docker-compose.yml

version: "2.4"
services:

  sf-redis:
    image: redis
    container_name: sf-redis
    read_only: true
    hostname: sf-redis
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    environment:
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
    network_mode: none
    command: [ "redis-server", "/redis.conf",  "--save", "\"\"", "--appendonly", "no", "--requirepass", "${SF_REDIS_AUTH}" ]
    volumes:
      - "${SF_BASEDIR:-.}/config/etc/redis/redis.conf:/redis.conf:ro"
      - "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"

  sf-encfsd:
    build: encfsd
    image: sf-encfsd
    container_name: sf-encfsd
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    depends_on:
      - sf-redis
    cap_add:
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    # xfs_quota needs this :/ FIXME
    privileged: true
    # NOTE: _MUST_ not run in host's pid space because we use 'pgrep' to find lg's encfsd pid.
    environment:
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
      - SF_SEED=${SF_SEED}
      - SF_DEBUG
    command: ["/encfsd.sh"]
    network_mode: none
    devices:
      - "/dev/fuse:/dev/fuse"
    volumes:
      - "${SF_BASEDIR:-.}/config/db:/config/db:rw"
      - "${SF_BASEDIR:-.}/config/etc/sf:/config/etc/sf:ro"
      - "${SF_BASEDIR:-.}/data:/encfs/raw"
      - "${SF_SHMDIR:-/dev/shm/sf}/encfs-sec:/encfs/sec:shared"
      - "${SF_SHMDIR:-/dev/shm/sf}/run:/sf/run:ro"
      - "${SF_SHMDIR:-/dev/shm/sf}/run/encfsd/user:/sf/run/encfsd/user"
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
      - "${SF_OVERLAYDIR:-/var/lib/docker/overlay2}:/var/lib/docker/overlay2:ro"
      - "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
      - "/sys/fs/cgroup:/sys/fs/cgroup"

  # Note: If this one fails to start then most likely bad ENCFS password.
  # level=fatal msg="no such file or directory": unknown
  sf-destructor:
    build: encfsd
    image: sf-encfsd
    container_name: sf-destructor
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    depends_on:
      - sf-redis
      - sf-encfsd
    cap_add:
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    environment:
      - SF_REDIS_AUTH=${SF_REDIS_AUTH:?}
      - SF_DEBUG
    pid: "service:sf-encfsd"
    command: ["/destructor.sh"]
    network_mode: none
    devices:
      - "/dev/fuse:/dev/fuse"
    volumes:
      - "${SF_BASEDIR:-.}/config/db:/config/db:rw"
      - "${SF_BASEDIR:-.}/config/etc/sf:/config/etc/sf:ro"
      - "${SF_BASEDIR:-.}/data:/encfs/raw"
      - "${SF_SHMDIR:-/dev/shm/sf}/self-for-guest:/config/self-for-guest"
      - "${SF_SHMDIR:-/dev/shm/sf}/encfs-sec:/encfs/sec:shared"
      - "${SF_SHMDIR:-/dev/shm/sf}/run:/sf/run"
      - "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"

  sf-containerguard:
    build: tools/cg
    image: sf-containerguard
    container_name: sf-containerguard
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    pid: "host"
    cap_add:
    - SYS_PTRACE # access to /proc/<PID>/root/dev/pts/* to send messages to user.
    network_mode: none
    volumes:
    - "/var/run/docker.sock:/var/run/docker.sock"
    - "/var/run/containerd/io.containerd.runtime.v2.task:/var/run/containerd/io.containerd.runtime.v2.task:ro"
    - "${SF_BASEDIR:-.}/config:${SF_BASEDIR:-.}/config"
    - "/sys/fs/cgroup:/sys/fs/cgroup"

  sf-logpipe:
    build: tools/logpipe
    image: sf-logpipe
    container_name: sf-logpipe
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    volumes:
      - "${SF_BASEDIR:-.}/config/etc/logpipe/:/app/config/:ro"    
      - "${SF_SHMDIR:-/dev/shm/sf}/run/logpipe/:/app/sock/:rw"
      
