mirror of https://github.com/telemt/telemt.git
New config.toml + tls_emulation enabled by default
This commit is contained in:
Alexey
parent
f40b645c05
commit
fed9346444
266
config.toml
266
config.toml
|
|
@ -1,67 +1,66 @@
|
|||
# === General Settings ===
|
||||
# Telemt full config with default values.
|
||||
# Examples are kept in comments after '#'.
|
||||
|
||||
# Top-level legacy field.
|
||||
show_link = [] # example: "*" or ["alice", "bob"]
|
||||
# default_dc = 2 # example: default DC for unmapped non-standard DCs
|
||||
|
||||
[general]
|
||||
fast_mode = true
|
||||
use_middle_proxy = true
|
||||
# ad_tag = "00000000000000000000000000000000"
|
||||
# Path to proxy-secret binary (auto-downloaded if missing).
|
||||
proxy_secret_path = "proxy-secret"
|
||||
# disable_colors = false # Disable colored output in logs (useful for files/systemd)
|
||||
|
||||
# === Log Level ===
|
||||
# Log level: debug | verbose | normal | silent
|
||||
# Can be overridden with --silent or --log-level CLI flags
|
||||
# RUST_LOG env var takes absolute priority over all of these
|
||||
log_level = "normal"
|
||||
|
||||
# === Middle Proxy - ME ===
|
||||
# Public IP override for ME KDF when behind NAT; leave unset to auto-detect.
|
||||
# middle_proxy_nat_ip = "203.0.113.10"
|
||||
# Enable STUN probing to discover public IP:port for ME.
|
||||
use_middle_proxy = false
|
||||
# ad_tag = "0123456789abcdef0123456789abcdef" # example
|
||||
# proxy_secret_path = "proxy-secret" # example custom path
|
||||
# middle_proxy_nat_ip = "203.0.113.10" # example public NAT IP override
|
||||
middle_proxy_nat_probe = true
|
||||
# Primary STUN server (host:port); defaults to Telegram STUN when empty.
|
||||
middle_proxy_nat_stun = "stun.l.google.com:19302"
|
||||
# Optional fallback STUN servers list.
|
||||
middle_proxy_nat_stun_servers = ["stun1.l.google.com:19302", "stun2.l.google.com:19302"]
|
||||
# Desired number of concurrent ME writers in pool.
|
||||
# middle_proxy_nat_stun = "stun.l.google.com:19302" # example
|
||||
middle_proxy_nat_stun_servers = [] # example: ["stun1.l.google.com:19302", "stun2.l.google.com:19302"]
|
||||
middle_proxy_pool_size = 8
|
||||
# Pre-initialized warm-standby ME connections kept idle.
|
||||
middle_proxy_warm_standby = 8
|
||||
# Ignore STUN/interface mismatch and keep ME enabled even if IP differs.
|
||||
stun_iface_mismatch_ignore = false
|
||||
# Keepalive padding frames - fl==4
|
||||
middle_proxy_warm_standby = 16
|
||||
me_keepalive_enabled = true
|
||||
me_keepalive_interval_secs = 25 # Period between keepalives
|
||||
me_keepalive_jitter_secs = 5 # Jitter added to interval
|
||||
me_keepalive_payload_random = true # Randomize 4-byte payload (vs zeros)
|
||||
# Stagger extra ME connections on warmup to de-phase lifecycles.
|
||||
me_keepalive_interval_secs = 25
|
||||
me_keepalive_jitter_secs = 5
|
||||
me_keepalive_payload_random = true
|
||||
crypto_pending_buffer = 262144
|
||||
max_client_frame = 16777216
|
||||
desync_all_full = false
|
||||
beobachten = true
|
||||
beobachten_minutes = 10
|
||||
beobachten_flush_secs = 15
|
||||
beobachten_file = "cache/beobachten.txt"
|
||||
hardswap = true
|
||||
me_warmup_stagger_enabled = true
|
||||
me_warmup_step_delay_ms = 500 # Base delay between extra connects
|
||||
me_warmup_step_jitter_ms = 300 # Jitter for warmup delay
|
||||
# Reconnect policy knobs.
|
||||
me_reconnect_max_concurrent_per_dc = 4 # Parallel reconnects per DC - EXPERIMENTAL! UNSTABLE!
|
||||
me_reconnect_backoff_base_ms = 500 # Backoff start
|
||||
me_reconnect_backoff_cap_ms = 30000 # Backoff cap
|
||||
me_reconnect_fast_retry_count = 11 # Quick retries before backoff
|
||||
update_every = 7200 # Resolve the active updater interval for ME infrastructure refresh tasks.
|
||||
crypto_pending_buffer = 262144 # Max pending ciphertext buffer per client writer (bytes). Controls FakeTLS backpressure vs throughput.
