services:
  ts-proxy:
    image: tailscale/tailscale:v1.98.9
    container_name: ts-proxy
    hostname: technohim-lan-proxy
    restart: unless-stopped
    env_file: ["/mnt/containers/tailscale-proxy/ts.env"]
    environment:
      TS_HOSTNAME: technohim-lan-proxy
      TS_STATE_DIR: /var/lib/tailscale
      TS_USERSPACE: "true"
      TS_ACCEPT_DNS: "false"
      TS_EXTRA_ARGS: "--exit-node=100.121.234.85 --reset"
      TS_TAILSCALED_EXTRA_ARGS: "--socks5-server=0.0.0.0:1055 --outbound-http-proxy-listen=0.0.0.0:1056"
    volumes: ["/mnt/containers/tailscale-proxy/state:/var/lib/tailscale:z"]
    networks: [proxynet]

  # Unified 3proxy front: HTTP proxy (:3128) + SOCKS5 (:1080), LAN passwordless
  # and external password-authenticated. Replaces the former tinyproxy HTTP
  # container (tinyproxy cannot do per-source-IP conditional auth).
  proxy:
    image: ghcr.io/3proxy/3proxy:latest
    container_name: ts-lan-proxy
    restart: unless-stopped
    depends_on: [ts-proxy]
    volumes:
      - "/mnt/containers/tailscale-proxy/3proxy.cfg:/etc/3proxy/3proxy.cfg:ro,z"
      - "/mnt/containers/tailscale-proxy/3proxy.secret:/etc/3proxy/3proxy.secret:ro,z"
    ports:
      - "192.168.0.35:3128:3128"
      - "192.168.0.35:1080:1080"
    logging:
      driver: syslog
      options:
        syslog-address: "udp://192.168.0.35:514"
        syslog-format: rfc3164
        tag: tailscale-proxy
    networks: [proxynet]

networks:
  proxynet:
    name: tailscale-proxynet