version: '2.3'

volumes:
  data:

services:
  tor_proxy:
    build: .
    image: fphammerle/tor-proxy
    environment:
      SOCKS_TIMEOUT_SECONDS: 30
    volumes:
    - type: volume
      source: data
      target: /var/lib/tor
      read_only: no
    - type: tmpfs
      target: /tmp # torrc
      tmpfs:
        # nosuid,nodev,noexec added by default
        mode: '1777'
        size: 4k
    read_only: yes
    ports:
    - '127.0.0.1:9050:9050/tcp'
    - '127.0.0.1:53:9053/udp'
    cap_drop: [ALL]
    # entrypoint.sh drops privileges after configuring nftables for transparent proxy
    cap_add: [NET_ADMIN, SETUID, SETGID]
    security_opt: [no-new-privileges]
    cpus: 0.5
    mem_limit: 128m
    restart: unless-stopped

# https://docs.docker.com/compose/compose-file/compose-file-v2/