prepare release (#23)

#### 📖 Summary

- update changelog

#### 📑 Test Plan

> 💡 Select your test plan for the code changes.

- [x] CI pipeline tests
- [ ] Custom test
- [ ] No test plan

##### Details / Justification

<!-- Add your test details or justification for missing tests here. -->

#### 📚 Additional Notes

<!-- A place for additional detail notes. -->

Reviewed-on: #23

.changelog.yml

@@ -0,0 +1,38 @@
+# The full repository name
+repo: OCram85/swarmproxy
+
+# Service type (gitea or github)
+service: gitea
+
+# Base URL for Gitea instance if using gitea service type (optional)
+# Default: https://gitea.com
+base-url: https://gitea.ocram85.com
+
+# Changelog groups and which labeled PRs to add to each group
+groups:
+  - name: 🐛 BUGFIXES
+    labels:
+      - bug
+  - name: ✨ FEATURES
+    labels:
+      - feature
+  - name: 🛠️ ENHANCEMENTS
+    labels:
+      - enhancement
+  - name: 📦 BUILD
+    labels:
+      - pipeline
+  - name: 🤖 DEPENDENCIES
+    labels:
+      - renovate
+  - name: 📚 DOCS
+    labels:
+      - docs
+  - name: ⚙️ META
+    labels:
+      - meta
+  - name: 🔖 MISC
+    default: true
+
+# regex indicating which labels to skip for the changelog
+skip-labels: skip-changelog|backport\/.+

.gitea/workflows/ci.yaml

@@ -20,7 +20,7 @@ jobs:
       -
         name: Docker meta
         id: meta
-        uses: actions/metadata-action@v4
+        uses: https://gitea.ocram85.com/actions/metadata-action@v5
         with:
           images: |
             gitea.ocram85.com/ocram85/swarmproxy
@@ -31,10 +31,10 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
       -
         name: Set up Docker Buildx
-        uses: actions/setup-buildx-action@v2
+        uses: https://gitea.ocram85.com/actions/setup-buildx-action@v3
       -
         name: Login to Gitea Package Registry
-        uses: actions/login-action@v2
+        uses: https://gitea.ocram85.com/actions/login-action@v3
         with:
           registry: gitea.ocram85.com
           username: ${{ secrets.USERNAME }}
@@ -42,7 +42,7 @@ jobs:
           password: ${{ secrets.TOKEN }}
       -
         name: Build and push
-        uses: actions/build-push-action@v4
+        uses: https://gitea.ocram85.com/actions/build-push-action@v6
         with:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}

.gitea/workflows/release.yaml

@@ -0,0 +1,27 @@
+name: release
+
+on:
+  push:
+    tags:
+      - '*'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://gitea.ocram85.com/actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: setup go
+        uses: https://gitea.ocram85.com/actions/setup-go@v3
+        with:
+          go-version: '>=1.20.1'
+      - name: Use Go Action
+        id: use-go-action
+        uses: https://gitea.ocram85.com/actions/release-action@main
+        with:
+          files: |-
+            CHANGELOG.md
+          api_key: '${{ secrets.TOKEN }}'
+          body: |
+            > :bulb: **Note:** See [CHANGELOG.md](src/branch/main/CHANGELOG.md) for recent changes.

.gitea/workflows/test.yaml

@@ -1,29 +0,0 @@
-name: test
-
-run-name: docker pipeline
-
-on: [ 'push' ]
-
-jobs:
-  docker:
-    runs-on: ubuntu-latest
-    container:
-      image: catthehacker/ubuntu:act-latest
-    steps:
-      -
-        name: Set up Docker Buildx
-        uses: actions/setup-buildx-action@v2
-      #-
-      #  name: Login to Gitea Package Registry
-      #  uses: actions/login-action@v2
-      #  with:
-      #    registry: gitea.ocram85.com
-      #    username: ${{ secrets.USERNAME }}
-      #    password: ${{ secrets.TOKEN }}
-      -
-        name: Build and push
-        uses: actions/build-push-action@v4
-        with:
-          push: false
-          #tags: gitea.ocram85.com/ocram85/swarmproxy:next
-          tags: ocram85/swarmproxy:test

.vscode/dictionaries/project-words.txt

@@ -1 +1,15 @@
+FOSS
+gitea
+Gitea
+LOGLEVEL
+MAXCLIENTS
+ocram
+Quickstart
+swarmproxy
+Swarmproxy
 tbd
+tinyproxy
+Tinyproxy
+TINYPROXY
+UID
+USR

.vscode/settings.json

@@ -65,6 +65,7 @@
       "path": "${workspaceRoot}/.vscode/dictionaries/project-words.txt",
       "description": "Words used in this project",
       "addWords": true
+
     },
     "custom": true
   }

.vscode/tasks.json

@@ -0,0 +1,37 @@
+{
+  "version": "2.0.0",
+  "tasks": [
+    {
+        "label": "Update GiteaChangelog",
+        "type": "shell",
+        "command": [
+          "mv 'CHANGELOG.md' 'CHANGELOG.back' &&",
+          "changelog -m '${input:Milestone}' --token '${input:GiteaToken}' -c .changelog.yml generate > CHANGELOG.md &&",
+          "echo '' >> CHANGELOG.md &&",
+          "cat CHANGELOG.back >> CHANGELOG.md &&",
+          "rm CHANGELOG.back"
+        ],
+        "problemMatcher": []
+    }
+  ],
+  "inputs": [
+    {
+        "id": "GiteaToken",
+        "type": "command",
+        "command": "shellCommand.execute",
+        "args": {
+          "command": "echo $GITEA_TOKEN",
+          "description": "Your personal Gitea access token"
+        }
+    },
+    {
+        "id": "Milestone",
+        "type": "command",
+        "command": "shellCommand.execute",
+        "args": {
+          "description": "Select or enter a open milestone",
+          "command": "tea milestone ls -f title --output simple"
+        }
+    }
+  ]
+}

