[{"_1":2,"_162":-5,"_163":-5},"loaderData",{"_3":4,"_18":19,"_25":26,"_141":142},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16,"_17":11},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","dockerRebrandTour","routes/_layout",{"_20":-5,"_21":22,"_23":11,"_24":22},"username","isAskGordonEnabled",true,"showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":-5,"_89":90,"_128":-5,"_129":11,"_130":22,"_131":11,"_132":11,"_133":11,"_134":-5,"_135":11,"_136":-5,"_137":138,"_139":91,"_140":-7},"canonicalUrl","https://hub.docker.com/r/powernic/tgwebproxy/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","powernic","reponame","tgwebproxy","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":11,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2026-10-01T05:48:18.911479Z","description","","is_private","last_updated","2026-10-01T05:48:19.058895Z","last_modified","2026-10-01T05:51:51.515357Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",74,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Telegram WEB Proxy — Docker\n\nDocker image for running a **Telegram WEB Proxy** compatible with Telegram Desktop 7.1+.\n\nThe proxy uses the WEB transport introduced in Telegram Desktop: Telegram connects to your domain over regular HTTPS and transports MTProto traffic through a hidden WebView using WebSocket or HTTPS fallback.\n\nBased on [`tgwebproxy`](https://github.com/kesevone/tgwebproxy).\n\n## Requirements\n\nYou need:\n\n- a VPS/server with a public IPv4 address;\n- a domain or subdomain pointing to the server;\n- TCP ports `80` and `443` available;\n- Docker or Docker Compose.\n\nExample DNS record:\n\n```text\nproxy.example.com A 203.0.113.10\n```\n\nThe DNS record must point directly to your server.\n\nIf you use Cloudflare, set the record to **DNS only** rather than proxied mode.\n\n---\n\n## Quick start\n\nGenerate a random 16-byte secret:\n\n```bash\nopenssl rand -hex 16\n```\n\nExample:\n\n```text\n0123456789abcdef0123456789abcdef\n```\n\nRun the container:\n\n```bash\ndocker run -d \\\n --name tgwebproxy \\\n --restart unless-stopped \\\n -p 80:80 \\\n -p 443:443 \\\n -v tgwebproxy-certs:/certs \\\n -e TGWP_DOMAIN=proxy.example.com \\\n -e TGWP_SECRET=0123456789abcdef0123456789abcdef \\\n powernic/tgwebproxy:latest\n```\n\nReplace:\n\n```text\nproxy.example.com\n```\n\nwith your domain and:\n\n```text\npowernic/tgwebproxy:latest\n```\n\nwith the actual Docker Hub image name.\n\nThe `/certs` volume should be persistent. It stores the automatically obtained TLS certificate and prevents unnecessary certificate reissuance after container recreation.