[ref] some improvements

2025-10-23 22:45:16 +03:00
parent 8297ea6382
commit 31335a20d3
4 changed files with 239 additions and 73 deletions
@@ -1,63 +1,89 @@
 # syntax=docker/dockerfile:1
 ARG UBUNTU_VERSION=24.04

+# === STAGE 1: Build Yggdrasil from source ===
 FROM ubuntu:${UBUNTU_VERSION} as builder_yggdrasil
 ARG YGGDRASIL_VERSION=v0.5.12
-RUN DEBIAN_FRONTEND=noninteractive\
-    apt-get update &&\
-    apt-get -y upgrade
-RUN DEBIAN_FRONTEND=noninteractive\
-    apt-get install -y git golang
+
+# Install build dependencies
+RUN DEBIAN_FRONTEND=noninteractive \
+ apt-get update && \
+ apt-get install -y --no-install-recommends \
+ git golang ca-certificates && \
+ apt-get clean && \
+ rm -rf /var/lib/apt/lists/*
+
+# Clone and build Yggdrasil from official repository
 WORKDIR /BUILD_YGGDRASIL/
-RUN git clone --depth 1 --branch $YGGDRASIL_VERSION https://github.com/yggdrasil-network/yggdrasil-go.git
-ENV CGO_ENABLED=0
+RUN git clone --depth 1 --branch $YGGDRASIL_VERSION \
+ https://github.com/yggdrasil-network/yggdrasil-go.git
+
+# Build Yggdrasil with static linking for better portability
 WORKDIR /BUILD_YGGDRASIL/yggdrasil-go
 # add genkeys to build
 RUN sed -i -e 's/yggdrasil yggdrasilctl/yggdrasil yggdrasilctl genkeys/g' build
 RUN ./build