  sf-portd:
    build: encfsd
    image: sf-encfsd
    container_name: sf-portd
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    depends_on:
      - sf-redis
    environment:
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
      - SF_DEBUG
    command: ["/portd.sh"]
    network_mode: none
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}/self-for-guest:/config/self-for-guest"
      - "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"

  dns-doh:
    image: crazymax/cloudflared
    container_name: sf-dns-doh
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    networks:
      dns-doh-net:
        ipv4_address: ${SF_DOH_IP:?}

  dnsmasq:
    image: 4km3/dnsmasq:latest
    container_name: sf-dnsmasq
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    depends_on:
      - dns-doh
    cap_add:
      - NET_ADMIN
    command: ["--no-resolv", "--domain-needed", "--server=${SF_DOH_IP}#5053", "--server=/onion/${SF_TOR_IP}#5353"]
    networks:
      vpn-net:
        ipv4_address: ${SF_NET_VPN_DNS_IP:?}
      dns-doh-net:
      access-net:
        ipv4_address: ${SF_NET_ACCESS_DNS_IP:?}

  nordvpn:
    image: hackerschoice/cryptostorm
    container_name: sf-nordvpn
    restart: "no"
    cgroup_parent: sf.slice
    depends_on:
      - dnsmasq
      - sf-redis
      - router
    dns: ${SF_NET_VPN_DNS_IP}
    cap_add:
      - NET_ADMIN #required
    environment:
      # - PRIVATE_KEY=${SF_NORDVPN_PRIVATE_KEY:-}
      - CONFIG=${SF_NORDVPN_CONFIG:-}
      - PROVIDER=NordVPN
      - NETWORK=${SF_NET_LG}
      - NET_VPN_ROUTER_IP=${SF_NET_VPN_ROUTER_IP}
      - POST_UP=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-nordvpn.log up %i
      - PRE_DOWN=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-nordvpn.log down %i
      - RECONNECT=604800 # Re-Connect every 7 days
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
      - SF_DEBUG
    networks:
      vpn-net:
        ipv4_address: ${SF_NORDVPN_IP}
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
      - net.ipv4.conf.all.rp_filter=2
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1 # SNAT
      - net.netfilter.nf_conntrack_frag6_timeout=10
      - net.netfilter.nf_conntrack_generic_timeout=180           # default is 600
      - net.netfilter.nf_conntrack_tcp_timeout_syn_sent=10       # default is 120
      - net.netfilter.nf_conntrack_tcp_timeout_syn_recv=1        # default is 30
      - net.netfilter.nf_conntrack_tcp_timeout_last_ack=5        # default is 30
      - net.netfilter.nf_conntrack_tcp_timeout_fin_wait=10       # default is 120
      - net.netfilter.nf_conntrack_tcp_timeout_close=1           # default is 10
      - net.netfilter.nf_conntrack_tcp_timeout_close_wait=10     # default is 60
      - net.netfilter.nf_conntrack_tcp_timeout_unacknowledged=30 # default is 300
      - net.netfilter.nf_conntrack_tcp_timeout_established=10800 # 3h, default is 5 days
      - net.netfilter.nf_conntrack_icmp_timeout=10 # default is 30
      - net.netfilter.nf_conntrack_udp_timeout=10  # default is 30
      # - net.nf_conntrack_udp_timeout_stream=       # leave as default of 120
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}/run/vpn:/sf/run/vpn"  # Between all VPNs
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
      - "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"

