OCram85/swarmproxy
1
0
Fork 0
generated from Templates/Baseline
Code Issues 1 Pull Requests 1 Actions Packages Releases 3 Activity

Compare commits

base: OCram85:main
Branches Tags
OCram85:main
OCram85:renovate/alpine-3.x
OCram85:v0.1.1
OCram85:v0.1.0
OCram85:v0.0.5-rc0
OCram85:v0.0.4
OCram85:v0.0.3
OCram85:v0.0.2
OCram85:v0.0.1
..
compare: OCram85:v0.0.5-rc0
Branches Tags
OCram85:renovate/alpine-3.x
OCram85:main
OCram85:v0.1.1
OCram85:v0.1.0
OCram85:v0.0.5-rc0
OCram85:v0.0.4
OCram85:v0.0.3
OCram85:v0.0.2
OCram85:v0.0.1

No commits in common. "main" and "v0.0.5-rc0" have entirely different histories.
main ... v0.0.5-rc0

14 changed files with 32 additions and 750 deletions
Show Stats Expand all files Collapse all files

8
.gitea/workflows/ci.yaml
View File

@ -20,7 +20,7 @@ jobs:
-
name: Docker meta
id: meta
uses: https://gitea.ocram85.com/actions/metadata-action@v5
uses: actions/metadata-action@v4
with:
images: |
gitea.ocram85.com/ocram85/swarmproxy
@ -31,10 +31,10 @@ jobs:
type=semver,pattern={{major}}.{{minor}}
-
name: Set up Docker Buildx
uses: https://gitea.ocram85.com/actions/setup-buildx-action@v3
uses: actions/setup-buildx-action@v2
-
name: Login to Gitea Package Registry
uses: https://gitea.ocram85.com/actions/login-action@v3
uses: actions/login-action@v2
with:
registry: gitea.ocram85.com
username: ${{ secrets.USERNAME }}
@ -42,7 +42,7 @@ jobs:
password: ${{ secrets.TOKEN }}
-
name: Build and push
uses: https://gitea.ocram85.com/actions/build-push-action@v6
uses: actions/build-push-action@v4
with:
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}

6
.gitea/workflows/release.yaml
View File

@ -9,16 +9,16 @@ jobs:
release:
runs-on: ubuntu-latest
steps:
- uses: https://gitea.ocram85.com/actions/checkout@v4
- uses: actions/checkout@v3
with:
fetch-depth: 0
- name: setup go
uses: https://gitea.ocram85.com/actions/setup-go@v3
uses: actions/setup-go@v3
with:
go-version: '>=1.20.1'
- name: Use Go Action
id: use-go-action
uses: https://gitea.ocram85.com/actions/release-action@main
uses: actions/release-action@main
with:
files: |-
CHANGELOG.md

14
.vscode/dictionaries/project-words.txt vendored
View File

@ -1,15 +1 @@
FOSS
gitea
Gitea
LOGLEVEL
MAXCLIENTS
ocram
Quickstart
swarmproxy
Swarmproxy
tbd
tinyproxy
Tinyproxy
TINYPROXY
UID
USR

1
.vscode/settings.json vendored
View File

@ -65,7 +65,6 @@
"path": "${workspaceRoot}/.vscode/dictionaries/project-words.txt",
"description": "Words used in this project",
"addWords": true
},
"custom": true
}

37
.vscode/tasks.json vendored
View File

@ -1,37 +0,0 @@
{
"version": "2.0.0",
"tasks": [
{
"label": "Update GiteaChangelog",
"type": "shell",
"command": [
"mv 'CHANGELOG.md' 'CHANGELOG.back' &&",
"changelog -m '${input:Milestone}' --token '${input:GiteaToken}' -c .changelog.yml generate > CHANGELOG.md &&",
"echo '' >> CHANGELOG.md &&",
"cat CHANGELOG.back >> CHANGELOG.md &&",
"rm CHANGELOG.back"
],
"problemMatcher": []
}
],
"inputs": [
{
"id": "GiteaToken",
"type": "command",
"command": "shellCommand.execute",
"args": {
"command": "echo $GITEA_TOKEN",
"description": "Your personal Gitea access token"
}
},
{
"id": "Milestone",
"type": "command",
"command": "shellCommand.execute",
"args": {
"description": "Select or enter a open milestone",
"command": "tea milestone ls -f title --output simple"
}
}
]
}

