70 lines
2.1 KiB
YAML
70 lines
2.1 KiB
YAML
# A private Tor network: a directory authority, three relays, an exit, a web
|
|
# server and a client. The network is internal: no container can reach the
|
|
# Internet, so nothing here touches the real Tor network or a real site.
|
|
#
|
|
# docker compose up -d --build start it
|
|
# docker compose down stop and remove this lab's containers
|
|
|
|
x-tor: &tor
|
|
build: .
|
|
volumes: ["./torrc:/lab/torrc:ro"]
|
|
read_only: true
|
|
tmpfs:
|
|
- /data:mode=0700
|
|
- /tmp
|
|
cap_drop: [ALL]
|
|
# tcpdump uses raw sockets; -p avoids needing promiscuous-mode privileges.
|
|
cap_add: [NET_RAW]
|
|
security_opt: [no-new-privileges:true]
|
|
pids_limit: 64
|
|
mem_limit: 256m
|
|
cpus: 1.0
|
|
logging:
|
|
driver: json-file
|
|
options: {max-size: 5m, max-file: "2"}
|
|
|
|
services:
|
|
da:
|
|
<<: *tor
|
|
# The authority's keys are fixed, so every node can be told in advance
|
|
# which authority to trust (the DirAuthority line in common.torrc).
|
|
command: sh -c "mkdir -p /data/keys && cp /lab/da-keys/* /data/keys/ && chmod 700 /data && tor -f /lab/torrc/da.torrc"
|
|
networks: {tornet: {ipv4_address: 10.77.0.10}}
|
|
|
|
relay1:
|
|
<<: *tor
|
|
command: tor -f /lab/torrc/relay.torrc --Nickname relay1 --Address 10.77.0.11
|
|
networks: {tornet: {ipv4_address: 10.77.0.11}}
|
|
|
|
relay2:
|
|
<<: *tor
|
|
command: tor -f /lab/torrc/relay.torrc --Nickname relay2 --Address 10.77.0.12
|
|
networks: {tornet: {ipv4_address: 10.77.0.12}}
|
|
|
|
relay3:
|
|
<<: *tor
|
|
command: tor -f /lab/torrc/relay.torrc --Nickname relay3 --Address 10.77.0.14
|
|
networks: {tornet: {ipv4_address: 10.77.0.14}}
|
|
|
|
exit:
|
|
<<: *tor
|
|
command: tor -f /lab/torrc/exit.torrc
|
|
networks: {tornet: {ipv4_address: 10.77.0.13}}
|
|
|
|
web:
|
|
<<: *tor
|
|
# Python's built-in web server. Its log shows the address of every request.
|
|
volumes: ["./web:/srv:ro"]
|
|
command: python3 -u -m http.server 80 --directory /srv
|
|
networks: {tornet: {ipv4_address: 10.77.0.80}}
|
|
|
|
client:
|
|
<<: *tor
|
|
command: tor -f /lab/torrc/client.torrc
|
|
networks: {tornet: {ipv4_address: 10.77.0.100}}
|
|
|
|
networks:
|
|
tornet:
|
|
internal: true
|
|
ipam:
|
|
config: [{subnet: 10.77.0.0/24}]
|