  cryptostorm:
    image: hackerschoice/cryptostorm
    container_name: sf-cryptostorm
    cgroup_parent: sf.slice
    restart: "no"
    depends_on:
      - dnsmasq
      - sf-redis
      - router
    dns: ${SF_NET_VPN_DNS_IP}
    cap_add:
      - NET_ADMIN #required
    environment:
      - CONFIG=${SF_CRYPTOSTORM_CONFIG:-}
      - PROVIDER=CryptoStorm
      - NETWORK=${SF_NET_LG}
      - NET_VPN_ROUTER_IP=${SF_NET_VPN_ROUTER_IP}
      - DNS=1.1.1.1 # Cryptostorm's DNS is often broken
      - POST_UP=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-cryptostorm.log up %i
      - PRE_DOWN=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-cryptostorm.log down %i
      - RECONNECT=604800 # Re-Connect every 7 days
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
      - SF_DEBUG
    networks:
      vpn-net:
        ipv4_address: ${SF_CRYPTOSTORM_IP}
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
      - net.ipv4.conf.all.rp_filter=2
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1 # SNAT
      - net.netfilter.nf_conntrack_frag6_timeout=10
      - net.netfilter.nf_conntrack_generic_timeout=180           # default is 600
      - net.netfilter.nf_conntrack_tcp_timeout_syn_sent=10       # default is 120
      - net.netfilter.nf_conntrack_tcp_timeout_syn_recv=5        # default is 30, 5 because of reverse tunnels (CS)
      - net.netfilter.nf_conntrack_tcp_timeout_last_ack=5        # default is 30
      - net.netfilter.nf_conntrack_tcp_timeout_fin_wait=10       # default is 120
      - net.netfilter.nf_conntrack_tcp_timeout_close=1           # default is 10
      - net.netfilter.nf_conntrack_tcp_timeout_close_wait=10     # default is 60
      - net.netfilter.nf_conntrack_tcp_timeout_unacknowledged=30 # default is 300
      - net.netfilter.nf_conntrack_tcp_timeout_established=10800 # 3h, default is 5 days
      - net.netfilter.nf_conntrack_icmp_timeout=10 # default is 30
      - net.netfilter.nf_conntrack_udp_timeout=10  # default is 30
      # - net.nf_conntrack_udp_timeout_stream=       # leave as default of 120
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}/run/vpn:/sf/run/vpn"  # Between all VPNs
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
      - "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
    # entrypoint: sleep infinity  # FIXME-TESTING


  mullvad:
    image: hackerschoice/cryptostorm
    container_name: sf-mullvad
    restart: "no"
    cgroup_parent: sf.slice
    depends_on:
      - dnsmasq
      - sf-redis
      - router
    dns: ${SF_NET_VPN_DNS_IP}
    cap_add:
      - NET_ADMIN #required
    environment:
      - CONFIG=${SF_MULLVAD_CONFIG:-}
      - PROVIDER=Mullvad
      - NETWORK=${SF_NET_LG}
      - NET_VPN_ROUTER_IP=${SF_NET_VPN_ROUTER_IP}
      - IS_REDIRECTS_DNS=1
      - POST_UP=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-mullvad.log up %i
      - PRE_DOWN=/sf/bin/vpn_wg2status.sh /sf/run/vpn/status-mullvad.log down %i
      - RECONNECT=604800 # Re-Connect every 7 days
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
      - SF_DEBUG
    networks:
      vpn-net:
        ipv4_address: ${SF_MULLVAD_IP}
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
      - net.ipv4.conf.all.rp_filter=2
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1 # SNAT
      - net.netfilter.nf_conntrack_frag6_timeout=10
      - net.netfilter.nf_conntrack_generic_timeout=180           # default is 600
      - net.netfilter.nf_conntrack_tcp_timeout_syn_sent=10       # default is 120
      - net.netfilter.nf_conntrack_tcp_timeout_syn_recv=1        # default is 30
      - net.netfilter.nf_conntrack_tcp_timeout_last_ack=5        # default is 30
      - net.netfilter.nf_conntrack_tcp_timeout_fin_wait=10       # default is 120
      - net.netfilter.nf_conntrack_tcp_timeout_close=1           # default is 10
      - net.netfilter.nf_conntrack_tcp_timeout_close_wait=10     # default is 60
      - net.netfilter.nf_conntrack_tcp_timeout_unacknowledged=30 # default is 300
      - net.netfilter.nf_conntrack_tcp_timeout_established=10800 # 3h, default is 5 days
      - net.netfilter.nf_conntrack_icmp_timeout=10 # default is 30
      - net.netfilter.nf_conntrack_udp_timeout=10  # default is 30
      # - net.nf_conntrack_udp_timeout_stream=       # leave as default of 120
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}/run/vpn:/sf/run/vpn"  # Between all VPNs
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
      - "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"

