pipistrelloandClaude Opus 4.8
07c4495a03
Retire the tinyproxy HTTP container (tinyproxy has no per-source-IP conditional auth) and serve both the HTTP proxy (:3128) and SOCKS5 (:1080) from a single 3proxy instance. LAN (192.168.0.0/22) stays passwordless; any non-LAN source (i.e. external clients via the router port-forward) must authenticate. Credentials live in a host-only /etc/3proxy/3proxy.secret (0600, not in git), included by 3proxy.cfg. A deny rule on the gateway IP makes the proxy fail closed if the port-forward ever SNATs to 192.168.0.1. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>