Merge remote-tracking branch 'origin/stable' into v2

Build release artifacts in CI

.codecov.yml

@@ -0,0 +1,4 @@
+---
+
+fixes:
+  - "github.com/9seconds/mtg/v2/::"

.dockerignore

@@ -0,0 +1,9 @@
+vendor/
+tags
+.github/
+.bin/
+*.md
+mtg
+.golangci.toml
+.gitignore
+run.sh

.gitattributes

@@ -0,0 +1,3 @@
+# git config merge.theirs.name "Always accept theirs"
+# git config merge.theirs.driver "cp %B %A"
+default.pgo binary merge=theirs

.github/workflows/ci.yaml

@@ -0,0 +1,214 @@
+---
+
+name: CI
+
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: read
+  issues: read
+  discussions: read
+  pull-requests: read
+  repository-projects: read
+  security-events: read
+  statuses: read
+
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - master
+      - stable
+      - v1
+  release:
+    types:
+      - published
+      - released
+  pull_request:
+    types:
+      - opened
+      - edited
+      - reopened
+      - synchronize
+      - ready_for_review
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - uses: jdx/mise-action@v3
+        name: Install mise
+
+      - name: Cache Go modules and build
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Run tests
+        run: mise tasks run covtest
+
+      - name: Collect coverage
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./coverage.txt
+
+  fuzz:
+    name: Fuzzing
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - uses: jdx/mise-action@v3
+        name: Install mise
+
+      - name: Cache Go modules and build
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Run fuzzing
+        run: mise tasks run 'test:fuzz:*'
+
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - uses: jdx/mise-action@v3
+        name: Install mise
+
+      - name: Cache Go modules and build
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Run linter
+        run: mise tasks run lint
+
+  artifacts:
+    name: Build release artifacts
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - uses: jdx/mise-action@v3
+        name: Install mise
+
+      - name: Cache Go modules
+        uses: actions/cache@v5
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-gomod-${{ hashFiles('go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-gomod-
+
+      - name: Cache cross-compilation build
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/go-build
+          key: ${{ runner.os }}-goreleaser-${{ hashFiles('go.sum') }}-${{ hashFiles('**/*.go') }}
+          restore-keys: |
+            ${{ runner.os }}-goreleaser-${{ hashFiles('go.sum') }}-
+            ${{ runner.os }}-goreleaser-
+
+      - name: Run release
+        run: mise tasks run release
+
+  docker:
+    name: Docker
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Get Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            nineseconds/mtg
+            ghcr.io/${{ github.repository }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=master,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=stable,enable=${{ github.ref == 'refs/heads/stable' }}
+
+      - name: Setup QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Setup BuildX
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to DockerHub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          pull: true
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/386,linux/arm/v7,linux/arm/v6
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,79 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+# https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#permissions
+# https://github.com/github/codeql-action/issues/572
+permissions:
+  actions: read
+  contents: read
+  pull-requests: read
+  security-events: write
+
+on:
+  push:
+    branches:
+      - master
+      - stable
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ master ]
+  schedule:
+    - cron: '24 20 * * 5'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'go' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
+        # Learn more:
+        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+      with:
+        submodules: recursive
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v4
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+    #    and modify them (or add more) to build your code if your project
+    #    uses a compiled language
+
+    #- run: |
+    #   make bootstrap
+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4

.github/workflows/govulncheck.yml

@@ -0,0 +1,42 @@
+---
+
+name: Vulnerability checks
+
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: read
+  issues: read
+  discussions: read
+  pull-requests: read
+  repository-projects: read
+  security-events: read
+  statuses: read
+
+on:
+  push:
+  pull_request:
+  schedule: # daily at 10:22 UTC
+    - cron: '22 10 * * *'
+  workflow_dispatch:
+
+jobs:
+  vuln:
+    name: Test vulnerabilities
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v6
+      with:
+        submodules: recursive
+
+    - name: Setup Go
+      uses: actions/setup-go@v6
+      with:
+        go-version-file: go.mod
+        cache: true
+
+    - name: Check for vulnerabilities
+      run: |
+        go run golang.org/x/vuln/cmd/govulncheck@latest ./...

.gitignore

@@ -6,5 +6,5 @@
 *.test
 *.out
 mtg
-vendor/
-version.go
+coverage.txt
+dist/

.golangci.toml

@@ -0,0 +1,21 @@
+# https://golangci-lint.run/docs/configuration/file/
+
+version = '2'
+
+[run]
+concurrency = 4
+tests = true
+
+# [linters]
+# enable-all = true
+# disable = [
+#     "containedctx",
+#     "exhaustivestruct",
+#     "exhaustruct",
+#     "gas",
+#     "gochecknoglobals",
+#     "goerr113",
+#     "ireturn",
+#     "thelper",
+#     "varnamelen",
+# ]

.gometalinter.json

@@ -1,4 +0,0 @@
-{
-    "aggregate": true,
-    "vendor": true
-}

.goreleaser.yml

@@ -0,0 +1,150 @@
+---
+
+version: 2
+
+project_name: mtg
+
+before:
+  hooks:
+    - go mod tidy
+    - go generate ./...
+
+builds:
+  - id: default
+    binary: '{{ .ProjectName }}'
+    goos:
+      - darwin
+      - freebsd
+      - linux
+      - netbsd
+      - openbsd
+      - windows
+    goarch:
+      - 386
+      - amd64
+      - arm
+      - arm64
+    goarm:
+      - 6
+      - 7
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+      - -mod=readonly
+    ldflags: -s -w -X main.version={{ .Version }}
+    ignore:
+      - goos: darwin
+        goarch: 386
+      - goos: darwin
+        goarch: arm
+      - goos: freebsd
+        goarch: arm64
+      - goos: netbsd
+        goarch: arm64
+      - goos: openbsd
+        goarch: arm64
+      - goos: windows
+        goarch: 386
+      - goos: windows
+        goarch: arm
+  - id: mips
+    binary: '{{ .ProjectName }}'
+    goos:
+      - linux
+    goarch:
+      - mips
+      - mipsle
+    gomips:
+      - softfloat
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+      - -mod=readonly
+    ldflags: -s -w -X main.version={{ .Version }}
+  - id: arm64-v9
+    binary: '{{ .ProjectName }}'
+    goos:
+      - darwin
+      - linux
+    goarch:
+      - arm64
+    goarm64:
+      - v9.0
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+      - -mod=readonly
+    ldflags: -s -w -X main.version={{ .Version }}
+  - id: amd64-v3
+    binary: '{{ .ProjectName }}'
+    goos:
+      - darwin
+      - freebsd
+      - linux
+      - netbsd
+      - openbsd
+      - windows
+    goarch:
+      - amd64
+    goamd64:
+      - v3
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+      - -mod=readonly
+    ldflags: -s -w -X main.version={{ .Version }}
+
+archives:
+  - id: default
+    ids:
+      - default
+      - mips
+    name_template: '{{ .ProjectName }}-{{ .Version }}-{{ .Os }}-{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}'
+    formats:
+      - tar.gz
+    wrap_in_directory: true
+    format_overrides:
+      - goos: windows
+        formats:
+          - zip
+    files:
+      - LICENSE
+      - README.md
+      - SECURITY.md
+      - BEST_PRACTICES.md
+      - example.config.toml
+  - id: optimized
+    ids:
+      - arm64-v9
+      - amd64-v3
+    name_template: '{{ .ProjectName }}-{{ .Version }}-{{ .Os }}-{{ .Arch }}{{ if .Arm64 }}-{{ .Arm64 }}{{ end }}{{ if .Amd64 }}-{{ .Amd64 }}{{ end }}'
+    formats:
+      - tar.gz
+    wrap_in_directory: true
+    format_overrides:
+      - goos: windows
+        formats:
+          - zip
+    files:
+      - LICENSE
+      - README.md
+      - SECURITY.md
+      - BEST_PRACTICES.md
+      - example.config.toml
+
+gomod:
+  proxy: true
+
+snapshot:
+  version_template: '{{ .Version }}'
+
+checksum:
+  name_template: '{{ .ProjectName }}-{{ .Version }}-checksums.txt'
+
+source:
+  enabled: true
+  name_template: '{{ .ProjectName }}-sources'

.mise.toml

@@ -0,0 +1,104 @@
+[tools]
+"go:golang.org/x/pkgsite/cmd/pkgsite" = "latest"
+"go:golang.org/x/tools/gopls" = "latest"
+"go:golang.org/x/vuln/cmd/govulncheck" = "latest"
+"go:mvdan.cc/gofumpt" = "latest"
+go = "latest"
+golangci-lint = "latest"
+goreleaser = "latest"
+
+[vars]
+fuzzflags = "-fuzztime=120s"
+
+[tasks.build]
+description = "Build binary"
+sources = ["**/*.go", "go.mod", "go.sum"]
+outputs = ["mtg"]
+run = "go build"
+
+[tasks."build:prof"]
+description = "Build binary with profiling enabled"
+sources = ["**/*.go", "go.mod", "go.sum"]
+outputs = ["mtg"]
+run = "go build -tags prof"
+
+[tasks.update]
+description = "Update dependencies"
+run = [
+    "go get -u",
+    "go mod tidy -go=1.26"
+]
+
+[tasks.lint]
+description = "Run linter"
+run = "golangci-lint run"
+
+[tasks.vuln]
+description = "Test for vulnerabilities"
+run = "govulncheck ./..."
+
+[tasks.test]
+description = "Run tests"
+run = "go test -v -race ./..."
+
+[tasks.covtest]
+description = "Run tests with code coverage"
+run = "go test -coverprofile=coverage.txt -covermode=atomic -count=2 -race -v ./..."
+
+[tasks.test-all]
+description = "Run all tests"
+depends = [
+    "test",
+    "test:fuzz:*"
+]
+
+[tasks."test:fuzz:client-hello"]
+description = "Run fuzzy test for ClientHello"
+run = "go test -v {{ vars.fuzzflags }} -fuzz=FuzzReadClientHello ./mtglib/internal/tls/fake"
+
+[tasks."test:fuzz:client-handshake"]
+description = "Run fuzzy test for ClientHandshake"
+run = "go test -v {{ vars.fuzzflags }} -fuzz=FuzzClientServerHandshake ./mtglib/internal/obfuscation"
+
+[tasks."test:fuzz:server-handshake-frame"]
+description = "Run fuzzy test for GenerateHandshakeFrame"
+run = "go test -v {{ vars.fuzzflags }} -fuzz=FuzzGenerateHandshakeFrame ./mtglib/internal/obfuscation"
+
+[tasks.static]
+description = "Build static binary"
+sources = ["**/*.go", "go.mod", "go.sum"]
+outputs = ["mtg"]
+run = """
+#!/bin/bash
+
+version="$(git describe --exact-match HEAD 2>/dev/null || git describe --tags --always)"
+go build \
+    -trimpath \
+    -mod=readonly \
+    -ldflags="-extldflags '-static' -s -w -X 'main.version=$version'" \
+    -a \
+    -tags netgo
+"""
+
+[tasks.release]
+description = "Create release tarballs"
+sources = ["**/*.go", "go.mod", "go.sum", ".goreleaser.yml"]
+run = [
+    "goreleaser --snapshot --clean",
+    "find dist -depth 1 -type d | xargs -r rm -r",
+    "rm ./dist/config.yaml"
+]
+
+[tasks.image]
+description = "Build docker image"
+sources = ["**/*.go", "go.mod", "go.sum", "Dockerfile"]
+run = "docker buildx build --pull -t mtg ."
+
+[tasks.docs]
+description = "Run doc server"
+run = "pkgsite -http 0.0.0.0:10000"
+
+[tasks.fmt]
+description = "Reformat source code"
+sources = ["**/*.go"]
+run = "gofumpt -w --extra ."

.travis.yml

@@ -1,18 +0,0 @@
----
-
-language: go
-sudo: false
-dist: trusty
-
-go:
-  - "1.9.x"
-  - "1.10.x"
-  - master
-
-script:
-  - make lint
-  - make test
-
-cache:
-  directories:
-    - vendor

BEST_PRACTICES.md

@@ -0,0 +1,55 @@
+# Best practices
+
+This is unfortunate, but since 2018 many things were changed. Most of them
+became way worse. Previous iterations of censorship systems were very dumb,
+DPI were primitive and filtered very obvious things. Nowadays they are
+way more intelligent and it is very naive to treat them frivolously.
+
+In 2026 is not enough to pretend that your mtg installation is a Microsoft
+website that sits in Amsterdam Digital Ocean location. Now your installation
+has to be a website that is mtg in disguise. Yes, it requires a bit more effort
+but this effort is probably less than rotating proxies each other day.
+
+mtproto traffic, even with FakeTLS, has its specifics that are probably
+very well known by DPI systems. These specifics are not something unique but
+could mark an IP address as suspicious. Now let's think:
+
+1. You have a proxy in Amsterdam Digital Ocean that tells it is microsoft.com
+   how hard could it be to find out that this is probably fake? 1 or probably 2
+   DNS queries for `microsoft.com`? In case of some CDN, there are ECS-powered
+   resolvers that are very capable to return results from POV of some subnets.
+   If censor sees no relevant results, will they be afraid to block IP?
+2. You have a proxy in Amsterdam Digital Ocean that tells it is a website from
+   the same public subnet. But not the same. Would it be hard to make these DNS
+   queries and ban IP?
+
+The correct way of having this proxy is following:
+
+1. Register a domain name
+2. Get some VPS, probably in your domestic location
+3. Set that domain name from a step 1 to IP address of that VPS
+4. Generate a couple of HTML pages by LLMs or even copy them from elsewhere
+5. Set some webserver and issue TLS certificates with Let's Encrypt or any other
+   name
+6. Set mtg before this webserver.
+7. Use sing-box or anything like that to provide local socks5 interface and
+   have VPNized uplinks
+8. Set up mtg to use socks5 from a 7 step.
+
+In that case you will get a match of DNS and SNI in requests. As a side effect,
+your proxy will work with XTLS and its friends: XTLS in sniff mode ignores
+IP address a client wants to connect to. Instead, it reads SNI and connect
+to resolved address: a clever idea if user does not have a trustworthy DNS
+set up.
+
+Yes, this is much longer that usual technique, and requires more effort. But
+this is could probably be very well automated to some reasonable extent.
+
+Unfortunately, this is a best practice right now.
+
+Do not also forget about other implementation, like
+[telemt](https://github.com/telemt/telemt). Try everything. Use VPNs. It does
+not really matter which project you are going to use as long it helps you to
+stay connected.
+
+_March 2026._

Dockerfile

@@ -1,25 +1,45 @@
 ###############################################################################
 # BUILD STAGE
 
-FROM golang:alpine
+FROM golang:1.26-alpine AS build
+
+ENV CGO_ENABLED=0
+
+# this is done for backward compatibility: before that we mounted a config
+# into /config.toml. Some application allow mounting directories only,
+# so it makes problems. So, instead we are going to do 2 steps:
+#  1. Create /config/config.toml as a symlink to /config.toml
+#  2. Force /mtg to use /config/config.toml
+#
+# it helps in both ways: users with directories could use /config directory
+# and overlap a symlink by their bind mount. Old users could continue using
+# /config.toml as a real config.
+RUN set -x \
+  && mkdir -p /config \
+  && ln -sv /config.toml /config/config.toml
+
+RUN --mount=type=cache,target=/var/cache/apk \
+    set -x \
+    && apk --update add \
+      bash \
+      ca-certificates \
+      git
+
+COPY go.mod go.sum /app/
+WORKDIR /app
+
+RUN go mod download
+
+COPY . /app
 
 RUN set -x \
-  && apk --no-cache --update add \
-    bash \
-    ca-certificates \
-    curl \
-    git \
-    make \
-    upx \
-  && update-ca-certificates
-
-ADD . /go/src/github.com/9seconds/mtg
-
-RUN set -x \
-  && cd /go/src/github.com/9seconds/mtg \
-  && make clean \
-  && make -j 4 static \
-  && upx --ultra-brute -qq ./mtg
+  && version="$(git describe --exact-match HEAD 2>/dev/null || git describe --tags --always)" \
+  && go build \
+      -trimpath \
+      -mod=readonly \
+      -ldflags="-extldflags '-static' -s -w -X 'main.version=$version'" \
+      -a \
+      -tags netgo
 
 
 ###############################################################################
@@ -27,12 +47,10 @@ RUN set -x \
 
 FROM scratch
 
-ENTRYPOINT ["/usr/local/bin/mtg"]
-ENV MTG_IP=0.0.0.0 \
-    MTG_PORT=3128 \
-    MTG_STATS_IP=0.0.0.0 \
-    MTG_STATS_PORT=3129
-EXPOSE 3128 3129
+ENTRYPOINT ["/mtg"]
+CMD ["run", "/config/config.toml"]
 
-COPY --from=0 /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
-COPY --from=0 /go/src/github.com/9seconds/mtg/mtg /usr/local/bin/mtg
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=build /app/mtg /mtg
+COPY --from=build /app/example.config.toml /config.toml
+COPY --from=build /config /config

Gopkg.lock

@@ -1,91 +0,0 @@
-# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.
-
-
-[[projects]]
-  branch = "master"
-  name = "github.com/alecthomas/template"
-  packages = [
-    ".",
-    "parse"
-  ]
-  revision = "a0175ee3bccc567396460bf5acd36800cb10c49c"
-
-[[projects]]
-  branch = "master"
-  name = "github.com/alecthomas/units"
-  packages = ["."]
-  revision = "2efee857e7cfd4f3d0138cc3cbb1b4966962b93a"
-
-[[projects]]
-  name = "github.com/davecgh/go-spew"
-  packages = ["spew"]
-  revision = "346938d642f2ec3594ed81d874461961cd0faa76"
-  version = "v1.1.0"
-
-[[projects]]
-  branch = "master"
-  name = "github.com/dustin/go-humanize"
-  packages = ["."]
-  revision = "02af3965c54e8cacf948b97fef38925c4120652c"
-
-[[projects]]
-  branch = "master"
-  name = "github.com/juju/errors"
-  packages = ["."]
-  revision = "c7d06af17c68cd34c835053720b21f6549d9b0ee"
-
-[[projects]]
-  name = "github.com/pmezard/go-difflib"
-  packages = ["difflib"]
-  revision = "792786c7400a136282c1664665ae0a8db921c6c2"
-  version = "v1.0.0"
-
-[[projects]]
-  name = "github.com/satori/go.uuid"
-  packages = ["."]
-  revision = "f58768cc1a7a7e77a3bd49e98cdd21419399b6a3"
-  version = "v1.2.0"
-
-[[projects]]
-  name = "github.com/stretchr/testify"
-  packages = ["assert"]
-  revision = "f35b8ab0b5a2cef36673838d662e249dd9c94686"
-  version = "v1.2.2"
-
-[[projects]]
-  name = "go.uber.org/atomic"
-  packages = ["."]
-  revision = "1ea20fb1cbb1cc08cbd0d913a96dead89aa18289"
-  version = "v1.3.2"
-
-[[projects]]
-  name = "go.uber.org/multierr"
-  packages = ["."]
-  revision = "3c4937480c32f4c13a875a1829af76c98ca3d40a"
-  version = "v1.1.0"
-
-[[projects]]
-  name = "go.uber.org/zap"
-  packages = [
-    ".",
-    "buffer",
-    "internal/bufferpool",
-    "internal/color",
-    "internal/exit",
-    "zapcore"
-  ]
-  revision = "eeedf312bc6c57391d84767a4cd413f02a917974"
-  version = "v1.8.0"
-
-[[projects]]
-  name = "gopkg.in/alecthomas/kingpin.v2"
-  packages = ["."]
-  revision = "947dcec5ba9c011838740e680966fd7087a71d0d"
-  version = "v2.2.6"
-
-[solve-meta]
-  analyzer-name = "dep"
-  analyzer-version = 1
-  inputs-digest = "c4fdd3664f683342ad0c2509f4a8bcfe5b267a6e8cdaf36f70d39536bbf89834"
-  solver-name = "gps-cdcl"
-  solver-version = 1

Gopkg.toml

@@ -1,50 +0,0 @@
-# Gopkg.toml example
-#
-# Refer to https://golang.github.io/dep/docs/Gopkg.toml.html
-# for detailed Gopkg.toml documentation.
-#
-# required = ["github.com/user/thing/cmd/thing"]
-# ignored = ["github.com/user/project/pkgX", "bitbucket.org/user/project/pkgA/pkgY"]
-#
-# [[constraint]]
-#   name = "github.com/user/project"
-#   version = "1.0.0"
-#
-# [[constraint]]
-#   name = "github.com/user/project2"
-#   branch = "dev"
-#   source = "github.com/myfork/project2"
-#
-# [[override]]
-#   name = "github.com/x/y"
-#   version = "2.4.0"
-#
-# [prune]
-#   non-go = false
-#   go-tests = true
-#   unused-packages = true
-
-
-[prune]
-  go-tests = true
-  unused-packages = true
-
-[[constraint]]
-  name = "gopkg.in/alecthomas/kingpin.v2"
-  version = "2.2.6"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/juju/errors"
-
-[[constraint]]
-  name = "github.com/stretchr/testify"
-  version = "1.2.1"
-
-[[constraint]]
-  name = "github.com/satori/go.uuid"
-  version = "1.2.0"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/dustin/go-humanize"

Makefile

@@ -1,80 +0,0 @@
-ROOT_DIR     := $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))
-IMAGE_NAME   := mtg
-APP_NAME     := $(IMAGE_NAME)
-GOMETALINTER := gometalinter
-
-VENDOR_FILES := $(shell find "$(ROOT_DIR)/vendor" 2>/dev/null || echo -n "vendor")
-CC_BINARIES  := $(shell bash -c "echo -n $(APP_NAME)-{linux,windows,darwin,freebsd,openbsd}-{386,amd64} $(APP_NAME)-linux-{arm,arm64}")
-APP_DEPS     := version.go $(VENDOR_FILES)
-
-COMMON_BUILD_FLAGS := -ldflags="-s -w"
-
-# -----------------------------------------------------------------------------
-
-$(APP_NAME): $(APP_DEPS)
-	@go build $(COMMON_BUILD_FLAGS) -o "$(APP_NAME)"
-
-static-$(APP_NAME): $(APP_DEPS)
-	@env CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo $(COMMON_BUILD_FLAGS) -o "$(APP_NAME)"
-
-$(APP_NAME)-%: GOOS=$(shell echo -n "$@" | sed 's?$(APP_NAME)-??' | cut -f1 -d-)
-$(APP_NAME)-%: GOARCH=$(shell echo -n "$@" | sed 's?$(APP_NAME)-??' | cut -f2 -d-)
-$(APP_NAME)-%: $(APP_DEPS) ccbuilds
-	@env "GOOS=$(GOOS)" "GOARCH=$(GOARCH)" \
-		go build \
-		$(COMMON_BUILD_FLAGS) \
-		-o "./ccbuilds/$(APP_NAME)-$(GOOS)-$(GOARCH)"
-
-ccbuilds:
-	@rm -rf ./ccbuilds && mkdir -p ./ccbuilds
-
-version.go:
-	@go generate main.go
-
-vendor: Gopkg.lock Gopkg.toml install-cli
-	@dep ensure
-
-# -----------------------------------------------------------------------------
-
-.PHONY: all
-all: $(APP_NAME)
-
-.PHONY: static
-static: static-$(APP_NAME)
-
-.PHONY: crosscompile
-crosscompile: $(CC_BINARIES)
-
-.PHONY: crosscompile-dir
-crosscompile-dir:
-	@rm -rf "$(CC_DIR)" && mkdir -p "$(CC_DIR)"
-
-.PHONY: test
-test: vendor install-cli version.go
-	@go test -v ./...
-
-.PHONY: lint
-lint: vendor install-cli version.go
-	@$(GOMETALINTER) --deadline=2m ./...
-
-.PHONY: clean
-clean:
-	@git clean -xfd && \
-		git reset --hard >/dev/null && \
-		git submodule foreach --recursive sh -c 'git clean -xfd && git reset --hard' >/dev/null
-
-.PHONY: docker
-docker:
-	@docker build --pull -t "$(IMAGE_NAME)" "$(ROOT_DIR)"
-
-.PHONY: install-cli
-install-cli: install-dep install-lint
-
-.PHONY: install-dep
-install-dep:
-	@go get github.com/golang/dep/cmd/dep
-
-.PHONY: install-lint
-install-lint:
-	@go get github.com/alecthomas/gometalinter && \
-		$(GOMETALINTER) --install >/dev/null

README.md

@@ -1,12 +1,27 @@
 # mtg
 
-Bullshit-free MTPROTO proxy for Telegram
+Highly-opinionated (ex-bullshit-free) MTPROTO proxy for
+[Telegram](https://telegram.org/).
 
-[![Build Status](https://travis-ci.org/9seconds/mtg.svg?branch=master)](https://travis-ci.org/9seconds/mtg)
-[![Docker Build Status](https://img.shields.io/docker/build/nineseconds/mtg.svg)](https://hub.docker.com/r/nineseconds/mtg/)
+[![CI](https://github.com/9seconds/mtg/actions/workflows/ci.yaml/badge.svg?branch=master)](https://github.com/9seconds/mtg/actions/workflows/ci.yaml)
+[![codecov](https://codecov.io/gh/9seconds/mtg/branch/master/graph/badge.svg?token=JfdDyGVpT4)](https://codecov.io/gh/9seconds/mtg)
+[![Go Reference](https://pkg.go.dev/badge/github.com/9seconds/mtg.svg)](https://pkg.go.dev/github.com/9seconds/mtg/v2)
 
+**If you use v1.0 or upgrade broke you proxy, please read the chapter
+[Version 2](#version-2)**
 
-# Rationale
+If you want to have a proxy that _supports adtag_ (possibility to promote a
+channel with a special Telegram bot), I recommend to use
+[telemt](https://github.com/telemt/telemt) project. v1 of mtg supports it
+but I do not see any reasonable point of using it: adtag requires communication
+via a fragile set of middle proxies, requires complex setup that must expose
+a public IPs, has lower bandwidth and latency.
+
+mtg idea is simple: minimal unbloated proxy that can handle a reasonable scale
+~10-20k simultaneous connections, has no user management, but ticks all
+checkboxes related to its main intent: provide a way to use Telegram.
+
+## Rationale
 
 There are several available proxies for Telegram MTPROTO available. Here
 are the most notable:
@@ -14,99 +29,517 @@ are the most notable:
 * [Official](https://github.com/TelegramMessenger/MTProxy)
 * [Python](https://github.com/alexbers/mtprotoproxy)
 * [Erlang](https://github.com/seriyps/mtproto_proxy)
-* [JS](https://github.com/FreedomPrevails/JSMTProxy)
+* [Telemt (Rust)](https://github.com/telemt/telemt)
 
-Almost all of them follow the way how official proxy was build. This
-includes support of multiple secrets, support of promoted channels etc.
+You can use any of these. They work great and all implementations have
+feature parity now. This includes support of adtag, replay attack
+protection, domain fronting, faketls, and so on. mtg has a similar
+goal: to give a possibility to connect to Telegram in a restricted,
+censored environment. But it does it slightly differently in details
+that probably matter.
 
-mtg is an implementation in golang which is intended to be:
+* **Domain fronting**
+
+  For years mtg supports domain fronting. This technique means that it fallbacks
+  to accessing a real website in case if request fails. It could fail by many
+  reasons: anti-replay protection, accidental access to the webserver or
+  stale request. Anyway, if mtg rejects this request, it does not break a
+  connection. It connects to the websites and replicates everything that client
+  has sent, and simply proxies it back as is. Users will see a response from
+  the real website, _byte-to-byte identical_ to the response of the real netloc.
+
+* **Doppelganger**
+
+  mtg also is a doppelganger of the website it fronts. Sure, with domain fronting
+  users will see replies of the real website in case if something will go wrong.
+  But what about such cases when _everything is fine_?
+
+  In that case mtg mimics TLS connection statistical characteristics as close as
+  possible. Different application have different statistics of their patterns.
+  Big CDN steadily pumping the data, small websites burst with short easily
+  compressiable chunks of traffic.
+
+  mtg artificially emulates those delays to be statistically indistinguishable
+  from the real website even if it covers connection of the very specific app.
+  It also follows 2 most common patterns of traffic chunking, so censors
+  will have to put more resources to find out that we have Telegram here
+  but not a hookah webshop served by nginx.
+
+* **Resource-efficient**
+
+  It has to be resource-efficient. It does not mean that you will see
+  the smallest memory usage. It means that it will try to use allocated
+  resources in zero-waste mode, reusing as much memory as possible and
+  so on.
 
