Update alpine Docker tag to v3.18.4 (#15)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| alpine | final | patch | `3.18.2` -> `3.18.4` |

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC40MC4yIiwidXBkYXRlZEluVmVyIjoiMzQuNDAuMiJ9-->

Reviewed-on: #15
Co-authored-by: renovate-bot <renovate@ocram85.com>
Co-committed-by: renovate-bot <renovate@ocram85.com>

.gitea/workflows/ci.yaml

@@ -20,7 +20,7 @@ jobs:
       -
         name: Docker meta
         id: meta
-        uses: actions/metadata-action@v4
+        uses: https://gitea.ocram85.com/actions/metadata-action@v4
         with:
           images: |
             gitea.ocram85.com/ocram85/swarmproxy
@@ -31,10 +31,10 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
       -
         name: Set up Docker Buildx
-        uses: actions/setup-buildx-action@v2
+        uses: https://gitea.ocram85.com/actions/setup-buildx-action@v2
       -
         name: Login to Gitea Package Registry
-        uses: actions/login-action@v2
+        uses: https://gitea.ocram85.com/actions/login-action@v2
         with:
           registry: gitea.ocram85.com
           username: ${{ secrets.USERNAME }}
@@ -42,7 +42,7 @@ jobs:
           password: ${{ secrets.TOKEN }}
       -
         name: Build and push
-        uses: actions/build-push-action@v4
+        uses: https://gitea.ocram85.com/actions/build-push-action@v4
         with:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}

.gitea/workflows/release.yaml

@@ -9,16 +9,16 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: https://gitea.ocram85.com/actions/checkout@v3
         with:
           fetch-depth: 0
       - name: setup go
-        uses: actions/setup-go@v3
+        uses: https://gitea.ocram85.com/actions/setup-go@v3
         with:
           go-version: '>=1.20.1'
       - name: Use Go Action
         id: use-go-action
-        uses: actions/release-action@main
+        uses: https://gitea.ocram85.com/actions/release-action@main
         with:
           files: |-
             CHANGELOG.md

.vscode/dictionaries/project-words.txt

@@ -1 +1,15 @@
+FOSS
+gitea
+Gitea
+LOGLEVEL
+MAXCLIENTS
+ocram
+Quickstart
+swarmproxy
+Swarmproxy
 tbd
+tinyproxy
+Tinyproxy
+TINYPROXY
+UID
+USR

.vscode/settings.json

@@ -65,6 +65,7 @@
       "path": "${workspaceRoot}/.vscode/dictionaries/project-words.txt",
       "description": "Words used in this project",
       "addWords": true
+
     },
     "custom": true
   }

CHANGELOG.md

@@ -1,4 +1,4 @@
-## [v0.1.0](https://gitea.ocram85.com/OCram85/swarmproxy/releases/tag/v0.1.0) - 2023-07-12
+## [v0.1.0](https://gitea.ocram85.com/OCram85/swarmproxy/releases/tag/v0.1.0) - 2023-07-13
 
 * ✨ FEATURES
   * Adds entrypoint (#6)
@@ -6,3 +6,10 @@
 * 📦 BUILD
   * Add gitea release action (#7)
   * Finalize ci (#5)
+  * Setup basic action based ci (#3)
+* 🤖 DEPENDENCIES
+  * Use absolute urls for action calls (#10)
+  * Adds renovate support (#8)
+* ⚙️ META
+  * Add Readme content (#11)
+  * Adds initial readme (#4)

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.18.2
+FROM alpine:3.18.4
 
 # Set labels manually, each build service differs in used or predefined labels.
 LABEL maintainer="OCram85"
@@ -29,11 +29,12 @@ ENV LOGLEVEL "Info"
 ENV MAXCLIENTS "600"
 ENV FILTER_FILE "/app/filter"
 
+ENV TZ "Europe/Berlin"
 
 # get existing packages
 # curl for healthchecks and debugging
 RUN apk add --no-cache \
-      tinyproxy curl
+      tinyproxy curl tzdata
 
 COPY entrypoint.sh /app/entrypoint.sh
 

README.md

@@ -6,23 +6,41 @@
 <p align="center">
   <a href="https://gitea.ocram85.com/OCram85/swarmproxy/">
     <img
-      src="/OCram85/swarmproxy/raw/branch/main/assets/social-logo.png"
-      alt="swarmproxy"
+      src="assets/social-logo.png"
+      alt="Swarmproxy - Tame your traffic"
     >
   </a>
 </p>
 
