mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 15:48:34 +00:00
Johnathan Corgan
f8d79c2d8c
The configuration reference, the shipped fips.yaml and two code comments said that setting dns.bind_addr to "::" exposes the responder to mesh peers. On Linux, macOS and FreeBSD with the daemon's own TUN, queries arriving on the mesh interface are dropped, so a wildcard bind in fact serves the host's other networks, and every host on them that can reach the port. They now say that, and that mesh peers are served on Windows, with an application-supplied TUN, or when the daemon logs at start that the mesh interface index is unresolved. The reference and fips.yaml also say that a reply goes to the query's source by the routing table, so a host on one of those networks that forges a mesh source address has the reply sent into the mesh from this node's mesh address. The macOS WireGuard container example published the container's DNS port on every host interface. It is now published on 127.0.0.1 only, which is all the macOS resolver it serves needs.
29 lines
790 B
YAML
29 lines
790 B
YAML
services:
|
|
wireguard-sidecar:
|
|
build: .
|
|
image: wireguard-sidecar:latest
|
|
container_name: wireguard-sidecar
|
|
hostname: wireguard-sidecar
|
|
# Docker's init runs as PID 1 and forwards the stop to fips, which the
|
|
# entrypoint execs.
|
|
init: true
|
|
privileged: true
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=0
|
|
- net.ipv6.conf.all.forwarding=1
|
|
- net.ipv4.ip_forward=1
|
|
ports:
|
|
- "127.0.0.1:5354:5354/udp"
|
|
- "127.0.0.1:5354:5354/tcp"
|
|
- "2222:22/tcp"
|
|
- "51820:51820/udp"
|
|
volumes:
|
|
- ./fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./identity/fips.key:/etc/fips/fips.key
|
|
- ./identity:/etc/fips/identity
|
|
environment:
|
|
- RUST_LOG=info
|
|
restart: unless-stopped
|