# Tor SOCKS proxy for the dark-web exploration agent.
#
# The agent process runs on the host (or its own container) and reaches Tor via
# DARKWEB_PROXY_URL=socks5h://127.0.0.1:9050. The proxy is bound to localhost
# only and runs client-only with the control port disabled.
services:
  tor-proxy:
    build:
      context: .
      dockerfile: tor-proxy/Dockerfile
    container_name: darkweb-tor-proxy
    restart: unless-stopped
    # Bound to localhost only so nothing else on the network can use the circuit.
    ports:
      - "127.0.0.1:${TOR_SOCKS_PORT:-9050}:9050"
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD-SHELL", "nc -z 127.0.0.1 9050"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 30s