name: ${COMPOSE_PROJECT_NAME:-chained-3proxy}

services:
  proxy:
    image: ghcr.io/tarampampam/3proxy:2
    restart: unless-stopped

    environment:
      LOG_OUTPUT: "${LOG_OUTPUT:-/dev/stdout}"
      PROXY_PORT: "${PROXY_PORT:-3128}"
      SOCKS_PORT: "${SOCKS_PORT:-1080}"
      PRIMARY_RESOLVER: "${PRIMARY_RESOLVER:-1.1.1.1}"
      SECONDARY_RESOLVER: "${SECONDARY_RESOLVER:-8.8.8.8}"
      DNS_CACHE_SIZE: "${DNS_CACHE_SIZE:-65536}"
      MAX_CONNECTIONS: "${MAX_CONNECTIONS:-100}"

      PROXY_EXTRA_ARGS: "${PROXY_EXTRA_ARGS:-}"
      SOCKS_EXTRA_ARGS: "${SOCKS_EXTRA_ARGS:-}"

      # EXTRA_CONFIG is inserted before both generated listeners.
      #
      # Operation-specific ACLs select the correct parent type:
      #
      # - HTTP/HTTPS operations belong to the HTTP proxy listener.
      # - CONNECT belongs to the SOCKS listener.
      #
      # auth iponly does not require client credentials, but enables
      # ACL and parent routing.
      EXTRA_CONFIG: |
        parentretries ${PARENT_RETRIES:-3}
        auth iponly

        allow * ${CLIENT_ALLOW:-*} * * HTTP,HTTPS
        parent 1000 http "${UPSTREAM_HOST:?Set UPSTREAM_HOST in .env}" ${UPSTREAM_PORT:-8080} "${UPSTREAM_USERNAME:?Set UPSTREAM_USERNAME in .env}" "${UPSTREAM_PASSWORD:?Set UPSTREAM_PASSWORD in .env}"

        allow * ${CLIENT_ALLOW:-*} * * CONNECT
        parent 1000 connect "${UPSTREAM_HOST:?Set UPSTREAM_HOST in .env}" ${UPSTREAM_PORT:-8080} "${UPSTREAM_USERNAME:?Set UPSTREAM_USERNAME in .env}" "${UPSTREAM_PASSWORD:?Set UPSTREAM_PASSWORD in .env}"

        deny *

    expose:
      - "${PROXY_PORT:-3128}"
      - "${SOCKS_PORT:-1080}"

    read_only: true

    tmpfs:
      # The native image entrypoint generates /etc/3proxy/3proxy.cfg.
      - /etc/3proxy:size=1m,mode=0755,uid=10001,gid=10001
      - /tmp:size=1m,mode=1777

    cap_drop:
      - ALL

    security_opt:
      - no-new-privileges:true

    ulimits:
      nofile:
        soft: ${NOFILE_SOFT:-2048}
        hard: ${NOFILE_HARD:-4096}

    networks:
      - proxy

networks:
  proxy:
    driver: bridge