-<h1 align="center">
-  Swarmproxy - Tame your traffic
-</h1>
-
 <p align="center">
-  Swarmproxy is a simple http/https proxy for outbound traffic in a docker swarm cluster.
+🦁 Swarmproxy is a simple http proxy to limit your outbound traffic.
 </p>
 
-## :book: About
+## 📖 About
 
-## 🤖 Quickstart
+Swarmproxy is a simply way to integrate a http proxy in your Docker swarm cluster or any other container network.
+It acts as an centralized proxy to limit your outbound / egress traffic. You can also add a whitelist filter to
+limit the allowed domains. There is also an option to use a upstream proxy.
+
+### What does Swarmproxy for you?
+
+Enterprise and production environments often face more stringent security requirements.
+Therefore, unfiltered Internet access may be prohibited.
+
+So Swarmproxy could help you with these features:
+
+- ✔️ Prevent direct web access from Container workload.
+- ✔️ Upstream proxy with or without authentication
+- ✔️ Optional domain based whitelist filter.
+
+### What does Swarmproxy not?
+
+Swarmproxy is just a supercharged Tinyproxy where you can point your container workload to.
+
+- ☣️ Swarmproxy does not block the web access or other traffic if you workload doesn't use a proxy
+- ☣️ It's not a firewall, thus it does not customize your iptables or any other firewall policies.
+
+## 🚀 Quickstart
 
 ### 1. ⚡ Get the image 📦
 
@@ -31,9 +49,12 @@ You can download the image from the Gitea embedded container registry: `gitea.oc
 - `latest`, `main` - Is based on the lasted master branch commit.
 - `1`, `0.1`, `0.1.0` - tag based version.
 
-> **💡 NOTE: See the [packages page](https://gitea.ocram85.com/OCram85/-/packages/container/swarmproxy/latest) for latest version and all other available tags.**
+> **💡 NOTE: See the [packages page](https://gitea.ocram85.com/OCram85/-/packages/container/swarmproxy/latest)
+> for latest version and all other available tags.**
 
-### 2.a Run as Docker Swarm Stack
+### 2. 🛡️ Run as Docker Swarm Stack
+
+This example shows all available configuration keys / environment variables for Swarmproxy.
 
 ```yaml
 version: "3.8"
@@ -55,12 +76,14 @@ networks:
 
 services:
   swarmproxy:
+    # Do not use the `latest` tag in production!
     image: gitea.ocram85.com/OCram85/swarmproxy:latest
     deploy:
       replicas: 1
     #secrets:
     #  - upstream-proxy
     environment:
+      - LOGLEVEL=Info
       # Recommended settings
       # Use an optional upstream proxy
       #- UPSTREAM_PROXY=
@@ -73,25 +96,28 @@ services:
       #- TINYPROXY_GID=5123
       #- PORT=8888
       #- TIMEOUT=600
-      #- LOGLEVEL=Info
       #- MAXCLIENTS=600
       #- FILTER_FILE=/app/filter
     volumes:
       # You can mount a single filter file into the container.
       # To reload the file use the docker kill -s USR1 <container_id| container_name> command.
-      - ./filter.txt:/app/filter:ro
-    configs:
-      - source: filter_file
-        target: /app/filter
+      # - ./filter.txt:/app/filter:ro
+    #configs:
+    #  - source: filter_file
+    #    target: /app/filter
     networks:
       egress:
         aliases:
           - swarmproxy
           - proxy
-
-
 ```
 
+## 🚀 Examples
+
+See the [Readme](examples/) docs in the examples folder...
+
+## 💣 Known Issues
+
 ## 😡 We're Using GitHub Under Protest
 
 This project is currently **mirrored** to GitHub. This is not ideal; GitHub is a
@@ -117,11 +143,11 @@ code in Copilot.
 
 ## 🙏 Credits
 
-swarmproxy is based on the following projects and wouldn't be possible without them:
+Swarmproxy is based on the following projects and wouldn't be possible without them:
 
 - [Tinyproxy](https://github.com/tinyproxy/tinyproxy) - The Tinyproxy project itself
-- [docker-tinyproxy](https://github.com/kalaksi/docker-tinyproxy) - A containerized tinyproxy variant.
-- [docker-tinyproxy](https://github.com/ajoergensen/docker-tinyproxy) - A containerized tinyproxy variant.
+- [docker-tinyproxy](https://github.com/kalaksi/docker-tinyproxy) - A containerized Tinyproxy variant.
+- [docker-tinyproxy](https://github.com/ajoergensen/docker-tinyproxy) - A containerized Tinyproxy variant.
 
