services: dark3proxy: container_name: dark3proxy build: context: ./3proxy/. platform: linux/amd64 cap_add: - NET_ADMIN devices: - /dev/net/tun:/dev/net/tun dns: - "10.5.0.6" dns_search: internal.namespace #namespace used in internal DNS environment: YGG_CONNECT_WAIT_SECONDS: "8" PROXY_REQUIRE_AUTH: "true" PROXY_USERS_FILE: /run/secrets/PROXY_USERS ROUTER_REQUIRE_AUTH: "true" ROUTER_NO_AUTH_CIDRS: ${ROUTER_NO_AUTH_CIDRS:-} ROUTER_USERS_FILE: /run/secrets/PROXY_USERS ROUTER_I2P_MAP_FILE: /var/lib/i2pdns/map.json ROUTER_I2P_POOL_CIDR: 172.31.0.0/16 security_opt: - no-new-privileges:true secrets: - PROXY_USERS volumes: - "./3proxy/first-instanse.cfg:/etc/3proxy/first-instanse.cfg" - "./3proxy/second-instanse.cfg:/etc/3proxy/second-instanse.cfg" - "./3proxy/yggdrasil.conf:/etc/yggdrasil/yggdrasil.conf" - "i2p_dns_map:/var/lib/i2pdns:ro" restart: unless-stopped cpus: "1.0" mem_reservation: 64m mem_limit: 256m healthcheck: test: ["CMD", "bash", "-lc", "pgrep -f 'yggdrasil -useconffile' >/dev/null && pgrep -f '3proxy /etc/3proxy/second-instanse.cfg' >/dev/null && pgrep -f '3proxy /etc/3proxy/first-instanse.cfg' >/dev/null && pgrep -f 'python3 /usr/local/bin/socks_router.py' >/dev/null"] interval: 30s timeout: 10s retries: 3 start_period: 45s sysctls: - "net.ipv6.conf.all.disable_ipv6=0" ports: - "2000:1080" # primary host SOCKS via dark3proxy (externally reachable) - "127.0.0.1:2002:8161" # 3proxy admin page (host-local only) networks: darkproxy: ipv4_address: 10.5.0.8 i2pd_yggdrasil: container_name: darki2p build: context: ./i2pd_yggdrasil_docker/src dockerfile: Dockerfile platform: linux/amd64 privileged: true cap_add: - NET_ADMIN devices: - /dev/net/tun:/dev/net/tun ports: # I2P Service Ports # - "2827:2827" # BOB Bridge # - "4444:4444" # HTTP Proxy # - "4447:4447" # SOCKS Proxy - "2001:7070" # Webconsole # - "7650:7650" # I2PControl # - "7654:7654" # I2CP # - "7656:7656" # SAM Bridge (TCP) - "10765:10765" # Main I2P Listener # I2P name resolution occurs over the SOCKS proxy; there is no # separate DNS listener in this build (the `dns` section in i2pd.conf # is currently disabled because the shipped i2pd release doesn't # support it). SOCKS remains on port 4447 and will resolve *.i2p names. # mapping to host is possible if desired, e.g. 10853:53/udp # Yggdrasil Ports - "10654:10654" # Yggdrasil Listener environment: tz: /run/secrets/tz secrets: - tz volumes: - i2pd_state:/var/lib/i2pd - yggdrasil_state:/var/lib/yggdrasil restart: unless-stopped cpus: "4.0" mem_reservation: 512m mem_limit: 2g healthcheck: test: ["CMD", "bash", "-lc", "pgrep i2pd >/dev/null && pgrep yggdrasil >/dev/null && [ -s /var/lib/i2pd/addressbook/addresses.csv ]"] interval: 30s timeout: 10s retries: 3 # Key generation + peer discovery can take several minutes on emulated ARM. start_period: 15m sysctls: - "net.ipv6.conf.all.disable_ipv6=0" mac_address: ce:22:b8:0e:6e:78 networks: darkproxy: ipv4_address: 10.5.0.2 i2pdns: container_name: darki2pdns build: context: ./i2pdns dockerfile: Dockerfile platform: linux/amd64 security_opt: - no-new-privileges:true restart: unless-stopped cpus: "0.5" mem_reservation: 64m mem_limit: 128m environment: I2PDNS_LISTEN_HOST: 0.0.0.0 I2PDNS_LISTEN_PORT: 53 I2PDNS_TTL: 60 I2PDNS_POOL_CIDR: 172.31.0.0/16 I2PDNS_MAP_FILE: /var/lib/i2pdns/map.json