name: darkproxy
services:
  3proxy_exporter:
    build:
      context: /home/blade/darkproxy/monitor
      dockerfile: Dockerfile
    container_name: dark3proxy-exporter
    depends_on:
      dark3proxy:
        condition: service_healthy
        required: true
    image: darkproxy-3proxy-exporter:local
    networks:
      darkproxy:
        ipv4_address: 10.5.0.20
    platform: linux/amd64
    security_opt:
      - no-new-privileges:true
  alfis:
    container_name: darkalfis
    dns:
      - 10.5.0.6
    image: cofob/alfis@sha256:0c5788b1e409557bb814dc2d055d584db8c48b3d42b375bf13feb59583af0585
    networks:
      darkproxy:
        ipv4_address: 10.5.0.3
    platform: linux/amd64
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 10s
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "0"
    volumes:
      - type: volume
        source: darkalfis_data
        target: /storage
        volume: {}
  coredns:
    build:
      context: /home/blade/darkproxy/PopuraDNS
      dockerfile: Dockerfile
    cpus: 1
    container_name: darkdns
    logging:
      driver: json-file
      options:
        max-file: "3"
        max-size: 10m
    mem_limit: "268435456"
    mem_reservation: "67108864"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.4
    platform: linux/amd64
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "0"
  dark3proxy:
    build:
      context: /home/blade/darkproxy/3proxy
      dockerfile: Dockerfile
    cap_add:
      - NET_ADMIN
    cpus: 1
    container_name: dark3proxy
    devices:
      - source: /dev/net/tun
        target: /dev/net/tun
        permissions: rwm
    dns:
      - 10.5.0.6
    dns_search:
      - internal.namespace
    environment:
      PROXY_REQUIRE_AUTH: "true"
      PROXY_USERS_FILE: /run/secrets/PROXY_USERS
      ROUTER_I2P_MAP_FILE: /var/lib/i2pdns/map.json
      ROUTER_I2P_POOL_CIDR: 172.31.0.0/16
      ROUTER_NO_AUTH_CIDRS: ""
      ROUTER_REQUIRE_AUTH: "true"
      ROUTER_USERS_FILE: /run/secrets/PROXY_USERS
      YGG_CONNECT_WAIT_SECONDS: "8"
    healthcheck:
      test:
        - CMD
        - bash
        - -lc
        - pgrep -f 'yggdrasil -useconffile' >/dev/null && pgrep -f '3proxy /etc/3proxy/second-instanse.cfg' >/dev/null && pgrep -f '3proxy /etc/3proxy/first-instanse.cfg' >/dev/null && pgrep -f 'python3 /usr/local/bin/socks_router.py' >/dev/null
      timeout: 10s
      interval: 30s
      retries: 3
      start_period: 45s
    mem_limit: "268435456"
    mem_reservation: "67108864"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.8
    platform: linux/amd64
    ports:
      - mode: ingress
        target: 1080
        published: "2000"
        protocol: tcp
      - mode: ingress
        host_ip: 127.0.0.1
        target: 8161
        published: "2002"
        protocol: tcp
    restart: unless-stopped
    secrets:
      - source: PROXY_USERS
        target: /run/secrets/PROXY_USERS
    security_opt:
      - no-new-privileges:true
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "0"
    volumes:
      - type: bind
        source: /home/blade/darkproxy/3proxy/first-instanse.cfg
        target: /etc/3proxy/first-instanse.cfg
        bind:
          create_host_path: true
      - type: bind
        source: /home/blade/darkproxy/3proxy/second-instanse.cfg
        target: /etc/3proxy/second-instanse.cfg
        bind:
          create_host_path: true
      - type: bind
        source: /home/blade/darkproxy/3proxy/yggdrasil.conf
        target: /etc/yggdrasil/yggdrasil.conf
        bind:
          create_host_path: true
      - type: volume
        source: i2p_dns_map
        target: /var/lib/i2pdns
        read_only: true
        volume: {}
  emc:
    cpus: 1
    command:
      - -datadir=/emc/data