 ## ⚖️ License (AGPLv3)
 

entrypoint.sh

@@ -27,7 +27,7 @@ EOF
 
 function addUpstreamConfig() {
   [ -z "$UPSTREAM_PROXY_FILE" ] || export UPSTREAM_PROXY=$(cat $UPSTREAM_PROXY_FILE)
-  [ -z "$UPSTREAM_PROXY" ] || echo "upstream http $UPSTREAM_PROXY \".\"" >> "$CONFIG"
+  [ -z "$UPSTREAM_PROXY" ] || echo "Upstream http $UPSTREAM_PROXY " >> "$CONFIG"
 }
 
 function addFilterConfig() {

examples/1-minimal.yml

@@ -0,0 +1,35 @@
+version: "3.8"
+
+networks:
+  egress:
+   attachable: true
+  backend:
+    internal: true
+
+services:
+  swarmproxy:
+    image: gitea.ocram85.com/ocram85/swarmproxy:latest
+    deploy:
+      replicas: 1
+    environment:
+      - LOGLEVEL=Info
+    networks:
+      egress:
+        aliases:
+          - proxy
+
+  curl:
+    image: curlimages/curl:8.1.2
+    command: ["-I", "-x", "proxy:8888", "https://google.com"]
+    depends_on:
+      - swarmproxy
+    deploy:
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+        delay: 10s
+        max_attempts: 5
+        window: 120s
+    networks:
+      - backend
+      - egress

examples/2-upstream.yml

@@ -0,0 +1,64 @@
+version: "3.8"
+
+# Setting up 3 default networks to act as dummy:
+# - backend : internal only network
+# - dmz : dmz network with connections allowed from internal and external
+# - egress : dummy egress zone with fake upstream proxy
+networks:
+  egress:
+   attachable: true
+  dmz:
+    attachable: true
+  backend:
+    internal: true
+
+services:
+  # Creating a fake upstream proxy
+  upstream:
+    image: gitea.ocram85.com/ocram85/swarmproxy:latest
+    deploy:
+      replicas: 1
+    environment:
+      - LOGLEVEL=Info
+    networks:
+      egress:
+        aliases:
+          - upstream
+
+  # Creating our swarmproxy instance to use the external upstream proxy
+  swarmproxy:
+    # Do not use the `latest` tag in production!
+    image: gitea.ocram85.com/ocram85/swarmproxy:latest
+    depends_on:
+      - upstream
+    deploy:
+      replicas: 1
+    environment:
+      - LOGLEVEL=Info
+      - UPSTREAM_PROXY=upstream:8888
+    networks:
+      dmz:
+        aliases:
+          - swarmproxy
+          - proxy
+      egress:
+
+  # container workload example which tries to communicate through our swarmproxy instance
+  # http request / response:
+  # [curl container] <---|req/res|---> [swarmproxy] <---|req/res|---> [upstream] <---|req/res|---> [target]
+  curl:
+    image: curlimages/curl:8.1.2
+    command: ["-I", "-x", "proxy:8888", "https://google.com"]
+    depends_on:
+      - upstream
+      - swarmproxy
+    deploy:
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+        delay: 10s
+        max_attempts: 5
+        window: 120s
+    networks:
+      - backend
+      - dmz

