From 74fe9ed02c153844c00d689776fa13e23d946fb5 Mon Sep 17 00:00:00 2001 From: auto-ci Date: Sun, 8 Mar 2026 13:53:02 -0400 Subject: [PATCH] Fix primary SOCKS onion routing and document port usage --- 3proxy/first-instanse.cfg | 8 ++++-- README.md | 30 ++++++++++++++++---- docker-compose.lock.yml | 60 +++++++++++++++++++++++---------------- docker-compose.yml | 36 +++++++++++------------ 4 files changed, 81 insertions(+), 53 deletions(-) diff --git a/3proxy/first-instanse.cfg b/3proxy/first-instanse.cfg index 0bb15aa..5a31c7a 100644 --- a/3proxy/first-instanse.cfg +++ b/3proxy/first-instanse.cfg @@ -1,8 +1,8 @@ # regular 3proxy configuration -fakeresolve flush -auth strong -users $/run/secrets/PROXY_USERS +nserver 10.5.0.6 +nscache 65536 +auth none admin -p8161 -a127.0.0.1 # strict required by 3proxy-eagle log lines log @@ -33,10 +33,12 @@ allow * * *.meshname parent 1000 socks5+ 127.0.0.1 1085 allow * * *.meship parent 1000 socks5+ 127.0.0.1 1085 +flush ## onion sites allow * * *.onion parent 1000 socks5+ 10.5.0.7 9050 +flush ## clearnet via another proxy or change to tor (9050) allow * diff --git a/README.md b/README.md index 3c6919c..5f590e3 100644 --- a/README.md +++ b/README.md @@ -6,20 +6,16 @@ The stack now uses safer defaults for production: * Sensitive passwords are loaded from Docker secrets instead of inline values. * Admin/monitoring ports are bound to `127.0.0.1` on the host. -* 3proxy now requires authentication (`auth strong`). +* 3proxy SOCKS auth is currently disabled (`auth none`) for trusted/internal use. * Pi-hole ARP cache parsing is disabled in Docker (`FTLCONF_database_network_parseARPcache=false`) to prevent recurring netlink `neigh`/ARP errors. Before starting in production, set these secret files: ```sh -printf 'proxyuser:CL:YOUR_STRONG_PROXY_PASSWORD\n' > secrets/3proxy_users.txt printf 'YOUR_STRONG_PIHOLE_PASSWORD\n' > secrets/pihole_webpassword.txt printf 'YOUR_STRONG_GRAFANA_PASSWORD\n' > secrets/grafana_admin_password.txt ``` -SOCKS clients must now authenticate to 3proxy with credentials from -`secrets/3proxy_users.txt`. - Pi-hole note: disabling ARP parsing avoids noisy `Failed to read ARP cache` messages in containerized setups where neighbor-table netlink operations are not supported. This only affects Pi-hole's network-table enrichment, not DNS @@ -40,6 +36,30 @@ This container runs the following vontainers in the stack. * Socks5 server for I2P - Tor container +## SOCKS ports on host + +Use these host ports depending on the traffic type: + +* `127.0.0.1:2000` -> direct Tor SOCKS (`darktor:9050`), recommended primary endpoint. + - Supports `.onion` and clearnet via `--socks5-hostname`. +* `127.0.0.1:2010` -> `dark3proxy` SOCKS (`dark3proxy:1080`) for advanced policy routing. + - Intended for stack routing rules; use `:2000` when you specifically need reliable `.onion` access. +* `127.0.0.1:2004` -> additional direct Tor SOCKS (`darktor:9050`). +* `127.0.0.1:2006/udp` -> Tor DNSPort (`darktor:9053`). + +Quick checks: + +```sh +# Onion over primary SOCKS +curl --socks5-hostname 127.0.0.1:2000 -I http://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion + +# Clearnet over primary SOCKS +curl --socks5-hostname 127.0.0.1:2000 -I https://example.com + +# Clearnet over dark3proxy SOCKS +curl --socks5-hostname 127.0.0.1:2010 -I https://example.com +``` + The system offers a DNS that resolves many darknet and clearnet IP's. The stack now handles: diff --git a/docker-compose.lock.yml