# dante-server config for the e2e SOCKS5 proxy.
#
# The proxy's host port is bound to 127.0.0.1 only by docker, so the
# attack surface is localhost on the host machine — auth is unnecessary
# and would just complicate the test setup. method: none.
logoutput: stderr

internal: 0.0.0.0 port = 1080
external: eth0

socksmethod: none
clientmethod: none

user.privileged: root
user.unprivileged: nobody

# Allow any client (the docker port-publish to 127.0.0.1 is the trust
# boundary — outside hosts cannot reach this listener).
client pass {
  from: 0.0.0.0/0 to: 0.0.0.0/0
  log: error
}

# Allow any destination through SOCKS (we want the host browser to be
# able to reach any service the proxy can route to in the simulated
# network).
socks pass {
  from: 0.0.0.0/0 to: 0.0.0.0/0
  log: error
}