" # Yggdrasil peer connections
secrets:
- YGGDRASIL_GENERATE_KEYS
environment:
YGGDRASIL_GENERATE_KEYS: /run/secrets/YGGDRASIL_GENERATE_KEYS # Generate new Yggdrasil keys on startup
- "127.0.0.1:2000:9050/tcp" # primary host SOCKS (direct Tor, onion-capable)
- "127.0.0.1:2004:9050/tcp" # direct Tor SOCKS (onion-capable)
- "127.0.0.1:2006:9053/udp" # direct Tor DNSPort
restart: unless-stopped # Auto-restart unless manually stopped
dns:
- "10.5.0.6"
@@ -107,7 +114,6 @@ services:
coredns:
# image: darkdns
image: host60/darkdns:v1.0
build:
context: ./PopuraDNS
dockerfile: Dockerfile
@@ -150,12 +156,12 @@ services:
pihole:
container_name: darkpihole
image: pihole/pihole:latest
platform: linux/arm64
platform: linux/amd64
# For DHCP it is recommended to remove these ports and instead add: network_mode: "host"
ports:
# DNS Ports
# - "53:53/tcp"
# - "53:53/udp"
- "53:53/tcp"
- "53:53/udp"
# Default HTTP Port
# - "80:80/tcp"
# Default HTTPs Port. FTL will generate a self-signed certificate
@@ -164,7 +170,7 @@ services:
# - "67:67/udp"
# Uncomment the line below if you are using Pi-hole as your NTP server
# - "123:123/udp"
- "100.117.196.19:2003:80/tcp" # pihole web port
- "2003:80/tcp" # pihole web port
environment:
# Set the appropriate timezone for your location (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones), e.g:
TZ: 'America/Detroit'
@@ -206,10 +212,10 @@ services:
geth:
image: ethereum/client-go:latest
platform: linux/arm64
platform: linux/amd64
container_name: darkgeth
command:
- --syncmode=light
- --syncmode=snap
- --http
- --http.addr=0.0.0.0
- --http.port=8545
@@ -231,11 +237,15 @@ services:
emc:
image: wg00/emercoin:0.8.4
platform: linux/arm64
platform: linux/amd64
container_name: darkemer
volumes:
- emc_data:/emc
- emc_data:/emc/data
- /etc/localtime:/etc/localtime:ro
command:
- -datadir=/emc/data
- -conf=/emc/emercoin.conf
- -printtoconsole
networks:
darkproxy:
ipv4_address: 10.5.0.9
docker-compose.yml
+16 -20
View File
@@ -10,8 +10,6 @@ services:
volumes:
- "./3proxy/first-instanse.cfg:/etc/3proxy/first-instanse.cfg"
- "./3proxy/second-instanse.cfg:/etc/3proxy/second-instanse.cfg"
secrets:
- PROXY_USERS
restart: unless-stopped
cpus: "1.0"
mem_reservation: 64m
@@ -19,8 +17,8 @@ services:
sysctls:
- "net.ipv6.conf.all.disable_ipv6=0"
ports:
- "127.0.0.1:2000:1080" # socks port (localhost only)
- "127.0.0.1:2002:8161" # 3proxy-eagle web page (localhost only)
- "2010:1080" # dark3proxy SOCKS (advanced routing)
- "2002:8161" # 3proxy-eagle web page (localhost only)
networks:
darkproxy:
ipv4_address: 10.5.0.8
@@ -78,20 +76,17 @@ services:
# image: tor_yggdrasil:latest
# container_name: tor_over_yggdrasil
container_name: darktor
entrypoint: ["tor"]
command: ["-f", "/etc/tor/torrc"]
# platform removed; image is amd64-only
cap_add:
- NET_ADMIN # Required for network tunnel management
security_opt:
- no-new-privileges:true # Security enhancement - prevent privilege esca>
devices:
- /dev/net/tun:/dev/net/tun # TUN device for Yggdrasil network interface
volumes:
- "./tor_yggdrasil_docker/torrc:/etc/tor/torrc:ro"
ports:
# - "127.0.0.1:9050:9050/tcp" # SOCKS5 proxy port (Tor) for application-l>
- "10655:10655/tcp" # Yggdrasil peer connections
secrets:
- YGGDRASIL_GENERATE_KEYS
environment:
YGGDRASIL_GENERATE_KEYS: /run/secrets/YGGDRASIL_GENERATE_KEYS # Generate new Yggdrasil keys on startup
- "127.0.0.1:2000:9050/tcp" # primary host SOCKS (direct Tor, onion-capable)
- "127.0.0.1:2004:9050/tcp" # direct Tor SOCKS (onion-capable)
- "127.0.0.1:2006:9053/udp" # direct Tor DNSPort
restart: unless-stopped # Auto-restart unless manually stopped
cpus: "2.0"
mem_reservation: 256m
@@ -175,8 +170,8 @@ services:
# For DHCP it is recommended to remove these ports and instead add: network_mode: "host"
ports:
# DNS Ports
# - "53:53/tcp"
# - "53:53/udp"
- "53:53/tcp"
- "53:53/udp"
# Default HTTP Port
# - "80:80/tcp"
# Default HTTPs Port. FTL will generate a self-signed certificate
@@ -234,11 +229,14 @@ services:
emc:
image: wg00/emercoin:0.8.4
platform: linux/arm64
container_name: darkemer
volumes:
- emc_data:/emc
- emc_data:/emc/data
- /etc/localtime:/etc/localtime:ro
command:
- -datadir=/emc/data
- -conf=/emc/emercoin.conf
- -printtoconsole
networks:
darkproxy:
ipv4_address: 10.5.0.9
@@ -458,6 +456,4 @@ secrets:
file: ./secrets/pihole_webpassword.txt
GRAFANA_ADMIN_PASSWORD:
file: ./secrets/grafana_admin_password.txt
PROXY_USERS:
file: ./secrets/3proxy_users.txt