pipistrello
229fddfc89
Publish Telemt's container metrics port 9090 as 192.168.0.35:9092 because Cockpit already owns host port 9090. Bind the application listener to 0.0.0.0 inside the container and restrict Telemt's metrics whitelist to the client-02 Zabbix server at 192.168.0.34/32.\n\nDocument the Zabbix template macro URL and the Telemt 3.4.25 loopback-binding gotcha. The live endpoint returned HTTP 200 with 40,235 bytes from the Zabbix server; Telemt remained healthy and rebuilt its Telegram DC connections in six seconds.
67 lines
2.6 KiB
YAML
67 lines
2.6 KiB
YAML
services:
|
|
ts-proxy:
|
|
image: tailscale/tailscale:v1.98.9
|
|
container_name: ts-proxy
|
|
hostname: technohim-lan-proxy
|
|
restart: unless-stopped
|
|
env_file: ["/mnt/containers/tailscale-proxy/ts.env"]
|
|
environment:
|
|
TS_HOSTNAME: technohim-lan-proxy
|
|
TS_STATE_DIR: /var/lib/tailscale
|
|
TS_USERSPACE: "true"
|
|
TS_ACCEPT_DNS: "false"
|
|
TS_EXTRA_ARGS: "--exit-node=100.121.234.85 --reset"
|
|
TS_TAILSCALED_EXTRA_ARGS: "--socks5-server=0.0.0.0:1055 --outbound-http-proxy-listen=0.0.0.0:1056"
|
|
volumes: ["/mnt/containers/tailscale-proxy/state:/var/lib/tailscale:z"]
|
|
networks: [proxynet]
|
|
|
|
# 3proxy HTTP front (:3128), LAN passwordless and external password-
|
|
# authenticated, egressing via the Tailscale exit node. (The generic SOCKS5
|
|
# :1080 was retired 2026-07-24 — see below.)
|
|
proxy:
|
|
image: ghcr.io/3proxy/3proxy:latest
|
|
container_name: ts-lan-proxy
|
|
restart: unless-stopped
|
|
depends_on: [ts-proxy]
|
|
volumes:
|
|
- "/mnt/containers/tailscale-proxy/3proxy.cfg:/etc/3proxy/3proxy.cfg:ro,z"
|
|
- "/mnt/containers/tailscale-proxy/3proxy.secret:/etc/3proxy/3proxy.secret:ro,z"
|
|
ports:
|
|
- "192.168.0.35:3128:3128"
|
|
logging:
|
|
driver: syslog
|
|
options:
|
|
syslog-address: "udp://192.168.0.35:514"
|
|
syslog-format: rfc3164
|
|
tag: tailscale-proxy
|
|
networks: [proxynet]
|
|
|
|
# Telegram Fake-TLS MTProto proxy on :1080. Uses Telemt (the same proven
|
|
# implementation as the Hetzner endpoint) after alexbers/mtprotoproxy's
|
|
# Fake-TLS handshake was rejected by real clients (see the mtproto diagnostic).
|
|
# Only DC-bound traffic is chained out through the Tailscale userspace SOCKS5
|
|
# ([[upstreams]] socks5 ts-proxy:1055 in telemt.toml), so egress rides the
|
|
# Hetzner exit node; the client-facing hop is direct Fake-TLS.
|
|
# telemt.toml is host-only (0600, uid 65532/nonroot, NOT in git) - holds the secret.
|
|
telemt:
|
|
image: ghcr.io/telemt/telemt:3.4.25
|
|
container_name: ts-lan-telemt
|
|
restart: unless-stopped
|
|
depends_on: [ts-proxy]
|
|
environment:
|
|
NO_COLOR: "1" # cleaner `docker logs` (no ANSI escapes)
|
|
volumes:
|
|
- "/mnt/containers/tailscale-proxy/telemt/telemt.toml:/app/config.toml:ro,z"
|
|
ports:
|
|
- "192.168.0.35:1080:1080"
|
|
# Host :9090 belongs to Cockpit; expose Telemt metrics on :9092 instead.
|
|
- "192.168.0.35:9092:9090"
|
|
# Stays on json-file: telemt's tracing logs don't ship cleanly over the
|
|
# syslog driver, and `docker logs ts-lan-telemt` is worth keeping for this
|
|
# critical service. Prometheus metrics are scraped by Zabbix on :9092.
|
|
networks: [proxynet]
|
|
|
|
networks:
|
|
proxynet:
|
|
name: tailscale-proxynet
|