### Enable MTProxy Service to Autostart

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Enable the MTProxy service to automatically start after system reboots.

```bash
systemctl enable MTProxy.service
```

--------------------------------

### Install Dependencies and Build MTProxy

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Installs necessary dependencies on Debian/Ubuntu systems and compiles the mtproto-proxy binary using make. Ensure OpenSSL and zlib development libraries are available.

```bash
# Install dependencies on Debian/Ubuntu
apt install git curl build-essential libssl-dev zlib1g-dev

# Clone and build
git clone https://github.com/GetPageSpeed/MTProxy
cd MTProxy
make -j$(nproc)

# Binary location
ls -la objs/bin/mtproto-proxy
```

--------------------------------

### Start MTProxy using Docker Compose

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Commands to start the MTProxy service defined in docker-compose.yml in detached mode and view its logs for generated secrets.

```bash
docker-compose up -d
```

```bash
docker-compose logs mtproxy | grep "Generated secret"
```

--------------------------------

### Docker Quick Start - Simplest Startup

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Launches MTProxy in a Docker container with automatic secret generation and default port mappings. The container is set to restart automatically.

```bash
docker run -d \
    --name mtproxy \
    -p 443:443 \
    -p 8888:8888 \
    --restart unless-stopped \
    ghcr.io/getpagespeed/mtproxy:latest
```

--------------------------------

### Install Build Dependencies on CentOS/RHEL

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Installs development tools and libraries for building MTProxy on CentOS/RHEL systems. Note: Using Debian/Ubuntu packages is generally recommended.

```bash
yum install openssl-devel zlib-devel
yum groupinstall "Development Tools"
```

--------------------------------

### Systemd Service for MTProxy (IPv6)

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

A systemd service file example for running MTProxy with IPv6 enabled. Ensure the ExecStart path and arguments are correct for your setup.

```ini
[Unit]
Description=MTProxy (IPv6)
After=network.target

[Service]
Type=simple
WorkingDirectory=/opt/MTProxy
ExecStart=/opt/MTProxy/mtproto-proxy -6 -u nobody -p 8888 -H 443 -S <secret> --http-stats -P <proxy tag> --aes-pwd proxy-secret proxy-multi.conf -M 1
Restart=on-failure

[Install]
WantedBy=multi-user.target
```

--------------------------------

### Run MTProxy using Docker

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Quick start command to run MTProxy in a Docker container. This command automatically downloads the latest configuration, generates a secret if needed, and starts the proxy.

```bash
docker run -d \
  --name mtproxy \
  -p 443:443 \
  -p 8888:8888 \
  --restart unless-stopped \
  ghcr.io/getpagespeed/mtproxy:latest
```

--------------------------------

### Create Systemd Service File for MTProxy

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Create a systemd service file for MTProxy. Ensure the WorkingDirectory and ExecStart paths are correct for your installation.

```bash
nano /etc/systemd/system/MTProxy.service
```

--------------------------------

### Docker Quick Start - Custom Configuration

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Runs MTProxy in Docker with custom environment variables for secret, proxy tag, domain, and worker count. A volume is mounted for persistent data.

```bash
docker run -d \
    --name mtproxy \
    -p 443:443 \
    -p 8888:8888 \
    -e SECRET=cafe1234567890abcdef1234567890ab \
    -e PROXY_TAG=your_proxy_tag_here \
    -e EE_DOMAIN=www.google.com \
    -e WORKERS=2 \
    -v mtproxy-data:/opt/mtproxy/data \
    --restart unless-stopped \
    ghcr.io/getpagespeed/mtproxy:latest
```

--------------------------------

### Basic Proxy Startup with Secret and Config

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Starts the MTProxy server with a secret for client authentication, downloads configuration from Telegram, and listens on port 443. Requires proxy-secret and proxy-multi.conf files.

```bash
# Download proxy configuration files
curl -fsSL https://core.telegram.org/getProxySecret -o proxy-secret
curl -fsSL https://core.telegram.org/getProxyConfig -o proxy-multi.conf

# Generate a random 16-byte secret
SECRET=$(head -c 16 /dev/urandom | xxd -ps)
echo "Generated secret: $SECRET"

# Start the proxy
./objs/bin/mtproto-proxy \
    -u nobody \
    -p 8888 \
    -H 443 \
    -S "$SECRET" \
    --http-stats \
    --aes-pwd proxy-secret \
    proxy-multi.conf \
    -M 1

# Expected output:
# config_filename = 'proxy-multi.conf'
# Starting mtproto-proxy...
# Listening on port 443
```

--------------------------------

### Run MTProxy with Configuration and Stats

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Starts the MTProxy server with specified user, ports, secrets, and configuration files. It enables HTTP statistics accessible on a local port.

```bash
./mtproto-proxy -u nobody -p 8888 -H 443 -S <secret> --http-stats --aes-pwd proxy-secret proxy-multi.conf -M 1
```

