tailscale-proxy: replace TSPU-blocked SOCKS5 with Fake-TLS MTProto (Telegram)

Retire the generic SOCKS5 :1080 (raw SOCKS5 is blocked by TSPU/DPI for the
external Telegram use case) and add ts-lan-mtproto (alexbers/mtprotoproxy) on
:1080 instead: a Fake-TLS MTProto proxy whose Telegram-DC connections chain
through the Tailscale userspace SOCKS5 (SOCKS5_HOST=ts-proxy:1055), so egress
still rides the Hetzner exit node. Client-facing hop is domestic Fake-TLS to
test the hypothesis that TSPU bites hardest at the border. 3proxy keeps only
the HTTP front (:3128). The proxy secret lives in a host-only config.py
(0600, uid 10000, not in git); config.py.example is the secret-free template.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tailscale-proxy/mtproto/config.py.example

@@ -0,0 +1,34 @@
+# alexbers/mtprotoproxy config for the tekhnohim Telegram Fake-TLS MTProto proxy.
+#
+# The REAL config.py is host-only at /mnt/containers/tailscale-proxy/mtproto/config.py
+# (mode 0600, owned by uid 10000 = the container's `tgproxy` user, NOT in git),
+# because USERS holds the proxy secret. This file is the secret-free template.
+#
+# Egress: SOCKS5_HOST/SOCKS5_PORT point at the Tailscale userspace SOCKS5
+# (ts-proxy:1055), so every Telegram-DC connection exits via the Hetzner exit
+# node (89.167.72.79). The client-facing side is Fake-TLS (looks like HTTPS to
+# TLS_DOMAIN), which survives TSPU where the retired raw SOCKS5 did not.
+
+PORT = 1080
+
+# username -> 32-hex-char secret (16 bytes). Generate: openssl rand -hex 16
+USERS = {
+    "tekhnohim": "00000000000000000000000000000000",
+}
+
+# Fake-TLS only (best obfuscation). classic/secure are easier to fingerprint.
+MODES = {
+    "classic": False,
+    "secure": False,
+    "tls": True,
+}
+
+# SNI presented in the Fake-TLS handshake. Must be a real, reachable HTTPS host.
+# Tunable if a given domain is filtered on the client path.
+TLS_DOMAIN = "www.google.com"
+
+# Upstream SOCKS5 = the Tailscale userspace proxy -> Hetzner exit node.
+SOCKS5_HOST = "ts-proxy"
+SOCKS5_PORT = 1055
+SOCKS5_USER = None
+SOCKS5_PASS = None