pipistrello
229fddfc89
Publish Telemt's container metrics port 9090 as 192.168.0.35:9092 because Cockpit already owns host port 9090. Bind the application listener to 0.0.0.0 inside the container and restrict Telemt's metrics whitelist to the client-02 Zabbix server at 192.168.0.34/32.\n\nDocument the Zabbix template macro URL and the Telemt 3.4.25 loopback-binding gotcha. The live endpoint returned HTTP 200 with 40,235 bytes from the Zabbix server; Telemt remained healthy and rebuilt its Telegram DC connections in six seconds.
45 lines
1.6 KiB
TOML
45 lines
1.6 KiB
TOML
# Telemt config for the tekhnohim Telegram Fake-TLS MTProto proxy (docker host).
|
|
#
|
|
# The REAL telemt.toml is host-only at
|
|
# /mnt/containers/tailscale-proxy/telemt/telemt.toml (mode 0600, owned by the
|
|
# image's nonroot uid 65532, NOT in git) because [access.users] holds the
|
|
# proxy secret. This is the secret-free template.
|
|
#
|
|
# Egress: [[upstreams]] socks5 -> ts-proxy:1055 (Tailscale userspace SOCKS5),
|
|
# so ONLY Telegram-DC traffic exits via the Hetzner exit node (89.167.72.79).
|
|
# The client-facing side is direct Fake-TLS on :1080.
|
|
|
|
# Direct-to-DC mode: with a SOCKS5 upstream, only DC-bound traffic is chained,
|
|
# so use_middle_proxy MUST be false (middle-proxy/ME servers are not routed
|
|
# through the upstream and fail to init behind the Tailscale SOCKS5).
|
|
[general]
|
|
use_middle_proxy = false
|
|
|
|
[general.modes]
|
|
classic = false
|
|
secure = false
|
|
tls = true # ee / FakeTLS
|
|
|
|
[server]
|
|
port = 1080
|
|
# Host TCP :9090 is Cockpit, so compose maps host 192.168.0.35:9092 to this
|
|
# container port. Explicit 0.0.0.0 is required because metrics_port alone binds
|
|
# Telemt 3.4.25 to container loopback. Only the client-02 Zabbix server may scrape.
|
|
metrics_port = 9090
|
|
metrics_listen = "0.0.0.0:9090"
|
|
metrics_whitelist = ["192.168.0.34/32"]
|
|
|
|
[censorship]
|
|
tls_domain = "www.google.com" # SNI presented in the Fake-TLS handshake; tunable
|
|
|
|
[access.users]
|
|
# username = 32-hex-char secret (16 bytes). Generate: openssl rand -hex 16
|
|
tekhnohim = "00000000000000000000000000000000"
|
|
|
|
# Chain Telegram-DC connections out through the Tailscale userspace SOCKS5.
|
|
[[upstreams]]
|
|
type = "socks5"
|
|
address = "ts-proxy:1055"
|
|
weight = 1
|
|
enabled = true
|