examples/3-external.yml

@@ -0,0 +1,101 @@
+version: "3.8"
+
+# IMPORTANT: Run the following command to add the required filter config file:
+# echo "google.com" | docker config create filter_file -
+configs:
+  filter_file:
+    external: true
+
+# IMPORTANT: Run the following command to add the required filter config file:
+# echo "upstream:8888" | docker secret create upstream-proxy -
+secrets:
+  upstream-proxy:
+    external: true
+
+# Setting up 3 default networks to act as dummy:
+# - backend : internal only network
+# - dmz : dmz network with connections allowed from internal and external
+# - egress : dummy egress zone with fake upstream proxy
+networks:
+  egress:
+   attachable: true
+  dmz:
+    attachable: true
+  backend:
+    internal: true
+
+services:
+  # Creating a fake upstream proxy
+  upstream:
+    image: gitea.ocram85.com/ocram85/swarmproxy:latest
+    deploy:
+      replicas: 1
+    environment:
+      - LOGLEVEL=Info
+    networks:
+      egress:
+        aliases:
+          - upstream
+
+  # Creating our swarmproxy instance to use the external upstream proxy
+  swarmproxy:
+    # Do not use the `latest` tag in production!
+    image: gitea.ocram85.com/ocram85/swarmproxy:latest
+    depends_on:
+      - upstream
+    deploy:
+      replicas: 1
+    environment:
+      - LOGLEVEL=Info
+      #- UPSTREAM_PROXY=upstream:8888
+      - UPSTREAM_PROXY_FILE=/run/secrets/upstream-proxy
+      - FILTER_FILE=/app/filter
+    configs:
+      - source: filter_file
+        target: /app/filter
+    secrets:
+      - upstream-proxy
+    networks:
+      dmz:
+        aliases:
+          - swarmproxy
+          - proxy
+      egress:
+
+  # container workload example whicht tries to communicate through our swarmproxy instance
+  # http request / response:
+  # [curl container] <---|req/res|---> [swarmproxy] <---|req/res|---> [upstream] <---|req/res|---> [target]
+  curl:
+    image: curlimages/curl:8.1.2
+    command: ["-I", "-x", "proxy:8888", "https://google.com"]
+    depends_on:
+      - upstream
+      - swarmproxy
+    deploy:
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+        delay: 10s
+        max_attempts: 5
+        window: 120s
+    networks:
+      - backend
+      - dmz
+
+  # Example for blocked request if there is no matching domain in the filter file.
+  curl-blocked:
+    image: curlimages/curl:8.1.2
+    command: ["-I", "-x", "proxy:8888", "https://amazon.com"]
+    depends_on:
+      - upstream
+      - swarmproxy
+    deploy:
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+        delay: 10s
+        max_attempts: 5
+        window: 120s
+    networks:
+      - backend
+      - dmz