  novpn:
    build: router
    image: sf-router
    hostname: sf-novpn
    container_name: sf-novpn
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    depends_on:
      - dnsmasq
      - sf-redis
      - router
    cap_add:
      - NET_ADMIN #required
    environment:
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
      - NET_LG=${SF_NET_LG:?}
      - NET_VPN_ROUTER_IP=${SF_NET_VPN_ROUTER_IP:?}
      - SF_NOVPN_IP=${SF_NOVPN_IP}
      - PROVIDER=NoVPN
      - SF_DIRECT
      - SF_DEBUG
    networks:
      vpn-net:
        ipv4_address: ${SF_NOVPN_IP}
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
      - net.ipv4.conf.all.rp_filter=2
      - net.ipv4.ip_forward=1
      - net.netfilter.nf_conntrack_frag6_timeout=10
      - net.netfilter.nf_conntrack_generic_timeout=180           # default is 600
      - net.netfilter.nf_conntrack_tcp_timeout_syn_sent=10       # default is 120
      - net.netfilter.nf_conntrack_tcp_timeout_syn_recv=1        # default is 30
      - net.netfilter.nf_conntrack_tcp_timeout_last_ack=5        # default is 30
      - net.netfilter.nf_conntrack_tcp_timeout_fin_wait=10       # default is 120
      - net.netfilter.nf_conntrack_tcp_timeout_close=1           # default is 10
      - net.netfilter.nf_conntrack_tcp_timeout_close_wait=10     # default is 60
      - net.netfilter.nf_conntrack_tcp_timeout_unacknowledged=30 # default is 300
      - net.netfilter.nf_conntrack_tcp_timeout_established=10800 # 3h, default is 5 days
      - net.netfilter.nf_conntrack_icmp_timeout=10 # default is 30
      - net.netfilter.nf_conntrack_udp_timeout=10  # default is 30
      # - net.nf_conntrack_udp_timeout_stream=       # leave as default of 120
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}/run/vpn:/sf/run/vpn"  # Between all VPNs
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
      - "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
    entrypoint: ["/init-novpn.sh"]