--------------------------------

### Install Python Dependencies for Local Testing

Source: https://github.com/getpagespeed/mtproxy/blob/master/TESTING.md

Install necessary Python packages for running MTProxy tests locally without Docker. Ensure you have Python 3.9+ installed.

```bash
pip install -r tests/requirements.txt
```

--------------------------------

### Run MTProxy Tests with Make

Source: https://github.com/getpagespeed/mtproxy/blob/master/TESTING.md

Execute the full test suite using the make command. This builds Docker images, starts the proxy and test runner, and performs connectivity checks.

```bash
make test
```

--------------------------------

### Install Build Dependencies on Debian/Ubuntu

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Installs the necessary packages for building MTProxy from source on Debian-based systems, including git, curl, build tools, and development libraries for OpenSSL and zlib.

```bash
apt install git curl build-essential libssl-dev zlib1g-dev
```

--------------------------------

### Basic Docker Compose Setup for MTProxy

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

A minimal docker-compose.yml file to deploy the MTProxy service. This configuration maps standard ports and sets the container to restart automatically.

```yaml
services:
  mtproxy:
    image: ghcr.io/getpagespeed/mtproxy:latest
    ports:
      - "443:443"
      - "8888:8888"
    restart: unless-stopped
```

--------------------------------

### Basic Systemd Service Configuration for MTProxy

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Edit the systemd service file with appropriate paths and parameters. This example includes options for HTTP stats and proxy tags.

```bash
[Unit]
Description=MTProxy
After=network.target

[Service]
Type=simple
WorkingDirectory=/opt/MTProxy
ExecStart=/opt/MTProxy/mtproto-proxy -u nobody -p 8888 -H 443 -S <secret> -P <proxy tag> <other params>
ExecStart=/opt/MTProxy/mtproto-proxy -u nobody -p 8888 -H 443 -S <secret> --http-stats -P <proxy tag> <other params>
Restart=on-failure

[Install]
WantedBy=multi-user.target
```

--------------------------------

### Docker Compose Configuration for MTProxy

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Example docker-compose.yml to deploy the MTProxy service, mapping ports and setting environment variables.

```yaml
services:
  mtproxy:
    image: ghcr.io/getpagespeed/mtproxy:latest
    ports:
      - "443:443"
      - "8888:8888"
    environment:
      - SECRET=${SECRET}
      - PROXY_TAG=${PROXY_TAG}
      - RANDOM_PADDING=${RANDOM_PADDING}
    restart: unless-stopped
```

--------------------------------

### Systemd Service Configuration for MTProxy

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Sets up MTProxy as a systemd service for automatic startup, management, and monitoring. Includes enabling and starting the service, and checking its status and logs.

```bash
# Create service file
cat > /etc/systemd/system/mtproxy.service << 'EOF'
[Unit]
Description=MTProxy Telegram Proxy
After=network.target

[Service]
Type=simple
WorkingDirectory=/opt/MTProxy
ExecStart=/opt/MTProxy/objs/bin/mtproto-proxy \
    -u nobody \
    -p 8888 \
    -H 443 \
    -S cafe1234567890abcdef1234567890ab \
    --http-stats \
    -D www.google.com \
    --aes-pwd proxy-secret proxy-multi.conf \
    -M 1
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

# Enable and start
systemctl daemon-reload
systemctl enable mtproxy
systemctl start mtproxy

# Check status
systemctl status mtproxy
journalctl -u mtproxy -f
```

--------------------------------

### Persist MTProxy Configuration with Volume Mounting

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Example of mounting a host directory to persist the Telegram DC configuration across container restarts.

```bash
-v /path/to/host/data:/opt/mtproxy/data
```

--------------------------------

### Running MTProxy Test Suite

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Commands to execute the MTProxy test suite, including options for running specific test types or running tests locally without Docker. Requires installing dependencies and setting environment variables.

```bash
# Run full test suite
make test

# Run specific test types
make test-tls           # TLS/EE mode tests
make test-multi-secret  # Multiple secrets test
make test-secret-limit  # Per-secret connection limits
make test-ip-acl        # IP access control tests
make test-drs-delays    # Dynamic Record Sizing tests

# Run tests locally without Docker
pip install -r tests/requirements.txt
export MTPROXY_HOST=localhost
export MTPROXY_PORT=443
export MTPROXY_STATS_PORT=8888
python3 tests/test_proxy.py

# Expected output:
# Testing HTTP stats...
# HTTP stats OK: config_filename...
# Testing Prometheus metrics...
# Prometheus metrics OK: 2048 bytes, 45 metrics
# Testing MTProto port...
# MTProto port OK
# Tests passed!
```

