host
eae60cf3d7
- AppArmor network rules must use socket types (stream/dgram), not protocol names (tcp/udp/icmp): the parser rejected the profile (Invalid network entry) until fixed. - Tinyproxy has no 'Upstream none' syntax; the line failed the service at startup. Direct connection is the default, so the line is removed. - Tinyproxy Filter is POSIX BASIC regex, not extended: the extended-style anchored patterns denied even allowed domains (verified: xcmapi.org got 403). Rewritten in basic syntax (\(...\)* groups); the anchored form still blocks evilgithub.com and xcmapi.org.evil.com (verified on host). - Filter file must be world-readable (was 640 root:root, so tinyproxy could not read it and exited on reload); install steps now chmod 644 (documented in the filter header via the install note in tinyproxy.conf). Host already runs these exact files (proxy allow/block verified: xcmapi/github/api.github 200, example/evilgithub/ xcmapi.org.evil.com 403).
53 lines
2.1 KiB
Plaintext
53 lines
2.1 KiB
Plaintext
# Tinyproxy egress allowlist for codex task containers.
|
|
#
|
|
# Only domains in the Filter file are reachable. Everything else
|
|
# gets 403 from the proxy (fail closed: a task that needs a new
|
|
# domain fails loudly instead of silently bypassing the list).
|
|
#
|
|
# Domains (one per line in tinyproxy-filter):
|
|
# - xcmapi.org: model relay (the only model endpoint tasks need)
|
|
# - github.com, *.githubusercontent.com: git clone/fetch
|
|
# - pypi.org, files.pythonhosted.org: pip install
|
|
# - registry.npmjs.org: npm install
|
|
# Add a domain here + reload tinyproxy when a legitimate task need
|
|
# appears; never add a wildcard like * (that voids the list).
|
|
#
|
|
# Install on host:
|
|
# apt-get install -y tinyproxy
|
|
# cp tinyproxy.conf /etc/tinyproxy/tinyproxy.conf
|
|
# cp tinyproxy-filter /etc/tinyproxy/tinyproxy-filter
|
|
# systemctl enable tinyproxy && systemctl restart tinyproxy
|
|
# Worker: --egress-proxy-port 8888 (containers reach the proxy via
|
|
# their network gateway IP, e.g. http://172.18.0.1:8888).
|
|
# Firewall (host, restricts WHO can use the proxy to containers):
|
|
# iptables -A INPUT -p tcp --dport 8888 -s 172.16.0.0/12 -j ACCEPT
|
|
# iptables -A INPUT -p tcp --dport 8888 -s 127.0.0.1 -j ACCEPT
|
|
# iptables -A INPUT -p tcp --dport 8888 -j DROP
|
|
# (Docker bridge subnets live in 172.16.0.0/12; the host LAN is
|
|
# NOT in that range, so LAN hosts cannot use the proxy.)
|
|
|
|
User tinyproxy
|
|
Group tinyproxy
|
|
Port 8888
|
|
Listen 0.0.0.0
|
|
Timeout 600
|
|
LogLevel Info
|
|
PidFile "/run/tinyproxy/tinyproxy.pid"
|
|
MaxClients 100
|
|
MinSpareServers 5
|
|
MaxSpareServers 20
|
|
StartServers 10
|
|
DefaultErrorFile "/usr/share/tinyproxy/default.html"
|
|
StatFile "/usr/share/tinyproxy/stats.html"
|
|
# CONNECT is required for HTTPS (relay + git are HTTPS).
|
|
ConnectPort 443
|
|
ConnectPort 80
|
|
# Allowlist: deny everything not in the filter file.
|
|
FilterDefaultDeny Yes
|
|
Filter "/etc/tinyproxy/tinyproxy-filter"
|
|
# No Upstream directive: direct connection is Tinyproxy's default.
|
|
# (There is no valid "Upstream none" syntax; an invalid line here
|
|
# used to fail the whole service at startup.)
|
|
# Do not forward proxy headers that leak container info.
|
|
DisableViaHeader Yes
|