From 7ebe9f2a7e5ec82c197a1b495c6e1e7641c8bf19 Mon Sep 17 00:00:00 2001
From: pipistrello <wkhooy@gmail.com>
Date: Thu, 23 Jul 2026 12:34:33 +0300
Subject: [PATCH] 02-tekhnohim: add LAN TeleProxy over Xray Reality stack

Add a dedicated Git-managed stack that leaves the existing Nginx Proxy Manager bindings on ports 80/443 unchanged and publishes the Telegram endpoint only on 192.168.0.35:10443.\n\nTeleProxy direct-mode traffic is routed through an isolated Xray SOCKS5 client and the dedicated Hetzner VLESS+Reality egress at 89.167.72.79:443. Both upstream images are digest-pinned. Credential-bearing Xray and TeleProxy files remain root-controlled host files under /mnt/containers/telegram-reality and are explicitly excluded from Git.
---
 telegram-reality/README.md           | 22 +++++++++++++
 telegram-reality/docker-compose.yaml | 47 ++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+)
 create mode 100644 telegram-reality/README.md
 create mode 100644 telegram-reality/docker-compose.yaml

diff --git a/telegram-reality/README.md b/telegram-reality/README.md
new file mode 100644
index 0000000..6ccfb7a
--- /dev/null
+++ b/telegram-reality/README.md
@@ -0,0 +1,22 @@
+# Telegram proxy through Xray Reality
+
+This stack publishes TeleProxy only on the client LAN:
+
+- client endpoint: `192.168.0.35:10443/tcp`;
+- TeleProxy runs in direct mode;
+- Telegram DC traffic goes to the local Xray SOCKS5 client;
+- Xray sends the outbound leg through the dedicated Hetzner VLESS+Reality
+  server at `89.167.72.79:443`;
+- Nginx Proxy Manager keeps exclusive ownership of host ports `80` and `443`.
+
+The stack deliberately keeps credential-bearing files outside Git:
+
+| Host path | Purpose | Required mode |
+|---|---|---|
+| `/mnt/containers/telegram-reality/xray-client.json` | Xray Reality client credentials and local SOCKS inbound | `0600`, owner `65532:65532` |
+| `/mnt/containers/telegram-reality/teleproxy.env` | TeleProxy secret and label | `0600`, owner `root:root` |
+| `/mnt/containers/telegram-reality/teleproxy-link.txt` | Generated LAN-only Telegram connection link | `0600`, owner `root:root` |
+
+Deploy this directory as a Portainer Git stack named `telegram-reality`, or run
+it with Docker Compose using project name `telegram-reality`. The absolute
+configuration files must already exist on the host before deployment.
diff --git a/telegram-reality/docker-compose.yaml b/telegram-reality/docker-compose.yaml
new file mode 100644
index 0000000..93f9d10
--- /dev/null
+++ b/telegram-reality/docker-compose.yaml
@@ -0,0 +1,47 @@
+services:
+  xray-client:
+    image: ghcr.io/xtls/xray-core@sha256:592ec4d11f656db95598d01e76dbcc6e002d67360b96a5436500a938230f52c7
+    container_name: telegram-reality-xray
+    command:
+      - run
+      - -config
+      - /etc/xray/config.json
+    restart: unless-stopped
+    volumes:
+      - /mnt/containers/telegram-reality/xray-client.json:/etc/xray/config.json:ro,Z
+    networks:
+      - telegram-reality-nw
+    healthcheck:
+      test: ["CMD", "xray", "run", "-test", "-config", "/etc/xray/config.json"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  teleproxy:
+    image: ghcr.io/teleproxy/teleproxy@sha256:f1d4c169d1a94a0d4871f9596fb2ca2783dc3015bcabe168ae59bc74c7a75e64
+    container_name: telegram-reality-teleproxy
+    restart: unless-stopped
+    depends_on:
+      xray-client:
+        condition: service_healthy
+    env_file:
+      - /mnt/containers/telegram-reality/teleproxy.env
+    environment:
+      DIRECT_MODE: "true"
+      SOCKS5_PROXY: "socks5://xray-client:1080"
+      PORT: "443"
+      EXTERNAL_PORT: "10443"
+      STATS_PORT: "8888"
+      WORKERS: "1"
+      EE_DOMAIN: "www.google.com"
+      EXTERNAL_IP: "89.167.72.79"
+      MSS_CLAMP: "false"
+    ports:
+      - "192.168.0.35:10443:443/tcp"
+    networks:
+      - telegram-reality-nw
+
+networks:
+  telegram-reality-nw:
+    name: telegram-reality-nw