CHANGELOG.md

@@ -0,0 +1,28 @@
+## [v0.1.1](https://gitea.ocram85.com/OCram85/swarmproxy/releases/tag/v0.1.1) - 2024-06-20
+
+* ✨ FEATURES
+  * Adds timezone support (#14)
+* 🤖 DEPENDENCIES
+  * Chore(deps): update actions/build-push-action action to v6 (#22)
+  * Chore(deps): update actions/setup-buildx-action action to v3 (#21)
+  * Chore(deps): update actions/metadata-action action to v5 (#20)
+  * Chore(deps): update actions/login-action action to v3 (#19)
+  * Chore(deps): update actions/checkout action to v4 (#18)
+  * Chore(deps): update alpine docker tag to v3.20.0 (#16)
+  * Update alpine Docker tag to v3.18.4 (#15)
+
+## [v0.1.0](https://gitea.ocram85.com/OCram85/swarmproxy/releases/tag/v0.1.0) - 2023-07-13
+
+* ✨ FEATURES
+  * Adds entrypoint (#6)
+  * Add first prototype implementation (#1)
+* 📦 BUILD
+  * Add gitea release action (#7)
+  * Finalize ci (#5)
+  * Setup basic action based ci (#3)
+* 🤖 DEPENDENCIES
+  * Use absolute urls for action calls (#10)
+  * Adds renovate support (#8)
+* ⚙️ META
+  * Add Readme content (#11)
+  * Adds initial readme (#4)

Dockerfile

@@ -1,6 +1,6 @@
-FROM alpine:3.18.2
+FROM alpine:3.20.0
 
-#LABEL build_version=""
+# Set labels manually, each build service differs in used or predefined labels.
 LABEL maintainer="OCram85"
 ARG VERSION
 LABEL build_version="${VERSION}"
@@ -17,8 +17,7 @@ LABEL org.opencontainers.image.url="https://gitea.ocram85.com/OCram85/swarmproxy
 LABEL org.opencontainers.image.source="https://gitea.ocram85.com/OCram85/swarmproxy.git"
 LABEL org.opencontainers.image.documentation="https://gitea.ocram85.com/OCram85/swarmproxy"
 
-# Use a custom UID/GID instead of the default system UID which has a greater possibility
+# Use a individual user and group ip for files and process
-# for collisions with the host and other containers.
 ENV TINYPROXY_UID 5123
 ENV TINYPROXY_GID 5123
 
@@ -28,46 +27,25 @@ ENV PORT "8888"
 ENV TIMEOUT "600"
 ENV LOGLEVEL "Info"
 ENV MAXCLIENTS "600"
-ENV FILTER_FILE "/etc/tinyproxy/filter"
+ENV FILTER_FILE "/app/filter"
 
-# Curl is for healthchecks.
+ENV TZ "Europe/Berlin"
+
+# get existing packages
+# curl for healthchecks and debugging
 RUN apk add --no-cache \
-      tinyproxy curl
+      tinyproxy curl tzdata
 
-RUN mv /etc/tinyproxy/tinyproxy.conf /etc/tinyproxy/tinyproxy.default.conf
+COPY entrypoint.sh /app/entrypoint.sh
 
-RUN <<EOF cat >> /etc/tinyproxy/tinyproxy.conf
+RUN touch /app/proxy.conf && \
-User $TINYPROXY_UID
+  chmod +x /app/entrypoint.sh && \
-Group $TINYPROXY_GID
+  chown -R ${TINYPROXY_UID}:${TINYPROXY_GID} /app /etc/tinyproxy /var/log/tinyproxy
-Port $PORT
-Timeout $TIMEOUT
-DefaultErrorFile "/usr/share/tinyproxy/default.html"
 
-StatHost "tinyproxy.stats"
-StatFile "/usr/share/tinyproxy/stats.html"
-
-LogLevel $LOGLEVEL
-MaxClients $MAXCLIENTS
-ViaProxyName "tinyproxy"
-
-Filter "$FILTER_FILE"
-FilterURLs Off
-FilterCaseSensitive Off
-FilterDefaultDeny Yes
-
-Allow 127.0.0.1/8
-Allow 10.0.0.0/8
-
-EOF
-
-RUN set -eu && \
-  CONFIG='/etc/tinyproxy/tinyproxy.conf' && \
-  [ -z "$UPSTREAM_PROXY_FILE" ] || export UPSTREAM_PROXY=$(cat $UPSTREAM_PROXY_FILE) && \
-  [ -z "$UPSTREAM_PROXY" ] || echo "upstream http $UPSTREAM_PROXY \".\"" >> "$CONFIG"
-
-RUN chown -R ${TINYPROXY_UID}:${TINYPROXY_GID} /etc/tinyproxy /var/log/tinyproxy
 USER ${TINYPROXY_UID}:${TINYPROXY_GID}
+WORKDIR /app
 
 EXPOSE 8888
 
-ENTRYPOINT ["/usr/bin/tinyproxy", "-d"]
+ENTRYPOINT ["/app/entrypoint.sh"]
+CMD ["-c", "/app/proxy.conf", "-d"]

README.md

@@ -6,78 +6,118 @@
 <p align="center">
   <a href="https://gitea.ocram85.com/OCram85/swarmproxy/">
     <img
-      src="/OCram85/swarmproxy/raw/branch/main/assets/social-logo.png"
+      src="assets/social-logo.png"
-      alt="swarmproxy"
+      alt="Swarmproxy - Tame your traffic"
     >
   </a>
 </p>
 