+# === STAGE 2: Runtime environment ===
 FROM ubuntu:${UBUNTU_VERSION}
-RUN DEBIAN_FRONTEND=noninteractive\
-    apt-get update &&\
-    apt-get -y upgrade
-RUN DEBIAN_FRONTEND=noninteractive\ 
-    apt-get install -y --fix-missing\
-    tor obfs4proxy\
-    git python3 python3-pip iputils-ping
-# ==== UTILS ====
+
+# Install runtime dependencies
+RUN DEBIAN_FRONTEND=noninteractive \
+ apt-get update && \
+ apt-get install -y --no-install-recommends \
+ # Tor and related services
+ tor obfs4proxy \ 
+ # Utilities and scripting
+ git python3 python3-pip iputils-ping curl && \ 
+ # Clear
+ apt-get clean && \
+ rm -rf /var/lib/apt/lists/*
+
+# === UTILITIES SECTION ===
 WORKDIR /UTILS/
 RUN git config --global advice.detachedHead false
-#   script to get strong yggdrasil address (https://yggdrasil-network.github.io/configuration.html#generating-stronger-addresses-and-prefixes)
-RUN git clone --depth 1 --branch v0 https://github.com/oldnick85/yggdrasil_get_keys.git /UTILS/yggdrasil_get_keys
-RUN python3 -m pip install --break-system-packages -r /UTILS/yggdrasil_get_keys/requirements.txt
-#   script to find yggdrasil public peers
-RUN git clone --depth 1 --branch v4 https://github.com/oldnick85/yggdrasil_find_public_peers.git /UTILS/yggdrasil_find_public_peers
-RUN python3 -m pip install --break-system-packages -r /UTILS/yggdrasil_find_public_peers/requirements.txt
-#   save peers to use in case of unavailable repository
+# Clone key generation script for strong Yggdrasil address (https://yggdrasil-network.github.io/configuration.html#generating-stronger-addresses-and-prefixes)
+RUN git clone --depth 1 --branch v0 \
+ https://github.com/oldnick85/yggdrasil_get_keys.git \
+ /UTILS/yggdrasil_get_keys
+
+# Clone peer discovery script for finding public Yggdrasil peers 
+RUN git clone --depth 1 --branch v4 \
+ https://github.com/oldnick85/yggdrasil_find_public_peers.git \
+ /UTILS/yggdrasil_find_public_peers
+
+# Install Python dependencies
+RUN python3 -m pip install --break-system-packages \
+ -r /UTILS/yggdrasil_get_keys/requirements.txt && \
+ python3 -m pip install --break-system-packages \
+ -r /UTILS/yggdrasil_find_public_peers/requirements.txt
+
+# Pre-fetch public peers list as fallback in case repository is unavailable
 RUN python3 /UTILS/yggdrasil_find_public_peers/yggdrasil_find_public_peers.py \
-    --yggdrasil-conf="" \
-    --yggdrasil-peers-json="/UTILS/yggdrasil_find_public_peers/public_peers.json"
+ --yggdrasil-conf="" \
+ --yggdrasil-peers-json="/UTILS/yggdrasil_find_public_peers/public_peers.json"
 # ==== YGGDRASIL ====
 #   Ports used by YGGDRASIL
-#   Listen
 EXPOSE 10654
-#   Default yggdrasil port
-EXPOSE 9001
 WORKDIR /YGGDRASIL/
+# Copy built binaries from builder stage
 COPY --from=builder_yggdrasil /BUILD_YGGDRASIL/yggdrasil-go/yggdrasil .
 COPY --from=builder_yggdrasil /BUILD_YGGDRASIL/yggdrasil-go/yggdrasilctl .
 COPY --from=builder_yggdrasil /BUILD_YGGDRASIL/yggdrasil-go/genkeys .
+# Base configuration file
 COPY ./yggdrasil.conf . 
-# ==== TOR ====
+
+# === TOR PROXY SETUP ===
+# SOCKS5 proxy port
 EXPOSE 9050
 EXPOSE 8118 
-WORKDIR /tmp/
-COPY ./torrc /etc/tor
-RUN ls /etc/tor
+# Tor configuration
+COPY ./torrc /etc/tor/torrc 
 COPY ./tor /etc/default/tor
 RUN chmod -R 0700 /etc/default/tor
-RUN cat /etc/default/tor
-RUN cat /etc/tor/torrc
-WORKDIR /
-COPY ./entrypoint.sh .
-ENTRYPOINT ["bash", "/entrypoint.sh"]
+# === CONTAINER STARTUP ===
+COPY ./entrypoint.sh /entrypoint.sh
+# Make entrypoint executable
+RUN chmod +x /entrypoint.sh 
+# Default container command
+ENTRYPOINT ["/entrypoint.sh"] 
@@ -1,22 +1,112 @@
-# TOR_YGGDRASIL_DOCKER
+# TOR over YGGDRASIL Docker Container

-## Description
+[![Docker](https://img.shields.io/badge/Docker-Enabled-blue.svg)](https://docker.com)
+[![Tor](https://img.shields.io/badge/Tor-Proxy-red.svg)](https://torproject.org)
+[![Yggdrasil](https://img.shields.io/badge/Yggdrasil-Network-green.svg)](https://yggdrasil-network.github.io/)

-This project is a set of tools for run TOR over [YGGDRASIL](https://yggdrasil-network.github.io/) docker images.
+A Docker container that routes Tor traffic through the Yggdrasil decentralized network for enhanced anonymity and censorship circumvention.