volumes: - "i2p_dns_map:/var/lib/i2pdns" sysctls: - "net.ipv6.conf.all.disable_ipv6=0" healthcheck: test: ["CMD", "python", "-c", "import socket; from dnslib import DNSRecord; q=DNSRecord.question('stats.i2p','A'); s=socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.settimeout(2); s.sendto(q.pack(), ('127.0.0.1', 53)); data, _ = s.recvfrom(4096); DNSRecord.parse(data)"] interval: 1m timeout: 10s retries: 3 start_period: 10s networks: darkproxy: ipv4_address: 10.5.0.16 tor_yggdrasil: build: context: ./tor_yggdrasil_docker dockerfile: Dockerfile platform: linux/amd64 # container_name: tor_over_yggdrasil container_name: darktor entrypoint: ["tor"] command: ["-f", "/etc/tor/torrc"] # platform removed; image is amd64-only security_opt: - no-new-privileges:true # Security enhancement - prevent privilege esca> volumes: - "./tor_yggdrasil_docker/torrc:/etc/tor/torrc:ro" ports: - "127.0.0.1:2006:9053/udp" # direct Tor DNSPort restart: unless-stopped # Auto-restart unless manually stopped cpus: "2.0" mem_reservation: 256m mem_limit: 1g dns: - "10.5.0.6" sysctls: - "net.ipv6.conf.all.disable_ipv6=0" networks: darkproxy: ipv4_address: 10.5.0.7 alfis: image: cofob/alfis@sha256:0c5788b1e409557bb814dc2d055d584db8c48b3d42b375bf13feb59583af0585 platform: linux/amd64 # platform removed; image is amd64 only container_name: darkalfis security_opt: - no-new-privileges:true volumes: - darkalfis_data:/storage restart: unless-stopped stop_grace_period: 10s dns: - "10.5.0.6" sysctls: - "net.ipv6.conf.all.disable_ipv6=0" networks: darkproxy: ipv4_address: 10.5.0.3 coredns: build: context: ./PopuraDNS dockerfile: Dockerfile platform: linux/amd64 container_name: darkdns security_opt: - no-new-privileges:true restart: unless-stopped cpus: "1.0" mem_reservation: 64m mem_limit: 256m sysctls: - "net.ipv6.conf.all.disable_ipv6=0" logging: driver: "json-file" options: max-size: "10m" # Maximum log file size max-file: "3" # Maximum of 3 rotating log files networks: darkproxy: ipv4_address: 10.5.0.4 unbound: container_name: darkunbound image: mvance/unbound@sha256:76906da36d1806f3387338f15dcf8b357c51ce6897fb6450d6ce010460927e90 platform: linux/amd64 # platform removed; image is amd64-only security_opt: - no-new-privileges:true sysctls: - "net.ipv6.conf.all.disable_ipv6=0" networks: darkproxy: ipv4_address: 10.5.0.5 volumes: - type: bind read_only: true source: ./unbound/unbound.conf target: /opt/unbound/etc/unbound/unbound.conf - "./unbound/forward-records.conf:/opt/unbound/etc/unbound/forward-records.conf" - "./unbound/a-records.conf:/opt/unbound/etc/unbound/a-records.conf" - "./unbound/srv-records.conf:/opt/unbound/etc/unbound/srv-records.conf" # ports: # - "5053:5053/tcp" # - "5053:5053/udp" # healthcheck: # disable: true restart: unless-stopped cpus: "4.0" mem_reservation: 256m mem_limit: 768m healthcheck: test: ["CMD-SHELL", "drill @127.0.0.1 google.com >/dev/null 2>&1"] interval: 1m timeout: 10s retries: 3 start_period: 20s pihole: container_name: darkpihole image: pihole/pihole@sha256:712b39f1fdb55121cef509813dfbe02d2bdef9c28e07404fa1d422f5157323b2 platform: linux/amd64 entrypoint: ["/usr/local/bin/darkproxy-pihole-entrypoint.sh"] security_opt: - no-new-privileges:true # For DHCP it is recommended to remove these ports and instead add: network_mode: "host" ports: # DNS Ports - "53:53/tcp" - "53:53/udp" # Default HTTP Port # - "80:80/tcp" # Default HTTPs Port. FTL will generate a self-signed certificate # - "443:443/tcp # Uncomment the line below if you are using Pi-hole as your DHCP server # - "67:67/udp" # Uncomment the line below if you are using Pi-hole as your NTP server # - "123:123/udp" - "${PIHOLE_WEB_BIND_HOST:-127.0.0.1}:${PIHOLE_WEB_BIND_PORT:-2003}:80/tcp" # pihole web port (host-local by default) environment: # Set the appropriate timezone for your location (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones), e.g: TZ: 'America/Detroit' # WEBPASSWORD: 'set a secure password here or it will be random' # FTLCONF_webserver_api_password: 'darkproxy' # If using Docker's default `bridge` network setting the dns listening mode should be set to 'all' FTLCONF_dns_listeningMode: 'all' PIHOLE_DNS_1: 10.5.0.4 TEMPERATUREUNIT: f WEBTHEME: lcars WEBPASSWORD_FILE: /run/secrets/PIHOLE_WEBPASSWORD # Pin upstream to IPv4 CoreDNS to avoid noisy IPv6 recursion-refused warnings. FTLCONF_dns_upstreams: 10.5.0.4#53 FTLCONF_database_network_parseARPcache: 'false' secrets: - PIHOLE_WEBPASSWORD # Volumes store your data between container upgrades volumes: # For persisting Pi-hole's databases and common configuration file - './pihole/etc-pihole:/etc/pihole' # Uncomment the below if you have custom dnsmasq config files that you want to persist. Not needed for most starting fresh with Pi-hole v6. If you're upgrading from v5 you and have used this directory before, you should keep it enabled for the first v6 container start to allow for a complete migration. It can be removed afterwards. Needs environment variable FTLCONF_misc_etc_dnsmasq_d: 'true' - './pihole/etc-dnsmasq.d:/etc/dnsmasq.d' - './scripts/pihole-entrypoint.sh:/usr/local/bin/darkproxy-pihole-entrypoint.sh:ro' cap_add: # See https://github.com/pi-hole/docker-pi-hole#note-on-capabilities # Required if you are using Pi-hole as your DHCP server, else not needed - NET_ADMIN # Required if you are using Pi-hole as your NTP client to be able to set the host's system time # - SYS_TIME # Optional, if Pi-hole should get some more processing time - SYS_NICE restart: unless-stopped # Recommended but not required (DHCP needs NET_ADMIN) cpus: "1.5" mem_reservation: 128m mem_limit: 512m sysctls: - "net.ipv6.conf.all.disable_ipv6=0" healthcheck: test: ["CMD", "dig", "+short", "+norecurse", "+timeout=2", "@127.0.0.1", "google.com"] interval: 1m timeout: 10s retries: 3 start_period: 30s networks: darkproxy: ipv4_address: 10.5.0.6 emc: image: wg00/emercoin:0.8.4@sha256:b890987fb4b158305040dc76b32cd24ed5173dd7bc4aba983141ea0fe82e2996 platform: linux/amd64 container_name: darkemer security_opt: - no-new-privileges:true volumes: - emc_data:/emc/data - /etc/localtime:/etc/localtime:ro command: - -datadir=/emc/data - -conf=/emc/emercoin.conf - -printtoconsole networks: darkproxy: ipv4_address: 10.5.0.9 restart: unless-stopped cpus: "1.0" mem_reservation: 256m mem_limit: 1g stop_grace_period: 30s ensdns: build: context: ./ensdns dockerfile: Dockerfile platform: linux/amd64 container_name: darkens security_opt: - no-new-privileges:true restart: unless-stopped cpus: "0.5" mem_reservation: 64m mem_limit: 256m environment: ENS_RPC_URL: https://ethereum-rpc.publicnode.com