-<h1 align="center">
-  swarmproxy
-</h1>
-
 <p align="center">
-  Swarmproxy is a simple http/https proxy for outbound traffic in a docker swarm cluster.
+🦁 Swarmproxy is a simple http proxy to limit your outbound traffic.
 </p>
 
-## :book: About
+## 📖 About
 
-## 🤖 Quickstart
+Swarmproxy is a simply way to integrate a http proxy in your Docker swarm cluster or any other container network.
+It acts as an centralized proxy to limit your outbound / egress traffic. You can also add a whitelist filter to
+limit the allowed domains. There is also an option to use a upstream proxy.
+
+### What does Swarmproxy for you?
+
+Enterprise and production environments often face more stringent security requirements.
+Therefore, unfiltered Internet access may be prohibited.
+
+So Swarmproxy could help you with these features:
+
+- ✔️ Prevent direct web access from Container workload.
+- ✔️ Upstream proxy with or without authentication
+- ✔️ Optional domain based whitelist filter.
+
+### What does Swarmproxy not?
+
+Swarmproxy is just a supercharged Tinyproxy where you can point your container workload to.
+
+- ☣️ Swarmproxy does not block the web access or other traffic if you workload doesn't use a proxy
+- ☣️ It's not a firewall, thus it does not customize your iptables or any other firewall policies.
+
+## 🚀 Quickstart
 
 ### 1. ⚡ Get the image 📦
 
-You can download the image from the gitea embedded container registry: `gitea.ocram85.com/ocram85/swarmproxy` with these tags:
+You can download the image from the Gitea embedded container registry: `gitea.ocram85.com/ocram85/swarmproxy` with these tags:
 
-- `latest` - Is based on the lasted master branch commit.
+- `latest`, `main` - Is based on the lasted master branch commit.
-- `next` - Is a test build based on the pull request
 - `1`, `0.1`, `0.1.0` - tag based version.
 
-> **💡 NOTE: See the [packages page](https://gitea.ocram85.com/OCram85/-/packages/container/swarmproxy/latest) for latest version and all other available tags.**
+> **💡 NOTE: See the [packages page](https://gitea.ocram85.com/OCram85/-/packages/container/swarmproxy/latest)
+> for latest version and all other available tags.**
 
-### 2.a Run as Docker Swarm Stack
+### 2. 🛡️ Run as Docker Swarm Stack
+
+This example shows all available configuration keys / environment variables for Swarmproxy.
 
 ```yaml
 version: "3.8"
 
-secrets:
-  upstream-proxy:
-    external: true
-
-services:
-  swarmproxy:
-    image: gitea.ocram85.com/OCram85/swarmproxy:latest
-    environment:
-      # mandatory environment variables
-      - UPSTREAM_PROXY=
-      # Set UPSTREAM_PROXY as docker secret if your upstream needs authentication
-      # Eg.: http://user:password@upstream.intra:3128
-      #- UPSTREAM_PROXY_FILE=/run/secrets/UPSTREAM_PROXY
-
-      # optional settings
-      #- TINYPROXY_UID=5123
-      #- TINYPROXY_GID=5123
-      #- PORT=8888
-      #- TIMEOUT=600
-      #- LOGLEVEL=Info
-      #- MAXCLIENTS=600
-      #- FILTER_FILE=/ety/tinyproxy/filter
-    deploy:
-      replicas: 1
-    volumes:
-      # mount a single file into the container if you need the modify it afterwards
-      # You can reload the file with `kill -s USR1 $(pidof tinyproxy)`
-      - ./filter.txt:/etc/tinyproxy/filter:ro
-      # Use a docker config or volume in production
-      - 
-    networks:
-      - egress
-
 networks:
   egress:
    attachable: true
    #external: true
+
+#configs:
+#  filter_file:
+#    # config can be predefined / external or loaded from file
+#    #external: true
+#    file: ./filter.txt
+
+#secrets:
+#  upstream-proxy:
+#    external: true
+
+services:
+  swarmproxy:
+    # Do not use the `latest` tag in production!
+    image: gitea.ocram85.com/OCram85/swarmproxy:latest
+    deploy:
+      replicas: 1
+    #secrets:
+    #  - upstream-proxy
+    environment:
+      - LOGLEVEL=Info
+      # Recommended settings
+      # Use an optional upstream proxy
+      #- UPSTREAM_PROXY=
+      # Set UPSTREAM_PROXY as docker secret if your upstream needs authentication
+      # Eg.: http://user:password@upstream.intra:3128
+      #- UPSTREAM_PROXY_FILE=/run/secrets/UPSTREAM_PROXY
+
+      # OPTIONAL config keys
+      #- TINYPROXY_UID=5123
+      #- TINYPROXY_GID=5123
+      #- PORT=8888
+      #- TIMEOUT=600
+      #- MAXCLIENTS=600
+      #- FILTER_FILE=/app/filter
+    volumes:
+      # You can mount a single filter file into the container.
+      # To reload the file use the docker kill -s USR1 <container_id| container_name> command.
+      # - ./filter.txt:/app/filter:ro
+    #configs:
+    #  - source: filter_file
+    #    target: /app/filter
+    networks:
+      egress:
+        aliases:
+          - swarmproxy
+          - proxy
 ```
 
+## 🚀 Examples
+
+See the [Readme](examples/) docs in the examples folder...
+
+## 💣 Known Issues
+
 ## 😡 We're Using GitHub Under Protest
 
 This project is currently **mirrored** to GitHub. This is not ideal; GitHub is a
@@ -103,11 +143,11 @@ code in Copilot.
 
