add(app): Tor Socks Proxy #5333
Conversation
WalkthroughA new configuration for the "Tor Socks Proxy" application has been introduced, including a JSON file defining its properties, a Docker Compose file for service management, and a markdown description file. The configuration specifies the application as a Tor Socks5 proxy within a Docker container, detailing its operational parameters, service setup, and user instructions. Changes
Possibly related PRs
Suggested reviewers
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Outside diff range and nitpick comments (6)
apps/tor-socks-proxy/docker-compose.yml (1)
4-11: Add security hardening configurations.Consider adding security-related configurations to enhance container security:
tor-socks-proxy: container_name: tor-socks-proxy image: peterdavehello/tor-socks-proxy:latest restart: unless-stopped + security_opt: + - no-new-privileges:true + read_only: true + cap_drop: + - ALL ports: - ${APP_PORT}:9150/tcp networks: - tipi_main_networkapps/tor-socks-proxy/metadata/description.md (5)
1-11: Enhance accessibility and update status badgesPlease add alt text to images for better accessibility and consider updating the CI badge:
<p align="center"> - <img width="300px" src="https://upload.wikimedia.org/wikipedia/commons/8/8f/Tor_project_logo_hq.png"> + <img width="300px" alt="Tor Project Logo" src="https://upload.wikimedia.org/wikipedia/commons/8/8f/Tor_project_logo_hq.png"> </p>Consider replacing Travis CI with GitHub Actions status badge as Travis CI is less commonly used now.
🧰 Tools
🪛 Markdownlint
2-2: null
Images should have alternate text (alt text)(MD045, no-alt-text)
28-66: Add proxy validation stepsThe usage instructions are clear, but consider adding steps to verify the proxy is working correctly:
- How to verify Tor connectivity
- How to check if traffic is actually routing through Tor
- How to verify DNS is not leaking
Add the following example:
curl --socks5-hostname 127.0.0.1:9150 https://ipinfo.tw/ip + +# Verify Tor connectivity +curl --socks5-hostname 127.0.0.1:9150 https://check.torproject.org/api/ip + +# Check for DNS leaks +curl --socks5-hostname 127.0.0.1:9150 https://dnsleaktest.com/🧰 Tools
🪛 LanguageTool
[uncategorized] ~36-~36: Loose punctuation mark.
Context: ...s-proxy:latest ``` ---restart=always: This ensures the container automaticall...(UNLIKELY_OPENING_PUNCTUATION)
[uncategorized] ~37-~37: Loose punctuation mark.
Context: ... reboots. --p 127.0.0.1:9150:9150/tcp: This binds the container to localhost, ...(UNLIKELY_OPENING_PUNCTUATION)
68-82: Enhance DNS security guidance and IP renewal detailsThe DNS configuration needs additional security context:
- Warn about potential DNS leaks if not configured correctly
- Explain why using Tor's DNS might be necessary
- Document the implications of different IP renewal intervals
Also, consider adding information about Tor circuit renewal:
## IP Renewal By default, Tor automatically changes IPs every 10 minutes. You can manually renew the IP by restarting the container: + +The IP renewal process creates a new Tor circuit, which: +- Provides a new exit node IP address +- Helps maintain anonymity +- May be necessary if the current exit node is blocked
83-93: Fix markdown formatting issuesPlease address the following markdown issues:
-<a href="https://m.do.co/c/1fdd0a1d695a"><img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" width="201px"></a> +<a href="https://m.do.co/c/1fdd0a1d695a"><img alt="DigitalOcean Logo" src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" width="201px"></a> -For cloud VPS hosting with $200 in free credit, consider using my DigitalOcean referral link: https://m.do.co/c/1fdd0a1d695a +For cloud VPS hosting with $200 in free credit, consider using my [DigitalOcean referral link](https://m.do.co/c/1fdd0a1d695a)🧰 Tools
🪛 Markdownlint
89-89: null
Bare URL used(MD034, no-bare-urls)
85-85: null
Images should have alternate text (alt text)(MD045, no-alt-text)
1-93: Documentation provides good coverage but needs security emphasisThe documentation comprehensively covers setup and usage. However, given that this is a Tor proxy intended for sensitive applications (as mentioned in PR objectives for "arr" applications), consider:
- Adding a dedicated "Security Considerations" section
- Providing guidance on monitoring for potential security issues
- Including troubleshooting steps for common problems
🧰 Tools
🪛 LanguageTool
[uncategorized] ~36-~36: Loose punctuation mark.
Context: ...s-proxy:latest ``` ---restart=always: This ensures the container automaticall...(UNLIKELY_OPENING_PUNCTUATION)
[uncategorized] ~37-~37: Loose punctuation mark.
Context: ... reboots. --p 127.0.0.1:9150:9150/tcp: This binds the container to localhost, ...(UNLIKELY_OPENING_PUNCTUATION)
🪛 Markdownlint
89-89: null
Bare URL used(MD034, no-bare-urls)
2-2: null
Images should have alternate text (alt text)(MD045, no-alt-text)
85-85: null
Images should have alternate text (alt text)(MD045, no-alt-text)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
⛔ Files ignored due to path filters (1)
apps/tor-socks-proxy/metadata/logo.jpgis excluded by!**/*.jpg
📒 Files selected for processing (3)
- apps/tor-socks-proxy/config.json (1 hunks)
- apps/tor-socks-proxy/docker-compose.yml (1 hunks)
- apps/tor-socks-proxy/metadata/description.md (1 hunks)
✅ Files skipped from review due to trivial changes (1)
- apps/tor-socks-proxy/config.json
🧰 Additional context used
🪛 yamllint
apps/tor-socks-proxy/docker-compose.yml
[error] 12-12: no new line character at the end of file
(new-line-at-end-of-file)
[error] 12-12: trailing spaces
(trailing-spaces)
🪛 LanguageTool
apps/tor-socks-proxy/metadata/description.md
[uncategorized] ~36-~36: Loose punctuation mark.