-* **Lightweight**
-  It has to consume as less resources as possible but not by losing
-  maintainability.
 * **Easily deployable**
+
   I strongly believe that Telegram proxies should follow the way of
-  ShadowSocks: promoted channels is a strange way of doing business
-  I suppose. I think the only viable way is to have a proxy with
-  minimum configuration which should work everywhere.
-* **Single secret**
-  I think that multiple secrets solves no problems and just complexify
-  software. I also believe that in case of throwout proxies, this feature
-  is useless luxury.
-* **Minimum docker image size**
-  Official image is less than 2 megabytes. Literally.
+  [ShadowSocks](https://shadowsocks.org): promoted channels is a strange
+  way of doing business I suppose. I think the only viable way is to
+  have a proxy that can be restored anywhere easily.
+
+* **Supports proxy protocol v1/v2**
+
+  This makes integration with loadbalancers like HAProxy and ELB a first class
+  citizen by supporting their
+  [commuication protocols](https://www.haproxy.org/download/2.3/doc/proxy-protocol.txt).
+
+* **A single secret**
+
+  I think that multiple secrets solve no problems and just complex
+  software. I also believe that in the case of throwout proxies, this
+  the feature is a useless luxury.
+
+  This is very controversial topic. Please read [rationale (in russian)](https://github.com/9seconds/mtg/issues/376#issuecomment-4118726699)
+  and use [mtg-multi](https://github.com/dolonet/mtg-multi) fork if you are disagree with.
+
+* **No adtag support**
+
+  Please read [Version 2](#version-2) chapter.
+
 * **No management WebUI**
-  This is an implementation of simple lightweight proxy. I won't do that.
 
-This proxy supports 2 modes of work: direct connection to Telegram and
-promoted channel mode. If you do not need promoted channels, I would
-recommend you to go with direct mode: this is way more robust.
+  This is an implementation of a simple lightweight proxy. I won't do that.
 
-To run proxy in direct mode, all you need to do is just provide a
-secret. If you do not provide ADTag as a second parameter, promoted
-channels mode won't be activated.
+* **Proxy chaining**
 
-To get promoted channel, please contact
-[@MTProxybot](https://t.me/MTProxybot) and provide generated adtag as a
-second parameter.
+  mtg has the support of [SOCKS5](https://en.wikipedia.org/wiki/SOCKS)
+  proxies. So, in theory, you can run this proxy as a frontend
+  and route traffic via [v2ray](https://www.v2ray.com/),
+  [Gost](https://docs.ginuerzh.xyz/gost/),
+  [Trojan](https://trojan-gfw.github.io/trojan/), or any other project
+  you like.
 
+* **Native blocklist support**
 
-# How to build
+  Previously, this was delegated to the [FireHOL](https://firehol.org/)
+  project or similar ones which track attacks and publish a list of
+  potentially dangerous IPs. mtg has native support of such blocklists.
+
+* **Can be used as a library**
+
+  mtg v2 was redesigned in a way so it can be embedded into your
+  software (written in Golang) with a minimum effort + you can replace
+  some parts with those you want.
+
+Please also to read about [best practices](https://github.com/9seconds/mtg/blob/master/BEST_PRACTICES.md).
+
+### Version 2
+
+If you use version 1.x before, you are probably noticed some major
+backward non-compatible details:
+
+1. Configuration file
+2. Removed support of adtag
+
+For the configuration file, please check out the full example in this
+repository. It has a lot of comments and most of the options are
+optional. We do have only `secret` and `bind-to` sections mandatory.
+Other sections in the example configuration file are filled with default
+values.
+
+Adtag support was removed completely. This was done to debloat mtg and
+keep it simple and obvious. Hopefully, this goal is achieved and the
+source code is clean and straightforward enough.
+
+I always was quite skeptical about adtag. In my POV, a proxy as a fat
+big connectivity point for hundreds of clients is an illusion. If you
+work in a censored environment, the first thing that authority does is
+IP blocking. For us, it means, those big proxies that can benefit from
+having a pinned channel are going to be blocked in a minute.
+
+Proxy has to be intimate. It has to be shared within a small group as
+a family or maybe your college friends. It has to have a small number
+of connections and never publicly announced its presence. It has to fly
+under the radar. If the proxy is detected, you need to be able to give
+a rebirth on a new IP address as soon as possible. I do no think that
+having some special channel for such a use case makes any sense.
+
+But other details like replay attack protection, domain fronting,
+accurate FakeTLS implementation, IP blacklisting, and proxy
+chaining matter here. If you work in censored perimeter like
+[GFW](https://en.wikipedia.org/wiki/Great_Firewall)-protected
+country, you probably want to have an MTPROTO proxy as
+a frontend that transports traffic via cloaked tunnels
+made by [Trojan](https://trojan-gfw.github.io/trojan/),
+[Shadowsocks](https://shadowsocks.org), [v2ray](https://www.v2ray.com/),
+or [Gost](https://docs.ginuerzh.xyz/gost/). That's why you have to have
+the support of chaining as a first-class citizen.
+
+Yes, this is possible and doable with optional adtag support. But the
+truth is that the MTPROTO proxy for Telegram is just a thing that either
+work as a normal client (direct mode) or doing some RPC calls in [TL
+language](https://core.telegram.org/mtproto/TL) (adtag support). I
+understand the intention of the developers and I understand that they
+were under high pressure fighting with [RKN](https://rkn.gov.ru/) and
+doing TON after that. Nothing is ideal. But for the proxy, it means that
+source code is full of complex non-trivial code which is required only
+to support a feature that we barely need.
+
+So, to have a reasonable MTPROTO proxy, adtag support was removed. This
+is a rare chance in my career where software v2 debloats a previous
+version. It feels so good :)
+
+### Version 1 and 2
+
+I do continue to support both versions 1 and 2. But in a different mode.
+
+Version 1 is now officially in maintenance mode. It means that I won't
+make any new features or improvements there. You can consider a feature
+freeze there. No bugs are going to be fixed there except for critical
+ones. PRs are welcome though. The goal is to keep it working. It will
+get some periodical updates like updates to the new Golang version of
+dependencies version bump, but that's mostly it.
+
+**If you want to have mtg with _adtag support_, please use version 1**.
+
+Version 2 is going to have all my love, active support, bug fixing, etc.
+It is under active development and maintenance.
+
+This project has several main branches
+
+1. [`master`](https://github.com/9seconds/mtg/tree/master) branch
+   contains a bleeding edge. It may potentially have some features
+   which will break your source code.
+2. [`stable`](https://github.com/9seconds/mtg/tree/stable) branch contains
+   dumps of a master branch when we consider it 'stable'. This is a
+   branch you probably want to pick.
+3. [`v2`](https://github.com/9seconds/mtg/tree/v2) has a development
+   of the v2.x version. In theory, it is the same as `master` but this
+   will change when we have v3.x.
+4. [`v1`](https://github.com/9seconds/mtg/tree/v1) has a version 1.x.
+
+## Getting started
+
+### Download mise
+
+mtg uses [mise](https://mise.jdx.dev/) to maintain its development
+dependencies + replaces a make for building things. Please
+[install](https://mise.jdx.dev/getting-started.html) it first.
+
+### Download a tool
+
+#### Download binaries
+
+Binaries can be downloaded from the release page. Also, you can download
+docker image.
+
+For the current version, please download like
 
 ```console
-$ make
+docker pull nineseconds/mtg:2
 ```
 
-If you want to build for another platform:
+For version 1:
 
 ```console
-$ make crosscompile
+docker pull nineseconds/mtg:1
 ```
 
-If you want to build Docker image (called `mtg`):
+You may also check both [Docker
+Hub](https://hub.docker.com/r/nineseconds/mtg/tags) and [Github
+Registry](https://github.com/users/9seconds/packages/container/package/mtg).
+Please do not choose `latest` or `stable` if you want to avoid
+surprises. Always choose some version tag.
+
+Also, if you have `go` installed, you can always download this tool with `go get`:
 
 ```console
-$ make docker
+go install github.com/9seconds/mtg/v2@latest
 ```
 
-# Docker image
+#### Build from sources
 
 ```console
-$ docker pull nineseconds/mtg
+git clone https://github.com/9seconds/mtg.git
+cd mtg
+mise install
+mise tasks run build
 ```
 
-# Configuration
-
-Basically, to run this tool you need to configure as less as possible.
-
-First, you need to generate a secret:
+or for the docker image:
 
 ```console
-$ openssl rand -hex 16
+mise tasks run image
+```
+
+### Generate secret
+
+If you already have a secret in Base64 format or that, which starts with `ee`,
+you can skip this chapter. Otherwise:
+
+```console
+$ mtg generate-secret google.com
+7ibaERuTSGPH1RdztfYnN4tnb29nbGUuY29t
 ```
 
 or
 
 ```console
-$ head -c 512 /dev/urandom | md5sum | cut -f 1 -d ' '
+$ mtg generate-secret --hex google.com
+ee473ce5d4958eb5f968c87680a23854a0676f6f676c652e636f6d
 ```
 
-Now run the tool:
+equivalent commands with docker:
 
 ```console
-$ mtg <secret>
+$ docker run --rm nineseconds/mtg:2 generate-secret google.com
+7ibaERuTSGPH1RdztfYnN4tnb29nbGUuY29t
+
+$ docker run --rm nineseconds/mtg:2 generate-secret --hex google.com
+ee473ce5d4958eb5f968c87680a23854a0676f6f676c652e636f6d
 ```
 
-This tool will listen on port 3128 by default with the given secret.
+This secret is a keystone for a proxy and your password for a client.
+You need to keep it secured.
 
-# One-line runner
+We recommend choosing a hostname wisely. Here we have a _google.com_
+but in reality, all providers can easily detect that this is not a
+Google. Google has a list of networks it officially uses and your IP
+address won't probably belong to it. It is a great idea to hide behind
+some domain that has some relation to this IP address.
+
+For example, you've bought a VPS from [Digital
+Ocean](https://www.digitalocean.com/). Then it might be a good idea to
+generate a secret for _digitalocean.com_ then.
+
+### Check configuration
+
+There is a special command for secret verification:
 
 ```
-$ docker run --name mtg --restart=unless-stopped -p 3128:3128 -p 3129:3129 -d nineseconds/mtg $(openssl rand -hex 16)
+$ mtg doctor /path/to/my/config.toml
+Deprecated options
+  ✅ All good
+Time skewness
+  ✅ Time drift is -607.048µs, but tolerate-time-skewness is 5s
+Validate native network connectivity
+  ✅ DC 1
+  ✅ DC 2
+  ✅ DC 3
+  ✅ DC 4
+  ✅ DC 5
+  ✅ DC 203
+Validate network connectivity with proxy socks5://127.0.0.1:1080
+  ✅ DC 1
+  ✅ DC 2
+  ✅ DC 3
+  ✅ DC 4
+  ✅ DC 5
+  ✅ DC 203
+Validate fronting domain connectivity
+  ✅ xx.xx.xx.xx:yyy is reachable
+Validate SNI-DNS match
+  ✅ IP address xx.xx.xx.xx matches secret hostname <REDACTED>
 ```
 
-You will have this tool up and running on port 3128. Now curl
-`localhost:3129` to get `tg://` links or do `docker logs mtg`. Also,
-port 3129 will show you some statistics if you are interested in.
+It aims to find out possible inconsistencies and problems with your
+configuration. It makes sense to run it before executing any relevant commands.
 
-Also, you can use [run-mtg.sh](https://github.com/9seconds/mtg/blob/master/run-mtg.sh) script
+### Simple run mode
+
+mtg supports 2 modes: simple and normal. Simple mode allows starting
+proxy with a small subset of configuration options you usually want to
+modify. This is quite good for oneliners that you can copy-paste and do
+not bother about external files whatsoever.
+
+Let's take a look:
+
+```console
+Usage: mtg simple-run <bind-to> <secret>
+
+Run proxy without config file.
+
+Arguments:
+  <bind-to>    A host:port to bind proxy to.
+  <secret>     Proxy secret.
+
+Flags:
+  -h, --help                           Show context-sensitive help.
+  -v, --version                        Print version.
+
+  -d, --debug                          Run in debug mode.
+  -c, --concurrency=8192               Max number of concurrent connection to proxy.
+  -b, --tcp-buffer="4KB"               Size of TCP buffer to use.
+  -i, --prefer-ip="prefer-ipv6"        IP preference. By default we prefer IPv6 with fallback to IPv4.
+  -p, --domain-fronting-port=443       A port to access for domain fronting.
+  -n, --doh-ip=1.1.1.1                 IP address of DNS-over-HTTP to use.
+  -t, --timeout=10s                    Network timeout to use
+  -a, --antireplay-cache-size="1MB"    A size of anti-replay cache to use.
+```
+
+So, if you want to startup a proxy with CLI only, you can do something like
+
+```console
+$ mtg simple-run -n 1.1.1.1 -t 30s -a 512kib 127.0.0.1:3128 7hBO-dCS4EBzenlKbdLFxyNnb29nbGUuY29t
+```
+
+The rest of the configuration will be taken from default values. But
+a simple run is fine if you do not have any special requirements or
+granular tuning. If you want it, please checkout the configuration
+files.
+
+### Prepare a configuration file
+
+Please checkout an example configuration file. All options except of
+`secret` and `bind-to` are optional. You can safely have this minimal
+configuration file:
+
+```toml
+secret = "ee473ce5d4958eb5f968c87680a23854a0676f6f676c652e636f6d"
+bind-to = "0.0.0.0:443"
+```
+
+This is enough to run the whole application. All other
+options already have sensible defaults for the app at almost any scale.
+
+Oh, the configuration is done in [TOML format](https://toml.io/en/).
+
+### Run a proxy
+
+Put a binary and a config into your webserver. Just for example,
+a binary goes to `/usr/local/bin/mtg` and configuration to `/etc/mtg.toml`.
+
+Now you can create a systemd unit:
+
+```console
+$ cat /etc/systemd/system/mtg.service
+[Unit]
+Description=mtg - MTProto proxy server
+Documentation=https://github.com/9seconds/mtg
+After=network.target
+
+[Service]
+ExecStart=/usr/local/bin/mtg run /etc/mtg.toml
+Restart=always
+RestartSec=3
+DynamicUser=true
+LimitNOFILE=65536
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target
+$ sudo systemctl daemon-reload
+$ sudo systemctl enable mtg
+$ sudo systemctl start mtg
+```
+
+or you can run a docker image
+
+```console
+docker run -d -v $PWD/config.toml:/config.toml -p 443:3128 --name mtg-proxy --restart=unless-stopped nineseconds/mtg:2
+```
+
+where _443_ is a host port (a port you want to connect to from a
+client), and _3128_ is the one you have in your config in the `bind-to`
+section.
+
+### Access a proxy
+
+Now you can generate some useful links:
+
+```console
+$ mtg access /etc/mtg.toml
+{
+  "ipv4": {
+    "ip": "x.y.z.a",
+    "port": 3128,
+    "tg_url": "tg://proxy?...",
+    "tg_qrcode": "https://api.qrserver.com/v1/create-qr-code?data...",
+    "tme_url": "https://t.me/proxy?...",
+    "tme_qrcode": "https://api.qrserver.com/v1/create-qr-code?data..."
+  },
+  "secret": {
+    "hex": "...",
+    "base64": "..."
+  }
+}
+```
+
+or if you are using docker:
+
+```console
+$ docker exec mtg-proxy /mtg access /config.toml
+```
+
+## Doppelganger
+
+mtg can mimic real websites, please take a look at relevant section in example
+config file.
+
+mtg comes with some very good precollected statistics coming from
+[ok.ru](https://ok.ru/). It does not mean that you have to cover yourself
+by pretending that mtg is _ok.ru_. **Do not do that: ok.ru comes from very specific
+ASNs, but not from VPS providers you are going to use.** What I want to say
+is that defaults are very good enough to use as is because ok.ru for public
+pages has a very generic profile of TLS packets delay.
+
+But for better results it is recommended to teach mtg about the website you
+will use as a domain front. In order to do that, you need to specify URLs
+from this website. Just go to it, open WebDeveloper console and pick up
+random URLs. For better results they have to be **from the same domain name
+you are going to use as a disguise** but serve light and heavy content: pages,
+images etc. Do not use many, 2-3 will probably work.
+
+mtg will crawl these pages periodically, accumulating statistics and
+using it as you go.
+
+```toml
+[defense.doppelganger]
+urls = [
+  "https://lalala.com/index.html",
+  "https://lalala.com/contacts.html",
+]
+```
+
+This is not very necessary. Keep in mind these rules:
+
+1. If you are not sure what is this all about, do nothing. Defaults are good.
+2. All URLs must be HTTPS
+3. All URLs should be from the same domain name (but this is not a rule)
+4. Do not use a lot of pages. Use _different_ pages. mtg will start using this
+   statistics when it will accumulate enough anyway.
+5. These URLs should be directly accessible from mtg without proxies whatsoever
+6. Do not create huge raids. mtg will repeatedly crawl in raids, making N repeats.
+   Do not use high N, you do not want to be noticeable.
+7. It makes no sense to have small delay between raids. Usually webservers
+   do not update their TLS settings each hour.
+8. If you have some specific knowledge if webserver is using
+   [TLS Dynamic Record Sizing](https://blog.cloudflare.com/optimizing-tls-over-tcp-to-reduce-latency/), you
+   can use a very specific setting. This are Cloudflare, Go standard webservers,
+   [caddy](https://caddyserver.com/) and [H2O](https://h2o.examp1e.net/). If so,
+   you can enable `drs` setting.
+9. **If you are not sure, touch nothing!**
+
+## Metrics
+
+Out of the box, mtg works with
+[statsd](https://github.com/statsd/statsd) and
+[Prometheus](https://prometheus.io/). Please check configuration file
+example to get how to set this integration up.
+
+Here goes a list of metrics with their types but without a prefix.
+
+| Name                        | Type    | Tags                             | Description                                                                                |
+|-----------------------------|---------|----------------------------------|--------------------------------------------------------------------------------------------|
+| client_connections          | gauge   | `ip_family`                      | Count of processing client connections.                                                    |
+| telegram_connections        | gauge   | `telegram_ip`, `dc`              | Count of connections to Telegram servers.                                                  |
+| domain_fronting_connections | gauge   | `ip_family`                      | Count of connections to fronting domain.                                                   |
+| iplist_size                 | gauge   | `ip_list`                        | A size of either allowlist or blocklist in use.                                            |
+| telegram_traffic            | counter | `telegram_ip`, `dc`, `direction` | Count of bytes, transmitted to/from Telegram.                                              |
+| domain_fronting_traffic     | counter | `direction`                      | Count of bytes, transmitted to/from fronting domain.                                       |
+| domain_fronting             | counter | –                                | Count of domain fronting events.                                                           |
+| concurrency_limited         | counter | –                                | Count of events, when client connection was rejected due to concurrency limit.             |
+| ip_blocklisted              | counter | `ip_list`                        | Count of events when client connection was rejected because IP was found in the blocklist. |
+| replay_attacks              | counter | –                                | Count of detected replay attacks.                                                          |
+
+Tag meaning:
+
+| Name        | Values                     | Description                                   |
+|-------------|----------------------------|-----------------------------------------------|
+| ip_family   | `ipv4`, `ipv6`             | A version of the IP protocol.                 |
+| dc          |                            | A number of the Telegram DC for a connection. |
+| telegram_ip |                            | IP address of the Telegram server.            |
+| direction   | `to_client`, `from_client` | A direction of the traffic flow.              |
+| ip_list     | `allowlist`, `blocklist`   | A type of the IP list.                        |

SECURITY.md

@@ -0,0 +1,24 @@
+# Security Policy
+
+## Supported Versions
+
+We support 2 tracks: 2.x and 1.x
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 2.x     | :white_check_mark: |
+| 1.x     | :interrobang:      |
+| < 1.0   | :x:                |
+
+1.x has adtag support. We do not plan any active development there but we guarantee:
+
+1. Regular dependency updates
+2. Updates for Golang versions
+3. Security vulnerability fixes
+4. Merging small PRs
+
+2.x is in active development and have a full support.
+
+## Reporting a Vulnerability
+
+If you have found a vulnerability, please report about it to nineseconds@yandex.ru, telegram @9seconds or here in issues

antireplay/init.go

@@ -0,0 +1,17 @@
+// Antireplay package has cache implementations that are effective against
+// replay attacks.
+//
+// To understand more about replay attacks, please read documentation for
+// [mtglib.AntiReplayCache] interface. This package has a list of some
+// implementations of this interface.
+package antireplay
+
+const (
+	// DefaultStableBloomFilterMaxSize is a recommended byte size for a stable
+	// bloom filter.
+	DefaultStableBloomFilterMaxSize = 1024 * 1024 // 1MiB
+
+	// DefaultStableBloomFilterErrorRate is a recommended default error rate for a
+	// stable bloom filter.
+	DefaultStableBloomFilterErrorRate = 0.001
+)

antireplay/noop.go

@@ -0,0 +1,13 @@
+package antireplay
+
+import "github.com/9seconds/mtg/v2/mtglib"
+
+type noop struct{}
+
+func (n noop) SeenBefore(_ []byte) bool { return false }
+
+// NewNoop returns an implementation that does nothing. A corresponding method
+// always returns false, so this cache accepts everything you pass to it.
+func NewNoop() mtglib.AntiReplayCache {
+	return noop{}
+}

antireplay/noop_test.go

@@ -0,0 +1,26 @@
+package antireplay_test
+
+import (
+	"testing"
+
+	"github.com/9seconds/mtg/v2/antireplay"
+	"github.com/stretchr/testify/suite"
+)
+
+type NoopTestSuite struct {
+	suite.Suite
+}
+
+func (suite *NoopTestSuite) TestOp() {
+	filter := antireplay.NewNoop()
+
+	suite.False(filter.SeenBefore([]byte{1, 2, 3}))
+	suite.False(filter.SeenBefore([]byte{4, 5, 6}))
+	suite.False(filter.SeenBefore([]byte{1, 2, 3}))
+	suite.False(filter.SeenBefore([]byte{4, 5, 6}))
+}
+
+func TestNoop(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &NoopTestSuite{})
+}

antireplay/stable_bloom_filter.go

@@ -0,0 +1,51 @@
+package antireplay
+
+import (
+	"sync"
+
+	"github.com/9seconds/mtg/v2/mtglib"
+	"github.com/OneOfOne/xxhash"
+	boom "github.com/tylertreat/BoomFilters"
+)
+
+type stableBloomFilter struct {
+	filter boom.StableBloomFilter
+	mutex  sync.Mutex
+}
+
+func (s *stableBloomFilter) SeenBefore(digest []byte) bool {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	return s.filter.TestAndAdd(digest)
+}
+
+// NewStableBloomFilter returns an implementation of AntiReplayCache based on
+// stable bloom filter.
+//
+// http://webdocs.cs.ualberta.ca/~drafiei/papers/DupDet06Sigmod.pdf
+//
+// The basic idea of a stable bloom filter is quite simple: each time when you
+// set a new element, you randomly reset P elements. There is a hardcore math
+// which proves that if you choose this P correctly, you can maintain the same
+// error rate for a stream of elements.
+//
+// byteSize is the number of bytes you want to give to a bloom filter.
+// errorRate is desired false-positive error rate. If you want to use default
+// values, please pass 0 for byteSize and <0 for errorRate.
+func NewStableBloomFilter(byteSize uint, errorRate float64) mtglib.AntiReplayCache {
+	if byteSize == 0 {
+		byteSize = DefaultStableBloomFilterMaxSize
+	}
+
+	if errorRate < 0 {
+		errorRate = DefaultStableBloomFilterErrorRate
+	}
+
+	sf := boom.NewDefaultStableBloomFilter(byteSize*8, errorRate)
+	sf.SetHash(xxhash.New64())
+
+	return &stableBloomFilter{
+		filter: *sf,
+	}
+}

antireplay/stable_bloom_filter_test.go

@@ -0,0 +1,26 @@
+package antireplay_test
+
+import (
+	"testing"
+
+	"github.com/9seconds/mtg/v2/antireplay"
+	"github.com/stretchr/testify/suite"
+)
+
+type StableBloomFilterTestSuite struct {
+	suite.Suite
+}
+
+func (suite *StableBloomFilterTestSuite) TestOp() {
+	filter := antireplay.NewStableBloomFilter(500, 0.001)
+
+	suite.False(filter.SeenBefore([]byte{1, 2, 3}))
+	suite.False(filter.SeenBefore([]byte{4, 5, 6}))
+	suite.True(filter.SeenBefore([]byte{1, 2, 3}))
+	suite.True(filter.SeenBefore([]byte{4, 5, 6}))
+}
+
+func TestStableBloomFilter(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &StableBloomFilterTestSuite{})
+}

buildinfo.go

@@ -0,0 +1,84 @@
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/binary"
+	"fmt"
+	"io"
+	"runtime/debug"
+	"sort"
+	"strconv"
+	"time"
+)
+
+var version = "dev" // has to be set by ldflags
+
+const (
+	buildInfoModuleStart byte = iota
+	buildInfoModuleFinish
+	buildInfoModuleDelimeter
+)
+
+func getVersion() string {
+	buildInfo, ok := debug.ReadBuildInfo()
+	if !ok {
+		return version
+	}
+
+	date := time.Now()
+	commit := ""
+	goVersion := buildInfo.GoVersion
+	dirtySuffix := ""
+
+	for _, setting := range buildInfo.Settings {
+		switch setting.Key {
+		case "vcs.time":
+			date, _ = time.Parse(time.RFC3339, setting.Value)
+		case "vcs.revision":
+			commit = setting.Value
+		case "vcs.modified":
+			if dirty, _ := strconv.ParseBool(setting.Value); dirty {
+				dirtySuffix = " [dirty]"
+			}
+		}
+	}
+
+	hasher := sha256.New()
+
+	checksumModule := func(mod *debug.Module) {
+		hasher.Write([]byte{buildInfoModuleStart})
+
+		io.WriteString(hasher, mod.Path) //nolint: errcheck
+		hasher.Write([]byte{buildInfoModuleDelimeter})
+
+		io.WriteString(hasher, mod.Version) //nolint: errcheck
+		hasher.Write([]byte{buildInfoModuleDelimeter})
+
+		io.WriteString(hasher, mod.Sum) //nolint: errcheck
+
+		hasher.Write([]byte{buildInfoModuleFinish})
+	}
+
+	io.WriteString(hasher, buildInfo.Path) //nolint: errcheck
+
+	binary.Write(hasher, binary.LittleEndian, uint64(1+len(buildInfo.Deps))) //nolint: errcheck
+
+	sort.Slice(buildInfo.Deps, func(i, j int) bool {
+		return buildInfo.Deps[i].Path > buildInfo.Deps[j].Path
+	})
+
+	checksumModule(&buildInfo.Main)
+
+	for _, module := range buildInfo.Deps {
+		checksumModule(module)
+	}
+
+	return fmt.Sprintf("%s (%s: %s on %s%s, modules checksum %s)",
+		version,
+		goVersion,
+		date.Format(time.RFC3339),
+		commit,
+		dirtySuffix,
+		base64.StdEncoding.EncodeToString(hasher.Sum(nil)))
+}

client/client.go

@@ -1,12 +0,0 @@
-package client
-
-import (
-	"net"
-
-	"github.com/9seconds/mtg/config"
-	"github.com/9seconds/mtg/mtproto"
-	"github.com/9seconds/mtg/wrappers"
-)
-
-// Init defines common method for initializing client connections.
-type Init func(net.Conn, string, *config.Config) (wrappers.Wrap, *mtproto.ConnectionOpts, error)