--------------------------------

### Fake-TLS Mode (EE Mode) Setup

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Enables Fake-TLS mode for DPI resistance, making traffic appear as regular HTTPS. Requires a domain for TLS mimicry. The client secret is generated by prefixing 'ee' to the server secret and appending the hex-encoded domain.

```bash
# Server setup with domain for TLS mimicry
./objs/bin/mtproto-proxy \
    -u nobody \
    -p 8888 \
    -H 443 \
    -S "cafe1234567890abcdef1234567890ab" \
    -D www.google.com \
    --http-stats \
    --aes-pwd proxy-secret \
    proxy-multi.conf

# Generate client secret (ee prefix + secret + domain hex)
SECRET="cafe1234567890abcdef1234567890ab"
DOMAIN="www.google.com"
DOMAIN_HEX=$(echo -n "$DOMAIN" | xxd -ps)
CLIENT_SECRET="ee${SECRET}${DOMAIN_HEX}"
echo "Client secret: $CLIENT_SECRET"
# Output: eecafe1234567890abcdef1234567890ab7777772e676f6f676c652e636f6d

# Share link format:
# tg://proxy?server=YOUR_IP&port=443&secret=$CLIENT_SECRET
```

--------------------------------

### Docker Compose Management Commands

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Essential commands for managing the MTProxy service when using Docker Compose. Includes starting the service in detached mode, following logs, and checking the stats and metrics endpoints.

```bash
# Start with docker-compose
docker-compose up -d

# View logs
docker-compose logs -f mtproxy

# Check stats
curl http://localhost:8888/stats
curl http://localhost:8888/metrics
```

--------------------------------

### Get Domain HEX Dump

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Convert a domain name to its hexadecimal representation using 'xxd -plain'. This is required for constructing the EE mode client secret.

```bash
echo -n www.google.com | xxd -plain
```

--------------------------------

### MTProxy IPv6 Support Configuration

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Enables MTProxy to listen for client connections on both IPv4 and IPv6 interfaces. Use the `-6` flag and ensure your host system has IPv6 enabled. A client link example with an AAAA record is provided.

```bash
# Enable IPv6 with -6 flag
./objs/bin/mtproto-proxy \
    -6 \
    -u nobody \
    -p 8888 \
    -H 443 \
    -S "$SECRET" \
    --http-stats \
    --aes-pwd proxy-secret \
    proxy-multi.conf

# Verify IPv6 listening
ss -ltnp | grep :443
# Expected: :::443 among listeners

# Test locally
curl -6 http://[::1]:8888/stats

# Client link with hostname (AAAA record):
# tg://proxy?server=proxy.example.com&port=443&secret=...

# Check IPv6 is enabled on host
sysctl net.ipv6.conf.all.disable_ipv6  # Should be 0
```

--------------------------------

### Run MTProxy in Direct Mode

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

This command starts the MTProxy in direct mode, bypassing Telegram's middle-end servers for reduced latency. It requires a secret and specifies ports for client connections and statistics.

```bash
./mtproto-proxy -S "$SECRET" -H 443 --direct -p 8888 --aes-pwd /dev/null
```

--------------------------------

### MTProxy Configuration Refresh Script

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

A shell script to automatically refresh MTProxy configuration from a specified URL and reload the proxy service if changes are detected. This script is intended to be run periodically, for example, via a cron job. It handles temporary file creation, comparison, and service reloading using SIGHUP.

```sh
#!/bin/sh
# mtproxy-config-refresh.sh
CONFIG_PATH="/opt/mtproxy/data/proxy-multi.conf"
CONFIG_URL="https://core.telegram.org/getProxyConfig"

curl --connect-timeout 10 --max-time 30 --retry 3 \
    -fsSL "$CONFIG_URL" -o "${CONFIG_PATH}.tmp"

if [ $? -eq 0 ] && [ -s "${CONFIG_PATH}.tmp" ]; then
    if ! cmp -s "${CONFIG_PATH}.tmp" "$CONFIG_PATH"; then
        mv "${CONFIG_PATH}.tmp" "$CONFIG_PATH"
        # Reload proxy without restart
        pkill -SIGHUP mtproto-proxy
        echo "Config refreshed and proxy reloaded"
    else
        rm "${CONFIG_PATH}.tmp"
        echo "Config unchanged"
    fi
else
    rm -f "${CONFIG_PATH}.tmp"
    echo "Config refresh failed"
fi

# Add to crontab for periodic refresh:
# 0 */6 * * * /opt/mtproxy/config-refresh.sh
```

--------------------------------

### Download and Prepare MTProxy Static Binary

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Download the pre-built static binary for your architecture and make it executable. A secret is generated for the proxy.

```bash
# Download (choose amd64 or arm64)
curl -Lo mtproto-proxy https://github.com/GetPageSpeed/MTProxy/releases/latest/download/mtproto-proxy-linux-amd64
chmod +x mtproto-proxy

# Generate a secret
SECRET=$(head -c 16 /dev/urandom | xxd -ps)
```

