# Telemt config for the tekhnohim Telegram Fake-TLS MTProto proxy (docker host).
#
# The REAL telemt.toml is host-only at
# /mnt/containers/tailscale-proxy/telemt/telemt.toml (mode 0600, owned by the
# image's nonroot uid 65532, NOT in git) because [access.users] holds the
# proxy secret. This is the secret-free template.
#
# Egress: [[upstreams]] socks5 -> ts-proxy:1055 (Tailscale userspace SOCKS5),
# so ONLY Telegram-DC traffic exits via the Hetzner exit node (89.167.72.79).
# The client-facing side is direct Fake-TLS on :1080.

# Direct-to-DC mode: with a SOCKS5 upstream, only DC-bound traffic is chained,
# so use_middle_proxy MUST be false (middle-proxy/ME servers are not routed
# through the upstream and fail to init behind the Tailscale SOCKS5).
[general]
use_middle_proxy = false

[general.modes]
classic = false
secure = false
tls = true                       # ee / FakeTLS

[server]
port = 1080
# Host TCP :9090 is Cockpit, so compose maps host 192.168.0.35:9092 to this
# container port. Explicit 0.0.0.0 is required because metrics_port alone binds
# Telemt 3.4.25 to container loopback. Only the client-02 Zabbix server may scrape.
metrics_port = 9090
metrics_listen = "0.0.0.0:9090"
metrics_whitelist = ["192.168.0.34/32"]

[censorship]
tls_domain = "www.google.com"    # SNI presented in the Fake-TLS handshake; tunable

[access.users]
# username = 32-hex-char secret (16 bytes). Generate: openssl rand -hex 16
tekhnohim = "00000000000000000000000000000000"

# Chain Telegram-DC connections out through the Tailscale userspace SOCKS5.
[[upstreams]]
type = "socks5"
address = "ts-proxy:1055"
weight = 1
enabled = true