22
CHANGELOG.md
View File

@ -1,17 +1,4 @@
## [v0.1.1](https://gitea.ocram85.com/OCram85/swarmproxy/releases/tag/v0.1.1) - 2024-06-20
* ✨ FEATURES
* Adds timezone support (#14)
* 🤖 DEPENDENCIES
* Chore(deps): update actions/build-push-action action to v6 (#22)
* Chore(deps): update actions/setup-buildx-action action to v3 (#21)
* Chore(deps): update actions/metadata-action action to v5 (#20)
* Chore(deps): update actions/login-action action to v3 (#19)
* Chore(deps): update actions/checkout action to v4 (#18)
* Chore(deps): update alpine docker tag to v3.20.0 (#16)
* Update alpine Docker tag to v3.18.4 (#15)
## [v0.1.0](https://gitea.ocram85.com/OCram85/swarmproxy/releases/tag/v0.1.0) - 2023-07-13
## [v0.1.0](https://gitea.ocram85.com/OCram85/swarmproxy/releases/tag/v0.1.0) - 2023-07-12
* ✨ FEATURES
* Adds entrypoint (#6)
@ -19,10 +6,3 @@
* 📦 BUILD
* Add gitea release action (#7)
* Finalize ci (#5)
* Setup basic action based ci (#3)
* 🤖 DEPENDENCIES
* Use absolute urls for action calls (#10)
* Adds renovate support (#8)
* ⚙️ META
* Add Readme content (#11)
* Adds initial readme (#4)

5
Dockerfile
View File

@ -1,4 +1,4 @@
FROM alpine:3.20.0
FROM alpine:3.18.2
# Set labels manually, each build service differs in used or predefined labels.
LABEL maintainer="OCram85"
@ -29,12 +29,11 @@ ENV LOGLEVEL "Info"
ENV MAXCLIENTS "600"
ENV FILTER_FILE "/app/filter"
ENV TZ "Europe/Berlin"
# get existing packages
# curl for healthchecks and debugging
RUN apk add --no-cache \
tinyproxy curl tzdata
tinyproxy curl
COPY entrypoint.sh /app/entrypoint.sh

