Replace the static Telemt observation text in the Tailscale proxy dashboard with eight Zabbix-backed panels. Make current unique active client IPs the dominant stat, alongside active/total connections, user and connection history, cumulative traffic, uptime, and byte totals.\n\nAll eight queries were exercised through Grafana's /api/ds/query endpoint against datasource zabbix-02 and returned HTTP 200. Current values included 3 unique active IPs, 10 active connections, and 216 total connections. The provisioned dashboard loaded as version 4, the live and tracked JSON hashes match, and Grafana remains running with zero restarts.
alexbers/mtprotoproxy's Fake-TLS handshake was rejected by real Telegram
clients (server/clock/secret/egress all verified good), so replace it with
Telemt (ghcr.io/telemt/telemt:3.4.25) - the same proven implementation as the
Hetzner endpoint. Config: Fake-TLS on :1080, use_middle_proxy=false (direct-to-DC,
required with a SOCKS5 upstream) and [[upstreams]] socks5 ts-proxy:1055 so only
DC-bound traffic exits via the Tailscale exit node. Secret in host-only
telemt.toml; config.py.example (alexbers) removed. Telemt stays on json-file
(its tracing logs don't ship cleanly via the syslog driver).
Dashboard: retarget the working 3proxy queries from :1080 to the HTTP front
:3128 (the old HTTP section used stale tinyproxy patterns), drop the retired
SOCKS5 section, add a Telegram/Telemt info panel.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Extends the Grafana dashboard with a second section for the 3proxy SOCKS5 front,
built from its access log already in Loki (docker syslog log-driver, tag
tailscale-socks5). Panels: total connections / unique clients / unique
destinations, connections-over-time, byte throughput (unwrap bout), top
destinations + top clients tables, and a live SOCKS5 access log. SOCKS5 lines
are isolated from the tinyproxy lines by content (`|~ " 1080 [0-9]{5} "`) since
Alloy doesn't lift the syslog app-name into a label. Dashboard now 17 panels,
version 2, two labeled rows (HTTP :3128 / SOCKS5 :1080).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New stack tailscale-proxy: a LAN HTTP proxy (192.168.0.35:3128) that egresses
through the dedicated Hetzner Tailscale exit node fedora-technohim, so proxied
LAN clients appear on the internet as 89.167.72.79 without routing the docker
host itself through the tunnel.
- ts-proxy: Tailscale in userspace mode (--exit-node=100.121.234.85), exposing a
SOCKS5 proxy on :1055. Userspace mode makes no host route/firewall changes.
- tinyproxy: LAN-facing forward proxy on :3128 (Allow 192.168.0.0/22), upstream
socks5 to ts-proxy. Access log shipped to Alloy/Loki via the syslog
log-driver (tag tailscale-proxy).
The Tailscale auth key stays outside Git in /mnt/containers/tailscale-proxy/
ts.env (0600); node state persists in the state/ dir. tinyproxy.conf is tracked
here as source of truth. See tailscale-proxy/README.md.
Also adds logging/grafana-dashboards/tailscale-proxy.json: a Loki dashboard
(request rate by method, top destinations, top clients, totals, live access
log) built from the tinyproxy syslog stream, matching the existing dashboards'
schemaVersion 39 + ${datasource} template-var pattern.
Full build record in ops-knowledge
diagnostics/2026-07-23-02-tekhnohim-docker-tailscale-exit-proxy-stack.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
pipistrello
