pipistrello
e41b55ca4f
Mirrors what is now running on the client-02 docker host, so a "pull and redeploy" from this repo can no longer silently revert it. On 2026-09-09 a connection flood against the public :1080 (peak 4,301 connections/minute, ~100% failing the Fake-TLS handshake) exhausted the Telemt container's file-descriptor table, which sat at Docker's default soft limit of 1024. accept() then failed for every caller — real Telegram clients and the monitoring collector alike — until the burst drained. Steady state needs only 45-73 descriptors, so the ceiling was ~7% used in normal operation. ulimits: nofile 65536/524288 on the telemt service The host was mitigated at runtime with prlimit on the day, but that is lost on any recreate, and this compose is exactly what a redeploy would restore. The proxy (3proxy) service deliberately does NOT get the block in this commit — it is still on the runtime limit only and is scheduled for its own window, so adding it here would make the repo claim something that is not yet true. rst_on_close = "errors" in telemt.toml.example Scanners and DPI probes that never complete the handshake leave orphaned sockets in FIN-WAIT-1. "errors" sets SO_LINGER(0) at accept() and clears it once a client authenticates, so real sessions still close gracefully with FIN and only pre-auth closes are aborted. Verified on the wire on the host: a failed handshake now ends FIN then RST, while authenticated sessions in the same capture closed FIN-only. Applied on the host at 22:17 MSK via telemt-safe-restart: healthy in 10s, container IP unchanged, bad-handshake delta 0 over a 5-minute recheck, no EMFILE since. NOTE for whoever deploys this stack from this repo: it is still missing the ts-vpn + ts-lan-ikev2 services that have been running on the client-02 host since 2026-09-05. Deploying this file as-is would take the IKEv2 VPN front down. That drift is untouched here and needs its own commit.
51 lines
1.9 KiB
TOML
51 lines
1.9 KiB
TOML
# Telemt config for the tekhnohim Telegram Fake-TLS MTProto proxy (docker host).
|
|
#
|
|
# The REAL telemt.toml is host-only at
|
|
# /mnt/containers/tailscale-proxy/telemt/telemt.toml (mode 0600, owned by the
|
|
# image's nonroot uid 65532, NOT in git) because [access.users] holds the
|
|
# proxy secret. This is the secret-free template.
|
|
#
|
|
# Egress: [[upstreams]] socks5 -> ts-proxy:1055 (Tailscale userspace SOCKS5),
|
|
# so ONLY Telegram-DC traffic exits via the Hetzner exit node (89.167.72.79).
|
|
# The client-facing side is direct Fake-TLS on :1080.
|
|
|
|
# Direct-to-DC mode: with a SOCKS5 upstream, only DC-bound traffic is chained,
|
|
# so use_middle_proxy MUST be false (middle-proxy/ME servers are not routed
|
|
# through the upstream and fail to init behind the Tailscale SOCKS5).
|
|
[general]
|
|
use_middle_proxy = false
|
|
|
|
# Scanners/DPI probes that never complete the Fake-TLS handshake leave orphaned
|
|
# sockets in FIN-WAIT-1. "errors" sets SO_LINGER(0) at accept() and CLEARS it once
|
|
# a client authenticates, so real sessions still close gracefully with FIN and only
|
|
# pre-auth closes get an RST. Applied at 02-tekhnohim 2026-09-09.
|
|
rst_on_close = "errors"
|
|
|
|
[general.modes]
|
|
classic = false
|
|
secure = false
|
|
tls = true # ee / FakeTLS
|
|
|
|
[server]
|
|
port = 1080
|
|
# Host TCP :9090 is Cockpit, so compose maps host 192.168.0.35:9092 to this
|
|
# container port. Explicit 0.0.0.0 is required because metrics_port alone binds
|
|
# Telemt 3.4.25 to container loopback. Only the client-02 Zabbix server may scrape.
|
|
metrics_port = 9090
|
|
metrics_listen = "0.0.0.0:9090"
|
|
metrics_whitelist = ["192.168.0.34/32"]
|
|
|
|
[censorship]
|
|
tls_domain = "www.google.com" # SNI presented in the Fake-TLS handshake; tunable
|
|
|
|
[access.users]
|
|
# username = 32-hex-char secret (16 bytes). Generate: openssl rand -hex 16
|
|
tekhnohim = "00000000000000000000000000000000"
|
|
|
|
# Chain Telegram-DC connections out through the Tailscale userspace SOCKS5.
|
|
[[upstreams]]
|
|
type = "socks5"
|
|
address = "ts-proxy:1055"
|
|
weight = 1
|
|
enabled = true
|