services:
  ts-proxy:
    image: tailscale/tailscale:v1.98.9
    container_name: ts-proxy
    hostname: technohim-lan-proxy
    restart: unless-stopped
    env_file: ["/mnt/containers/tailscale-proxy/ts.env"]
    environment:
      TS_HOSTNAME: technohim-lan-proxy
      TS_STATE_DIR: /var/lib/tailscale
      TS_USERSPACE: "true"
      TS_ACCEPT_DNS: "false"
      TS_EXTRA_ARGS: "--exit-node=100.121.234.85 --reset"
      TS_TAILSCALED_EXTRA_ARGS: "--socks5-server=0.0.0.0:1055 --outbound-http-proxy-listen=0.0.0.0:1056"
    volumes: ["/mnt/containers/tailscale-proxy/state:/var/lib/tailscale:z"]
    networks: [proxynet]

  # 3proxy HTTP front (:3128), LAN passwordless and external password-
  # authenticated, egressing via the Tailscale exit node. (The generic SOCKS5
  # :1080 was retired 2026-07-24 — see below.)
  proxy:
    image: ghcr.io/3proxy/3proxy:latest
    container_name: ts-lan-proxy
    restart: unless-stopped
    depends_on: [ts-proxy]
    volumes:
      - "/mnt/containers/tailscale-proxy/3proxy.cfg:/etc/3proxy/3proxy.cfg:ro,z"
      - "/mnt/containers/tailscale-proxy/3proxy.secret:/etc/3proxy/3proxy.secret:ro,z"
    ports:
      - "192.168.0.35:3128:3128"
    logging:
      driver: syslog
      options:
        syslog-address: "udp://192.168.0.35:514"
        syslog-format: rfc3164
        tag: tailscale-proxy
    networks: [proxynet]

  # Telegram Fake-TLS MTProto proxy on :1080. Uses Telemt (the same proven
  # implementation as the Hetzner endpoint) after alexbers/mtprotoproxy's
  # Fake-TLS handshake was rejected by real clients (see the mtproto diagnostic).
  # Only DC-bound traffic is chained out through the Tailscale userspace SOCKS5
  # ([[upstreams]] socks5 ts-proxy:1055 in telemt.toml), so egress rides the
  # Hetzner exit node; the client-facing hop is direct Fake-TLS.
  # telemt.toml is host-only (0600, uid 65532/nonroot, NOT in git) - holds the secret.
  telemt:
    image: ghcr.io/telemt/telemt:3.4.25
    container_name: ts-lan-telemt
    restart: unless-stopped
    depends_on: [ts-proxy]
    environment:
      NO_COLOR: "1"                # cleaner `docker logs` (no ANSI escapes)
    volumes:
      - "/mnt/containers/tailscale-proxy/telemt/telemt.toml:/app/config.toml:ro,z"
    ports:
      - "192.168.0.35:1080:1080"
    # Stays on json-file: telemt's tracing logs don't ship cleanly over the
    # syslog driver, and `docker logs ts-lan-telemt` is worth keeping for this
    # critical service. Observe it there (or wire its Prometheus metrics later).
    networks: [proxynet]

networks:
  proxynet:
    name: tailscale-proxynet