mirror of
https://github.com/r3bo0tbx1/tor-guard-relay.git
synced 2026-04-06 00:32:04 +02:00
9ed70bdb89
🚀 Major architectural release with a near full rewrite of the entrypoint, validation system, diagnostics, and templates. The image is now ~20MB, fully busybox based, more secure, and more flexible for relay and bridge operators. 🔧 Critical Fixes - Busybox compatible rewrite of OBFS4V_* parsing for values with spaces. - Rewritten TOR_CONTACT_INFO validation to prevent crash loops. - Restored bootstrap logs with Log notice stdout. - Fixed ENV healthchecks and validation order. - Resolved busybox regex and quoting issues across the script. ✨ Features and Enhancements - Added PT_PORT with complete obfs4 bridge compatibility. - Support for OR_PORT, PT_PORT, EMAIL, and NICKNAME. - Rewritten bandwidth logic with correct Rate and Burst translation. - Unified guard, exit, and bridge via TOR_RELAY_MODE. - Integrated obfs4 with rewritten diagnostics for status, health, fingerprint, and bridge-line. - Reliable ENV only mode without torrc files. 📦 Build Improvements - Image reduced ~45MB to ~20MB with busybox only tools. - Rewritten healthcheck for ENV and mounted configs. - Four diagnostic tools rewritten to pure busybox sh. - Weekly rebuilds with latest Alpine and Tor. 📚 Templates and Documentation - All templates rewritten and updated with bandwidth options and naming alternatives. - Updated Cosmos and Docker Compose templates for bridge, guard, exit. - New templates README with full deployment, migration, and config comparisons. - Revised Claude file with clearer differences and bandwidth notes. 🔒 Security Hardening - 32 vulnerabilities fixed across critical, high, medium, low categories. - Non root runtime with UID 100. - Strict OBFS4V_* whitelist and rewritten validation. - No exposed diagnostics ports, docker exec only. - Smaller attack surface with removed binaries. 🚀 Migration Notes - From v1.1.0: direct upgrade, no config changes, fingerprint preserved. - From official obfs4 bridge: one time UID fix required, full ENV compatibility afterward. - Templates include both TOR_ and official naming for smooth migration. 🧩 Compatibility - Alpine 3.22.2 base, latest Tor from edge. - AMD64 and ARM64 supported. - Works with Docker, Compose, Cosmos Cloud, Portainer.
54 lines
1.4 KiB
JSON
54 lines
1.4 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": [
|
|
"config:recommended",
|
|
":preserveSemverRanges",
|
|
":disableDependencyDashboard",
|
|
":prHourlyLimit2"
|
|
],
|
|
|
|
"labels": ["dependencies", "alpine", "docker"],
|
|
"commitMessagePrefix": "build",
|
|
"rebaseWhen": "behind-base-branch",
|
|
"assignees": ["r3bo0tbx1"],
|
|
"reviewers": ["r3bo0tbx1"],
|
|
|
|
"enabledManagers": ["dockerfile"],
|
|
|
|
"packageRules": [
|
|
{
|
|
"matchDatasources": ["docker"],
|
|
"matchPackageNames": ["alpine"],
|
|
"groupName": "🐳 Alpine Base Image",
|
|
"schedule": ["before 3am on monday"],
|
|
"prPriority": 1,
|
|
"automerge": false,
|
|
"allowedVersions": "/^3\\.(2[2-9]|[3-9][0-9])\\./",
|
|
"description": "Track Alpine 3.22+ versions for security updates"
|
|
},
|
|
{
|
|
"matchManagers": ["dockerfile"],
|
|
"excludePackageNames": ["alpine"],
|
|
"groupName": "🐳 Other Docker Images",
|
|
"schedule": ["before 3am on monday"],
|
|
"prPriority": 2,
|
|
"automerge": false
|
|
}
|
|
],
|
|
|
|
"vulnerabilityAlerts": {
|
|
"enabled": true,
|
|
"labels": ["security", "dependencies"],
|
|
"assignees": ["r3bo0tbx1"],
|
|
"schedule": ["at any time"]
|
|
},
|
|
|
|
"osvVulnerabilityAlerts": true,
|
|
"timezone": "UTC",
|
|
"prConcurrentLimit": 5,
|
|
|
|
"customManagers": [],
|
|
|
|
"description": "Renovate tracks only Docker base images. Alpine packages (tor, tini, lyrebird) are NOT pinned and update automatically via weekly rebuilds."
|
|
}
|