yaml
networks:
frontend:
driver: bridge
internal: false
backend:
driver: bridge
internal: true
vpn:
driver: bridge
internal: true
The internal: true flag prevents containers on that network from accessing the internet directly. This ensures sensitive services can only communicate through designated channels, like your VPN container.
Your VPN container (preferably running NordVPN for its robust Docker support and extensive server network) should be configured with network_mode: "host" to handle routing properly. Other containers that need private internet access can then use network_mode: "service:vpn" to route through it.
## Implementing a Secure Proxy Layer
A properly configured proxy layer is crucial for privacy. While Squid is popular, Traefik offers better integration with Docker and modern features. Here's a privacy-focused Traefik configuration:
yaml
traefik:
image: traefik:v2.5
command:
- "--api.insecure=false"
- "--providers.docker=true"
- "--entrypoints.web.address=:80"
- "--entrypoints.websecure.address=:443"
- "--certificatesresolvers.myresolver.acme.tlschallenge=true"
ports:
- "443:443"
volumes:
- "/var/run/docker.sock:/var/run/docker.sock:ro"
Configure strict headers in your proxy:
yaml
headers:
referrerPolicy: "strict-origin-when-cross-origin"
contentSecurityPolicy: "default-src 'self'"
permissionsPolicy: "camera=(), microphone=(), geolocation=()"