  router:
    build: router
    image: sf-router
    hostname: sf-router
    container_name: sf-router
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    depends_on:
      - router-fix-network
    networks:
      incoming-net:
        ipv4_address: ${SF_NET_DIRECT_ROUTER_IP}
      vpn-net:
        ipv4_address: ${SF_NET_VPN_ROUTER_IP}
      guest-net:
        ipv4_address: ${SF_NET_LG_ROUTER_IP_DUMMY} # Will be replaced by init.sh with x.x.x.1
      access-net:
        ipv4_address: ${SF_NET_ACCESS_ROUTER_IP}
      dmz-net:
        ipv4_address: ${SF_NET_DMZ_ROUTER_IP}
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1 # SNAT
      - net.ipv4.conf.all.rp_filter=2
      - net.netfilter.nf_conntrack_frag6_timeout=10
      - net.netfilter.nf_conntrack_generic_timeout=180           # default is 600
      - net.netfilter.nf_conntrack_tcp_timeout_syn_sent=10       # default is 120
      - net.netfilter.nf_conntrack_tcp_timeout_syn_recv=5        # default is 30, 5 because of reverse tunnels (sf-router)
      - net.netfilter.nf_conntrack_tcp_timeout_last_ack=5        # default is 30
      - net.netfilter.nf_conntrack_tcp_timeout_fin_wait=10       # default is 120
      - net.netfilter.nf_conntrack_tcp_timeout_close=1           # default is 10
      - net.netfilter.nf_conntrack_tcp_timeout_close_wait=10     # default is 60
      - net.netfilter.nf_conntrack_tcp_timeout_unacknowledged=30 # default is 300
      - net.netfilter.nf_conntrack_tcp_timeout_established=10800 # 3h, default is 5 days
      - net.netfilter.nf_conntrack_icmp_timeout=10 # default is 30
      - net.netfilter.nf_conntrack_udp_timeout=10  # default is 30
      # - net.nf_conntrack_udp_timeout_stream=       # leave as default of 120
    ports:
      - "${SF_SSH_PORT:-22}:22"
      - "${SF_SSH_PORT2:-443}:22"
    environment:
      - SF_DEBUG
      - SF_MAXOUT
      - SF_MAXIN
      - NET_LG=${SF_NET_LG:?}
      - NET_LG_ROUTER_IP=${SF_NET_LG_ROUTER_IP:?}
      - NET_LG_ROUTER_IP_DUMMY=${SF_NET_LG_ROUTER_IP_DUMMY:?}
      - NET_VPN=${SF_NET_VPN:?}
      - NET_ONION=${SF_NET_ONION:?}
      - MULLVAD_ROUTE=${SF_MULLVAD_ROUTE:-10.124.0.0/22}
      - TOR_IP=${SF_TOR_IP:?}
      - NOVPN_IP=${SF_NOVPN_IP:?}
      - GSNC_IP=${SF_GSNC_IP:?}
      - SSHD_IP=${SF_SSHD_IP:?}
      - NGINX_IP=${SF_NGINX_IP:?}
      - RPC_IP=${SF_RPC_IP:?}
      - NET_DIRECT_ROUTER_IP=${SF_NET_DIRECT_ROUTER_IP:?}
      - NET_DIRECT_BRIDGE_IP=${SF_NET_DIRECT_BRIDGE_IP:?}
      - NET_VPN_ROUTER_IP=${SF_NET_VPN_ROUTER_IP:?}
      - NET_VPN_DNS_IP=${SF_NET_VPN_DNS_IP:?}
      - NET_ACCESS_ROUTER_IP=${SF_NET_ACCESS_ROUTER_IP:?}
      - NET_DMZ_ROUTER_IP=${SF_NET_DMZ_ROUTER_IP:?}
      - SF_DIRECT
      - SF_NORDVPN_IP=${SF_NORDVPN_IP:?}
      - SF_CRYPTOSTORM_IP=${SF_CRYPTOSTORM_IP:?}
      - SF_MULLVAD_IP=${SF_MULLVAD_IP:?}
      - SF_GUEST_MTU=${SF_GUEST_MTU:-1420}
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}/run:/sf/run"
      - "${SF_BASEDIR:-.}/config/db:/config/db:ro"
      - "${SF_BASEDIR:-.}/config/etc/sf:/config/host/etc/sf:ro"
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
    entrypoint: ["/init.sh"]

  # The master for modifying other containers
  # - Set default routes
  # - Retrieve dmesg
  # - Set WireGuard routes for FOB
  master:
    build: master
    image: sf-master
    hostname: sf-master
    container_name: sf-master
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    depends_on:
      - sf-redis
    network_mode: none
    dns: ${SF_NET_VPN_DNS_IP}
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN   # For nsenter
      - SYSLOG      # For dmesg
    pid: "host"     # For nsenter
    devices:
      - "/dev/net/tun:/dev/net/tun"
    environment:
      - SF_DEBUG
      - SF_FQDN=${SF_FQDN:-SF_FQDN-NOT-SET.hack.segfault.net}
      - WG_EP_IP=${SF_IP}
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
      - SF_RPC_IP=${SF_RPC_IP:?}
      - SF_TOR_IP=${SF_TOR_IP:?}
      - SF_NET_ONION=${SF_NET_ONION:?}
      - WG_IPS=${SF_WG_IPS:-172.16.0.x/16,fd:16::x/104}
      - SF_MULLVAD_ROUTE=${SF_MULLVAD_ROUTE:?}
      - SF_DNS=${SF_NET_VPN_DNS_IP}
      - SF_NET_LG_ROUTER_IP=${SF_NET_LG_ROUTER_IP:?}
      - SF_HOST_MTU=${SF_HOST_MTU:-1500}
      - SF_GUEST_MTU=${SF_GUEST_MTU:-1420}
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}:/dev/shm/sf"
      - "${SF_BASEDIR:-.}/config/db:/config/db"
      - "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
      - "${SF_BASEDIR:-.}/config/etc/sf:/config/host/etc/sf:ro"
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
      - "/sys/fs/cgroup/sf.slice/sf-guest.slice:/sf-cgroup"
      # - "/research/segfault/sfbin:/sf/bin:ro"  # FIXME-2022
      - "/var/run/docker.sock:/var/run/docker.sock"
      # - /research/segfault/master/cgi-bin:/cgi-bin:ro # FIXME-2022
    entrypoint: ["/init-master.sh"]

