pipistrello
331c274b8b
Completes the pair started in e41b55c, which deliberately left the proxy service
out because it was still on a runtime prlimit only and had not yet had its
maintenance window.
ts-lan-proxy was subject to the same Docker default soft limit of 1024 that took
Telemt down on 2026-09-09 — 3proxy does not raise its own limit either, and the
container's HostConfig.Ulimits was null. Steady state is ~22 descriptors, so the
ceiling was ~2% used in normal operation.
Applied on the client-02 host at 22:45 MSK with
docker compose up -d --no-deps --force-recreate proxy
never a whole-stack up -d, which would also recreate ts-vpn and leave
ts-lan-ikev2 holding a stale namespace. Verified afterwards: HostConfig.Ulimits
now 65536/524288, container IP unchanged (172.31.0.4), egress through the proxy
still measures the exit node 89.167.72.79 against a direct-egress control of
212.116.102.42, 3proxy.cfg untouched so the conditional-auth behaviour is
unchanged, and the syslog log driver still emits access lines (confirmed on the
wire).
This file is STILL missing ts-vpn and ts-lan-ikev2, which have run on the host
since 2026-09-05 — deploying it as-is would take the IKEv2 VPN down. That drift
is unrelated to this commit and still needs its own.
80 lines
3.1 KiB
YAML
80 lines
3.1 KiB
YAML
services:
|
|
ts-proxy:
|
|
image: tailscale/tailscale:v1.98.9
|
|
container_name: ts-proxy
|
|
hostname: technohim-lan-proxy
|
|
restart: unless-stopped
|
|
env_file: ["/mnt/containers/tailscale-proxy/ts.env"]
|
|
environment:
|
|
TS_HOSTNAME: technohim-lan-proxy
|
|
TS_STATE_DIR: /var/lib/tailscale
|
|
TS_USERSPACE: "true"
|
|
TS_ACCEPT_DNS: "false"
|
|
TS_EXTRA_ARGS: "--exit-node=100.121.234.85 --reset"
|
|
TS_TAILSCALED_EXTRA_ARGS: "--socks5-server=0.0.0.0:1055 --outbound-http-proxy-listen=0.0.0.0:1056"
|
|
volumes: ["/mnt/containers/tailscale-proxy/state:/var/lib/tailscale:z"]
|
|
networks: [proxynet]
|
|
|
|
# 3proxy HTTP front (:3128), LAN passwordless and external password-
|
|
# authenticated, egressing via the Tailscale exit node. (The generic SOCKS5
|
|
# :1080 was retired 2026-07-24 — see below.)
|
|
proxy:
|
|
image: ghcr.io/3proxy/3proxy:latest
|
|
container_name: ts-lan-proxy
|
|
restart: unless-stopped
|
|
# Same Docker default-1024 trap that took Telemt down on 2026-09-09; 3proxy
|
|
# does not raise its own soft limit either. Steady state is ~22 descriptors.
|
|
ulimits:
|
|
nofile:
|
|
soft: 65536
|
|
hard: 524288
|
|
depends_on: [ts-proxy]
|
|
volumes:
|
|
- "/mnt/containers/tailscale-proxy/3proxy.cfg:/etc/3proxy/3proxy.cfg:ro,z"
|
|
- "/mnt/containers/tailscale-proxy/3proxy.secret:/etc/3proxy/3proxy.secret:ro,z"
|
|
ports:
|
|
- "192.168.0.35:3128:3128"
|
|
logging:
|
|
driver: syslog
|
|
options:
|
|
syslog-address: "udp://192.168.0.35:514"
|
|
syslog-format: rfc3164
|
|
tag: tailscale-proxy
|
|
networks: [proxynet]
|
|
|
|
# Telegram Fake-TLS MTProto proxy on :1080. Uses Telemt (the same proven
|
|
# implementation as the Hetzner endpoint) after alexbers/mtprotoproxy's
|
|
# Fake-TLS handshake was rejected by real clients (see the mtproto diagnostic).
|
|
# Only DC-bound traffic is chained out through the Tailscale userspace SOCKS5
|
|
# ([[upstreams]] socks5 ts-proxy:1055 in telemt.toml), so egress rides the
|
|
# Hetzner exit node; the client-facing hop is direct Fake-TLS.
|
|
# telemt.toml is host-only (0600, uid 65532/nonroot, NOT in git) - holds the secret.
|
|
telemt:
|
|
image: ghcr.io/telemt/telemt:3.4.25
|
|
container_name: ts-lan-telemt
|
|
restart: unless-stopped
|
|
# Docker default soft nofile is 1024. A connection flood on the public :1080
|
|
# exhausted it on 2026-09-09 and accept() then failed for EVERY caller, for
|
|
# ~8 minutes. Steady state needs only ~45-73 descriptors.
|
|
ulimits:
|
|
nofile:
|
|
soft: 65536
|
|
hard: 524288
|
|
depends_on: [ts-proxy]
|
|
environment:
|
|
NO_COLOR: "1" # cleaner `docker logs` (no ANSI escapes)
|
|
volumes:
|
|
- "/mnt/containers/tailscale-proxy/telemt/telemt.toml:/app/config.toml:ro,z"
|
|
ports:
|
|
- "192.168.0.35:1080:1080"
|
|
# Host :9090 belongs to Cockpit; expose Telemt metrics on :9092 instead.
|
|
- "192.168.0.35:9092:9090"
|
|
# Stays on json-file: telemt's tracing logs don't ship cleanly over the
|
|
# syslog driver, and `docker logs ts-lan-telemt` is worth keeping for this
|
|
# critical service. Prometheus metrics are scraped by Zabbix on :9092.
|
|
networks: [proxynet]
|
|
|
|
networks:
|
|
proxynet:
|
|
name: tailscale-proxynet
|