--------------------------------

### Run MTProxy with IP Access Control

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Launches MTProxy with IP blocklist and allowlist enabled. The --ip-blocklist and --ip-allowlist flags specify the respective configuration files.

```bash
./objs/bin/mtproto-proxy \
    -u nobody \
    -p 8888 \
    -H 443 \
    -S "$SECRET" \
    --ip-blocklist blocklist.txt \
    --ip-allowlist allowlist.txt \
    --http-stats \
    --aes-pwd proxy-secret \
    proxy-multi.conf
```

--------------------------------

### Direct-to-DC Mode Startup

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Runs MTProxy in direct-to-data center mode, bypassing Telegram's middle-end relays for potentially lower latency. This mode does not require proxy-secret or proxy-multi.conf files. Note: --direct is incompatible with -P.

```bash
# Generate secret
SECRET=$(head -c 16 /dev/urandom | xxd -ps)

# Run in direct mode (no proxy-secret or proxy-multi.conf needed)
./objs/bin/mtproto-proxy \
    -u nobody \
    -p 8888 \
    -H 443 \
    -S "$SECRET" \
    --http-stats \
    --direct \
    -M 1

# Note: --direct is incompatible with -P (proxy tag)
# Direct mode reduces latency but cannot use promoted channels
```

--------------------------------

### Clone MTProxy Repository and Build

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Clones the MTProxy source code from GitHub and navigates into the project directory. It then builds the proxy binary, which will be located in `objs/bin/mtproto-proxy`.

```bash
git clone https://github.com/GetPageSpeed/MTProxy
cd MTProxy
make && cd objs/bin
```

--------------------------------

### Run MTProxy with Custom Backend

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Launches MTProxy with specified user, ports, secret, stats, and AES password. The --http-stats flag enables the stats endpoint, and --aes-pwd is used for secure password authentication.

```bash
./objs/bin/mtproto-proxy \
    -u nobody \
    -p 8888 \
    -H 443 \
    -S "cafe1234567890abcdef1234567890ab" \
    -D mywebsite.com:8443 \
    --http-stats \
    --aes-pwd proxy-secret \
    proxy-multi.conf
```

--------------------------------

### Create IP Allowlist File

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Defines a list of IP address ranges in CIDR notation to allow client connections. When used, only IPs matching these ranges will be permitted.

```bash
cat > allowlist.txt << 'EOF' \
# Allow only corporate network \
10.0.0.0/8 \
172.16.0.0/12 \
EOF
```

--------------------------------

### Run Local MTProxy Tests

Source: https://github.com/getpagespeed/mtproxy/blob/master/TESTING.md

Execute the MTProxy test script using Python after setting up dependencies and environment variables.

```bash
python3 tests/test_proxy.py
```

--------------------------------

### Run MTProxy Tests with Docker

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Executes the MTProxy test suite using Docker. Ensure you have exported the necessary environment variables as detailed in TESTING.md before running this command.

```bash
# Export environment variables (see TESTING.md)
export MTPROXY_SECRET=...
make test
```

--------------------------------

### Configure Multiple Secrets with Labels and Limits

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Sets up MTProxy with multiple secrets, each associated with a human-readable label and a per-secret connection limit. This aids in access control and monitoring. Format: -S <32-hex-secret>:<label>:<connection-limit>.

```bash
# Multiple secrets with labels and connection limits
./objs/bin/mtproto-proxy \
    -u nobody \
    -p 8888 \
    -H 443 \
    -S "cafe1234567890abcdef1234567890ab:family:1000" \
    -S "dead1234567890abcdef1234567890ef:friends:500" \
    -S "beef1234567890abcdef1234567890cd:public:200" \
    --http-stats \
    --aes-pwd proxy-secret \
    proxy-multi.conf

# Format: -S <32-hex-secret>:<label>:<connection-limit>
# Labels appear in logs: "TLS handshake matched secret [family] from 1.2.3.4:12345"
# Limits enforced per-worker: limit/workers connections each
# When limit reached, new connections rejected (EE mode: proxied to domain)
```

--------------------------------

### View MTProxy Docker Container Logs

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

View the logs of the MTProxy Docker container to find connection links and check for any startup errors.

```bash
docker logs mtproxy
```

--------------------------------

### Build Custom MTProxy Docker Image

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Commands to build a custom MTProxy Docker image from source and run it as a detached container.

```bash
docker build -t mtproxy .
docker run -d \
  --name mtproxy \
  -p 443:443 \
  -p 8888:8888 \
  mtproxy
```

