From 4c207ae6ab1f341035365cfcf613532cf1168d5e Mon Sep 17 00:00:00 2001 From: Sudipto Chandra Date: Mon, 15 Jun 2026 09:23:27 +0400 Subject: [PATCH 1/4] Update .env.example --- .env.example | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.env.example b/.env.example index d44d3f8..458c7ed 100644 --- a/.env.example +++ b/.env.example @@ -15,4 +15,4 @@ CONTROL_HOST=0.0.0.0 # Comma-separated IP/CIDR allow-list for the SOCKS proxy. # Default: RFC 1918 private ranges + loopback. -SOCKS_POLICY=accept 127.0.0.1,accept 10.0.0.0/8,accept 172.16.0.0/12,accept 192.168.0.0/16 +SOCKS_POLICY=accept 127.0.0.1,accept 10.0.0.0/8,accept 172.16.0.0/12,accept 192.168.0.0/16,reject * From e518cfabde7e73d7951657b043deb0e7fb97868e Mon Sep 17 00:00:00 2001 From: Sudipto Chandra Date: Mon, 15 Jun 2026 09:24:35 +0400 Subject: [PATCH 2/4] Update compose.yml --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 16a163d..371efb1 100644 --- a/compose.yml +++ b/compose.yml @@ -22,7 +22,7 @@ services: CONTROL_HOST: '${CONTROL_HOST:-0.0.0.0}' # Which source IPs may use the proxy. - SOCKS_POLICY: '${SOCKS_POLICY:-accept 127.0.0.1,accept 10.0.0.0/8,accept 172.16.0.0/12,accept 192.168.0.0/16}' + SOCKS_POLICY: '${SOCKS_POLICY:-accept 127.0.0.1,accept 10.0.0.0/8,accept 172.16.0.0/12,accept 192.168.0.0/16,reject *}' ports: # SOCKS5 proxy — your scraper connects here From 8b364970558ae9a0e183c2c2e2abed98c630a49a Mon Sep 17 00:00:00 2001 From: Sudipto Chandra Date: Mon, 15 Jun 2026 09:25:51 +0400 Subject: [PATCH 3/4] Update entrypoint.sh --- docker/entrypoint.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh index 8461e61..4181b7e 100644 --- a/docker/entrypoint.sh +++ b/docker/entrypoint.sh @@ -18,7 +18,6 @@ SocksPort ${SOCKS_HOST}:9150 # Accept policy: allow only the listed CIDRs, reject everything else. $(echo "${SOCKS_POLICY}" | tr ',' '\n' | sed 's/^ */SocksPolicy /') -SocksPolicy reject * # === Control port (used by stem for NEWNYM / circuit rotation) === ControlPort ${CONTROL_HOST}:9151 @@ -34,4 +33,4 @@ echo "[tor-proxy] SOCKS5 -> ${SOCKS_HOST}:9150" echo "[tor-proxy] Control -> ${CONTROL_HOST}:9151 (password auth)" # Run as the 'tor' user created by the apk package. -exec su-exec tor tor -f /etc/tor/torrc "$@" \ No newline at end of file +exec su-exec tor tor -f /etc/tor/torrc "$@" From 11dfa2e4f4698d5acb5e88704be92e2913d4f1e9 Mon Sep 17 00:00:00 2001 From: Sudipto Chandra Date: Mon, 15 Jun 2026 09:26:38 +0400 Subject: [PATCH 4/4] Update Dockerfile --- docker/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 0753171..fc149af 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -22,6 +22,6 @@ EXPOSE 9150 9151 ENV CONTROL_PASSWORD="changeme" \ SOCKS_HOST="0.0.0.0" \ CONTROL_HOST="0.0.0.0" \ - SOCKS_POLICY="accept 127.0.0.1,accept 10.0.0.0/8,accept 172.16.0.0/12,accept 192.168.0.0/16" + SOCKS_POLICY="accept 127.0.0.1,accept 10.0.0.0/8,accept 172.16.0.0/12,accept 192.168.0.0/16,reject *" ENTRYPOINT ["/entrypoint.sh"]