|
||||
max_client_frame = 16777216 # Maximum allowed client MTProto frame size (bytes).
|
||||
desync_all_full = false # Emit full crypto-desync forensic logs for every event. When false, full forensic details are emitted once per key window.
|
||||
auto_degradation_enabled = true # Enable auto-degradation from ME to Direct-DC.
|
||||
degradation_min_unavailable_dc_groups = 2 # Minimum unavailable ME DC groups before degrading.
|
||||
hardswap = true # Enable C-like hard-swap for ME pool generations. When true, Telemt prewarms a new generation and switches once full coverage is reached.
|
||||
default_me_hardswap_warmup_delay_min_ms = 1000 # Minimum delay in ms between hardswap warmup connect attempts.
|
||||
default_me_hardswap_warmup_delay_max_ms = 2000 # Maximum delay in ms between hardswap warmup connect attempts.
|
||||
default_me_hardswap_warmup_extra_passes = 3 # Additional warmup passes in the same hardswap cycle after the base pass.
|
||||
default_me_hardswap_warmup_pass_backoff_base_ms = 500 # Base backoff in ms between hardswap warmup passes when floor is still incomplete.
|
||||
me_pool_drain_ttl_secs = 90 # Drain-TTL in seconds for stale ME writers after endpoint map changes. During TTL, stale writers may be used only as fallback for new bindings.
|
||||
me_pool_min_fresh_ratio = 0.8 # Minimum desired-DC coverage ratio required before draining stale writers. Range: 0.0..=1.0.
|
||||
me_reinit_drain_timeout_secs = 120 # Drain timeout in seconds for stale ME writers after endpoint map changes. Set to 0 to keep stale writers draining indefinitely (no force-close).
|
||||
me_config_stable_snapshots = 2 # Number of identical getProxyConfig snapshots required before applying ME map updates.
|
||||
me_config_apply_cooldown_secs = 300 # Cooldown in seconds between applied ME map updates.
|
||||
proxy_secret_rotate_runtime = true # Enable runtime proxy-secret rotation from getProxySecret.
|
||||
proxy_secret_stable_snapshots = 2 # Number of identical getProxySecret snapshots required before runtime secret rotation.
|
||||
proxy_secret_len_max = 256 # Maximum allowed proxy-secret length in bytes for startup and runtime refresh.
|
||||
default_me_reinit_every_secs = 900 # Periodic ME pool reinitialization interval in seconds.
|
||||
me_warmup_step_delay_ms = 500
|
||||
me_warmup_step_jitter_ms = 300
|
||||
me_reconnect_max_concurrent_per_dc = 8
|
||||
me_reconnect_backoff_base_ms = 500
|
||||
me_reconnect_backoff_cap_ms = 30000
|
||||
me_reconnect_fast_retry_count = 12
|
||||
stun_iface_mismatch_ignore = false
|
||||
unknown_dc_log_path = "unknown-dc.txt" # to disable: set to null
|
||||
log_level = "normal" # debug | verbose | normal | silent
|
||||
disable_colors = false
|
||||
fast_mode_min_tls_record = 0
|
||||
update_every = 300
|
||||
me_reinit_every_secs = 900
|
||||
me_hardswap_warmup_delay_min_ms = 1000
|
||||
me_hardswap_warmup_delay_max_ms = 2000
|
||||
me_hardswap_warmup_extra_passes = 3
|
||||
me_hardswap_warmup_pass_backoff_base_ms = 500
|
||||
me_config_stable_snapshots = 2
|
||||
me_config_apply_cooldown_secs = 300
|
||||
proxy_secret_stable_snapshots = 2
|
||||
proxy_secret_rotate_runtime = true
|
||||
proxy_secret_len_max = 256
|
||||
me_pool_drain_ttl_secs = 90
|
||||
me_pool_min_fresh_ratio = 0.8
|
||||
me_reinit_drain_timeout_secs = 120
|
||||
# Legacy compatibility fields used when update_every is omitted.
|
||||
proxy_secret_auto_reload_secs = 3600
|
||||
proxy_config_auto_reload_secs = 3600
|
||||
ntp_check = true
|
||||
ntp_servers = ["pool.ntp.org"] # example: ["pool.ntp.org", "time.cloudflare.com"]
|
||||
auto_degradation_enabled = true
|
||||
degradation_min_unavailable_dc_groups = 2
|
||||
|
||||
[general.modes]
|
||||
classic = false
|
||||
|
|
@ -69,63 +68,82 @@ secure = false
|
|||
tls = true
|
||||
|
||||
[general.links]
|
||||
show = "*"
|
||||
# show = ["alice", "bob"] # Only show links for alice and bob
|
||||
# show = "*" # Show links for all users
|
||||
# public_host = "proxy.example.com" # Host (IP or domain) for tg:// links
|
||||
# public_port = 443 # Port for tg:// links (default: server.port)
|
||||
show = [] # example: "*" or ["alice", "bob"]
|
||||
# public_host = "proxy.example.com" # example explicit host/IP for tg:// links
|
||||
# public_port = 443 # example explicit port for tg:// links
|
||||
|
||||
# === Network Parameters ===
|
||||
[network]
|
||||
# Enable/disable families: true/false/auto(None)
|
||||
ipv4 = true
|
||||
ipv6 = false # UNSTABLE WITH ME
|
||||
# prefer = 4 or 6
|
||||
prefer = 4
|
||||
multipath = false # EXPERIMENTAL!
