kadinhoandClaude Opus 4.8
7292a500eb
Add an ALLOWED_CLIENTS source-address filter to the DNS service so it only answers queries from the authorized PS5 VLAN (192.168.40.0/28 by default). Queries from any other source address are dropped and logged as "denied" on both UDP and TCP. The value accepts a comma-separated mix of individual addresses and CIDR ranges, and an empty value disables the filter. Record the two authorized consoles (PS5PRO 192.168.40.14, PS5FAT 192.168.40.13) and the stale 192.168.10.x workstation address in the docs. Co-Authored-By: Claude Opus 4.8 <[email protected]>
45 lines
1.6 KiB
YAML
45 lines
1.6 KiB
YAML
services:
|
|
relapse-exploit:
|
|
build:
|
|
context: .
|
|
image: relapse-exploit:local
|
|
ports:
|
|
- "${HOST_BIND:-0.0.0.0}:${HOST_PORT:-8000}:8080"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=1m,mode=1777
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
restart: unless-stopped
|
|
|
|
ps5-guide-gateway:
|
|
image: relapse-exploit:local
|
|
command: ["python", "/srv/guide_gateway.py"]
|
|
environment:
|
|
GATEWAY_IP: "${GATEWAY_IP:-192.168.20.30}"
|
|
REDIRECT_URL: "${GUIDE_REDIRECT_URL:-http://192.168.20.30:8000/}"
|
|
FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,raw.githubusercontent.com,release-assets.githubusercontent.com,prosperopatches.com,cdn.prosperopatches.com,image.api.playstation.com,gmedia.playstation.com}"
|
|
UPSTREAM_DNS: "${UPSTREAM_DNS:-1.1.1.1}"
|
|
ALLOWED_CLIENTS: "${ALLOWED_CLIENTS:-192.168.40.0/28}"
|
|
ports:
|
|
- "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/udp"
|
|
- "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/tcp"
|
|
- "${GATEWAY_BIND_IP:-192.168.20.30}:80:8081/tcp"
|
|
- "${GATEWAY_BIND_IP:-192.168.20.30}:443:8443/tcp"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=1m,mode=1777
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
healthcheck:
|
|
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8081/_health', timeout=2).close()"]
|
|
interval: 30s
|
|
timeout: 3s
|
|
start_period: 5s
|
|
retries: 3
|
|
restart: unless-stopped
|