From 31335a20d3d4b14559672817ae4acd586942c3d4 Mon Sep 17 00:00:00 2001 From: oldnick85 Date: Thu, 23 Oct 2025 22:45:16 +0300 Subject: [PATCH] [ref] some improvements --- Dockerfile | 102 +++++++++++++++++++++++++--------------- README.md | 114 ++++++++++++++++++++++++++++++++++++++++----- docker-compose.yml | 23 ++++----- entrypoint.sh | 73 ++++++++++++++++++++++++----- 4 files changed, 239 insertions(+), 73 deletions(-) diff --git a/Dockerfile b/Dockerfile index c5c1d70..f14ff32 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,63 +1,89 @@ # syntax=docker/dockerfile:1 ARG UBUNTU_VERSION=24.04 +# === STAGE 1: Build Yggdrasil from source === FROM ubuntu:${UBUNTU_VERSION} as builder_yggdrasil ARG YGGDRASIL_VERSION=v0.5.12 -RUN DEBIAN_FRONTEND=noninteractive\ - apt-get update &&\ - apt-get -y upgrade -RUN DEBIAN_FRONTEND=noninteractive\ - apt-get install -y git golang + +# Install build dependencies +RUN DEBIAN_FRONTEND=noninteractive \ + apt-get update && \ + apt-get install -y --no-install-recommends \ + git golang ca-certificates && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists/* + +# Clone and build Yggdrasil from official repository WORKDIR /BUILD_YGGDRASIL/ -RUN git clone --depth 1 --branch $YGGDRASIL_VERSION https://github.com/yggdrasil-network/yggdrasil-go.git -ENV CGO_ENABLED=0 +RUN git clone --depth 1 --branch $YGGDRASIL_VERSION \ + https://github.com/yggdrasil-network/yggdrasil-go.git + +# Build Yggdrasil with static linking for better portability WORKDIR /BUILD_YGGDRASIL/yggdrasil-go # add genkeys to build RUN sed -i -e 's/yggdrasil yggdrasilctl/yggdrasil yggdrasilctl genkeys/g' build RUN ./build +# === STAGE 2: Runtime environment === FROM ubuntu:${UBUNTU_VERSION} -RUN DEBIAN_FRONTEND=noninteractive\ - apt-get update &&\ - apt-get -y upgrade -RUN DEBIAN_FRONTEND=noninteractive\ - apt-get install -y --fix-missing\ - tor obfs4proxy\ - git python3 python3-pip iputils-ping -# ==== UTILS ==== + +# Install runtime dependencies +RUN DEBIAN_FRONTEND=noninteractive \ + apt-get update && \ + apt-get install -y --no-install-recommends \ + # Tor and related services + tor obfs4proxy \ + # Utilities and scripting + git python3 python3-pip iputils-ping curl && \ + # Clear + apt-get clean && \ + rm -rf /var/lib/apt/lists/* + +# === UTILITIES SECTION === WORKDIR /UTILS/ RUN git config --global advice.detachedHead false -# script to get strong yggdrasil address (https://yggdrasil-network.github.io/configuration.html#generating-stronger-addresses-and-prefixes) -RUN git clone --depth 1 --branch v0 https://github.com/oldnick85/yggdrasil_get_keys.git /UTILS/yggdrasil_get_keys -RUN python3 -m pip install --break-system-packages -r /UTILS/yggdrasil_get_keys/requirements.txt -# script to find yggdrasil public peers -RUN git clone --depth 1 --branch v4 https://github.com/oldnick85/yggdrasil_find_public_peers.git /UTILS/yggdrasil_find_public_peers -RUN python3 -m pip install --break-system-packages -r /UTILS/yggdrasil_find_public_peers/requirements.txt -# save peers to use in case of unavailable repository +# Clone key generation script for strong Yggdrasil address (https://yggdrasil-network.github.io/configuration.html#generating-stronger-addresses-and-prefixes) +RUN git clone --depth 1 --branch v0 \ + https://github.com/oldnick85/yggdrasil_get_keys.git \ + /UTILS/yggdrasil_get_keys + +# Clone peer discovery script for finding public Yggdrasil peers +RUN git clone --depth 1 --branch v4 \ + https://github.com/oldnick85/yggdrasil_find_public_peers.git \ + /UTILS/yggdrasil_find_public_peers + +# Install Python dependencies +RUN python3 -m pip install --break-system-packages \ + -r /UTILS/yggdrasil_get_keys/requirements.txt && \ + python3 -m pip install --break-system-packages \ + -r /UTILS/yggdrasil_find_public_peers/requirements.txt + +# Pre-fetch public peers list as fallback in case repository is unavailable RUN python3 /UTILS/yggdrasil_find_public_peers/yggdrasil_find_public_peers.py \ - --yggdrasil-conf="" \ - --yggdrasil-peers-json="/UTILS/yggdrasil_find_public_peers/public_peers.json" + --yggdrasil-conf="" \ + --yggdrasil-peers-json="/UTILS/yggdrasil_find_public_peers/public_peers.json" # ==== YGGDRASIL ==== # Ports used by YGGDRASIL -# Listen EXPOSE 10654 -# Default yggdrasil port -EXPOSE 9001 WORKDIR /YGGDRASIL/ +# Copy built binaries from builder stage COPY --from=builder_yggdrasil /BUILD_YGGDRASIL/yggdrasil-go/yggdrasil . COPY --from=builder_yggdrasil /BUILD_YGGDRASIL/yggdrasil-go/yggdrasilctl . COPY --from=builder_yggdrasil /BUILD_YGGDRASIL/yggdrasil-go/genkeys . -COPY ./yggdrasil.conf . -# ==== TOR ==== +# Base configuration file +COPY ./yggdrasil.conf . + +# === TOR PROXY SETUP === +# SOCKS5 proxy port EXPOSE 9050 -EXPOSE 8118 -WORKDIR /tmp/ -COPY ./torrc /etc/tor -RUN ls /etc/tor +EXPOSE 8118 +# Tor configuration +COPY ./torrc /etc/tor/torrc COPY ./tor /etc/default/tor RUN chmod -R 0700 /etc/default/tor -RUN cat /etc/default/tor -RUN cat /etc/tor/torrc -WORKDIR / -COPY ./entrypoint.sh . -ENTRYPOINT ["bash", "/entrypoint.sh"] \ No newline at end of file +# === CONTAINER STARTUP === +COPY ./entrypoint.sh /entrypoint.sh +# Make entrypoint executable +RUN chmod +x /entrypoint.sh +# Default container command +ENTRYPOINT ["/entrypoint.sh"] \ No newline at end of file diff --git a/README.md b/README.md index 9952e58..737689b 100644 --- a/README.md +++ b/README.md @@ -1,22 +1,112 @@ -# TOR_YGGDRASIL_DOCKER +# TOR over YGGDRASIL Docker Container -## Description +[![Docker](https://img.shields.io/badge/Docker-Enabled-blue.svg)](https://docker.com) +[![Tor](https://img.shields.io/badge/Tor-Proxy-red.svg)](https://torproject.org) +[![Yggdrasil](https://img.shields.io/badge/Yggdrasil-Network-green.svg)](https://yggdrasil-network.github.io/) -This project is a set of tools for run TOR over [YGGDRASIL](https://yggdrasil-network.github.io/) docker images. +A Docker container that routes Tor traffic through the Yggdrasil decentralized network for enhanced anonymity and censorship circumvention. -At startup, the script searches YGGDRASIL public peers and chooses several best of them. -Then it generates YGGDRASIL *PublicKey* and *PrivateKey* unless the keys not set in environment variables. +## 🌟 Features -## Building +- **Dual Anonymity**: Tor over Yggdrasil for multiple privacy layers +- **Automatic Peer Discovery**: Finds best Yggdrasil peers automatically +- **Strong Key Generation**: Creates cryptographically strong Yggdrasil keys +- **Health Monitoring**: Built-in health checks for service reliability +- **Persistent Configuration**: Saves settings between container restarts -You can build docker image by simply run script *build_image.sh*. +## 🏗 Architecture -> bash build_image.sh +Internet → Yggdrasil Network → Tor SOCKS5 (9050) → Your Applications -Feel free to modify it with your own building arguments. +## 🚀 Quick Start -## Running +### Prerequisites +- Docker Engine 20.10+ +- Docker Compose 2.0+ -To run docker container just run +### Building the Image +```bash +./build_image.sh +``` -> docker-compose up +### Running the Container +```bash +docker-compose up -d +``` + +## ⚙️ Configuration + +### Environment Variables + +| Variable | Default | Description | +|-------------------------|---------|----------------------------------------| +| YGGDRASIL_GENERATE_KEYS | true | Generate new Yggdrasil keys on startup | + +## 🔧 Usage + +### Test Tor over Yggdrasil + +```bash +# Test SOCKS5 proxy +curl --socks5-hostname localhost:9050 https://check.torproject.org/ +``` + +### Check Yggdrasil Status + +```bash +docker exec -it tor_over_yggdrasil /YGGDRASIL/yggdrasilctl getself +``` + +## 🛠 Development + +### Project Structure +```text +tor_yggdrasil/ +├── docker-compose.yml # Container orchestration +├── Dockerfile # Multi-stage container build +├── entrypoint.sh # Startup script +├── torrc # Tor configuration +├── yggdrasil.conf # Yggdrasil base configuration +└── build_image.sh # Build script +``` + +### Build Arguments + + - UBUNTU_VERSION: Base OS version (default: 24.04) + - YGGDRASIL_VERSION: Yggdrasil release (default: v0.5.12) + +## 🔒 Security Features + + - Non-privileged: Runs without root privileges when possible + - Capability Limits: Only necessary Linux capabilities + - Network Isolation: Controlled network access + - Health Monitoring: Automatic service health checks + +## 🐛 Troubleshooting + +### Check Container Status +```bash +docker-compose ps +docker logs tor_over_yggdrasil +``` + +### Verify Services +```bash +# Check Yggdrasil +docker exec tor_over_yggdrasil ping6 -c 3 200::1 + +# Check Tor +curl --socks5 localhost:9050 https://check.torproject.org/ +``` + +## 📄 License + +This project is provided for educational and research purposes. Users are responsible for complying with local laws and regulations. + +## 🤝 Contributing + +Contributions are welcome! Please