  rpc:
    image: nginx
    container_name: sf-rpc
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    depends_on:
      - master
    networks:
      guest-net:
        ipv4_address: ${SF_RPC_IP}
    dns: 255.255.255.255
    entrypoint: ["nginx", "-g", "daemon off;"]
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}:/dev/shm/sf"
      - "${SF_BASEDIR:-.}/config/db:/config/db"
      - "${SF_BASEDIR:-.}/config/etc/nginx/nginx-rpc.conf:/etc/nginx/nginx.conf:ro"

  wg:
    build: router
    image: sf-router
    hostname: sf-wg
    container_name: sf-wg
    restart: ${SF_RESTART:-on-failure}:1  # Try 1 restart
    cgroup_parent: sf.slice
    depends_on:
      - router-fix-network
    networks:
      incoming-net:
        ipv4_address: ${SF_NET_DIRECT_WG_IP}
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1 # SNAT
      - net.ipv4.conf.all.rp_filter=2
      - net.netfilter.nf_conntrack_frag6_timeout=10
      - net.netfilter.nf_conntrack_generic_timeout=180           # default is 600
      - net.netfilter.nf_conntrack_tcp_timeout_syn_sent=10       # default is 120
      - net.netfilter.nf_conntrack_tcp_timeout_syn_recv=1        # default is 30
      - net.netfilter.nf_conntrack_tcp_timeout_last_ack=5        # default is 30
      - net.netfilter.nf_conntrack_tcp_timeout_fin_wait=10       # default is 120
      - net.netfilter.nf_conntrack_tcp_timeout_close=1           # default is 10
      - net.netfilter.nf_conntrack_tcp_timeout_close_wait=10     # default is 60
      - net.netfilter.nf_conntrack_tcp_timeout_unacknowledged=30 # default is 300
      - net.netfilter.nf_conntrack_tcp_timeout_established=10800 # 3h, default is 5 days
      - net.netfilter.nf_conntrack_icmp_timeout=10 # default is 30
      - net.netfilter.nf_conntrack_udp_timeout=10  # default is 30
      # - net.nf_conntrack_udp_timeout_stream=       # leave as default of 120
    environment:
      - SF_DEBUG
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}/run/vpn:/sf/run/vpn"
      - "${SF_BASEDIR:-.}/config/etc/sf:/config/host/etc/sf:ro"
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest" # vpn_status to guest
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
    entrypoint: ["/init-wg.sh"]

  router-fix-network:
    build: router
    image: sf-router
    container_name: sf-fix-network
    restart: ${SF_RESTART:-on-failure}:1  # Try 1 restart
    cgroup_parent: sf.slice
    network_mode: host # host's stack
    privileged: true  # For 'sysctl -w' in fix-network.sh
    cap_add:
      - NET_ADMIN
    environment:
      - SF_DEBUG
      - NET_LG_ROUTER_IP=${SF_NET_LG_ROUTER_IP:?}
      - NET_DIRECT_WG_IP=${SF_NET_DIRECT_WG_IP:?}
      - NET_DIRECT_ROUTER_IP=${SF_NET_DIRECT_ROUTER_IP:?}
      - NET_DIRECT_BRIDGE_IP=${SF_NET_DIRECT_BRIDGE_IP:?}
    volumes:
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
    entrypoint: ["/fix-network.sh"]

