tailscale-proxy: expose Telemt metrics to client-02 Zabbix

Publish Telemt's container metrics port 9090 as 192.168.0.35:9092 because Cockpit already owns host port 9090. Bind the application listener to 0.0.0.0 inside the container and restrict Telemt's metrics whitelist to the client-02 Zabbix server at 192.168.0.34/32.\n\nDocument the Zabbix template macro URL and the Telemt 3.4.25 loopback-binding gotcha. The live endpoint returned HTTP 200 with 40,235 bytes from the Zabbix server; Telemt remained healthy and rebuilt its Telegram DC connections in six seconds.

tailscale-proxy/README.md

@@ -39,3 +39,12 @@ configuration files must already exist on the host before deployment.
 Full build record and rationale (userspace vs TUN dead-ends, SOCKS5-vs-HTTP,
 monitoring) is in ops-knowledge:
 `diagnostics/2026-07-23-02-tekhnohim-docker-tailscale-exit-proxy-stack.md`.
+
+## Telemt monitoring
+
+Telemt exports Prometheus metrics on container port `9090`, published as
+`http://192.168.0.35:9092/metrics` because host port `9090` is reserved by
+Cockpit. The Telemt application whitelist permits only the client-02 Zabbix
+server (`192.168.0.34/32`). In Zabbix, import Telemt's upstream
+`tools/zbx_telemt_template.yaml`, link it to the Docker host, and set
+`{$TELEMT_URL}` to the URL above.

tailscale-proxy/docker-compose.yaml

@@ -54,9 +54,11 @@ services:
       - "/mnt/containers/tailscale-proxy/telemt/telemt.toml:/app/config.toml:ro,z"
     ports:
       - "192.168.0.35:1080:1080"
+      # Host :9090 belongs to Cockpit; expose Telemt metrics on :9092 instead.
+      - "192.168.0.35:9092:9090"
     # Stays on json-file: telemt's tracing logs don't ship cleanly over the
     # syslog driver, and `docker logs ts-lan-telemt` is worth keeping for this
-    # critical service. Observe it there (or wire its Prometheus metrics later).
+    # critical service. Prometheus metrics are scraped by Zabbix on :9092.
     networks: [proxynet]
 
 networks:

tailscale-proxy/telemt/telemt.toml.example

@@ -22,6 +22,12 @@ tls = true                       # ee / FakeTLS
 
 [server]
 port = 1080
+# Host TCP :9090 is Cockpit, so compose maps host 192.168.0.35:9092 to this
+# container port. Explicit 0.0.0.0 is required because metrics_port alone binds
+# Telemt 3.4.25 to container loopback. Only the client-02 Zabbix server may scrape.
+metrics_port = 9090
+metrics_listen = "0.0.0.0:9090"
+metrics_whitelist = ["192.168.0.34/32"]
 
 [censorship]
 tls_domain = "www.google.com"    # SNI presented in the Fake-TLS handshake; tunable