Initial release

2026-07-26 05:15:08 +04:00
commit 35143415e8
10 changed files with 998 additions and 0 deletions
@@ -0,0 +1,68 @@
+name: ${COMPOSE_PROJECT_NAME:-chained-3proxy}
+
+services:
+  proxy:
+    image: ghcr.io/tarampampam/3proxy:2
+    restart: unless-stopped
+
+    environment:
+      LOG_OUTPUT: "${LOG_OUTPUT:-/dev/stdout}"
+      PROXY_PORT: "${PROXY_PORT:-3128}"
+      SOCKS_PORT: "${SOCKS_PORT:-1080}"
+      PRIMARY_RESOLVER: "${PRIMARY_RESOLVER:-1.1.1.1}"
+      SECONDARY_RESOLVER: "${SECONDARY_RESOLVER:-8.8.8.8}"
+      DNS_CACHE_SIZE: "${DNS_CACHE_SIZE:-65536}"
+      MAX_CONNECTIONS: "${MAX_CONNECTIONS:-100}"
+
+      PROXY_EXTRA_ARGS: "${PROXY_EXTRA_ARGS:-}"
+      SOCKS_EXTRA_ARGS: "${SOCKS_EXTRA_ARGS:-}"
+
+      # EXTRA_CONFIG is inserted before both generated listeners.
+      #
+      # Operation-specific ACLs select the correct parent type:
+      #
+      # - HTTP/HTTPS operations belong to the HTTP proxy listener.
+      # - CONNECT belongs to the SOCKS listener.
+      #
+      # auth iponly does not require client credentials, but enables
+      # ACL and parent routing.
+      EXTRA_CONFIG: |
+        parentretries ${PARENT_RETRIES:-3}
+        auth iponly
+
+        allow * ${CLIENT_ALLOW:-*} * * HTTP,HTTPS
+        parent 1000 http "${UPSTREAM_HOST:?Set UPSTREAM_HOST in .env}" ${UPSTREAM_PORT:-8080} "${UPSTREAM_USERNAME:?Set UPSTREAM_USERNAME in .env}" "${UPSTREAM_PASSWORD:?Set UPSTREAM_PASSWORD in .env}"
+
+        allow * ${CLIENT_ALLOW:-*} * * CONNECT
+        parent 1000 connect "${UPSTREAM_HOST:?Set UPSTREAM_HOST in .env}" ${UPSTREAM_PORT:-8080} "${UPSTREAM_USERNAME:?Set UPSTREAM_USERNAME in .env}" "${UPSTREAM_PASSWORD:?Set UPSTREAM_PASSWORD in .env}"
+
+        deny *
+
+    expose:
+      - "${PROXY_PORT:-3128}"
+      - "${SOCKS_PORT:-1080}"
+
+    read_only: true
+
+    tmpfs:
+      # The native image entrypoint generates /etc/3proxy/3proxy.cfg.
+      - /etc/3proxy:size=1m,mode=0755,uid=10001,gid=10001
+      - /tmp:size=1m,mode=1777
+
+    cap_drop:
+      - ALL
+
+    security_opt:
+      - no-new-privileges:true
+
+    ulimits:
+      nofile:
+        soft: ${NOFILE_SOFT:-2048}
+        hard: ${NOFILE_HARD:-4096}
+
+    networks:
+      - proxy
+
+networks:
+  proxy:
+    driver: bridge