--------------------------------

### Run MTProxy with Custom TLS Backend

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Run MTProxy specifying the domain and backend port using the -D flag. Ensure you replace <secret> with your actual 32-hex secret.

```bash
./mtproto-proxy -u nobody -p 8888 -H 443 -S <secret> -D mywebsite.com:8443 --http-stats --aes-pwd proxy-secret proxy-multi.conf -M 1
```

--------------------------------

### Docker: Inline Comma-Separated Secrets

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Define multiple secrets, their labels, and limits in a single comma-separated environment variable.

```env
SECRET=cafe...90ab:family:1000,dead...90ef:public:200
```

--------------------------------

### Enable HTTP Stats Endpoint

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Configures MTProxy to expose statistics via an HTTP endpoint. The --http-stats flag must be used during proxy startup.

```bash
./objs/bin/mtproto-proxy ... --http-stats -p 8888
```

--------------------------------

### Run All Fuzz Targets

Source: https://github.com/getpagespeed/mtproxy/blob/master/TESTING.md

Execute all compiled fuzz targets with their default 60-second duration. You can customize the duration using FUZZ_DURATION.

```bash
# Run all targets for 60 seconds each (default)
make fuzz-run

# Custom duration
make fuzz-run FUZZ_DURATION=300
```

--------------------------------

### Run MTProxy in Direct Mode with Stats

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Launches MTProxy in direct mode, connecting clients straight to Telegram DCs. This mode does not require `proxy-multi.conf` or `proxy-secret` and is incompatible with proxy tags.

```bash
./mtproto-proxy -u nobody -p 8888 -H 443 -S <secret> --http-stats --direct
```

--------------------------------

### Docker: Numbered Environment Variables for Secrets

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Use numbered environment variables to define multiple secrets, their labels, and connection limits.

```env
SECRET_1=cafe1234567890abcdef1234567890ab
SECRET_LABEL_1=family
SECRET_LIMIT_1=1000
SECRET_2=dead1234567890abcdef1234567890ef
SECRET_LABEL_2=public
SECRET_LIMIT_2=200
```

--------------------------------

### Configure Per-Secret Connection Limits (CLI)

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Set maximum concurrent connections for individual secrets using the CLI by appending a limit value after the secret or label.

```bash
./mtproto-proxy ... -S cafe...90ab:family:1000 -S dead...90ef:public:200
```

```bash
./mtproto-proxy ... -S cafe...90ab::500
```

--------------------------------

### Configure MTProxy with Custom Environment Variables via .env file

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Create a .env file to specify custom environment variables for the Docker Compose deployment of MTProxy, such as secrets and proxy tags.

```bash
SECRET=your_secret_here
PROXY_TAG=your_proxy_tag_here
RANDOM_PADDING=false
```

--------------------------------

### Clean and Rebuild MTProxy

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Use this command to clean previous build artifacts before attempting to build MTProxy again, especially if the build has failed.

```bash
make clean
```

--------------------------------

### Obtain Telegram Proxy Configuration

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Downloads the current Telegram proxy configuration file. It's recommended to update this file daily as it can change occasionally.

```bash
curl --connect-timeout 10 --max-time 30 --retry 3 -fsSL https://core.telegram.org/getProxyConfig -o proxy-multi.conf
```

--------------------------------

### Docker Direct Mode Configuration

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Launches an MTProxy container configured for direct-to-DC connections. This mode bypasses middle-end relays and requires `DIRECT_MODE=true`. Note that `PROXY_TAG` is incompatible with this setting.

```bash
docker run -d \
    --name mtproxy-direct \
    -p 443:443 \
    -p 8888:8888 \
    -e SECRET=cafe1234567890abcdef1234567890ab \
    -e DIRECT_MODE=true \
    -e EE_DOMAIN=www.google.com \
    --restart unless-stopped \
    ghcr.io/getpagespeed/mtproxy:latest

# Note: DIRECT_MODE=true is incompatible with PROXY_TAG
# Direct mode: proxy connects directly to Telegram DCs (no ME relay)
# No proxy-multi.conf required in direct mode
```

--------------------------------

### Configure Local MTProxy Test Environment

Source: https://github.com/getpagespeed/mtproxy/blob/master/TESTING.md

Set environment variables for the host and port of your local MTProxy instance before running the Python test script.

```bash
export MTPROXY_HOST=localhost  # or IP of your proxy
export MTPROXY_PORT=443        # or your proxy port
```

--------------------------------

### Add Host Entry for MTProxy Resolution

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Add an /etc/hosts entry to resolve the domain to loopback. This is necessary when nginx only listens on 127.0.0.1. If nginx listens on all interfaces, this step can be skipped.

```bash
127.0.0.1 mywebsite.com
```

