pipistrelloandClaude Opus 4.8
07c4495a03
Retire the tinyproxy HTTP container (tinyproxy has no per-source-IP conditional auth) and serve both the HTTP proxy (:3128) and SOCKS5 (:1080) from a single 3proxy instance. LAN (192.168.0.0/22) stays passwordless; any non-LAN source (i.e. external clients via the router port-forward) must authenticate. Credentials live in a host-only /etc/3proxy/3proxy.secret (0600, not in git), included by 3proxy.cfg. A deny rule on the gateway IP makes the proxy fail closed if the port-forward ever SNATs to 192.168.0.1. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
43 lines
1.4 KiB
YAML
43 lines
1.4 KiB
YAML
services:
|
|
ts-proxy:
|
|
image: tailscale/tailscale:v1.98.9
|
|
container_name: ts-proxy
|
|
hostname: technohim-lan-proxy
|
|
restart: unless-stopped
|
|
env_file: ["/mnt/containers/tailscale-proxy/ts.env"]
|
|
environment:
|
|
TS_HOSTNAME: technohim-lan-proxy
|
|
TS_STATE_DIR: /var/lib/tailscale
|
|
TS_USERSPACE: "true"
|
|
TS_ACCEPT_DNS: "false"
|
|
TS_EXTRA_ARGS: "--exit-node=100.121.234.85 --reset"
|
|
TS_TAILSCALED_EXTRA_ARGS: "--socks5-server=0.0.0.0:1055 --outbound-http-proxy-listen=0.0.0.0:1056"
|
|
volumes: ["/mnt/containers/tailscale-proxy/state:/var/lib/tailscale:z"]
|
|
networks: [proxynet]
|
|
|
|
# Unified 3proxy front: HTTP proxy (:3128) + SOCKS5 (:1080), LAN passwordless
|
|
# and external password-authenticated. Replaces the former tinyproxy HTTP
|
|
# container (tinyproxy cannot do per-source-IP conditional auth).
|
|
proxy:
|
|
image: ghcr.io/3proxy/3proxy:latest
|
|
container_name: ts-lan-proxy
|
|
restart: unless-stopped
|
|
depends_on: [ts-proxy]
|
|
volumes:
|
|
- "/mnt/containers/tailscale-proxy/3proxy.cfg:/etc/3proxy/3proxy.cfg:ro,z"
|
|
- "/mnt/containers/tailscale-proxy/3proxy.secret:/etc/3proxy/3proxy.secret:ro,z"
|
|
ports:
|
|
- "192.168.0.35:3128:3128"
|
|
- "192.168.0.35:1080:1080"
|
|
logging:
|
|
driver: syslog
|
|
options:
|
|
syslog-address: "udp://192.168.0.35:514"
|
|
syslog-format: rfc3164
|
|
tag: tailscale-proxy
|
|
networks: [proxynet]
|
|
|
|
networks:
|
|
proxynet:
|
|
name: tailscale-proxynet
|