      - -conf=/emc/emercoin.conf
      - -printtoconsole
    container_name: darkemer
    image: wg00/emercoin:0.8.4@sha256:b890987fb4b158305040dc76b32cd24ed5173dd7bc4aba983141ea0fe82e2996
    mem_limit: "1073741824"
    mem_reservation: "268435456"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.9
    platform: linux/amd64
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 30s
    volumes:
      - type: volume
        source: emc_data
        target: /emc/data
        volume: {}
      - type: bind
        source: /etc/localtime
        target: /etc/localtime
        read_only: true
        bind:
          create_host_path: true
  ensdns:
    build:
      context: /home/blade/darkproxy/ensdns
      dockerfile: Dockerfile
    cpus: 0.5
    container_name: darkens
    dns:
      - 10.5.0.4
    environment:
      ENS_RPC_URL: https://ethereum-rpc.publicnode.com
      ENSDNS_TTL: "60"
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - import socket; from dnslib import DNSRecord; q=DNSRecord.question('vitalik.eth','TXT'); s=socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.settimeout(2); s.sendto(q.pack(), ('127.0.0.1', 53)); data, _ = s.recvfrom(4096); DNSRecord.parse(data)
      timeout: 10s
      interval: 1m0s
      retries: 3
      start_period: 15s
    mem_limit: "268435456"
    mem_reservation: "67108864"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.11
    platform: linux/amd64
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "0"
  i2pd_yggdrasil:
    build:
      context: /home/blade/darkproxy/i2pd_yggdrasil_docker/src
      dockerfile: Dockerfile
    cap_add:
      - NET_ADMIN
    cpus: 4
    container_name: darki2p
    devices:
      - source: /dev/net/tun
        target: /dev/net/tun
        permissions: rwm
    environment:
      tz: /run/secrets/tz
    healthcheck:
      test:
        - CMD
        - bash
        - -lc
        - pgrep i2pd >/dev/null && pgrep yggdrasil >/dev/null && [ -s /var/lib/i2pd/addressbook/addresses.csv ]
      timeout: 10s
      interval: 30s
      retries: 3
      start_period: 15m0s
    mem_limit: "2147483648"
    mem_reservation: "536870912"
    mac_address: ce:22:b8:0e:6e:78
    networks:
      darkproxy:
        ipv4_address: 10.5.0.2
    platform: linux/amd64
    ports:
      - mode: ingress
        target: 7070
        published: "2001"
        protocol: tcp
      - mode: ingress
        target: 10765
        published: "10765"
        protocol: tcp
      - mode: ingress
        target: 10654
        published: "10654"
        protocol: tcp
    privileged: true
    restart: unless-stopped
    secrets:
      - source: tz
        target: /run/secrets/tz
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "0"
    volumes:
      - type: volume
        source: i2pd_state
        target: /var/lib/i2pd
        volume: {}
      - type: volume
        source: yggdrasil_state
        target: /var/lib/yggdrasil
        volume: {}
  i2pdns:
    build:
      context: /home/blade/darkproxy/i2pdns
      dockerfile: Dockerfile
    cpus: 0.5
    container_name: darki2pdns
    environment:
      I2PDNS_LISTEN_HOST: 0.0.0.0
      I2PDNS_LISTEN_PORT: "53"
      I2PDNS_MAP_FILE: /var/lib/i2pdns/map.json
      I2PDNS_POOL_CIDR: 172.31.0.0/16
      I2PDNS_TTL: "60"
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - import socket; from dnslib import DNSRecord; q=DNSRecord.question('stats.i2p','A'); s=socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.settimeout(2); s.sendto(q.pack(), ('127.0.0.1', 53)); data, _ = s.recvfrom(4096); DNSRecord.parse(data)
      timeout: 10s
      interval: 1m0s
      retries: 3
      start_period: 10s
    mem_limit: "134217728"
    mem_reservation: "67108864"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.16