68
README.md
View File

@ -6,41 +6,23 @@
<p align="center">
<a href="https://gitea.ocram85.com/OCram85/swarmproxy/">
<img
src="assets/social-logo.png"
alt="Swarmproxy - Tame your traffic"
src="/OCram85/swarmproxy/raw/branch/main/assets/social-logo.png"
alt="swarmproxy"
>
</a>
</p>
<h1 align="center">
Swarmproxy - Tame your traffic
</h1>
<p align="center">
🦁 Swarmproxy is a simple http proxy to limit your outbound traffic.
Swarmproxy is a simple http/https proxy for outbound traffic in a docker swarm cluster.
</p>
## 📖 About
## :book: About
Swarmproxy is a simply way to integrate a http proxy in your Docker swarm cluster or any other container network.
It acts as an centralized proxy to limit your outbound / egress traffic. You can also add a whitelist filter to
limit the allowed domains. There is also an option to use a upstream proxy.
### What does Swarmproxy for you?
Enterprise and production environments often face more stringent security requirements.
Therefore, unfiltered Internet access may be prohibited.
So Swarmproxy could help you with these features:
- ✔️ Prevent direct web access from Container workload.
- ✔️ Upstream proxy with or without authentication
- ✔️ Optional domain based whitelist filter.
### What does Swarmproxy not?
Swarmproxy is just a supercharged Tinyproxy where you can point your container workload to.
- ☣️ Swarmproxy does not block the web access or other traffic if you workload doesn't use a proxy
- ☣️ It's not a firewall, thus it does not customize your iptables or any other firewall policies.
## 🚀 Quickstart
## 🤖 Quickstart
### 1. ⚡ Get the image 📦
@ -49,12 +31,9 @@ You can download the image from the Gitea embedded container registry: `gitea.oc
- `latest`, `main` - Is based on the lasted master branch commit.
- `1`, `0.1`, `0.1.0` - tag based version.
> **💡 NOTE: See the [packages page](https://gitea.ocram85.com/OCram85/-/packages/container/swarmproxy/latest)
> for latest version and all other available tags.**
> **💡 NOTE: See the [packages page](https://gitea.ocram85.com/OCram85/-/packages/container/swarmproxy/latest) for latest version and all other available tags.**
### 2. 🛡️ Run as Docker Swarm Stack
This example shows all available configuration keys / environment variables for Swarmproxy.
### 2.a Run as Docker Swarm Stack
```yaml
version: "3.8"
@ -76,14 +55,12 @@ networks:
services:
swarmproxy:
# Do not use the `latest` tag in production!
image: gitea.ocram85.com/OCram85/swarmproxy:latest
deploy:
replicas: 1
#secrets:
# - upstream-proxy
environment:
- LOGLEVEL=Info
# Recommended settings
# Use an optional upstream proxy
#- UPSTREAM_PROXY=
@ -96,28 +73,25 @@ services:
#- TINYPROXY_GID=5123
#- PORT=8888
#- TIMEOUT=600
#- LOGLEVEL=Info
#- MAXCLIENTS=600
#- FILTER_FILE=/app/filter
volumes:
# You can mount a single filter file into the container.
# To reload the file use the docker kill -s USR1 <container_id| container_name> command.
# - ./filter.txt:/app/filter:ro
#configs:
# - source: filter_file
# target: /app/filter
- ./filter.txt:/app/filter:ro
configs:
- source: filter_file
target: /app/filter
networks:
egress:
aliases:
- swarmproxy
- proxy
```
## 🚀 Examples
See the [Readme](examples/) docs in the examples folder...
## 💣 Known Issues
## 😡 We're Using GitHub Under Protest
This project is currently **mirrored** to GitHub. This is not ideal; GitHub is a
@ -143,11 +117,11 @@ code in Copilot.
## 🙏 Credits
Swarmproxy is based on the following projects and wouldn't be possible without them:
swarmproxy is based on the following projects and wouldn't be possible without them:
- [Tinyproxy](https://github.com/tinyproxy/tinyproxy) - The Tinyproxy project itself
- [docker-tinyproxy](https://github.com/kalaksi/docker-tinyproxy) - A containerized Tinyproxy variant.
- [docker-tinyproxy](https://github.com/ajoergensen/docker-tinyproxy) - A containerized Tinyproxy variant.
- [docker-tinyproxy](https://github.com/kalaksi/docker-tinyproxy) - A containerized tinyproxy variant.
- [docker-tinyproxy](https://github.com/ajoergensen/docker-tinyproxy) - A containerized tinyproxy variant.
## ⚖️ License (AGPLv3)

2
entrypoint.sh
View File

@ -27,7 +27,7 @@ EOF
function addUpstreamConfig() {
[ -z "$UPSTREAM_PROXY_FILE" ] || export UPSTREAM_PROXY=$(cat $UPSTREAM_PROXY_FILE)
[ -z "$UPSTREAM_PROXY" ] || echo "Upstream http $UPSTREAM_PROXY " >> "$CONFIG"
[ -z "$UPSTREAM_PROXY" ] || echo "upstream http $UPSTREAM_PROXY \".\"" >> "$CONFIG"
}
function addFilterConfig() {

35
examples/1-minimal.yml
View File

@ -1,35 +0,0 @@
version: "3.8"
networks:
egress:
attachable: true
backend:
internal: true
services:
swarmproxy:
image: gitea.ocram85.com/ocram85/swarmproxy:latest
deploy:
replicas: 1
environment:
- LOGLEVEL=Info
networks:
egress:
aliases:
- proxy
curl:
image: curlimages/curl:8.1.2
command: ["-I", "-x", "proxy:8888", "https://google.com"]
depends_on:
- swarmproxy
deploy:
replicas: 1
restart_policy:
condition: on-failure
delay: 10s
max_attempts: 5
window: 120s
networks:
- backend
- egress

