kadinhoandClaude Opus 4.8
50dd2d8266
Replace the gateway's env-var DNS policy with docker/nanodns.ini, modelled on https://github.com/drakmor/nanoDNS#config: [general] (redirect_url, allowed_clients), [upstream] (ordered resolver list + timeout_ms), [overrides] (mask = IPv4 spoof) and [exceptions] (masks forwarded upstream). Masks use shell-style wildcards and match case-insensitively; resolution order is exceptions -> overrides -> NXDOMAIN. The unmatched-name behaviour is deliberately inverted from upstream nanoDNS: names matching no rule return NXDOMAIN (default-deny) instead of being forwarded, so PSN, updates and telemetry stay blocked. The source-client allowlist now lives in [general] allowed_clients. The INI is baked into the image; CONFIG_FILE can point at a mounted file for per-host overrides. Co-Authored-By: Claude Opus 4.8 <[email protected]>
43 lines
1.3 KiB
Docker
43 lines
1.3 KiB
Docker
ARG PYTHON_IMAGE=python:3.14-alpine
|
|
FROM ${PYTHON_IMAGE} AS certificates
|
|
|
|
RUN apk add --no-cache openssl \
|
|
&& install -d -m 0755 /certificates \
|
|
&& openssl req -x509 -newkey rsa:2048 -sha256 -nodes -days 3650 \
|
|
-subj "/CN=manuals.playstation.net" \
|
|
-addext "subjectAltName=DNS:manuals.playstation.net" \
|
|
-keyout /certificates/manuals.key \
|
|
-out /certificates/manuals.crt \
|
|
&& chmod 0600 /certificates/manuals.key
|
|
|
|
FROM ${PYTHON_IMAGE}
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PORT=8080
|
|
|
|
WORKDIR /srv
|
|
|
|
COPY payloads.sha256 /tmp/payloads.sha256
|
|
COPY app/index.html /srv/public/index.html
|
|
COPY app/src /srv/public/src
|
|
COPY app/offsets /srv/public/offsets
|
|
COPY app/payloads /srv/public/payloads
|
|
COPY docker/server.py /srv/server.py
|
|
COPY docker/guide_gateway.py /srv/guide_gateway.py
|
|
COPY docker/nanodns.ini /srv/nanodns.ini
|
|
COPY --from=certificates /certificates /srv/certificates
|
|
|
|
RUN cd /srv/public && sha256sum -c /tmp/payloads.sha256 \
|
|
&& rm /tmp/payloads.sha256 \
|
|
&& chown -R 65532:65532 /srv
|
|
|
|
USER 65532:65532
|
|
|
|
EXPOSE 8080
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
|
|
CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/', timeout=2).close()"]
|
|
|
|
CMD ["python", "/srv/server.py"]
|