https_proxy/docker-compose.yml at main · hightemp/https_proxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
services:
  # Plain HTTP proxy
  http-proxy:
    image: hightemp/https_proxy:latest
    container_name: https_proxy_http
    restart: unless-stopped
    ports:
      - "8080:8080"
    environment:
      PROXY_ADDR: 0.0.0.0:8080
      PROXY_PROTO: http
      PROXY_USERNAME: ${PROXY_USERNAME:-}
      PROXY_PASSWORD: ${PROXY_PASSWORD:-}
      PROXY_UPSTREAM_PROXY: ${PROXY_UPSTREAM_PROXY:-}
      PROXY_NETWORK: ${PROXY_NETWORK:-auto}
      PROXY_LOG_SENSITIVE_DATA: "${PROXY_LOG_SENSITIVE_DATA:-false}"
      PROXY_MAX_CONNECTIONS: "${PROXY_MAX_CONNECTIONS:-1024}"
      PROXY_MAX_CONNECTIONS_PER_IP: "${PROXY_MAX_CONNECTIONS_PER_IP:-64}"
      PROXY_MAX_TUNNELS: "${PROXY_MAX_TUNNELS:-256}"
      PROXY_MAX_TUNNELS_PER_IP: "${PROXY_MAX_TUNNELS_PER_IP:-16}"
      PROXY_MAX_IDLE_CONNS: "${PROXY_MAX_IDLE_CONNS:-100}"
      PROXY_MAX_IDLE_CONNS_PER_HOST: "${PROXY_MAX_IDLE_CONNS_PER_HOST:-10}"
      PROXY_MAX_HEADER_BYTES: "${PROXY_MAX_HEADER_BYTES:-65536}"
      PROXY_IDLE_CONN_TIMEOUT: "${PROXY_IDLE_CONN_TIMEOUT:-90s}"
      PROXY_TUNNEL_IDLE_TIMEOUT: "${PROXY_TUNNEL_IDLE_TIMEOUT:-10m}"
      PROXY_AUTH_MAX_FAILURES: "${PROXY_AUTH_MAX_FAILURES:-10}"
      PROXY_AUTH_FAILURE_WINDOW: "${PROXY_AUTH_FAILURE_WINDOW:-1m}"
      PROXY_AUTH_BLOCK_DURATION: "${PROXY_AUTH_BLOCK_DURATION:-5m}"
      PROXY_ALLOW_PRIVATE_DESTINATIONS: "${PROXY_ALLOW_PRIVATE_DESTINATIONS:-false}"
      PROXY_BLOCKED_DESTINATION_PORTS: "${PROXY_BLOCKED_DESTINATION_PORTS:-}"

  # HTTPS proxy with Let's Encrypt certificates (read from shared volume)
  https-proxy:
    image: hightemp/https_proxy:latest
    container_name: https_proxy_https
    restart: unless-stopped
    ports:
      - "8443:8443"
    environment:
      PROXY_ADDR: 0.0.0.0:8443
      PROXY_PROTO: https
      PROXY_USERNAME: ${PROXY_USERNAME:-}
      PROXY_PASSWORD: ${PROXY_PASSWORD:-}
      PROXY_CERT_PATH: /etc/letsencrypt/live/${DOMAIN:?DOMAIN must be set in .env}/fullchain.pem
      PROXY_KEY_PATH: /etc/letsencrypt/live/${DOMAIN}/privkey.pem
      PROXY_UPSTREAM_PROXY: ${PROXY_UPSTREAM_PROXY:-}
      PROXY_NETWORK: ${PROXY_NETWORK:-auto}
      PROXY_LOG_SENSITIVE_DATA: "${PROXY_LOG_SENSITIVE_DATA:-false}"
      PROXY_MAX_CONNECTIONS: "${PROXY_MAX_CONNECTIONS:-1024}"
      PROXY_MAX_CONNECTIONS_PER_IP: "${PROXY_MAX_CONNECTIONS_PER_IP:-64}"
      PROXY_MAX_TUNNELS: "${PROXY_MAX_TUNNELS:-256}"
      PROXY_MAX_TUNNELS_PER_IP: "${PROXY_MAX_TUNNELS_PER_IP:-16}"
      PROXY_MAX_IDLE_CONNS: "${PROXY_MAX_IDLE_CONNS:-100}"
      PROXY_MAX_IDLE_CONNS_PER_HOST: "${PROXY_MAX_IDLE_CONNS_PER_HOST:-10}"
      PROXY_MAX_HEADER_BYTES: "${PROXY_MAX_HEADER_BYTES:-65536}"
      PROXY_IDLE_CONN_TIMEOUT: "${PROXY_IDLE_CONN_TIMEOUT:-90s}"
      PROXY_TUNNEL_IDLE_TIMEOUT: "${PROXY_TUNNEL_IDLE_TIMEOUT:-10m}"
      PROXY_AUTH_MAX_FAILURES: "${PROXY_AUTH_MAX_FAILURES:-10}"
      PROXY_AUTH_FAILURE_WINDOW: "${PROXY_AUTH_FAILURE_WINDOW:-1m}"
      PROXY_AUTH_BLOCK_DURATION: "${PROXY_AUTH_BLOCK_DURATION:-5m}"
      PROXY_ALLOW_PRIVATE_DESTINATIONS: "${PROXY_ALLOW_PRIVATE_DESTINATIONS:-false}"
      PROXY_BLOCKED_DESTINATION_PORTS: "${PROXY_BLOCKED_DESTINATION_PORTS:-}"
      PROXY_TLS_RELOAD_INTERVAL: "${PROXY_TLS_RELOAD_INTERVAL:-1m}"
    volumes:
      - letsencrypt:/etc/letsencrypt:ro
    depends_on:
      - certbot

  # Let's Encrypt certificate manager.
  # First-time issue:
  #   docker compose run --rm --service-ports certbot issue
  # Then `docker compose up -d` runs auto-renewal in a loop. The HTTPS proxy
  # detects renewed certificate files and reloads them without a restart.
  certbot:
    image: certbot/certbot:latest
    container_name: https_proxy_certbot
    restart: unless-stopped
    environment:
      DOMAIN: ${DOMAIN:?DOMAIN must be set in .env}
      EMAIL: ${EMAIL:?EMAIL must be set in .env}
    ports:
      - "80:80"
    volumes:
      - letsencrypt:/etc/letsencrypt
      - certbot-www:/var/www/certbot
    entrypoint:
      - /bin/sh
      - -c
      - |
        if [ "$$1" = "issue" ]; then
          exec certbot certonly --standalone \
            -d "$$DOMAIN" -m "$$EMAIL" --agree-tos --no-eff-email --non-interactive
        fi
        trap exit TERM
        while :; do
          certbot renew --quiet
          sleep 12h & wait $${!}
        done
      - --

volumes:
  letsencrypt:
  certbot-www: