pipistrello
7ebe9f2a7e
Add a dedicated Git-managed stack that leaves the existing Nginx Proxy Manager bindings on ports 80/443 unchanged and publishes the Telegram endpoint only on 192.168.0.35:10443.\n\nTeleProxy direct-mode traffic is routed through an isolated Xray SOCKS5 client and the dedicated Hetzner VLESS+Reality egress at 89.167.72.79:443. Both upstream images are digest-pinned. Credential-bearing Xray and TeleProxy files remain root-controlled host files under /mnt/containers/telegram-reality and are explicitly excluded from Git.
48 lines
1.3 KiB
YAML
48 lines
1.3 KiB
YAML
services:
|
|
xray-client:
|
|
image: ghcr.io/xtls/xray-core@sha256:592ec4d11f656db95598d01e76dbcc6e002d67360b96a5436500a938230f52c7
|
|
container_name: telegram-reality-xray
|
|
command:
|
|
- run
|
|
- -config
|
|
- /etc/xray/config.json
|
|
restart: unless-stopped
|
|
volumes:
|
|
- /mnt/containers/telegram-reality/xray-client.json:/etc/xray/config.json:ro,Z
|
|
networks:
|
|
- telegram-reality-nw
|
|
healthcheck:
|
|
test: ["CMD", "xray", "run", "-test", "-config", "/etc/xray/config.json"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
teleproxy:
|
|
image: ghcr.io/teleproxy/teleproxy@sha256:f1d4c169d1a94a0d4871f9596fb2ca2783dc3015bcabe168ae59bc74c7a75e64
|
|
container_name: telegram-reality-teleproxy
|
|
restart: unless-stopped
|
|
depends_on:
|
|
xray-client:
|
|
condition: service_healthy
|
|
env_file:
|
|
- /mnt/containers/telegram-reality/teleproxy.env
|
|
environment:
|
|
DIRECT_MODE: "true"
|
|
SOCKS5_PROXY: "socks5://xray-client:1080"
|
|
PORT: "443"
|
|
EXTERNAL_PORT: "10443"
|
|
STATS_PORT: "8888"
|
|
WORKERS: "1"
|
|
EE_DOMAIN: "www.google.com"
|
|
EXTERNAL_IP: "89.167.72.79"
|
|
MSS_CLAMP: "false"
|
|
ports:
|
|
- "192.168.0.35:10443:443/tcp"
|
|
networks:
|
|
- telegram-reality-nw
|
|
|
|
networks:
|
|
telegram-reality-nw:
|
|
name: telegram-reality-nw
|