 ## 🙏 Credits
 
-swarmproxy is based on the following projects and wouldn't be possible without them:
+Swarmproxy is based on the following projects and wouldn't be possible without them:
 
 - [Tinyproxy](https://github.com/tinyproxy/tinyproxy) - The Tinyproxy project itself
-- [docker-tinyproxy](https://github.com/kalaksi/docker-tinyproxy) - A containerized tinyproxy variant.
+- [docker-tinyproxy](https://github.com/kalaksi/docker-tinyproxy) - A containerized Tinyproxy variant.
-- [docker-tinyproxy](https://github.com/ajoergensen/docker-tinyproxy) - A containerized tinyproxy variant.
+- [docker-tinyproxy](https://github.com/ajoergensen/docker-tinyproxy) - A containerized Tinyproxy variant.
 
 ## ⚖️ License (AGPLv3)
 

entrypoint.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env sh
+
+set -e
+
+CONFIG="/app/proxy.conf"
+
+function writeConfig() {
+    cat << EOF >> "$CONFIG"
+User $TINYPROXY_UID
+Group $TINYPROXY_GID
+Port $PORT
+Timeout $TIMEOUT
+DefaultErrorFile "/usr/share/tinyproxy/default.html"
+
+StatHost "tinyproxy.stats"
+StatFile "/usr/share/tinyproxy/stats.html"
+
+LogLevel $LOGLEVEL
+MaxClients $MAXCLIENTS
+ViaProxyName "Swarmproxy"
+
+Allow 127.0.0.1/8
+Allow 10.0.0.0/8
+
+EOF
+}
+
+function addUpstreamConfig() {
+  [ -z "$UPSTREAM_PROXY_FILE" ] || export UPSTREAM_PROXY=$(cat $UPSTREAM_PROXY_FILE)
+  [ -z "$UPSTREAM_PROXY" ] || echo "Upstream http $UPSTREAM_PROXY " >> "$CONFIG"
+}
+
+function addFilterConfig() {
+  if [ -f "$FILTER_FILE" ]; then
+    cat << FBLOCK >> "$CONFIG"
+Filter "$FILTER_FILE"
+FilterURLs Off
+FilterCaseSensitive Off
+FilterDefaultDeny Yes
+FBLOCK
+  else
+    echo "🦁 FILTER_FILE not found or set."
+  fi
+}
+
+function showConfig() {
+  echo "🦁 Final Swarmproxy config 🦁"
+  cat "$CONFIG"
+}
+
+function execTinyproxy() {
+  echo "🦁 Starting Tinyproxy..."
+  echo "args count: $#"
+  echo "args value: $@"
+  exec "/usr/bin/tinyproxy" "$@"
+}
+
+function main() {
+  writeConfig
+  addUpstreamConfig
+  addFilterConfig
+  showConfig
+  execTinyproxy $@
+}
+
+main $@
+echo "entrypoint end. 🚀"

examples/1-minimal.yml

@@ -0,0 +1,35 @@
+version: "3.8"
+
+networks:
+  egress:
+   attachable: true
+  backend:
+    internal: true
+
+services:
+  swarmproxy:
+    image: gitea.ocram85.com/ocram85/swarmproxy:latest
+    deploy:
+      replicas: 1
+    environment:
+      - LOGLEVEL=Info
+    networks:
+      egress:
+        aliases:
+          - proxy
+
+  curl:
+    image: curlimages/curl:8.1.2
+    command: ["-I", "-x", "proxy:8888", "https://google.com"]
+    depends_on:
+      - swarmproxy
+    deploy:
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+        delay: 10s
+        max_attempts: 5
+        window: 120s
+    networks:
+      - backend
+      - egress

examples/2-upstream.yml

@@ -0,0 +1,64 @@
+version: "3.8"
+
+# Setting up 3 default networks to act as dummy:
+# - backend : internal only network
+# - dmz : dmz network with connections allowed from internal and external
+# - egress : dummy egress zone with fake upstream proxy
+networks:
+  egress:
+   attachable: true
+  dmz:
+    attachable: true
+  backend:
+    internal: true
+
+services:
+  # Creating a fake upstream proxy
+  upstream:
+    image: gitea.ocram85.com/ocram85/swarmproxy:latest
+    deploy:
+      replicas: 1
+    environment:
+      - LOGLEVEL=Info
+    networks:
+      egress:
+        aliases:
+          - upstream
+
+  # Creating our swarmproxy instance to use the external upstream proxy
+  swarmproxy:
+    # Do not use the `latest` tag in production!
+    image: gitea.ocram85.com/ocram85/swarmproxy:latest
+    depends_on:
+      - upstream
+    deploy:
+      replicas: 1
+    environment:
+      - LOGLEVEL=Info
+      - UPSTREAM_PROXY=upstream:8888
+    networks:
+      dmz:
+        aliases:
+          - swarmproxy
+          - proxy
+      egress:
+
+  # container workload example which tries to communicate through our swarmproxy instance
+  # http request / response:
+  # [curl container] <---|req/res|---> [swarmproxy] <---|req/res|---> [upstream] <---|req/res|---> [target]
+  curl:
+    image: curlimages/curl:8.1.2
+    command: ["-I", "-x", "proxy:8888", "https://google.com"]
+    depends_on:
+      - upstream
+      - swarmproxy
+    deploy:
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+        delay: 10s
+        max_attempts: 5
+        window: 120s
+    networks:
+      - backend
+      - dmz

