pipistrelloandClaude Opus 4.8
8f95385b89
alexbers/mtprotoproxy's Fake-TLS handshake was rejected by real Telegram clients (server/clock/secret/egress all verified good), so replace it with Telemt (ghcr.io/telemt/telemt:3.4.25) - the same proven implementation as the Hetzner endpoint. Config: Fake-TLS on :1080, use_middle_proxy=false (direct-to-DC, required with a SOCKS5 upstream) and [[upstreams]] socks5 ts-proxy:1055 so only DC-bound traffic exits via the Tailscale exit node. Secret in host-only telemt.toml; config.py.example (alexbers) removed. Telemt stays on json-file (its tracing logs don't ship cleanly via the syslog driver). Dashboard: retarget the working 3proxy queries from :1080 to the HTTP front :3128 (the old HTTP section used stale tinyproxy patterns), drop the retired SOCKS5 section, add a Telegram/Telemt info panel. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
39 lines
1.3 KiB
TOML
39 lines
1.3 KiB
TOML
# Telemt config for the tekhnohim Telegram Fake-TLS MTProto proxy (docker host).
|
|
#
|
|
# The REAL telemt.toml is host-only at
|
|
# /mnt/containers/tailscale-proxy/telemt/telemt.toml (mode 0600, owned by the
|
|
# image's nonroot uid 65532, NOT in git) because [access.users] holds the
|
|
# proxy secret. This is the secret-free template.
|
|
#
|
|
# Egress: [[upstreams]] socks5 -> ts-proxy:1055 (Tailscale userspace SOCKS5),
|
|
# so ONLY Telegram-DC traffic exits via the Hetzner exit node (89.167.72.79).
|
|
# The client-facing side is direct Fake-TLS on :1080.
|
|
|
|
# Direct-to-DC mode: with a SOCKS5 upstream, only DC-bound traffic is chained,
|
|
# so use_middle_proxy MUST be false (middle-proxy/ME servers are not routed
|
|
# through the upstream and fail to init behind the Tailscale SOCKS5).
|
|
[general]
|
|
use_middle_proxy = false
|
|
|
|
[general.modes]
|
|
classic = false
|
|
secure = false
|
|
tls = true # ee / FakeTLS
|
|
|
|
[server]
|
|
port = 1080
|
|
|
|
[censorship]
|
|
tls_domain = "www.google.com" # SNI presented in the Fake-TLS handshake; tunable
|
|
|
|
[access.users]
|
|
# username = 32-hex-char secret (16 bytes). Generate: openssl rand -hex 16
|
|
tekhnohim = "00000000000000000000000000000000"
|
|
|
|
# Chain Telegram-DC connections out through the Tailscale userspace SOCKS5.
|
|
[[upstreams]]
|
|
type = "socks5"
|
|
address = "ts-proxy:1055"
|
|
weight = 1
|
|
enabled = true
|