b/docker-compose.lock.yml index 3ab2406..b7cc133 100644 --- a/docker-compose.lock.yml +++ b/docker-compose.lock.yml @@ -1,7 +1,6 @@ services: dark3proxy: container_name: dark3proxy - image: host60/darkproxy-dark3proxy:v1.0 build: context: ./3proxy/. dns: @@ -14,8 +13,8 @@ services: sysctls: - "net.ipv6.conf.all.disable_ipv6=0" ports: - - 100.117.196.19:2000:1080 # socks port - - 100.117.196.19:2002:8161 # 3proxy-eagle web page + - "2010:1080" # dark3proxy SOCKS (advanced routing) + - "2002:8161" # 3proxy-eagle web page networks: darkproxy: ipv4_address: 10.5.0.8 @@ -29,12 +28,14 @@ services: - NET_ADMIN devices: - /dev/net/tun:/dev/net/tun + volumes: + - "./i2pd_yggdrasil_docker/src/entrypoint.sh:/entrypoint.sh:ro" ports: # I2P Service Ports # - "2827:2827" # BOB Bridge # - "4444:4444" # HTTP Proxy # - "4447:4447" # SOCKS Proxy - - "100.117.196.19:2001:7070" # Webconsole + - "2001:7070" # Webconsole # - "7650:7650" # I2PControl # - "7654:7654" # I2CP # - "7656:7656" # SAM Bridge (TCP) @@ -45,6 +46,13 @@ services: - "10654:10654" # Yggdrasil Listener environment: tz: /run/secrets/tz + # Lower-intensity peer selection for faster readiness in lock workflow. + YGG_PEER_PARALLEL: "2" + YGG_PEER_PINGS: "3" + YGG_PEER_BEST: "4" + YGG_PEER_MAX_FROM_COUNTRY: "1" + YGG_PEER_PING_INTERVAL: "0.3" + YGG_CONNECT_WAIT_SECONDS: "20" secrets: - tz restart: unless-stopped @@ -53,7 +61,7 @@ services: interval: 30s timeout: 10s retries: 3 - start_period: 60s + start_period: 15m sysctls: - "net.ipv6.conf.all.disable_ipv6=0" mac_address: ce:22:b8:0e:6e:78 @@ -62,24 +70,23 @@ services: ipv4_address: 10.5.0.2 tor_yggdrasil: - image: host60/tor_yggdrasil:v1.0 + build: + context: ./tor_yggdrasil_docker + dockerfile: Dockerfile # image: tor_yggdrasil:latest # container_name: tor_over_yggdrasil container_name: darktor + entrypoint: ["tor"] + command: ["-f", "/etc/tor/torrc"] # platform removed; image is amd64-only - cap_add: - - NET_ADMIN # Required for network tunnel management security_opt: - no-new-privileges:true # Security enhancement - prevent privilege esca> - devices: - - /dev/net/tun:/dev/net/tun # TUN device for Yggdrasil network interface + volumes: + - "./tor_yggdrasil_docker/torrc:/etc/tor/torrc:ro" ports: -# - "127.0.0.1:9050:9050/tcp" # SOCKS5 proxy port (Tor) for application-l> - - "10655:10655/tcp" # Yggdrasil peer connections - secrets: - - YGGDRASIL_GENERATE_KEYS - environment: - YGGDRASIL_GENERATE_KEYS: /run/secrets/YGGDRASIL_GENERATE_KEYS # Generate new Yggdrasil keys on startup + - "127.0.0.1:2000:9050/tcp" # primary host SOCKS (direct Tor, onion-capable) + - "127.0.0.1:2004:9050/tcp" # direct Tor SOCKS (onion-capable) + - "127.0.0.1:2006:9053/udp" # direct Tor DNSPort restart: unless-stopped # Auto-restart unless manually stopped dns: - "10.5.0.6" @@ -107,7 +114,6 @@ services: coredns: # image: darkdns - image: host60/darkdns:v1.0 build: context: ./PopuraDNS dockerfile: Dockerfile @@ -150,12 +156,12 @@ services: pihole: container_name: darkpihole image: pihole/pihole:latest - platform: linux/arm64 + platform: linux/amd64 # For DHCP it is recommended to remove these ports and instead add: network_mode: "host" ports: # DNS Ports -# - "53:53/tcp" -# - "53:53/udp" + - "53:53/tcp" + - "53:53/udp" # Default HTTP Port # - "80:80/tcp" # Default HTTPs Port. FTL will generate a self-signed certificate @@ -164,7 +170,7 @@ services: # - "67:67/udp" # Uncomment the line below if you are using Pi-hole as your NTP server # - "123:123/udp" - - "100.117.196.19:2003:80/tcp" # pihole web port + - "2003:80/tcp" # pihole web port environment: # Set the appropriate timezone for your location (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones), e.g: TZ: 'America/Detroit' @@ -206,10 +212,10 @@ services: geth: image: ethereum/client-go:latest - platform: linux/arm64 + platform: linux/amd64 container_name: darkgeth command: - - --syncmode=light + - --syncmode=snap - --http - --http.addr=0.0.0.0 - --http.port=8545 @@ -231,11 +237,15 @@ services: emc: image: wg00/emercoin:0.8.4 - platform: linux/arm64 + platform: linux/amd64 container_name: darkemer volumes: - - emc_data:/emc + - emc_data:/emc/data - /etc/localtime:/etc/localtime:ro + command: + - -datadir=/emc/data + - -conf=/emc/emercoin.conf + - -printtoconsole networks: darkproxy: ipv4_address: 10.5.0.9 diff --git a/docker-compose.yml b/docker-compose.yml index d099660..edbc48d 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -10,8 +10,6 @@ services: volumes: - "./3proxy/first-instanse.cfg:/etc/3proxy/first-instanse.cfg" - "./3proxy/second-instanse.cfg:/etc/3proxy/second-instanse.cfg" - secrets: - - PROXY_USERS restart: unless-stopped cpus: "1.0" mem_reservation: 64m @@ -19,8 +17,8 @@ services: sysctls: - "net.ipv6.conf.all.disable_ipv6=0" ports: - - "127.0.0.1:2000:1080" # socks port (localhost only) - - "127.0.0.1:2002:8161" # 3proxy-eagle web page (localhost only) + - "2010:1080" # dark3proxy SOCKS (advanced routing) + - "2002:8161" # 3proxy-eagle web page (localhost only) networks: darkproxy: ipv4_address: 10.5.0.8 @@ -78,20 +76,17 @@ services: # image: tor_yggdrasil:latest # container_name: tor_over_yggdrasil container_name: darktor + entrypoint: ["tor"] + command: ["-f", "/etc/tor/torrc"] # platform removed; image is amd64-only - cap_add: - - NET_ADMIN # Required for network tunnel management security_opt: - no-new-privileges:true # Security enhancement - prevent privilege esca> - devices: - - /dev/net/tun:/dev/net/tun # TUN device for Yggdrasil network interface + volumes: + - "./tor_yggdrasil_docker/torrc:/etc/tor/torrc:ro" ports: -# - "127.0.0.1:9050:9050/tcp" # SOCKS5 proxy port (Tor) for application-l> - - "10655:10655/tcp" # Yggdrasil peer connections - secrets: - - YGGDRASIL_GENERATE_KEYS - environment: - YGGDRASIL_GENERATE_KEYS: /run/secrets/YGGDRASIL_GENERATE_KEYS # Generate new Yggdrasil keys on startup + - "127.0.0.1:2000:9050/tcp" # primary host SOCKS (direct Tor, onion-capable) + - "127.0.0.1:2004:9050/tcp" # direct Tor SOCKS (onion-capable) + - "127.0.0.1:2006:9053/udp" # direct Tor DNSPort restart: unless-stopped # Auto-restart unless manually stopped cpus: "2.0" mem_reservation: 256m @@ -175,8 +170,8 @@ services: # For DHCP it is recommended to remove these ports and instead add: network_mode: "host" ports: # DNS Ports -# - "53:53/tcp" -# - "53:53/udp" + - "53:53/tcp" + - "53:53/udp" # Default HTTP Port # - "80:80/tcp" # Default HTTPs Port. FTL will generate a self-signed certificate @@ -234,11 +229,14 @@ services: emc: image: wg00/emercoin:0.8.4 - platform: linux/arm64 container_name: darkemer volumes: - - emc_data:/emc + - emc_data:/emc/data - /etc/localtime:/etc/localtime:ro + command: + - -datadir=/emc/data + - -conf=/emc/emercoin.conf + - -printtoconsole networks: darkproxy: ipv4_address: 10.5.0.9 @@ -458,6 +456,4 @@ secrets: file: ./secrets/pihole_webpassword.txt GRAFANA_ADMIN_PASSWORD: file: ./secrets/grafana_admin_password.txt - PROXY_USERS: - file: ./secrets/3proxy_users.txt