examples/Readme.md

@@ -0,0 +1,407 @@
+---
+gitea: none
+include_toc: true
+---
+
+# 📘 Examples
+
+This folder contains some examples you can use to start building your Swarmproxy stack.
+
+## Basic example `(1-minimal.yml)`
+
+### Source
+
+> 🗄️ File: [1-minimal.yml](1-minimal.yml)
+
+### Description
+
+This is the mos basic example. It contains the Swarmproxy service and curl als helper. Just deploy the stack and
+inspect the logs form the containers.
+
+### Usage
+
+```bash
+docker stack deploy -c 1-minimal.yml swarmproxy-mini
+```
+
+### Container Logs
+
+- Swarmproxy:
+
+```
+🦁 FILTER_FILE not found or set.
+🦁 Final Swarmproxy config 🦁
+
+3
+Group 5123
+
+8
+Timeout 600
+DefaultErrorFile "/usr/share/tinyproxy/default.html"
+StatHost "tinyproxy.stats"
+StatFile "/usr/share/tinyproxy/stats.html"
+LogLevel Info
+MaxClients 600
+ViaProxyName "Swarmproxy"
+Allow 127.0.0.1/8
+Allow 10.0.0.0/8
+🦁 Starting Tinyproxy...
+args count: 3
+args value: -c /app/proxy.conf -d
+NOTICE    Jul 13 11:10:23.360 [1]: Initializing tinyproxy ...
+NOTICE    Jul 13 11:10:23.360 [1]: Reloading config file
+INFO      Jul 13 11:10:23.360 [1]: Stathost set to "tinyproxy.stats"
+INFO      Jul 13 11:10:23.360 [1]: Setting "Via" header to 'Swarmproxy'
+NOTICE    Jul 13 11:10:23.360 [1]: Reloading config file finished
+INFO      Jul 13 11:10:23.360 [1]: listen_sock called with addr = '(NULL)'
+INFO      Jul 13 11:10:23.360 [1]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
+INFO      Jul 13 11:10:23.360 [1]: listening on fd [3]
+INFO      Jul 13 11:10:23.360 [1]: trying to listen on host[::], family[10], socktype[1], proto[6]
+INFO      Jul 13 11:10:23.360 [1]: listening on fd [4]
+INFO      Jul 13 11:10:23.360 [1]: Not running as root, so not changing UID/GID.
+INFO      Jul 13 11:10:23.360 [1]: Setting the various signals.
+INFO      Jul 13 11:10:23.360 [1]: Starting main loop. Accepting connections.
+CONNECT   Jul 13 11:10:29.845 [1]: Connect (file descriptor 5): 10.0.35.4
+CONNECT   Jul 13 11:10:29.845 [1]: Request (file descriptor 5): CONNECT google.com:443 HTTP/1.1
+INFO      Jul 13 11:10:29.845 [1]: No upstream proxy for google.com
+INFO      Jul 13 11:10:29.845 [1]: opensock: opening connection to google.com:443
+INFO      Jul 13 11:10:29.955 [1]: opensock: getaddrinfo returned for google.com:443
+CONNECT   Jul 13 11:10:29.959 [1]: Established connection to host "google.com" using file descriptor 6.
+INFO      Jul 13 11:10:29.959 [1]: Not sending client headers to remote machine
+INFO      Jul 13 11:10:30.033 [1]: Closed connection between local client (fd:5) and remote client (fd:6)
+```
+
+- Curl:
+
+```
+  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                 Dload  Upload   Total   Spent    Left  Speed
+HTTP/1.0 200 Connection established
+
+  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+  0   220    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+Proxy-agent: tinyproxy/1.11.1
+
+HTTP/2 301
+location: https:xt/html; charset=UTF-8
+content-security//www.google.com/
+content-type: te-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-gEktpIC_xSqk9njjM0KANA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
+date: Thu, 13 Jul 2023 11:10:29 GMT
+expires: Thu, 13 Jul 2023 11:10:29 GMT
+cache-control: private, max-age=2592000
+
+server: gws
+content-length: 220
+x-xss-protection: 0
+x-frame-options: SAMEORIGIN
+set-cookie: CONSENT=PENDING+663; expires=Sat, 12-Jul-2025 11:10:29 GMT; path=/; domain=.google.com; Secure
+p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
+alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
+```
+
+## Upstream proxy example `(2-upstream.yml)`
+
+### Source
+
+> 🗄️ File: [2-upstream.yml](2-upstream.yml)
+
+### Description
+