client/direct.go

@@ -1,55 +0,0 @@
-package client
-
-import (
-	"net"
-	"time"
-
-	"github.com/juju/errors"
-
-	"github.com/9seconds/mtg/config"
-	"github.com/9seconds/mtg/mtproto"
-	"github.com/9seconds/mtg/obfuscated2"
-	"github.com/9seconds/mtg/wrappers"
-)
-
-const (
-	handshakeTimeout = 10 * time.Second
-	readBufferSize   = 64 * 1024
-	writeBufferSize  = 64 * 1024
-)
-
-// DirectInit initializes client connection for proxy which connects to
-// Telegram directly.
-func DirectInit(socket net.Conn, connID string, conf *config.Config) (wrappers.Wrap, *mtproto.ConnectionOpts, error) {
-	tcpSocket := socket.(*net.TCPConn)
-	if err := tcpSocket.SetNoDelay(false); err != nil {
-		return nil, nil, errors.Annotate(err, "Cannot disable NO_DELAY to client socket")
-	}
-	if err := tcpSocket.SetReadBuffer(readBufferSize); err != nil {
-		return nil, nil, errors.Annotate(err, "Cannot set read buffer size of client socket")
-	}
-	if err := tcpSocket.SetWriteBuffer(writeBufferSize); err != nil {
-		return nil, nil, errors.Annotate(err, "Cannot set write buffer size of client socket")
-	}
-
-	socket.SetReadDeadline(time.Now().Add(handshakeTimeout)) // nolint: errcheck
-	frame, err := obfuscated2.ExtractFrame(socket)
-	if err != nil {
-		return nil, nil, errors.Annotate(err, "Cannot extract frame")
-	}
-	socket.SetReadDeadline(time.Time{}) // nolint: errcheck
-
-	conn := wrappers.NewConn(socket, connID, wrappers.ConnPurposeClient, conf.PublicIPv4, conf.PublicIPv6)
-	obfs2, connOpts, err := obfuscated2.ParseObfuscated2ClientFrame(conf.Secret, frame)
-	if err != nil {
-		return nil, nil, errors.Annotate(err, "Cannot parse obfuscated frame")
-	}
-	connOpts.ConnectionProto = mtproto.ConnectionProtocolAny
-	connOpts.ClientAddr = conn.RemoteAddr()
-
-	conn = wrappers.NewStreamCipher(conn, obfs2.Encryptor, obfs2.Decryptor)
-
-	conn.Logger().Infow("Client connection initialized")
-
-	return conn, connOpts, nil
-}

client/middle.go

@@ -1,31 +0,0 @@
-package client
-
-import (
-	"net"
-
-	"github.com/9seconds/mtg/config"
-	"github.com/9seconds/mtg/mtproto"
-	"github.com/9seconds/mtg/wrappers"
-)
-
-// MiddleInit initializes client connection for proxy which has to
-// support promoted channels, connect to Telegram middle proxies etc.
-func MiddleInit(socket net.Conn, connID string, conf *config.Config) (wrappers.Wrap, *mtproto.ConnectionOpts, error) {
-	conn, opts, err := DirectInit(socket, connID, conf)
-	if err != nil {
-		return nil, nil, err
-	}
-	connStream := conn.(wrappers.StreamReadWriteCloser)
-
-	newConn := wrappers.NewMTProtoAbridged(connStream, opts)
-	if opts.ConnectionType != mtproto.ConnectionTypeAbridged {
-		newConn = wrappers.NewMTProtoIntermediate(connStream, opts)
-	}
-
-	opts.ConnectionProto = mtproto.ConnectionProtocolIPv4
-	if socket.LocalAddr().(*net.TCPAddr).IP.To4() == nil {
-		opts.ConnectionProto = mtproto.ConnectionProtocolIPv6
-	}
-
-	return newConn, opts, err
-}

config/config.go

@@ -1,153 +0,0 @@
-package config
-
-import (
-	"encoding/hex"
-	"fmt"
-	"net"
-	"strconv"
-
-	"github.com/juju/errors"
-)
-
-// Buffer sizes define internal socket buffer sizes.
-const (
-	BufferWriteSize = 32 * 1024
-	BufferReadSize  = 32 * 1024
-)
-
-// Config represents common configuration of mtg.
-type Config struct {
-	Debug   bool
-	Verbose bool
-
-	BindPort       uint16
-	PublicIPv4Port uint16
-	PublicIPv6Port uint16
-	StatsPort      uint16
-
-	BindIP     net.IP
-	PublicIPv4 net.IP
-	PublicIPv6 net.IP
-	StatsIP    net.IP
-
-	Secret []byte
-	AdTag  []byte
-}
-
-// URLs contains links to the proxy (tg://, t.me) and their QR codes.
-type URLs struct {
-	TG        string `json:"tg_url"`
-	TMe       string `json:"tme_url"`
-	TGQRCode  string `json:"tg_qrcode"`
-	TMeQRCode string `json:"tme_qrcode"`
-}
-
-// IPURLs contains links to both ipv4 and ipv6 of the proxy.
-type IPURLs struct {
-	IPv4 URLs `json:"ipv4"`
-	IPv6 URLs `json:"ipv6"`
-}
-
-// BindAddr returns connection for this server to bind to.
-func (c *Config) BindAddr() string {
-	return getAddr(c.BindIP, c.BindPort)
-}
-
-// StatAddr returns connection string to the stats API.
-func (c *Config) StatAddr() string {
-	return getAddr(c.StatsIP, c.StatsPort)
-}
-
-// UseMiddleProxy defines if this proxy has to connect middle proxies
-// which supports promoted channels or directly access Telegram.
-func (c *Config) UseMiddleProxy() bool {
-	return len(c.AdTag) > 0
-}
-
-// GetURLs returns configured IPURLs instance with links to this server.
-func (c *Config) GetURLs() IPURLs {
-	urls := IPURLs{}
-	if c.PublicIPv4 != nil {
-		urls.IPv4 = getURLs(c.PublicIPv4, c.PublicIPv4Port, c.Secret)
-	}
-	if c.PublicIPv6 != nil {
-		urls.IPv6 = getURLs(c.PublicIPv6, c.PublicIPv6Port, c.Secret)
-	}
-
-	return urls
-}
-
-func getAddr(host fmt.Stringer, port uint16) string {
-	return net.JoinHostPort(host.String(), strconv.Itoa(int(port)))
-}
-
-// NewConfig returns new configuration. If required, it manages and
-// fetches data from external sources. Parameters passed to this
-// function, should come from command line arguments.
-func NewConfig(debug, verbose bool, // nolint: gocyclo
-	bindIP net.IP, bindPort uint16,
-	publicIPv4 net.IP, PublicIPv4Port uint16,
-	publicIPv6 net.IP, publicIPv6Port uint16,
-	statsIP net.IP, statsPort uint16,
-	secret, adtag string) (*Config, error) {
-	if len(secret) != 32 {
-		return nil, errors.New("Telegram demands secret of length 32")
-	}
-	secretBytes, err := hex.DecodeString(secret)
-	if err != nil {
-		return nil, errors.Annotate(err, "Cannot create config")
-	}
-
-	var adTagBytes []byte
-	if len(adtag) != 0 {
-		adTagBytes, err = hex.DecodeString(adtag)
-		if err != nil {
-			return nil, errors.Annotate(err, "Cannot create config")
-		}
-	}
-
-	if publicIPv4 == nil {
-		publicIPv4, err = getGlobalIPv4()
-		if err != nil {
-			publicIPv4 = nil
-		} else if publicIPv4.To4() == nil {
-			return nil, errors.Errorf("IP %s is not IPv4", publicIPv4.String())
-		}
-	}
-	if PublicIPv4Port == 0 {
-		PublicIPv4Port = bindPort
-	}
-
-	if publicIPv6 == nil {
-		publicIPv6, err = getGlobalIPv6()
-		if err != nil {
-			publicIPv6 = nil
-		} else if publicIPv6.To4() != nil {
-			return nil, errors.Errorf("IP %s is not IPv6", publicIPv6.String())
-		}
-	}
-	if publicIPv6Port == 0 {
-		publicIPv6Port = bindPort
-	}
-
-	if statsIP == nil {
-		statsIP = publicIPv4
-	}
-
-	conf := &Config{
-		Debug:          debug,
-		Verbose:        verbose,
-		BindIP:         bindIP,
-		BindPort:       bindPort,
-		PublicIPv4:     publicIPv4,
-		PublicIPv4Port: PublicIPv4Port,
-		PublicIPv6:     publicIPv6,
-		PublicIPv6Port: publicIPv6Port,
-		StatsIP:        statsIP,
-		StatsPort:      statsPort,
-		Secret:         secretBytes,
-		AdTag:          adTagBytes,
-	}
-
-	return conf, nil
-}

config/global_ips.go

@@ -1,39 +0,0 @@
-package config
-
-import (
-	"io/ioutil"
-	"net"
-	"net/http"
-	"strings"
-
-	"github.com/juju/errors"
-)
-
-func getGlobalIPv4() (net.IP, error) {
-	return fetchIP("https://v4.ifconfig.co/ip")
-}
-
-func getGlobalIPv6() (net.IP, error) {
-	return fetchIP("https://v6.ifconfig.co/ip")
-}
-
-func fetchIP(url string) (net.IP, error) {
-	resp, err := http.Get(url)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close() // nolint: errcheck
-
-	respDataBytes, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		return nil, err
-	}
-	respData := strings.TrimSpace(string(respDataBytes))
-
-	ip := net.ParseIP(respData)
-	if ip == nil {
-		return nil, errors.Errorf("ifconfig.co returns incorrect IP %s", respData)
-	}
-
-	return ip, nil
-}

config/urls.go

@@ -1,59 +0,0 @@
-package config
-
-import (
-	"encoding/hex"
-	"net"
-	"net/url"
-	"strconv"
-)
-
-func getURLs(addr net.IP, port uint16, secret []byte) (urls URLs) {
-	values := url.Values{}
-	values.Set("server", addr.String())
-	values.Set("port", strconv.Itoa(int(port)))
-	values.Set("secret", hex.EncodeToString(secret))
-
-	urls.TG = makeTGURL(values)
-	urls.TMe = makeTMeURL(values)
-	urls.TGQRCode = makeQRCodeURL(urls.TG)
-	urls.TMeQRCode = makeQRCodeURL(urls.TG)
-
-	return
-}
-
-func makeTGURL(values url.Values) string {
-	tgURL := url.URL{
-		Scheme:   "tg",
-		Host:     "proxy",
-		RawQuery: values.Encode(),
-	}
-
-	return tgURL.String()
-}
-
-func makeTMeURL(values url.Values) string {
-	tMeURL := url.URL{
-		Scheme:   "https",
-		Host:     "t.me",
-		Path:     "proxy",
-		RawQuery: values.Encode(),
-	}
-
-	return tMeURL.String()
-}
-
-func makeQRCodeURL(data string) string {
-	QRURL := url.URL{
-		Scheme: "https",
-		Host:   "api.qrserver.com",
-		Path:   "v1/create-qr-code",
-	}
-
-	values := url.Values{}
-	values.Set("qzone", "4")
-	values.Set("format", "svg")
-	values.Set("data", data)
-	QRURL.RawQuery = values.Encode()
-
-	return QRURL.String()
-}

essentials/addresses.go

@@ -0,0 +1,30 @@
+package essentials
+
+// TelegramCoreAddresses are publicly known addresses of Telegram core network.
+var TelegramCoreAddresses = map[int][]string{
+	1: {
+		"149.154.175.50:443",
+		"[2001:b28:f23d:f001::a]:443",
+	},
+	2: {
+		"149.154.167.51:443",
+		"95.161.76.100:443",
+		"[2001:67c:04e8:f002::a]:443",
+	},
+	3: {
+		"149.154.175.100:443",
+		"[2001:b28:f23d:f003::a]:443",
+	},
+	4: {
+		"149.154.167.91:443",
+		"[2001:67c:04e8:f004::a]:443",
+	},
+	5: {
+		"149.154.171.5:443",
+		"[2001:b28:f23f:f005::a]:443",
+	},
+	203: {
+		"91.105.192.100:443",
+		"[2a0a:f280:0203:000a:5000:0000:0000:0100]:443",
+	},
+}

essentials/conns.go

@@ -0,0 +1,51 @@
+package essentials
+
+import (
+	"io"
+	"net"
+)
+
+// CloseableReader is an [io.Reader] interface that can close its reading end.
+type CloseableReader interface {
+	io.Reader
+	CloseRead() error
+}
+
+// CloseableWriter is an [io.Writer] that can close its writing end.
+type CloseableWriter interface {
+	io.Writer
+	CloseWrite() error
+}
+
+// Conn is an extension of [net.Conn] that can close its ends. This mostly
+// implies TCP connections.
+type Conn interface {
+	net.Conn
+	CloseableReader
+	CloseableWriter
+}
+
+type netConnWrapper struct {
+	net.Conn
+}
+
+func (n netConnWrapper) CloseRead() error {
+	if conn, ok := n.Conn.(CloseableReader); ok {
+		return conn.CloseRead()
+	}
+
+	return n.Close()
+}
+
+func (n netConnWrapper) CloseWrite() error {
+	if conn, ok := n.Conn.(CloseableWriter); ok {
+		return conn.CloseWrite()
+	}
+
+	return n.Close()
+}
+
+// WrapConn wraps a generic [net.Conn] into Conn.
+func WrapNetConn(conn net.Conn) Conn {
+	return netConnWrapper{conn}
+}

essentials/doc.go

@@ -0,0 +1,6 @@
+// This is a minimal package that contains _essentials_ of mtglib and its
+// complimentary packages. This is mostly required to comply some interfaces
+// between mtglib and its internals to avoid circular dependencies.
+//
+// This package should contain only bare minimum and mostly technical.
+package essentials

events/event_stream.go

@@ -0,0 +1,110 @@
+package events
+
+import (
+	"context"
+	"math/rand/v2"
+	"runtime"
+
+	"github.com/9seconds/mtg/v2/mtglib"
+	"github.com/OneOfOne/xxhash"
+)
+
+// EventStream is a default implementation of the [mtglib.EventStream]
+// interface.
+//
+// EventStream manages a set of goroutines, observers. Main
+// responsibility of the event stream is to route an event to relevant
+// observer based on some hash so each observer will have all events
+// which belong to some stream id.
+//
+// Thus, EventStream can spawn many observers.
+type EventStream struct {
+	ctx       context.Context
+	ctxCancel context.CancelFunc
+	chans     []chan mtglib.Event
+}
+
+// Send starts delivering of the message to observer with respect to a
+// given context If context is closed, message could be not delivered.
+func (e EventStream) Send(ctx context.Context, evt mtglib.Event) {
+	var chanNo uint32
+
+	if streamID := evt.StreamID(); streamID != "" {
+		chanNo = xxhash.ChecksumString32(streamID)
+	} else {
+		chanNo = rand.Uint32()
+	}
+
+	select {
+	case <-ctx.Done():
+	case <-e.ctx.Done():
+	case e.chans[chanNo%uint32(len(e.chans))] <- evt:
+	}
+}
+
+// Shutdown stops an event stream pipeline.
+func (e EventStream) Shutdown() {
+	e.ctxCancel()
+}
+
+// NewEventStream builds a new default event stream.
+//
+// If you give an empty array of observers, then NoopObserver is going
+// to be used. If you give many observers, then they will process a
+// message concurrently.
+func NewEventStream(observerFactories []ObserverFactory) EventStream {
+	if len(observerFactories) == 0 {
+		observerFactories = append(observerFactories, NewNoopObserver)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	rv := EventStream{
+		ctx:       ctx,
+		ctxCancel: cancel,
+		chans:     make([]chan mtglib.Event, runtime.NumCPU()),
+	}
+
+	for i := range runtime.NumCPU() {
+		rv.chans[i] = make(chan mtglib.Event, 1)
+
+		if len(observerFactories) == 1 {
+			go eventStreamProcessor(ctx, rv.chans[i], observerFactories[0]())
+		} else {
+			go eventStreamProcessor(ctx, rv.chans[i], newMultiObserver(observerFactories))
+		}
+	}
+
+	return rv
+}
+
+func eventStreamProcessor(ctx context.Context, eventChan <-chan mtglib.Event, observer Observer) { //nolint: cyclop
+	defer observer.Shutdown()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case evt := <-eventChan:
+			switch typedEvt := evt.(type) {
+			case mtglib.EventTraffic:
+				observer.EventTraffic(typedEvt)
+			case mtglib.EventStart:
+				observer.EventStart(typedEvt)
+			case mtglib.EventFinish:
+				observer.EventFinish(typedEvt)
+			case mtglib.EventConnectedToDC:
+				observer.EventConnectedToDC(typedEvt)
+			case mtglib.EventDomainFronting:
+				observer.EventDomainFronting(typedEvt)
+			case mtglib.EventIPBlocklisted:
+				observer.EventIPBlocklisted(typedEvt)
+			case mtglib.EventConcurrencyLimited:
+				observer.EventConcurrencyLimited(typedEvt)
+			case mtglib.EventReplayAttack:
+				observer.EventReplayAttack(typedEvt)
+			case mtglib.EventIPListSize:
+				observer.EventIPListSize(typedEvt)
+			}
+		}
+	}
+}

events/event_stream_test.go

@@ -0,0 +1,241 @@
+package events_test
+
+import (
+	"context"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/9seconds/mtg/v2/events"
+	"github.com/9seconds/mtg/v2/mtglib"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/suite"
+)
+
+type EventStreamTestSuite struct {
+	suite.Suite
+
+	ctx           context.Context
+	ctxCancel     context.CancelFunc
+	observerMock1 *ObserverMock
+	observerMock2 *ObserverMock
+	stream        events.EventStream
+}
+
+func (suite *EventStreamTestSuite) SetupTest() {
+	suite.ctx, suite.ctxCancel = context.WithCancel(context.Background())
+
+	suite.observerMock1 = &ObserverMock{}
+	suite.observerMock2 = &ObserverMock{}
+
+	suite.observerMock1.On("Shutdown")
+	suite.observerMock2.On("Shutdown")
+
+	factories := make([]events.ObserverFactory, 2)
+	factories[0] = func() events.Observer { return suite.observerMock1 }
+	factories[1] = func() events.Observer { return suite.observerMock2 }
+
+	suite.stream = events.NewEventStream(factories)
+}
+
+func (suite *EventStreamTestSuite) TestEventStart() {
+	evt := mtglib.NewEventStart("connID", net.ParseIP("10.0.0.1"))
+
+	for _, v := range []*ObserverMock{suite.observerMock1, suite.observerMock2} {
+		v.
+			On("EventStart", mock.Anything).
+			Once().
+			Run(func(args mock.Arguments) {
+				caught, ok := args.Get(0).(mtglib.EventStart)
+
+				suite.True(ok)
+				suite.Equal(evt.RemoteIP.String(), caught.RemoteIP.String())
+				suite.Equal(evt.StreamID(), caught.StreamID())
+				suite.Equal(evt.Timestamp(), caught.Timestamp())
+			})
+	}
+
+	suite.stream.Send(suite.ctx, evt)
+	time.Sleep(100 * time.Millisecond)
+}
+
+func (suite *EventStreamTestSuite) TestEventConnectedToDC() {
+	evt := mtglib.NewEventConnectedToDC("connID", net.ParseIP("10.0.0.1"), 3)
+
+	for _, v := range []*ObserverMock{suite.observerMock1, suite.observerMock2} {
+		v.
+			On("EventConnectedToDC", mock.Anything).
+			Once().
+			Run(func(args mock.Arguments) {
+				caught, ok := args.Get(0).(mtglib.EventConnectedToDC)
+
+				suite.True(ok)
+				suite.Equal(evt.RemoteIP.String(), caught.RemoteIP.String())
+				suite.Equal(evt.StreamID(), caught.StreamID())
+				suite.Equal(evt.DC, caught.DC)
+				suite.Equal(evt.Timestamp(), caught.Timestamp())
+			})
+	}
+
+	suite.stream.Send(suite.ctx, evt)
+	time.Sleep(100 * time.Millisecond)
+}
+
+func (suite *EventStreamTestSuite) TestEventDomainFronting() {
+	evt := mtglib.NewEventDomainFronting("connID")
+
+	for _, v := range []*ObserverMock{suite.observerMock1, suite.observerMock2} {
+		v.
+			On("EventDomainFronting", mock.Anything).
+			Once().
+			Run(func(args mock.Arguments) {
+				caught, ok := args.Get(0).(mtglib.EventDomainFronting)
+
+				suite.True(ok)
+				suite.Equal(evt.StreamID(), caught.StreamID())
+				suite.Equal(evt.Timestamp(), caught.Timestamp())
+			})
+	}
+
+	suite.stream.Send(suite.ctx, evt)
+	time.Sleep(100 * time.Millisecond)
+}
+
+func (suite *EventStreamTestSuite) TestEventTraffic() {
+	evt := mtglib.NewEventTraffic("connID", 1024, true)
+
+	for _, v := range []*ObserverMock{suite.observerMock1, suite.observerMock2} {
+		v.
+			On("EventTraffic", mock.Anything).
+			Once().
+			Run(func(args mock.Arguments) {
+				caught, ok := args.Get(0).(mtglib.EventTraffic)
+
+				suite.True(ok)
+				suite.Equal(evt.StreamID(), caught.StreamID())
+				suite.Equal(evt.Timestamp(), caught.Timestamp())
+				suite.Equal(evt.Traffic, caught.Traffic)
+				suite.Equal(evt.IsRead, caught.IsRead)
+			})
+	}
+
+	suite.stream.Send(suite.ctx, evt)
+	time.Sleep(100 * time.Millisecond)
+}
+
+func (suite *EventStreamTestSuite) TestEventFinish() {
+	evt := mtglib.NewEventFinish("connID")
+
+	for _, v := range []*ObserverMock{suite.observerMock1, suite.observerMock2} {
+		v.
+			On("EventFinish", mock.Anything).
+			Once().
+			Run(func(args mock.Arguments) {
+				caught, ok := args.Get(0).(mtglib.EventFinish)
+
+				suite.True(ok)
+				suite.Equal(evt.StreamID(), caught.StreamID())
+				suite.Equal(evt.Timestamp(), caught.Timestamp())
+			})
+	}
+
+	suite.stream.Send(suite.ctx, evt)
+	time.Sleep(100 * time.Millisecond)
+}
+
+func (suite *EventStreamTestSuite) TestEventConcurrencyLimited() {
+	evt := mtglib.NewEventConcurrencyLimited()
+
+	for _, v := range []*ObserverMock{suite.observerMock1, suite.observerMock2} {
+		v.
+			On("EventConcurrencyLimited", mock.Anything).
+			Once().
+			Run(func(args mock.Arguments) {
+				caught, ok := args.Get(0).(mtglib.EventConcurrencyLimited)
+
+				suite.True(ok)
+				suite.Equal(evt.Timestamp(), caught.Timestamp())
+				suite.Empty(evt.StreamID())
+			})
+	}
+
+	suite.stream.Send(suite.ctx, evt)
+	time.Sleep(100 * time.Millisecond)
+}
+
+func (suite *EventStreamTestSuite) TestEventIPBlocklisted() {
+	evt := mtglib.NewEventIPBlocklisted(net.ParseIP("10.0.0.10"))
+
+	for _, v := range []*ObserverMock{suite.observerMock1, suite.observerMock2} {
+		v.
+			On("EventIPBlocklisted", mock.Anything).
+			Once().
+			Run(func(args mock.Arguments) {
+				caught, ok := args.Get(0).(mtglib.EventIPBlocklisted)
+
+				suite.True(ok)
+				suite.Equal(evt.StreamID(), caught.StreamID())
+				suite.Equal(evt.Timestamp(), caught.Timestamp())
+				suite.Equal(evt.RemoteIP.String(), caught.RemoteIP.String())
+			})
+	}
+
+	suite.stream.Send(suite.ctx, evt)
+	time.Sleep(100 * time.Millisecond)
+}
+
+func (suite *EventStreamTestSuite) TestEventReplayAttack() {
+	evt := mtglib.NewEventReplayAttack("CONNID")
+
+	for _, v := range []*ObserverMock{suite.observerMock1, suite.observerMock2} {
+		v.
+			On("EventReplayAttack", mock.Anything).
+			Once().
+			Run(func(args mock.Arguments) {
+				caught, ok := args.Get(0).(mtglib.EventReplayAttack)
+
+				suite.True(ok)
+				suite.Equal(evt.StreamID(), caught.StreamID())
+				suite.Equal(evt.Timestamp(), caught.Timestamp())
+			})
+	}
+
+	suite.stream.Send(suite.ctx, evt)
+	time.Sleep(100 * time.Millisecond)
+}
+
+func (suite *EventStreamTestSuite) TestEventIPListSize() {
+	evt := mtglib.NewEventIPListSize(10, true)
+
+	for _, v := range []*ObserverMock{suite.observerMock1, suite.observerMock2} {
+		v.
+			On("EventIPListSize", mock.Anything).
+			Once().
+			Run(func(args mock.Arguments) {
+				caught, ok := args.Get(0).(mtglib.EventIPListSize)
+
+				suite.True(ok)
+				suite.Equal(evt.Timestamp(), caught.Timestamp())
+				suite.Equal(evt.Size, caught.Size)
+				suite.Equal(evt.IsBlockList, caught.IsBlockList)
+			})
+	}
+
+	suite.stream.Send(suite.ctx, evt)
+	time.Sleep(100 * time.Millisecond)
+}
+
+func (suite *EventStreamTestSuite) TearDownTest() {
+	suite.stream.Shutdown()
+	suite.ctxCancel()
+
+	time.Sleep(100 * time.Millisecond)
+
+	suite.observerMock1.AssertExpectations(suite.T())
+	suite.observerMock2.AssertExpectations(suite.T())
+}
+
+func TestEventStream(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &EventStreamTestSuite{})
+}

events/init.go

@@ -0,0 +1,72 @@
+// Events has a default implementations of EventStream for mtglib.
+//
+// Please see documentation for [mtglib.EventStream] interface to get an idea
+// of such an abstraction. This package has implementations for the default
+// event stream.
+//
+// Default event stream has a list of its own concepts. First, all it does is a
+// routing of messages to known observers. It takes an event, defines its type
+// and pass this message to a method of the observer.
+//
+// There might be many observers, but default event stream has a guarantee
+// though. It uses StreamID as a sharding key and guarantees that a message
+// with the same StreamID will be devlivered to the same observer instance. So,
+// each producer is guarateed to get all relevant messages related to the same
+// session. It is not possible that it will get EventFinish if it has not seen
+// EventStart for that session yet.
+package events
+
+import "github.com/9seconds/mtg/v2/mtglib"
+
+// Observer is an instance that listens for the incoming events.
+//
+// As it is said in the package description, the default event stream
+// guarantees that all events with the same StreamID are going to be routed to
+// the same instance of the observer. So, there is no need to synchronize
+// information about streams between many observers instances, they can have
+// their local storage.
+type Observer interface {
+	// EventStart reacts on incoming mtglib.EventStart event.
+	EventStart(mtglib.EventStart)
+
+	// EventFinish reacts on incoming mtglib.EventFinish event.
+	EventFinish(mtglib.EventFinish)
+
+	// EventConnectedToDC reacts on incoming mtglib.EventConnectedToDC
+	// event.
+	EventConnectedToDC(mtglib.EventConnectedToDC)
+
+	// EventDomainFronting reacts on incoming mtglib.EventDomainFronting
+	// event.
+	EventDomainFronting(mtglib.EventDomainFronting)
+
+	// EventTraffic reacts on incoming mtglib.EventTraffic event.
+	EventTraffic(mtglib.EventTraffic)
+
+	// EventConcurrencyLimited reacts on incoming
+	// mtglib.EventConcurrencyLimited event.
+	EventConcurrencyLimited(mtglib.EventConcurrencyLimited)
+
+	// EventIPBlocklisted reacts on incoming mtglib.EventIPBlocklisted event.
+	EventIPBlocklisted(mtglib.EventIPBlocklisted)
+
+	// EventReplayAttack reacts on incoming mtglib.EventReplayAttack event.
+	EventReplayAttack(mtglib.EventReplayAttack)
+
+	// EventIPListSize reacts on incoming mtglib.EventIPListSize
+	EventIPListSize(mtglib.EventIPListSize)
+
+	// Shutdown stop observer. Default event stream guarantees:
+	//   1. If shutdown is executed, it is executed only once
+	//   2. Observer won't receieve any new message after this
+	//      function call.
+	Shutdown()
+}
+
+// ObserverFactory creates a new instance of the observer.
+//
+// Default event stream creates a small set of goroutines to manage incoming
+// messages. Each message is routed to an appropriate observer based on a
+// sharding key, stream id. So, it is possible that an instance of mtg will
+// have many observer instances, not a single one.
+type ObserverFactory func() Observer