-At startup, the script searches YGGDRASIL public peers and chooses several best of them. 
-Then it generates YGGDRASIL *PublicKey* and *PrivateKey* unless the keys not set in environment variables.
+## 🌟 Features

-## Building
+- **Dual Anonymity**: Tor over Yggdrasil for multiple privacy layers
+- **Automatic Peer Discovery**: Finds best Yggdrasil peers automatically  
+- **Strong Key Generation**: Creates cryptographically strong Yggdrasil keys
+- **Health Monitoring**: Built-in health checks for service reliability
+- **Persistent Configuration**: Saves settings between container restarts

-You can build docker image by simply run script *build_image.sh*. 
+## 🏗 Architecture

-> bash build_image.sh
+Internet → Yggdrasil Network → Tor SOCKS5 (9050) → Your Applications

-Feel free to modify it with your own building arguments.
+## 🚀 Quick Start

-## Running
+### Prerequisites
+- Docker Engine 20.10+
+- Docker Compose 2.0+

-To run docker container just run
+### Building the Image
+```bash
+./build_image.sh
+```

-> docker-compose up
+### Running the Container
+```bash
+docker-compose up -d
+```
+
+## ⚙️ Configuration
+
+### Environment Variables
+
+| Variable                | Default | Description                            |
+|-------------------------|---------|----------------------------------------|
+| YGGDRASIL_GENERATE_KEYS | true    | Generate new Yggdrasil keys on startup |
+
+## 🔧 Usage
+
+### Test Tor over Yggdrasil
+
+```bash
+# Test SOCKS5 proxy
+curl --socks5-hostname localhost:9050 https://check.torproject.org/
+```
+
+### Check Yggdrasil Status
+
+```bash
+docker exec -it tor_over_yggdrasil /YGGDRASIL/yggdrasilctl getself
+```
+
+## 🛠 Development
+
+### Project Structure
+```text
+tor_yggdrasil/
+├── docker-compose.yml      # Container orchestration
+├── Dockerfile             # Multi-stage container build
+├── entrypoint.sh          # Startup script
+├── torrc                  # Tor configuration
+├── yggdrasil.conf         # Yggdrasil base configuration
+└── build_image.sh         # Build script
+```
+
+### Build Arguments
+
+ - UBUNTU_VERSION: Base OS version (default: 24.04)
+ - YGGDRASIL_VERSION: Yggdrasil release (default: v0.5.12)
+
+## 🔒 Security Features
+
+ - Non-privileged: Runs without root privileges when possible
+ - Capability Limits: Only necessary Linux capabilities
+ - Network Isolation: Controlled network access
+ - Health Monitoring: Automatic service health checks
+
+## 🐛 Troubleshooting
+
+### Check Container Status
+```bash
+docker-compose ps
+docker logs tor_over_yggdrasil
+```
+
+### Verify Services
+```bash
+# Check Yggdrasil
+docker exec tor_over_yggdrasil ping6 -c 3 200::1
+
+# Check Tor
+curl --socks5 localhost:9050 https://check.torproject.org/
+```
+
+## 📄 License
+
+This project is provided for educational and research purposes. Users are responsible for complying with local laws and regulations.
+
+## 🤝 Contributing
+
+Contributions are welcome! Please feel free to submit pull requests or open issues for bugs and feature requests.
+
+## ⚠️ Disclaimer
+
+This tool is designed for privacy research and legal anonymity purposes. Users are responsible for ensuring their use complies with applicable laws.
@@ -1,17 +1,18 @@
-version: "3.3"
+version: "3.8"