+The upstream example contains another Swarmproxy instance as fake upstream proxy. The client connects to it's
+configured Swarmproxy instance which forwards the query to the upstream.
+
+### Usage
+
+```bash
+docker stack deploy -c 2-upstream.yml swarmproxy-upstream
+```
+
+### Container Logs
+
+- Upstream
+
+```
+🦁 FILTER_FILE not found or set.
+🦁 Final Swarmproxy config 🦁
+
+3
+Group 5123
+8
+Timeout 600
+DefaultErrorFile "/usr/share/tinyproxy/default.html"
+StatHost "tinyproxy.stats"
+StatFile "/usr/share/tinyproxy/stats.html"
+LogLevel Info
+MaxClients 600
+ViaProxyName "Swarmproxy"
+Allow 127.0.0.1/8
+Allow 10.0.0.0/8
+🦁 Starting Tinyproxy...
+args count: 3
+args value: -c /app/proxy.conf -d
+NOTICE    Jul 13 11:18:50.279 [1]: Initializing tinyproxy ...
+NOTICE    Jul 13 11:18:50.279 [1]: Reloading config file
+INFO      Jul 13 11:18:50.279 [1]: Stathost set to "tinyproxy.stats"
+INFO      Jul 13 11:18:50.279 [1]: Setting "Via" header to 'Swarmproxy'
+NOTICE    Jul 13 11:18:50.279 [1]: Reloading config file finished
+INFO      Jul 13 11:18:50.279 [1]: listen_sock called with addr = '(NULL)'
+INFO      Jul 13 11:18:50.279 [1]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
+INFO      Jul 13 11:18:50.279 [1]: listening on fd [3]
+INFO      Jul 13 11:18:50.279 [1]: trying to listen on host[::], family[10], socktype[1], proto[6]
+INFO      Jul 13 11:18:50.279 [1]: listening on fd [4]
+INFO      Jul 13 11:18:50.279 [1]: Not running as root, so not changing UID/GID.
+INFO      Jul 13 11:18:50.279 [1]: Setting the various signals.
+INFO      Jul 13 11:18:50.279 [1]: Starting main loop. Accepting connections.
+```
+
+- Swarmproxy
+
+```
+🦁 FILTER_FILE not found or set.
+🦁 Final Swarmproxy config 🦁
+3
+Group 5123
+8
+Timeout 600
+DefaultErrorFile "/usr/share/tinyproxy/default.html"
+StatHost "tinyproxy.stats"
+StatFile "/usr/share/tinyproxy/stats.html"
+LogLevel Info
+MaxClients 600
+ViaProxyName "Swarmproxy"
+Allow 127.0.0.1/8
+Allow 10.0.0.0/8
+Upstream http upstream:8888
+🦁 Starting Tinyproxy...
+args count: 3
+args value: -c /app/proxy.conf -d
+NOTICE    Jul 13 11:22:46.583 [1]: Initializing tinyproxy ...
+NOTICE    Jul 13 11:22:46.583 [1]: Reloading config file
+INFO      Jul 13 11:22:46.583 [1]: Stathost set to "tinyproxy.stats"
+INFO      Jul 13 11:22:46.583 [1]: Setting "Via" header to 'Swarmproxy'
+INFO      Jul 13 11:22:46.583 [1]: Added upstream http upstream:8888 for [default]
+NOTICE    Jul 13 11:22:46.583 [1]: Reloading config file finished
+INFO      Jul 13 11:22:46.583 [1]: listen_sock called with addr = '(NULL)'
+INFO      Jul 13 11:22:46.583 [1]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
+INFO      Jul 13 11:22:46.583 [1]: listening on fd [3]
+INFO      Jul 13 11:22:46.583 [1]: trying to listen on host[::], family[10], socktype[1], proto[6]
+INFO      Jul 13 11:22:46.583 [1]: listening on fd [4]
+INFO      Jul 13 11:22:46.583 [1]: Not running as root, so not changing UID/GID.
+INFO      Jul 13 11:22:46.583 [1]: Setting the various signals.
+INFO      Jul 13 11:22:46.583 [1]: Starting main loop. Accepting connections.
+CONNECT   Jul 13 11:23:02.916 [1]: Connect (file descriptor 5): 10.0.38.4
+CONNECT   Jul 13 11:23:02.916 [1]: Request (file descriptor 5): CONNECT google.com:443 HTTP/1.1
+INFO      Jul 13 11:23:02.916 [1]: Found upstream proxy http upstream:8888 for google.com
+INFO      Jul 13 11:23:02.916 [1]: opensock: opening connection to upstream:8888
+INFO      Jul 13 11:23:02.916 [1]: opensock: getaddrinfo returned for upstream:8888
+CONNECT   Jul 13 11:23:02.917 [1]: Established connection to upstream proxy "upstream" using file descriptor 6.
+INFO      Jul 13 11:23:03.182 [1]: Closed connection between local client (fd:5) and remote client (fd:6)
+```
+
+- Curl
+
+```
+  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                 Dload  Upload   Total   Spent    Left  Speed
