blade/tor_yggdrasil_docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[ref] some improvements

Browse Source
This commit is contained in:
oldnick85
2025-10-23 22:45:16 +03:00
parent 8297ea6382
commit 31335a20d3
4 changed files with 239 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+64 -38
View File
@@ -1,63 +1,89 @@
# syntax=docker/dockerfile:1 # syntax=docker/dockerfile:1
ARG UBUNTU_VERSION=24.04 ARG UBUNTU_VERSION=24.04
# === STAGE 1: Build Yggdrasil from source ===
FROM ubuntu:${UBUNTU_VERSION} as builder_yggdrasil FROM ubuntu:${UBUNTU_VERSION} as builder_yggdrasil
ARG YGGDRASIL_VERSION=v0.5.12 ARG YGGDRASIL_VERSION=v0.5.12
RUN DEBIAN_FRONTEND=noninteractive\
apt-get update &&\ # Install build dependencies
apt-get -y upgrade RUN DEBIAN_FRONTEND=noninteractive \
RUN DEBIAN_FRONTEND=noninteractive\ apt-get update && \
apt-get install -y git golang apt-get install -y --no-install-recommends \
git golang ca-certificates && \
apt-get clean && \
rm -rf /var/lib/apt/lists/*
# Clone and build Yggdrasil from official repository
WORKDIR /BUILD_YGGDRASIL/ WORKDIR /BUILD_YGGDRASIL/
RUN git clone --depth 1 --branch $YGGDRASIL_VERSION https://github.com/yggdrasil-network/yggdrasil-go.git RUN git clone --depth 1 --branch $YGGDRASIL_VERSION \
ENV CGO_ENABLED=0 https://github.com/yggdrasil-network/yggdrasil-go.git
# Build Yggdrasil with static linking for better portability
WORKDIR /BUILD_YGGDRASIL/yggdrasil-go WORKDIR /BUILD_YGGDRASIL/yggdrasil-go
# add genkeys to build # add genkeys to build
RUN sed -i -e 's/yggdrasil yggdrasilctl/yggdrasil yggdrasilctl genkeys/g' build RUN sed -i -e 's/yggdrasil yggdrasilctl/yggdrasil yggdrasilctl genkeys/g' build
RUN ./build RUN ./build
# === STAGE 2: Runtime environment ===
FROM ubuntu:${UBUNTU_VERSION} FROM ubuntu:${UBUNTU_VERSION}
RUN DEBIAN_FRONTEND=noninteractive\
apt-get update &&\ # Install runtime dependencies
apt-get -y upgrade RUN DEBIAN_FRONTEND=noninteractive \
RUN DEBIAN_FRONTEND=noninteractive\ apt-get update && \
apt-get install -y --fix-missing\ apt-get install -y --no-install-recommends \
tor obfs4proxy\ # Tor and related services
git python3 python3-pip iputils-ping tor obfs4proxy \
# ==== UTILS ==== # Utilities and scripting
git python3 python3-pip iputils-ping curl && \
# Clear
apt-get clean && \
rm -rf /var/lib/apt/lists/*
# === UTILITIES SECTION ===
WORKDIR /UTILS/ WORKDIR /UTILS/
RUN git config --global advice.detachedHead false RUN git config --global advice.detachedHead false
# script to get strong yggdrasil address (https://yggdrasil-network.github.io/configuration.html#generating-stronger-addresses-and-prefixes) # Clone key generation script for strong Yggdrasil address (https://yggdrasil-network.github.io/configuration.html#generating-stronger-addresses-and-prefixes)
RUN git clone --depth 1 --branch v0 https://github.com/oldnick85/yggdrasil_get_keys.git /UTILS/yggdrasil_get_keys RUN git clone --depth 1 --branch v0 \
RUN python3 -m pip install --break-system-packages -r /UTILS/yggdrasil_get_keys/requirements.txt https://github.com/oldnick85/yggdrasil_get_keys.git \
