Merge pull request #25 from openqj/egress-fixes

Fix egress/AppArmor configs found during host install

deploy/apparmor/docker-codex

@@ -26,14 +26,11 @@
 profile docker-codex flags=(attach_disconnected,mediate_deleted) {
   #include <abstractions/base>
 
-  network inet tcp,
-  network inet udp,
-  network inet icmp,
-  network inet6 tcp,
-  network inet6 udp,
-  network inet6 icmp,
+  network inet stream,
+  network inet dgram,
+  network inet6 stream,
+  network inet6 dgram,
   deny network raw,
-  deny network packet,
 
   capability chown,
   capability dac_override,

deploy/egress/tinyproxy-filter

@@ -1,10 +1,23 @@
-# Tinyproxy Filter lines are extended regexes, matched as substrings
-# unless anchored. A bare "github.com" would also match
-# "evilgithub.com", so every entry is anchored to the domain and
-# its subdomains only.
-^(.+\.)?xcmapi\.org$
-^(.+\.)?github\.com$
-^(.+\.)?githubusercontent\.com$
-^(.+\.)?pypi\.org$
-^(.+\.)?pythonhosted\.org$
-^(.+\.)?npmjs\.org$
+# Tinyproxy Filter: ONE regex per line, matched against the bare
+# domain for CONNECT requests (the log shows e.g. filtered domain
+# "xcmapi.org" -- no scheme, no :port suffix).
+#
+# CRITICAL: Tinyproxy compiles these as POSIX BASIC regex, not
+# extended regex. Extended syntax (+ ? ( ) |) does NOT work here:
+# an extended-style anchored pattern (^(.+\.)?xcmapi\.org$) was
+# verified on 2026-10-26 to deny even xcmapi.org itself, while the
+# basic-syntax equivalent below allows it. In basic regex, groups
+# are \(...\), repetition of a group is \(...\)*, and + ? ( ) are
+# literal characters. Do NOT "modernize" these patterns.
+#
+# Each entry is anchored (^...$) to the domain and its subdomains
+# only: a bare substring "github.com" would also match
+# "evilgithub.com". The \(.*\.\)* prefix matches zero or more
+# "label." segments, so xcmapi.org and api.xcmapi.org match, while
+# notxcmapi.org and xcmapi.org.evil.com do not.
+^\(.*\.\)*xcmapi\.org$
+^\(.*\.\)*github\.com$
+^\(.*\.\)*githubusercontent\.com$
+^\(.*\.\)*pypi\.org$
+^\(.*\.\)*pythonhosted\.org$
+^\(.*\.\)*npmjs\.org$

deploy/egress/tinyproxy.conf

@@ -45,8 +45,8 @@ ConnectPort 80
 # Allowlist: deny everything not in the filter file.
 FilterDefaultDeny Yes
 Filter "/etc/tinyproxy/tinyproxy-filter"
-# Upstream: direct (no parent proxy). The host's own egress is
-# unrestricted; only container traffic goes through this proxy.
-Upstream none
+# No Upstream directive: direct connection is Tinyproxy's default.
+# (There is no valid "Upstream none" syntax; an invalid line here
+# used to fail the whole service at startup.)
 # Do not forward proxy headers that leak container info.
 DisableViaHeader Yes