92 lines
3.1 KiB
Markdown
92 lines
3.1 KiB
Markdown
# Telegram WEB proxy
|
|
|
|
Self-hosted Telegram WEB proxy deployment for Docker and Nginx Proxy Manager.
|
|
The repository contains no deployment-specific hostname, public address,
|
|
credential or generated client secret.
|
|
|
|
## Architecture
|
|
|
|
```text
|
|
Telegram Desktop
|
|
-> HTTPS / WebSocket
|
|
Nginx Proxy Manager
|
|
-> tg-web-proxy:8088
|
|
Ingress
|
|
-> local tproxy-server
|
|
-> local MTProxy
|
|
-> Telegram DCs
|
|
```
|
|
|
|
Only Nginx Proxy Manager can reach the container on its shared Docker network;
|
|
the Compose file publishes no host ports. The public fallback page is served
|
|
only for requests without a query string, so authenticated bridge requests and
|
|
WebSocket traffic always reach `tproxy-server`.
|
|
|
|
## Repository contents
|
|
|
|
- `install.sh` — interactive installation on an existing Docker/NPM host;
|
|
- `compose.yml` and `Dockerfile` — reproducible, checksum-pinned build;
|
|
- `ingress/ingress.go` — canonical ingress used by new installations;
|
|
- `ingress/ingress.js` — equivalent emergency implementation;
|
|
- `docs/runbook.md` — checks, deployment, rollback and troubleshooting;
|
|
- `docs/incidents/bridge-routing.md` — routing regression design note;
|
|
- `scripts/audit-public.sh` — scans the working tree and Git history for
|
|
secrets, deployment identifiers and unexpected address literals.
|
|
|
|
## Installation
|
|
|
|
Requirements:
|
|
|
|
- x86_64 Linux;
|
|
- Docker Engine with the Compose plugin;
|
|
- an existing Nginx Proxy Manager container and Docker network;
|
|
- a lowercase DNS hostname whose `A` record points to the server;
|
|
- outbound HTTPS access during the build and first start.
|
|
|
|
Clone this repository, enter its directory and run:
|
|
|
|
```sh
|
|
./install.sh
|
|
```
|
|
|
|
The installer asks for:
|
|
|
|
1. the public proxy hostname;
|
|
2. the server's public IPv4 address;
|
|
3. the Nginx Proxy Manager Docker network, but only when it cannot be detected.
|
|
|
|
For unattended use, provide the same values with `--hostname`, `--public-ip`,
|
|
`--npm-network` and `--yes`.
|
|
|
|
The two cryptographic secrets are generated locally and remain in the named
|
|
Docker volume. The generated `.env` contains only the hostname, public address,
|
|
network name and capacity settings. The installer does not use an external IP
|
|
discovery service.
|
|
|
|
When the container is healthy, the script prints the Nginx Proxy Manager Proxy
|
|
Host values and the generated client secret. Store that secret securely.
|
|
|
|
## External network access
|
|
|
|
The build downloads checksum-pinned source archives from the official MTProxy
|
|
and `tproxy-server` repositories. At startup, the container downloads Telegram's
|
|
official proxy secret and routing configuration over HTTPS. No access token or
|
|
API key is required.
|
|
|
|
## Security check
|
|
|
|
Never commit `.env`, access tokens, client secrets, generated bridge URLs,
|
|
`profiles.json`, MTProxy secret files or volume backups.
|
|
|
|
Run this before every public release:
|
|
|
|
```sh
|
|
./scripts/audit-public.sh
|
|
```
|
|
|
|
To check private deployment identifiers without publishing them, create an
|
|
ignored `.audit-private-patterns` file with one literal string per line. The
|
|
audit checks those strings in the working tree while the file stays local.
|
|
|
|
A clean result is necessary, but it does not replace review of the actual diff.
|