kadinhoandClaude Opus 4.8
50dd2d8266
Replace the gateway's env-var DNS policy with docker/nanodns.ini, modelled on https://github.com/drakmor/nanoDNS#config: [general] (redirect_url, allowed_clients), [upstream] (ordered resolver list + timeout_ms), [overrides] (mask = IPv4 spoof) and [exceptions] (masks forwarded upstream). Masks use shell-style wildcards and match case-insensitively; resolution order is exceptions -> overrides -> NXDOMAIN. The unmatched-name behaviour is deliberately inverted from upstream nanoDNS: names matching no rule return NXDOMAIN (default-deny) instead of being forwarded, so PSN, updates and telemetry stay blocked. The source-client allowlist now lives in [general] allowed_clients. The INI is baked into the image; CONFIG_FILE can point at a mounted file for per-host overrides. Co-Authored-By: Claude Opus 4.8 <[email protected]>
42 lines
1.2 KiB
YAML
42 lines
1.2 KiB
YAML
services:
|
|
relapse-exploit:
|
|
build:
|
|
context: .
|
|
image: relapse-exploit:local
|
|
ports:
|
|
- "${HOST_BIND:-0.0.0.0}:${HOST_PORT:-8000}:8080"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=1m,mode=1777
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
restart: unless-stopped
|
|
|
|
ps5-guide-gateway:
|
|
image: relapse-exploit:local
|
|
command: ["python", "/srv/guide_gateway.py"]
|
|
# DNS policy (overrides, exceptions, upstreams, allowed client VLANs) lives in
|
|
# docker/nanodns.ini, baked into the image. Set CONFIG_FILE to point at a
|
|
# different mounted file for per-host customisation.
|
|
ports:
|
|
- "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/udp"
|
|
- "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/tcp"
|
|
- "${GATEWAY_BIND_IP:-192.168.20.30}:80:8081/tcp"
|
|
- "${GATEWAY_BIND_IP:-192.168.20.30}:443:8443/tcp"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=1m,mode=1777
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
healthcheck:
|
|
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8081/_health', timeout=2).close()"]
|
|
interval: 30s
|
|
timeout: 3s
|
|
start_period: 5s
|
|
retries: 3
|
|
restart: unless-stopped
|