pipistrelloandClaude Opus 4.8
ebf94e668b
Retire the generic SOCKS5 :1080 (raw SOCKS5 is blocked by TSPU/DPI for the external Telegram use case) and add ts-lan-mtproto (alexbers/mtprotoproxy) on :1080 instead: a Fake-TLS MTProto proxy whose Telegram-DC connections chain through the Tailscale userspace SOCKS5 (SOCKS5_HOST=ts-proxy:1055), so egress still rides the Hetzner exit node. Client-facing hop is domestic Fake-TLS to test the hypothesis that TSPU bites hardest at the border. 3proxy keeps only the HTTP front (:3128). The proxy secret lives in a host-only config.py (0600, uid 10000, not in git); config.py.example is the secret-free template. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
35 lines
1.2 KiB
Plaintext
35 lines
1.2 KiB
Plaintext
# alexbers/mtprotoproxy config for the tekhnohim Telegram Fake-TLS MTProto proxy.
|
|
#
|
|
# The REAL config.py is host-only at /mnt/containers/tailscale-proxy/mtproto/config.py
|
|
# (mode 0600, owned by uid 10000 = the container's `tgproxy` user, NOT in git),
|
|
# because USERS holds the proxy secret. This file is the secret-free template.
|
|
#
|
|
# Egress: SOCKS5_HOST/SOCKS5_PORT point at the Tailscale userspace SOCKS5
|
|
# (ts-proxy:1055), so every Telegram-DC connection exits via the Hetzner exit
|
|
# node (89.167.72.79). The client-facing side is Fake-TLS (looks like HTTPS to
|
|
# TLS_DOMAIN), which survives TSPU where the retired raw SOCKS5 did not.
|
|
|
|
PORT = 1080
|
|
|
|
# username -> 32-hex-char secret (16 bytes). Generate: openssl rand -hex 16
|
|
USERS = {
|
|
"tekhnohim": "00000000000000000000000000000000",
|
|
}
|
|
|
|
# Fake-TLS only (best obfuscation). classic/secure are easier to fingerprint.
|
|
MODES = {
|
|
"classic": False,
|
|
"secure": False,
|
|
"tls": True,
|
|
}
|
|
|
|
# SNI presented in the Fake-TLS handshake. Must be a real, reachable HTTPS host.
|
|
# Tunable if a given domain is filtered on the client path.
|
|
TLS_DOMAIN = "www.google.com"
|
|
|
|
# Upstream SOCKS5 = the Tailscale userspace proxy -> Hetzner exit node.
|
|
SOCKS5_HOST = "ts-proxy"
|
|
SOCKS5_PORT = 1055
|
|
SOCKS5_USER = None
|
|
SOCKS5_PASS = None
|