feat(gateway): add scoped proxy egress deployment

telegram-gateway/.env.example

@@ -1,5 +1,8 @@
 # Application
 NODE_ENV=development
+# Optional image build mirrors for networks where deb.debian.org is unavailable.
+DEBIAN_MIRROR=https://deb.debian.org/debian
+DEBIAN_SECURITY_MIRROR=https://deb.debian.org/debian-security
 PORT=3000
 APP_NAME=TelegramUserGateway
 CORS_ORIGINS=
@@ -29,6 +32,14 @@ TDLIB_PATH=/usr/local/lib/libtdjson.so
 TG_API_ID=0
 TG_API_HASH=your_api_hash_here
 
+# 可选默认代理。账号未绑定专属代理时使用；只影响 Telegram TDLib 出站。
+TG_DEFAULT_PROXY_TYPE=
+TG_DEFAULT_PROXY_HOST=
+TG_DEFAULT_PROXY_PORT=
+TG_DEFAULT_PROXY_USERNAME=
+TG_DEFAULT_PROXY_PASSWORD=
+TG_DEFAULT_PROXY_SECRET=
+
 # Rate Limiting
 RATE_LIMIT_DEFAULT_TTL=60000
 RATE_LIMIT_DEFAULT_LIMIT=30

telegram-gateway/docker/Dockerfile

@@ -1,5 +1,8 @@
 FROM node:20-bookworm-slim AS builder
 
+ARG DEBIAN_MIRROR=https://deb.debian.org/debian
+ARG DEBIAN_SECURITY_MIRROR=https://deb.debian.org/debian-security
+RUN sed -i "s|http://deb.debian.org/debian-security|${DEBIAN_SECURITY_MIRROR}|g; s|http://deb.debian.org/debian|${DEBIAN_MIRROR}|g" /etc/apt/sources.list.d/debian.sources
 RUN apt-get update \
     && apt-get install -y --no-install-recommends g++ make python3 \
     && rm -rf /var/lib/apt/lists/*
@@ -22,6 +25,9 @@ RUN npm prune --omit=dev
 
 FROM node:20-bookworm-slim
 
+ARG DEBIAN_MIRROR=https://deb.debian.org/debian
+ARG DEBIAN_SECURITY_MIRROR=https://deb.debian.org/debian-security
+RUN sed -i "s|http://deb.debian.org/debian-security|${DEBIAN_SECURITY_MIRROR}|g; s|http://deb.debian.org/debian|${DEBIAN_MIRROR}|g" /etc/apt/sources.list.d/debian.sources
 RUN apt-get update \
     && apt-get install -y --no-install-recommends tini ca-certificates \
     && rm -rf /var/lib/apt/lists/*

telegram-gateway/docker/docker-compose.yml

@@ -30,9 +30,12 @@ services:
     build:
       context: ..
       dockerfile: docker/Dockerfile
+      args:
+        DEBIAN_MIRROR: ${DEBIAN_MIRROR:-https://deb.debian.org/debian}
+        DEBIAN_SECURITY_MIRROR: ${DEBIAN_SECURITY_MIRROR:-https://deb.debian.org/debian-security}
     container_name: tgw-app
     ports:
-      - '3000:3000'
+      - '127.0.0.1:3010:3000'
     env_file:
       - ../.env
     environment:
@@ -52,6 +55,12 @@ services:
       TDLIB_PATH: /app/node_modules/@prebuilt-tdlib/linux-x64-glibc/libtdjson.so
       TG_API_ID: ${TG_API_ID}
       TG_API_HASH: ${TG_API_HASH}
+      TG_DEFAULT_PROXY_TYPE: ${TG_DEFAULT_PROXY_TYPE:-}
+      TG_DEFAULT_PROXY_HOST: ${TG_DEFAULT_PROXY_HOST:-}
+      TG_DEFAULT_PROXY_PORT: ${TG_DEFAULT_PROXY_PORT:-}
+      TG_DEFAULT_PROXY_USERNAME: ${TG_DEFAULT_PROXY_USERNAME:-}
+      TG_DEFAULT_PROXY_PASSWORD: ${TG_DEFAULT_PROXY_PASSWORD:-}
+      TG_DEFAULT_PROXY_SECRET: ${TG_DEFAULT_PROXY_SECRET:-}
     depends_on:
       postgres:
         condition: service_healthy

telegram-gateway/docker/scripts/init-db.sql

@@ -0,0 +1,8 @@
+-- Telegram User Gateway - Database Initialization
+-- This script runs on first PostgreSQL startup
+
+-- Enable UUID extension
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+
+-- Create indexes will be handled by TypeORM synchronize in dev
+-- or by migrations in production

telegram-gateway/src/modules/tg-accounts/tg-accounts.service.ts

@@ -171,7 +171,7 @@ export class TgAccountsService implements OnModuleInit {
     const binding = await this.bindingRepo.findOne({
       where: { accountId, isActive: true },
     });
-    if (!binding) return undefined;
+    if (!binding) return this.getDefaultProxy();
 
     const proxy = await this.proxyRepo
       .createQueryBuilder('proxy')
@@ -179,7 +179,7 @@ export class TgAccountsService implements OnModuleInit {
       .where('proxy.id = :id', { id: binding.proxyId })
       .andWhere('proxy.isActive = :isActive', { isActive: true })
       .getOne();
-    if (!proxy) return undefined;
+    if (!proxy) return this.getDefaultProxy();
 
     return {
       type: proxy.type,
@@ -190,4 +190,27 @@ export class TgAccountsService implements OnModuleInit {
       secret: proxy.secret,
     };
   }
+
+  private getDefaultProxy() {
+    const host = String(process.env.TG_DEFAULT_PROXY_HOST || '').trim();
+    const port = Number(process.env.TG_DEFAULT_PROXY_PORT || 0);
+    if (!host || !Number.isInteger(port) || port < 1 || port > 65535) {
+      return undefined;
+    }
+
+    const type = String(process.env.TG_DEFAULT_PROXY_TYPE || 'socks5').toLowerCase();
+    if (!['socks5', 'http', 'mtproto'].includes(type)) {
+      this.logger.warn(`Ignoring unsupported TG_DEFAULT_PROXY_TYPE: ${type}`);
+      return undefined;
+    }
+
+    return {
+      type,
+      host,
+      port,
+      username: process.env.TG_DEFAULT_PROXY_USERNAME || '',
+      password: process.env.TG_DEFAULT_PROXY_PASSWORD || '',
+      secret: process.env.TG_DEFAULT_PROXY_SECRET || '',
+    };
+  }
 }