# script to find yggdrasil public peers /UTILS/yggdrasil_get_keys
RUN git clone --depth 1 --branch v4 https://github.com/oldnick85/yggdrasil_find_public_peers.git /UTILS/yggdrasil_find_public_peers
RUN python3 -m pip install --break-system-packages -r /UTILS/yggdrasil_find_public_peers/requirements.txt # Clone peer discovery script for finding public Yggdrasil peers
# save peers to use in case of unavailable repository RUN git clone --depth 1 --branch v4 \
https://github.com/oldnick85/yggdrasil_find_public_peers.git \
/UTILS/yggdrasil_find_public_peers
# Install Python dependencies
RUN python3 -m pip install --break-system-packages \
-r /UTILS/yggdrasil_get_keys/requirements.txt && \
python3 -m pip install --break-system-packages \
-r /UTILS/yggdrasil_find_public_peers/requirements.txt
# Pre-fetch public peers list as fallback in case repository is unavailable
RUN python3 /UTILS/yggdrasil_find_public_peers/yggdrasil_find_public_peers.py \ RUN python3 /UTILS/yggdrasil_find_public_peers/yggdrasil_find_public_peers.py \
--yggdrasil-conf="" \ --yggdrasil-conf="" \
--yggdrasil-peers-json="/UTILS/yggdrasil_find_public_peers/public_peers.json" --yggdrasil-peers-json="/UTILS/yggdrasil_find_public_peers/public_peers.json"
# ==== YGGDRASIL ==== # ==== YGGDRASIL ====
# Ports used by YGGDRASIL # Ports used by YGGDRASIL
# Listen
EXPOSE 10654 EXPOSE 10654
# Default yggdrasil port
EXPOSE 9001
WORKDIR /YGGDRASIL/ WORKDIR /YGGDRASIL/
# Copy built binaries from builder stage
COPY --from=builder_yggdrasil /BUILD_YGGDRASIL/yggdrasil-go/yggdrasil . COPY --from=builder_yggdrasil /BUILD_YGGDRASIL/yggdrasil-go/yggdrasil .
COPY --from=builder_yggdrasil /BUILD_YGGDRASIL/yggdrasil-go/yggdrasilctl . COPY --from=builder_yggdrasil /BUILD_YGGDRASIL/yggdrasil-go/yggdrasilctl .
COPY --from=builder_yggdrasil /BUILD_YGGDRASIL/yggdrasil-go/genkeys . COPY --from=builder_yggdrasil /BUILD_YGGDRASIL/yggdrasil-go/genkeys .
COPY ./yggdrasil.conf . # Base configuration file
# ==== TOR ==== COPY ./yggdrasil.conf .
# === TOR PROXY SETUP ===
# SOCKS5 proxy port
EXPOSE 9050 EXPOSE 9050
EXPOSE 8118 EXPOSE 8118
WORKDIR /tmp/ # Tor configuration
COPY ./torrc /etc/tor COPY ./torrc /etc/tor/torrc
RUN ls /etc/tor
COPY ./tor /etc/default/tor COPY ./tor /etc/default/tor
RUN chmod -R 0700 /etc/default/tor RUN chmod -R 0700 /etc/default/tor
RUN cat /etc/default/tor # === CONTAINER STARTUP ===
RUN cat /etc/tor/torrc COPY ./entrypoint.sh /entrypoint.sh
WORKDIR / # Make entrypoint executable
COPY ./entrypoint.sh . RUN chmod +x /entrypoint.sh
ENTRYPOINT ["bash", "/entrypoint.sh"] # Default container command
ENTRYPOINT ["/entrypoint.sh"]
README.md
+102 -12
View File
@@ -1,22 +1,112 @@
# TOR_YGGDRASIL_DOCKER # TOR over YGGDRASIL Docker Container
## Description [![Docker](https://img.shields.io/badge/Docker-Enabled-blue.svg)](https://docker.com)
[![Tor](https://img.shields.io/badge/Tor-Proxy-red.svg)](https://torproject.org)
[![Yggdrasil](https://img.shields.io/badge/Yggdrasil-Network-green.svg)](https://yggdrasil-network.github.io/)
This project is a set of tools for run TOR over [YGGDRASIL](https://yggdrasil-network.github.io/) docker images. A Docker container that routes Tor traffic through the Yggdrasil decentralized network for enhanced anonymity and censorship circumvention.