examples/3-external.yml

@@ -0,0 +1,101 @@
+version: "3.8"
+
+# IMPORTANT: Run the following command to add the required filter config file:
+# echo "google.com" | docker config create filter_file -
+configs:
+  filter_file:
+    external: true
+
+# IMPORTANT: Run the following command to add the required filter config file:
+# echo "upstream:8888" | docker secret create upstream-proxy -
+secrets:
+  upstream-proxy:
+    external: true
+
+# Setting up 3 default networks to act as dummy:
+# - backend : internal only network
+# - dmz : dmz network with connections allowed from internal and external
+# - egress : dummy egress zone with fake upstream proxy
+networks:
+  egress:
+   attachable: true
+  dmz:
+    attachable: true
+  backend:
+    internal: true
+
+services:
+  # Creating a fake upstream proxy
+  upstream:
+    image: gitea.ocram85.com/ocram85/swarmproxy:latest
+    deploy:
+      replicas: 1
+    environment:
+      - LOGLEVEL=Info
+    networks:
+      egress:
+        aliases:
+          - upstream
+
+  # Creating our swarmproxy instance to use the external upstream proxy
+  swarmproxy:
+    # Do not use the `latest` tag in production!
+    image: gitea.ocram85.com/ocram85/swarmproxy:latest
+    depends_on:
+      - upstream
+    deploy:
+      replicas: 1
+    environment:
+      - LOGLEVEL=Info
+      #- UPSTREAM_PROXY=upstream:8888
+      - UPSTREAM_PROXY_FILE=/run/secrets/upstream-proxy
+      - FILTER_FILE=/app/filter
+    configs:
+      - source: filter_file
+        target: /app/filter
+    secrets:
+      - upstream-proxy
+    networks:
+      dmz:
+        aliases:
+          - swarmproxy
+          - proxy
+      egress:
+
+  # container workload example whicht tries to communicate through our swarmproxy instance
+  # http request / response:
+  # [curl container] <---|req/res|---> [swarmproxy] <---|req/res|---> [upstream] <---|req/res|---> [target]
+  curl:
+    image: curlimages/curl:8.1.2
+    command: ["-I", "-x", "proxy:8888", "https://google.com"]
+    depends_on:
+      - upstream
+      - swarmproxy
+    deploy:
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+        delay: 10s
+        max_attempts: 5
+        window: 120s
+    networks:
+      - backend
+      - dmz
+
+  # Example for blocked request if there is no matching domain in the filter file.
+  curl-blocked:
+    image: curlimages/curl:8.1.2
+    command: ["-I", "-x", "proxy:8888", "https://amazon.com"]
+    depends_on:
+      - upstream
+      - swarmproxy
+    deploy:
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+        delay: 10s
+        max_attempts: 5
+        window: 120s
+    networks:
+      - backend
+      - dmz