Context: ...s-proxy:latest ``` ---restart=always: This ensures the container automaticall...(UNLIKELY_OPENING_PUNCTUATION)
[uncategorized] ~37-~37: Loose punctuation mark.
Context: ... reboots. --p 127.0.0.1:9150:9150/tcp: This binds the container to localhost, ...(UNLIKELY_OPENING_PUNCTUATION)
🪛 Markdownlint
apps/tor-socks-proxy/metadata/description.md
89-89: null
Bare URL used(MD034, no-bare-urls)
2-2: null
Images should have alternate text (alt text)(MD045, no-alt-text)
85-85: null
Images should have alternate text (alt text)(MD045, no-alt-text)
🔇 Additional comments (2)
apps/tor-socks-proxy/docker-compose.yml (1)
1-12: Verify network configuration with arr applications.The service is connected to
tipi_main_network. Let's verify if this network is properly configured and accessible by the arr applications that will use this proxy.✅ Verification successful
Let me examine the actual network configurations of these arr applications to verify if they're properly connected to the same network as the tor-socks-proxy.
Network configuration is properly set up for all arr applications
All the arr applications (Sonarr, Radarr, and Prowlarr) are correctly configured to use the
tipi_main_networknetwork, which matches the network configuration of the tor-socks-proxy service. This ensures proper network connectivity between these services and the proxy.🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Check network configuration in other arr application compose files # Search for network configuration in arr application compose files echo "Checking network configuration in arr applications:" fd -e yml -e yaml . apps/ --exec grep -l "tipi_main_network" {} \; # Search for potential arr applications that might use this proxy echo -e "\nChecking for arr applications:" fd -e yml -e yaml . apps/ --exec grep -l "prowlarr\|radarr\|sonarr" {} \;Length of output: 9286
Script:
#!/bin/bash # Let's check the network configuration in the arr applications to verify connectivity echo "Checking Sonarr network configuration:" cat apps/sonarr/docker-compose.yml echo -e "\nChecking Radarr network configuration:" cat apps/radarr/docker-compose.yml echo -e "\nChecking Prowlarr network configuration:" cat apps/prowlarr/docker-compose.ymlLength of output: 5960
🧰 Tools
🪛 yamllint
[error] 12-12: no new line character at the end of file
(new-line-at-end-of-file)
[error] 12-12: trailing spaces
(trailing-spaces)
apps/tor-socks-proxy/metadata/description.md (1)
13-27: Add security advisory sectionThe introduction clearly explains the purpose, but consider adding a security advisory section warning users about:
- The importance of binding to localhost only
- Risks of exposing the SOCKS proxy to the network
- Recommendations for securing the proxy if network access is required
Let's check if there are any existing security advisories in the repository:
| services: | ||
| tor-socks-proxy: | ||
| container_name: tor-socks-proxy | ||
| image: peterdavehello/tor-socks-proxy:latest |
There was a problem hiding this comment.
Pin the image to a specific version for security and stability.
Using latest tag can lead to unexpected changes and potential security issues. Consider pinning to a specific version.
- image: peterdavehello/tor-socks-proxy:latest
+ image: peterdavehello/tor-socks-proxy:0.4.7.13📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| image: peterdavehello/tor-socks-proxy:latest | |
| image: peterdavehello/tor-socks-proxy:0.4.7.13 |
| ports: | ||
| - ${APP_PORT}:9150/tcp |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Consider restricting port access to specific networks.
The Tor SOCKS proxy port is currently exposed to all interfaces. For better security, consider binding to specific networks or localhost if possible.
ports:
- - ${APP_PORT}:9150/tcp
+ - 127.0.0.1:${APP_PORT}:9150/tcp📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ports: | |
| - ${APP_PORT}:9150/tcp | |
| ports: | |
| - 127.0.0.1:${APP_PORT}:9150/tcp |
| - ${APP_PORT}:9150/tcp | ||
| networks: | ||
| - tipi_main_network | ||
|
|
There was a problem hiding this comment.
Fix formatting issues.
There are two formatting issues that should be addressed:
- Remove trailing spaces
- Add a newline at the end of file
networks:
- - tipi_main_network
-
+ - tipi_main_network
+Committable suggestion was skipped due to low confidence.
🧰 Tools
🪛 yamllint
[error] 12-12: no new line character at the end of file
(new-line-at-end-of-file)
[error] 12-12: trailing spaces
(trailing-spaces)
Added latest version of Tor Socks Proxy. Repo: here
It's socks5 proxy over Tor network which quite handy in a "arr" (prowlarr, radarr, sonarr) setup if your ISP is blocking certain indexers.
Summary by CodeRabbit
These enhancements streamline the setup and usage of the Tor Socks Proxy, making it more accessible for users.