havenodex/haveno-daemon repository overview

⁠Haveno Daemon with Tor and Envoy - Docker Setup

This Docker setup provides a secure and private environment to run the Haveno Daemon, leveraging Tor for anonymous routing and Envoy for proxying and managing the traffic. The following services are part of this stack:

• Haveno Daemon: The core service responsible for facilitating decentralized peer-to-peer exchanges on the Haveno platform.
• Tor: A proxy to route traffic through the Tor network, ensuring anonymity and privacy.
• dnsmasq: A lightweight DNS forwarder, resolving and appropriately relaying the DNS queries within the Docker network.
• Envoy: A proxy that manages incoming and outgoing traffic, transforming gRPC and HTTP requests as needed.
• Watchtower: A service that automatically updates Docker containers when new versions are available.

⁠Docker Compose Services Overview

⁠1. haveno-daemon

This is the main service that powers the decentralized Haveno platform. It connects to the Monero blockchain through the specified Monero node and uses the seed nodes for network discovery.

Key Environment Variables:

• TOR_CONTROL_HOST: The IP address of the Tor service.
• TOR_CONTROL_PORT: The port of the Tor control interface (usually 9051).
• TOR_CONTROL_PASSWORD: The password used to control the Tor instance.
• NETWORK_NAME: The custom network name for this Haveno instance.
• NODE_PORT: The network port on which the Haveno node will listen.
• API_PASSWORD: The password to secure the API access.
• MAX_MEMORY: The maximum memory the daemon is allowed to use.
• SEED_NODES: A list of seed nodes to help the daemon connect to the network.
• XMR_NODE: The Monero node that the Haveno daemon uses for blockchain data.

The Haveno Daemon mounts two key volumes:

• /app/user/: User configuration and data for the Haveno instance.
• /app/data/: Network-specific data storage.

This service listens on port 3201, which is exposed for API communication.

⁠2. tor

Tor handles all traffic anonymously, routing it through the Tor network. The Tor instance is configured with the necessary control options to allow the Haveno Daemon to interact with it and manage connections securely.

Key Features:

• Control Port: Set to 9051 for managing Tor instance interactions.
• Iptables Manipulation: The container uses NET_ADMIN and NET_RAW capabilities to manage low-level networking.

Optional:

• A custom torrc file can be mounted to configure the Tor instance further.

Restart Policy: unless-stopped, ensuring that the Tor service continues running in case of failures.

⁠3. dnsmasq

A DNS forwarder that ensures DNS resolution routes onion hosts to the DNSSock Docker network and anything else to 1.1.1.1 (Cloudflare). It plays a crucial role in resolving DNS queries for services running inside the isolated Docker network (lockdown_net).

Ports:

• 53/tcp and 53/udp are exposed to handle DNS queries.

Capabilities:

• Requires NET_ADMIN and NET_RAW for low-level networking tasks.

⁠4. envoy

Envoy acts as a proxy to manage incoming and outgoing traffic to the Haveno Daemon. It routes both gRPC and HTTP requests and can transform gRPC requests into HTTP requests, if necessary.

The key configuration is loaded from a YAML file (transformer-envoy.yaml), which dictates how the traffic is routed and transformed. This service exposes port 2222 for incoming requests.

⁠5. watchtower

Watchtower monitors the running containers and automatically pulls updates for the services when new images are published. This ensures that the Haveno Daemon, Tor, and Envoy are always up-to-date.

Environment Variables:

• WATCHTOWER_CLEANUP: Ensures that old containers are removed after updates.
• WATCHTOWER_POLL_INTERVAL: Configures the interval (in seconds) at which Watchtower checks for updates.

⁠Networks

The services communicate over the lockdown_net bridge network. Each service has a static IP address within the subnet 172.23.0.0/16. This ensures predictable IP assignment and facilitates easy configuration, especially for the Tor and Haveno Daemon services.

Example subnet configuration:

• Tor: 172.23.0.3
• Haveno Daemon: 172.23.0.4
• DNSMasq: 172.23.0.2
• Envoy: 172.23.0.5

⁠Dockerfile for Haveno Daemon

The Haveno Daemon is built using a multi-stage Dockerfile that minimizes the size of the final image by separating the build environment from the runtime environment.

⁠Key Environment Variables in the Dockerfile:

• BASE_NETWORK: The base network for the daemon (default: XMR_STAGENET).
• NETWORK_NAME: The name of the Haveno network (default: HAVENO).
• NODE_PORT: The port on which the daemon listens (default: 8080).
• MAX_MEMORY: Maximum memory the daemon can use (default: 1024m).
• XMR_NODE: The Monero node the daemon connects to (default: localhost:18081).
• TOR_CONTROL_HOST: The host where the Tor control port is running (default: localhost).
• TOR_CONTROL_PORT: The control port for Tor (default: 9051).
• SEED_NODES: Seed nodes for connecting to the network.

The entry point dynamically constructs the command for starting the Haveno Daemon based on these environment variables.

This Docker setup provides a secure and private environment to run the Haveno Daemon, leveraging Tor for anonymous routing and Envoy for proxying and managing the traffic. The following services are part of this stack:

• Haveno Daemon: The core service responsible for facilitating decentralized peer-to-peer exchanges on the Haveno platform.
• Tor: A proxy to route traffic through the Tor network, ensuring anonymity and privacy.
• DNSMasq: A lightweight DNS forwarder, resolving and segmenting DNS queries within the Docker network.
• Envoy: A proxy that manages incoming and outgoing traffic, transforming gRPC and HTTP requests as needed.
• Watchtower: A service that automatically updates Docker containers when new versions are available.