events/init_test.go

@@ -0,0 +1,50 @@
+package events_test
+
+import (
+	"github.com/9seconds/mtg/v2/mtglib"
+	"github.com/stretchr/testify/mock"
+)
+
+type ObserverMock struct {
+	mock.Mock
+}
+
+func (o *ObserverMock) EventStart(evt mtglib.EventStart) {
+	o.Called(evt)
+}
+
+func (o *ObserverMock) EventConnectedToDC(evt mtglib.EventConnectedToDC) {
+	o.Called(evt)
+}
+
+func (o *ObserverMock) EventDomainFronting(evt mtglib.EventDomainFronting) {
+	o.Called(evt)
+}
+
+func (o *ObserverMock) EventTraffic(evt mtglib.EventTraffic) {
+	o.Called(evt)
+}
+
+func (o *ObserverMock) EventFinish(evt mtglib.EventFinish) {
+	o.Called(evt)
+}
+
+func (o *ObserverMock) EventConcurrencyLimited(evt mtglib.EventConcurrencyLimited) {
+	o.Called(evt)
+}
+
+func (o *ObserverMock) EventIPBlocklisted(evt mtglib.EventIPBlocklisted) {
+	o.Called(evt)
+}
+
+func (o *ObserverMock) EventReplayAttack(evt mtglib.EventReplayAttack) {
+	o.Called(evt)
+}
+
+func (o *ObserverMock) EventIPListSize(evt mtglib.EventIPListSize) {
+	o.Called(evt)
+}
+
+func (o *ObserverMock) Shutdown() {
+	o.Called()
+}

events/multi_observer.go

@@ -0,0 +1,137 @@
+package events
+
+import (
+	"sync"
+
+	"github.com/9seconds/mtg/v2/mtglib"
+)
+
+type multiObserver struct {
+	observers []Observer
+}
+
+func (m multiObserver) EventStart(evt mtglib.EventStart) {
+	wg := &sync.WaitGroup{}
+
+	for _, v := range m.observers {
+		wg.Go(func() {
+			v.EventStart(evt)
+		})
+	}
+
+	wg.Wait()
+}
+
+func (m multiObserver) EventConnectedToDC(evt mtglib.EventConnectedToDC) {
+	wg := &sync.WaitGroup{}
+
+	for _, v := range m.observers {
+		wg.Go(func() {
+			v.EventConnectedToDC(evt)
+		})
+	}
+
+	wg.Wait()
+}
+
+func (m multiObserver) EventDomainFronting(evt mtglib.EventDomainFronting) {
+	wg := &sync.WaitGroup{}
+
+	for _, v := range m.observers {
+		wg.Go(func() {
+			v.EventDomainFronting(evt)
+		})
+	}
+
+	wg.Wait()
+}
+
+func (m multiObserver) EventTraffic(evt mtglib.EventTraffic) {
+	wg := &sync.WaitGroup{}
+
+	for _, v := range m.observers {
+		wg.Go(func() {
+			v.EventTraffic(evt)
+		})
+	}
+
+	wg.Wait()
+}
+
+func (m multiObserver) EventFinish(evt mtglib.EventFinish) {
+	wg := &sync.WaitGroup{}
+
+	for _, v := range m.observers {
+		wg.Go(func() {
+			v.EventFinish(evt)
+		})
+	}
+
+	wg.Wait()
+}
+
+func (m multiObserver) EventConcurrencyLimited(evt mtglib.EventConcurrencyLimited) {
+	wg := &sync.WaitGroup{}
+
+	for _, v := range m.observers {
+		wg.Go(func() {
+			v.EventConcurrencyLimited(evt)
+		})
+	}
+
+	wg.Wait()
+}
+
+func (m multiObserver) EventIPBlocklisted(evt mtglib.EventIPBlocklisted) {
+	wg := &sync.WaitGroup{}
+
+	for _, v := range m.observers {
+		wg.Go(func() {
+			v.EventIPBlocklisted(evt)
+		})
+	}
+
+	wg.Wait()
+}
+
+func (m multiObserver) EventReplayAttack(evt mtglib.EventReplayAttack) {
+	wg := &sync.WaitGroup{}
+
+	for _, v := range m.observers {
+		wg.Go(func() {
+			v.EventReplayAttack(evt)
+		})
+	}
+
+	wg.Wait()
+}
+
+func (m multiObserver) EventIPListSize(evt mtglib.EventIPListSize) {
+	wg := &sync.WaitGroup{}
+
+	for _, v := range m.observers {
+		wg.Go(func() {
+			v.EventIPListSize(evt)
+		})
+	}
+
+	wg.Wait()
+}
+
+func (m multiObserver) Shutdown() {
+	for _, v := range m.observers {
+		v.Shutdown()
+	}
+}
+
+func newMultiObserver(factories []ObserverFactory) Observer {
+	observers := make([]Observer, len(factories))
+
+	for i, v := range factories {
+		observers[i] = v()
+	}
+
+	return multiObserver{
+		observers: observers,
+	}
+}

events/noop.go

@@ -0,0 +1,34 @@
+package events
+
+import (
+	"context"
+
+	"github.com/9seconds/mtg/v2/mtglib"
+)
+
+type noop struct{}
+
+func (n noop) Send(ctx context.Context, evt mtglib.Event) {}
+
+// NewNoopStream creates a stream which discards each message.
+func NewNoopStream() mtglib.EventStream {
+	return noop{}
+}
+
+type noopObserver struct{}
+
+func (n noopObserver) EventStart(_ mtglib.EventStart)                           {}
+func (n noopObserver) EventConnectedToDC(_ mtglib.EventConnectedToDC)           {}
+func (n noopObserver) EventDomainFronting(_ mtglib.EventDomainFronting)         {}
+func (n noopObserver) EventTraffic(_ mtglib.EventTraffic)                       {}
+func (n noopObserver) EventFinish(_ mtglib.EventFinish)                         {}
+func (n noopObserver) EventConcurrencyLimited(_ mtglib.EventConcurrencyLimited) {}
+func (n noopObserver) EventIPBlocklisted(_ mtglib.EventIPBlocklisted)           {}
+func (n noopObserver) EventReplayAttack(_ mtglib.EventReplayAttack)             {}
+func (n noopObserver) EventIPListSize(_ mtglib.EventIPListSize)                 {}
+func (n noopObserver) Shutdown()                                                {}
+
+// NewNoopObserver creates an observer which discards each message.
+func NewNoopObserver() Observer {
+	return noopObserver{}
+}

events/noop_test.go

@@ -0,0 +1,81 @@
+package events_test
+
+import (
+	"context"
+	"net"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/events"
+	"github.com/9seconds/mtg/v2/mtglib"
+	"github.com/stretchr/testify/suite"
+)
+
+type NoopTestSuite struct {
+	suite.Suite
+
+	testData map[string]mtglib.Event
+	ctx      context.Context
+}
+
+func (suite *NoopTestSuite) SetupSuite() {
+	suite.testData = map[string]mtglib.Event{
+		"start":               mtglib.NewEventStart("connID", net.ParseIP("127.0.0.1")),
+		"connected-to-dc":     mtglib.NewEventConnectedToDC("connID", net.ParseIP("127.1.0.1"), 2),
+		"domain-fronting":     mtglib.NewEventDomainFronting("connID"),
+		"traffic":             mtglib.NewEventTraffic("connID", 1000, true),
+		"finish":              mtglib.NewEventFinish("connID"),
+		"concurrency-limited": mtglib.NewEventConcurrencyLimited(),
+		"ip-blacklisted":      mtglib.NewEventIPBlocklisted(net.ParseIP("10.0.0.10")),
+		"replay-attack":       mtglib.NewEventReplayAttack("connID"),
+		"ip-list-size":        mtglib.NewEventIPListSize(10, true),
+	}
+	suite.ctx = context.Background()
+}
+
+func (suite *NoopTestSuite) TestStream() {
+	stream := events.NewNoopStream()
+
+	for name, v := range suite.testData {
+		value := v
+
+		suite.T().Run(name, func(t *testing.T) {
+			stream.Send(suite.ctx, value)
+		})
+	}
+}
+
+func (suite *NoopTestSuite) TestObserver() {
+	observer := events.NewNoopObserver()
+
+	for name, v := range suite.testData {
+		value := v
+
+		suite.T().Run(name, func(t *testing.T) {
+			switch typedEvt := value.(type) {
+			case mtglib.EventStart:
+				observer.EventStart(typedEvt)
+			case mtglib.EventConnectedToDC:
+				observer.EventConnectedToDC(typedEvt)
+			case mtglib.EventDomainFronting:
+				observer.EventDomainFronting(typedEvt)
+			case mtglib.EventFinish:
+				observer.EventFinish(typedEvt)
+			case mtglib.EventConcurrencyLimited:
+				observer.EventConcurrencyLimited(typedEvt)
+			case mtglib.EventIPBlocklisted:
+				observer.EventIPBlocklisted(typedEvt)
+			case mtglib.EventReplayAttack:
+				observer.EventReplayAttack(typedEvt)
+			case mtglib.EventIPListSize:
+				observer.EventIPListSize(typedEvt)
+			}
+		})
+	}
+
+	observer.Shutdown()
+}
+
+func TestNoop(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &NoopTestSuite{})
+}

example.config.toml

@@ -0,0 +1,361 @@
+# This is an example of the configuration file for mtg. You actually can
+# run mtg with it. It starts a proxy on all interfaces with a secret
+# ee367a189aee18fa31c190054efd4a8e9573746f726167652e676f6f676c65617069732e636f6d
+#
+# It has all possible options with default values. So, a real world
+# configuration file should contain only those options you are going to
+# use. You do not need to enumerate all of them. In other words, each
+# option here has a default value. If you comment a key-value pair, it
+# should not make any effect.
+#
+# stats is the only exception.
+
+# Debug starts application in debug mode. It starts to be quite verbose
+# in output. Actually, the idea is that you run it in debug mode only if
+# you have any issue.
+debug = true
+
+# A secret. Please remember that mtg supports only FakeTLS mode, legacy
+# simple and secured mode are prohibited. For you it means that secret
+# should either be base64-encoded or starts with ee.
+secret = "ee367a189aee18fa31c190054efd4a8e9573746f726167652e676f6f676c65617069732e636f6d"
+
+# Host:port pair to run proxy on.
+bind-to = "0.0.0.0:3128"
+
+# This defines what types of traffic mtg listens to. If you are not sure,
+# then definitely keep it disable. Enable it only and only if incoming traffic
+# is coming from some sort of load-balancer like HAProxy or ELB.
+# https://www.haproxy.org/download/2.3/doc/proxy-protocol.txt
+#
+# mtg uses a library that supports v1 and v2 versions of ProxyProtocol.
+# default value is false.
+# proxy-protocol-listener = false
+
+# Defines how many concurrent connections are allowed to this proxy.
+# All other incoming connections are going to be dropped.
+concurrency = 8192
+
+# Sometimes you want to enforce mtg to use some types of
+# IP connectivity to Telegram. We have 4 modes:
+#   - prefer-ipv6:
+#     We can use both ipv4 and ipv6 but ipv6 has a preference
+#   - prefer-ipv4:
+#     We can use both ipv4 and ipv6 but ipv4 has a preference
+#   - only-ipv6:
+#     Only ipv6 connectivity is used
+#   - only-ipv4:
+#     Only ipv4 connectivity is used
+prefer-ip = "prefer-ipv6"
+
+# Public IP addresses of this server. Used by 'mtg access' to generate
+# proxy links and by 'mtg doctor' to validate SNI-DNS match.
+# If not set, mtg tries to detect them automatically via ifconfig.co.
+# Set these if ifconfig.co is unreachable from your server.
+# public-ipv4 = "1.2.3.4"
+# public-ipv6 = "2001:db8::1"
+
+# If this setting is set, then mtg will try to get proxy updates from Telegram
+# Usually this is completely fine to have it disabled, because mtg has a list
+# of some core proxies hardcoded.
+auto-update = false
+
+# FakeTLS uses domain fronting protection. So it needs to know a port to
+# access.
+#
+# Deprecated: use [domain-fronting] configuration block. If relevant option
+# is defined there, this one would be ignored.
+# domain-fronting-port = 443
+
+# By default, mtg resolves the fronting hostname (from the secret) via DNS
+# to establish a TCP connection. If DNS resolution of that hostname is blocked,
+# you can specify an IP address to connect to directly. The hostname is still
+# used for SNI in the TLS handshake.
+#
+# default value is not set (DNS resolution is used).
+#
+# Deprecated: use [domain-fronting] configuration block. If relevant option
+# is defined there, this one would be ignored.
+# domain-fronting-ip = "10.0.0.10"
+
+# This makes a communication between both fronting website and mtg to use
+# proxy protocol.
+#
+# Deprecated: use [domain-fronting] configuration block. If relevant option
+# is defined there, this one would be ignored.
+# domain-fronting-proxy-protocol = false
+
+# FakeTLS can compare timestamps to prevent probes. Each message has
+# encrypted timestamp. So, mtg can compare this timestamp and decide if
+# we need to proceed with connection or not.
+#
+# Sometimes time can be skewed so we accept all messages within a
+# time range of this parameter.
+tolerate-time-skewness = "5s"
+
+# Telegram has a concept of DC. You can think about DC as a number of a cluster
+# with a certain purpose. Some clusters serve media, some - messages, some rule
+# channels and so on. But sometimes unknown DC number is requested by client.
+# It could be a bug or some global reconfiguration of the Telegram.
+#
+# By default, proxy rejects such requests. But it is also possible to fallback
+# this request to any DC. Telegram works in a way that any DC is able to serve
+# any request but sacrificing a latency.
+#
+# If this setting is disabled (default), mtg will reject a connection.
+# Otherwise, chose a new DC.
+allow-fallback-on-unknown-dc = false
+
+# This section is relevant to communication with fronting domain. Usually
+# you do not need to setup anything here but there are plenty of cases, especially
+# if you put mtg behind load balancer, when some specific configuration is
+# required.
+[domain-fronting]
+# By default, mtg resolves the fronting hostname (from the secret) via DNS
+# to establish a TCP connection. If DNS resolution of that hostname is blocked,
+# you can specify an IP address to connect to directly. The hostname is still
+# used for SNI in the TLS handshake.
+#
+# default value is not set (DNS resolution is used).
+# ip = "10.10.10.11"
+
+# FakeTLS uses domain fronting protection. So it needs to know a port to
+# access. Default value is 443
+# port = 443
+
+# This makes a communication between both fronting website and mtg to use
+# proxy protocol.
+# proxy-protocol = false
+
+# network defines different network-related settings
+[network]
+# please be aware that mtg needs to do some external requests. For
+# example, if you do not pass public ips, it will request your public ip
+# address from some external service.
+#
+# As for 2.0, if you set a public-ip on your own, mtg won't issue any
+# network requests except of those required for Telegram.
+#
+# so, in order of doing them, it needs to do DNS lookup. mtg ignores DNS
+# resolver of the operating system and uses DOH instead. This is a host
+# it has to access.
+#
+# By default we use Cloudflare.
+#
+# DEPRECATED option:
+#  If dns option is specified, it will be used instead. No default is defined
+#  anymore. But if you set this option, this is literally the same providing
+#  https:// URL to `dns`.
+#
+#  In other words:
+#
+#    doh-ip = "1.1.1.1"
+#
+# is literally the same as
+#
+#    dns = "https://1.1.1.1"
+# doh-ip = "1.1.1.1"
+
+# Starting from mtg v2.1.12 we have changed a configuration for DNS. Now it
+# supports DNS-over-HTTPS, DNS-over-TLS, custom UDP resolver and system
+# resolver.
+#
+# Here is how to define DNS-over-HTTPS:
+#  - https://1.1.1.1
+#  - https://1.1.1.1/dns-query
+#  - https://cloudflare-dns.com/dns-query
+#  - https://cloudflare-dns.com
+#
+# Here is how to define DNS-over-TLS:
+#  - tls://1.1.1.1
+#  - tls://cloudflare-dns.com
+#
+# Here is how to define a custom UDP resolver (we support only IPs here)
+#  - 1.1.1.1
+#  - udp://1.1.1.1
+#
+# If you set it to empty string, default resolver will be used.
+# But please comment out doh-ip
+dns = "https://1.1.1.1"
+
+# mtg can work via proxies (for now, we support only socks5). Proxy
+# configuration is done via list. So, you can specify many proxies
+# there.
+#
+# Actually, if you supply an empty list, then no proxies are going to be
+# used. If you supply a single proxy, then mtg will use it exclusively.
+# If you supply >= 2, then mtg will load balance between them.
+#
+# If you add an empty string here, this is an equivalent of 'plain network',
+# with no proxy usage.
+#
+# Proxy configuration is done via ordinary URI schema:
+#
+#     socks5://user:password@host:port
+#
+# Only socks5 proxy is used. user/password is optional. As you can
+# see, you can specify some parameters in GET query. These parameters
+# configure circuit breaker.
+proxies = [
+    # "socks5://user:password@host:port"
+]
+
+# network timeouts define different settings for timeouts. tcp timeout
+# define a global timeout on establishing of network connections. idle
+# means a timeout on pumping data between sockset when nothing is
+# happening.
+#
+# please be noticed that handshakes have no timeouts intentionally. You can
+# find a reasoning here:
+# https://www.ndss-symposium.org/wp-content/uploads/2020/02/23087-paper.pdf
+[network.timeout]
+tcp = "5s"
+http = "10s"
+idle = "1m"
+
+# mtg has to mimic real websites. It does not mean domain fronting, it also
+# means that traffic characteristics should be similar to real world traffic.
+# websites and applications behave differently, their traffic patterns are also
+# different. Applications do bursts of RPC-style messages (or JSON communication,
+# does not really matter), while websites pump heavy content in HTTP2 streams
+#
+# It means that statistically there is a different between traffic shape:
+# delays between packets are also different.
+# In order to avoid censorship detection based on these patterns, there is a
+# mtg subsystem called "Doppelganger" that aims to mimic website statistics
+# as close as it could.
+#
+# Delays between TLS packets are not constant. There are many factors
+# that come in play. Application should generate some response, it could
+# send some headers first and stream content with chunked encoding. So
+# some first packets could come as soon as possible, with some delays
+# after first ones. Such phenomenon is described by different statistic
+# distribution. There are 2 distribution that describe it: lognormal
+# distribution and Weibul distribution. Lognormal is all about steady streams
+# of heavy content like a video. Weibul is great about short bursts like
+# user who requested a static page an a couple of images.
+[defense.doppelganger]
+# This is a list of URLs that would be crawled by mtg to approximate delay
+# statistics. They MUST be HTTPS urls.
+#
+# You can come to the website and collect different URLs, with light and
+# heavy content. We recommend to search for CDNs.
+urls = [
+    # "https://st-ok.cdn-vk.ru/res/react/vendor/clsx-2.1.1-amd.js"
+]
+# A collection is done in raids. Each raid makes this number of requests to
+# each URL in this list. Do not use a huge number, 10 is probably ok.
+repeats-per-raid = 10
+# This is a duration between each raid. It makes no sense to have a small number
+# here as you would start to make a noticeable activity. Usually traffic patterns
+# do not change a lot, so do not expect different results if you request
+# each 10 minutes.
+raid-each = "6h"
+# This enables dynamic tls record sizing.
+#
+# Some modern stacks and platforms start to use the technique that is called
+# DRS. They start with small TLS packets and ramp up eventually. First packets
+# are usually about MTU size, after that we get 4k and eventually max size.
+# This is done with a good intention: to minimize a time to the first byte,
+# so application could start doing something with the data right after first
+# RTT.
+#
+# Apparently, about 90% of application do not employ this technique, they use
+# max size always: nginx, apache, java stuff. But Golang tools, angie and
+# some specific patches activate this technique.
+#
+# In order to mimic a real website we need to know something about software
+# it uses. Usually nobody cares: openssl does 16384, Python does it, nginx
+# does it. So this setting is disabled by default.
+#
+#      https://blog.cloudflare.com/optimizing-tls-over-tcp-to-reduce-latency/
+#      https://aws.github.io/s2n-tls/usage-guide/ch08-record-sizes.html
+#      https://github.com/cloudflare/sslconfig/blob/master/patches/nginx__dynamic_tls_records.patch
+drs = false
+
+# Some countries do active probing on Telegram connections. This technique
+# allows to protect from such effort.
+#
+# mtg has a cache of some connection fingerprints. Actually, first bytes
+# of each connection. So, it stores them in some in-memory LRU+TTL cache.
+# You can configure this cache here.
+[defense.anti-replay]
+# You can enable/disable this feature.
+enabled = true
+# max size of such a cache. Please be aware that this number is
+# approximate we try hard to store data quite dense but it is possible
+# that we can go over this limit for 10-20% under some conditions and
+# architectures.
+max-size = "1mib"
+# we use stable bloom filters for anti-replay cache. This helps
+# to maintain a desired error ratio.
+error-rate = 0.001
+
+# You can protect proxies by using different blocklists. If client has
+# ip from the given range, we do not try to do a proper handshake. We
+# actually route it to fronting domain. So, this client will never ever
+# have a chance to use mtg to access Telegram.
+#
+# Please remember that blocklists are initialized in async way. So,
+# when you start a proxy, blocklists are empty, they are populated and
+# processed in backgrounds. An error in any URL is ignored.
+[defense.blocklist]
+# You can enable/disable this feature.
+enabled = true
+# This is a limiter for concurrency. In order to protect website
+# from overloading, we download files in this number of threads.
+download-concurrency = 2
+# A list of URLs in FireHOL format (https://iplists.firehol.org/)
+# You can provider links here (starts with https:// or http://) or
+# path to a local file, but in this case it should be absolute.
+urls = [
+    "https://iplists.firehol.org/files/firehol_level1.netset",
+    # "/local.file"
+]
+# How often do we need to update a blocklist set.
+update-each = "24h"
+
+# Allowlist is an opposite to a blocklist. Only those IPs that are coming from
+# subnets defined in these lists are allowed. All others will be rejected.
+#
+# If this feature is disabled, then there won't be any check performed by this
+# validator. It is possible to combine both blocklist and whitelist.
+[defense.allowlist]
+# You can enable/disable this feature.
+enabled = false
+# This is a limiter for concurrency. In order to protect website
+# from overloading, we download files in this number of threads.
+download-concurrency = 2
+# A list of URLs in FireHOL format (https://iplists.firehol.org/)
+# You can provider links here (starts with https:// or http://) or
+# path to a local file, but in this case it should be absolute.
+urls = [
+    # "https://iplists.firehol.org/files/firehol_level1.netset",
+    # "/local.file"
+
+]
+update-each = "24h"
+
+# statsd statistics integration.
+[stats.statsd]
+# enabled/disabled
+enabled = false
+# host:port for UDP endpoint of statsd
+address = "127.0.0.1:8888"
+# prefix of metric for statsd
+metric-prefix = "mtg"
+# tag format to use
+# supported values are 'datadog', 'influxdb' and 'graphite'
+# default format is graphite.
+tag-format = "datadog"
+
+# prometheus metrics integration.
+[stats.prometheus]
+# enabled/disabled
+enabled = true
+# host:port where to start http server for endpoint
+bind-to = "127.0.0.1:3129"
+# prefix of http path
+http-path = "/"
+# prefix for metrics for prometheus
+metric-prefix = "mtg"

go.mod

@@ -0,0 +1,57 @@
+module github.com/9seconds/mtg/v2
+
+go 1.26
+
+require (
+	github.com/OneOfOne/xxhash v1.2.8
+	github.com/alecthomas/kong v1.14.0
+	github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b
+	github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
+	github.com/babolivier/go-doh-client v0.0.0-20201028162107-a76cff4cb8b6
+	github.com/d4l3k/messagediff v1.2.1 // indirect
+	github.com/jarcoal/httpmock v1.0.8
+	github.com/mccutchen/go-httpbin v1.1.1
+	github.com/panjf2000/ants/v2 v2.12.0
+	github.com/prometheus/client_golang v1.23.2
+	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
+	github.com/rs/zerolog v1.35.0
+	github.com/smira/go-statsd v1.3.4
+	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/stretchr/testify v1.11.1
+	github.com/tylertreat/BoomFilters v0.0.0-20251117164519-53813c36cc1b
+	golang.org/x/crypto v0.49.0
+	golang.org/x/net v0.52.0
+	golang.org/x/sys v0.42.0
+	google.golang.org/protobuf v1.36.11 // indirect
+)
+
+require (
+	github.com/beevik/ntp v1.5.0
+	github.com/ncruces/go-dns v1.3.2
+	github.com/pelletier/go-toml/v2 v2.3.0
+	github.com/pires/go-proxyproto v0.11.0
+	github.com/things-go/go-socks5 v0.1.0
+	github.com/txthinking/socks5 v0.0.0-20251011041537-5c31f201a10e
+	github.com/yl2chen/cidranger v1.0.2
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/klauspost/compress v1.18.3 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/txthinking/runnergroup v0.0.0-20250224021307-5864ffeb65ae // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/tools v0.41.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)

go.sum

@@ -0,0 +1,155 @@
+github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
+github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
+github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
+github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
+github.com/alecthomas/kong v1.14.0 h1:gFgEUZWu2ZmZ+UhyZ1bDhuutbKN1nTtJTwh19Wsn21s=
+github.com/alecthomas/kong v1.14.0/go.mod h1:wrlbXem1CWqUV5Vbmss5ISYhsVPkBb1Yo7YKJghju2I=
+github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
+github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b h1:mimo19zliBX/vSQ6PWWSL9lK8qwHozUj03+zLoEB8O0=
+github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b/go.mod h1:fvzegU4vN3H1qMT+8wDmzjAcDONcgo2/SZ/TyfdUOFs=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/babolivier/go-doh-client v0.0.0-20201028162107-a76cff4cb8b6 h1:4NNbNM2Iq/k57qEu7WfL67UrbPq1uFWxW4qODCohi+0=
+github.com/babolivier/go-doh-client v0.0.0-20201028162107-a76cff4cb8b6/go.mod h1:J29hk+f9lJrblVIfiJOtTFk+OblBawmib4uz/VdKzlg=
+github.com/beevik/ntp v1.5.0 h1:y+uj/JjNwlY2JahivxYvtmv4ehfi3h74fAuABB9ZSM4=
+github.com/beevik/ntp v1.5.0/go.mod h1:mJEhBrwT76w9D+IfOEGvuzyuudiW9E52U2BaTrMOYow=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/d4l3k/messagediff v1.2.1 h1:ZcAIMYsUg0EAp9X+tt8/enBE/Q8Yd5kzPynLyKptt9U=
+github.com/d4l3k/messagediff v1.2.1/go.mod h1:Oozbb1TVXFac9FtSIxHBMnBCq2qeH/2KkEQxENCrlLo=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
+github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
+github.com/jarcoal/httpmock v1.0.8 h1:8kI16SoO6LQKgPE7PvQuV+YuD/inwHd7fOOe2zMbo4k=
+github.com/jarcoal/httpmock v1.0.8/go.mod h1:ATjnClrvW/3tijVmpL/va5Z3aAyGvqU3gCT8nX0Txik=
+github.com/klauspost/compress v1.18.3 h1:9PJRvfbmTabkOX8moIpXPbMMbYN60bWImDDU7L+/6zw=
+github.com/klauspost/compress v1.18.3/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mccutchen/go-httpbin v1.1.1 h1:aEws49HEJEyXHLDnshQVswfUlCVoS8g6h9YaDyaW7RE=
+github.com/mccutchen/go-httpbin v1.1.1/go.mod h1:fhpOYavp5g2K74XDl/ao2y4KvhqVtKlkg1e+0UaQv7I=
+github.com/miekg/dns v1.1.51 h1:0+Xg7vObnhrz/4ZCZcZh7zPXlmU0aveS2HDBd0m0qSo=
+github.com/miekg/dns v1.1.51/go.mod h1:2Z9d3CP1LQWihRZUf29mQ19yDThaI4DAYzte2CaQW5c=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/ncruces/go-dns v1.3.2 h1:kBLuUZBgkQ4qF4WDXZRQ4rG0Gk6sLVJQ5tESkWrxUa0=
+github.com/ncruces/go-dns v1.3.2/go.mod h1:tuzixNY8PY/M7yUzcvRbUaeLs3ifIdydpi5H2bfRU+s=
+github.com/panjf2000/ants/v2 v2.12.0 h1:u9JhESo83i/GkZnhfTNuFMMWcNt7mnV1bGJ6FT4wXH8=
+github.com/panjf2000/ants/v2 v2.12.0/go.mod h1:tSQuaNQ6r6NRhPt+IZVUevvDyFMTs+eS4ztZc52uJTY=
+github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
+github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
+github.com/pelletier/go-toml/v2 v2.3.0 h1:k59bC/lIZREW0/iVaQR8nDHxVq8OVlIzYCOJf421CaM=
+github.com/pelletier/go-toml/v2 v2.3.0/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pires/go-proxyproto v0.11.0 h1:gUQpS85X/VJMdUsYyEgyn59uLJvGqPhJV5YvG68wXH4=
+github.com/pires/go-proxyproto v0.11.0/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
+github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
+github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
+github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rs/zerolog v1.35.0 h1:VD0ykx7HMiMJytqINBsKcbLS+BJ4WYjz+05us+LRTdI=
+github.com/rs/zerolog v1.35.0/go.mod h1:EjML9kdfa/RMA7h/6z6pYmq1ykOuA8/mjWaEvGI+jcw=
+github.com/smira/go-statsd v1.3.4 h1:kBYWcLSGT+qC6JVbvfz48kX7mQys32fjDOPrfmsSx2c=
+github.com/smira/go-statsd v1.3.4/go.mod h1:RjdsESPgDODtg1VpVVf9MJrEW2Hw0wtRNbmB1CAhu6A=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/things-go/go-socks5 v0.1.0 h1:4f5dz0iMQ6cA4wseFmyLmCHmg3SWJTW92ndrKS6oERg=
+github.com/things-go/go-socks5 v0.1.0/go.mod h1:Riabiyu52kLsla0YmJqunt1c1JEl6iXSr4bRd7swFEA=
+github.com/txthinking/runnergroup v0.0.0-20210608031112-152c7c4432bf/go.mod h1:CLUSJbazqETbaR+i0YAhXBICV9TrKH93pziccMhmhpM=
+github.com/txthinking/runnergroup v0.0.0-20250224021307-5864ffeb65ae h1:ArVM1jICfm7g4E4dBet+KHUFMLuxmj1Nxdp/tr3ByCU=
+github.com/txthinking/runnergroup v0.0.0-20250224021307-5864ffeb65ae/go.mod h1:cldYm15/XHcGt7ndItnEWHwFZo7dinU+2QoyjfErhsI=
+github.com/txthinking/socks5 v0.0.0-20251011041537-5c31f201a10e h1:xA7GVlbz6teIF4FdvuqwbX6C4tiqNk2PH7FRPIDerao=
+github.com/txthinking/socks5 v0.0.0-20251011041537-5c31f201a10e/go.mod h1:ntmMHL/xPq1WLeKiw8p/eRATaae6PiVRNipHFJxI8PM=
+github.com/tylertreat/BoomFilters v0.0.0-20251117164519-53813c36cc1b h1:p+bJ3v5uUdEVMCoeFUs+BNJPsqt+Y6BLbDaPfTcbcH8=
+github.com/tylertreat/BoomFilters v0.0.0-20251117164519-53813c36cc1b/go.mod h1:OYRfF6eb5wY9VRFkXJH8FFBi3plw2v+giaIu7P054pM=
+github.com/yl2chen/cidranger v1.0.2 h1:lbOWZVCG1tCRX4u24kuM1Tb4nHqWkDxwLdoS+SevawU=
+github.com/yl2chen/cidranger v1.0.2/go.mod h1:9U1yz7WPYDwf0vpNWFaeRh0bjwz5RVgRy/9UEQfHl0g=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
+golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
+golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
+golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
+golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