64
examples/2-upstream.yml
View File

@ -1,64 +0,0 @@
version: "3.8"
# Setting up 3 default networks to act as dummy:
# - backend : internal only network
# - dmz : dmz network with connections allowed from internal and external
# - egress : dummy egress zone with fake upstream proxy
networks:
egress:
attachable: true
dmz:
attachable: true
backend:
internal: true
services:
# Creating a fake upstream proxy
upstream:
image: gitea.ocram85.com/ocram85/swarmproxy:latest
deploy:
replicas: 1
environment:
- LOGLEVEL=Info
networks:
egress:
aliases:
- upstream
# Creating our swarmproxy instance to use the external upstream proxy
swarmproxy:
# Do not use the `latest` tag in production!
image: gitea.ocram85.com/ocram85/swarmproxy:latest
depends_on:
- upstream
deploy:
replicas: 1
environment:
- LOGLEVEL=Info
- UPSTREAM_PROXY=upstream:8888
networks:
dmz:
aliases:
- swarmproxy
- proxy
egress:
# container workload example which tries to communicate through our swarmproxy instance
# http request / response:
# [curl container] <---|req/res|---> [swarmproxy] <---|req/res|---> [upstream] <---|req/res|---> [target]
curl:
image: curlimages/curl:8.1.2
command: ["-I", "-x", "proxy:8888", "https://google.com"]
depends_on:
- upstream
- swarmproxy
deploy:
replicas: 1
restart_policy:
condition: on-failure
delay: 10s
max_attempts: 5
window: 120s
networks:
- backend
- dmz

101
examples/3-external.yml
View File

@ -1,101 +0,0 @@
version: "3.8"
# IMPORTANT: Run the following command to add the required filter config file:
# echo "google.com" | docker config create filter_file -
configs:
filter_file:
external: true
# IMPORTANT: Run the following command to add the required filter config file:
# echo "upstream:8888" | docker secret create upstream-proxy -
secrets:
upstream-proxy:
external: true
# Setting up 3 default networks to act as dummy:
# - backend : internal only network
# - dmz : dmz network with connections allowed from internal and external
# - egress : dummy egress zone with fake upstream proxy
networks:
egress:
attachable: true
dmz:
attachable: true
backend:
internal: true
services:
# Creating a fake upstream proxy
upstream:
image: gitea.ocram85.com/ocram85/swarmproxy:latest
deploy:
replicas: 1
environment:
- LOGLEVEL=Info
networks:
egress:
aliases:
- upstream
# Creating our swarmproxy instance to use the external upstream proxy
swarmproxy:
# Do not use the `latest` tag in production!
image: gitea.ocram85.com/ocram85/swarmproxy:latest
depends_on:
- upstream
deploy:
replicas: 1
environment:
- LOGLEVEL=Info
#- UPSTREAM_PROXY=upstream:8888
- UPSTREAM_PROXY_FILE=/run/secrets/upstream-proxy
- FILTER_FILE=/app/filter
configs:
- source: filter_file
target: /app/filter
secrets:
- upstream-proxy
networks:
dmz:
aliases:
- swarmproxy
- proxy
egress:
# container workload example whicht tries to communicate through our swarmproxy instance
# http request / response:
# [curl container] <---|req/res|---> [swarmproxy] <---|req/res|---> [upstream] <---|req/res|---> [target]
curl:
image: curlimages/curl:8.1.2
command: ["-I", "-x", "proxy:8888", "https://google.com"]
depends_on:
- upstream
- swarmproxy
deploy:
replicas: 1
restart_policy:
condition: on-failure
delay: 10s
max_attempts: 5
window: 120s
networks:
- backend
- dmz
# Example for blocked request if there is no matching domain in the filter file.
curl-blocked:
image: curlimages/curl:8.1.2
command: ["-I", "-x", "proxy:8888", "https://amazon.com"]
depends_on:
- upstream
- swarmproxy
deploy:
replicas: 1
restart_policy:
condition: on-failure
delay: 10s
max_attempts: 5
window: 120s
networks:
- backend
- dmz