--------------------------------

### Configure MTProxy Secrets with Inline Labels (CLI)

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Use the -S flag with the mtproto-proxy executable to assign inline labels to secrets, enabling per-group access control and monitoring.

```bash
./mtproto-proxy ... -S cafe1234567890abcdef1234567890ab:family -S dead1234567890abcdef1234567890ef:friends
```

--------------------------------

### Create IP Blocklist File

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Defines a list of IP address ranges in CIDR notation to block client connections. This file is used by MTProxy for IP access control.

```bash
cat > blocklist.txt << 'EOF' \
# Block known scanner ranges \
185.220.101.0/24 \
2001:db8::/32 \
192.168.100.0/24 \
EOF
```

--------------------------------

### Run MTProxy Docker Container with Custom Environment Variables

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Use this command to run the MTProxy Docker image, specifying environment variables for secret generation, proxy tags, and port mappings. The SECRET variable auto-generates a 32-character hex secret if not provided.

```bash
docker run -d \
  --name mtproxy \
  -p 443:443 \
  -p 8888:8888 \
  -e SECRET=$(head -c 16 /dev/urandom | xxd -ps) \
  -e PROXY_TAG=your_proxy_tag_here \
  -v mtproxy-data:/opt/mtproxy/data \
  --restart unless-stopped \
  ghcr.io/getpagespeed/mtproxy:latest
```

--------------------------------

### Enable IPv6 Listening

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Use the -6 flag to enable IPv6 listening. The proxy binds to all IPv6 interfaces, which often includes IPv4 connections on the same port (dual-stack). Ensure no IP literals are passed to -H.

```bash
./mtproto-proxy -6 -u nobody -p 8888 -H 443 -S <secret> --http-stats --aes-pwd proxy-secret proxy-multi.conf -M 1
```

--------------------------------

### Configure MTProxy Secrets with Separate Label Environment Variables (Docker)

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Use separate environment variables (SECRET_N and SECRET_LABEL_N) to define secrets and their corresponding labels for MTProxy when running in Docker.

```bash
SECRET_1=cafe1234567890abcdef1234567890ab
SECRET_LABEL_1=family
SECRET_2=dead1234567890abcdef1234567890ef
SECRET_LABEL_2=friends
```

--------------------------------

### Configure Multiple MTProxy Secrets using Docker Compose

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Demonstrates two methods for configuring multiple secrets in MTProxy via Docker Compose: comma-separated in a single SECRET variable or using numbered SECRET_N variables.

```bash
# Option A: comma-separated
SECRET=family_secret_hex,friends_secret_hex,public_secret_hex
```

```bash
# Option B: numbered variables
SECRET_1=family_secret_hex
SECRET_2=friends_secret_hex
SECRET_3=public_secret_hex
```

--------------------------------

### Custom TLS Backend Configuration

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Configures MTProxy to run a custom TLS backend (e.g., Nginx) for active probing resistance. Non-MTProxy visitors will see a functioning website. Requires Nginx configuration and hosts file modification.

```bash
# 1. Configure nginx on port 8443 with TLS 1.3
# nginx.conf:
# server {
#     listen 127.0.0.1:8443 ssl; 
#     server_name mywebsite.com;
#     ssl_certificate /etc/letsencrypt/live/mywebsite.com/fullchain.pem;
#     ssl_certificate_key /etc/letsencrypt/live/mywebsite.com/privkey.pem;
#     ssl_protocols TLSv1.3;
#     root /var/www/html;
# }

# 2. Add hosts entry for domain resolution
echo "127.0.0.1 mywebsite.com" >> /etc/hosts
```

--------------------------------

### Verify IPv6 Listener

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Check if the proxy is listening on IPv6 by grepping for the port in the output of 'ss -ltnp'. Expect to see ':::port' among the listeners.

```bash
ss -ltnp | grep :443
```

--------------------------------

### Build Fuzz Targets with Clang

Source: https://github.com/getpagespeed/mtproxy/blob/master/TESTING.md

Compile the libFuzzer fuzzing targets using Clang, enabling AddressSanitizer and UndefinedBehaviorSanitizer for robust testing.

```bash
# Build fuzz targets
make fuzz CC=clang
```

--------------------------------

### Configure MTProxy with Domain for EE Mode

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Use the -D flag to specify a domain for EE mode. This domain should support TLS 1.3 and will be mimicked by the proxy for obfuscation.

```bash
./mtproto-proxy -u nobody -p 8888 -H 443 -S <secret> -D www.google.com --http-stats --aes-pwd proxy-secret proxy-multi.conf -M 1
```

--------------------------------

### Check IPv6 Host Status

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Verify that IPv6 is enabled on the host system by checking the sysctl value for net.ipv6.conf.all.disable_ipv6. It should be 0.

```bash
sysctl net.ipv6.conf.all.disable_ipv6
```