internal/cli/access.go

@@ -0,0 +1,144 @@
+package cli
+
+import (
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/url"
+	"os"
+	"strconv"
+	"sync"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/9seconds/mtg/v2/internal/utils"
+)
+
+type accessResponse struct {
+	IPv4   *accessResponseURLs `json:"ipv4,omitempty"`
+	IPv6   *accessResponseURLs `json:"ipv6,omitempty"`
+	Secret struct {
+		Hex    string `json:"hex"`
+		Base64 string `json:"base64"`
+	} `json:"secret"`
+}
+
+type accessResponseURLs struct {
+	IP        net.IP `json:"ip"`
+	Port      uint   `json:"port"`
+	TgURL     string `json:"tg_url"`     //nolint: tagliatelle
+	TgQrCode  string `json:"tg_qrcode"`  //nolint: tagliatelle
+	TmeURL    string `json:"tme_url"`    //nolint: tagliatelle
+	TmeQrCode string `json:"tme_qrcode"` //nolint: tagliatelle
+}
+
+type Access struct {
+	ConfigPath string `kong:"arg,required,type='existingfile',help='Path to the configuration file.',name='config-path'"`                 //nolint: lll
+	PublicIPv4 net.IP `kong:"help='Public IPv4 address for proxy. By default it is resolved via remote website',name='ipv4',short='i'"`   //nolint: lll
+	PublicIPv6 net.IP `kong:"help='Public IPv6 address for proxy. By default it is resolved via remote website',name='ipv6',short='I'"`   //nolint: lll
+	Port       uint   `kong:"help='Port number. Default port is taken from configuration file, bind-to parameter',type:'uint',short='p'"` //nolint: lll
+	Hex        bool   `kong:"help='Print secret in hex encoding.',short='x'"`
+}
+
+func (a *Access) Run(cli *CLI, version string) error {
+	conf, err := utils.ReadConfig(a.ConfigPath)
+	if err != nil {
+		return fmt.Errorf("cannot init config: %w", err)
+	}
+
+	resp := &accessResponse{}
+	resp.Secret.Base64 = conf.Secret.Base64()
+	resp.Secret.Hex = conf.Secret.Hex()
+
+	ntw, err := makeNetwork(conf, version)
+	if err != nil {
+		return fmt.Errorf("cannot init network: %w", err)
+	}
+
+	wg := &sync.WaitGroup{}
+
+	wg.Go(func() {
+		ip := a.PublicIPv4
+		if ip == nil {
+			ip = conf.PublicIPv4.Get(nil)
+		}
+		if ip == nil {
+			ip = getIP(ntw, "tcp4")
+		}
+
+		if ip != nil {
+			ip = ip.To4()
+		}
+
+		resp.IPv4 = a.makeURLs(conf, ip)
+	})
+	wg.Go(func() {
+		ip := a.PublicIPv6
+		if ip == nil {
+			ip = conf.PublicIPv6.Get(nil)
+		}
+		if ip == nil {
+			ip = getIP(ntw, "tcp6")
+		}
+
+		if ip != nil {
+			ip = ip.To16()
+		}
+
+		resp.IPv6 = a.makeURLs(conf, ip)
+	})
+
+	wg.Wait()
+
+	encoder := json.NewEncoder(os.Stdout)
+	encoder.SetEscapeHTML(false)
+	encoder.SetIndent("", "  ")
+
+	if err := encoder.Encode(resp); err != nil {
+		return fmt.Errorf("cannot dump access json: %w", err)
+	}
+
+	return nil
+}
+
+func (a *Access) makeURLs(conf *config.Config, ip net.IP) *accessResponseURLs {
+	if ip == nil {
+		return nil
+	}
+
+	portNo := a.Port
+	if portNo == 0 {
+		portNo = conf.BindTo.Port
+	}
+
+	values := url.Values{}
+	values.Set("server", ip.String())
+	values.Set("port", strconv.Itoa(int(portNo)))
+
+	if a.Hex {
+		values.Set("secret", conf.Secret.Hex())
+	} else {
+		values.Set("secret", conf.Secret.Base64())
+	}
+
+	urlQuery := values.Encode()
+
+	rv := &accessResponseURLs{
+		IP:   ip,
+		Port: portNo,
+		TgURL: (&url.URL{
+			Scheme:   "tg",
+			Host:     "proxy",
+			RawQuery: urlQuery,
+		}).String(),
+		TmeURL: (&url.URL{
+			Scheme:   "https",
+			Host:     "t.me",
+			Path:     "proxy",
+			RawQuery: urlQuery,
+		}).String(),
+	}
+	rv.TgQrCode = utils.MakeQRCodeURL(rv.TgURL)
+	rv.TmeQrCode = utils.MakeQRCodeURL(rv.TmeURL)
+
+	return rv
+}

internal/cli/cli.go

@@ -0,0 +1,12 @@
+package cli
+
+import "github.com/alecthomas/kong"
+
+type CLI struct {
+	GenerateSecret GenerateSecret   `kong:"cmd,help='Generate new proxy secret'"`
+	Doctor         Doctor           `kong:"cmd,help='Check that proxy can run correctly'"`
+	Access         Access           `kong:"cmd,help='Print access information.'"`
+	Run            Run              `kong:"cmd,help='Run proxy.'"`
+	SimpleRun      SimpleRun        `kong:"cmd,help='Run proxy without config file.'"`
+	Version        kong.VersionFlag `kong:"help='Print version.',short='v'"`
+}

internal/cli/doctor.go

@@ -0,0 +1,375 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"net"
+	"os"
+	"slices"
+	"strconv"
+	"strings"
+	"text/template"
+	"time"
+
+	"github.com/9seconds/mtg/v2/essentials"
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/9seconds/mtg/v2/internal/utils"
+	"github.com/9seconds/mtg/v2/mtglib"
+	"github.com/9seconds/mtg/v2/network/v2"
+	"github.com/beevik/ntp"
+)
+
+var (
+	tplError = template.Must(
+		template.New("").Parse("  ‼️ {{ .description }}: {{ .error }}\n"),
+	)
+
+	tplWDeprecatedConfig = template.Must(
+		template.New("").
+			Parse(`  ⚠️ Option {{ .old | printf "%q" }}{{ if .old_section }} from section [{{ .old_section }}]{{ end }} is deprecated and will be removed in v{{ .when }}. Please use {{ .new | printf "%q" }}{{ if .new_section }} in [{{ .new_section }}] section{{ end }} instead.` + "\n"),
+	)
+
+	tplOTimeSkewness = template.Must(
+		template.New("").
+			Parse("  ✅ Time drift is {{ .drift }}, but tolerate-time-skewness is {{ .value }}\n"),
+	)
+	tplWTimeSkewness = template.Must(
+		template.New("").
+			Parse("  ⚠️ Time drift is {{ .drift }}, but tolerate-time-skewness is {{ .value }}. Please check ntp.\n"),
+	)
+	tplETimeSkewness = template.Must(
+		template.New("").
+			Parse("  ❌ Time drift is {{ .drift }}, but tolerate-time-skewness is {{ .value }}. You will get many rejected connections!\n"),
+	)
+
+	tplODCConnect = template.Must(
+		template.New("").Parse("  ✅ DC {{ .dc }}\n"),
+	)
+	tplEDCConnect = template.Must(
+		template.New("").Parse("  ❌ DC {{ .dc }}: {{ .error }}\n"),
+	)
+
+	tplODNSSNIMatch = template.Must(
+		template.New("").Parse("  ✅ IP address {{ .ip }} matches secret hostname {{ .hostname }}\n"),
+	)
+	tplEDNSSNIMatch = template.Must(
+		template.New("").Parse("  ❌ Hostname {{ .hostname }} {{ if .resolved }}is resolved to {{ .resolved }} addresses, not {{ if .ip4 }}{{ .ip4 }}{{ else }}{{ .ip6 }}{{ end }}{{ else }}cannot be resolved to any host{{ end }}\n"),
+	)
+
+	tplOFrontingDomain = template.Must(
+		template.New("").Parse("  ✅ {{ .address }} is reachable\n"),
+	)
+	tplEFrontingDomain = template.Must(
+		template.New("").Parse("  ❌ {{ .address }}: {{ .error }}\n"),
+	)
+)
+
+type Doctor struct {
+	conf *config.Config
+
+	ConfigPath string `kong:"arg,required,type='existingfile',help='Path to the configuration file.',name='config-path'"` //nolint: lll
+}
+
+func (d *Doctor) Run(cli *CLI, version string) error {
+	conf, err := utils.ReadConfig(d.ConfigPath)
+	if err != nil {
+		return fmt.Errorf("cannot init config: %w", err)
+	}
+
+	d.conf = conf
+
+	fmt.Println("Deprecated options")
+	everythingOK := d.checkDeprecatedConfig()
+
+	fmt.Println("Time skewness")
+	everythingOK = d.checkTimeSkewness() && everythingOK
+
+	resolver, err := network.GetDNS(conf.GetDNS())
+	if err != nil {
+		return fmt.Errorf("cannot create DNS resolver: %w", err)
+	}
+
+	base := network.New(
+		resolver,
+		"",
+		conf.Network.Timeout.TCP.Get(10*time.Second),
+		conf.Network.Timeout.HTTP.Get(0),
+		conf.Network.Timeout.Idle.Get(0),
+	)
+
+	fmt.Println("Validate native network connectivity")
+	everythingOK = d.checkNetwork(base) && everythingOK
+
+	for _, url := range conf.Network.Proxies {
+		value, err := network.NewProxyNetwork(base, url.Get(nil))
+		if err != nil {
+			return err
+		}
+
+		fmt.Printf("Validate network connectivity with proxy %s\n", url.Get(nil))
+		everythingOK = d.checkNetwork(value) && everythingOK
+	}
+
+	fmt.Println("Validate fronting domain connectivity")
+	everythingOK = d.checkFrontingDomain(base) && everythingOK
+
+	fmt.Println("Validate SNI-DNS match")
+	everythingOK = d.checkSecretHost(resolver, base) && everythingOK
+
+	if !everythingOK {
+		os.Exit(1)
+	}
+
+	return nil
+}
+
+func (d *Doctor) checkDeprecatedConfig() bool {
+	ok := true
+
+	if d.conf.DomainFrontingIP.Value != nil {
+		ok = false
+		tplWDeprecatedConfig.Execute(os.Stdout, map[string]string{ //nolint: errcheck
+			"when":        "2.3.0",
+			"old":         "domain-fronting-ip",
+			"old_section": "",
+			"new":         "ip",
+			"new_section": "domain-fronting",
+		})
+	}
+
+	if d.conf.DomainFrontingPort.Value != 0 {
+		ok = false
+		tplWDeprecatedConfig.Execute(os.Stdout, map[string]string{ //nolint: errcheck
+			"when":        "2.3.0",
+			"old":         "domain-fronting-port",
+			"old_section": "",
+			"new":         "port",
+			"new_section": "domain-fronting",
+		})
+	}
+
+	if d.conf.DomainFrontingProxyProtocol.Value {
+		ok = false
+		tplWDeprecatedConfig.Execute(os.Stdout, map[string]string{ //nolint: errcheck
+			"when":        "2.3.0",
+			"old":         "domain-fronting-proxy-protocol",
+			"old_section": "",
+			"new":         "proxy-protocol",
+			"new_section": "domain-fronting",
+		})
+	}
+
+	if d.conf.Network.DOHIP.Value != nil {
+		ok = false
+		tplWDeprecatedConfig.Execute(os.Stdout, map[string]string{ //nolint: errcheck
+			"when":        "2.3.0",
+			"old":         "doh-ip",
+			"old_section": "network",
+			"new":         "dns",
+			"new_section": "network",
+		})
+	}
+
+	if ok {
+		fmt.Println("  ✅ All good")
+	}
+
+	return ok
+}
+
+func (d *Doctor) checkTimeSkewness() bool {
+	response, err := ntp.Query("0.pool.ntp.org")
+	if err != nil {
+		tplError.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+			"description": "cannot access ntp pool",
+			"error":       err,
+		})
+		return false
+	}
+
+	skewness := response.ClockOffset.Abs()
+	confValue := d.conf.TolerateTimeSkewness.Get(mtglib.DefaultTolerateTimeSkewness)
+	diff := float64(skewness) / float64(confValue)
+	tplData := map[string]any{
+		"drift": response.ClockOffset,
+		"value": confValue,
+	}
+
+	switch {
+	case diff < 0.3:
+		tplOTimeSkewness.Execute(os.Stdout, tplData) //nolint: errcheck
+		return true
+	case diff < 0.7:
+		tplWTimeSkewness.Execute(os.Stdout, tplData) //nolint: errcheck
+	default:
+		tplETimeSkewness.Execute(os.Stdout, tplData) //nolint: errcheck
+	}
+
+	return false
+}
+
+func (d *Doctor) checkNetwork(ntw mtglib.Network) bool {
+	dcs := slices.Collect(maps.Keys(essentials.TelegramCoreAddresses))
+	slices.Sort(dcs)
+
+	ok := true
+
+	for _, dc := range dcs {
+		err := d.checkNetworkAddresses(ntw, essentials.TelegramCoreAddresses[dc])
+		if err == nil {
+			tplODCConnect.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+				"dc": dc,
+			})
+		} else {
+			tplEDCConnect.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+				"dc":    dc,
+				"error": err,
+			})
+			ok = false
+		}
+	}
+
+	return ok
+}
+
+func (d *Doctor) checkNetworkAddresses(ntw mtglib.Network, addresses []string) error {
+	checkAddresses := []string{}
+
+	switch d.conf.PreferIP.Get("prefer-ip4") {
+	case "only-ipv4":
+		for _, addr := range addresses {
+			host, _, err := net.SplitHostPort(addr)
+			if err != nil {
+				panic(err)
+			}
+
+			if ip := net.ParseIP(host); ip != nil && ip.To4() != nil {
+				checkAddresses = append(checkAddresses, addr)
+			}
+		}
+	case "only-ipv6":
+		for _, addr := range addresses {
+			host, _, err := net.SplitHostPort(addr)
+			if err != nil {
+				panic(err)
+			}
+
+			if ip := net.ParseIP(host); ip != nil && ip.To4() == nil {
+				checkAddresses = append(checkAddresses, addr)
+			}
+		}
+	default:
+		checkAddresses = addresses
+	}
+
+	if len(checkAddresses) == 0 {
+		return fmt.Errorf("no suitable addresses after IP version filtering")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	var (
+		conn net.Conn
+		err  error
+	)
+
+	for _, addr := range checkAddresses {
+		conn, err = ntw.DialContext(ctx, "tcp", addr)
+		if err != nil {
+			continue
+		}
+
+		conn.Close() //nolint: errcheck
+
+		return nil
+	}
+
+	return err
+}
+
+func (d *Doctor) checkFrontingDomain(ntw mtglib.Network) bool {
+	host := d.conf.Secret.Host
+	if ip := d.conf.GetDomainFrontingIP(nil); ip != "" {
+		host = ip
+	}
+
+	port := d.conf.GetDomainFrontingPort(mtglib.DefaultDomainFrontingPort)
+	address := net.JoinHostPort(host, strconv.Itoa(int(port)))
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	dialer := ntw.NativeDialer()
+
+	conn, err := dialer.DialContext(ctx, "tcp", address)
+	if err != nil {
+		tplEFrontingDomain.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+			"address": address,
+			"error":   err,
+		})
+		return false
+	}
+
+	conn.Close() //nolint: errcheck
+
+	tplOFrontingDomain.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+		"address": address,
+	})
+
+	return true
+}
+
+func (d *Doctor) checkSecretHost(resolver *net.Resolver, ntw mtglib.Network) bool {
+	addresses, err := resolver.LookupIPAddr(context.Background(), d.conf.Secret.Host)
+	if err != nil {
+		tplError.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+			"description": fmt.Sprintf("cannot resolve DNS name of %s", d.conf.Secret.Host),
+			"error":       err,
+		})
+		return false
+	}
+
+	ourIP4 := d.conf.PublicIPv4.Get(nil)
+	if ourIP4 == nil {
+		ourIP4 = getIP(ntw, "tcp4")
+	}
+
+	ourIP6 := d.conf.PublicIPv6.Get(nil)
+	if ourIP6 == nil {
+		ourIP6 = getIP(ntw, "tcp6")
+	}
+
+	if ourIP4 == nil && ourIP6 == nil {
+		tplError.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+			"description": "cannot detect public IP address",
+			"error":       errors.New("cannot detect automatically and public-ipv4/public-ipv6 are not set in config"),
+		})
+		return false
+	}
+
+	strAddresses := []string{}
+	for _, value := range addresses {
+		if (ourIP4 != nil && value.IP.String() == ourIP4.String()) ||
+			(ourIP6 != nil && value.IP.String() == ourIP6.String()) {
+			tplODNSSNIMatch.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+				"ip":       value.IP,
+				"hostname": d.conf.Secret.Host,
+			})
+			return true
+		}
+
+		strAddresses = append(strAddresses, `"`+value.IP.String()+`"`)
+	}
+
+	tplEDNSSNIMatch.Execute(os.Stdout, map[string]any{ //nolint: errcheck
+		"hostname": d.conf.Secret.Host,
+		"resolved": strings.Join(strAddresses, ", "),
+		"ip4":      ourIP4,
+		"ip6":      ourIP6,
+	})
+
+	return false
+}

internal/cli/generate_secret.go

@@ -0,0 +1,24 @@
+package cli
+
+import (
+	"fmt"
+
+	"github.com/9seconds/mtg/v2/mtglib"
+)
+
+type GenerateSecret struct {
+	HostName string `kong:"arg,required,help='Hostname to use for domain fronting.',name='hostname'"`
+	Hex      bool   `kong:"help='Print secret in hex encoding.',short='x'"`
+}
+
+func (g *GenerateSecret) Run(cli *CLI, _ string) error {
+	secret := mtglib.GenerateSecret(cli.GenerateSecret.HostName)
+
+	if g.Hex {
+		fmt.Println(secret.Hex()) //nolint: forbidigo
+	} else {
+		fmt.Println(secret.Base64()) //nolint: forbidigo
+	}
+
+	return nil
+}

internal/cli/run.go

@@ -0,0 +1,20 @@
+package cli
+
+import (
+	"fmt"
+
+	"github.com/9seconds/mtg/v2/internal/utils"
+)
+
+type Run struct {
+	ConfigPath string `kong:"arg,required,type='existingfile',help='Path to the configuration file.',name='config-path'"` //nolint: lll
+}
+
+func (r *Run) Run(cli *CLI, version string) error {
+	conf, err := utils.ReadConfig(r.ConfigPath)
+	if err != nil {
+		return fmt.Errorf("cannot init config: %w", err)
+	}
+
+	return runProxy(conf, version)
+}

internal/cli/run_proxy.go

@@ -0,0 +1,301 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"time"
+
+	"github.com/9seconds/mtg/v2/antireplay"
+	"github.com/9seconds/mtg/v2/events"
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/9seconds/mtg/v2/internal/proxyprotocol"
+	"github.com/9seconds/mtg/v2/internal/utils"
+	"github.com/9seconds/mtg/v2/ipblocklist"
+	"github.com/9seconds/mtg/v2/ipblocklist/files"
+	"github.com/9seconds/mtg/v2/logger"
+	"github.com/9seconds/mtg/v2/mtglib"
+	"github.com/9seconds/mtg/v2/network/v2"
+	"github.com/9seconds/mtg/v2/stats"
+	"github.com/pires/go-proxyproto"
+	"github.com/rs/zerolog"
+	"github.com/yl2chen/cidranger"
+)
+
+func makeLogger(conf *config.Config) mtglib.Logger {
+	zerolog.TimeFieldFormat = zerolog.TimeFormatUnixMs
+	zerolog.TimestampFieldName = "timestamp"
+	zerolog.LevelFieldName = "level"
+
+	if conf.Debug.Get(false) {
+		zerolog.SetGlobalLevel(zerolog.DebugLevel)
+	} else {
+		zerolog.SetGlobalLevel(zerolog.WarnLevel)
+	}
+
+	baseLogger := zerolog.New(os.Stdout).With().Timestamp().Logger()
+
+	return logger.NewZeroLogger(baseLogger)
+}
+
+func makeNetwork(conf *config.Config, version string) (mtglib.Network, error) {
+	resolver, err := network.GetDNS(conf.GetDNS())
+	if err != nil {
+		return nil, fmt.Errorf("cannot create DNS resolver: %w", err)
+	}
+
+	base := network.New(
+		resolver,
+		"",
+		conf.Network.Timeout.TCP.Get(0),
+		conf.Network.Timeout.HTTP.Get(0),
+		conf.Network.Timeout.Idle.Get(0),
+	)
+
+	proxyDialers := make([]mtglib.Network, len(conf.Network.Proxies))
+	for idx, v := range conf.Network.Proxies {
+		value, err := network.NewProxyNetwork(base, v.Get(nil))
+		if err != nil {
+			return nil, fmt.Errorf("cannot use %v for proxy url: %w", v.Get(nil), err)
+		}
+		proxyDialers[idx] = value
+	}
+
+	switch len(proxyDialers) {
+	case 0:
+		return base, nil
+	case 1:
+		return proxyDialers[0], nil
+	}
+
+	value, err := network.Join(proxyDialers...)
+	if err != nil {
+		panic(err)
+	}
+
+	return value, nil
+}
+
+func makeAntiReplayCache(conf *config.Config) mtglib.AntiReplayCache {
+	if !conf.Defense.AntiReplay.Enabled.Get(false) {
+		return antireplay.NewNoop()
+	}
+
+	return antireplay.NewStableBloomFilter(
+		conf.Defense.AntiReplay.MaxSize.Get(antireplay.DefaultStableBloomFilterMaxSize),
+		conf.Defense.AntiReplay.ErrorRate.Get(antireplay.DefaultStableBloomFilterErrorRate),
+	)
+}
+
+func makeIPBlocklist(conf config.ListConfig,
+	logger mtglib.Logger,
+	ntw mtglib.Network,
+	updateCallback ipblocklist.FireholUpdateCallback,
+) (mtglib.IPBlocklist, error) {
+	if !conf.Enabled.Get(false) {
+		return ipblocklist.NewNoop(), nil
+	}
+
+	remoteURLs := []string{}
+	localFiles := []string{}
+
+	for _, v := range conf.URLs {
+		if v.IsRemote() {
+			remoteURLs = append(remoteURLs, v.String())
+		} else {
+			localFiles = append(localFiles, v.String())
+		}
+	}
+
+	blocklist, err := ipblocklist.NewFirehol(logger.Named("ipblockist"),
+		ntw,
+		conf.DownloadConcurrency.Get(1),
+		remoteURLs,
+		localFiles,
+		updateCallback)
+	if err != nil {
+		return nil, fmt.Errorf("incorrect parameters for firehol: %w", err)
+	}
+
+	go blocklist.Run(conf.UpdateEach.Get(ipblocklist.DefaultFireholUpdateEach))
+
+	return blocklist, nil
+}
+
+func makeIPAllowlist(conf config.ListConfig,
+	logger mtglib.Logger,
+	ntw mtglib.Network,
+	updateCallback ipblocklist.FireholUpdateCallback,
+) (mtglib.IPBlocklist, error) {
+	var (
+		allowlist mtglib.IPBlocklist
+		err       error
+	)
+
+	if !conf.Enabled.Get(false) {
+		allowlist, err = ipblocklist.NewFireholFromFiles(
+			logger.Named("ipblocklist"),
+			1,
+			[]files.File{
+				files.NewMem([]*net.IPNet{
+					cidranger.AllIPv4,
+					cidranger.AllIPv6,
+				}),
+			},
+			updateCallback,
+		)
+
+		go allowlist.Run(conf.UpdateEach.Get(ipblocklist.DefaultFireholUpdateEach))
+	} else {
+		allowlist, err = makeIPBlocklist(
+			conf,
+			logger,
+			ntw,
+			updateCallback,
+		)
+	}
+
+	if err != nil {
+		return nil, fmt.Errorf("cannot build allowlist: %w", err)
+	}
+
+	return allowlist, nil
+}
+
+func makeEventStream(conf *config.Config, logger mtglib.Logger) (mtglib.EventStream, error) {
+	factories := make([]events.ObserverFactory, 0, 2)
+
+	if conf.Stats.StatsD.Enabled.Get(false) {
+		statsdFactory, err := stats.NewStatsd(
+			conf.Stats.StatsD.Address.Get(""),
+			logger.Named("statsd"),
+			conf.Stats.StatsD.MetricPrefix.Get(stats.DefaultStatsdMetricPrefix),
+			conf.Stats.StatsD.TagFormat.Get(stats.DefaultStatsdTagFormat))
+		if err != nil {
+			return nil, fmt.Errorf("cannot build statsd observer: %w", err)
+		}
+
+		factories = append(factories, statsdFactory.Make)
+	}
+
+	if conf.Stats.Prometheus.Enabled.Get(false) {
+		prometheus := stats.NewPrometheus(
+			conf.Stats.Prometheus.MetricPrefix.Get(stats.DefaultMetricPrefix),
+			conf.Stats.Prometheus.HTTPPath.Get("/"),
+		)
+
+		listener, err := net.Listen("tcp", conf.Stats.Prometheus.BindTo.Get(""))
+		if err != nil {
+			return nil, fmt.Errorf("cannot start a listener for prometheus: %w", err)
+		}
+
+		go prometheus.Serve(listener) //nolint: errcheck
+
+		factories = append(factories, prometheus.Make)
+	}
+
+	if len(factories) > 0 {
+		return events.NewEventStream(factories), nil
+	}
+
+	return events.NewNoopStream(), nil
+}
+
+func runProxy(conf *config.Config, version string) error { //nolint: funlen
+	logger := makeLogger(conf)
+
+	logger.BindJSON("configuration", conf.String()).Debug("configuration")
+
+	eventStream, err := makeEventStream(conf, logger)
+	if err != nil {
+		return fmt.Errorf("cannot build event stream: %w", err)
+	}
+
+	ntw, err := makeNetwork(conf, version)
+	if err != nil {
+		return fmt.Errorf("cannot build network: %w", err)
+	}
+
+	blocklist, err := makeIPBlocklist(
+		conf.Defense.Blocklist,
+		logger.Named("blocklist"),
+		ntw,
+		func(ctx context.Context, size int) {
+			eventStream.Send(ctx, mtglib.NewEventIPListSize(size, true))
+		})
+	if err != nil {
+		return fmt.Errorf("cannot build ip blocklist: %w", err)
+	}
+
+	allowlist, err := makeIPAllowlist(
+		conf.Defense.Allowlist,
+		logger.Named("allowlist"),
+		ntw,
+		func(ctx context.Context, size int) {
+			eventStream.Send(ctx, mtglib.NewEventIPListSize(size, false))
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("cannot build ip allowlist: %w", err)
+	}
+
+	doppelGangerURLs := make([]string, len(conf.Defense.Doppelganger.URLs))
+	for i, v := range conf.Defense.Doppelganger.URLs {
+		doppelGangerURLs[i] = v.String()
+	}
+
+	opts := mtglib.ProxyOpts{
+		Logger:          logger,
+		Network:         ntw,
+		AntiReplayCache: makeAntiReplayCache(conf),
+		IPBlocklist:     blocklist,
+		IPAllowlist:     allowlist,
+		EventStream:     eventStream,
+
+		Secret:                      conf.Secret,
+		Concurrency:                 conf.GetConcurrency(mtglib.DefaultConcurrency),
+		DomainFrontingPort:          conf.GetDomainFrontingPort(mtglib.DefaultDomainFrontingPort),
+		DomainFrontingIP:            conf.GetDomainFrontingIP(nil),
+		DomainFrontingProxyProtocol: conf.GetDomainFrontingProxyProtocol(false),
+		PreferIP:                    conf.PreferIP.Get(mtglib.DefaultPreferIP),
+		AutoUpdate:                  conf.AutoUpdate.Get(false),
+
+		AllowFallbackOnUnknownDC: conf.AllowFallbackOnUnknownDC.Get(false),
+		TolerateTimeSkewness:     conf.TolerateTimeSkewness.Value,
+		IdleTimeout:              conf.Network.Timeout.Idle.Get(time.Minute),
+
+		DoppelGangerURLs:    doppelGangerURLs,
+		DoppelGangerPerRaid: conf.Defense.Doppelganger.Repeats.Get(mtglib.DoppelGangerPerRaid),
+		DoppelGangerEach:    conf.Defense.Doppelganger.UpdateEach.Get(mtglib.DoppelGangerEach),
+		DoppelGangerDRS:     conf.Defense.Doppelganger.DRS.Get(false),
+	}
+
+	proxy, err := mtglib.NewProxy(opts)
+	if err != nil {
+		return fmt.Errorf("cannot create a proxy: %w", err)
+	}
+
+	listener, err := utils.NewListener(conf.BindTo.Get(""), 0)
+	if err != nil {
+		return fmt.Errorf("cannot start proxy: %w", err)
+	}
+
+	if conf.ProxyProtocolListener.Get(false) {
+		listener = &proxyprotocol.ListenerAdapter{
+			Listener: proxyproto.Listener{
+				Listener: listener,
+			},
+		}
+	}
+
+	ctx := utils.RootContext()
+
+	go proxy.Serve(listener) //nolint: errcheck
+
+	<-ctx.Done()
+	listener.Close() //nolint: errcheck
+	proxy.Shutdown()
+
+	return nil
+}