At startup, the script searches YGGDRASIL public peers and chooses several best of them. ## 🌟 Features
Then it generates YGGDRASIL *PublicKey* and *PrivateKey* unless the keys not set in environment variables.
## Building - **Dual Anonymity**: Tor over Yggdrasil for multiple privacy layers
- **Automatic Peer Discovery**: Finds best Yggdrasil peers automatically
- **Strong Key Generation**: Creates cryptographically strong Yggdrasil keys
- **Health Monitoring**: Built-in health checks for service reliability
- **Persistent Configuration**: Saves settings between container restarts
You can build docker image by simply run script *build_image.sh*. ## 🏗 Architecture
> bash build_image.sh Internet → Yggdrasil Network → Tor SOCKS5 (9050) → Your Applications
Feel free to modify it with your own building arguments. ## 🚀 Quick Start
## Running ### Prerequisites
- Docker Engine 20.10+
- Docker Compose 2.0+
To run docker container just run ### Building the Image
```bash
./build_image.sh
```
> docker-compose up ### Running the Container
```bash
docker-compose up -d
```
## ⚙️ Configuration
### Environment Variables
| Variable | Default | Description |
|-------------------------|---------|----------------------------------------|
| YGGDRASIL_GENERATE_KEYS | true | Generate new Yggdrasil keys on startup |
## 🔧 Usage
### Test Tor over Yggdrasil
```bash
# Test SOCKS5 proxy
curl --socks5-hostname localhost:9050 https://check.torproject.org/
```
### Check Yggdrasil Status
```bash
docker exec -it tor_over_yggdrasil /YGGDRASIL/yggdrasilctl getself
```
## 🛠 Development
### Project Structure
```text
tor_yggdrasil/
├── docker-compose.yml # Container orchestration
├── Dockerfile # Multi-stage container build
├── entrypoint.sh # Startup script
├── torrc # Tor configuration
├── yggdrasil.conf # Yggdrasil base configuration
└── build_image.sh # Build script
```
### Build Arguments
- UBUNTU_VERSION: Base OS version (default: 24.04)
- YGGDRASIL_VERSION: Yggdrasil release (default: v0.5.12)
## 🔒 Security Features
- Non-privileged: Runs without root privileges when possible
- Capability Limits: Only necessary Linux capabilities
- Network Isolation: Controlled network access
- Health Monitoring: Automatic service health checks
## 🐛 Troubleshooting
### Check Container Status
```bash
docker-compose ps
docker logs tor_over_yggdrasil
```
### Verify Services
```bash
# Check Yggdrasil
docker exec tor_over_yggdrasil ping6 -c 3 200::1
# Check Tor
curl --socks5 localhost:9050 https://check.torproject.org/
```
## 📄 License
This project is provided for educational and research purposes. Users are responsible for complying with local laws and regulations.
## 🤝 Contributing
Contributions are welcome! Please feel free to submit pull requests or open issues for bugs and feature requests.
## ⚠️ Disclaimer
This tool is designed for privacy research and legal anonymity purposes. Users are responsible for ensuring their use complies with applicable laws.
docker-compose.yml
+12 -11
View File
@@ -1,17 +1,18 @@
version: "3.3" version: "3.8"
services: services:
#
tor_yggdrasil: tor_yggdrasil:
image: tor_yggdrasil:latest image: tor_yggdrasil:latest
privileged: true container_name: tor_over_yggdrasil
cap_add: cap_add:
- NET_ADMIN - NET_ADMIN # Required for network tunnel management
security_opt:
- no-new-privileges:true # Security enhancement - prevent privilege escalation
devices: devices:
- /dev/net/tun:/dev/net/tun - /dev/net/tun:/dev/net/tun # TUN device for Yggdrasil network interface
ports: ports:
- "8118:8118" - "127.0.0.1:9050:9050/tcp" # SOCKS5 proxy port (Tor) for application-level traffic
- "9050:9050" - "10654:10654/tcp" # Yggdrasil peer connections
- "10765:10765" environment:
- "10654:10654" - YGGDRASIL_GENERATE_KEYS=true # Generate new Yggdrasil keys on startup
- "9001:9001" restart: unless-stopped # Auto-restart unless manually stopped
entrypoint.sh
+61 -12
View File
@@ -1,24 +1,73 @@
#!/bin/bash #!/bin/bash
# get strong yggdrasil address (https://yggdrasil-network.github.io/configuration.html#generating-stronger-addresses-and-prefixes) set -e # Exit immediately on any error - fail fast principle
python3 /UTILS/yggdrasil_get_keys/yggdrasil_get_keys.py \
--genkeys="/YGGDRASIL/genkeys" \ echo "Starting Tor over Yggdrasil setup..."
