#!/bin/sh
# PROJECT: Jayanta
# UPDATES: 2026-10-18 17:58:24 JST
# LICENSE: The Unlicense (unlicense.org)
PATH='/usr/sbin:/usr/bin:/sbin:/bin'
TOR="${1:-tor}"; RAW="${2:-privoxy}"; NNS="$(ip netns identify)"
[ "$(id -u)" -eq 0 ] || exit 1; type nft tor conntrack || exit 2
[ -z "$NNS" ] || exit 3; ln -sfv /usr/share/zoneinfo/Etc/UTC /etc/localtime || exit 4
( id "$TOR" && id "$RAW" ) || { echo 'sudo sh jayanta [debian-]tor[anon] priv[tinypr]oxy'; exit 5; }
sysctl net.ipv4.ip_forward=0 net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1 || exit 6
for t in nat filter; do nft add table inet $t; nft flush table inet $t; done
nft add chain inet nat output '{ type nat hook output priority dstnat; policy accept; }'
for c in input output forward; do nft add chain inet filter $c "{ type filter hook $c priority filter; policy drop; }"; done; conntrack -F expect && conntrack -F || exit 7
nft add set inet nat reserved '{ type ipv4_addr; flags interval; elements = { 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24, 192.0.2.0/24, 192.31.196.0/24, 192.52.193.0/24, 192.88.99.0/24, 192.168.0.0/16, 192.175.48.0/24, 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24, 224.0.0.0/4, 240.0.0.0/4 }; }'
nft add rule inet nat output udp dport 53 redirect to 9053
nft add rule inet nat output ip daddr 10.192.0.0/10 tcp dport '{ 80, 443 }' tcp flags syn / fin,syn,rst,ack redirect to 9040
nft add rule inet nat output skuid != "{ $TOR, $RAW }" oifname != "lo" ip daddr != @reserved tcp dport '{ 80, 443 }' tcp flags syn / fin,syn,rst,ack redirect to 9040
nft add rule inet filter input ct state vmap '{ invalid : drop, established : accept }'
nft add rule inet filter input ct state new iifname "lo" ip daddr 127.0.0.1 accept
nft add rule inet filter output ct state vmap '{ invalid : drop, established : accept }'
nft add rule inet filter output ct state new ip daddr 127.0.0.1 meta l4proto . th dport vmap '{ udp . 9053 : accept, tcp . 9040 : accept, tcp . 9050 : accept }'
nft add rule inet filter output ct state new tcp dport 443 tcp flags syn / fin,syn,rst,ack skuid "{ $TOR, $RAW }" accept
nft add rule inet filter output ct state new oifname "lo" ip daddr 127.0.0.1 accept; nft list ruleset
{
echo "SafeSocks 1"
echo "ReachableAddresses *:443"
echo "User $TOR"
echo "DataDirectory /var/lib/tor"
echo "DNSPort 9053"
echo "AutomapHostsOnResolve 1"
echo "AutomapHostsSuffixes .onion"
echo "VirtualAddrNetworkIPv4 10.192.0.0/10"
echo "TransPort 9040 IsolateClientAddr IsolateClientProtocol IsolateDestAddr IsolateDestPort"
echo "SocksPort 9050 IsolateClientAddr IsolateClientProtocol IsolateDestAddr IsolateDestPort"
} | tee /etc/tor/torrc || exit 8
{ sv restart tor || service tor restart || systemctl restart tor || rc-service tor restart; } >/dev/null 2>&1 && echo '[ OK ] tor' || echo '[ NG ] tor' >&2