Sergei Poljanski
b4d6852a80
The VLESS Reality proxy ran from a hand-installed binary on the temporary server. Run the upstream image instead, pinned and on the host network, with only CAP_NET_BIND_SERVICE; its config (keys and client id) is in the vault. Assisted-by: Claude:opus-5-5
16 lines
527 B
Django/Jinja
16 lines
527 B
Django/Jinja
# Managed by Ansible (role xray). Root in the container only to read the
|
|
# 0600 config and bind :443; every other capability is dropped.
|
|
services:
|
|
xray:
|
|
image: ghcr.io/xtls/xray-core:{{ xray_version }}
|
|
container_name: xray
|
|
command: ["run", "-c", "/etc/xray/config.json"]
|
|
network_mode: host
|
|
user: "0"
|
|
cap_drop: [ALL]
|
|
cap_add: [NET_BIND_SERVICE]
|
|
security_opt: ["no-new-privileges:true"]
|
|
read_only: true
|
|
volumes:
|
|
- ./config.json:/etc/xray/config.json:ro
|
|
restart: unless-stopped
|