68 lines
2.0 KiB
YAML
68 lines
2.0 KiB
YAML
name: ${COMPOSE_PROJECT_NAME:-chained-3proxy}
|
|
|
|
services:
|
|
proxy:
|
|
image: ghcr.io/tarampampam/3proxy:2
|
|
restart: unless-stopped
|
|
|
|
environment:
|
|
LOG_OUTPUT: "${LOG_OUTPUT:-/dev/stdout}"
|
|
PROXY_PORT: "${PROXY_PORT:-3128}"
|
|
SOCKS_PORT: "${SOCKS_PORT:-1080}"
|
|
PRIMARY_RESOLVER: "${PRIMARY_RESOLVER:-1.1.1.1}"
|
|
SECONDARY_RESOLVER: "${SECONDARY_RESOLVER:-8.8.8.8}"
|
|
DNS_CACHE_SIZE: "${DNS_CACHE_SIZE:-65536}"
|
|
MAX_CONNECTIONS: "${MAX_CONNECTIONS:-100}"
|
|
|
|
PROXY_EXTRA_ARGS: "${PROXY_EXTRA_ARGS:-}"
|
|
SOCKS_EXTRA_ARGS: "${SOCKS_EXTRA_ARGS:-}"
|
|
|
|
# EXTRA_CONFIG is inserted before both generated listeners.
|
|
#
|
|
# Operation-specific ACLs select the correct parent type:
|
|
#
|
|
# - HTTP/HTTPS operations belong to the HTTP proxy listener.
|
|
# - CONNECT belongs to the SOCKS listener.
|
|
#
|
|
# auth iponly does not require client credentials, but enables
|
|
# ACL and parent routing.
|
|
EXTRA_CONFIG: |
|
|
parentretries ${PARENT_RETRIES:-3}
|
|
auth iponly
|
|
|
|
allow * ${CLIENT_ALLOW:-*} * * HTTP,HTTPS
|
|
parent 1000 http "${UPSTREAM_HOST:?Set UPSTREAM_HOST in .env}" ${UPSTREAM_PORT:-8080} "${UPSTREAM_USERNAME:?Set UPSTREAM_USERNAME in .env}" "${UPSTREAM_PASSWORD:?Set UPSTREAM_PASSWORD in .env}"
|
|
|
|
allow * ${CLIENT_ALLOW:-*} * * CONNECT
|
|
parent 1000 connect "${UPSTREAM_HOST:?Set UPSTREAM_HOST in .env}" ${UPSTREAM_PORT:-8080} "${UPSTREAM_USERNAME:?Set UPSTREAM_USERNAME in .env}" "${UPSTREAM_PASSWORD:?Set UPSTREAM_PASSWORD in .env}"
|
|
|
|
deny *
|
|
|
|
expose:
|
|
- "${PROXY_PORT:-3128}"
|
|
- "${SOCKS_PORT:-1080}"
|
|
|
|
read_only: true
|
|
|
|
tmpfs:
|
|
# The native image entrypoint generates /etc/3proxy/3proxy.cfg.
|
|
- /etc/3proxy:size=1m,mode=0755,uid=10001,gid=10001
|
|
- /tmp:size=1m,mode=1777
|
|
|
|
cap_drop:
|
|
- ALL
|
|
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
|
|
ulimits:
|
|
nofile:
|
|
soft: ${NOFILE_SOFT:-2048}
|
|
hard: ${NOFILE_HARD:-4096}
|
|
|
|
networks:
|
|
- proxy
|
|
|
|
networks:
|
|
proxy:
|
|
driver: bridge |