feel free to submit pull requests or open issues for bugs and feature requests. + +## ⚠️ Disclaimer + +This tool is designed for privacy research and legal anonymity purposes. Users are responsible for ensuring their use complies with applicable laws. diff --git a/docker-compose.yml b/docker-compose.yml index ae6fab9..ea4dd20 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,17 +1,18 @@ -version: "3.3" - +version: "3.8" + services: - # tor_yggdrasil: image: tor_yggdrasil:latest - privileged: true + container_name: tor_over_yggdrasil cap_add: - - NET_ADMIN + - NET_ADMIN # Required for network tunnel management + security_opt: + - no-new-privileges:true # Security enhancement - prevent privilege escalation devices: - - /dev/net/tun:/dev/net/tun + - /dev/net/tun:/dev/net/tun # TUN device for Yggdrasil network interface ports: - - "8118:8118" - - "9050:9050" - - "10765:10765" - - "10654:10654" - - "9001:9001" \ No newline at end of file + - "127.0.0.1:9050:9050/tcp" # SOCKS5 proxy port (Tor) for application-level traffic + - "10654:10654/tcp" # Yggdrasil peer connections + environment: + - YGGDRASIL_GENERATE_KEYS=true # Generate new Yggdrasil keys on startup + restart: unless-stopped # Auto-restart unless manually stopped \ No newline at end of file diff --git a/entrypoint.sh b/entrypoint.sh index 467ac9d..21c3780 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,24 +1,73 @@ #!/bin/bash -# get strong yggdrasil address (https://yggdrasil-network.github.io/configuration.html#generating-stronger-addresses-and-prefixes) -python3 /UTILS/yggdrasil_get_keys/yggdrasil_get_keys.py \ - --genkeys="/YGGDRASIL/genkeys" \ - --yggdrasil-conf="/YGGDRASIL/yggdrasil.conf" \ - --timeout=10 \ - --environment -# find yggdrasil public peers +set -e # Exit immediately on any error - fail fast principle + +echo "Starting Tor over Yggdrasil setup..." + +# Logging function for consistent output format +log() { + echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" +} + +# Generate strong Yggdrasil keys unless disabled by environment variable +# This enhances cryptographic security compared to default keys +if [ "${YGGDRASIL_GENERATE_KEYS:-true}" = "true" ]; then + log "Generating strong Yggdrasil keys for enhanced security..." + python3 /UTILS/yggdrasil_get_keys/yggdrasil_get_keys.py \ + --genkeys="/YGGDRASIL/genkeys" \ + --yggdrasil-conf="/YGGDRASIL/yggdrasil.conf" \ + --timeout=10 \ + --environment +else + log "Skipping key generation (YGGDRASIL_GENERATE_KEYS=false)" +fi + +# Discover and select optimal Yggdrasil public peers +# This finds the fastest and most reliable peers from public lists +log "Discovering and testing Yggdrasil public peers for optimal performance..." python3 /UTILS/yggdrasil_find_public_peers/yggdrasil_find_public_peers.py \ --yggdrasil-conf="/YGGDRASIL/yggdrasil.conf" \ --yggdrasil-peers-json="/UTILS/yggdrasil_find_public_peers/public_peers.json" \ --parallel=40 \ --pings=10 \ - --best=6 \ + --best=8 \ --max-from-country=2 \ --ping-interval=0.5 + +# Enable IPv6 - required for Yggdrasil network functionality +log "Enabling IPv6 support for Yggdrasil network..." sysctl net.ipv6.conf.all.disable_ipv6=0 || true -# start YGGDRASIL + +# Start Yggdrasil network service in background +log "Starting Yggdrasil decentralized network..." /YGGDRASIL/yggdrasil -useconffile /YGGDRASIL/yggdrasil.conf & -sleep 30s -# start TOR +# Capture process ID for monitoring +YGG_PID=$! + +# Allow time for Yggdrasil to initialize and establish peer connections +log "Waiting for Yggdrasil network initialization (30 seconds)..." +sleep 30 + +# Verify Yggdrasil process is still running +if ! ps -p $YGG_PID > /dev/null; then + log "ERROR: Yggdrasil process terminated unexpectedly!" + exit 1 +fi + +# Start Tor proxy service - will route through Yggdrasil network +log "Starting Tor proxy service..." tor & +TOR_PID=$! + +log "Setup complete! All services are now running:" +echo "- Yggdrasil Network PID: $YGG_PID" +echo "- Tor Proxy PID: $TOR_PID" +echo "- SOCKS5 Proxy: localhost:9050 (for applications)" + +# Wait for any process to exit, then cleanup +# This maintains container running until a service fails wait -n -exit $? \ No newline at end of file +log "One of the services has stopped. Initiating shutdown sequence..." +# Graceful termination +kill $YGG_PID $TOR_PID 2>/dev/null || true +# Return the exit code of the failed process +exit $? \ No newline at end of file