Follow-up from the Telegram operator-bot deploy (#121/#45). The bot currently reaches api.telegram.org directly over clearnet — both the outbound notifier (service/telegram_notifier.py, requests) and the command long-poll (service/telegram_commands.py, aiohttp getUpdates). On a Tor-first stack (the default; network.tor_egress_firewall: true) this exposes the host exit IP to Telegram, inconsistent with how Healthchecks.io (#79) and the XvB stats fetch (#163) already route over the bundled Tor SOCKS proxy (TOR_SOCKS_PROXY, socks5h).
Observed on gouda: the dashboard container reaches Telegram over clearnet (HTTP 200) despite tor_egress_firewall: true, so today the feature works but leaks. (Separately worth checking whether the #270 egress rules should have dropped that dial at all.)
Scope:
- Notifier — easy:
requests already has the [socks] extra (PySocks) for XvB; add proxies={"https": TOR_SOCKS_PROXY} (socks5h so DNS goes through Tor).
- Command bot —
aiohttp needs a SOCKS connector (aiohttp_socks, a new dep) for the getUpdates long-poll, or run the poll via requests in a thread to reuse the existing SOCKS path.
- Make it the default when the egress firewall is on; keep working on clearnet hosts. Note Telegram sometimes rate-limits Tor exits — validate reachability.
- Update
docs/telegram.md + docs/privacy.md (the current telegram doc says "Telegram is clearnet, fails silently on Tor-only" — this issue changes that).
Follow-up from the Telegram operator-bot deploy (#121/#45). The bot currently reaches
api.telegram.orgdirectly over clearnet — both the outbound notifier (service/telegram_notifier.py,requests) and the command long-poll (service/telegram_commands.py,aiohttpgetUpdates). On a Tor-first stack (the default;network.tor_egress_firewall: true) this exposes the host exit IP to Telegram, inconsistent with how Healthchecks.io (#79) and the XvB stats fetch (#163) already route over the bundled Tor SOCKS proxy (TOR_SOCKS_PROXY,socks5h).Observed on gouda: the dashboard container reaches Telegram over clearnet (HTTP 200) despite
tor_egress_firewall: true, so today the feature works but leaks. (Separately worth checking whether the #270 egress rules should have dropped that dial at all.)Scope:
requestsalready has the[socks]extra (PySocks) for XvB; addproxies={"https": TOR_SOCKS_PROXY}(socks5h so DNS goes through Tor).aiohttpneeds a SOCKS connector (aiohttp_socks, a new dep) for thegetUpdateslong-poll, or run the poll viarequestsin a thread to reuse the existing SOCKS path.docs/telegram.md+docs/privacy.md(the current telegram doc says "Telegram is clearnet, fails silently on Tor-only" — this issue changes that).