# Telegram proxy through Xray Reality

This stack publishes TeleProxy only on the client LAN:

- client endpoint: `192.168.0.35:10443/tcp`;
- TeleProxy runs in direct mode;
- Telegram DC traffic goes to the local Xray SOCKS5 client;
- Xray sends the outbound leg through the dedicated Hetzner VLESS+Reality
  server at `89.167.72.79:443`;
- Nginx Proxy Manager keeps exclusive ownership of host ports `80` and `443`.

The stack deliberately keeps credential-bearing files outside Git:

| Host path | Purpose | Required mode |
|---|---|---|
| `/mnt/containers/telegram-reality/xray-client.json` | Xray Reality client credentials and local SOCKS inbound | `0600`, owner `65532:65532` |
| `/mnt/containers/telegram-reality/teleproxy.env` | TeleProxy secret and label | `0600`, owner `root:root` |
| `/mnt/containers/telegram-reality/teleproxy-link.txt` | Generated LAN-only Telegram connection link | `0600`, owner `root:root` |

Deploy this directory as a Portainer Git stack named `telegram-reality`, or run
it with Docker Compose using project name `telegram-reality`. The absolute
configuration files must already exist on the host before deployment.