Deprecate Tor

Since a bridge support has been already added in to the community version https://github.com/hassio-addons/addon-tor/pull/170
This commit is contained in:
Renat Gabdulhakov
2026-03-07 22:04:44 +00:00
parent 7a5463f9bc
commit 02c6d55777
20 changed files with 477 additions and 0 deletions

View File

@@ -1,91 +0,0 @@
ARG BUILD_FROM=ghcr.io/hassio-addons/base:17.2.0
# hadolint ignore=DL3006
FROM ${BUILD_FROM}
# Set shell
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
# Copy root filesystem
COPY rootfs /
# Setup base
RUN \
apk add --no-cache \
coreutils=9.5-r2 \
tor=0.4.8.14-r1 \
go=1.23.6-r0 \
git=2.47.2-r0 \
ca-certificates=20241121-r1 \
libcap=2.71-r0
# Download pluggable-transports sources
WORKDIR /go
ARG OBFS_VERSION=obfs4proxy-0.0.14
ARG SNOWFLAKE_VERSION=v2.10.1
ARG WEBTUNNEL_VERSION=v0.0.2
RUN git clone -b ${OBFS_VERSION} --single-branch --depth 1 https://github.com/Yawning/obfs4.git \
&& git clone -b ${SNOWFLAKE_VERSION} --single-branch --depth 1 https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake.git \
&& git clone -b ${WEBTUNNEL_VERSION} --single-branch --depth 1 https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/webtunnel.git
# Build obfs4proxy
WORKDIR /go/obfs4
RUN go build -o /usr/local/bin/obfs4proxy ./obfs4proxy
# Build snowflake
WORKDIR /go/snowflake/client
RUN go get \
&& go build -ldflags '-extldflags "-static" -w -s' -o /usr/local/bin/snowflake
# Build webtunnel
WORKDIR /go/webtunnel/main/client
RUN go get \
&& go build -ldflags="-s -w" -o /usr/local/bin/webtunnel
# Clean up after build
WORKDIR /
RUN rm -rf /go
# Give transports clients the capability to bind privileged port.
RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/obfs4proxy \
&& setcap 'cap_net_bind_service=+ep' /usr/local/bin/snowflake \
&& setcap 'cap_net_bind_service=+ep' /usr/local/bin/webtunnel
HEALTHCHECK \
--start-period=60m \
--interval=60s \
--timeout=30s \
CMD curl \
--silent \
--location \
--socks5-hostname localhost:9050 \
https://check.torproject.org/?lang=en_US \
| grep -qm1 Congratulations
# Build arguments
ARG BUILD_ARCH
ARG BUILD_DATE
ARG BUILD_DESCRIPTION
ARG BUILD_NAME
ARG BUILD_REF
ARG BUILD_REPOSITORY
ARG BUILD_VERSION
# Labels
LABEL \
io.hass.name="${BUILD_NAME}" \
io.hass.description="${BUILD_DESCRIPTION}" \
io.hass.arch="${BUILD_ARCH}" \
io.hass.type="addon" \
io.hass.version=${BUILD_VERSION} \
maintainer="Franck Nijhof <frenck@addons.community>" \
org.opencontainers.image.title="${BUILD_NAME}" \
org.opencontainers.image.description="${BUILD_DESCRIPTION}" \
org.opencontainers.image.vendor="Home Assistant Community Add-ons" \
org.opencontainers.image.authors="Franck Nijhof <frenck@addons.community>" \
org.opencontainers.image.licenses="MIT" \
org.opencontainers.image.url="https://addons.community" \
org.opencontainers.image.source="https://github.com/${BUILD_REPOSITORY}" \
org.opencontainers.image.documentation="https://github.com/${BUILD_REPOSITORY}/blob/main/README.md" \
org.opencontainers.image.created=${BUILD_DATE} \
org.opencontainers.image.revision=${BUILD_REF} \
org.opencontainers.image.version=${BUILD_VERSION}

View File

@@ -1,67 +0,0 @@
#include <tunables/global>
profile tor_addon flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/base>
capability,
file,
signal,
mount,
umount,
remount,
network udp,
network tcp,
network dgram,
network stream,
network inet,
network inet6,
network netlink raw,
network unix dgram,
capability setgid,
capability setuid,
capability sys_admin,
capability dac_read_search,
# capability dac_override,
# capability sys_rawio,
# S6-Overlay
/init ix,
/run/{s6,s6-rc*,service}/** ix,
/package/** ix,
/command/** ix,
/run/{,**} rwk,
/dev/tty rw,
/bin/** ix,
/usr/bin/** ix,
/usr/lib/bashio/** ix,
/etc/s6/** rix,
/etc/s6-overlay/** rix,
/run/s6/** rix,
/etc/services.d/** rwix,
/etc/cont-init.d/** rwix,
/etc/cont-finish.d/** rwix,
/init rix,
/var/run/** mrwkl,
/var/run/ mrwkl,
/dev/i2c-1 mrwkl,
# Files required
/dev/fuse mrwkl,
/dev/sda1 mrwkl,
/dev/sdb1 mrwkl,
/dev/nvme0 mrwkl,
/dev/nvme1 mrwkl,
/dev/mmcblk0p1 mrwkl,
/dev/* mrwkl,
/tmp/** mrkwl,
# Data access
/data/** rw,
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
ptrace (trace,read) peer=docker-default,
# docker daemon confinement requires explict allow rule for signal
signal (receive) set=(kill,term) peer=/usr/bin/docker,
}

View File

@@ -1 +0,0 @@
oneshot

View File

@@ -1 +0,0 @@
/etc/s6-overlay/s6-rc.d/init-tor/run

View File

@@ -1,27 +0,0 @@
#!/command/with-contenv bashio
# shellcheck shell=bash
# ==============================================================================
# Home Assistant Community Add-on: Tor
# Take down the S6 supervision tree when the Tor daemon fails
# ==============================================================================
declare exit_code
readonly exit_code_container=$(</run/s6-linux-init-container-results/exitcode)
readonly exit_code_service="${1}"
readonly exit_code_signal="${2}"
readonly service="Tor"
bashio::log.info \
"Service ${service} exited with code ${exit_code_service}" \
"(by signal ${exit_code_signal})"
if [[ "${exit_code_service}" -eq 256 ]]; then
if [[ "${exit_code_container}" -eq 0 ]]; then
echo $((128 + $exit_code_signal)) > /run/s6-linux-init-container-results/exitcode
fi
[[ "${exit_code_signal}" -eq 15 ]] && exec /run/s6/basedir/bin/halt
elif [[ "${exit_code_service}" -ne 0 ]]; then
if [[ "${exit_code_container}" -eq 0 ]]; then
echo "${exit_code_service}" > /run/s6-linux-init-container-results/exitcode
fi
exec /run/s6/basedir/bin/halt
fi

View File

@@ -1 +0,0 @@
longrun

View File

@@ -1,3 +0,0 @@
RunAsDaemon 0
DataDirectory /data
AvoidDiskWrites 1