День: 28.03.2026

mkdir telemt
cd telemt
vi ./docker-compose.yml

1

2

3

mkdir telemt

cd telemt

vi ./docker-compose.yml

services:
  telemt:
    image: whn0thacked/telemt-docker:latest
    container_name: telemt
    restart: unless-stopped
    environment:
      - RUST_LOG=info
    volumes:
      - ./telemt.toml:/etc/telemt.toml:ro
    ports:
      - "3443:3443/tcp"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    read_only: true
    tmpfs:
      - /tmp:rw,nosuid,nodev,noexec,size=16m

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

services:

telemt:

image: whn0thacked/telemt-docker:latest

container_name: telemt

restart: unless-stopped

environment:

- RUST_LOG=info

volumes:

- ./telemt.toml:/etc/telemt.toml:ro

ports:

- "3443:3443/tcp"

security_opt:

- no-new-privileges:true

cap_drop:

- ALL

cap_add:

- NET_BIND_SERVICE

read_only: true

tmpfs:

- /tmp:rw,nosuid,nodev,noexec,size=16m

openssl rand -hex 16
# or
head -c 16 /dev/urandom | xxd -ps

1

2

3

openssl rand -hex 16

# or

head -c 16 /dev/urandom | xxd -ps

vi ./telemt.toml

1	vi ./telemt.toml

### Telemt Based Config.toml
# We believe that these settings are sufficient for most scenarios
# where cutting-egde methods and parameters or special solutions are not needed

# === General Settings ===
[general]
use_middle_proxy = false
# Global ad_tag fallback when user has no per-user tag in [access.user_ad_tags]
ad_tag = "[your random secret]"
# Per-user ad_tag in [access.user_ad_tags] (32 hex from @MTProxybot)

# === Log Level ===
# Log level: debug | verbose | normal | silent
# Can be overridden with --silent or --log-level CLI flags
# RUST_LOG env var takes absolute priority over all of these
log_level = "normal"

[general.modes]
classic = true
secure = false
tls = false

[general.links]
show = "*"
# show = ["alice", "bob"] # Only show links for alice and bob
# show = "*"              # Show links for all users
public_host = "[your VPS public host]"  # Host (IP or domain) for tg:// links
public_port = 3443                  # Port for tg:// links (default: server.port)

# === Server Binding ===
[server]
port = 3443
# proxy_protocol = false           # Enable if behind HAProxy/nginx with PROXY protocol
# metrics_port = 9090
# metrics_listen = "0.0.0.0:9090"  # Listen address for metrics (overrides metrics_port)
# metrics_whitelist = ["127.0.0.1", "::1", "0.0.0.0/0"]

[server.api]
enabled = true
listen = "0.0.0.0:9091"
whitelist = ["127.0.0.0/8"]
minimal_runtime_enabled = false
minimal_runtime_cache_ttl_ms = 1000

# Listen on multiple interfaces/IPs - IPv4
[[server.listeners]]
ip = "0.0.0.0"

# === Anti-Censorship & Masking ===
[censorship]
tls_domain = "www.microsoft.com"
mask = true
tls_emulation = true        # Fetch real cert lengths and emulate TLS records
tls_front_dir = "tlsfront"   # Cache directory for TLS emulation
mask_port = 443

[access.users]
# format: "username" = "32_hex_chars_secret"
hello = "[your random secret]"

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

### Telemt Based Config.toml

# We believe that these settings are sufficient for most scenarios

# where cutting-egde methods and parameters or special solutions are not needed

# === General Settings ===

[general]

use_middle_proxy = false

# Global ad_tag fallback when user has no per-user tag in [access.user_ad_tags]

ad_tag = "[your random secret]"

# Per-user ad_tag in [access.user_ad_tags] (32 hex from @MTProxybot)

# === Log Level ===

# Log level: debug | verbose | normal | silent

# Can be overridden with --silent or --log-level CLI flags

# RUST_LOG env var takes absolute priority over all of these

log_level = "normal"

[general.modes]

classic = true

secure = false

tls = false

[general.links]

show = "*"

# show = ["alice", "bob"] # Only show links for alice and bob

# show = "*" # Show links for all users

public_host = "[your VPS public host]" # Host (IP or domain) for tg:// links

public_port = 3443 # Port for tg:// links (default: server.port)

# === Server Binding ===

[server]

port = 3443

# proxy_protocol = false # Enable if behind HAProxy/nginx with PROXY protocol

# metrics_port = 9090

# metrics_listen = "0.0.0.0:9090" # Listen address for metrics (overrides metrics_port)

# metrics_whitelist = ["127.0.0.1", "::1", "0.0.0.0/0"]

[server.api]

enabled = true

listen = "0.0.0.0:9091"

whitelist = ["127.0.0.0/8"]

minimal_runtime_enabled = false

minimal_runtime_cache_ttl_ms = 1000

# Listen on multiple interfaces/IPs - IPv4

[[server.listeners]]

ip = "0.0.0.0"

# === Anti-Censorship & Masking ===

[censorship]

tls_domain = "www.microsoft.com"

mask = true

tls_emulation = true # Fetch real cert lengths and emulate TLS records

tls_front_dir = "tlsfront" # Cache directory for TLS emulation

mask_port = 443

[access.users]

# format: "username" = "32_hex_chars_secret"

hello = "[your random secret]"

docker compose up -d
# wait a few seconds
docker logs telemt|grep tg:

1

2

3

docker compose up -d

# wait a few seconds

docker logs telemt|grep tg:

ufw allow 3443/tcp

1	ufw allow 3443/tcp

Daily Archives: 28.03.2026

Telegram proxy (mtproto)