blob: f03bdce455559b2847f6fe430f13009340fa9fe0 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
# =============================================================================
# VAPORDROP - DOCKER COMPOSE HARDENED
# =============================================================================
services:
vapordrop:
build:
context: .
dockerfile: Dockerfile
volumes:
- ./static:/app/static:ro
- ./file_storage:/app/file_storage
container_name: vapordrop
# =========================================================================
# SICUREZZA CRITICA
# =========================================================================
# Permetti a MemGuard di bloccare la RAM
cap_add:
- IPC_LOCK
# Rimuovi tutte le altre capabilities
cap_drop:
- ALL
# Security options
security_opt:
- no-new-privileges:true
# Seccomp opzionale - può bloccare alcune syscall Tor
# - seccomp:seccomp-profile.json
# Disabilita core dumps
ulimits:
core:
soft: 0
hard: 0
memlock:
soft: -1 # Unlimited - necessario per MemGuard
hard: -1
nofile:
soft: 65536
hard: 65536
# Read-only root filesystem
read_only: true
# Filesystem temporanei in RAM
tmpfs:
- /tmp:size=256M,mode=1777,uid=1000,gid=1000
- /run:size=64M,mode=1777
# =========================================================================
# ENVIRONMENT
# =========================================================================
environment:
# Chiave da passare esternamente
- VAPOR_KEY=${VAPOR_KEY:?VAPOR_KEY è obbligatoria}
# =========================================================================
# NETWORKING
# =========================================================================
# Network isolata
networks:
- vapor_net
# Nessuna porta esposta (solo Hidden Service)
# ports: []
# =========================================================================
# RISORSE
# =========================================================================
deploy:
resources:
limits:
cpus: '2'
memory: 512M
reservations:
cpus: '0.5'
memory: 128M
# =========================================================================
# RESTART POLICY
# =========================================================================
restart: unless-stopped
# =========================================================================
# LOGGING MINIMALE (no sensitive data)
# =========================================================================
logging:
driver: "json-file"
options:
max-size: "10m"
max-file: "3"
# =========================================================================
# HEALTHCHECK
# =========================================================================
healthcheck:
test: ["CMD-SHELL", "pgrep -x vapordrop || exit 1"]
interval: 30s
timeout: 10s
retries: 3
start_period: 120s
# =============================================================================
# NETWORK ISOLATA
# =============================================================================
networks:
vapor_net:
driver: bridge
internal: false # Necessario per connessione Tor
ipam:
config:
- subnet: 172.28.0.0/16
|