ENSDNS_TTL: 60 dns: - "10.5.0.4" sysctls: - "net.ipv6.conf.all.disable_ipv6=0" healthcheck: test: ["CMD", "python", "-c", "import socket; from dnslib import DNSRecord; q=DNSRecord.question('vitalik.eth','TXT'); s=socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.settimeout(2); s.sendto(q.pack(), ('127.0.0.1', 53)); data, _ = s.recvfrom(4096); DNSRecord.parse(data)"] interval: 1m timeout: 10s retries: 3 start_period: 15s networks: darkproxy: ipv4_address: 10.5.0.11 zildns: build: context: ./zildns dockerfile: Dockerfile platform: linux/amd64 container_name: darkzil security_opt: - no-new-privileges:true restart: unless-stopped cpus: "0.5" mem_reservation: 64m mem_limit: 256m environment: ZILDNS_ZNS_URL: https://api.zilliqa.com ZILDNS_ZNS_NETWORK: mainnet ZILDNS_TTL: 120 ZILDNS_CACHE_SECONDS: 300 ZILDNS_PREWARM_DOMAIN: brad.zil dns: - "1.1.1.1" - "8.8.8.8" sysctls: - "net.ipv6.conf.all.disable_ipv6=0" healthcheck: test: ["CMD", "node", "-e", "const net=require('net'); const socket=net.createConnection({host:'127.0.0.1', port:53}); socket.setTimeout(2000); socket.on('connect',()=>{socket.end(); process.exit(0);}); socket.on('timeout',()=>{socket.destroy(); process.exit(1);}); socket.on('error',()=>process.exit(1));"] interval: 1m timeout: 10s retries: 3 start_period: 20s networks: darkproxy: ipv4_address: 10.5.0.15 lokinet: build: context: ./lokinet dockerfile: Dockerfile platform: linux/amd64 container_name: darklokinet security_opt: - no-new-privileges:true restart: unless-stopped cpus: "1.0" mem_reservation: 64m mem_limit: 256m cap_add: - NET_ADMIN - NET_BIND_SERVICE devices: - /dev/net/tun:/dev/net/tun sysctls: - "net.ipv6.conf.all.disable_ipv6=0" healthcheck: test: ["CMD-SHELL", "pidof lokinet >/dev/null && ip link show lokinet0 >/dev/null 2>&1"] interval: 1m timeout: 10s retries: 3 start_period: 45s networks: darkproxy: ipv4_address: 10.5.0.14 namecoind: image: ukd1/namecoind@sha256:6fdf63f61f687ee639893a8cdcd910bb24c5eb3a3493ff72142c911d7019200b platform: linux/amd64 container_name: darknamecoind entrypoint: - /bin/sh - -ec - | exec /usr/local/bin/namecoind \ -server=1 \ -daemon=0 \ -datadir=/data \ -rpcbind=0.0.0.0 \ -rpcallowip=10.5.0.0/16 \ -rpcuser=namecoinrpc \ "-rpcpassword=$(cat /run/secrets/NAMECOIN_RPC_PASSWORD)" \ -printtoconsole \ -txindex=1 \ -dnsseed=1 \ -addnode=162.212.154.52:8334 \ -addnode=162.210.196.27:8334 \ -addnode=23.108.191.178:8334 \ -addnode=3.228.193.128:8334 \ -addnode=3.66.245.44:8334 \ -addnode=212.51.144.42:8334 security_opt: - no-new-privileges:true restart: unless-stopped cpus: "2.0" mem_reservation: 512m mem_limit: 2g secrets: - NAMECOIN_RPC_PASSWORD volumes: - namecoin_data:/data sysctls: - "net.ipv6.conf.all.disable_ipv6=0" healthcheck: test: ["CMD-SHELL", "curl -fsS --user \"namecoinrpc:$(cat /run/secrets/NAMECOIN_RPC_PASSWORD)\" --data-binary '{\"jsonrpc\":\"1.0\",\"id\":\"health\",\"method\":\"getblockcount\",\"params\":[]}' -H 'content-type: text/plain;' http://127.0.0.1:8336/ >/dev/null"] interval: 1m timeout: 10s retries: 3 start_period: 30s networks: darkproxy: ipv4_address: 10.5.0.13 namecoindns: build: context: ./namecoindns dockerfile: Dockerfile platform: linux/amd64 container_name: darknamecoin security_opt: - no-new-privileges:true restart: unless-stopped cpus: "0.5" mem_reservation: 64m mem_limit: 256m depends_on: namecoind: condition: service_healthy environment: NAMECOIN_RPC_URL: http://darknamecoind:8336/ NAMECOIN_RPC_USER: namecoinrpc NAMECOIN_RPC_PASSWORD_FILE: /run/secrets/NAMECOIN_RPC_PASSWORD NAMECOIN_RPC_TIMEOUT: 8 secrets: - NAMECOIN_RPC_PASSWORD sysctls: - "net.ipv6.conf.all.disable_ipv6=0" healthcheck: test: ["CMD", "python", "-c", "import socket; from dnslib import DNSRecord; q=DNSRecord.question('d.bit','TXT'); s=socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.settimeout(2); s.sendto(q.pack(), ('127.0.0.1', 53)); data, _ = s.recvfrom(4096); DNSRecord.parse(data)"] interval: 1m timeout: 10s retries: 3 start_period: 15s networks: darkproxy: ipv4_address: 10.5.0.12 tailscale: build: context: ./tailscale dockerfile: Dockerfile platform: linux/amd64 profiles: ["tailscale"] container_name: darkscale hostname: darkproxy-exit security_opt: - no-new-privileges:true cap_add: - NET_ADMIN - SYS_MODULE devices: - /dev/net/tun:/dev/net/tun environment: - TS_AUTHKEY=${TS_AUTHKEY:-} - TS_EXTRA_ARGS=--accept-dns=false --advertise-exit-node - TS_STATE_DIR=/var/lib/tailscale volumes: - tailscale_data:/var/lib/tailscale networks: darkproxy: ipv4_address: 10.5.0.10 sysctls: - net.ipv4.ip_forward=1 - net.ipv6.conf.all.forwarding=1 restart: unless-stopped # monitoring exporter for 3proxy metrics 3proxy_exporter: container_name: dark3proxy-exporter build: context: ./monitor image: darkproxy-3proxy-exporter:local platform: linux/amd64 security_opt: - no-new-privileges:true depends_on: dark3proxy: condition: service_healthy networks: darkproxy: ipv4_address: 10.5.0.20 status_dashboard: container_name: darkstatus build: context: ./monitor dockerfile: status.Dockerfile image: darkproxy-status-dashboard:local platform: linux/amd64 security_opt: - no-new-privileges:true depends_on: dark3proxy: condition: service_healthy pihole: condition: service_healthy environment: DASHBOARD_PORT: 8080 DOCKER_PROJECT: darkproxy DOCKER_SOCKET: /var/run/docker.sock DNS_SERVER: darkpihole DNS_PORT: 53 PROXY_HOST: dark3proxy PROXY_PORT: 1080 PROXY_USERS_FILE: /run/secrets/PROXY_USERS STATUS_CACHE_SECONDS: 15 SOCKET_TIMEOUT: 5 LOG_TAIL_LINES: 120 secrets: - PROXY_USERS volumes: - /var/run/docker.sock:/var/run/docker.sock:ro ports: - "${STATUS_DASHBOARD_BIND_HOST:-127.0.0.1}:${STATUS_DASHBOARD_BIND_PORT:-2004}:8080" healthcheck: test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=5).read()"] interval: 1m timeout: 10s retries: 3 start_period: 20s networks: darkproxy: ipv4_address: 10.5.0.21 restart: unless-stopped volumes: i2pd_state: name: i2pd_state yggdrasil_state: name: yggdrasil_state darkalfis_data: name: darkalfis_data emc_data: name: emc_data namecoin_data: name: namecoin_data tor-data: driver: local tailscale_data: name: tailscale_data i2p_dns_map: name: i2p_dns_map networks: darkproxy: # name: darkproxy enable_ipv6: true driver: bridge ipam: config: - subnet: 10.5.0.0/16 gateway: 10.5.0.1 - subnet: 2001:0BC5::/112 gateway: 2001:0BC5::1 secrets: tz: file: ./secrets/tz.txt YGGDRASIL_GENERATE_KEYS: file: ./secrets/YGGDRASIL_GENERATE_KEYS.txt PIHOLE_WEBPASSWORD: file: ./secrets/pihole_webpassword.txt PROXY_USERS: file: ./secrets/3proxy_users.txt NAMECOIN_RPC_PASSWORD: file: ./secrets/namecoin_rpc_password.txt