⁠Docker Compose Configuration

Here’s a detailed example of a docker-compose.yml file to run Haveno Daemon with Tor, DNSMasq, Envoy, and Watchtower:

# Copyright 2024 Kewbit (https://kewbit.org/)
version: '3'
services:
  haveno-daemon:
    image: haveno-daemon:latest
    build: .
    volumes:
      - ./haveno-daemon/user:/app/user/
      - ./haveno-daemon/data:/app/data/
    ports:
      - "3201:3201"
    environment:
      TOR_CONTROL_HOST: 172.23.0.3
      TOR_CONTROL_PORT: 9051
      TOR_CONTROL_PASSWORD: "FartLogs"
      NETWORK_NAME: WOODSER
      NODE_PORT: 9999
      API_PASSWORD: "Rotteneggs123"
      MAX_MEMORY: 2400
      SEED_NODES: "dl57jitswby4yhzpqpu7pwq6iyqg2x6vkio73araparbftlqoqxhvqad.onion:2002,3cqlkowdu766sto5wrdqpntpsi7kezwkkakc532i6jeiyu7hha726ead.onion:3003" 
      XMR_NODE: http://node2.monerodevs.org:38089 
    networks:
      lockdown_net:
        ipv4_address: 172.23.0.4
    depends_on:
      tor:
        condition: service_healthy
      dnsmasq:
        condition: service_healthy
    dns:
      - 172.23.0.2

  tor:
    image: dperson/torproxy
    environment:
      - TZ=UTC
      - SERVICE=80;172.23.0.4:3201,80:172.23.0.5:2222
      - EXITNODE=0
    volumes:
      - ./torrc:/etc/tor/torrc:ro
      - ./tordata:/tor/data
    restart: unless-stopped
    networks:
      lockdown_net:
        ipv4_address: 172.23.0.3
    cap_add:
      - NET_ADMIN
      - NET_RAW

  dnsmasq:
    image: havenodex/dnsmasq:latest
    networks:
      lockdown_net:
        ipv4_address: 172.23.0.2
    cap_add:
      - NET_ADMIN
      - NET_RAW
    ports:
      - "53/tcp"
      - "53/udp"
    restart: unless-stopped

  envoy:
    image: envoyproxy/envoy:v1.24.0
    volumes:
      - ./transformer-envoy.yaml:/etc/envoy/envoy.yaml
    depends_on:
      - tor
    networks:
      lockdown_net:
        ipv4_address: 172.23.0.5
    ports:
      - "2222:2222"

  watchtower:
    image: containrrr/watchtower
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      WATCHTOWER_CLEANUP: "true"
      WATCHTOWER_POLL_INTERVAL: 300
    networks:
      lockdown_net:
        ipv4_address: 172.23.0.6

networks:
  lockdown_net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.23.0.0/16

⁠Explanation of Services

• Haveno Daemon: The main service that runs the Haveno network node, facilitates decentralized exchanges, and connects to Monero via a specified node. You can configure the service with environment variables for Tor, Monero nodes, memory usage, and network settings.
• Tor: A proxy service that routes all traffic through the Tor network to ensure anonymity. It also manages the control interface that Haveno Daemon connects to. Capabilities such as NET_ADMIN and NET_RAW are added to manipulate low-level network settings.
• DNSMasq: A lightweight DNS forwarder that ensures internal DNS resolution within the Docker network. It helps route requests efficiently between services.
• Envoy: A proxy service that manages and transforms traffic between Haveno Daemon and external requests. It can forward gRPC and HTTP requests to their respective services.
• Watchtower: A service responsible for automatically updating Docker containers. It checks for updates periodically and replaces containers with new versions without downtime.

⁠Usage Instructions

To use this setup, create a docker-compose.yml file with the provided configuration, and run the following commands to start the services:

⁠Start the Services

To start all the services in the background (detached mode), use the following command:

docker-compose up -d

⁠Stop the Services

To stop the running services, use the following command:

docker-compose down

⁠Viewing Logs

To view the logs of a specific service (e.g., the Haveno Daemon), use:

docker-compose logs haveno-daemon

You can replace haveno-daemon with any service name (e.g., tor, envoy) to view logs for other services.

⁠Checking Service Status

You can check the status of all the running services using:

docker-compose ps

⁠Restarting a Specific Service

To restart a particular service (e.g., tor), use the following command:

docker-compose restart tor

⁠Configuration Options

Here are the key environment variables used to configure the Haveno Daemon. You can adjust these in your docker-compose.yml file under the environment section of the haveno-daemon service.

⁠Customizing the torrc File

If you need to customize the Tor instance further, you can modify the torrc file and mount it in the tor service. This allows for more control over how Tor interacts with the Haveno Daemon and the rest of the services.

Example:

tor:
  image: dperson/torproxy
  volumes:
    - ./torrc:/etc/tor/torrc:ro

⁠Envoy Configuration

Envoy is responsible for proxying gRPC and HTTP requests to the Haveno Daemon. The configuration for Envoy is provided via a YAML file (transformer-envoy.yaml), which can be customised based on your proxying needs. Ensure the ports and addresses match your Docker network setup. This documentation is provided by Kewbit⁠ I wrote an article about dnsmasq vs DNSCrypt⁠ which may be appropriate to implement later on as they can supplement each other. If you have any questions at all free free to reach out to me on my Kewbit email⁠ (Proton alias to prevent spam)

⁠Experimental

Although some of the features work, it's a work in progress but should be completed shortly. Do not use in production environments.