|
||||
ipv6 = false # set true to enable IPv6
|
||||
prefer = 4 # 4 or 6
|
||||
multipath = false
|
||||
stun_servers = [
|
||||
"stun.l.google.com:5349",
|
||||
"stun1.l.google.com:3478",
|
||||
"stun.gmx.net:3478",
|
||||
"stun.l.google.com:19302",
|
||||
"stun.1und1.de:3478",
|
||||
"stun1.l.google.com:19302",
|
||||
"stun2.l.google.com:19302",
|
||||
"stun3.l.google.com:19302",
|
||||
"stun4.l.google.com:19302",
|
||||
"stun.services.mozilla.com:3478",
|
||||
"stun.stunprotocol.org:3478",
|
||||
"stun.nextcloud.com:3478",
|
||||
"stun.voip.eutelia.it:3478",
|
||||
]
|
||||
stun_tcp_fallback = true
|
||||
http_ip_detect_urls = ["https://ifconfig.me/ip", "https://api.ipify.org"]
|
||||
cache_public_ip_path = "cache/public_ip.txt"
|
||||
|
||||
# === Server Binding ===
|
||||
[server]
|
||||
port = 443
|
||||
listen_addr_ipv4 = "0.0.0.0"
|
||||
listen_addr_ipv6 = "::"
|
||||
# listen_unix_sock = "/var/run/telemt.sock" # Unix socket
|
||||
# listen_unix_sock_perm = "0666" # Socket file permissions
|
||||
# proxy_protocol = false # Enable if behind HAProxy/nginx with PROXY protocol
|
||||
# metrics_port = 9090
|
||||
# metrics_whitelist = ["127.0.0.1", "::1"]
|
||||
# listen_unix_sock = "/var/run/telemt.sock" # example
|
||||
# listen_unix_sock_perm = "0660" # example unix socket mode
|
||||
# listen_tcp = true # example explicit override (auto-detected when omitted)
|
||||
proxy_protocol = false
|
||||
# metrics_port = 9090 # example
|
||||
metrics_whitelist = ["127.0.0.1/32", "::1/128"]
|
||||
# Example explicit listeners (default: omitted, auto-generated from listen_addr_*):
|
||||
# [[server.listeners]]
|
||||
# ip = "0.0.0.0"
|
||||
# announce = "proxy-v4.example.com"
|
||||
# # announce_ip = "203.0.113.10" # deprecated alias
|
||||
# proxy_protocol = false
|
||||
# reuse_allow = false
|
||||
#
|
||||
# [[server.listeners]]
|
||||
# ip = "::"
|
||||
# announce = "proxy-v6.example.com"
|
||||
# proxy_protocol = false
|
||||
# reuse_allow = false
|
||||
|
||||
# Listen on multiple interfaces/IPs - IPv4
|
||||
[[server.listeners]]
|
||||
ip = "0.0.0.0"
|
||||
|
||||
# Listen on multiple interfaces/IPs - IPv6
|
||||
[[server.listeners]]
|
||||
ip = "::"
|
||||
|
||||
# === Timeouts (in seconds) ===
|
||||
[timeouts]