--yggdrasil-conf="/YGGDRASIL/yggdrasil.conf" \
--timeout=10 \ # Logging function for consistent output format
--environment log() {
# find yggdrasil public peers echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1"
}
# Generate strong Yggdrasil keys unless disabled by environment variable
# This enhances cryptographic security compared to default keys
if [ "${YGGDRASIL_GENERATE_KEYS:-true}" = "true" ]; then
log "Generating strong Yggdrasil keys for enhanced security..."
python3 /UTILS/yggdrasil_get_keys/yggdrasil_get_keys.py \
--genkeys="/YGGDRASIL/genkeys" \
--yggdrasil-conf="/YGGDRASIL/yggdrasil.conf" \
--timeout=10 \
--environment
else
log "Skipping key generation (YGGDRASIL_GENERATE_KEYS=false)"
fi
# Discover and select optimal Yggdrasil public peers
# This finds the fastest and most reliable peers from public lists
log "Discovering and testing Yggdrasil public peers for optimal performance..."
python3 /UTILS/yggdrasil_find_public_peers/yggdrasil_find_public_peers.py \ python3 /UTILS/yggdrasil_find_public_peers/yggdrasil_find_public_peers.py \
--yggdrasil-conf="/YGGDRASIL/yggdrasil.conf" \ --yggdrasil-conf="/YGGDRASIL/yggdrasil.conf" \
--yggdrasil-peers-json="/UTILS/yggdrasil_find_public_peers/public_peers.json" \ --yggdrasil-peers-json="/UTILS/yggdrasil_find_public_peers/public_peers.json" \
--parallel=40 \ --parallel=40 \
--pings=10 \ --pings=10 \
--best=6 \ --best=8 \
--max-from-country=2 \ --max-from-country=2 \
--ping-interval=0.5 --ping-interval=0.5
# Enable IPv6 - required for Yggdrasil network functionality
log "Enabling IPv6 support for Yggdrasil network..."
sysctl net.ipv6.conf.all.disable_ipv6=0 || true sysctl net.ipv6.conf.all.disable_ipv6=0 || true
# start YGGDRASIL
# Start Yggdrasil network service in background
log "Starting Yggdrasil decentralized network..."
/YGGDRASIL/yggdrasil -useconffile /YGGDRASIL/yggdrasil.conf & /YGGDRASIL/yggdrasil -useconffile /YGGDRASIL/yggdrasil.conf &
sleep 30s # Capture process ID for monitoring
# start TOR YGG_PID=$!
# Allow time for Yggdrasil to initialize and establish peer connections
log "Waiting for Yggdrasil network initialization (30 seconds)..."
sleep 30
# Verify Yggdrasil process is still running
if ! ps -p $YGG_PID > /dev/null; then
log "ERROR: Yggdrasil process terminated unexpectedly!"
exit 1
fi
# Start Tor proxy service - will route through Yggdrasil network
log "Starting Tor proxy service..."
tor & tor &
TOR_PID=$!
log "Setup complete! All services are now running:"
echo "- Yggdrasil Network PID: $YGG_PID"
echo "- Tor Proxy PID: $TOR_PID"
echo "- SOCKS5 Proxy: localhost:9050 (for applications)"
# Wait for any process to exit, then cleanup
# This maintains container running until a service fails
wait -n wait -n
exit $? log "One of the services has stopped. Initiating shutdown sequence..."
# Graceful termination
kill $YGG_PID $TOR_PID 2>/dev/null || true
# Return the exit code of the failed process
exit $?