\n\n---\n\n# Docker Compose\n\nCreate `compose.yml`:\n\n```yaml\nservices:\n tgwebproxy:\n image: powernic/tgwebproxy:latest\n container_name: tgwebproxy\n\n restart: unless-stopped\n\n ports:\n - \"80:80\"\n - \"443:443\"\n\n environment:\n TGWP_DOMAIN: \"${TGWP_DOMAIN}\"\n TGWP_SECRET: \"${TGWP_SECRET}\"\n TGWP_LOG_LEVEL: \"info\"\n\n volumes:\n - tgwebproxy-certs:/certs\n\nvolumes:\n tgwebproxy-certs:\n```\n\nCreate `.env`:\n\n```dotenv\nTGWP_DOMAIN=proxy.example.com\nTGWP_SECRET=0123456789abcdef0123456789abcdef\n```\n\nGenerate the secret with:\n\n```bash\nopenssl rand -hex 16\n```\n\nStart the proxy:\n\n```bash\ndocker compose up -d\n```\n\nView logs:\n\n```bash\ndocker compose logs -f\n```\n\nRestart:\n\n```bash\ndocker compose restart\n```\n\nUpdate to the newest image:\n\n```bash\ndocker compose pull\ndocker compose up -d\n```\n\nStop:\n\n```bash\ndocker compose down\n```\n\nThe certificate volume is retained after `docker compose down`.\n\nTo remove it as well:\n\n```bash\ndocker compose down -v\n```\n\nNormally you **should not** remove the certificate volume.\n\n---\n\n# Telegram configuration\n\nOpen Telegram Desktop:\n\n```text\nSettings\n→ Advanced\n→ Connection type\n→ Add proxy\n→ WEB\n```\n\nEnter:\n\n```text\nWeb proxy hostname:\nproxy.example.com\n\nSecret:\n0123456789abcdef0123456789abcdef\n```\n\nYou can also create a Telegram proxy link:\n\n```text\nhttps://t.me/webproxy?server=proxy.example.com&secret=0123456789abcdef0123456789abcdef\n```\n\nDepending on Telegram support, the link may need to be opened directly inside Telegram.\n\n---\n\n# Environment variables\n\n| Variable | Default | Description |\n|---|---|---|\n| `TGWP_DOMAIN` | — | Domain served by the relay. Required. |\n| `TGWP_SECRET` | generated | 16-byte secret encoded as hex or base64url. |\n| `TGWP_SITE` | built-in page | Directory containing the cover website. |\n| `TGWP_CERT_DIR` | `certs` | Directory used to cache ACME/TLS certificates. |\n| `TGWP_LISTEN` | `:443` | HTTPS listen address. |\n| `TGWP_PLAIN_LISTEN` | `:80` | HTTP listener used for redirect and ACME HTTP-01. |\n| `TGWP_BEHIND_PROXY` | `false` | Run behind nginx/Caddy/another TLS frontend. |\n| `TGWP_DIAGNOSE` | `false` | Enable diagnostic request logging. |\n| `TGWP_LOG_LEVEL` | `info` | `debug`, `info`, `warn`, or `error`. |\n\n---\n\n# Custom cover website\n\nWhen the domain is opened in a regular browser, the proxy can show a normal static website.\n\nCreate:\n\n```text\nsite/\n├── index.html\n├── style.css\n└── ...\n```\n\nThen mount it into the container:\n\n```yaml\nservices:\n tgwebproxy:\n image: powernic/tgwebproxy:latest\n\n restart: unless-stopped\n\n ports:\n - \"80:80\"\n - \"443:443\"\n\n environment:\n TGWP_DOMAIN: \"${TGWP_DOMAIN}\"\n TGWP_SECRET: \"${TGWP_SECRET}\"\n TGWP_SITE: \"/site\"\n TGWP_LOG_LEVEL: \"info\"\n\n volumes:\n - tgwebproxy-certs:/certs\n - ./site:/site:ro\n\nvolumes:\n tgwebproxy-certs:\n```\n\nA simple `site/index.html`:\n\n```html\n\n\n\n \n \n Welcome\n\n\n\n

