pipistrelloandClaude Opus 4.8
8f95385b89
alexbers/mtprotoproxy's Fake-TLS handshake was rejected by real Telegram clients (server/clock/secret/egress all verified good), so replace it with Telemt (ghcr.io/telemt/telemt:3.4.25) - the same proven implementation as the Hetzner endpoint. Config: Fake-TLS on :1080, use_middle_proxy=false (direct-to-DC, required with a SOCKS5 upstream) and [[upstreams]] socks5 ts-proxy:1055 so only DC-bound traffic exits via the Tailscale exit node. Secret in host-only telemt.toml; config.py.example (alexbers) removed. Telemt stays on json-file (its tracing logs don't ship cleanly via the syslog driver). Dashboard: retarget the working 3proxy queries from :1080 to the HTTP front :3128 (the old HTTP section used stale tinyproxy patterns), drop the retired SOCKS5 section, add a Telegram/Telemt info panel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
65 lines
2.5 KiB
YAML
65 lines
2.5 KiB
YAML
services:
|
|
ts-proxy:
|
|
image: tailscale/tailscale:v1.98.9
|
|
container_name: ts-proxy
|
|
hostname: technohim-lan-proxy
|
|
restart: unless-stopped
|
|
env_file: ["/mnt/containers/tailscale-proxy/ts.env"]
|
|
environment:
|
|
TS_HOSTNAME: technohim-lan-proxy
|
|
TS_STATE_DIR: /var/lib/tailscale
|
|
TS_USERSPACE: "true"
|
|
TS_ACCEPT_DNS: "false"
|
|
TS_EXTRA_ARGS: "--exit-node=100.121.234.85 --reset"
|
|
TS_TAILSCALED_EXTRA_ARGS: "--socks5-server=0.0.0.0:1055 --outbound-http-proxy-listen=0.0.0.0:1056"
|
|
volumes: ["/mnt/containers/tailscale-proxy/state:/var/lib/tailscale:z"]
|
|
networks: [proxynet]
|
|
|
|
# 3proxy HTTP front (:3128), LAN passwordless and external password-
|
|
# authenticated, egressing via the Tailscale exit node. (The generic SOCKS5
|
|
# :1080 was retired 2026-07-24 — see below.)
|
|
proxy:
|
|
image: ghcr.io/3proxy/3proxy:latest
|
|
container_name: ts-lan-proxy
|
|
restart: unless-stopped
|
|
depends_on: [ts-proxy]
|
|
volumes:
|
|
- "/mnt/containers/tailscale-proxy/3proxy.cfg:/etc/3proxy/3proxy.cfg:ro,z"
|
|
- "/mnt/containers/tailscale-proxy/3proxy.secret:/etc/3proxy/3proxy.secret:ro,z"
|
|
ports:
|
|
- "192.168.0.35:3128:3128"
|
|
logging:
|
|
driver: syslog
|
|
options:
|
|
syslog-address: "udp://192.168.0.35:514"
|
|
syslog-format: rfc3164
|
|
tag: tailscale-proxy
|
|
networks: [proxynet]
|
|
|
|
# Telegram Fake-TLS MTProto proxy on :1080. Uses Telemt (the same proven
|
|
# implementation as the Hetzner endpoint) after alexbers/mtprotoproxy's
|
|
# Fake-TLS handshake was rejected by real clients (see the mtproto diagnostic).
|
|
# Only DC-bound traffic is chained out through the Tailscale userspace SOCKS5
|
|
# ([[upstreams]] socks5 ts-proxy:1055 in telemt.toml), so egress rides the
|
|
# Hetzner exit node; the client-facing hop is direct Fake-TLS.
|
|
# telemt.toml is host-only (0600, uid 65532/nonroot, NOT in git) - holds the secret.
|
|
telemt:
|
|
image: ghcr.io/telemt/telemt:3.4.25
|
|
container_name: ts-lan-telemt
|
|
restart: unless-stopped
|
|
depends_on: [ts-proxy]
|
|
environment:
|
|
NO_COLOR: "1" # cleaner `docker logs` (no ANSI escapes)
|
|
volumes:
|
|
- "/mnt/containers/tailscale-proxy/telemt/telemt.toml:/app/config.toml:ro,z"
|
|
ports:
|
|
- "192.168.0.35:1080:1080"
|
|
# Stays on json-file: telemt's tracing logs don't ship cleanly over the
|
|
# syslog driver, and `docker logs ts-lan-telemt` is worth keeping for this
|
|
# critical service. Observe it there (or wire its Prometheus metrics later).
|
|
networks: [proxynet]
|
|
|
|
networks:
|
|
proxynet:
|
|
name: tailscale-proxynet
|