+HTTP/1.0 200 Connection established
+
+  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+  0   220    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+Via: 1.1 Swarmproxy (tinyproxy/1.11.1)
+Proxy-agent: tinyproxy/1.11.1
+
+HTTP/2 301
+location: https://www.google.com/
+content-type: text/html; charset=UTF-8
+content-security-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-g1lolRpzk2b93t4bhY80uA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
+date: Thu, 13 Jul 2023 11:23:03 GMT
+expires: Thu, 13 Jul 2023 11:23:03 GMT
+cache-control: private, max-age=2592000
+
+server: gws
+content-length: 220
+x-xss-protection: 0
+x-frame-options: SAMEORIGIN
+set-cookie: CONSENT=PENDING+481; expires=Sat, 12-Jul-2025 11:23:03 GMT; path=/; domain=.google.com; Secure
+p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
+alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
+```
+
+## Fullstack example with external secrets and config `(3-external.yml)`
+
+### Source
+
+> 🗄️ File: [3-upstream.yml](3-upstream.yml)
+
+### Description
+
+This stack is based on the previous upstream example. It's modified to show these additional features:
+
+- Using external docker secret to set up an upstream proxy. Should be used when upstream needs authentication
+- Mounting a docker config as filter file
+- filtering queries by domains
+- added curl-blocked service to show output if target domain is not in whitelist
+
+### Usage
+
+```bash
+echo "google.com" | docker config create filter_file -
+echo "upstream:8888" | docker secret create upstream-proxy -
+docker stack deploy -c 1-minimal.yml swarmproxy-mini
+```
+
+### Container Logs
+
+- Upstream
+
+```
+🦁 FILTER_FILE not found or set.
+🦁 Final Swarmproxy config 🦁
+
+3
+Group 5123
+
+8
+Timeout 600
+DefaultErrorFile "/usr/share/tinyproxy/default.html"
+StatHost "tinyproxy.stats"
+StatFile "/usr/share/tinyproxy/stats.html"
+LogLevel Info
+MaxClients 600
+ViaProxyName "Swarmproxy"
+Allow 127.0.0.1/8
+Allow 10.0.0.0/8
+🦁 Starting Tinyproxy...
+args count: 3
+args value: -c /app/proxy.conf -d
+NOTICE    Jul 13 11:37:47.554 [1]: Initializing tinyproxy ...
+NOTICE    Jul 13 11:37:47.554 [1]: Reloading config file
+INFO      Jul 13 11:37:47.554 [1]: Stathost set to "tinyproxy.stats"
+INFO      Jul 13 11:37:47.554 [1]: Setting "Via" header to 'Swarmproxy'
+NOTICE    Jul 13 11:37:47.554 [1]: Reloading config file finished
+INFO      Jul 13 11:37:47.554 [1]: listen_sock called with addr = '(NULL)'
+INFO      Jul 13 11:37:47.554 [1]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
+INFO      Jul 13 11:37:47.554 [1]: listening on fd [3]
+INFO      Jul 13 11:37:47.554 [1]: trying to listen on host[::], family[10], socktype[1], proto[6]
+INFO      Jul 13 11:37:47.554 [1]: listening on fd [4]
+INFO      Jul 13 11:37:47.554 [1]: Not running as root, so not changing UID/GID.
+INFO      Jul 13 11:37:47.554 [1]: Setting the various signals.
+INFO      Jul 13 11:37:47.554 [1]: Starting main loop. Accepting connections.
+CONNECT   Jul 13 11:38:22.698 [1]: Connect (file descriptor 5): 10.0.40.4
+CONNECT   Jul 13 11:38:22.699 [1]: Request (file descriptor 5): CONNECT google.com:443 HTTP/1.1
+INFO      Jul 13 11:38:22.699 [1]: No upstream proxy for google.com
+INFO      Jul 13 11:38:22.699 [1]: opensock: opening connection to google.com:443
+INFO      Jul 13 11:38:26.704 [1]: opensock: getaddrinfo returned for google.com:443
+CONNECT   Jul 13 11:38:26.708 [1]: Established connection to host "google.com" using file descriptor 6.
+INFO      Jul 13 11:38:26.708 [1]: Not sending client headers to remote machine
+INFO      Jul 13 11:38:26.785 [1]: Closed connection between local client (fd:5) and remote client (fd:6)
+```
+
+- Swarmproxy
+
+```
+🦁 Final Swarmproxy config 🦁
+

