services:
  ts-proxy:
    image: tailscale/tailscale:v1.98.9
    container_name: ts-proxy
    hostname: technohim-lan-proxy
    restart: unless-stopped
    env_file: ["/mnt/containers/tailscale-proxy/ts.env"]
    environment:
      TS_HOSTNAME: technohim-lan-proxy
      TS_STATE_DIR: /var/lib/tailscale
      TS_USERSPACE: "true"
      TS_ACCEPT_DNS: "false"
      TS_EXTRA_ARGS: "--exit-node=100.121.234.85 --reset"
      TS_TAILSCALED_EXTRA_ARGS: "--socks5-server=0.0.0.0:1055 --outbound-http-proxy-listen=0.0.0.0:1056"
    volumes: ["/mnt/containers/tailscale-proxy/state:/var/lib/tailscale:z"]
    networks: [proxynet]

  # 3proxy HTTP front (:3128), LAN passwordless and external password-
  # authenticated, egressing via the Tailscale exit node. (The generic SOCKS5
  # :1080 was retired 2026-07-24 — see below.)
  proxy:
    image: ghcr.io/3proxy/3proxy:latest
    container_name: ts-lan-proxy
    restart: unless-stopped
    depends_on: [ts-proxy]
    volumes:
      - "/mnt/containers/tailscale-proxy/3proxy.cfg:/etc/3proxy/3proxy.cfg:ro,z"
      - "/mnt/containers/tailscale-proxy/3proxy.secret:/etc/3proxy/3proxy.secret:ro,z"
    ports:
      - "192.168.0.35:3128:3128"
    logging:
      driver: syslog
      options:
        syslog-address: "udp://192.168.0.35:514"
        syslog-format: rfc3164
        tag: tailscale-proxy
    networks: [proxynet]

  # Telegram-only Fake-TLS MTProto proxy on :1080 (replaces the TSPU-blocked
  # generic SOCKS5). Chains its Telegram-DC connections through the Tailscale
  # userspace SOCKS5 (SOCKS5_HOST=ts-proxy:1055 in config.py) so egress still
  # rides the Hetzner exit node. Client-facing hop is domestic Fake-TLS; the
  # foreign leg is the WireGuard tunnel that already carries the HTTP proxy.
  # config.py is host-only (0600, uid 10000, NOT in git) - holds the secret.
  mtproto:
    image: alexbers/mtprotoproxy:latest
    container_name: ts-lan-mtproto
    restart: unless-stopped
    depends_on: [ts-proxy]
    volumes:
      - "/mnt/containers/tailscale-proxy/mtproto/config.py:/home/tgproxy/config.py:ro,z"
    ports:
      - "192.168.0.35:1080:1080"
    networks: [proxynet]

networks:
  proxynet:
    name: tailscale-proxynet