mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
55 lines
1.5 KiB
YAML
55 lines
1.5 KiB
YAML
---
|
|
# nocheck: playwright-service-flag — Tor Browser users need third-party assets
|
|
# served first-party; deploying tor therefore always deploys the mirror.
|
|
# nocheck: dynamic-flag — hard dependency: every tor deployment serves the mirror.
|
|
mirror:
|
|
bond: 1
|
|
enabled: true
|
|
shared: true
|
|
tor: # nocheck: category-modes
|
|
modes:
|
|
compose:
|
|
enabled: true
|
|
swarm:
|
|
enabled: true
|
|
# nocheck: default-placement-manager node onion ingress: host-published SOCKS/DNS/Trans ports and the HiddenService loopback forward must live on the stack host
|
|
placement: manager
|
|
bond: 0.5
|
|
enabled: true
|
|
shared: true
|
|
exclusive: true
|
|
primary: true
|
|
image: debian
|
|
version: 13.7-slim
|
|
custom: true
|
|
name: tor
|
|
node: ""
|
|
use_entry_guards: true
|
|
flavor: public
|
|
forwards:
|
|
ssh: true
|
|
http: true
|
|
egress:
|
|
enabled: true
|
|
timeout_multipliers:
|
|
chutney: 2
|
|
public: 5
|
|
ports:
|
|
local:
|
|
socks: 9050
|
|
trans: 9040
|
|
dns: 9053
|
|
onion:
|
|
# nocheck: onion-flag a SOCKS port anyone can reach is an open proxy, and SocksPolicy cannot refuse it because the forward arrives from the node's own address
|
|
socks: false
|
|
# nocheck: onion-flag the transparent port takes its destination from the caller's routing, which an onion client does not share
|
|
trans: false
|
|
# nocheck: onion-flag publishing the resolver would answer recursive queries for anyone holding the onion address
|
|
dns: false
|
|
min_storage: 100MB
|
|
cpus: "0.25"
|
|
mem_reservation: 128m
|
|
mem_limit: 256m
|
|
pids_limit: 128
|
|
lifecycle: beta
|