  tor:
    build: tor
    image: sf-tor
    container_name: sf-tor
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    hostname: sf-tor
    networks:
      vpn-net:
        ipv4_address: ${SF_TOR_IP}
    cap_add:
      - NET_ADMIN
    environment:
      - SF_DEBUG
      - SF_TOR_VIA_VPN
      - NET_LG=${SF_NET_LG:?}
      - SSHD_IP=${SF_SSHD_IP:?}
      - NGINX_IP=${SF_NGINX_IP:?}
      - NET_VPN_ROUTER_IP=${SF_NET_VPN_ROUTER_IP:?}
    dns: ${SF_NET_VPN_DNS_IP}
    depends_on:
      - dnsmasq
      - nginx
    volumes:
      - "${SF_BASEDIR:-.}/config/${SF_FQDN:-SF_FQDN-NOT-SET.hack.segfault.net}/tor/hidden:/var/lib/tor/hidden"
      - "${SF_BASEDIR:-.}/config/etc/tor:/config/host/etc/tor:ro"
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest"

  gsnc:
    build: gsnc
    image: sf-gsnc
    container_name: sf-gsnc
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    networks:
      access-net:
        ipv4_address: ${SF_GSNC_IP}
    dns: ${SF_NET_ACCESS_DNS_IP}
    cap_add:
      - NET_ADMIN # need to set default route via sf-router
    depends_on:
      - dnsmasq
      - router
    environment:
      - SF_SSH_PORT=${SF_SSH_PORT:-22}
      - SF_FQDN=${SF_FQDN:-SF_FQDN-NOT-SET.hack.segfault.net}
      - SF_DEBUG
      - SF_SEED=${SF_SEED}
      - SSHD_IP=${SF_SSHD_IP}
    volumes:
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest"
    entrypoint: ["/sf-gsnc.sh", "${SF_SSHD_IP}"]

  segfault:
    build: host
    image: sf-host
    # /bin/segfaultsh need to know the container name; set it to sf-host statically
    container_name: sf-host
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    networks:
      # WARNING: sshd's port forward/socks can access those networks.
      access-net:
        ipv4_address: ${SF_SSHD_IP}
    dns: ${SF_NET_ACCESS_DNS_IP}
    cap_add:
      - NET_ADMIN # need to set default route via sf-router
      - SYS_ADMIN # Move non-priv sshd to guest's network Namespace (setns())
      - SYS_PTRACE # needed for debugging (/bin/sf_trace)
    pid: host # Move non-priv sshd to guest's network NameSpace.
    depends_on:
      - dnsmasq
      - router
      - sf-encfsd
    init: true
    # SSHD clears all environment variables before spwaning a shell (segfaultsh).
    # Add any variables to docker_sshd.sh as well.
    environment:
      - SF_CG_PARENT=${SF_CG_PARENT:-sf-guest.slice}
      - SF_DNS=${SF_NET_VPN_DNS_IP}  # passed to sf-guest
      - SF_TOR_IP=${SF_TOR_IP}
      - SF_BASEDIR=${SF_BASEDIR}
      - SF_SHMDIR=${SF_SHMDIR:-/dev/shm/sf}
      - SF_USER=${SF_USER:-root}
      - SF_USER_PASSWORD=${SF_USER_PASSWORD:-segfault}
      - SF_FQDN=${SF_FQDN:-SF_FQDN-NOT-SET.hack.segfault.net}
      - SF_REDIS_AUTH=${SF_REDIS_AUTH}
      - SF_RPC_IP=${SF_RPC_IP}
      - SF_NET_LG_ROUTER_IP=${SF_NET_LG_ROUTER_IP:?}
      - SF_SEED=${SF_SEED}
      - SF_HM_SIZE_LG=8
      - SF_DIRECT
      - SF_DEBUG
      - SF_BACKING_FS
      # - SF_DEBUG_SSHD=1  # FIXME-TESTING sshd debug
    volumes:
      - "${SF_BASEDIR:-.}/config:/config/host"
      - "${SF_BASEDIR:-.}/data/share:/sf/share:ro"
      - "${SF_BASEDIR:-.}/data/ext:/sf/ext:ro"
      - "${SF_BASEDIR:-.}/sfbin:/sf/bin:ro"
      - "${SF_SHMDIR:-/dev/shm/sf}/run:/sf/run"
      - "${SF_SHMDIR:-/dev/shm/sf}/encfs-sec/www-root:/sec/www-root:slave"
      - "${SF_SHMDIR:-/dev/shm/sf}/config-for-guest:/config/guest"
      - "${SF_SHMDIR:-/dev/shm/sf}/self-for-guest:/config/self-for-guest"
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "/var/lib/lxcfs:/var/lib/lxcfs:ro"
      - "${SF_SHMDIR:-/dev/shm/sf}/run/redis/sock:/redis-sock"
      # - /research/segfault/host/fs-root/bin/segfaultsh:/bin/segfaultsh:ro # FIXME-TESTING
      # - /research/segfault/host:/host:ro # FIXME-TESTING sshd debug