examples/Readme.md

@@ -0,0 +1,407 @@
+---
+gitea: none
+include_toc: true
+---
+
+# 📘 Examples
+
+This folder contains some examples you can use to start building your Swarmproxy stack.
+
+## Basic example `(1-minimal.yml)`
+
+### Source
+
+> 🗄️ File: [1-minimal.yml](1-minimal.yml)
+
+### Description
+
+This is the mos basic example. It contains the Swarmproxy service and curl als helper. Just deploy the stack and
+inspect the logs form the containers.
+
+### Usage
+
+```bash
+docker stack deploy -c 1-minimal.yml swarmproxy-mini
+```
+
+### Container Logs
+
+- Swarmproxy:
+
+```
+🦁 FILTER_FILE not found or set.
+🦁 Final Swarmproxy config 🦁
+
+3
+Group 5123
+
+8
+Timeout 600
+DefaultErrorFile "/usr/share/tinyproxy/default.html"
+StatHost "tinyproxy.stats"
+StatFile "/usr/share/tinyproxy/stats.html"
+LogLevel Info
+MaxClients 600
+ViaProxyName "Swarmproxy"
+Allow 127.0.0.1/8
+Allow 10.0.0.0/8
+🦁 Starting Tinyproxy...
+args count: 3
+args value: -c /app/proxy.conf -d
+NOTICE    Jul 13 11:10:23.360 [1]: Initializing tinyproxy ...
+NOTICE    Jul 13 11:10:23.360 [1]: Reloading config file
+INFO      Jul 13 11:10:23.360 [1]: Stathost set to "tinyproxy.stats"
+INFO      Jul 13 11:10:23.360 [1]: Setting "Via" header to 'Swarmproxy'
+NOTICE    Jul 13 11:10:23.360 [1]: Reloading config file finished
+INFO      Jul 13 11:10:23.360 [1]: listen_sock called with addr = '(NULL)'
+INFO      Jul 13 11:10:23.360 [1]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
+INFO      Jul 13 11:10:23.360 [1]: listening on fd [3]
+INFO      Jul 13 11:10:23.360 [1]: trying to listen on host[::], family[10], socktype[1], proto[6]
+INFO      Jul 13 11:10:23.360 [1]: listening on fd [4]
+INFO      Jul 13 11:10:23.360 [1]: Not running as root, so not changing UID/GID.
+INFO      Jul 13 11:10:23.360 [1]: Setting the various signals.
+INFO      Jul 13 11:10:23.360 [1]: Starting main loop. Accepting connections.
+CONNECT   Jul 13 11:10:29.845 [1]: Connect (file descriptor 5): 10.0.35.4
+CONNECT   Jul 13 11:10:29.845 [1]: Request (file descriptor 5): CONNECT google.com:443 HTTP/1.1
+INFO      Jul 13 11:10:29.845 [1]: No upstream proxy for google.com
+INFO      Jul 13 11:10:29.845 [1]: opensock: opening connection to google.com:443
+INFO      Jul 13 11:10:29.955 [1]: opensock: getaddrinfo returned for google.com:443
+CONNECT   Jul 13 11:10:29.959 [1]: Established connection to host "google.com" using file descriptor 6.
+INFO      Jul 13 11:10:29.959 [1]: Not sending client headers to remote machine
+INFO      Jul 13 11:10:30.033 [1]: Closed connection between local client (fd:5) and remote client (fd:6)
+```
+
+- Curl:
+
+```
+  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                 Dload  Upload   Total   Spent    Left  Speed
+HTTP/1.0 200 Connection established
+
+  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+  0   220    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+Proxy-agent: tinyproxy/1.11.1
+
+HTTP/2 301
+location: https:xt/html; charset=UTF-8
+content-security//www.google.com/
+content-type: te-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-gEktpIC_xSqk9njjM0KANA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
+date: Thu, 13 Jul 2023 11:10:29 GMT
+expires: Thu, 13 Jul 2023 11:10:29 GMT
+cache-control: private, max-age=2592000
+
+server: gws
+content-length: 220
+x-xss-protection: 0
+x-frame-options: SAMEORIGIN
+set-cookie: CONSENT=PENDING+663; expires=Sat, 12-Jul-2025 11:10:29 GMT; path=/; domain=.google.com; Secure
+p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
+alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
+```
+
+## Upstream proxy example `(2-upstream.yml)`
+
+### Source
+
+> 🗄️ File: [2-upstream.yml](2-upstream.yml)
+
+### Description
+
+The upstream example contains another Swarmproxy instance as fake upstream proxy. The client connects to it's
+configured Swarmproxy instance which forwards the query to the upstream.
+
+### Usage
+
+```bash
+docker stack deploy -c 2-upstream.yml swarmproxy-upstream
+```
+
+### Container Logs
+
+- Upstream
+
+```
+🦁 FILTER_FILE not found or set.
+🦁 Final Swarmproxy config 🦁
+
+3
+Group 5123
+8
+Timeout 600
+DefaultErrorFile "/usr/share/tinyproxy/default.html"
+StatHost "tinyproxy.stats"
+StatFile "/usr/share/tinyproxy/stats.html"
+LogLevel Info
+MaxClients 600
+ViaProxyName "Swarmproxy"
+Allow 127.0.0.1/8
+Allow 10.0.0.0/8
+🦁 Starting Tinyproxy...
+args count: 3
+args value: -c /app/proxy.conf -d
+NOTICE    Jul 13 11:18:50.279 [1]: Initializing tinyproxy ...
+NOTICE    Jul 13 11:18:50.279 [1]: Reloading config file
+INFO      Jul 13 11:18:50.279 [1]: Stathost set to "tinyproxy.stats"
+INFO      Jul 13 11:18:50.279 [1]: Setting "Via" header to 'Swarmproxy'
+NOTICE    Jul 13 11:18:50.279 [1]: Reloading config file finished
+INFO      Jul 13 11:18:50.279 [1]: listen_sock called with addr = '(NULL)'
+INFO      Jul 13 11:18:50.279 [1]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
+INFO      Jul 13 11:18:50.279 [1]: listening on fd [3]
+INFO      Jul 13 11:18:50.279 [1]: trying to listen on host[::], family[10], socktype[1], proto[6]
+INFO      Jul 13 11:18:50.279 [1]: listening on fd [4]
+INFO      Jul 13 11:18:50.279 [1]: Not running as root, so not changing UID/GID.
+INFO      Jul 13 11:18:50.279 [1]: Setting the various signals.
+INFO      Jul 13 11:18:50.279 [1]: Starting main loop. Accepting connections.
+```
+
+- Swarmproxy
+
+```
+🦁 FILTER_FILE not found or set.
+🦁 Final Swarmproxy config 🦁
+3
+Group 5123
+8
+Timeout 600
+DefaultErrorFile "/usr/share/tinyproxy/default.html"
+StatHost "tinyproxy.stats"
+StatFile "/usr/share/tinyproxy/stats.html"
+LogLevel Info
+MaxClients 600
+ViaProxyName "Swarmproxy"
+Allow 127.0.0.1/8