internal/cli/simple_run.go

@@ -0,0 +1,96 @@
+package cli
+
+import (
+	"fmt"
+	"net"
+	"strconv"
+	"time"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+)
+
+type SimpleRun struct {
+	BindTo string `kong:"arg,required,name='bind-to',help='A host:port to bind proxy to.'"`
+	Secret string `kong:"arg,required,name='secret',help='Proxy secret.'"`
+
+	Debug               bool          `kong:"name='debug',short='d',help='Run in debug mode.'"`                                                                        //nolint: lll
+	Concurrency         uint64        `kong:"name='concurrency',short='c',default='8192',help='Max number of concurrent connection to proxy.'"`                        //nolint: lll
+	TCPBuffer           string        `kong:"name='tcp-buffer',short='b',default='4KB',help='Deprecated and ignored'"`                                                 //nolint: lll
+	PreferIP            string        `kong:"name='prefer-ip',short='i',default='prefer-ipv6',help='IP preference. By default we prefer IPv6 with fallback to IPv4.'"` //nolint: lll
+	DomainFrontingPort  uint64        `kong:"name='domain-fronting-port',short='p',default='443',help='A port to access for domain fronting.'"`                        //nolint: lll
+	DomainFrontingIP    string        `kong:"name='domain-fronting-ip',help='An IP address to use for domain fronting instead of resolving the hostname via DNS.'"`    //nolint: lll
+	DOHIP               net.IP        `kong:"name='doh-ip',short='n',default='1.1.1.1',help='IP address of DNS-over-HTTP to use.'"`                                    //nolint: lll
+	Timeout             time.Duration `kong:"name='timeout',short='t',default='10s',help='Network timeout to use'"`                                                    //nolint: lll
+	Socks5Proxies       []string      `kong:"name='socks5-proxy',short='s',help='Socks5 proxies to use for network access.'"`                                          //nolint: lll
+	AntiReplayCacheSize string        `kong:"name='antireplay-cache-size',short='a',default='1MB',help='A size of anti-replay cache to use.'"`                         //nolint: lll
+}
+
+func (s *SimpleRun) Run(cli *CLI, version string) error { //nolint: cyclop,funlen
+	conf := &config.Config{}
+
+	if err := conf.BindTo.Set(s.BindTo); err != nil {
+		return fmt.Errorf("incorrect bind-to parameter: %w", err)
+	}
+
+	if err := conf.Secret.Set(s.Secret); err != nil {
+		return fmt.Errorf("incorrect secret: %w", err)
+	}
+
+	if err := conf.Concurrency.Set(strconv.FormatUint(s.Concurrency, 10)); err != nil {
+		return fmt.Errorf("incorrect concurrency: %w", err)
+	}
+
+	if err := conf.PreferIP.Set(s.PreferIP); err != nil {
+		return fmt.Errorf("incorrect prefer-ip: %w", err)
+	}
+
+	if err := conf.DomainFrontingPort.Set(strconv.FormatUint(s.DomainFrontingPort, 10)); err != nil {
+		return fmt.Errorf("incorrect domain-fronting-port: %w", err)
+	}
+
+	if s.DomainFrontingIP != "" {
+		if err := conf.DomainFrontingIP.Set(s.DomainFrontingIP); err != nil {
+			return fmt.Errorf("incorrect domain-fronting-ip: %w", err)
+		}
+	}
+
+	if err := conf.Network.DOHIP.Set(s.DOHIP.String()); err != nil {
+		return fmt.Errorf("incorrect doh-ip: %w", err)
+	}
+
+	if err := conf.Network.Timeout.TCP.Set(s.Timeout.String()); err != nil {
+		return fmt.Errorf("incorrect timeout: %w", err)
+	}
+
+	if err := conf.Network.Timeout.HTTP.Set(s.Timeout.String()); err != nil {
+		return fmt.Errorf("incorrect timeout: %w", err)
+	}
+
+	if err := conf.Network.Timeout.Idle.Set(s.Timeout.String()); err != nil {
+		return fmt.Errorf("incorrect timeout: %w", err)
+	}
+
+	if err := conf.Defense.AntiReplay.MaxSize.Set(s.AntiReplayCacheSize); err != nil {
+		return fmt.Errorf("incorrect antireplay-cache-size: %w", err)
+	}
+
+	for _, v := range s.Socks5Proxies {
+		proxyURL := config.TypeProxyURL{}
+
+		if err := proxyURL.Set(v); err != nil {
+			return fmt.Errorf("incorrect socks5 proxy URL: %w", err)
+		}
+
+		conf.Network.Proxies = append(conf.Network.Proxies, proxyURL)
+	}
+
+	conf.Debug.Value = s.Debug
+	conf.AllowFallbackOnUnknownDC.Value = true
+	conf.Defense.AntiReplay.Enabled.Value = true
+
+	if err := conf.Validate(); err != nil {
+		return fmt.Errorf("invalid result configuration: %w", err)
+	}
+
+	return runProxy(conf, version)
+}

internal/cli/utils.go

@@ -0,0 +1,51 @@
+package cli
+
+import (
+	"context"
+	"io"
+	"net"
+	"net/http"
+	"strings"
+
+	"github.com/9seconds/mtg/v2/essentials"
+	"github.com/9seconds/mtg/v2/mtglib"
+)
+
+func getIP(ntw mtglib.Network, protocol string) net.IP {
+	dialer := ntw.NativeDialer()
+	client := ntw.MakeHTTPClient(func(ctx context.Context, network, address string) (essentials.Conn, error) {
+		conn, err := dialer.DialContext(ctx, protocol, address)
+		if err != nil {
+			return nil, err
+		}
+		return essentials.WrapNetConn(conn), err
+	})
+
+	req, err := http.NewRequest(http.MethodGet, "https://ifconfig.co", nil) //nolint: noctx
+	if err != nil {
+		panic(err)
+	}
+
+	req.Header.Add("Accept", "text/plain")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil
+	}
+
+	defer func() {
+		io.Copy(io.Discard, resp.Body) //nolint: errcheck
+		resp.Body.Close()              //nolint: errcheck
+	}()
+
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil
+	}
+
+	return net.ParseIP(strings.TrimSpace(string(data)))
+}

internal/config/config.go

@@ -0,0 +1,150 @@
+package config
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/url"
+
+	"github.com/9seconds/mtg/v2/mtglib"
+)
+
+type Optional struct {
+	Enabled TypeBool `json:"enabled"`
+}
+
+type ListConfig struct {
+	Optional
+
+	DownloadConcurrency TypeConcurrency    `json:"downloadConcurrency"`
+	URLs                []TypeBlocklistURI `json:"urls"`
+	UpdateEach          TypeDuration       `json:"updateEach"`
+}
+
+type Config struct {
+	Debug                       TypeBool        `json:"debug"`
+	AllowFallbackOnUnknownDC    TypeBool        `json:"allowFallbackOnUnknownDc"`
+	Secret                      mtglib.Secret   `json:"secret"`
+	BindTo                      TypeHostPort    `json:"bindTo"`
+	ProxyProtocolListener       TypeBool        `json:"proxyProtocolListener"`
+	PreferIP                    TypePreferIP    `json:"preferIp"`
+	AutoUpdate                  TypeBool        `json:"autoUpdate"`
+	DomainFrontingPort          TypePort        `json:"domainFrontingPort"`
+	DomainFrontingIP            TypeIP          `json:"domainFrontingIp"`
+	DomainFrontingProxyProtocol TypeBool        `json:"domainFrontingProxyProtocol"`
+	TolerateTimeSkewness        TypeDuration    `json:"tolerateTimeSkewness"`
+	Concurrency                 TypeConcurrency `json:"concurrency"`
+	PublicIPv4                  TypeIP          `json:"publicIpv4"`
+	PublicIPv6                  TypeIP          `json:"publicIpv6"`
+	DomainFronting              struct {
+		IP            TypeIP   `json:"ip"`
+		Port          TypePort `json:"port"`
+		ProxyProtocol TypeBool `json:"proxyProtocol"`
+	} `json:"domainFronting"`
+	Defense struct {
+		AntiReplay struct {
+			Optional
+
+			MaxSize   TypeBytes     `json:"maxSize"`
+			ErrorRate TypeErrorRate `json:"errorRate"`
+		} `json:"antiReplay"`
+		Blocklist    ListConfig `json:"blocklist"`
+		Allowlist    ListConfig `json:"allowlist"`
+		Doppelganger struct {
+			URLs            []TypeHttpsURL  `json:"urls"`
+			Repeats         TypeConcurrency `json:"repeats_per_raid"`
+			UpdateEach      TypeDuration    `json:"raid_each"`
+			DRS             TypeBool        `json:"drs"`
+		} `json:"doppelganger"`
+	} `json:"defense"`
+	Network struct {
+		Timeout struct {
+			TCP  TypeDuration `json:"tcp"`
+			HTTP TypeDuration `json:"http"`
+			Idle TypeDuration `json:"idle"`
+		} `json:"timeout"`
+		DOHIP   TypeIP         `json:"dohIp"`
+		DNS     TypeDNSURI     `json:"dns"`
+		Proxies []TypeProxyURL `json:"proxies"`
+	} `json:"network"`
+	Stats struct {
+		StatsD struct {
+			Optional
+
+			Address      TypeHostPort        `json:"address"`
+			MetricPrefix TypeMetricPrefix    `json:"metricPrefix"`
+			TagFormat    TypeStatsdTagFormat `json:"tagFormat"`
+		} `json:"statsd"`
+		Prometheus struct {
+			Optional
+
+			BindTo       TypeHostPort     `json:"bindTo"`
+			HTTPPath     TypeHTTPPath     `json:"httpPath"`
+			MetricPrefix TypeMetricPrefix `json:"metricPrefix"`
+		} `json:"prometheus"`
+	} `json:"stats"`
+}
+
+func (c *Config) GetConcurrency(defaultValue uint) uint {
+	if concurrency := c.Concurrency.Get(0); concurrency != 0 {
+		return concurrency
+	}
+	return c.Concurrency.Get(defaultValue)
+}
+
+func (c *Config) GetDNS() *url.URL {
+	var dohURL *url.URL
+
+	if dohIP := c.Network.DOHIP.Get(nil); dohIP != nil {
+		dohURL, _ = url.Parse("https://" + dohIP.String())
+	}
+
+	return c.Network.DNS.Get(dohURL)
+}
+
+func (c *Config) GetDomainFrontingPort(defaultValue uint) uint {
+	if port := c.DomainFronting.Port.Get(0); port != 0 {
+		return port
+	}
+	return c.DomainFrontingPort.Get(defaultValue)
+}
+
+func (c *Config) GetDomainFrontingIP(defaultValue net.IP) string {
+	if ip := c.DomainFronting.IP.Get(nil); ip != nil {
+		return ip.String()
+	}
+	if ip := c.DomainFrontingIP.Get(defaultValue); ip != nil {
+		return ip.String()
+	}
+	return ""
+}
+
+func (c *Config) GetDomainFrontingProxyProtocol(defaultValue bool) bool {
+	return c.DomainFronting.ProxyProtocol.Get(false) || c.DomainFrontingProxyProtocol.Get(defaultValue)
+}
+
+func (c *Config) Validate() error {
+	if !c.Secret.Valid() {
+		return fmt.Errorf("invalid secret %s", c.Secret.String())
+	}
+
+	if c.BindTo.Get("") == "" {
+		return fmt.Errorf("incorrect bind-to parameter %s", c.BindTo.String())
+	}
+
+	return nil
+}
+
+func (c *Config) String() string {
+	buf := &bytes.Buffer{}
+	encoder := json.NewEncoder(buf)
+
+	encoder.SetEscapeHTML(false)
+
+	if err := encoder.Encode(c); err != nil {
+		panic(err)
+	}
+
+	return buf.String()
+}

internal/config/config_test.go

@@ -0,0 +1,80 @@
+package config_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/suite"
+)
+
+type ConfigTestSuite struct {
+	suite.Suite
+}
+
+func (suite *ConfigTestSuite) ReadConfig(filename string) []byte {
+	data, err := os.ReadFile(filepath.Join("testdata", filename))
+	suite.NoError(err)
+
+	return data
+}
+
+func (suite *ConfigTestSuite) TestParseEmpty() {
+	_, err := config.Parse([]byte{})
+	suite.Error(err)
+}
+
+func (suite *ConfigTestSuite) TestParseBrokenToml() {
+	_, err := config.Parse(suite.ReadConfig("broken.toml"))
+	suite.Error(err)
+}
+
+func (suite *ConfigTestSuite) TestParseOnlySecret() {
+	_, err := config.Parse(suite.ReadConfig("only_secret.toml"))
+	suite.Error(err)
+}
+
+func (suite *ConfigTestSuite) TestParseMinimalConfig() {
+	conf, err := config.Parse(suite.ReadConfig("minimal.toml"))
+	suite.NoError(err)
+	suite.Equal("7oe1GqLy6TBc38CV3jx7q09nb29nbGUuY29t", conf.Secret.Base64())
+	suite.Equal("0.0.0.0:3128", conf.BindTo.String())
+}
+
+func (suite *ConfigTestSuite) TestParsePublicIP() {
+	conf, err := config.Parse(suite.ReadConfig("public_ip.toml"))
+	suite.NoError(err)
+	suite.Equal("203.0.113.1", conf.PublicIPv4.Get(nil).String())
+	suite.Equal("2001:db8::1", conf.PublicIPv6.Get(nil).String())
+}
+
+func (suite *ConfigTestSuite) TestParsePublicIPv4Only() {
+	conf, err := config.Parse(suite.ReadConfig("public_ip_v4_only.toml"))
+	suite.NoError(err)
+	suite.Equal("203.0.113.1", conf.PublicIPv4.Get(nil).String())
+	suite.Nil(conf.PublicIPv6.Get(nil))
+}
+
+func (suite *ConfigTestSuite) TestParsePublicIPInvalid() {
+	_, err := config.Parse(suite.ReadConfig("public_ip_invalid.toml"))
+	suite.Error(err)
+}
+
+func (suite *ConfigTestSuite) TestParsePublicIPNotSet() {
+	conf, err := config.Parse(suite.ReadConfig("minimal.toml"))
+	suite.NoError(err)
+	suite.Nil(conf.PublicIPv4.Get(nil))
+	suite.Nil(conf.PublicIPv6.Get(nil))
+}
+
+func (suite *ConfigTestSuite) TestString() {
+	conf, err := config.Parse(suite.ReadConfig("minimal.toml"))
+	suite.NoError(err)
+	suite.NotEmpty(conf.String())
+}
+
+func TestConfig(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &ConfigTestSuite{})
+}

internal/config/parse.go

@@ -0,0 +1,104 @@
+package config
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+
+	"github.com/pelletier/go-toml/v2"
+)
+
+type tomlConfig struct {
+	Debug                       bool   `toml:"debug" json:"debug,omitempty"`
+	AllowFallbackOnUnknownDC    bool   `toml:"allow-fallback-on-unknown-dc" json:"allowFallbackOnUnknownDc,omitempty"`
+	Secret                      string `toml:"secret" json:"secret"`
+	BindTo                      string `toml:"bind-to" json:"bindTo"`
+	ProxyProtocolListener       bool   `toml:"proxy-protocol-listener" json:"proxyProtocolListener"`
+	PreferIP                    string `toml:"prefer-ip" json:"preferIp,omitempty"`
+	AutoUpdate                  bool   `toml:"auto-update" json:"autoUpdate,omitempty"`
+	DomainFrontingPort          uint   `toml:"domain-fronting-port" json:"domainFrontingPort,omitempty"`
+	DomainFrontingIP            string `toml:"domain-fronting-ip" json:"domainFrontingIp,omitempty"`
+	DomainFrontingProxyProtocol bool   `toml:"domain-fronting-proxy-protocol" json:"domainFrontingProxyProtocol,omitempty"`
+	TolerateTimeSkewness        string `toml:"tolerate-time-skewness" json:"tolerateTimeSkewness,omitempty"`
+	Concurrency                 uint   `toml:"concurrency" json:"concurrency,omitempty"`
+	PublicIPv4                  string `toml:"public-ipv4" json:"publicIpv4,omitempty"`
+	PublicIPv6                  string `toml:"public-ipv6" json:"publicIpv6,omitempty"`
+	DomainFronting              struct {
+		IP            string `toml:"ip" json:"ip,omitempty"`
+		Port          uint   `toml:"port" json:"port,omitempty"`
+		ProxyProtocol bool   `toml:"proxy-protocol" json:"proxyProtocol,omitempty"`
+	} `toml:"domain-fronting" json:"domainFronting,omitempty"`
+	Defense struct {
+		AntiReplay struct {
+			Enabled   bool    `toml:"enabled" json:"enabled,omitempty"`
+			MaxSize   string  `toml:"max-size" json:"maxSize,omitempty"`
+			ErrorRate float64 `toml:"error-rate" json:"errorRate,omitempty"`
+		} `toml:"anti-replay" json:"antiReplay,omitempty"`
+		Blocklist struct {
+			Enabled             bool     `toml:"enabled" json:"enabled,omitempty"`
+			DownloadConcurrency uint     `toml:"download-concurrency" json:"downloadConcurrency,omitempty"`
+			URLs                []string `toml:"urls" json:"urls,omitempty"`
+			UpdateEach          string   `toml:"update-each" json:"updateEach,omitempty"`
+		} `toml:"blocklist" json:"blocklist,omitempty"`
+		Allowlist struct {
+			Enabled             bool     `toml:"enabled" json:"enabled,omitempty"`
+			DownloadConcurrency uint     `toml:"download-concurrency" json:"downloadConcurrency,omitempty"`
+			URLs                []string `toml:"urls" json:"urls,omitempty"`
+			UpdateEach          string   `toml:"update-each" json:"updateEach,omitempty"`
+		} `toml:"allowlist" json:"allowlist,omitempty"`
+		Doppelganger struct {
+			URLs            []string `toml:"urls" json:"urls,omitempty"`
+			Repeats         uint     `toml:"repeats-per-raid" json:"repeats_per_raid,omitempty"`
+			UpdateEach      string   `toml:"raid-each" json:"raid_each,omitempty"`
+			DRS             bool     `toml:"drs" json:"drs,omitempty"`
+		} `toml:"doppelganger" json:"doppelganger,omitempty"`
+	} `toml:"defense" json:"defense,omitempty"`
+	Network struct {
+		Timeout struct {
+			TCP  string `toml:"tcp" json:"tcp,omitempty"`
+			HTTP string `toml:"http" json:"http,omitempty"`
+			Idle string `toml:"idle" json:"idle,omitempty"`
+		} `toml:"timeout" json:"timeout,omitempty"`
+		DOHIP   string   `toml:"doh-ip" json:"dohIp,omitempty"`
+		DNS     string   `toml:"dns" json:"dns,omitempty"`
+		Proxies []string `toml:"proxies" json:"proxies,omitempty"`
+	} `toml:"network" json:"network,omitempty"`
+	Stats struct {
+		StatsD struct {
+			Enabled      bool   `toml:"enabled" json:"enabled,omitempty"`
+			Address      string `toml:"address" json:"address,omitempty"`
+			MetricPrefix string `toml:"metric-prefix" json:"metricPrefix,omitempty"`
+			TagFormat    string `toml:"tag-format" json:"tagFormat,omitempty"`
+		} `toml:"statsd" json:"statsd,omitempty"`
+		Prometheus struct {
+			Enabled      bool   `toml:"enabled" json:"enabled,omitempty"`
+			BindTo       string `toml:"bind-to" json:"bindTo,omitempty"`
+			HTTPPath     string `toml:"http-path" json:"httpPath,omitempty"`
+			MetricPrefix string `toml:"metric-prefix" json:"metricPrefix,omitempty"`
+		} `toml:"prometheus" json:"prometheus,omitempty"`
+	} `toml:"stats" json:"stats,omitempty"`
+}
+
+func Parse(rawData []byte) (*Config, error) {
+	tomlConf := &tomlConfig{}
+	jsonBuf := &bytes.Buffer{}
+	conf := &Config{}
+
+	jsonEncoder := json.NewEncoder(jsonBuf)
+	jsonEncoder.SetEscapeHTML(false)
+	jsonEncoder.SetIndent("", "")
+
+	if err := toml.Unmarshal(rawData, tomlConf); err != nil {
+		return nil, fmt.Errorf("cannot parse toml config: %w", err)
+	}
+
+	if err := jsonEncoder.Encode(tomlConf); err != nil {
+		panic(err)
+	}
+
+	if err := json.NewDecoder(jsonBuf).Decode(conf); err != nil {
+		return nil, fmt.Errorf("cannot parse a config: %w", err)
+	}
+
+	return conf, nil
+}

internal/config/testdata/broken.toml

@@ -0,0 +1 @@
+s = sdfsdfds

internal/config/testdata/minimal.toml

@@ -0,0 +1,2 @@
+secret = "7oe1GqLy6TBc38CV3jx7q09nb29nbGUuY29t"
+bind-to = "0.0.0.0:3128"

internal/config/testdata/only_secret.toml

@@ -0,0 +1 @@
+secret = "7oe1GqLy6TBc38CV3jx7q09nb29nbGUuY29t"

internal/config/testdata/public_ip.toml

@@ -0,0 +1,4 @@
+secret = "7oe1GqLy6TBc38CV3jx7q09nb29nbGUuY29t"
+bind-to = "0.0.0.0:3128"
+public-ipv4 = "203.0.113.1"
+public-ipv6 = "2001:db8::1"

internal/config/testdata/public_ip_invalid.toml

@@ -0,0 +1,3 @@
+secret = "7oe1GqLy6TBc38CV3jx7q09nb29nbGUuY29t"
+bind-to = "0.0.0.0:3128"
+public-ipv4 = "not-an-ip"

internal/config/testdata/public_ip_v4_only.toml

@@ -0,0 +1,3 @@
+secret = "7oe1GqLy6TBc38CV3jx7q09nb29nbGUuY29t"
+bind-to = "0.0.0.0:3128"
+public-ipv4 = "203.0.113.1"

internal/config/type_blocklist_uri.go

@@ -0,0 +1,77 @@
+package config
+
+import (
+	"fmt"
+	"net/url"
+	"os"
+	"path/filepath"
+)
+
+type TypeBlocklistURI struct {
+	Value string
+}
+
+func (t *TypeBlocklistURI) Set(value string) error {
+	if stat, err := os.Stat(value); err == nil || os.IsExist(err) {
+		switch {
+		case stat.IsDir():
+			return fmt.Errorf("value is correct filepath but directory")
+		case stat.Mode().Perm()&0o400 == 0:
+			return fmt.Errorf("value is correct filepath but not readable")
+		}
+
+		value, err = filepath.Abs(value)
+		if err != nil {
+			return fmt.Errorf(
+				"value is correct filepath but cannot resolve absolute (%s): %w",
+				value, err)
+		}
+
+		t.Value = value
+
+		return nil
+	}
+
+	parsedURL, err := url.Parse(value)
+	if err != nil {
+		return fmt.Errorf("incorrect url (%s): %w", value, err)
+	}
+
+	switch parsedURL.Scheme {
+	case "http", "https":
+	default:
+		return fmt.Errorf("unknown schema %s (%s)", parsedURL.Scheme, value)
+	}
+
+	if parsedURL.Host == "" {
+		return fmt.Errorf("incorrect url %s", value)
+	}
+
+	t.Value = parsedURL.String()
+
+	return nil
+}
+
+func (t TypeBlocklistURI) Get(defaultValue string) string {
+	if t.Value == "" {
+		return defaultValue
+	}
+
+	return t.Value
+}
+
+func (t TypeBlocklistURI) IsRemote() bool {
+	return !filepath.IsAbs(t.Value)
+}
+
+func (t *TypeBlocklistURI) UnmarshalText(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypeBlocklistURI) MarshalText() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypeBlocklistURI) String() string {
+	return t.Value
+}