407
examples/Readme.md
View File

@ -1,407 +0,0 @@
---
gitea: none
include_toc: true
---
# 📘 Examples
This folder contains some examples you can use to start building your Swarmproxy stack.
## Basic example `(1-minimal.yml)`
### Source
> 🗄️ File: [1-minimal.yml](1-minimal.yml)
### Description
This is the mos basic example. It contains the Swarmproxy service and curl als helper. Just deploy the stack and
inspect the logs form the containers.
### Usage
```bash
docker stack deploy -c 1-minimal.yml swarmproxy-mini
```
### Container Logs
- Swarmproxy:
```
🦁 FILTER_FILE not found or set.
🦁 Final Swarmproxy config 🦁
3
Group 5123
8
Timeout 600
DefaultErrorFile "/usr/share/tinyproxy/default.html"
StatHost "tinyproxy.stats"
StatFile "/usr/share/tinyproxy/stats.html"
LogLevel Info
MaxClients 600
ViaProxyName "Swarmproxy"
Allow 127.0.0.1/8
Allow 10.0.0.0/8
🦁 Starting Tinyproxy...
args count: 3
args value: -c /app/proxy.conf -d
NOTICE Jul 13 11:10:23.360 [1]: Initializing tinyproxy ...
NOTICE Jul 13 11:10:23.360 [1]: Reloading config file
INFO Jul 13 11:10:23.360 [1]: Stathost set to "tinyproxy.stats"
INFO Jul 13 11:10:23.360 [1]: Setting "Via" header to 'Swarmproxy'
NOTICE Jul 13 11:10:23.360 [1]: Reloading config file finished
INFO Jul 13 11:10:23.360 [1]: listen_sock called with addr = '(NULL)'
INFO Jul 13 11:10:23.360 [1]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
INFO Jul 13 11:10:23.360 [1]: listening on fd [3]
INFO Jul 13 11:10:23.360 [1]: trying to listen on host[::], family[10], socktype[1], proto[6]
INFO Jul 13 11:10:23.360 [1]: listening on fd [4]
INFO Jul 13 11:10:23.360 [1]: Not running as root, so not changing UID/GID.
INFO Jul 13 11:10:23.360 [1]: Setting the various signals.
INFO Jul 13 11:10:23.360 [1]: Starting main loop. Accepting connections.
CONNECT Jul 13 11:10:29.845 [1]: Connect (file descriptor 5): 10.0.35.4
CONNECT Jul 13 11:10:29.845 [1]: Request (file descriptor 5): CONNECT google.com:443 HTTP/1.1
INFO Jul 13 11:10:29.845 [1]: No upstream proxy for google.com
INFO Jul 13 11:10:29.845 [1]: opensock: opening connection to google.com:443
INFO Jul 13 11:10:29.955 [1]: opensock: getaddrinfo returned for google.com:443
CONNECT Jul 13 11:10:29.959 [1]: Established connection to host "google.com" using file descriptor 6.
INFO Jul 13 11:10:29.959 [1]: Not sending client headers to remote machine
INFO Jul 13 11:10:30.033 [1]: Closed connection between local client (fd:5) and remote client (fd:6)
```
- Curl:
```
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
HTTP/1.0 200 Connection established
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 220 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
Proxy-agent: tinyproxy/1.11.1
HTTP/2 301
location: https:xt/html; charset=UTF-8
content-security//www.google.com/
content-type: te-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-gEktpIC_xSqk9njjM0KANA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
date: Thu, 13 Jul 2023 11:10:29 GMT
expires: Thu, 13 Jul 2023 11:10:29 GMT
cache-control: private, max-age=2592000
server: gws
content-length: 220
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: CONSENT=PENDING+663; expires=Sat, 12-Jul-2025 11:10:29 GMT; path=/; domain=.google.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
```
## Upstream proxy example `(2-upstream.yml)`
### Source
> 🗄️ File: [2-upstream.yml](2-upstream.yml)
### Description
The upstream example contains another Swarmproxy instance as fake upstream proxy. The client connects to it's
configured Swarmproxy instance which forwards the query to the upstream.
### Usage
```bash
docker stack deploy -c 2-upstream.yml swarmproxy-upstream
```
### Container Logs
- Upstream
```
🦁 FILTER_FILE not found or set.