+Allow 10.0.0.0/8
+Upstream http upstream:8888
+🦁 Starting Tinyproxy...
+args count: 3
+args value: -c /app/proxy.conf -d
+NOTICE    Jul 13 11:22:46.583 [1]: Initializing tinyproxy ...
+NOTICE    Jul 13 11:22:46.583 [1]: Reloading config file
+INFO      Jul 13 11:22:46.583 [1]: Stathost set to "tinyproxy.stats"
+INFO      Jul 13 11:22:46.583 [1]: Setting "Via" header to 'Swarmproxy'
+INFO      Jul 13 11:22:46.583 [1]: Added upstream http upstream:8888 for [default]
+NOTICE    Jul 13 11:22:46.583 [1]: Reloading config file finished
+INFO      Jul 13 11:22:46.583 [1]: listen_sock called with addr = '(NULL)'
+INFO      Jul 13 11:22:46.583 [1]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
+INFO      Jul 13 11:22:46.583 [1]: listening on fd [3]
+INFO      Jul 13 11:22:46.583 [1]: trying to listen on host[::], family[10], socktype[1], proto[6]
+INFO      Jul 13 11:22:46.583 [1]: listening on fd [4]
+INFO      Jul 13 11:22:46.583 [1]: Not running as root, so not changing UID/GID.
+INFO      Jul 13 11:22:46.583 [1]: Setting the various signals.
+INFO      Jul 13 11:22:46.583 [1]: Starting main loop. Accepting connections.
+CONNECT   Jul 13 11:23:02.916 [1]: Connect (file descriptor 5): 10.0.38.4
+CONNECT   Jul 13 11:23:02.916 [1]: Request (file descriptor 5): CONNECT google.com:443 HTTP/1.1
+INFO      Jul 13 11:23:02.916 [1]: Found upstream proxy http upstream:8888 for google.com
+INFO      Jul 13 11:23:02.916 [1]: opensock: opening connection to upstream:8888
+INFO      Jul 13 11:23:02.916 [1]: opensock: getaddrinfo returned for upstream:8888
+CONNECT   Jul 13 11:23:02.917 [1]: Established connection to upstream proxy "upstream" using file descriptor 6.
+INFO      Jul 13 11:23:03.182 [1]: Closed connection between local client (fd:5) and remote client (fd:6)
+```
+
+- Curl
+
+```
+  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                 Dload  Upload   Total   Spent    Left  Speed
+HTTP/1.0 200 Connection established
+
+  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+  0   220    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+Via: 1.1 Swarmproxy (tinyproxy/1.11.1)
+Proxy-agent: tinyproxy/1.11.1
+
+HTTP/2 301
+location: https://www.google.com/
+content-type: text/html; charset=UTF-8
+content-security-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-g1lolRpzk2b93t4bhY80uA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
+date: Thu, 13 Jul 2023 11:23:03 GMT
+expires: Thu, 13 Jul 2023 11:23:03 GMT
+cache-control: private, max-age=2592000
+
+server: gws
+content-length: 220
+x-xss-protection: 0
+x-frame-options: SAMEORIGIN
+set-cookie: CONSENT=PENDING+481; expires=Sat, 12-Jul-2025 11:23:03 GMT; path=/; domain=.google.com; Secure
+p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
+alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
+```
+
+## Fullstack example with external secrets and config `(3-external.yml)`
+
+### Source
+
+> 🗄️ File: [3-upstream.yml](3-upstream.yml)
+
+### Description
+
+This stack is based on the previous upstream example. It's modified to show these additional features:
+
+- Using external docker secret to set up an upstream proxy. Should be used when upstream needs authentication
+- Mounting a docker config as filter file
+- filtering queries by domains
+- added curl-blocked service to show output if target domain is not in whitelist
+
+### Usage
+
+```bash
+echo "google.com" | docker config create filter_file -
+echo "upstream:8888" | docker secret create upstream-proxy -
+docker stack deploy -c 1-minimal.yml swarmproxy-mini
+```
+
+### Container Logs
+
+- Upstream
+
+```
+🦁 FILTER_FILE not found or set.
+🦁 Final Swarmproxy config 🦁
+
+3
+Group 5123
+
+8
+Timeout 600
+DefaultErrorFile "/usr/share/tinyproxy/default.html"
+StatHost "tinyproxy.stats"
+StatFile "/usr/share/tinyproxy/stats.html"
+LogLevel Info
+MaxClients 600
+ViaProxyName "Swarmproxy"
+Allow 127.0.0.1/8
+Allow 10.0.0.0/8
+🦁 Starting Tinyproxy...
+args count: 3
+args value: -c /app/proxy.conf -d
+NOTICE    Jul 13 11:37:47.554 [1]: Initializing tinyproxy ...
+NOTICE    Jul 13 11:37:47.554 [1]: Reloading config file
+INFO      Jul 13 11:37:47.554 [1]: Stathost set to "tinyproxy.stats"
+INFO      Jul 13 11:37:47.554 [1]: Setting "Via" header to 'Swarmproxy'
+NOTICE    Jul 13 11:37:47.554 [1]: Reloading config file finished
+INFO      Jul 13 11:37:47.554 [1]: listen_sock called with addr = '(NULL)'
+INFO      Jul 13 11:37:47.554 [1]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
+INFO      Jul 13 11:37:47.554 [1]: listening on fd [3]
+INFO      Jul 13 11:37:47.554 [1]: trying to listen on host[::], family[10], socktype[1], proto[6]
+INFO      Jul 13 11:37:47.554 [1]: listening on fd [4]
+INFO      Jul 13 11:37:47.554 [1]: Not running as root, so not changing UID/GID.
+INFO      Jul 13 11:37:47.554 [1]: Setting the various signals.
+INFO      Jul 13 11:37:47.554 [1]: Starting main loop. Accepting connections.
+CONNECT   Jul 13 11:38:22.698 [1]: Connect (file descriptor 5): 10.0.40.4
+CONNECT   Jul 13 11:38:22.699 [1]: Request (file descriptor 5): CONNECT google.com:443 HTTP/1.1
+INFO      Jul 13 11:38:22.699 [1]: No upstream proxy for google.com
+INFO      Jul 13 11:38:22.699 [1]: opensock: opening connection to google.com:443
+INFO      Jul 13 11:38:26.704 [1]: opensock: getaddrinfo returned for google.com:443
+CONNECT   Jul 13 11:38:26.708 [1]: Established connection to host "google.com" using file descriptor 6.
+INFO      Jul 13 11:38:26.708 [1]: Not sending client headers to remote machine
+INFO      Jul 13 11:38:26.785 [1]: Closed connection between local client (fd:5) and remote client (fd:6)
+```
+
+- Swarmproxy
+
+```
+🦁 Final Swarmproxy config 🦁
+

