pipistrello
7ebe9f2a7e
Add a dedicated Git-managed stack that leaves the existing Nginx Proxy Manager bindings on ports 80/443 unchanged and publishes the Telegram endpoint only on 192.168.0.35:10443.\n\nTeleProxy direct-mode traffic is routed through an isolated Xray SOCKS5 client and the dedicated Hetzner VLESS+Reality egress at 89.167.72.79:443. Both upstream images are digest-pinned. Credential-bearing Xray and TeleProxy files remain root-controlled host files under /mnt/containers/telegram-reality and are explicitly excluded from Git.
23 lines
1.1 KiB
Markdown
23 lines
1.1 KiB
Markdown
# Telegram proxy through Xray Reality
|
|
|
|
This stack publishes TeleProxy only on the client LAN:
|
|
|
|
- client endpoint: `192.168.0.35:10443/tcp`;
|
|
- TeleProxy runs in direct mode;
|
|
- Telegram DC traffic goes to the local Xray SOCKS5 client;
|
|
- Xray sends the outbound leg through the dedicated Hetzner VLESS+Reality
|
|
server at `89.167.72.79:443`;
|
|
- Nginx Proxy Manager keeps exclusive ownership of host ports `80` and `443`.
|
|
|
|
The stack deliberately keeps credential-bearing files outside Git:
|
|
|
|
| Host path | Purpose | Required mode |
|
|
|---|---|---|
|
|
| `/mnt/containers/telegram-reality/xray-client.json` | Xray Reality client credentials and local SOCKS inbound | `0600`, owner `65532:65532` |
|
|
| `/mnt/containers/telegram-reality/teleproxy.env` | TeleProxy secret and label | `0600`, owner `root:root` |
|
|
| `/mnt/containers/telegram-reality/teleproxy-link.txt` | Generated LAN-only Telegram connection link | `0600`, owner `root:root` |
|
|
|
|
Deploy this directory as a Portainer Git stack named `telegram-reality`, or run
|
|
it with Docker Compose using project name `telegram-reality`. The absolute
|
|
configuration files must already exist on the host before deployment.
|