tailscale-proxy: replace TSPU-blocked SOCKS5 with Fake-TLS MTProto (Telegram)

Retire the generic SOCKS5 :1080 (raw SOCKS5 is blocked by TSPU/DPI for the
external Telegram use case) and add ts-lan-mtproto (alexbers/mtprotoproxy) on
:1080 instead: a Fake-TLS MTProto proxy whose Telegram-DC connections chain
through the Tailscale userspace SOCKS5 (SOCKS5_HOST=ts-proxy:1055), so egress
still rides the Hetzner exit node. Client-facing hop is domestic Fake-TLS to
test the hypothesis that TSPU bites hardest at the border. 3proxy keeps only
the HTTP front (:3128). The proxy secret lives in a host-only config.py
(0600, uid 10000, not in git); config.py.example is the secret-free template.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tailscale-proxy/docker-compose.yaml

@@ -15,9 +15,9 @@ services:
     volumes: ["/mnt/containers/tailscale-proxy/state:/var/lib/tailscale:z"]
     networks: [proxynet]
 
-  # Unified 3proxy front: HTTP proxy (:3128) + SOCKS5 (:1080), LAN passwordless
-  # and external password-authenticated. Replaces the former tinyproxy HTTP
-  # container (tinyproxy cannot do per-source-IP conditional auth).
+  # 3proxy HTTP front (:3128), LAN passwordless and external password-
+  # authenticated, egressing via the Tailscale exit node. (The generic SOCKS5
+  # :1080 was retired 2026-07-24 — see below.)
   proxy:
     image: ghcr.io/3proxy/3proxy:latest
     container_name: ts-lan-proxy
@@ -28,7 +28,6 @@ services:
       - "/mnt/containers/tailscale-proxy/3proxy.secret:/etc/3proxy/3proxy.secret:ro,z"
     ports:
       - "192.168.0.35:3128:3128"
-      - "192.168.0.35:1080:1080"
     logging:
       driver: syslog
       options:
@@ -37,6 +36,23 @@ services:
         tag: tailscale-proxy
     networks: [proxynet]
 
+  # Telegram-only Fake-TLS MTProto proxy on :1080 (replaces the TSPU-blocked
+  # generic SOCKS5). Chains its Telegram-DC connections through the Tailscale
+  # userspace SOCKS5 (SOCKS5_HOST=ts-proxy:1055 in config.py) so egress still
+  # rides the Hetzner exit node. Client-facing hop is domestic Fake-TLS; the
+  # foreign leg is the WireGuard tunnel that already carries the HTTP proxy.
+  # config.py is host-only (0600, uid 10000, NOT in git) - holds the secret.
+  mtproto:
+    image: alexbers/mtprotoproxy:latest
+    container_name: ts-lan-mtproto
+    restart: unless-stopped
+    depends_on: [ts-proxy]
+    volumes:
+      - "/mnt/containers/tailscale-proxy/mtproto/config.py:/home/tgproxy/config.py:ro,z"
+    ports:
+      - "192.168.0.35:1080:1080"
+    networks: [proxynet]
+
 networks:
   proxynet:
     name: tailscale-proxynet