iceBear67andClaude Opus 5
f37cd0a125
Multi-stage Dockerfile on debian:trixie-slim. openvpn3 and lwIP are cloned at pinned refs and handed to CMake through OVG_OPENVPN3_DIR/OVG_LWIP_DIR rather than left to FetchContent, whose GIT_TAG master would make the same Dockerfile build a different VPN client each week. The unit suite runs in the builder stage. docker/openvpngate.conf overrides only the keys whose host default is wrong inside a container -- loopback listen addresses, which make a published port reach nothing, and relative state paths, which put the node failure history on a layer that gets thrown away. Everything else stays absent and takes the compiled-in default so the file cannot drift from the code. The compose example drops every capability, runs read-only as uid 10001 and publishes both ports to host loopback: the admin endpoint has no auth and includes POST /switch. That configuration is the design constraint of this project (no root, no tun device) turned into something testable. docs/DOCKER.md 8 records what was checked against the source and what was not: this sandbox has no docker daemon, so neither the image build nor the compose file has actually been run. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
33 lines
1.2 KiB
Plaintext
33 lines
1.2 KiB
Plaintext
# SOCKS5 credentials, one per line: <user>:<secret>
|
|
#
|
|
# cp docker/socks5.auth.example docker/socks5.auth
|
|
# $EDITOR docker/socks5.auth
|
|
#
|
|
# docker-compose.yml mounts docker/socks5.auth read-only into the container.
|
|
# Reloaded on SIGHUP without dropping a live session:
|
|
#
|
|
# docker compose kill -s HUP openvpngate
|
|
#
|
|
# Two accepted forms.
|
|
#
|
|
# 1. Plaintext. Hashed with a random salt when the file is read, so it is never
|
|
# held in memory in the clear -- but it is sitting in the clear right here,
|
|
# which is the part that matters on a shared host.
|
|
#
|
|
# alice:changeme
|
|
#
|
|
# 2. Pre-hashed: sha256$<salt_hex>$<sha256_hex(salt_hex + password)>. Note the
|
|
# salt is concatenated as its *hex text*, not as raw bytes. Generate one:
|
|
#
|
|
# salt=$(openssl rand -hex 16)
|
|
# printf 'alice:sha256$%s$%s\n' "$salt" \
|
|
# "$(printf '%s' "${salt}${PASSWORD}" | sha256sum | cut -d' ' -f1)"
|
|
#
|
|
# Lines starting with '#' and blank lines are ignored. A malformed line is a
|
|
# hard startup error, not a skipped entry: half-loaded credentials are worse
|
|
# than none.
|
|
#
|
|
# The entry below is an example and will be rejected by anyone paying
|
|
# attention. Replace it.
|
|
alice:changeme
|