    platform: linux/amd64
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "0"
    volumes:
      - type: volume
        source: i2p_dns_map
        target: /var/lib/i2pdns
        volume: {}
  lokinet:
    build:
      context: /home/blade/darkproxy/lokinet
      dockerfile: Dockerfile
    cap_add:
      - NET_ADMIN
      - NET_BIND_SERVICE
    cpus: 1
    container_name: darklokinet
    devices:
      - source: /dev/net/tun
        target: /dev/net/tun
        permissions: rwm
    healthcheck:
      test:
        - CMD-SHELL
        - pidof lokinet >/dev/null && ip link show lokinet0 >/dev/null 2>&1
      timeout: 10s
      interval: 1m0s
      retries: 3
      start_period: 45s
    mem_limit: "268435456"
    mem_reservation: "67108864"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.14
    platform: linux/amd64
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "0"
  namecoind:
    cpus: 2
    container_name: darknamecoind
    entrypoint:
      - /bin/sh
      - -ec
      - |
        exec /usr/local/bin/namecoind \
          -server=1 \
          -daemon=0 \
          -datadir=/data \
          -rpcbind=0.0.0.0 \
          -rpcallowip=10.5.0.0/16 \
          -rpcuser=namecoinrpc \
          "-rpcpassword=$$(cat /run/secrets/NAMECOIN_RPC_PASSWORD)" \
          -printtoconsole \
          -txindex=1 \
          -dnsseed=1 \
          -addnode=162.212.154.52:8334 \
          -addnode=162.210.196.27:8334 \
          -addnode=23.108.191.178:8334 \
          -addnode=3.228.193.128:8334 \
          -addnode=3.66.245.44:8334 \
          -addnode=212.51.144.42:8334
    healthcheck:
      test:
        - CMD-SHELL
        - 'curl -fsS --user "namecoinrpc:$$(cat /run/secrets/NAMECOIN_RPC_PASSWORD)" --data-binary ''{"jsonrpc":"1.0","id":"health","method":"getblockcount","params":[]}'' -H ''content-type: text/plain;'' http://127.0.0.1:8336/ >/dev/null'
      timeout: 10s
      interval: 1m0s
      retries: 3
      start_period: 30s
    image: ukd1/namecoind@sha256:6fdf63f61f687ee639893a8cdcd910bb24c5eb3a3493ff72142c911d7019200b
    mem_limit: "2147483648"
    mem_reservation: "536870912"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.13
    platform: linux/amd64
    restart: unless-stopped
    secrets:
      - source: NAMECOIN_RPC_PASSWORD
        target: /run/secrets/NAMECOIN_RPC_PASSWORD
    security_opt:
      - no-new-privileges:true
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "0"
    volumes:
      - type: volume
        source: namecoin_data
        target: /data
        volume: {}
  namecoindns:
    build:
      context: /home/blade/darkproxy/namecoindns
      dockerfile: Dockerfile
    cpus: 0.5
    container_name: darknamecoin
    depends_on:
      namecoind:
        condition: service_healthy
        required: true
    environment:
      NAMECOIN_RPC_PASSWORD_FILE: /run/secrets/NAMECOIN_RPC_PASSWORD
      NAMECOIN_RPC_TIMEOUT: "8"
      NAMECOIN_RPC_URL: http://darknamecoind:8336/
      NAMECOIN_RPC_USER: namecoinrpc
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - import socket; from dnslib import DNSRecord; q=DNSRecord.question('d.bit','TXT'); s=socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.settimeout(2); s.sendto(q.pack(), ('127.0.0.1', 53)); data, _ = s.recvfrom(4096); DNSRecord.parse(data)
      timeout: 10s
      interval: 1m0s
      retries: 3
      start_period: 15s
    mem_limit: "268435456"
    mem_reservation: "67108864"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.12
    platform: linux/amd64
    restart: unless-stopped
    secrets:
      - source: NAMECOIN_RPC_PASSWORD
        target: /run/secrets/NAMECOIN_RPC_PASSWORD
    security_opt:
      - no-new-privileges:true