internal/config/type_blocklist_uri_test.go

@@ -0,0 +1,113 @@
+package config_test
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeBlocklistURITestStruct struct {
+	Value config.TypeBlocklistURI `json:"value"`
+}
+
+type TypeBlocklistURITestSuite struct {
+	suite.Suite
+
+	directory    string
+	absDirectory string
+}
+
+func (suite *TypeBlocklistURITestSuite) SetupSuite() {
+	dir, _ := os.Getwd()
+	absDir, _ := filepath.Abs(dir)
+
+	suite.directory = dir
+	suite.absDirectory = absDir
+}
+
+func (suite *TypeBlocklistURITestSuite) TestUnmarshalFail() {
+	testData := []string{
+		"gopher://lalala",
+		"https:///paths",
+		"h:/=",
+		filepath.Join(suite.directory, "___"),
+		filepath.Join(suite.absDirectory, "___"),
+		suite.directory,
+		suite.absDirectory,
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typeBlocklistURITestStruct{}))
+		})
+	}
+}
+
+func (suite *TypeBlocklistURITestSuite) TestUnmarshalOk() {
+	testData := []string{
+		"http://lalala",
+		"https://lalala",
+		"https://lalala/path",
+		filepath.Join(suite.directory, "config.go"),
+		filepath.Join(suite.absDirectory, "config.go"),
+	}
+
+	for _, v := range testData {
+		value := v
+
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			testStruct := &typeBlocklistURITestStruct{}
+
+			assert.NoError(t, json.Unmarshal(data, testStruct))
+			assert.EqualValues(t, value, testStruct.Value.Get(""))
+
+			if strings.HasPrefix(value, "http") {
+				assert.True(t, testStruct.Value.IsRemote())
+			} else {
+				assert.False(t, testStruct.Value.IsRemote())
+			}
+		})
+	}
+}
+
+func (suite *TypeBlocklistURITestSuite) TestMarshalOk() {
+	testStruct := &typeBlocklistURITestStruct{
+		Value: config.TypeBlocklistURI{
+			Value: "http://some.url/with/path",
+		},
+	}
+
+	data, err := json.Marshal(testStruct)
+	suite.NoError(err)
+	suite.JSONEq(`{"value": "http://some.url/with/path"}`, string(data))
+}
+
+func (suite *TypeBlocklistURITestSuite) TestGet() {
+	value := config.TypeBlocklistURI{}
+	suite.Equal("/path", value.Get("/path"))
+
+	suite.NoError(value.Set("http://lalala.ru"))
+	suite.Equal("http://lalala.ru", value.Get("/path"))
+	suite.Equal("http://lalala.ru", value.Get(""))
+}
+
+func TestTypeBlocklistURI(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &TypeBlocklistURITestSuite{})
+}

internal/config/type_bool.go

@@ -0,0 +1,37 @@
+package config
+
+import (
+	"fmt"
+	"strconv"
+)
+
+type TypeBool struct {
+	Value bool
+}
+
+func (t *TypeBool) Set(data string) error {
+	parsed, err := strconv.ParseBool(data)
+	if err != nil {
+		return fmt.Errorf("incorrect bool value: %s", data)
+	}
+
+	t.Value = parsed
+
+	return nil
+}
+
+func (t TypeBool) Get(defaultValue bool) bool {
+	return t.Value || defaultValue
+}
+
+func (t *TypeBool) UnmarshalJSON(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypeBool) MarshalJSON() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypeBool) String() string {
+	return strconv.FormatBool(t.Value)
+}

internal/config/type_bool_test.go

@@ -0,0 +1,107 @@
+package config_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeBoolTestStruct struct {
+	Value config.TypeBool `json:"value"`
+}
+
+type TypeBoolTestSuite struct {
+	suite.Suite
+}
+
+func (suite *TypeBoolTestSuite) TestUnmarshalFail() {
+	testData := []any{
+		"",
+		"np",
+		"нет",
+		int(10),
+		[]int{},
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]any{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(fmt.Sprintf("%v", v), func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typeBoolTestStruct{}))
+		})
+	}
+}
+
+func (suite *TypeBoolTestSuite) TestUnmarshalOk() {
+	testData := []bool{
+		true,
+		false,
+	}
+
+	for _, v := range testData {
+		value := v
+
+		data, err := json.Marshal(map[string]bool{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(strconv.FormatBool(v), func(t *testing.T) {
+			testStruct := &typeBoolTestStruct{}
+			assert.NoError(t, json.Unmarshal(data, testStruct))
+
+			if value {
+				assert.True(t, testStruct.Value.Value)
+			} else {
+				assert.False(t, testStruct.Value.Value)
+			}
+		})
+	}
+}
+
+func (suite *TypeBoolTestSuite) TestMarshalOk() {
+	for _, v := range []bool{true, false} {
+		value := v
+
+		suite.T().Run(strconv.FormatBool(v), func(t *testing.T) {
+			testStruct := typeBoolTestStruct{
+				Value: config.TypeBool{
+					Value: value,
+				},
+			}
+
+			encodedJSON, err := json.Marshal(testStruct)
+			assert.NoError(t, err)
+
+			expectedJSON, err := json.Marshal(map[string]bool{
+				"value": value,
+			})
+			assert.NoError(t, err)
+
+			assert.JSONEq(t, string(expectedJSON), string(encodedJSON))
+		})
+	}
+}
+
+func (suite *TypeBoolTestSuite) TestGet() {
+	value := config.TypeBool{}
+	suite.False(value.Get(false))
+	suite.True(value.Get(true))
+
+	value.Value = true
+	suite.True(value.Get(false))
+	suite.True(value.Get(true))
+}
+
+func TestTypeBool(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &TypeBoolTestSuite{})
+}

internal/config/type_bytes.go

@@ -0,0 +1,55 @@
+package config
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/alecthomas/units"
+)
+
+var typeBytesStringCleaner = strings.NewReplacer(" ", "", "\t", "", "IB", "iB")
+
+type TypeBytes struct {
+	Value units.Base2Bytes
+}
+
+func (t *TypeBytes) Set(value string) error {
+	normalizedValue := typeBytesStringCleaner.Replace(strings.ToUpper(value))
+
+	parsedValue, err := units.ParseBase2Bytes(normalizedValue)
+	if err != nil {
+		return fmt.Errorf("incorrect bytes value (%v): %w", value, err)
+	}
+
+	if parsedValue < 0 {
+		return fmt.Errorf("bytes should be positive (%s)", value)
+	}
+
+	t.Value = parsedValue
+
+	return nil
+}
+
+func (t TypeBytes) Get(defaultValue uint) uint {
+	if t.Value == 0 {
+		return defaultValue
+	}
+
+	return uint(t.Value)
+}
+
+func (t *TypeBytes) UnmarshalText(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypeBytes) MarshalText() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypeBytes) String() string {
+	if t.Value == 0 {
+		return ""
+	}
+
+	return strings.ToLower(t.Value.String())
+}

internal/config/type_bytes_test.go

@@ -0,0 +1,86 @@
+package config_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeBytesTestStruct struct {
+	Value config.TypeBytes `json:"value"`
+}
+
+type TypeBytesTestSuite struct {
+	suite.Suite
+}
+
+func (suite *TypeBytesTestSuite) TestUnmarshalFail() {
+	testData := []string{
+		"1m",
+		"1",
+		"-1kb",
+		"-1kib",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typeBytesTestStruct{}))
+		})
+	}
+}
+
+func (suite *TypeBytesTestSuite) TestUnmarshalOk() {
+	testData := map[string]uint{
+		"1b":   1,
+		"1kb":  1024,
+		"1kib": 1024,
+		"2mb":  2 * 1024 * 1024,
+		"2mib": 2 * 1024 * 1024,
+	}
+
+	for k, v := range testData {
+		value := v
+
+		data, err := json.Marshal(map[string]string{
+			"value": k,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(k, func(t *testing.T) {
+			testStruct := &typeBytesTestStruct{}
+
+			assert.NoError(t, json.Unmarshal(data, testStruct))
+			assert.EqualValues(t, value, testStruct.Value.Get(0))
+		})
+	}
+}
+
+func (suite *TypeBytesTestSuite) TestMarshalOk() {
+	value := typeBytesTestStruct{}
+	suite.NoError(value.Value.Set("1kib"))
+
+	data, err := json.Marshal(value)
+	suite.NoError(err)
+	suite.JSONEq(`{"value": "1kib"}`, string(data))
+}
+
+func (suite *TypeBytesTestSuite) TestGet() {
+	value := config.TypeBytes{}
+	suite.EqualValues(1000, value.Get(1000))
+
+	suite.NoError(value.Set("1mib"))
+	suite.EqualValues(1048576, value.Get(1000))
+}
+
+func TestTypeBytes(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &TypeBytesTestSuite{})
+}

internal/config/type_concurrency.go

@@ -0,0 +1,45 @@
+package config
+
+import (
+	"fmt"
+	"strconv"
+)
+
+type TypeConcurrency struct {
+	Value uint
+}
+
+func (t *TypeConcurrency) Set(value string) error {
+	concurrencyValue, err := strconv.ParseUint(value, 10, 16)
+	if err != nil {
+		return fmt.Errorf("value is not uint (%s): %w", value, err)
+	}
+
+	if concurrencyValue == 0 {
+		return fmt.Errorf("value should be >0 (%s)", value)
+	}
+
+	t.Value = uint(concurrencyValue)
+
+	return nil
+}
+
+func (t TypeConcurrency) Get(defaultValue uint) uint {
+	if t.Value == 0 {
+		return defaultValue
+	}
+
+	return t.Value
+}
+
+func (t *TypeConcurrency) UnmarshalJSON(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypeConcurrency) MarshalJSON() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypeConcurrency) String() string {
+	return strconv.FormatUint(uint64(t.Value), 10)
+}

internal/config/type_concurrency_test.go

@@ -0,0 +1,73 @@
+package config_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeConcurrencyTestStruct struct {
+	Value config.TypeConcurrency `json:"value"`
+}
+
+type TypeConcurrencyTestSuite struct {
+	suite.Suite
+}
+
+func (suite *TypeConcurrencyTestSuite) TestUnmarshalFail() {
+	testData := []string{
+		"-1",
+		"0",
+		"0.0",
+		"1.0",
+		"1.1",
+		".",
+		"some_value",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typeConcurrencyTestStruct{}))
+		})
+	}
+}
+
+func (suite *TypeConcurrencyTestSuite) TestUnmarshalOk() {
+	testStruct := &typeConcurrencyTestStruct{}
+
+	suite.NoError(json.Unmarshal([]byte(`{"value": 1}`), testStruct))
+	suite.EqualValues(1, testStruct.Value.Get(2))
+}
+
+func (suite *TypeConcurrencyTestSuite) TestMarshalOk() {
+	testStruct := &typeConcurrencyTestStruct{
+		Value: config.TypeConcurrency{
+			Value: 2,
+		},
+	}
+
+	data, err := json.Marshal(testStruct)
+	suite.NoError(err)
+	suite.JSONEq(`{"value": 2}`, string(data))
+}
+
+func (suite *TypeConcurrencyTestSuite) TestGet() {
+	value := config.TypeConcurrency{}
+	suite.EqualValues(1, value.Get(1))
+
+	value.Value = 3
+	suite.EqualValues(3, value.Get(1))
+}
+
+func TestTypeConcurrency(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &TypeConcurrencyTestSuite{})
+}

internal/config/type_dc.go

@@ -0,0 +1,41 @@
+package config
+
+import (
+	"fmt"
+	"strconv"
+)
+
+type TypeDC struct {
+	Value int
+}
+
+func (t *TypeDC) Set(value string) error {
+	parsed, err := strconv.ParseInt(value, 10, 16)
+	if err != nil {
+		return fmt.Errorf("cannot parse dc: %w", err)
+	}
+
+	if parsed < 0 {
+		parsed = -parsed
+	}
+
+	t.Value = int(parsed)
+
+	return nil
+}
+
+func (t *TypeDC) UnmarshalJSON(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypeDC) MarshalJSON() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypeDC) String() string {
+	return strconv.Itoa(t.Value)
+}
+
+func (t TypeDC) Get() int {
+	return t.Value
+}

internal/config/type_dc_test.go

@@ -0,0 +1,96 @@
+package config_test
+
+import (
+	"encoding/json"
+	"strconv"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeDCTestStruct struct {
+	Value config.TypeDC `json:"value"`
+}
+
+type TypeDCTestSuite struct {
+	suite.Suite
+}
+
+func (suite *TypeDCTestSuite) TestUnmarshalFail() {
+	testData := []string{
+		"-1s",
+		"1202002020202",
+		"xxx",
+		"-11111111111111",
+		"",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typeDCTestStruct{}))
+		})
+	}
+}
+
+func (suite *TypeDCTestSuite) TestUnmarshalOk() {
+	testData := map[int]int{
+		1:   1,
+		-1:  1,
+		203: 203,
+	}
+
+	for value, expected := range testData {
+		data, err := json.Marshal(map[string]int{
+			"value": value,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(strconv.Itoa(value), func(t *testing.T) {
+			testStruct := &typeDCTestStruct{}
+
+			assert.NoError(t, json.Unmarshal(data, testStruct))
+			assert.Equal(t, expected, testStruct.Value.Value)
+			assert.Equal(t, expected, testStruct.Value.Get())
+		})
+	}
+}
+
+func (suite *TypeDCTestSuite) TestMarshalOk() {
+	testData := map[string]int{
+		"1":   1,
+		"203": 203,
+	}
+
+	for k, v := range testData {
+		value := k
+		expected := v
+
+		suite.T().Run(value, func(t *testing.T) {
+			testStruct := &typeDCTestStruct{}
+
+			assert.NoError(t, testStruct.Value.Set(value))
+
+			data, err := json.Marshal(testStruct)
+			assert.NoError(t, err)
+
+			expectedJSON, err := json.Marshal(map[string]int{
+				"value": expected,
+			})
+			assert.NoError(t, err)
+
+			assert.JSONEq(t, string(expectedJSON), string(data))
+		})
+	}
+}
+
+func TestTypeDC(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &TypeDCTestSuite{})
+}

internal/config/type_dns_uri.go

@@ -0,0 +1,69 @@
+package config
+
+import (
+	"fmt"
+	"net"
+	"net/url"
+)
+
+type TypeDNSURI struct {
+	Value *url.URL
+}
+
+func (t *TypeDNSURI) Set(value string) error {
+	parsed, err := url.Parse(value)
+	if err != nil {
+		return fmt.Errorf("value is not URI: %w", err)
+	}
+
+	if parsed.Host == "" {
+		parsed.Host = parsed.Path
+		parsed.Path = ""
+		parsed.Scheme = "udp"
+	}
+
+	switch parsed.Scheme {
+	case "https", "tls":
+	case "udp":
+		if ip := net.ParseIP(parsed.Hostname()); ip == nil {
+			return fmt.Errorf("simple DNS must IP address: %s", parsed.Hostname())
+		}
+	default:
+		return fmt.Errorf("unsupported DNS type %s", parsed.Scheme)
+	}
+
+	if parsed.Scheme != "https" && parsed.Path != "" {
+		return fmt.Errorf("path is supported only for DoH: %s", parsed)
+	}
+
+	if parsed.User != nil {
+		return fmt.Errorf("used info is not supported: %s", parsed.User.String())
+	}
+
+	t.Value = parsed
+
+	return nil
+}
+
+func (t *TypeDNSURI) Get(defaultValue *url.URL) *url.URL {
+	if t.Value != nil {
+		return t.Value
+	}
+
+	return defaultValue
+}
+
+func (t *TypeDNSURI) UnmarshalText(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypeDNSURI) MarshalText() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypeDNSURI) String() string {
+	if t.Value == nil {
+		return ""
+	}
+	return t.Value.String()
+}

internal/config/type_dns_uri_test.go

@@ -0,0 +1,117 @@
+package config_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeDNSURITestStruct struct {
+	Value config.TypeDNSURI `json:"value"`
+}
+
+type TypeDNSURITestSuite struct {
+	suite.Suite
+}
+
+func (suite *TypeDNSURITestSuite) TestUnmarshalFail() {
+	testData := []string{
+		"xx",
+		"ppar",
+		"",
+		"dns://hahaha",
+		"udp://xcxxcv",
+		"udp://1.1.1.1/xcv",
+		"1.1.1.1/xxx",
+		"tls://dns/xx",
+		"tls://1.1.1.1/xx",
+		"https://user:password@1.1.1.1",
+		"tls://user:password@1.1.1.1",
+		"udp://user:password@1.1.1.1",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typeDNSURITestStruct{}))
+		})
+	}
+}
+
+func (suite *TypeDNSURITestSuite) TestUnmarshalOk() {
+	testData := []string{
+		"1.1.1.1",
+		"tls://1.1.1.1",
+		"tls://dns.google",
+		"https://1.1.1.1",
+		"https://1.1.1.1/dns-query",
+		"https://dns.google",
+		"https://dns.google/dns-query",
+		"udp://1.1.1.1",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			testStruct := &typeDNSURITestStruct{}
+			assert.NoError(t, json.Unmarshal(data, testStruct))
+			if v == "1.1.1.1" {
+				v = "udp://" + v
+			}
+			assert.Equal(t, v, testStruct.Value.String())
+		})
+	}
+}
+
+func (suite *TypeDNSURITestSuite) TestMarshalOk() {
+	testData := []string{
+		"tls://1.1.1.1",
+		"tls://dns.google",
+		"https://1.1.1.1",
+		"https://1.1.1.1/dns-query",
+	}
+
+	for _, v := range testData {
+		suite.T().Run(v, func(t *testing.T) {
+			testStruct := &typePreferIPTestStruct{
+				Value: config.TypePreferIP{
+					Value: v,
+				},
+			}
+
+			encodedJSON, err := json.Marshal(testStruct)
+			assert.NoError(t, err)
+
+			expectedJSON, err := json.Marshal(map[string]string{
+				"value": v,
+			})
+			assert.NoError(t, err)
+
+			assert.JSONEq(t, string(expectedJSON), string(encodedJSON))
+		})
+	}
+}
+
+func (suite *TypeDNSURITestSuite) TestGet() {
+	value := config.TypeDNSURI{}
+	suite.Nil(value.Get(nil))
+
+	suite.NoError(value.Set("tls://1.1.1.1"))
+	suite.NotNil(value.Get(nil))
+}
+
+func TestDNSURI(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &TypeDNSURITestSuite{})
+}

internal/config/type_duration.go

@@ -0,0 +1,53 @@
+package config
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+var typeDurationStringCleaner = strings.NewReplacer(" ", "", "\t", "")
+
+type TypeDuration struct {
+	Value time.Duration
+}
+
+func (t *TypeDuration) Set(value string) error {
+	parsedValue, err := time.ParseDuration(
+		typeDurationStringCleaner.Replace(strings.ToLower(value)))
+	if err != nil {
+		return fmt.Errorf("incorrect duration (%s): %w", value, err)
+	}
+
+	if parsedValue < 0 {
+		return fmt.Errorf("duration has to be a positive: %s", value)
+	}
+
+	t.Value = parsedValue
+
+	return nil
+}
+
+func (t TypeDuration) Get(defaultValue time.Duration) time.Duration {
+	if t.Value == 0 {
+		return defaultValue
+	}
+
+	return t.Value
+}
+
+func (t *TypeDuration) UnmarshalText(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypeDuration) MarshalText() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypeDuration) String() string {
+	if t.Value == 0 {
+		return ""
+	}
+
+	return t.Value.String()
+}

internal/config/type_duration_test.go

@@ -0,0 +1,110 @@
+package config_test
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeDurationTestStruct struct {
+	Value config.TypeDuration `json:"value"`
+}
+
+type TypeDurationTestSuite struct {
+	suite.Suite
+}
+
+func (suite *TypeDurationTestSuite) TestUnmarshalFail() {
+	testData := []string{
+		"-1s",
+		"1 seconds ago",
+		"1s ago",
+		"",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typeDurationTestStruct{}))
+		})
+	}
+}
+
+func (suite *TypeDurationTestSuite) TestUnmarshalOk() {
+	testData := map[string]time.Duration{
+		"1s":   time.Second,
+		"0":    0 * time.Second,
+		"0s":   0 * time.Second,
+		"1\tM": time.Minute,
+		"1H":   time.Hour,
+		"1 h":  time.Hour,
+	}
+
+	for k, v := range testData {
+		value := v
+
+		data, err := json.Marshal(map[string]string{
+			"value": k,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(k, func(t *testing.T) {
+			testStruct := &typeDurationTestStruct{}
+
+			assert.NoError(t, json.Unmarshal(data, testStruct))
+			assert.Equal(t, value, testStruct.Value.Value)
+		})
+	}
+}
+
+func (suite *TypeDurationTestSuite) TestMarshalOk() {
+	testData := map[string]string{
+		"1s":  "1s",
+		"0":   "",
+		"0s":  "",
+		"0ms": "",
+		"1 H": "1h0m0s",
+	}
+
+	for k, v := range testData {
+		value := k
+		expected := v
+
+		suite.T().Run(value, func(t *testing.T) {
+			testStruct := &typeDurationTestStruct{}
+
+			assert.NoError(t, testStruct.Value.Set(value))
+
+			data, err := json.Marshal(testStruct)
+			assert.NoError(t, err)
+
+			expectedJSON, err := json.Marshal(map[string]string{
+				"value": expected,
+			})
+			assert.NoError(t, err)
+
+			assert.JSONEq(t, string(expectedJSON), string(data))
+		})
+	}
+}
+
+func (suite *TypeDurationTestSuite) TestGet() {
+	value := config.TypeDuration{}
+	suite.Equal(time.Second, value.Get(time.Second))
+
+	value.Value = 3 * time.Second
+	suite.Equal(3*time.Second, value.Get(time.Hour))
+}
+
+func TestTypeDuration(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &TypeDurationTestSuite{})
+}

internal/config/type_error_rate.go

@@ -0,0 +1,47 @@
+package config
+
+import (
+	"fmt"
+	"strconv"
+)
+
+const typeErrorRateIgnoreLess = 1e-8
+
+type TypeErrorRate struct {
+	Value float64
+}
+
+func (t *TypeErrorRate) Set(value string) error {
+	parsedValue, err := strconv.ParseFloat(value, 64)
+	if err != nil {
+		return fmt.Errorf("value is not a float (%s): %w", value, err)
+	}
+
+	if parsedValue <= 0.0 || parsedValue >= 100.0 {
+		return fmt.Errorf("value should be 0 < x < 100 (%s)", value)
+	}
+
+	t.Value = parsedValue
+
+	return nil
+}
+
+func (t TypeErrorRate) Get(defaultValue float64) float64 {
+	if t.Value < typeErrorRateIgnoreLess {
+		return defaultValue
+	}
+
+	return t.Value
+}
+
+func (t *TypeErrorRate) UnmarshalJSON(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypeErrorRate) MarshalJSON() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypeErrorRate) String() string {
+	return strconv.FormatFloat(t.Value, 'f', -1, 64)
+}

internal/config/type_error_rate_test.go

@@ -0,0 +1,81 @@
+package config_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeErrorRateTestStruct struct {
+	Value config.TypeErrorRate `json:"value"`
+}
+
+type TypeErrorRateTestSuite struct {
+	suite.Suite
+}
+
+func (suite *TypeErrorRateTestSuite) TestUnmarshalFail() {
+	testData := []string{
+		"",
+		"1s",
+		"1,",
+		"1,2",
+		".",
+		"3.4.5",
+		"3.5.",
+		".3.5",
+		"some word",
+		"1e2",
+		"-1.0",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typeErrorRateTestStruct{}))
+		})
+	}
+}
+
+func (suite *TypeErrorRateTestSuite) TestUnmarshalOk() {
+	data, err := json.Marshal(map[string]float64{
+		"value": 1.0,
+	})
+	suite.NoError(err)
+
+	testStruct := &typeErrorRateTestStruct{}
+	suite.NoError(json.Unmarshal(data, testStruct))
+	suite.InEpsilon(1.0, testStruct.Value.Value, 1e-10)
+}
+
+func (suite *TypeErrorRateTestSuite) TestMarshalOk() {
+	testStruct := typeErrorRateTestStruct{
+		Value: config.TypeErrorRate{
+			Value: 1.01,
+		},
+	}
+
+	encodedJSON, err := json.Marshal(testStruct)
+	suite.NoError(err)
+	suite.JSONEq(`{"value": 1.01}`, string(encodedJSON))
+}
+
+func (suite *TypeErrorRateTestSuite) TestGet() {
+	value := config.TypeErrorRate{}
+	suite.InEpsilon(1.0, value.Get(1.0), 1e-10)
+
+	value.Value = 5.0
+	suite.InEpsilon(5.0, value.Get(1.0), 1e-10)
+}
+
+func TestTypeErrorRate(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &TypeErrorRateTestSuite{})
+}

internal/config/type_hostport.go

@@ -0,0 +1,63 @@
+package config
+
+import (
+	"fmt"
+	"net"
+	"strconv"
+)
+
+type TypeHostPort struct {
+	Value string
+	Host  string
+	Port  uint
+}
+
+func (t *TypeHostPort) Set(value string) error {
+	host, port, err := net.SplitHostPort(value)
+	if err != nil {
+		return fmt.Errorf("incorrect host:port value (%v): %w", value, err)
+	}
+
+	portValue, err := strconv.ParseUint(port, 10, 16)
+	if err != nil {
+		return fmt.Errorf("incorrect port number (%v): %w", value, err)
+	}
+
+	if portValue == 0 {
+		return fmt.Errorf("incorrect port number (%s)", value)
+	}
+
+	if host == "" {
+		return fmt.Errorf("empty host: %s", value)
+	}
+
+	if net.ParseIP(host) == nil {
+		return fmt.Errorf("host is not an IP address: %s", value)
+	}
+
+	t.Value = net.JoinHostPort(host, port)
+	t.Port = uint(portValue)
+	t.Host = host
+
+	return nil
+}
+
+func (t TypeHostPort) Get(defaultValue string) string {
+	if t.Value == "" {
+		return defaultValue
+	}
+
+	return t.Value
+}
+
+func (t *TypeHostPort) UnmarshalText(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypeHostPort) MarshalText() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypeHostPort) String() string {
+	return t.Value
+}

internal/config/type_hostport_test.go

@@ -0,0 +1,88 @@
+package config_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeHostPortTestStruct struct {
+	Value config.TypeHostPort `json:"value"`
+}
+
+type TypeHostPortTestSuite struct {
+	suite.Suite
+}
+
+func (suite *TypeHostPortTestSuite) TestUnmarshalFail() {
+	testData := []string{
+		":",
+		":800",
+		"127.0.0.1:8000000",
+		"12...:80",
+		"",
+		"localhost",
+		"google.com:",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typeHostPortTestStruct{}))
+		})
+	}
+}
+
+func (suite *TypeHostPortTestSuite) TestUnmarshalOk() {
+	testData := []string{
+		"127.0.0.1:80",
+		"10.0.0.10:6553",
+	}
+
+	for _, v := range testData {
+		value := v
+
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			testStruct := &typeHostPortTestStruct{}
+			assert.NoError(t, json.Unmarshal(data, testStruct))
+			assert.Equal(t, value, testStruct.Value.Value)
+		})
+	}
+}
+
+func (suite *TypeHostPortTestSuite) TestMarshalOk() {
+	testStruct := typeHostPortTestStruct{
+		Value: config.TypeHostPort{
+			Value: "127.0.0.1:8000",
+		},
+	}
+
+	data, err := json.Marshal(testStruct)
+	suite.NoError(err)
+	suite.JSONEq(`{"value": "127.0.0.1:8000"}`, string(data))
+}
+
+func (suite *TypeHostPortTestSuite) TestGet() {
+	value := config.TypeHostPort{}
+	suite.Equal("127.0.0.1:9000", value.Get("127.0.0.1:9000"))
+
+	value.Value = "127.0.0.1:80"
+	suite.Equal("127.0.0.1:80", value.Get("127.0.0.1:9000"))
+}
+
+func TestTypeHostPort(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &TypeHostPortTestSuite{})
+}

internal/config/type_http_path.go

@@ -0,0 +1,33 @@
+package config
+
+import "strings"
+
+type TypeHTTPPath struct {
+	Value string
+}
+
+func (t *TypeHTTPPath) Set(value string) error {
+	t.Value = "/" + strings.Trim(value, "/")
+
+	return nil
+}
+
+func (t TypeHTTPPath) Get(defaultValue string) string {
+	if t.Value == "" {
+		return defaultValue
+	}
+
+	return t.Value
+}
+
+func (t *TypeHTTPPath) UnmarshalText(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypeHTTPPath) MarshalText() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypeHTTPPath) String() string {
+	return t.Value
+}

internal/config/type_http_path_test.go

@@ -0,0 +1,67 @@
+package config_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeHTTPPathTestStruct struct {
+	Value config.TypeHTTPPath `json:"value"`
+}
+
+type TypeHTTPPathTestSuite struct {
+	suite.Suite
+}
+
+func (suite *TypeHTTPPathTestSuite) TestUnmarshalOk() {
+	testData := map[string]string{
+		"":      "/",
+		"/":     "/",
+		"/path": "/path",
+		"path":  "/path",
+	}
+
+	for k, v := range testData {
+		value := v
+
+		data, err := json.Marshal(map[string]string{
+			"value": k,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(k, func(t *testing.T) {
+			testStruct := &typeHTTPPathTestStruct{}
+			assert.NoError(t, json.Unmarshal(data, testStruct))
+			assert.Equal(t, value, testStruct.Value.Get(""))
+		})
+	}
+}
+
+func (suite *TypeHTTPPathTestSuite) TestMarshalOk() {
+	value := typeHTTPPathTestStruct{
+		Value: config.TypeHTTPPath{
+			Value: "/path",
+		},
+	}
+
+	data, err := json.Marshal(value)
+	suite.NoError(err)
+	suite.JSONEq(`{"value": "/path"}`, string(data))
+}
+
+func (suite *TypeHTTPPathTestSuite) TestGet() {
+	value := config.TypeHTTPPath{}
+	suite.Equal("/hello", value.Get("/hello"))
+
+	suite.NoError(value.Set("/lalala"))
+	suite.Equal("/lalala", value.Get("/hello"))
+}
+
+func TestTypeHTTPPath(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &TypeHTTPPathTestSuite{})
+}