🦁 Final Swarmproxy config 🦁
3
Group 5123
8
Timeout 600
DefaultErrorFile "/usr/share/tinyproxy/default.html"
StatHost "tinyproxy.stats"
StatFile "/usr/share/tinyproxy/stats.html"
LogLevel Info
MaxClients 600
ViaProxyName "Swarmproxy"
Allow 127.0.0.1/8
Allow 10.0.0.0/8
🦁 Starting Tinyproxy...
args count: 3
args value: -c /app/proxy.conf -d
NOTICE Jul 13 11:18:50.279 [1]: Initializing tinyproxy ...
NOTICE Jul 13 11:18:50.279 [1]: Reloading config file
INFO Jul 13 11:18:50.279 [1]: Stathost set to "tinyproxy.stats"
INFO Jul 13 11:18:50.279 [1]: Setting "Via" header to 'Swarmproxy'
NOTICE Jul 13 11:18:50.279 [1]: Reloading config file finished
INFO Jul 13 11:18:50.279 [1]: listen_sock called with addr = '(NULL)'
INFO Jul 13 11:18:50.279 [1]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
INFO Jul 13 11:18:50.279 [1]: listening on fd [3]
INFO Jul 13 11:18:50.279 [1]: trying to listen on host[::], family[10], socktype[1], proto[6]
INFO Jul 13 11:18:50.279 [1]: listening on fd [4]
INFO Jul 13 11:18:50.279 [1]: Not running as root, so not changing UID/GID.
INFO Jul 13 11:18:50.279 [1]: Setting the various signals.
INFO Jul 13 11:18:50.279 [1]: Starting main loop. Accepting connections.
```
- Swarmproxy
```
🦁 FILTER_FILE not found or set.
🦁 Final Swarmproxy config 🦁
3
Group 5123
8
Timeout 600
DefaultErrorFile "/usr/share/tinyproxy/default.html"
StatHost "tinyproxy.stats"
StatFile "/usr/share/tinyproxy/stats.html"
LogLevel Info
MaxClients 600
ViaProxyName "Swarmproxy"
Allow 127.0.0.1/8
Allow 10.0.0.0/8
Upstream http upstream:8888
🦁 Starting Tinyproxy...
args count: 3
args value: -c /app/proxy.conf -d
NOTICE Jul 13 11:22:46.583 [1]: Initializing tinyproxy ...
NOTICE Jul 13 11:22:46.583 [1]: Reloading config file
INFO Jul 13 11:22:46.583 [1]: Stathost set to "tinyproxy.stats"
INFO Jul 13 11:22:46.583 [1]: Setting "Via" header to 'Swarmproxy'
INFO Jul 13 11:22:46.583 [1]: Added upstream http upstream:8888 for [default]
NOTICE Jul 13 11:22:46.583 [1]: Reloading config file finished
INFO Jul 13 11:22:46.583 [1]: listen_sock called with addr = '(NULL)'
INFO Jul 13 11:22:46.583 [1]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
INFO Jul 13 11:22:46.583 [1]: listening on fd [3]
INFO Jul 13 11:22:46.583 [1]: trying to listen on host[::], family[10], socktype[1], proto[6]
INFO Jul 13 11:22:46.583 [1]: listening on fd [4]
INFO Jul 13 11:22:46.583 [1]: Not running as root, so not changing UID/GID.
INFO Jul 13 11:22:46.583 [1]: Setting the various signals.
INFO Jul 13 11:22:46.583 [1]: Starting main loop. Accepting connections.
CONNECT Jul 13 11:23:02.916 [1]: Connect (file descriptor 5): 10.0.38.4
CONNECT Jul 13 11:23:02.916 [1]: Request (file descriptor 5): CONNECT google.com:443 HTTP/1.1
INFO Jul 13 11:23:02.916 [1]: Found upstream proxy http upstream:8888 for google.com
INFO Jul 13 11:23:02.916 [1]: opensock: opening connection to upstream:8888
INFO Jul 13 11:23:02.916 [1]: opensock: getaddrinfo returned for upstream:8888
CONNECT Jul 13 11:23:02.917 [1]: Established connection to upstream proxy "upstream" using file descriptor 6.
INFO Jul 13 11:23:03.182 [1]: Closed connection between local client (fd:5) and remote client (fd:6)
```
- Curl
```
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
HTTP/1.0 200 Connection established
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 220 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
Via: 1.1 Swarmproxy (tinyproxy/1.11.1)
Proxy-agent: tinyproxy/1.11.1
HTTP/2 301
location: https://www.google.com/
content-type: text/html; charset=UTF-8
content-security-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-g1lolRpzk2b93t4bhY80uA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
