# Unified LAN proxy for the tekhnohim Tailscale exit-node egress.
#
# One 3proxy instance serves BOTH an HTTP proxy (:3128) and a SOCKS5 proxy
# (:1080), each chained to the Tailscale userspace SOCKS5 (ts-proxy:1055) so
# clients exit the internet as the Hetzner exit-node IP (89.167.72.79).
# TCP only (Tailscale userspace SOCKS5 has no UDP ASSOCIATE -> no QUIC/HTTP3).
#
# Access model (LAN free, outside password):
#   * LAN 192.168.0.0/22  -> authorised by source IP, NO password.
#   * everyone else       -> must authenticate (external clients arriving via
#                            the router port-forward keep their public source
#                            IP, so they fall through to the password rule).
# The username/password lives in a host-only file (0600, NOT in git), mounted
# separately and pulled in with the include below - same pattern as ts.env.

nserver 127.0.0.11
nscache 65536
timeouts 1 5 30 60 180 1800 15 60
log

# Account(s) for external, password-authenticated access (host-only secret):
include /etc/3proxy/3proxy.secret

# iponly authorises the LAN by address; strong forces login for the rest.
auth iponly strong

# Safety guard: never treat the router's own address as a trusted LAN client.
# If the port-forward ever SNATs external traffic to the gateway IP, this rule
# makes the proxy fail CLOSED (external denied) instead of becoming an open
# proxy. Verify after opening the port: an unauthenticated external client
# must be refused.
deny * 192.168.0.1

# LAN clients: allowed by source IP, no password. Egress via the Tailscale
# userspace SOCKS5 (a `parent` binds to the `allow` line directly above it).
allow * 192.168.0.0/22
parent 1000 socks5 ts-proxy 1055

# External clients: must present the configured account, same egress.
allow thproxy
parent 1000 socks5 ts-proxy 1055

# Anything else: denied.
deny *

proxy -p3128 -a -i0.0.0.0
socks -p1080 -i0.0.0.0