internal/config/type_https_url.go

@@ -0,0 +1,53 @@
+package config
+
+import (
+	"fmt"
+	"net/url"
+)
+
+type TypeHttpsURL struct {
+	Value *url.URL
+}
+
+func (t *TypeHttpsURL) Set(value string) error {
+	parsedURL, err := url.Parse(value)
+	if err != nil {
+		return fmt.Errorf("value is not correct URL (%s): %w", value, err)
+	}
+
+	if parsedURL.Host == "" {
+		return fmt.Errorf("url has to have a schema: %s", value)
+	}
+
+	if parsedURL.Scheme != "https" {
+		return fmt.Errorf("unsupported schema: %s", parsedURL.Scheme)
+	}
+
+	t.Value = parsedURL
+
+	return nil
+}
+
+func (t *TypeHttpsURL) Get(defaultValue *url.URL) *url.URL {
+	if t.Value == nil {
+		return defaultValue
+	}
+
+	return t.Value
+}
+
+func (t *TypeHttpsURL) UnmarshalText(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypeHttpsURL) MarshalText() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypeHttpsURL) String() string {
+	if t.Value == nil {
+		return ""
+	}
+
+	return t.Value.String()
+}

internal/config/type_https_url_test.go

@@ -0,0 +1,100 @@
+package config_test
+
+import (
+	"encoding/json"
+	"net/url"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeHttpsURLTestStruct struct {
+	Value config.TypeHttpsURL `json:"value"`
+}
+
+type HttpsURLTestSuite struct {
+	suite.Suite
+}
+
+func (suite *HttpsURLTestSuite) TestUnmarshalFail() {
+	testData := []string{
+		"",
+		"https://",
+		"://lala",
+		"/path",
+		"http://example.com",
+		"socks5://example.com",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typeHttpsURLTestStruct{}))
+		})
+	}
+}
+
+func (suite *HttpsURLTestSuite) TestUnmarshalOk() {
+	testData := map[string]string{
+		"https://example.com":           "https://example.com",
+		"https://example.com:8443":      "https://example.com:8443",
+		"https://example.com/path?q=1":  "https://example.com/path?q=1",
+		"https://user:pass@example.com": "https://user:pass@example.com",
+	}
+
+	for k, v := range testData {
+		value := v
+
+		data, err := json.Marshal(map[string]string{
+			"value": k,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(k, func(t *testing.T) {
+			testStruct := &typeHttpsURLTestStruct{}
+			assert.NoError(t, json.Unmarshal(data, testStruct))
+
+			parsed, _ := url.Parse(value)
+
+			assert.Equal(t, parsed.Scheme, testStruct.Value.Get(nil).Scheme)
+			assert.Equal(t, parsed.Host, testStruct.Value.Get(nil).Host)
+			assert.Equal(t, parsed.RawQuery, testStruct.Value.Get(nil).RawQuery)
+			assert.Equal(t, parsed.Path, testStruct.Value.Get(nil).Path)
+		})
+	}
+}
+
+func (suite *HttpsURLTestSuite) TestMarshalOk() {
+	parsed, _ := url.Parse("https://example.com/path?q=1")
+	testStruct := &typeHttpsURLTestStruct{
+		Value: config.TypeHttpsURL{
+			Value: parsed,
+		},
+	}
+
+	encodedJSON, err := json.Marshal(testStruct)
+	suite.NoError(err)
+	suite.JSONEq(`{"value": "https://example.com/path?q=1"}`,
+		string(encodedJSON))
+}
+
+func (suite *HttpsURLTestSuite) TestGet() {
+	emptyURL := &url.URL{}
+
+	value := config.TypeHttpsURL{}
+	suite.Equal(emptyURL, value.Get(emptyURL))
+
+	value.Value = &url.URL{}
+	suite.Equal(value.Value, value.Get(emptyURL))
+}
+
+func TestTypeHttpsURL(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &HttpsURLTestSuite{})
+}

internal/config/type_ip.go

@@ -0,0 +1,45 @@
+package config
+
+import (
+	"fmt"
+	"net"
+)
+
+type TypeIP struct {
+	Value net.IP
+}
+
+func (t *TypeIP) Set(value string) error {
+	ip := net.ParseIP(value)
+	if ip == nil {
+		return fmt.Errorf("incorret ip %s", value)
+	}
+
+	t.Value = ip
+
+	return nil
+}
+
+func (t *TypeIP) Get(defaultValue net.IP) net.IP {
+	if len(t.Value) == 0 {
+		return defaultValue
+	}
+
+	return t.Value
+}
+
+func (t *TypeIP) UnmarshalText(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypeIP) MarshalText() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypeIP) String() string {
+	if len(t.Value) == 0 {
+		return ""
+	}
+
+	return t.Value.String()
+}

internal/config/type_ip_test.go

@@ -0,0 +1,104 @@
+package config_test
+
+import (
+	"encoding/json"
+	"net"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeIPTestStruct struct {
+	Value config.TypeIP `json:"value"`
+}
+
+type TypeIPTestSuite struct {
+	suite.Suite
+}
+
+func (suite *TypeIPTestSuite) TestUnmarshalFail() {
+	testData := []string{
+		"",
+		"....",
+		"0...",
+		"300.200.200.800",
+		"[]",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typeIPTestStruct{}))
+		})
+	}
+}
+
+func (suite *TypeIPTestSuite) TestUnmarshalOk() {
+	testData := map[string]string{
+		"2001:0db8:85a3:0000:0000:8a2e:0370:7334": "2001:db8:85a3::8a2e:370:7334",
+		"127.0.0.1": "127.0.0.1",
+	}
+
+	for k, v := range testData {
+		expected := v
+
+		data, err := json.Marshal(map[string]string{
+			"value": k,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(k, func(t *testing.T) {
+			testStruct := &typeIPTestStruct{}
+			assert.NoError(t, json.Unmarshal(data, testStruct))
+			assert.Equal(t, expected, testStruct.Value.Get(nil).String())
+		})
+	}
+}
+
+func (suite *TypeIPTestSuite) TestMarshalOk() {
+	testData := []string{
+		"2001:db8:85a3::8a2e:370:7334",
+		"127.0.0.1",
+	}
+
+	for _, v := range testData {
+		value := v
+
+		suite.T().Run(v, func(t *testing.T) {
+			testStruct := &typeIPTestStruct{
+				Value: config.TypeIP{
+					Value: net.ParseIP(value),
+				},
+			}
+
+			encodedJSON, err := json.Marshal(testStruct)
+			assert.NoError(t, err)
+
+			expectedJSON, err := json.Marshal(map[string]string{
+				"value": value,
+			})
+			assert.NoError(t, err)
+
+			assert.JSONEq(t, string(expectedJSON), string(encodedJSON))
+		})
+	}
+}
+
+func (suite *TypeIPTestSuite) TestGet() {
+	value := config.TypeIP{}
+	suite.Equal("127.0.0.1", value.Get(net.ParseIP("127.0.0.1")).String())
+
+	suite.NoError(value.Set("127.0.0.2"))
+	suite.Equal("127.0.0.2", value.Get(net.ParseIP("127.0.0.1")).String())
+}
+
+func TestTypeIP(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &TypeIPTestSuite{})
+}

internal/config/type_metric_prefix.go

@@ -0,0 +1,40 @@
+package config
+
+import (
+	"fmt"
+	"regexp"
+)
+
+type TypeMetricPrefix struct {
+	Value string
+}
+
+func (t *TypeMetricPrefix) Set(value string) error {
+	if ok, err := regexp.MatchString("^[a-z0-9]+$", value); !ok || err != nil {
+		return fmt.Errorf("incorrect metric prefix %s: %w", value, err)
+	}
+
+	t.Value = value
+
+	return nil
+}
+
+func (t TypeMetricPrefix) Get(defaultValue string) string {
+	if t.Value == "" {
+		return defaultValue
+	}
+
+	return t.Value
+}
+
+func (t *TypeMetricPrefix) UnmarshalText(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypeMetricPrefix) MarshalText() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypeMetricPrefix) String() string {
+	return t.Value
+}

internal/config/type_metric_prefix_test.go

@@ -0,0 +1,70 @@
+package config_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeMetricPrefixTestStruct struct {
+	Value config.TypeMetricPrefix `json:"value"`
+}
+
+type TypeMetricPrefixTestSuite struct {
+	suite.Suite
+}
+
+func (suite *TypeMetricPrefixTestSuite) TestUnmarshalFail() {
+	testData := []string{
+		"",
+		"-",
+		"hello/world",
+		"lala*",
+		"++sdf++",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typeMetricPrefixTestStruct{}))
+		})
+	}
+}
+
+func (suite *TypeMetricPrefixTestSuite) TestUnmarshalOk() {
+	testStruct := &typeMetricPrefixTestStruct{}
+	suite.NoError(json.Unmarshal([]byte(`{"value": "mtg"}`), testStruct))
+	suite.Equal("mtg", testStruct.Value.Get("lalala"))
+}
+
+func (suite *TypeMetricPrefixTestSuite) TestMarshalOk() {
+	testStruct := &typeMetricPrefixTestStruct{
+		Value: config.TypeMetricPrefix{
+			Value: "mtg",
+		},
+	}
+
+	data, err := json.Marshal(testStruct)
+	suite.NoError(err)
+	suite.JSONEq(`{"value": "mtg"}`, string(data))
+}
+
+func (suite *TypeMetricPrefixTestSuite) TestGet() {
+	value := config.TypeMetricPrefix{}
+	suite.Equal("lalala", value.Get("lalala"))
+
+	value.Value = "mtg"
+	suite.Equal("mtg", value.Get("lalala"))
+}
+
+func TestTypeMetricPrefix(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &TypeMetricPrefixTestSuite{})
+}

internal/config/type_port.go

@@ -0,0 +1,45 @@
+package config
+
+import (
+	"fmt"
+	"strconv"
+)
+
+type TypePort struct {
+	Value uint
+}
+
+func (t *TypePort) Set(value string) error {
+	portValue, err := strconv.ParseUint(value, 10, 16)
+	if err != nil {
+		return fmt.Errorf("incorrect port number (%v): %w", value, err)
+	}
+
+	if portValue == 0 {
+		return fmt.Errorf("incorrect port number (%s)", value)
+	}
+
+	t.Value = uint(portValue)
+
+	return nil
+}
+
+func (t TypePort) Get(defaultValue uint) uint {
+	if t.Value == 0 {
+		return defaultValue
+	}
+
+	return t.Value
+}
+
+func (t *TypePort) UnmarshalJSON(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypePort) MarshalJSON() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypePort) String() string {
+	return strconv.Itoa(int(t.Value))
+}

internal/config/type_port_test.go

@@ -0,0 +1,71 @@
+package config_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typePortTestStruct struct {
+	Value config.TypePort `json:"value"`
+}
+
+type TypePortTestSuite struct {
+	suite.Suite
+}
+
+func (suite *TypePortTestSuite) TestUnmarshalFail() {
+	testData := []string{
+		"",
+		"port",
+		"0",
+		"-1",
+		"1.5",
+		"70000",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typePortTestStruct{}))
+		})
+	}
+}
+
+func (suite *TypePortTestSuite) TestUnmarshalOk() {
+	testStruct := &typePortTestStruct{}
+	suite.NoError(json.Unmarshal([]byte(`{"value": 5}`), testStruct))
+	suite.EqualValues(5, testStruct.Value.Value)
+}
+
+func (suite *TypePortTestSuite) TestMarshalOk() {
+	testStruct := &typePortTestStruct{
+		Value: config.TypePort{
+			Value: 10,
+		},
+	}
+
+	data, err := json.Marshal(testStruct)
+	suite.NoError(err)
+	suite.JSONEq(`{"value":10}`, string(data))
+}
+
+func (suite *TypePortTestSuite) TestGet() {
+	value := config.TypePort{}
+	suite.EqualValues(10, value.Get(10))
+
+	value.Value = 100
+	suite.EqualValues(100, value.Get(10))
+}
+
+func TestTypePort(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &TypePortTestSuite{})
+}

internal/config/type_prefer_ip.go

@@ -0,0 +1,62 @@
+package config
+
+import (
+	"fmt"
+	"strings"
+)
+
+const (
+	// TypePreferIPPreferIPv4 states that you prefer to use IPv4 addresses
+	// but IPv6 is also possible.
+	TypePreferIPPreferIPv4 = "prefer-ipv4"
+
+	// TypePreferIPPreferIPv6 states that you prefer to use IPv6 addresses
+	// but IPv4 is also possible.
+	TypePreferIPPreferIPv6 = "prefer-ipv6"
+
+	// TypePreferOnlyIPv4 states that you prefer to use IPv4 addresses
+	// only.
+	TypePreferOnlyIPv4 = "only-ipv4"
+
+	// TypePreferOnlyIPv6 states that you prefer to use IPv6 addresses
+	// only.
+	TypePreferOnlyIPv6 = "only-ipv6"
+)
+
+type TypePreferIP struct {
+	Value string
+}
+
+func (t *TypePreferIP) Set(value string) error {
+	value = strings.ToLower(value)
+
+	switch value {
+	case TypePreferIPPreferIPv4, TypePreferIPPreferIPv6,
+		TypePreferOnlyIPv4, TypePreferOnlyIPv6:
+		t.Value = value
+
+		return nil
+	default:
+		return fmt.Errorf("unsupported ip preference: %s", value)
+	}
+}
+
+func (t *TypePreferIP) Get(defaultValue string) string {
+	if t.Value == "" {
+		return defaultValue
+	}
+
+	return t.Value
+}
+
+func (t *TypePreferIP) UnmarshalText(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypePreferIP) MarshalText() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypePreferIP) String() string {
+	return t.Value
+}

internal/config/type_prefer_ip_test.go

@@ -0,0 +1,113 @@
+package config_test
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typePreferIPTestStruct struct {
+	Value config.TypePreferIP `json:"value"`
+}
+
+type TypePreferIPTestSuite struct {
+	suite.Suite
+}
+
+func (suite *TypePreferIPTestSuite) TestUnmarshalFail() {
+	testData := []string{
+		"",
+		"prefer",
+		"preferipv4",
+		config.TypePreferIPPreferIPv4 + "_",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typePreferIPTestStruct{}))
+		})
+	}
+}
+
+func (suite *TypePreferIPTestSuite) TestUnmarshalOk() {
+	testData := []string{
+		config.TypePreferIPPreferIPv4,
+		config.TypePreferIPPreferIPv6,
+		config.TypePreferOnlyIPv4,
+		config.TypePreferOnlyIPv6,
+		strings.ToTitle(config.TypePreferOnlyIPv4),
+		strings.ToTitle(config.TypePreferOnlyIPv6),
+		strings.ToTitle(config.TypePreferIPPreferIPv4),
+		strings.ToTitle(config.TypePreferIPPreferIPv6),
+	}
+
+	for _, v := range testData {
+		value := v
+
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			testStruct := &typePreferIPTestStruct{}
+			assert.NoError(t, json.Unmarshal(data, testStruct))
+			assert.Equal(t, strings.ToLower(value), testStruct.Value.Value)
+		})
+	}
+}
+
+func (suite *TypePreferIPTestSuite) TestMarshalOk() {
+	testData := []string{
+		config.TypePreferIPPreferIPv4,
+		config.TypePreferIPPreferIPv6,
+		config.TypePreferOnlyIPv4,
+		config.TypePreferOnlyIPv6,
+	}
+
+	for _, v := range testData {
+		value := v
+
+		suite.T().Run(v, func(t *testing.T) {
+			testStruct := &typePreferIPTestStruct{
+				Value: config.TypePreferIP{
+					Value: value,
+				},
+			}
+
+			encodedJSON, err := json.Marshal(testStruct)
+			assert.NoError(t, err)
+
+			expectedJSON, err := json.Marshal(map[string]string{
+				"value": value,
+			})
+			assert.NoError(t, err)
+
+			assert.JSONEq(t, string(expectedJSON), string(encodedJSON))
+		})
+	}
+}
+
+func (suite *TypePreferIPTestSuite) TestGet() {
+	value := config.TypePreferIP{}
+	suite.Equal(config.TypePreferIPPreferIPv4,
+		value.Get(config.TypePreferIPPreferIPv4))
+
+	suite.NoError(value.Set(config.TypePreferIPPreferIPv6))
+	suite.Equal(config.TypePreferIPPreferIPv6,
+		value.Get(config.TypePreferIPPreferIPv4))
+}
+
+func TestTypePreferIP(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &TypePreferIPTestSuite{})
+}

internal/config/type_proxy_url.go

@@ -0,0 +1,65 @@
+package config
+
+import (
+	"fmt"
+	"net"
+	"net/url"
+)
+
+const typeProxyURLDefaultSOCKS5Port = "1080"
+
+type TypeProxyURL struct {
+	Value *url.URL
+}
+
+func (t *TypeProxyURL) Set(value string) error {
+	parsedURL, err := url.Parse(value)
+	if err != nil {
+		return fmt.Errorf("value is not correct URL (%s): %w", value, err)
+	}
+
+	if parsedURL.Host == "" {
+		return fmt.Errorf("url has to have a schema: %s", value)
+	}
+
+	switch parsedURL.Scheme {
+	case "socks5", "socks5h":
+	default:
+		return fmt.Errorf("unsupported schema: %s", parsedURL.Scheme)
+	}
+
+	if _, _, err := net.SplitHostPort(parsedURL.Host); err != nil {
+		parsedURL.Host = net.JoinHostPort(
+			parsedURL.Host,
+			typeProxyURLDefaultSOCKS5Port,
+		)
+	}
+
+	t.Value = parsedURL
+
+	return nil
+}
+
+func (t *TypeProxyURL) Get(defaultValue *url.URL) *url.URL {
+	if t.Value == nil {
+		return defaultValue
+	}
+
+	return t.Value
+}
+
+func (t *TypeProxyURL) UnmarshalText(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t TypeProxyURL) MarshalText() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t TypeProxyURL) String() string {
+	if t.Value == nil {
+		return ""
+	}
+
+	return t.Value.String()
+}

internal/config/type_proxy_url_test.go

@@ -0,0 +1,96 @@
+package config_test
+
+import (
+	"encoding/json"
+	"net/url"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeProxyURLTestStruct struct {
+	Value config.TypeProxyURL `json:"value"`
+}
+
+type ProxyURLTestSuite struct {
+	suite.Suite
+}
+
+func (suite *ProxyURLTestSuite) TestUnmarshalFail() {
+	testData := []string{
+		"",
+		"socks5://",
+		"://lala",
+		"/path",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typeProxyURLTestStruct{}))
+		})
+	}
+}
+
+func (suite *ProxyURLTestSuite) TestUnmarshalOk() {
+	testData := map[string]string{
+		"socks5://127.0.0.1/?open_threshold=1": "socks5://127.0.0.1:1080/?open_threshold=1",
+		"socks5://127.0.0.1:80":                "socks5://127.0.0.1:80",
+	}
+
+	for k, v := range testData {
+		value := v
+
+		data, err := json.Marshal(map[string]string{
+			"value": k,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(k, func(t *testing.T) {
+			testStruct := &typeProxyURLTestStruct{}
+			assert.NoError(t, json.Unmarshal(data, testStruct))
+
+			parsed, _ := url.Parse(value)
+
+			assert.Equal(t, parsed.Scheme, testStruct.Value.Get(nil).Scheme)
+			assert.Equal(t, parsed.Host, testStruct.Value.Get(nil).Host)
+			assert.Equal(t, parsed.RawQuery, testStruct.Value.Get(nil).RawQuery)
+			assert.Equal(t, parsed.Path, testStruct.Value.Get(nil).Path)
+		})
+	}
+}
+
+func (suite *ProxyURLTestSuite) TestMarshalOk() {
+	parsed, _ := url.Parse("socks5://127.0.0.1:1080?open_threshold=1")
+	testStruct := &typeProxyURLTestStruct{
+		Value: config.TypeProxyURL{
+			Value: parsed,
+		},
+	}
+
+	encodedJSON, err := json.Marshal(testStruct)
+	suite.NoError(err)
+	suite.JSONEq(`{"value": "socks5://127.0.0.1:1080?open_threshold=1"}`,
+		string(encodedJSON))
+}
+
+func (suite *ProxyURLTestSuite) TestGet() {
+	emptyURL := &url.URL{}
+
+	value := config.TypeProxyURL{}
+	suite.Equal(emptyURL, value.Get(emptyURL))
+
+	value.Value = &url.URL{}
+	suite.Equal(value.Value, value.Get(emptyURL))
+}
+
+func TestTypeProxyURL(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &ProxyURLTestSuite{})
+}

internal/config/type_statsd_tag_format.go

@@ -0,0 +1,58 @@
+package config
+
+import (
+	"fmt"
+	"strings"
+)
+
+const (
+	// TypeStatsdTagFormatInfluxdb defines a tag format compatible with
+	// InfluxDB.
+	TypeStatsdTagFormatInfluxdb = "influxdb"
+
+	// TypeStatsdTagFormatDatadog defines a tag format compatible with
+	// DataDog.
+	TypeStatsdTagFormatDatadog = "datadog"
+
+	// TypeStatsdTagFormatGraphite defines a tag format compatible with
+	// Graphite.
+	TypeStatsdTagFormatGraphite = "graphite"
+)
+
+type TypeStatsdTagFormat struct {
+	Value string
+}
+
+func (t *TypeStatsdTagFormat) Set(value string) error {
+	lowercasedValue := strings.ToLower(value)
+
+	switch lowercasedValue {
+	case TypeStatsdTagFormatDatadog, TypeStatsdTagFormatInfluxdb,
+		TypeStatsdTagFormatGraphite:
+		t.Value = lowercasedValue
+
+		return nil
+	default:
+		return fmt.Errorf("unknown tag format %s", value)
+	}
+}
+
+func (t TypeStatsdTagFormat) Get(defaultValue string) string {
+	if t.Value == "" {
+		return defaultValue
+	}
+
+	return t.Value
+}
+
+func (t *TypeStatsdTagFormat) UnmarshalText(data []byte) error {
+	return t.Set(string(data))
+}
+
+func (t *TypeStatsdTagFormat) MarshalText() ([]byte, error) {
+	return []byte(t.String()), nil
+}
+
+func (t *TypeStatsdTagFormat) String() string {
+	return t.Value
+}

internal/config/type_statsd_tag_format_test.go

@@ -0,0 +1,108 @@
+package config_test
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/9seconds/mtg/v2/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+)
+
+type typeStatsdTagFormatTestStruct struct {
+	Value config.TypeStatsdTagFormat `json:"value"`
+}
+
+type StatsdTagFormatTestSuite struct {
+	suite.Suite
+}
+
+func (suite *StatsdTagFormatTestSuite) TestUnmarshalFail() {
+	testData := []string{
+		"",
+		"dogdog",
+	}
+
+	for _, v := range testData {
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			assert.Error(t, json.Unmarshal(data, &typeStatsdTagFormatTestStruct{}))
+		})
+	}
+}
+
+func (suite *StatsdTagFormatTestSuite) TestUnmarshalOk() {
+	testData := []string{
+		config.TypeStatsdTagFormatInfluxdb,
+		config.TypeStatsdTagFormatGraphite,
+		config.TypeStatsdTagFormatDatadog,
+		strings.ToUpper(config.TypeStatsdTagFormatInfluxdb),
+		strings.ToUpper(config.TypeStatsdTagFormatGraphite),
+		strings.ToUpper(config.TypeStatsdTagFormatDatadog),
+	}
+
+	for _, v := range testData {
+		value := v
+
+		data, err := json.Marshal(map[string]string{
+			"value": v,
+		})
+		suite.NoError(err)
+
+		suite.T().Run(v, func(t *testing.T) {
+			testStruct := &typeStatsdTagFormatTestStruct{}
+			assert.NoError(t, json.Unmarshal(data, testStruct))
+			assert.Equal(t, strings.ToLower(value), testStruct.Value.Value)
+		})
+	}
+}
+
+func (suite *StatsdTagFormatTestSuite) TestMarshalOk() {
+	testData := []string{
+		config.TypeStatsdTagFormatInfluxdb,
+		config.TypeStatsdTagFormatGraphite,
+		config.TypeStatsdTagFormatDatadog,
+	}
+
+	for _, v := range testData {
+		value := v
+
+		suite.T().Run(v, func(t *testing.T) {
+			testStruct := &typeStatsdTagFormatTestStruct{
+				Value: config.TypeStatsdTagFormat{
+					Value: value,
+				},
+			}
+
+			encodedJSON, err := json.Marshal(testStruct)
+			assert.NoError(t, err)
+
+			expectedJSON, err := json.Marshal(map[string]string{
+				"value": value,
+			})
+			assert.NoError(t, err)
+
+			assert.JSONEq(t, string(expectedJSON), string(encodedJSON))
+		})
+	}
+}
+
+func (suite *StatsdTagFormatTestSuite) TestGet() {
+	value := config.TypeStatsdTagFormat{}
+	suite.Equal(config.TypeStatsdTagFormatDatadog,
+		value.Get(config.TypeStatsdTagFormatDatadog))
+
+	suite.NoError(value.Set(config.TypeStatsdTagFormatInfluxdb))
+	suite.Equal(config.TypeStatsdTagFormatInfluxdb,
+		value.Get(config.TypeStatsdTagFormatDatadog))
+}
+
+func TestTypeStatsdTagFormat(t *testing.T) {
+	t.Parallel()
+	suite.Run(t, &StatsdTagFormatTestSuite{})
+}

internal/proxyprotocol/adapter.go

@@ -0,0 +1,20 @@
+package proxyprotocol
+
+import (
+	"net"
+
+	"github.com/pires/go-proxyproto"
+)
+
+type ListenerAdapter struct {
+	proxyproto.Listener
+}
+
+func (l *ListenerAdapter) Accept() (net.Conn, error) {
+	conn, err := l.Listener.Accept()
+	if err != nil {
+		return nil, err
+	}
+
+	return connWrapper{conn.(*proxyproto.Conn)}, nil
+}

internal/proxyprotocol/conn.go

@@ -0,0 +1,25 @@
+package proxyprotocol
+
+import "github.com/pires/go-proxyproto"
+
+type connWrapper struct {
+	*proxyproto.Conn
+}
+
+func (c connWrapper) CloseRead() error {
+	tcpConn, ok := c.TCPConn()
+	if !ok {
+		panic("we support only tcp connections")
+	}
+
+	return tcpConn.CloseRead()
+}
+
+func (c connWrapper) CloseWrite() error {
+	tcpConn, ok := c.TCPConn()
+	if !ok {
+		panic("we support only tcp connections")
+	}
+
+	return tcpConn.CloseWrite()
+}

internal/testlib/capture_output.go

@@ -0,0 +1,42 @@
+package testlib
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"strings"
+)
+
+func CaptureStdout(callback func()) string {
+	return captureOutput(&os.Stdout, callback)
+}
+
+func CaptureStderr(callback func()) string {
+	return captureOutput(&os.Stderr, callback)
+}
+
+func captureOutput(filefp **os.File, callback func()) string {
+	oldFp := *filefp
+
+	defer func() {
+		*filefp = oldFp
+	}()
+
+	reader, writer, _ := os.Pipe()
+	buf := &bytes.Buffer{}
+	closeChan := make(chan bool)
+
+	go func() {
+		io.Copy(buf, reader) //nolint: errcheck
+		close(closeChan)
+	}()
+
+	*filefp = writer
+
+	callback()
+
+	writer.Close() //nolint: errcheck
+	<-closeChan
+
+	return strings.TrimSpace(buf.String())
+}

internal/testlib/events_observer_mock.go

@@ -0,0 +1,7 @@
+package testlib
+
+import "github.com/stretchr/testify/mock"
+
+type EventsObserverMock struct {
+	mock.Mock
+}