date: Thu, 13 Jul 2023 11:23:03 GMT
expires: Thu, 13 Jul 2023 11:23:03 GMT
cache-control: private, max-age=2592000
server: gws
content-length: 220
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: CONSENT=PENDING+481; expires=Sat, 12-Jul-2025 11:23:03 GMT; path=/; domain=.google.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
```
## Fullstack example with external secrets and config `(3-external.yml)`
### Source
> 🗄️ File: [3-upstream.yml](3-upstream.yml)
### Description
This stack is based on the previous upstream example. It's modified to show these additional features:
- Using external docker secret to set up an upstream proxy. Should be used when upstream needs authentication
- Mounting a docker config as filter file
- filtering queries by domains
- added curl-blocked service to show output if target domain is not in whitelist
### Usage
```bash
echo "google.com" | docker config create filter_file -
echo "upstream:8888" | docker secret create upstream-proxy -
docker stack deploy -c 1-minimal.yml swarmproxy-mini
```
### Container Logs
- Upstream
```
🦁 FILTER_FILE not found or set.
🦁 Final Swarmproxy config 🦁
3
Group 5123
8
Timeout 600
DefaultErrorFile "/usr/share/tinyproxy/default.html"
StatHost "tinyproxy.stats"
StatFile "/usr/share/tinyproxy/stats.html"
LogLevel Info
MaxClients 600
ViaProxyName "Swarmproxy"
Allow 127.0.0.1/8
Allow 10.0.0.0/8
🦁 Starting Tinyproxy...
args count: 3
args value: -c /app/proxy.conf -d
NOTICE Jul 13 11:37:47.554 [1]: Initializing tinyproxy ...
NOTICE Jul 13 11:37:47.554 [1]: Reloading config file
INFO Jul 13 11:37:47.554 [1]: Stathost set to "tinyproxy.stats"
INFO Jul 13 11:37:47.554 [1]: Setting "Via" header to 'Swarmproxy'
NOTICE Jul 13 11:37:47.554 [1]: Reloading config file finished
INFO Jul 13 11:37:47.554 [1]: listen_sock called with addr = '(NULL)'
INFO Jul 13 11:37:47.554 [1]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
INFO Jul 13 11:37:47.554 [1]: listening on fd [3]
INFO Jul 13 11:37:47.554 [1]: trying to listen on host[::], family[10], socktype[1], proto[6]
INFO Jul 13 11:37:47.554 [1]: listening on fd [4]
INFO Jul 13 11:37:47.554 [1]: Not running as root, so not changing UID/GID.
INFO Jul 13 11:37:47.554 [1]: Setting the various signals.
INFO Jul 13 11:37:47.554 [1]: Starting main loop. Accepting connections.
CONNECT Jul 13 11:38:22.698 [1]: Connect (file descriptor 5): 10.0.40.4
CONNECT Jul 13 11:38:22.699 [1]: Request (file descriptor 5): CONNECT google.com:443 HTTP/1.1
INFO Jul 13 11:38:22.699 [1]: No upstream proxy for google.com
INFO Jul 13 11:38:22.699 [1]: opensock: opening connection to google.com:443
INFO Jul 13 11:38:26.704 [1]: opensock: getaddrinfo returned for google.com:443
CONNECT Jul 13 11:38:26.708 [1]: Established connection to host "google.com" using file descriptor 6.
INFO Jul 13 11:38:26.708 [1]: Not sending client headers to remote machine
INFO Jul 13 11:38:26.785 [1]: Closed connection between local client (fd:5) and remote client (fd:6)
```
- Swarmproxy
```
🦁 Final Swarmproxy config 🦁

3
Group 5123

8
Timeout 600
DefaultErrorFile "/usr/share/tinyproxy/default.html"
StatHost "tinyproxy.stats"
StatFile "/usr/share/tinyproxy/stats.html"
LogLevel Info
MaxClients 600
ViaProxyName "Swarmproxy"
Allow 127.0.0.1/8
Allow 10.0.0.0/8
Upstream http upstream:8888
Filter "/app/filter"
FilterURLs Off
FilterCaseSensitive Off
FilterDefaultDeny Yes
🦁 Starting Tinyproxy...
args count: 3
args value: -c /app/proxy.conf -d
NOTICE Jul 13 11:37:57.704 [1]: Initializing tinyproxy ...
NOTICE Jul 13 11:37:57.704 [1]: Reloading config file
INFO Jul 13 11:37:57.704 [1]: Stathost set to "tinyproxy.stats"
INFO Jul 13 11:37:57.704 [1]: Setting "Via" header to 'Swarmproxy'
