pipistrello
7ebe9f2a7e
Add a dedicated Git-managed stack that leaves the existing Nginx Proxy Manager bindings on ports 80/443 unchanged and publishes the Telegram endpoint only on 192.168.0.35:10443.\n\nTeleProxy direct-mode traffic is routed through an isolated Xray SOCKS5 client and the dedicated Hetzner VLESS+Reality egress at 89.167.72.79:443. Both upstream images are digest-pinned. Credential-bearing Xray and TeleProxy files remain root-controlled host files under /mnt/containers/telegram-reality and are explicitly excluded from Git.
Telegram proxy through Xray Reality
This stack publishes TeleProxy only on the client LAN:
- client endpoint:
192.168.0.35:10443/tcp; - TeleProxy runs in direct mode;
- Telegram DC traffic goes to the local Xray SOCKS5 client;
- Xray sends the outbound leg through the dedicated Hetzner VLESS+Reality
server at
89.167.72.79:443; - Nginx Proxy Manager keeps exclusive ownership of host ports
80and443.
The stack deliberately keeps credential-bearing files outside Git:
| Host path | Purpose | Required mode |
|---|---|---|
/mnt/containers/telegram-reality/xray-client.json |
Xray Reality client credentials and local SOCKS inbound | 0600, owner 65532:65532 |
/mnt/containers/telegram-reality/teleproxy.env |
TeleProxy secret and label | 0600, owner root:root |
/mnt/containers/telegram-reality/teleproxy-link.txt |
Generated LAN-only Telegram connection link | 0600, owner root:root |
Deploy this directory as a Portainer Git stack named telegram-reality, or run
it with Docker Compose using project name telegram-reality. The absolute
configuration files must already exist on the host before deployment.