drjones/rigel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

README: document public SOCKS5 endpoint + router DNAT dependency, auth model, deploy; drop key material from a public repo

Browse Source
This commit is contained in:
drjones
2026-09-10 01:34:45 -07:00
parent 13b87ffa59
commit c0951378a4
1 changed files with 81 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

97
README.md
View File

@@ -1,15 +1,30 @@
# Rigel — no-KYC SOCKS5 Proxy Shop
Self-hosted SOCKS5 proxy storefront. Sells access to residential/mobile/datacenter proxies. Bitcoin via BTCPay. No KYC — username + email + password + arithmetic captcha.
Self-hosted SOCKS5 proxy storefront. Sells access to datacenter / residential / mobile
proxies. Bitcoin via BTCPay. **No KYC** — username + email + password + arithmetic captcha,
nothing else.
**Status: LIVE — end-to-end verified 2026-09-10.** Real BTC payment → NBXplorer match →
BTCPay webhook → subscription activated → per-user SOCKS5 credentials issued → authenticated
proxy access **proven from an external network** (off-LAN vantage, correct country exit).
## Stack
- **App**: Flask single-page app, `/opt/rigel/app.py` (SQLite, no-KYC auth)
- **CT**: 158 `rigel` @ `10.30.20.116`, Debian 12, nginx :80 → Flask :5000
- **Service**: `rigel.service` (systemd)
- **Payments**: BTCPay store `[redacted]` / key `[redacted]` (webhook → `/api/btcpay/webhook`)
- **Public**: `https://rigel.thetempleofdoom.com` (fleet tunnel `1aeb1ac0`, REMOTE-MANAGED config via CF API)
| Piece | Detail |
|---|---|
| Storefront | Flask SPA — `/opt/rigel/app.py` (SQLite, no-KYC auth, BTCPay invoicing) |
| Proxy frontend | `/opt/rigel/proxy_server.py` — authenticated SOCKS5 on `:1081` |
| Container | **CT 158 `rigel` @ `10.30.20.116`** — Debian 12, nginx `:80` → Flask `:5000` |
| Services | `rigel.service` (`:5000`), `rigel-proxy.service` (`:1081`) |
| Payments | BTCPay store `3j9HygtT…` — webhook → `POST /api/btcpay/webhook` |
| Public web | `https://rigel.thetempleofdoom.com` (fleet tunnel `1aeb1ac0`, **remote-managed**) |
| Public SOCKS5 | **`76.146.4.178:1081`** — WAN port-forward (see below) |
> **No secrets in this repo.** Store IDs, API keys and webhook secrets live in the
> `rigel.service` environment and in Teable → `API_Credentials`.
## Inventory
| Location | Type | Endpoint |
|---|---|---|
| Tokyo | datacenter (Nord exit) | CT680 `10.30.20.154:1080` |
@@ -18,21 +33,69 @@ Self-hosted SOCKS5 proxy storefront. Sells access to residential/mobile/datacent
| Residential | rotating / sticky | IPRoyal `geo.iproyal.com:12321` |
| Mobile 4G | rotating | IPRoyal `4g.iproyal.com` |
`proxy_server.py` derives the upstream list from `app.py`'s `LOCATIONS` (single source of
truth) so the shop and the proxy can never disagree about inventory.
## API
- `POST /api/register` — `{username, email, password, captcha_id, captcha}`
- `POST /api/login` — `{username, password}`
- `GET /api/captcha` — arithmetic challenge
- `POST /api/buy` — `{plan_id}` → creates BTCPay invoice + pending subscription
- `GET /api/subscriptions` — user's active proxies
- `POST /api/btcpay/webhook` — activates subscription + issues creds on payment
| Route | Body | Purpose |
|---|---|---|
| `GET /api/captcha` | — | arithmetic challenge |
| `POST /api/register` | `{username, email, password, captcha_id, captcha}` | no-KYC signup |
| `POST /api/login` | `{username, password}` | session |
| `POST /api/buy` | `{plan_id}` | creates BTCPay invoice + pending subscription |
| `GET /api/subscriptions` | — | user's active proxies + issued credentials |
| `POST /api/btcpay/webhook` | BTCPay payload | activates subscription + issues creds |
Plans: `day` (8,000 sats) · `week` (45,000 sats) · `month` (150,000 sats).
## Public SOCKS5 access — the part that isn't obvious
A Cloudflare tunnel **cannot** carry SOCKS5 (HTTP-only), and Tailscale Funnel's raw-TCP mode
does not actually forward publicly (verified, then reverted). Customers therefore connect to
the **home WAN IP directly**: the router DNATs `tcp 1081 → 10.30.20.116:1081`.
⚠️ **If SOCKS5 ever stops being reachable from the internet, check in this order:**
1. **Router** — `iptables -t nat -L VSERVER -n | grep 1081`
2. **Hook present?** — `/jffs/scripts/firewall-start` must exist and be executable
(setting the `vts_rulelist` nvram var alone does **not** emit the DNAT on this firmware)
3. **Service** — `systemctl is-active rigel-proxy` inside CT158
4. **Never trust a LAN test** — NAT loopback can pass while the world can't reach it.
Verify from an external host.
## Auth model
`proxy_server.py` validates every SOCKS5 username/password against `rigel.db`:
the subscription must exist, be **active**, and **not expired**. The subscription's location
selects the upstream exit. Unknown user, wrong password, expired sub, or wrong auth method →
rejected; no traffic leaves. All time comparisons are **UTC**.
## Deploy
```
tar czf rigel.tar.gz app.py
```sh
tar czf rigel.tar.gz app.py proxy_server.py
scp rigel.tar.gz root@10.30.20.85:/tmp/
ssh root@10.30.20.85 "pct push 158 /tmp/rigel.tar.gz /tmp/rigel.tar.gz && pct exec 158 -- bash -c 'cd /opt/rigel && tar xzf /tmp/rigel.tar.gz && systemctl restart rigel'"
ssh root@10.30.20.85 "pct push 158 /tmp/rigel.tar.gz /tmp/rigel.tar.gz && pct exec 158 -- bash -c '
cd /opt/rigel &&
cp app.py app.py.bak-\$(date +%s) &&
cp proxy_server.py proxy_server.py.bak-\$(date +%s) &&
tar xzf /tmp/rigel.tar.gz &&
systemctl restart rigel rigel-proxy'"
```
Always back up the running file before overwriting it. CT158 does **not** accept the standard
fleet root password over SSH — deploy through the Proxmox host with `pct exec`.
## Gotchas
- Fleet tunnel is REMOTE-MANAGED — edit ingress via CF API (`/accounts/<id>/cfd_tunnel/1aeb1ac0.../configurations`), NOT the local `config-fleet.yml`. Local edits are ignored.
- BTCPay webhook secret wired via `BTCPAY_WEBHOOK_SECRET` env in `rigel.service`.
- **Fleet tunnel is REMOTE-MANAGED** — edit ingress via the Cloudflare API, not the local
`config-fleet.yml`. Local edits are silently ignored.
- **`checkoutLink` comes back with the LAN host** (it's derived from the API call's Host
header) — `app.py` rewrites the prefix onto `BTCPAY_PUBLIC_URL`.
- **SOCKS5 CONNECT to a domain target must length-prefix the domain** (`atyp=3`). Omit the
prefix and the upstream reads the first character as a length and hangs.
- **`rigel.db` is gitignored** — never commit the live database.
- BTCPay `NetworkFeeMode = Always` makes the exact amount land a few sats short
(`PaidPartial` rather than `Settled`); activation still fires. Not settable via the
Greenfield API.