+3
+Group 5123
+

+8
+Timeout 600
+DefaultErrorFile "/usr/share/tinyproxy/default.html"
+StatHost "tinyproxy.stats"
+StatFile "/usr/share/tinyproxy/stats.html"
+LogLevel Info
+MaxClients 600
+ViaProxyName "Swarmproxy"
+Allow 127.0.0.1/8
+Allow 10.0.0.0/8
+Upstream http upstream:8888
+Filter "/app/filter"
+FilterURLs Off
+FilterCaseSensitive Off
+FilterDefaultDeny Yes
+🦁 Starting Tinyproxy...
+args count: 3
+args value: -c /app/proxy.conf -d
+NOTICE    Jul 13 11:37:57.704 [1]: Initializing tinyproxy ...
+NOTICE    Jul 13 11:37:57.704 [1]: Reloading config file
+INFO      Jul 13 11:37:57.704 [1]: Stathost set to "tinyproxy.stats"
+INFO      Jul 13 11:37:57.704 [1]: Setting "Via" header to 'Swarmproxy'
+INFO      Jul 13 11:37:57.704 [1]: Added upstream http upstream:8888 for [default]
+NOTICE    Jul 13 11:37:57.704 [1]: Reloading config file finished
+INFO      Jul 13 11:37:57.704 [1]: listen_sock called with addr = '(NULL)'
+INFO      Jul 13 11:37:57.704 [1]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
+INFO      Jul 13 11:37:57.704 [1]: listening on fd [3]
+INFO      Jul 13 11:37:57.704 [1]: trying to listen on host[::], family[10], socktype[1], proto[6]
+INFO      Jul 13 11:37:57.704 [1]: listening on fd [4]
+INFO      Jul 13 11:37:57.704 [1]: Not running as root, so not changing UID/GID.
+INFO      Jul 13 11:37:57.704 [1]: Setting the various signals.
+INFO      Jul 13 11:37:57.704 [1]: Starting main loop. Accepting connections.
+CONNECT   Jul 13 11:38:00.361 [1]: Connect (file descriptor 5): 10.0.39.4
+CONNECT   Jul 13 11:38:00.361 [1]: Request (file descriptor 5): CONNECT amazon.com:443 HTTP/1.1
+NOTICE    Jul 13 11:38:00.361 [1]: Proxying refused on filtered domain "amazon.com"
+CONNECT   Jul 13 11:38:14.022 [1]: Connect (file descriptor 5): 10.0.39.4
+CONNECT   Jul 13 11:38:14.022 [1]: Request (file descriptor 5): CONNECT amazon.com:443 HTTP/1.1
+NOTICE    Jul 13 11:38:14.022 [1]: Proxying refused on filtered domain "amazon.com"
+CONNECT   Jul 13 11:38:22.698 [1]: Connect (file descriptor 5): 10.0.39.4
+CONNECT   Jul 13 11:38:22.698 [1]: Request (file descriptor 5): CONNECT google.com:443 HTTP/1.1
+INFO      Jul 13 11:38:22.698 [1]: Found upstream proxy http upstream:8888 for google.com
+INFO      Jul 13 11:38:22.698 [1]: opensock: opening connection to upstream:8888
+INFO      Jul 13 11:38:22.698 [1]: opensock: getaddrinfo returned for upstream:8888
+CONNECT   Jul 13 11:38:22.698 [1]: Established connection to upstream proxy "upstream" using file descriptor 6.
+CONNECT   Jul 13 11:38:25.064 [1]: Connect (file descriptor 7): 10.0.39.4
+CONNECT   Jul 13 11:38:25.064 [1]: Request (file descriptor 7): CONNECT amazon.com:443 HTTP/1.1
+NOTICE    Jul 13 11:38:25.064 [1]: Proxying refused on filtered domain "amazon.com"
+INFO      Jul 13 11:38:26.785 [1]: Closed connection between local client (fd:5) and remote client (fd:6)
+CONNECT   Jul 13 11:38:36.285 [1]: Connect (file descriptor 5): 10.0.39.4
+CONNECT   Jul 13 11:38:36.285 [1]: Request (file descriptor 5): CONNECT amazon.com:443 HTTP/1.1
+NOTICE    Jul 13 11:38:36.285 [1]: Proxying refused on filtered domain "amazon.com"
+```
+
+- Curl
+
+```
+  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                 Dload  Upload   Total   Spent    Left  Speed
+HTTP/1.0 200 Connection established
+
+  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+  0     0    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0
+  0     0    0     0    0     0      0      0 --:--:--  0:00:02 --:--:--     0
+  0     0    0     0    0     0      0      0 --:--:--  0:00:03 --:--:--     0
+  0     0    0     0    0     0      0      0 --:--:--  0:00:04 --:--:--     0
+  0   220    0     0    0     0      0      0 --:--:--  0:00:04 --:--:--     0
+Via: 1.1 Swarmproxy (tinyproxy/1.11.1)
+Proxy-agent: tinyproxy/1.11.1
+
+HTTP/2 301
+location: https://www.google.com/
+content-type: text/html; charset=UTF-8
+content-security-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-UGtC_QXXA9WxUVfYPZJkJA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
+date: Thu, 13 Jul 2023 11:38:26 GMT
+expires: Thu, 13 Jul 2023 11:38:26 GMT
+cache-control: private, max-age=2592000
+
+server: gws
+content-length: 220
+x-xss-protection: 0
+x-frame-options: SAMEORIGIN
+set-cookie: CONSENT=PENDING+670; expires=Sat, 12-Jul-2025 11:38:26 GMT; path=/; domain=.google.com; Secure
+p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
+alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
+```
+
+- Curl-blocked
+
+```
+  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                 Dload  Upload   Total   Spent    Left  Speed
+
+  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+HTTP/1.1 403 Filtered
+curl: (56) CONNECT tunnel failed, response 403
+Server: tinyproxy/1.11.1
+Content-Type: text/html
+Connection: close
+```

renovate.json

@@ -0,0 +1,12 @@
+{
+  "dependencyDashboard": true,
+  "docker": {
+    "enabled": true
+  },
+  "github-actions": {
+    "enabled": true,
+    "fileMatch": [
+      "^\\.gitea/workflows/[^/]+\\.ya?ml$"
+    ]
+  }
+}