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "0"
  pihole:
    cap_add:
      - NET_ADMIN
      - SYS_NICE
    cpus: 1.5
    container_name: darkpihole
    entrypoint:
      - /usr/local/bin/darkproxy-pihole-entrypoint.sh
    environment:
      FTLCONF_database_network_parseARPcache: "false"
      FTLCONF_dns_listeningMode: all
      FTLCONF_dns_upstreams: 10.5.0.4#53
      PIHOLE_DNS_1: 10.5.0.4
      TEMPERATUREUNIT: f
      TZ: America/Detroit
      WEBPASSWORD_FILE: /run/secrets/PIHOLE_WEBPASSWORD
      WEBTHEME: lcars
    healthcheck:
      test:
        - CMD
        - dig
        - +short
        - +norecurse
        - +timeout=2
        - '@127.0.0.1'
        - google.com
      timeout: 10s
      interval: 1m0s
      retries: 3
      start_period: 30s
    image: pihole/pihole@sha256:712b39f1fdb55121cef509813dfbe02d2bdef9c28e07404fa1d422f5157323b2
    mem_limit: "536870912"
    mem_reservation: "134217728"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.6
    platform: linux/amd64
    ports:
      - mode: ingress
        target: 53
        published: "53"
        protocol: tcp
      - mode: ingress
        target: 53
        published: "53"
        protocol: udp
      - mode: ingress
        host_ip: 127.0.0.1
        target: 80
        published: "2003"
        protocol: tcp
    restart: unless-stopped
    secrets:
      - source: PIHOLE_WEBPASSWORD
        target: /run/secrets/PIHOLE_WEBPASSWORD
    security_opt:
      - no-new-privileges:true
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "0"
    volumes:
      - type: bind
        source: /home/blade/darkproxy/pihole/etc-pihole
        target: /etc/pihole
        bind:
          create_host_path: true
      - type: bind
        source: /home/blade/darkproxy/pihole/etc-dnsmasq.d
        target: /etc/dnsmasq.d
        bind:
          create_host_path: true
      - type: bind
        source: /home/blade/darkproxy/scripts/pihole-entrypoint.sh
        target: /usr/local/bin/darkproxy-pihole-entrypoint.sh
        read_only: true
        bind:
          create_host_path: true
  status_dashboard:
    build:
      context: /home/blade/darkproxy/monitor
      dockerfile: status.Dockerfile
    container_name: darkstatus
    depends_on:
      dark3proxy:
        condition: service_healthy
        required: true
      pihole:
        condition: service_healthy
        required: true
    environment:
      DASHBOARD_PORT: "8080"
      DNS_PORT: "53"
      DNS_SERVER: darkpihole
      DOCKER_PROJECT: darkproxy
      DOCKER_SOCKET: /var/run/docker.sock
      LOG_TAIL_LINES: "120"
      PROXY_HOST: dark3proxy
      PROXY_PORT: "1080"
      PROXY_USERS_FILE: /run/secrets/PROXY_USERS
      SOCKET_TIMEOUT: "5"
      STATUS_CACHE_SECONDS: "15"
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=5).read()
      timeout: 10s
      interval: 1m0s
      retries: 3
      start_period: 20s
    image: darkproxy-status-dashboard:local
    networks:
      darkproxy:
        ipv4_address: 10.5.0.21
    platform: linux/amd64
    ports:
      - mode: ingress
        host_ip: 127.0.0.1
        target: 8080
        published: "2004"
        protocol: tcp
    restart: unless-stopped
    secrets:
      - source: PROXY_USERS
        target: /run/secrets/PROXY_USERS
    security_opt:
      - no-new-privileges:true
    volumes:
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock
        read_only: true
        bind:
          create_host_path: true
  tor_yggdrasil:
    build:
      context: /home/blade/darkproxy/tor_yggdrasil_docker
      dockerfile: Dockerfile
    cpus: 2
    command:
      - -f
      - /etc/tor/torrc
    container_name: darktor
    dns:
      - 10.5.0.6
    entrypoint:
      - tor
    mem_limit: "1073741824"
    mem_reservation: "268435456"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.7
    platform: linux/amd64
    ports:
      - mode: ingress
        host_ip: 127.0.0.1
        target: 9053
        published: "2006"
        protocol: udp
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "0"
    volumes:
      - type: bind
        source: /home/blade/darkproxy/tor_yggdrasil_docker/torrc
        target: /etc/tor/torrc
        read_only: true
        bind:
          create_host_path: true
  unbound:
    cpus: 4
    container_name: darkunbound
    healthcheck:
      test:
        - CMD-SHELL
        - drill @127.0.0.1 google.com >/dev/null 2>&1
      timeout: 10s
      interval: 1m0s
      retries: 3
      start_period: 20s
    image: mvance/unbound@sha256:76906da36d1806f3387338f15dcf8b357c51ce6897fb6450d6ce010460927e90
    mem_limit: "805306368"
    mem_reservation: "268435456"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.5
    platform: linux/amd64
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "0"
    volumes:
      - type: bind
        source: /home/blade/darkproxy/unbound/unbound.conf
        target: /opt/unbound/etc/unbound/unbound.conf
        read_only: true
      - type: bind
        source: /home/blade/darkproxy/unbound/forward-records.conf
        target: /opt/unbound/etc/unbound/forward-records.conf
        bind:
          create_host_path: true
      - type: bind
        source: /home/blade/darkproxy/unbound/a-records.conf
        target: /opt/unbound/etc/unbound/a-records.conf
        bind:
          create_host_path: true
      - type: bind
        source: /home/blade/darkproxy/unbound/srv-records.conf
        target: /opt/unbound/etc/unbound/srv-records.conf
        bind:
          create_host_path: true
  zildns:
    build:
      context: /home/blade/darkproxy/zildns
      dockerfile: Dockerfile
    cpus: 0.5
    container_name: darkzil
    dns:
      - 1.1.1.1
      - 8.8.8.8
    environment:
      ZILDNS_CACHE_SECONDS: "300"
      ZILDNS_PREWARM_DOMAIN: brad.zil
      ZILDNS_TTL: "120"
      ZILDNS_ZNS_NETWORK: mainnet
      ZILDNS_ZNS_URL: https://api.zilliqa.com
    healthcheck:
      test:
        - CMD
        - node
        - -e
        - const net=require('net'); const socket=net.createConnection({host:'127.0.0.1', port:53}); socket.setTimeout(2000); socket.on('connect',()=>{socket.end(); process.exit(0);}); socket.on('timeout',()=>{socket.destroy(); process.exit(1);}); socket.on('error',()=>process.exit(1));
      timeout: 10s
      interval: 1m0s
      retries: 3
      start_period: 20s
    mem_limit: "268435456"
    mem_reservation: "67108864"
    networks:
      darkproxy:
        ipv4_address: 10.5.0.15
    platform: linux/amd64
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "0"
networks:
  darkproxy:
    name: darkproxy_darkproxy
    driver: bridge
    ipam:
      config:
        - subnet: 10.5.0.0/16
          gateway: 10.5.0.1
        - subnet: 2001:0BC5::/112
          gateway: 2001:0BC5::1
    enable_ipv6: true
volumes:
  darkalfis_data:
    name: darkalfis_data
  emc_data:
    name: emc_data
  i2p_dns_map:
    name: i2p_dns_map
  i2pd_state:
    name: i2pd_state
  namecoin_data:
    name: namecoin_data
  yggdrasil_state:
    name: yggdrasil_state
secrets:
  NAMECOIN_RPC_PASSWORD:
    name: darkproxy_NAMECOIN_RPC_PASSWORD
    file: /home/blade/darkproxy/secrets/namecoin_rpc_password.txt
  PIHOLE_WEBPASSWORD:
    name: darkproxy_PIHOLE_WEBPASSWORD
    file: /home/blade/darkproxy/secrets/pihole_webpassword.txt
  PROXY_USERS:
    name: darkproxy_PROXY_USERS
    file: /home/blade/darkproxy/secrets/3proxy_users.txt
  tz:
    name: darkproxy_tz
    file: /home/blade/darkproxy/secrets/tz.txt