--------------------------------

### Configure MTProxy Secrets with Inline Labels (Docker)

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Assign inline labels to secrets directly within the SECRET environment variable when running the MTProxy Docker container.

```bash
SECRET=cafe1234567890abcdef1234567890ab:family,dead1234567890abcdef1234567890ef:friends
```

--------------------------------

### Fuzz Testing MTProxy

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Builds and runs fuzz targets for MTProxy protocol parsers using libFuzzer and AddressSanitizer. Allows custom durations for fuzzing sessions.

```bash
# Build fuzz targets (requires Clang)
make fuzz CC=clang

# Run all fuzzers for 60 seconds each
make fuzz-run

# Custom duration
make fuzz-run FUZZ_DURATION=300

# Fuzz targets:
# - fuzz_tls_server_hello: TLS ServerHello parsing
# - fuzz_tls_client_hello: SNI extraction, cipher suite handling
```

--------------------------------

### Apply IP Access Control to MTProxy

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Configures MTProxy to use IP blocklist and allowlist files for restricting client connections. These files can be reloaded without restarting the proxy.

```bash
./mtproto-proxy ... --ip-blocklist blocklist.txt --ip-allowlist allowlist.txt
```

--------------------------------

### Check MTProxy Container Health

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Use 'docker ps' to check the health status of the running MTProxy container.

```bash
docker ps
# Look for the health status in the STATUS column
```

--------------------------------

### Docker Compose Configuration for MTProxy

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Defines the MTProxy service for Docker Compose, including ports, environment variables for secrets and configuration, volume mounts, and health checks. Supports multiple secrets with labels and limits.

```yaml
version: '3.8'
services:
  mtproxy:
    image: ghcr.io/getpagespeed/mtproxy:latest
    ports:
      - "443:443"
      - "8888:8888"
    environment:
      # Multiple secrets with labels and limits
      - SECRET=cafe1234567890abcdef1234567890ab:family:1000,dead1234567890abcdef1234567890ef:public:500
      # Or use numbered secrets
      # - SECRET_1=cafe1234567890abcdef1234567890ab
      # - SECRET_LABEL_1=family
      # - SECRET_LIMIT_1=1000
      - PORT=443
      - STATS_PORT=8888
      - WORKERS=1
      - PROXY_TAG=your_tag_from_mtproxybot
      - EE_DOMAIN=www.google.com
      - RANDOM_PADDING=false
      - DIRECT_MODE=false
      - EXTERNAL_IP=203.0.113.1
    volumes:
      - ./data:/opt/mtproxy/data
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8888/stats"]
      interval: 30s
      timeout: 10s
      retries: 3
```

--------------------------------

### IP Access Control File Format

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Specifies the format for IP blocklist and allowlist files used by MTProxy. Each line should contain a CIDR range or a comment.

```plaintext
# Block known scanner ranges
185.220.101.0/24
2001:db8::/32
```

--------------------------------

### Query MTProxy Stats Endpoint

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Fetches proxy statistics from the HTTP stats endpoint. This provides real-time data on proxy performance and configuration.

```bash
curl http://localhost:8888/stats
```

--------------------------------

### Generate EE Mode Client Secret

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Automatically generate the complete client secret for EE mode by concatenating the 'ee' prefix, the server secret, and the domain's HEX dump.

```bash
# Generate complete client secret automatically
SECRET="cafe1234567890abcdef1234567890ab"
DOMAIN="www.google.com"
echo -n "ee${SECRET}" && echo -n $DOMAIN | xxd -plain
```

--------------------------------

### Nginx Configuration for TLS Backend

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Configure nginx to listen on a local port with TLS 1.3. Ensure your certificate and key paths are correct. Certificate renewal requires DNS-01 challenge with certbot.

```nginx
server {
    listen 127.0.0.1:8443 ssl default_server;
    server_name mywebsite.com;

    ssl_certificate /etc/letsencrypt/live/mywebsite.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mywebsite.com/privkey.pem;
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers off;

    root /var/www/html;

    location / {
        try_files $uri $uri/ =404;
    }
}
```

--------------------------------

### Generate HTTPS Proxy Link

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Generates an HTTPS link format for accessing the proxy, which opens in a web browser. This link uses the EE mode secret. Ensure SERVER_IP, PORT, and EE_SECRET are correctly set.

```bash
# HTTPS link format (opens in browser)
echo "https://t.me/proxy?server=${SERVER_IP}&port=${PORT}&secret=${EE_SECRET}"
```

--------------------------------

### Generate EE Secret for Custom TLS

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Generate the client 'ee' secret by prefixing your 32-hex secret with 'ee' and appending the hex-encoded domain name.

```bash
SECRET="<your_32_hex_secret>"
echo -n "ee${SECRET}" && echo -n mywebsite.com | xxd -plain
```

