baone/hox repository overview

docker compose up -d

name: hox

# 公网部署只需修改这里的域名，并把 DNS 指向服务器。
x-hox-environment: &hox-environment
  HOX_DOMAIN: nat.gzgfwl.com.cn

services:
  admin:
    image: baone/hox:admin-0.2.21-server.2
    container_name: hox-admin
    environment:
      <<: *hox-environment
      YCCT_RELAY_CONTAINER: hox-relay
    ports:
      - "127.0.0.1:21112:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - admin-data:/data
      - relay-policy:/data/relay-policy
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    mem_limit: 96m
    pids_limit: 64
    restart: unless-stopped
    logging:
      driver: json-file
      options: {max-size: "2m", max-file: "2"}
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; assert urllib.request.urlopen('http://127.0.0.1:8080/', timeout=3).status == 200"]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 10s
  relay:
    image: baone/hox:relay-2.6.4-hox.1
    container_name: hox-relay
    network_mode: host
    command: ["--config-file", "/etc/ycct/relay.toml", "--rpc-portal", "127.0.0.1:21111", "--console-log-level", "error"]
    volumes:
      - relay-policy:/etc/ycct:ro
    depends_on:
      admin: {condition: service_healthy}
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    read_only: true
    tmpfs: [/tmp:size=16m]
    mem_limit: 192m
    pids_limit: 128
    restart: unless-stopped
    logging:
      driver: json-file
      options: {max-size: "5m", max-file: "2"}
    healthcheck:
      test: ["CMD-SHELL", "easytier-cli -p 127.0.0.1:21111 node >/dev/null 2>&1"]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 10s
  https:
    image: caddy:2.10.2-alpine
    container_name: hox-https
    network_mode: host
    environment: *hox-environment
    command:
      - /bin/sh
      - -ec
      - 'exec caddy reverse-proxy --from "$$HOX_DOMAIN" --to 127.0.0.1:21112 --header-up "X-Real-IP: {remote_host}" --header-down "Strict-Transport-Security: max-age=31536000"'
    volumes:
      - tls-data:/data
    read_only: true
    tmpfs: [/config:size=16m, /tmp:size=16m]
    cap_drop: [ALL]
    cap_add: [NET_BIND_SERVICE]
    security_opt: [no-new-privileges:true]
    mem_limit: 128m
    pids_limit: 128
    restart: unless-stopped
    depends_on:
      admin: {condition: service_healthy}
    logging:
      driver: json-file
      options: {max-size: "2m", max-file: "2"}

volumes:
  admin-data:
  relay-policy:
  tls-data: