pipistrello
673d747abd
Telemt's Prometheus endpoint exposes only active-IP counts, while its loopback control API includes both the address list and sensitive proxy links. Add a root systemd timer that enters the Telemt container network namespace, filters the API response in memory, and publishes only username/address rows through the Zabbix agent key telemt.active_ips.list.\n\nThe collector refreshes every 30 seconds, writes atomically with root:zabbix 0640 permissions, and leaves the control API unexposed. Document the host installation and recommend one-day Zabbix history because client IP addresses are sensitive operational data.
Tailscale exit-node LAN proxy
LAN HTTP and SOCKS5 proxies that egress through the dedicated Hetzner Tailscale
exit node, so proxied clients appear on the internet as 89.167.72.79 without
routing the docker host itself through the tunnel.
- HTTP endpoint:
192.168.0.35:3128/tcp(tinyproxy, HTTP/HTTPS forward proxy); - SOCKS5 endpoint:
192.168.0.35:1080/tcp(3proxy, LAN-only); - both fronts accept LAN clients (
192.168.0.0/22) and forward upstream over SOCKS5 to the Tailscale container (tinyproxy upstream socks5,3proxy parent socks5); ts-proxyruns Tailscale in userspace mode and sends outbound traffic through the exit nodefedora-technohim(100.121.234.85);- userspace mode adds no host route/firewall changes — the docker host's own services (NPM, KMS, IPsec) keep egressing via the normal gateway;
- both fronts carry TCP only — QUIC/HTTP3 (UDP) is not proxied, so clients must disable browser QUIC for e.g. YouTube video, or run the Tailscale client directly and use the exit node for a full (UDP-capable) tunnel;
- proxy access logs ship to the logging stack (Alloy → Loki) via the syslog
log-driver (
tag: tailscale-proxyfor HTTP,tag: tailscale-socks5for SOCKS5); the Grafana dashboardlogging/grafana-dashboards/tailscale-proxy.jsonvisualises the HTTP proxy.
The stack deliberately keeps credential-bearing / stateful files outside Git:
| Host path | Purpose | Required mode |
|---|---|---|
/mnt/containers/tailscale-proxy/ts.env |
TS_AUTHKEY=<tailscale auth key> |
0600, owner root:root |
/mnt/containers/tailscale-proxy/state/ |
Tailscale node state (persists identity across restarts) | dir, owner root:root |
/mnt/containers/tailscale-proxy/tinyproxy.conf |
tinyproxy config (also tracked in this directory as the source of truth) | 0644 |
/mnt/containers/tailscale-proxy/3proxy.cfg |
3proxy SOCKS5 config (also tracked in this directory as the source of truth) | 0644 |
Before deploying: create ts.env on the host with a Tailscale auth key, and in
the Tailscale admin console approve the exit node and allow this node to use it.
Deploy this directory as a Portainer Git stack named tailscale-proxy, or run it
with Docker Compose using project name tailscale-proxy. The absolute
configuration files must already exist on the host before deployment.
Full build record and rationale (userspace vs TUN dead-ends, SOCKS5-vs-HTTP,
monitoring) is in ops-knowledge:
diagnostics/2026-07-23-02-tekhnohim-docker-tailscale-exit-proxy-stack.md.
Telemt monitoring
Telemt exports Prometheus metrics on container port 9090, published as
http://192.168.0.35:9092/metrics because host port 9090 is reserved by
Cockpit. The Telemt application whitelist permits only the client-02 Zabbix
server (192.168.0.34/32). In Zabbix, import Telemt's upstream
tools/zbx_telemt_template.yaml, link it to the Docker host, and set
{$TELEMT_URL} to the URL above.
Prometheus deliberately exposes only active-IP counts. The files in
zabbix/ add the text key telemt.active_ips.list without publishing
Telemt's control API. A root timer enters only the container's network
namespace, reads /v1/users, discards links/secrets in memory, and writes a
sanitized username/IP list readable by the Zabbix agent:
install -o root -g root -m 0755 zabbix/zabbix-telemt-active-ips \
/usr/local/libexec/zabbix-telemt-active-ips
install -o root -g root -m 0644 zabbix/zabbix-telemt-active-ips.service \
zabbix/zabbix-telemt-active-ips.timer /etc/systemd/system/
install -o root -g root -m 0644 zabbix/telemt-active-ips.conf \
/etc/zabbix/zabbix_agent2.d/telemt-active-ips.conf
systemctl daemon-reload
systemctl enable --now zabbix-telemt-active-ips.timer
systemctl start zabbix-telemt-active-ips.service
systemctl restart zabbix-agent2
Create a Zabbix agent item on Fedora Kirochnaya with key
telemt.active_ips.list, information type Text, a 30-second update
interval, and one-day history. IP addresses are operationally sensitive; do
not retain this item longer or expose it on unrestricted dashboards.