Welcome

This website is currently under construction.

\n\n\n```\n\nUsing a realistic cover website is recommended instead of leaving the default placeholder.\n\n---\n\n# Firewall\n\nPorts `80/tcp` and `443/tcp` must be reachable from the Internet.\n\nFor UFW:\n\n```bash\nsudo ufw allow 80/tcp\nsudo ufw allow 443/tcp\n```\n\nCheck listening ports:\n\n```bash\nss -lntp | grep -E ':80|:443'\n```\n\nCheck container status:\n\n```bash\ndocker ps\n```\n\n---\n\n# Logs\n\nFollow logs:\n\n```bash\ndocker logs -f tgwebproxy\n```\n\nor with Compose:\n\n```bash\ndocker compose logs -f tgwebproxy\n```\n\nFor normal production use:\n\n```yaml\nTGWP_LOG_LEVEL: \"info\"\n```\n\nFor troubleshooting:\n\n```yaml\nTGWP_LOG_LEVEL: \"debug\"\n```\n\nAvoid leaving debug/diagnostic logging enabled unnecessarily.\n\nThe WEB proxy capability should be treated as a credential and should not be exposed in access logs or public configuration files.\n\n---\n\n# Running behind nginx / Caddy\n\nIf port `443` is already occupied by nginx, Caddy, Traefik or another reverse proxy, enable:\n\n```yaml\nenvironment:\n TGWP_DOMAIN: \"${TGWP_DOMAIN}\"\n TGWP_SECRET: \"${TGWP_SECRET}\"\n TGWP_BEHIND_PROXY: \"true\"\n```\n\nIn this mode TLS termination is handled by the frontend proxy.\n\nThe frontend must support and forward WebSocket upgrade headers.\n\nWhen using a reverse proxy, make sure sensitive query parameters are not written to public or long-lived access logs.\n\n---\n\n# Security recommendations\n\n- Generate a unique random secret:\n\n```bash\nopenssl rand -hex 16\n```\n\n- Do not publish your real `TGWP_SECRET`.\n- Do not commit `.env` to a public repository.\n- Keep the `/certs` volume persistent.\n- Use HTTPS on port `443`.\n- Keep Docker and the image updated.\n- Avoid exposing management or metrics interfaces publicly.\n- Use a separate secret for each user when using configuration-file mode.\n\nAdd `.env` to `.gitignore`:\n\n```gitignore\n.env\n```\n\n---\n\n# Updating\n\nPull the newest image:\n\n```bash\ndocker compose pull\n```\n\nRecreate the container:\n\n```bash\ndocker compose up -d\n```\n\nRemove unused old images:\n\n```bash\ndocker image prune\n```\n\n---\n\n# Example directory\n\n```text\ntgwebproxy/\n├── compose.yml\n├── .env\n└── site/\n └── index.html\n```\n\nStart:\n\n```bash\ncd tgwebproxy\ndocker compose up -d\n```\n\nCheck:\n\n```bash\ndocker compose ps\ndocker compose logs --tail=100\n```\n\n---\n\n# License\n\nThe Docker image packages `tgwebproxy`.\n\nPlease refer to the upstream project for source code and licensing information:\n\nhttps://github.com/kesevone/tgwebproxy","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":22,"_83":11,"_84":11},"read","write","admin","user","storage_size",10875369,"orgData","recentTags",[91],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_101":102,"_50":117,"_118":94,"_119":33,"_120":56,"_57":121,"_122":123,"_124":108,"_125":117,"_126":66,"_127":22},"content_type","creator",1337460,"digest","sha256:a9d3d463ed5b13682057dd24dfb5d11814241235f8f2cd1c1a41b921d25e42a8","full_size",10871971,"id",1330302009,"images",[103],{"_104":105,"_95":96,"_106":48,"_107":108,"_109":110,"_111":112,"_113":48,"_114":-5,"_115":98,"_63":66,"_116":-5},"architecture","amd64","features","last_pulled","2026-11-11T09:18:33.302062958Z","last_pushed","2026-10-01T05:48:18.325456133Z","os","linux","os_features","os_version","size","variant","2026-10-01T05:48:18.592247Z","last_updater","last_updater_username","media_type","latest","repository",32695373,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxRunInCloud","showSbxAgenticPlatformBadge","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":143,"_150":151,"_137":160,"_161":11},{"_40":144,"_42":145,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":146,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":147,"_79":11,"_80":149,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":148},[78],{"_82":22,"_83":11,"_84":11},"tags",{"_152":64,"_153":-5,"_154":-5,"_155":156},"count","next","previous","results",[157],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_101":158,"_50":117,"_118":94,"_119":33,"_120":56,"_57":121,"_122":123,"_124":108,"_125":117,"_126":66,"_127":22},[159],{"_104":105,"_95":96,"_106":48,"_107":108,"_109":110,"_111":112,"_113":48,"_114":-5,"_115":98,"_63":66,"_116":-5},[],"canDeleteTags","actionData","errors"]

powernic/tgwebproxy

Tags for powernic/tgwebproxy