 services:
-  #
  tor_yggdrasil:
    image: tor_yggdrasil:latest
-    privileged: true
+    container_name: tor_over_yggdrasil
    cap_add:
-      - NET_ADMIN
+      - NET_ADMIN  # Required for network tunnel management
+    security_opt:
+      - no-new-privileges:true  # Security enhancement - prevent privilege escalation
    devices:
-      - /dev/net/tun:/dev/net/tun
+      - /dev/net/tun:/dev/net/tun  # TUN device for Yggdrasil network interface
    ports:
-      - "8118:8118"
-      - "9050:9050"
-      - "10765:10765"
-      - "10654:10654"
-      - "9001:9001"
+      - "127.0.0.1:9050:9050/tcp"   # SOCKS5 proxy port (Tor) for application-level traffic
+      - "10654:10654/tcp" # Yggdrasil peer connections  
+    environment:
+      - YGGDRASIL_GENERATE_KEYS=true  # Generate new Yggdrasil keys on startup
+    restart: unless-stopped  # Auto-restart unless manually stopped
@@ -1,24 +1,73 @@
 #!/bin/bash
-# get strong yggdrasil address (https://yggdrasil-network.github.io/configuration.html#generating-stronger-addresses-and-prefixes)
-python3 /UTILS/yggdrasil_get_keys/yggdrasil_get_keys.py \
-    --genkeys="/YGGDRASIL/genkeys" \
-    --yggdrasil-conf="/YGGDRASIL/yggdrasil.conf" \
-    --timeout=10 \
-    --environment
-# find yggdrasil public peers
+set -e  # Exit immediately on any error - fail fast principle
+
+echo "Starting Tor over Yggdrasil setup..."
+
+# Logging function for consistent output format
+log() {
+    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1"
+}
+
+# Generate strong Yggdrasil keys unless disabled by environment variable
+# This enhances cryptographic security compared to default keys
+if [ "${YGGDRASIL_GENERATE_KEYS:-true}" = "true" ]; then
+    log "Generating strong Yggdrasil keys for enhanced security..."
+    python3 /UTILS/yggdrasil_get_keys/yggdrasil_get_keys.py \
+        --genkeys="/YGGDRASIL/genkeys" \
+        --yggdrasil-conf="/YGGDRASIL/yggdrasil.conf" \
+        --timeout=10 \
+        --environment
+else
+    log "Skipping key generation (YGGDRASIL_GENERATE_KEYS=false)"
+fi
+
+# Discover and select optimal Yggdrasil public peers
+# This finds the fastest and most reliable peers from public lists
+log "Discovering and testing Yggdrasil public peers for optimal performance..."
 python3 /UTILS/yggdrasil_find_public_peers/yggdrasil_find_public_peers.py \
    --yggdrasil-conf="/YGGDRASIL/yggdrasil.conf" \
    --yggdrasil-peers-json="/UTILS/yggdrasil_find_public_peers/public_peers.json" \
    --parallel=40 \
    --pings=10 \
-    --best=6 \
+    --best=8 \
    --max-from-country=2 \
    --ping-interval=0.5
+
+# Enable IPv6 - required for Yggdrasil network functionality
+log "Enabling IPv6 support for Yggdrasil network..."
 sysctl net.ipv6.conf.all.disable_ipv6=0 || true
-# start YGGDRASIL
+
+# Start Yggdrasil network service in background
+log "Starting Yggdrasil decentralized network..."
 /YGGDRASIL/yggdrasil -useconffile /YGGDRASIL/yggdrasil.conf &
-sleep 30s
-# start TOR
+# Capture process ID for monitoring
+YGG_PID=$!
+
+# Allow time for Yggdrasil to initialize and establish peer connections
+log "Waiting for Yggdrasil network initialization (30 seconds)..."
+sleep 30
+
+# Verify Yggdrasil process is still running
+if ! ps -p $YGG_PID > /dev/null; then
+    log "ERROR: Yggdrasil process terminated unexpectedly!"
+    exit 1
+fi
+
+# Start Tor proxy service - will route through Yggdrasil network
+log "Starting Tor proxy service..."
 tor &
+TOR_PID=$!
+
+log "Setup complete! All services are now running:"
+echo "- Yggdrasil Network PID: $YGG_PID"
+echo "- Tor Proxy PID: $TOR_PID"
+echo "- SOCKS5 Proxy: localhost:9050 (for applications)"
+
+# Wait for any process to exit, then cleanup
+# This maintains container running until a service fails
 wait -n
+log "One of the services has stopped. Initiating shutdown sequence..."
+# Graceful termination
+kill $YGG_PID $TOR_PID 2>/dev/null || true
+# Return the exit code of the failed process
 exit $?