pipistrelloandClaude Opus 4.8
ebf94e668b
Retire the generic SOCKS5 :1080 (raw SOCKS5 is blocked by TSPU/DPI for the external Telegram use case) and add ts-lan-mtproto (alexbers/mtprotoproxy) on :1080 instead: a Fake-TLS MTProto proxy whose Telegram-DC connections chain through the Tailscale userspace SOCKS5 (SOCKS5_HOST=ts-proxy:1055), so egress still rides the Hetzner exit node. Client-facing hop is domestic Fake-TLS to test the hypothesis that TSPU bites hardest at the border. 3proxy keeps only the HTTP front (:3128). The proxy secret lives in a host-only config.py (0600, uid 10000, not in git); config.py.example is the secret-free template. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
59 lines
2.1 KiB
YAML
59 lines
2.1 KiB
YAML
services:
|
|
ts-proxy:
|
|
image: tailscale/tailscale:v1.98.9
|
|
container_name: ts-proxy
|
|
hostname: technohim-lan-proxy
|
|
restart: unless-stopped
|
|
env_file: ["/mnt/containers/tailscale-proxy/ts.env"]
|
|
environment:
|
|
TS_HOSTNAME: technohim-lan-proxy
|
|
TS_STATE_DIR: /var/lib/tailscale
|
|
TS_USERSPACE: "true"
|
|
TS_ACCEPT_DNS: "false"
|
|
TS_EXTRA_ARGS: "--exit-node=100.121.234.85 --reset"
|
|
TS_TAILSCALED_EXTRA_ARGS: "--socks5-server=0.0.0.0:1055 --outbound-http-proxy-listen=0.0.0.0:1056"
|
|
volumes: ["/mnt/containers/tailscale-proxy/state:/var/lib/tailscale:z"]
|
|
networks: [proxynet]
|
|
|
|
# 3proxy HTTP front (:3128), LAN passwordless and external password-
|
|
# authenticated, egressing via the Tailscale exit node. (The generic SOCKS5
|
|
# :1080 was retired 2026-07-24 — see below.)
|
|
proxy:
|
|
image: ghcr.io/3proxy/3proxy:latest
|
|
container_name: ts-lan-proxy
|
|
restart: unless-stopped
|
|
depends_on: [ts-proxy]
|
|
volumes:
|
|
- "/mnt/containers/tailscale-proxy/3proxy.cfg:/etc/3proxy/3proxy.cfg:ro,z"
|
|
- "/mnt/containers/tailscale-proxy/3proxy.secret:/etc/3proxy/3proxy.secret:ro,z"
|
|
ports:
|
|
- "192.168.0.35:3128:3128"
|
|
logging:
|
|
driver: syslog
|
|
options:
|
|
syslog-address: "udp://192.168.0.35:514"
|
|
syslog-format: rfc3164
|
|
tag: tailscale-proxy
|
|
networks: [proxynet]
|
|
|
|
# Telegram-only Fake-TLS MTProto proxy on :1080 (replaces the TSPU-blocked
|
|
# generic SOCKS5). Chains its Telegram-DC connections through the Tailscale
|
|
# userspace SOCKS5 (SOCKS5_HOST=ts-proxy:1055 in config.py) so egress still
|
|
# rides the Hetzner exit node. Client-facing hop is domestic Fake-TLS; the
|
|
# foreign leg is the WireGuard tunnel that already carries the HTTP proxy.
|
|
# config.py is host-only (0600, uid 10000, NOT in git) - holds the secret.
|
|
mtproto:
|
|
image: alexbers/mtprotoproxy:latest
|
|
container_name: ts-lan-mtproto
|
|
restart: unless-stopped
|
|
depends_on: [ts-proxy]
|
|
volumes:
|
|
- "/mnt/containers/tailscale-proxy/mtproto/config.py:/home/tgproxy/config.py:ro,z"
|
|
ports:
|
|
- "192.168.0.35:1080:1080"
|
|
networks: [proxynet]
|
|
|
|
networks:
|
|
proxynet:
|
|
name: tailscale-proxynet
|