INFO Jul 13 11:37:57.704 [1]: Added upstream http upstream:8888 for [default]
NOTICE Jul 13 11:37:57.704 [1]: Reloading config file finished
INFO Jul 13 11:37:57.704 [1]: listen_sock called with addr = '(NULL)'
INFO Jul 13 11:37:57.704 [1]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
INFO Jul 13 11:37:57.704 [1]: listening on fd [3]
INFO Jul 13 11:37:57.704 [1]: trying to listen on host[::], family[10], socktype[1], proto[6]
INFO Jul 13 11:37:57.704 [1]: listening on fd [4]
INFO Jul 13 11:37:57.704 [1]: Not running as root, so not changing UID/GID.
INFO Jul 13 11:37:57.704 [1]: Setting the various signals.
INFO Jul 13 11:37:57.704 [1]: Starting main loop. Accepting connections.
CONNECT Jul 13 11:38:00.361 [1]: Connect (file descriptor 5): 10.0.39.4
CONNECT Jul 13 11:38:00.361 [1]: Request (file descriptor 5): CONNECT amazon.com:443 HTTP/1.1
NOTICE Jul 13 11:38:00.361 [1]: Proxying refused on filtered domain "amazon.com"
CONNECT Jul 13 11:38:14.022 [1]: Connect (file descriptor 5): 10.0.39.4
CONNECT Jul 13 11:38:14.022 [1]: Request (file descriptor 5): CONNECT amazon.com:443 HTTP/1.1
NOTICE Jul 13 11:38:14.022 [1]: Proxying refused on filtered domain "amazon.com"
CONNECT Jul 13 11:38:22.698 [1]: Connect (file descriptor 5): 10.0.39.4
CONNECT Jul 13 11:38:22.698 [1]: Request (file descriptor 5): CONNECT google.com:443 HTTP/1.1
INFO Jul 13 11:38:22.698 [1]: Found upstream proxy http upstream:8888 for google.com
INFO Jul 13 11:38:22.698 [1]: opensock: opening connection to upstream:8888
INFO Jul 13 11:38:22.698 [1]: opensock: getaddrinfo returned for upstream:8888
CONNECT Jul 13 11:38:22.698 [1]: Established connection to upstream proxy "upstream" using file descriptor 6.
CONNECT Jul 13 11:38:25.064 [1]: Connect (file descriptor 7): 10.0.39.4
CONNECT Jul 13 11:38:25.064 [1]: Request (file descriptor 7): CONNECT amazon.com:443 HTTP/1.1
NOTICE Jul 13 11:38:25.064 [1]: Proxying refused on filtered domain "amazon.com"
INFO Jul 13 11:38:26.785 [1]: Closed connection between local client (fd:5) and remote client (fd:6)
CONNECT Jul 13 11:38:36.285 [1]: Connect (file descriptor 5): 10.0.39.4
CONNECT Jul 13 11:38:36.285 [1]: Request (file descriptor 5): CONNECT amazon.com:443 HTTP/1.1
NOTICE Jul 13 11:38:36.285 [1]: Proxying refused on filtered domain "amazon.com"
```
- Curl
```
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
HTTP/1.0 200 Connection established
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- 0:00:02 --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- 0:00:03 --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- 0:00:04 --:--:-- 0
0 220 0 0 0 0 0 0 --:--:-- 0:00:04 --:--:-- 0
Via: 1.1 Swarmproxy (tinyproxy/1.11.1)
Proxy-agent: tinyproxy/1.11.1
HTTP/2 301
location: https://www.google.com/
content-type: text/html; charset=UTF-8
content-security-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-UGtC_QXXA9WxUVfYPZJkJA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
date: Thu, 13 Jul 2023 11:38:26 GMT
expires: Thu, 13 Jul 2023 11:38:26 GMT
cache-control: private, max-age=2592000
server: gws
content-length: 220
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: CONSENT=PENDING+670; expires=Sat, 12-Jul-2025 11:38:26 GMT; path=/; domain=.google.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
```
- Curl-blocked
```
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
HTTP/1.1 403 Filtered
curl: (56) CONNECT tunnel failed, response 403
Server: tinyproxy/1.11.1
Content-Type: text/html
Connection: close
```

12
renovate.json
View File

@ -1,12 +0,0 @@
{
"dependencyDashboard": true,
"docker": {
"enabled": true
},
"github-actions": {
"enabled": true,
"fileMatch": [
"^\\.gitea/workflows/[^/]+\\.ya?ml$"
]
}
}