--------------------------------

### Reload IP ACL Rules

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Sends a SIGHUP signal to the MTProxy process to reload IP access control rules without restarting the service.

```bash
kill -SIGHUP $(pidof mtproto-proxy)
```

--------------------------------

### Manually Check Telegram Connectivity

Source: https://github.com/getpagespeed/mtproxy/blob/master/TESTING.md

Use netcat to verify direct TCP connectivity to a Telegram data center. This helps diagnose network blocking issues.

```bash
# Check connectivity to Telegram DC 2 (Europe)
nc -zv 149.154.167.50 443
# Expected output: Connection to 149.154.167.50 443 port [tcp/https] succeeded!
```

--------------------------------

### Query Prometheus Metrics Endpoint

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Retrieves proxy metrics in Prometheus format. This endpoint is used for integration with monitoring systems like Prometheus.

```bash
curl http://localhost:8888/metrics
```

--------------------------------

### Restart and Check MTProxy Service Status

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Restart the MTProxy service to apply changes and check its status to ensure it is running correctly.

```bash
systemctl restart MTProxy.service
systemctl status MTProxy.service
```

--------------------------------

### MTProxy Multi-Worker Mode Configuration

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Configures MTProxy to run with multiple worker processes, utilizing the `SO_REUSEPORT` socket option for high-connection-count deployments. Note that this mode is not recommended with TLS-transport due to weaker replay protection.

```bash
# Run with 4 worker processes
./objs/bin/mtproto-proxy \
    -u nobody \
    -p 8888 \
    -H 443 \
    -S "$SECRET" \
    --http-stats \
    --aes-pwd proxy-secret \
    proxy-multi.conf \
    -M 4

# Workers share listening socket via SO_REUSEPORT
# Per-secret limits divided among workers: limit/workers each
# Not recommended with TLS-transport (weaker replay protection)

# Stats aggregated from all workers
curl http://localhost:8888/stats | grep workers
# workers    4
```

--------------------------------

### Reload Systemd Daemons

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

After creating or modifying a systemd service file, reload the systemd daemon to recognize the changes.

```bash
systemctl daemon-reload
```

--------------------------------

### Generate User Connection Secret

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Generates a random 16-byte secret and formats it as a hexadecimal string. This secret will be used by users to connect to your MTProxy.

```bash
head -c 16 /dev/urandom | xxd -ps
```

--------------------------------

### Test IPv6 Stats Endpoint

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Test the proxy's stats endpoint using curl with the -6 flag to ensure IPv6 connectivity.

```bash
curl -6 http://[::1]:8888/stats
```

--------------------------------

### Obtain MTProxy Secret

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Fetches the encryption secret required for MTProto key exchange with Telegram servers. This command retries up to 3 times with specified timeouts.

```bash
curl --connect-timeout 10 --max-time 30 --retry 3 -fsSL https://core.telegram.org/getProxySecret -o proxy-secret
```

--------------------------------

### Allow Additional Networks for Stats

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Extends the private IP range from which the stats endpoint is accessible. Use the --stats-allow-net flag with a CIDR block.

```bash
./objs/bin/mtproto-proxy ... --stats-allow-net 100.64.0.0/10
```

--------------------------------

### Retrieve Auto-Generated Secret from Docker Logs

Source: https://github.com/getpagespeed/mtproxy/blob/master/README.md

Command to check the Docker container logs for the auto-generated secret.

```bash
docker logs mtproxy 2>&1 | grep "Generated secret"
```

--------------------------------

### Generate Telegram EE Mode Proxy Link

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Generates a shareable proxy link for Telegram clients using the EE mode secret (Fake-TLS). This mode requires a domain name to be appended to the secret in hexadecimal format. Ensure SECRET, SERVER_IP, PORT, and DOMAIN are correctly set.

```bash
# EE mode link (Fake-TLS)
DOMAIN="www.google.com"
DOMAIN_HEX=$(echo -n "$DOMAIN" | xxd -ps)
EE_SECRET="ee${SECRET}${DOMAIN_HEX}"
echo "tg://proxy?server=${SERVER_IP}&port=${PORT}&secret=${EE_SECRET}"
```

--------------------------------

### Generate Telegram DD Mode Proxy Link

Source: https://context7.com/getpagespeed/mtproxy/llms.txt

Generates a shareable proxy link for Telegram clients using the DD mode secret (obfuscated2). Ensure the SECRET, SERVER_IP, and PORT variables are correctly set.

```bash
# Basic secret (obfuscated2/DD mode)
SECRET="cafe1234567890abcdef1234567890ab"
SERVER_IP="203.0.113.1"
PORT="443"

# DD mode link (random padding)
echo "tg://proxy?server=${SERVER_IP}&port=${PORT}&secret=dd${SECRET}"
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.