+3
+Group 5123
+

+8
+Timeout 600
+DefaultErrorFile "/usr/share/tinyproxy/default.html"
+StatHost "tinyproxy.stats"
+StatFile "/usr/share/tinyproxy/stats.html"
+LogLevel Info
+MaxClients 600
+ViaProxyName "Swarmproxy"
+Allow 127.0.0.1/8
+Allow 10.0.0.0/8
+Upstream http upstream:8888
+Filter "/app/filter"
+FilterURLs Off
+FilterCaseSensitive Off
+FilterDefaultDeny Yes
+🦁 Starting Tinyproxy...
+args count: 3
+args value: -c /app/proxy.conf -d
+NOTICE    Jul 13 11:37:57.704 [1]: Initializing tinyproxy ...
+NOTICE    Jul 13 11:37:57.704 [1]: Reloading config file
+INFO      Jul 13 11:37:57.704 [1]: Stathost set to "tinyproxy.stats"
+INFO      Jul 13 11:37:57.704 [1]: Setting "Via" header to 'Swarmproxy'
+INFO      Jul 13 11:37:57.704 [1]: Added upstream http upstream:8888 for [default]
+NOTICE    Jul 13 11:37:57.704 [1]: Reloading config file finished
+INFO      Jul 13 11:37:57.704 [1]: listen_sock called with addr = '(NULL)'
+INFO      Jul 13 11:37:57.704 [1]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
+INFO      Jul 13 11:37:57.704 [1]: listening on fd [3]
+INFO      Jul 13 11:37:57.704 [1]: trying to listen on host[::], family[10], socktype[1], proto[6]
+INFO      Jul 13 11:37:57.704 [1]: listening on fd [4]
+INFO      Jul 13 11:37:57.704 [1]: Not running as root, so not changing UID/GID.
+INFO      Jul 13 11:37:57.704 [1]: Setting the various signals.
+INFO      Jul 13 11:37:57.704 [1]: Starting main loop. Accepting connections.
+CONNECT   Jul 13 11:38:00.361 [1]: Connect (file descriptor 5): 10.0.39.4
+CONNECT   Jul 13 11:38:00.361 [1]: Request (file descriptor 5): CONNECT amazon.com:443 HTTP/1.1
+NOTICE    Jul 13 11:38:00.361 [1]: Proxying refused on filtered domain "amazon.com"
+CONNECT   Jul 13 11:38:14.022 [1]: Connect (file descriptor 5): 10.0.39.4
+CONNECT   Jul 13 11:38:14.022 [1]: Request (file descriptor 5): CONNECT amazon.com:443 HTTP/1.1
+NOTICE    Jul 13 11:38:14.022 [1]: Proxying refused on filtered domain "amazon.com"
+CONNECT   Jul 13 11:38:22.698 [1]: Connect (file descriptor 5): 10.0.39.4
+CONNECT   Jul 13 11:38:22.698 [1]: Request (file descriptor 5): CONNECT google.com:443 HTTP/1.1
+INFO      Jul 13 11:38:22.698 [1]: Found upstream proxy http upstream:8888 for google.com
+INFO      Jul 13 11:38:22.698 [1]: opensock: opening connection to upstream:8888
+INFO      Jul 13 11:38:22.698 [1]: opensock: getaddrinfo returned for upstream:8888
+CONNECT   Jul 13 11:38:22.698 [1]: Established connection to upstream proxy "upstream" using file descriptor 6.
+CONNECT   Jul 13 11:38:25.064 [1]: Connect (file descriptor 7): 10.0.39.4
+CONNECT   Jul 13 11:38:25.064 [1]: Request (file descriptor 7): CONNECT amazon.com:443 HTTP/1.1
+NOTICE    Jul 13 11:38:25.064 [1]: Proxying refused on filtered domain "amazon.com"
+INFO      Jul 13 11:38:26.785 [1]: Closed connection between local client (fd:5) and remote client (fd:6)
+CONNECT   Jul 13 11:38:36.285 [1]: Connect (file descriptor 5): 10.0.39.4
+CONNECT   Jul 13 11:38:36.285 [1]: Request (file descriptor 5): CONNECT amazon.com:443 HTTP/1.1
+NOTICE    Jul 13 11:38:36.285 [1]: Proxying refused on filtered domain "amazon.com"
+```
+
+- Curl
+
+```
+  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                 Dload  Upload   Total   Spent    Left  Speed
+HTTP/1.0 200 Connection established
+
+  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+  0     0    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0
+  0     0    0     0    0     0      0      0 --:--:--  0:00:02 --:--:--     0
+  0     0    0     0    0     0      0      0 --:--:--  0:00:03 --:--:--     0
+  0     0    0     0    0     0      0      0 --:--:--  0:00:04 --:--:--     0
+  0   220    0     0    0     0      0      0 --:--:--  0:00:04 --:--:--     0
+Via: 1.1 Swarmproxy (tinyproxy/1.11.1)
+Proxy-agent: tinyproxy/1.11.1
+
+HTTP/2 301
+location: https://www.google.com/
+content-type: text/html; charset=UTF-8
+content-security-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-UGtC_QXXA9WxUVfYPZJkJA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
+date: Thu, 13 Jul 2023 11:38:26 GMT
+expires: Thu, 13 Jul 2023 11:38:26 GMT
+cache-control: private, max-age=2592000
+
+server: gws
+content-length: 220
+x-xss-protection: 0
+x-frame-options: SAMEORIGIN
+set-cookie: CONSENT=PENDING+670; expires=Sat, 12-Jul-2025 11:38:26 GMT; path=/; domain=.google.com; Secure
+p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
+alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
+```
+
+- Curl-blocked
+
+```
+  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                 Dload  Upload   Total   Spent    Left  Speed
+
+  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+HTTP/1.1 403 Filtered
+curl: (56) CONNECT tunnel failed, response 403
+Server: tinyproxy/1.11.1
+Content-Type: text/html
+Connection: close
+```

renovate.json

@@ -0,0 +1,12 @@
+{
+  "dependencyDashboard": true,
+  "docker": {
+    "enabled": true
+  },
+  "github-actions": {
+    "enabled": true,
+    "fileMatch": [
+      "^\\.gitea/workflows/[^/]+\\.ya?ml$"
+    ]
+  }
+}