  nginx:
    image: nginx
    container_name: sf-nginx
    restart: ${SF_RESTART:-on-failure}
    cgroup_parent: sf.slice
    depends_on:
      - sf-encfsd
    entrypoint: ["/sf/bin/wait_semaphore.sh", "/sec/.IS-ENCRYPTED", "nginx", "-g", "daemon off;"]
    networks:
      dmz-net:
        ipv4_address: ${SF_NGINX_IP}
    dns: 255.255.255.255
    volumes:
      - "${SF_BASEDIR:-.}/sfbin/wait_semaphore.sh:/sf/bin/wait_semaphore.sh:ro"
      - "${SF_SHMDIR:-/dev/shm/sf}/encfs-sec/www-root:/sec:slave,ro"
      - "${SF_BASEDIR:-.}/config/etc/nginx/nginx.conf:/etc/nginx/nginx.conf:ro"

networks:
  # Force docker0 
  default:
    driver: bridge
    driver_opts:
      com.docker.network.driver.mtu: ${SF_HOST_MTU:-1500}

  vpn-net:
    name: sf-vpn
    driver: bridge
    driver_opts:
      com.docker.network.driver.mtu: ${SF_HOST_MTU:-1500}
    ipam:
      config:
      - subnet: ${SF_NET_VPN:?}

  incoming-net:
    # Note: 'name' must be the first in alphabetic order. Docker forwards
    # the host's port to the _first_ network (in alphanetic order). sf-router
    # expects all host traffic to arrive at SF_NET_DIRECT_ROUTE_IP.
    name: A-sf-direct
    driver: bridge
    driver_opts:
      com.docker.network.driver.mtu: ${SF_HOST_MTU:-1500}
    ipam:
      config:
      - subnet: ${SF_NET_DIRECT:?}

  access-net:
    # sf-host and gsnc
    name: sf-access
    driver: bridge
    driver_opts:
      com.docker.network.driver.mtu: ${SF_HOST_MTU:-1500}
    ipam:
      config:
      - subnet: ${SF_NET_ACCESS:?}

  dmz-net:
    name: sf-dmz
    driver: bridge
    driver_opts:
      com.docker.network.driver.mtu: ${SF_HOST_MTU:-1500}
    ipam:
      config:
        - subnet: ${SF_NET_DMZ:?}

  dns-doh-net:
    name: sf-dns-doh
    driver: bridge
    driver_opts:
      com.docker.network.driver.mtu: ${SF_HOST_MTU:-1500}
    ipam:
      config:
        - subnet: ${SF_NET_DOH:?}

  # User's shell
  guest-net:
    name: sf-guest
    driver: bridge
    driver_opts:
      com.docker.network.driver.mtu: ${SF_GUEST_MTU:-1420}
    # Can not use 'internal'. This will only remvoe the host's bridge
    # but this also means we can not route via 10.11.0.* even if we can
    # ping the router.
    # internal: true
    ipam:
      config:
        - subnet: ${SF_NET_LG:?}
          # gateway: 10.11.0.1 # Set's the IP of the host's bridge.

        # 255 hosts. BUG-ARP-CACHE
        # default gw is always 10.11.0.1 and is the host side of the bridge (?)
        # The init.sh script in sf-router will overwrite it's own interface with 10.11.0.1
        # so that the sf-router receives all traffic.