|
||||
client_handshake = 30
|
||||
client_handshake = 15
|
||||
tg_connect = 10
|
||||
client_keepalive = 60
|
||||
client_ack = 300
|
||||
# Quick ME reconnects for single-address DCs (count and per-attempt timeout, ms).
|
||||
me_one_retry = 12
|
||||
me_one_timeout_ms = 1200
|
||||
me_one_retry = 3
|
||||
me_one_timeout_ms = 1500
|
||||
|
||||
# === Anti-Censorship & Masking ===
|
||||
[censorship]
|
||||
tls_domain = "petrovich.ru"
|
||||
# tls_domains = ["example.com", "cdn.example.net"] # Additional domains for EE links
|
||||
mask = true
|
||||
# mask_host = "www.google.com" # example, defaults to tls_domain when both mask_host/mask_unix_sock are unset
|
||||
# mask_unix_sock = "/var/run/nginx.sock" # example, mutually exclusive with mask_host
|
||||
mask_port = 443
|
||||
# mask_host = "petrovich.ru" # Defaults to tls_domain if not set
|
||||
# mask_unix_sock = "/var/run/nginx.sock" # Unix socket (mutually exclusive with mask_host)
|
||||
fake_cert_len = 2048
|
||||
# tls_emulation = false # Fetch real cert lengths and emulate TLS records
|
||||
# tls_front_dir = "tlsfront" # Cache directory for TLS emulation
|
||||
fake_cert_len = 2048 # if tls_emulation=false and default value is used, loader may randomize this value at runtime
|
||||
tls_emulation = true
|
||||
tls_front_dir = "tlsfront"
|
||||
server_hello_delay_min_ms = 0
|
||||
server_hello_delay_max_ms = 0
|
||||
tls_new_session_tickets = 0
|
||||
tls_full_cert_ttl_secs = 90
|
||||
alpn_enforce = true
|
||||
|
||||
# === Access Control & Users ===
|
||||
[access]
|
||||
replay_check_len = 65536
|
||||
replay_window_secs = 1800
|
||||
|
|
@ -134,34 +152,52 @@ ignore_time_skew = false
|
|||
[access.users]
|
||||
# format: "username" = "32_hex_chars_secret"
|
||||
hello = "00000000000000000000000000000000"
|
||||
default = "00000000000000000000000000000000"
|
||||
# alice = "11111111111111111111111111111111" # example
|
||||
|
||||
# [access.user_max_tcp_conns]
|
||||
# hello = 50
|
||||
[access.user_max_tcp_conns]
|
||||
# alice = 100 # example
|
||||
|
||||
# [access.user_max_unique_ips]
|
||||
# hello = 5
|
||||
[access.user_expirations]
|
||||
# alice = "2027-01-01T00:00:00Z" # example
|
||||
|
||||
# [access.user_data_quota]
|
||||
# hello = 1073741824 # 1 GB
|
||||
[access.user_data_quota]
|
||||
# alice = 10737418240 # example bytes
|
||||
|
||||
# [access.user_expirations]
|
||||
# format: username = "[year]-[month]-[day]T[hour]:[minute]:[second]Z" UTC
|
||||
# hello = "2027-01-01T00:00:00Z"
|
||||
|
||||
# === Upstreams & Routing ===
|
||||
[[upstreams]]
|
||||
type = "direct"
|
||||
enabled = true
|
||||
weight = 10
|
||||
# interface = "192.168.1.100" # Bind outgoing to specific IP or iface name
|
||||
# bind_addresses = ["192.168.1.100"] # List for round-robin binding (family must match target)
|
||||
[access.user_max_unique_ips]
|
||||
# alice = 10 # example
|
||||
|
||||
# Default behavior if [[upstreams]] is omitted: loader injects one direct upstream.
|
||||
# Example explicit upstreams:
|
||||
# [[upstreams]]
|
||||
# type = "direct"
|
||||
# interface = "eth0"
|
||||
# bind_addresses = ["192.0.2.10"]
|
||||
# weight = 1
|
||||
# enabled = true
|
||||
# scopes = "*"
|
||||
#
|
||||
# [[upstreams]]
|
||||
# type = "socks4"
|
||||
# address = "198.51.100.20:1080"
|
||||
# interface = "eth0"
|
||||
# user_id = "telemt"
|
||||
# weight = 1
|
||||
# enabled = true
|
||||
# scopes = "*"
|
||||
#
|
||||
# [[upstreams]]
|
||||
# type = "socks5"
|
||||
# address = "127.0.0.1:1080"
|
||||
# enabled = false
|
||||
# address = "198.51.100.30:1080"
|
||||
# interface = "eth0"
|
||||
# username = "proxy-user"
|
||||
# password = "proxy-pass"
|
||||
# weight = 1
|
||||
# enabled = true
|
||||
# scopes = "*"
|
||||
|
||||
# === DC Address Overrides ===
|
||||
# [dc_overrides]
|
||||
# "203" = "91.105.192.100:443"
|
||||
# "201" = "149.154.175.50:443" # example
|
||||
# "202" = ["149.154.167.51:443", "149.154.175.100:443"] # example
|
||||
# "203" = "91.105.192.100:443" # loader auto-adds this one when omitted
|
||||
|
|
|
|||
|
|
@ -623,7 +623,7 @@ impl Default for AntiCensorshipConfig {
|
|||
mask_port: default_mask_port(),
|
||||
mask_unix_sock: None,
|
||||
fake_cert_len: default_fake_cert_len(),
|
||||
tls_emulation: false,
|
||||
tls_emulation: true,
|
||||
tls_front_dir: default_tls_front_dir(),
|
||||
server_hello_delay_min_ms: default_server_hello_delay_min_ms(),
|
||||
server_hello_delay_max_ms: default_server_hello_delay_max_ms(),
|
||||
|
|
|
|||
Loading…
Reference in New Issue