vh
14dd9ab90c
- scripts/setup-nh3-scale-socks-egress.sh: dante-server on CT107, mesh+fleet ACL only, After=tailscaled + Restart=on-failure; run via pct push/exec on nh3-pve - YTVC_PROXY on irv-ml1 -> socks5h://100.64.0.1:1080 (override, untracked); worker recreated; end-to-end job verified with proxied/direct controls - YTVC Homepage href/siteMonitor -> irv-ml1.nh3.internal:8000 (was the dead wg0 IP)
61 lines
1.7 KiB
Bash
Executable File
61 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# nh3-scale (CT107): SOCKS5 egress proxy over the mesh — fleet-internal only.
|
|
# Successor to the retired nh3-dev danted (2026-09-06): same residential NH3 egress,
|
|
# now hosted ON the exit-node router so mesh peers reach it at 100.64.0.1:1080.
|
|
set -euo pipefail
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
dpkg -s dante-server >/dev/null 2>&1 || { apt-get update -qq; apt-get install -y -qq dante-server; }
|
|
cat > /etc/danted.conf <<'CONF'
|
|
# Fleet egress proxy on nh3-scale (PFI infra) — SOCKS5, INTERNAL-ONLY.
|
|
# Egress via NH3's residential line. Managed from eshpfi-management
|
|
# (scripts/setup-nh3-scale-socks-egress.sh) — edit there, not here.
|
|
logoutput: syslog
|
|
internal: 0.0.0.0 port = 1080
|
|
external: eth0
|
|
socksmethod: none
|
|
clientmethod: none
|
|
user.privileged: root
|
|
user.unprivileged: nobody
|
|
# Client ACL — mesh + fleet RFC1918 only. NOT an open proxy.
|
|
client pass {
|
|
from: 100.64.0.0/10 to: 0.0.0.0/0
|
|
log: error
|
|
}
|
|
client pass {
|
|
from: 10.0.0.0/8 to: 0.0.0.0/0
|
|
log: error
|
|
}
|
|
client block {
|
|
from: 0.0.0.0/0 to: 0.0.0.0/0
|
|
log: connect error
|
|
}
|
|
socks pass {
|
|
from: 100.64.0.0/10 to: 0.0.0.0/0
|
|
protocol: tcp udp
|
|
log: error
|
|
}
|
|
socks pass {
|
|
from: 10.0.0.0/8 to: 0.0.0.0/0
|
|
protocol: tcp udp
|
|
log: error
|
|
}
|
|
socks block {
|
|
from: 0.0.0.0/0 to: 0.0.0.0/0
|
|
}
|
|
CONF
|
|
mkdir -p /etc/systemd/system/danted.service.d
|
|
cat > /etc/systemd/system/danted.service.d/override.conf <<'UNIT'
|
|
[Unit]
|
|
After=network-online.target tailscaled.service
|
|
Wants=network-online.target
|
|
[Service]
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
UNIT
|
|
systemctl daemon-reload
|
|
systemctl enable --now danted
|
|
systemctl restart danted
|
|
sleep 1
|
|
systemctl is-active danted
|
|
ss -ltn | grep ":1080 "
|