fix: Telegram+Discord TLS/SNI bypass via Cloudflare Worker proxy

- Confirmed HF blocks Telegram via TLS/SNI inspection (60s timeout, ECONNRESET)
- Moved NODE_OPTIONS to Dockerfile ENV (after COPY) so dns-fix.js loads in n8n
- Added keep-alive=false patch to prevent stale socket ECONNRESET on Node 22
- Removed diagnostic code from dns-fix.js
- Updated README and guide to cover both Discord and Telegram proxy workaround
- Guide now includes Telegram Base URL field instructions for n8n credential

DISCORD_PROXY_GUIDE.md

@@ -1,45 +1,67 @@
-# 🛠️ How to Create a Free Discord Proxy
+# 🛠️ Bypassing Hugging Face Network Restrictions
 
-Hugging Face officially blocks outgoing connections to Discord's IP addresses on Free Tier Spaces to prevent spam. While our built-in DNS script cleanly bypasses blocks for Telegram and WhatsApp, Discord is blocked at the physical IP firewall level.
+Hugging Face Free Tier Spaces block outgoing connections to certain messaging platforms (**Discord** and **Telegram**) via **TLS/SNI inspection**. This means the TCP connection is allowed, but the TLS handshake is silently dropped as soon as HF detects the target hostname (e.g., `discord.com`, `api.telegram.org`) in the SNI field.
 
-This means the native n8n "Discord" node will always hang and fail with a "Connection closed unexpectedly" error.
+The fix is to route your traffic through a **Cloudflare Worker proxy** with a neutral hostname. Since the SNI in the TLS handshake will show `your-proxy.workers.dev` instead of the blocked hostname, HF's filter won't block it. Cloudflare Workers are **100% free** (100,000 requests/day).
 
-To work around this, you can easily create your own private Discord proxy using Cloudflare Workers. It takes about 2 minutes and is 100% free (allowing up to 100,000 requests per day).
+---
+
+## Setting Up a Cloudflare Worker Proxy
 
-## Step-by-Step Guide
+This process takes about 2 minutes and works for both Discord and Telegram.
 
 ### Step 1: Create a Cloudflare Worker
-1. Log into [Cloudflare](https://dash.cloudflare.com/) (create an account if you don't have one).
-2. On the left sidebar, go to **Workers & Pages**.
-3. Click **Create Worker** -> **Start with Hello World!**.
-4. Name it something memorable, like `discord-proxy`, and click **Deploy**.
+1. Log into [Cloudflare](https://dash.cloudflare.com/) (create a free account if needed).
+2. Go to **Workers & Pages** in the left sidebar.
+3. Click **Create Worker** → **Start with Hello World!**.
+4. Give it a name (e.g., `discord-proxy` or `telegram-proxy`) and click **Deploy**.
 
 ### Step 2: Add the Proxy Code
-1. Once deployed, click the **Edit Code** button.
-2. In the online code editor, delete the existing code and replace it entirely with this 6-line snippet:
+1. Click **Edit Code**.
+2. Delete all existing code and paste the following snippet.
+3. Replace `TARGET_HOSTNAME` with the service you want to proxy (see table below).
 
 ```javascript
 export default {
   async fetch(request) {
     const url = new URL(request.url);
-    url.hostname = 'discord.com';
+    url.hostname = 'TARGET_HOSTNAME';
     return fetch(new Request(url, request));
   }
 }
 ```
 
-3. Click **Save and Deploy** in the top right corner. Cloudflare will generate a unique URL for you (e.g., `https://discord-proxy.yourname.workers.dev`).
+| Service | Replace `TARGET_HOSTNAME` with |
+| :--- | :--- |
+| Discord | `discord.com` |
+| Telegram | `api.telegram.org` |
+
+4. Click **Save and Deploy**. Cloudflare gives you a URL like `https://your-proxy.yourname.workers.dev`.
+
+---
 
-### Step 3: Use the Proxy in n8n
-Because the native Discord Node hardcodes connections to `discord.com` when using Bot tokens, you must use the **Webhook** method.
+## Using the Proxy in n8n
 
-1. Add the standard **Discord** node to your n8n workflow.
-2. Under "Authentication", select **Webhook**.
-3. Take your normal Discord Webhook URL and replace `discord.com` with your new worker domain.
-   * *Original:* `https://discord.com/api/webhooks/123456/abcdef`
-   * *New:* `https://discord-proxy.yourname.workers.dev/api/webhooks/123456/abcdef`
-4. Create a new Discord Webhook Credential in n8n and paste that **New URL** into the "Webhook URL" field.
-5. Setup your message (e.g., set the text to "Hello World") and click **Execute Node**. Your message will instantly appear in Discord!
+### Discord
+The native n8n Discord node uses Bot tokens that hardcode `discord.com`. Use the **Webhook** authentication method instead:
+
+1. Add a **Discord** node and set the **Credential** to use **Webhook** authentication.
+2. Create a new Discord Webhook credential.
+3. Take your Discord Webhook URL and replace `discord.com` with your Worker domain:
+   - *Original:* `https://discord.com/api/webhooks/123456/abcdef`
+   - *Proxied:* `https://discord-proxy.yourname.workers.dev/api/webhooks/123456/abcdef`
+4. Paste the proxied URL in the **Webhook URL** field.
+
+### Telegram
+The n8n Telegram credential has a **Base URL** field that can be changed:
+
+1. Go to **Credentials** → add or edit a **Telegram** credential.
+2. Enter your Bot Token as usual.
+3. In the **Base URL** field, replace `https://api.telegram.org` with your Worker URL:
+   - *Original:* `https://api.telegram.org`
+   - *Proxied:* `https://telegram-proxy.yourname.workers.dev`
+4. Click **Save** and then **Test** — it should connect instantly.
 
 ---
-*Note: If you ever upgrade your Hugging Face Space to a paid hardware tier, the outgoing firewall restriction is removed, and you can go back to using the native n8n Discord node directly!*
+
+*Note: Upgrading your Hugging Face Space to a paid hardware tier removes these network restrictions entirely, allowing you to use all n8n nodes natively without a proxy.*

README.md

@@ -68,10 +68,10 @@ Hugging8n automatically creates and maintains a private dataset in your Hugging
 
 ## ⚠️ Known Limitations & Workarounds
 
-**Discord Webhooks**
-Hugging Face officially blocks outgoing connections to Discord on Free Tier Spaces. To use the Discord node, you must route your traffic through a simple, free proxy.
+**Discord & Telegram Webhooks Blocked by Hugging Face**
+Hugging Face blocks outgoing connections to Discord and Telegram on Free Tier Spaces via TLS/SNI inspection — the TCP connection opens but the TLS handshake is silently dropped when the target hostname is detected. To use these services, you must route traffic through a proxy with a different hostname.
 
-👉 **[Read the Guide: How to Create a Free Discord Proxy in 2 minutes](./DISCORD_PROXY_GUIDE.md)**
+👉 **[Read the Guide: How to Create a Free Cloudflare Proxy in 2 minutes](./DISCORD_PROXY_GUIDE.md)**
 *(Upgrading to a paid Space removes this firewall restriction entirely).*
 
 ## 🏗️ Architecture

dns-fix.js

@@ -11,7 +11,7 @@
  */
 "use strict";
 
-console.error("[DNS-FIX] dns-fix.js preload script loaded successfully.");
+console.error("[DNS-FIX] Loaded — DoH-first resolver + keep-alive patch active.");
 
 const dns = require("dns");
 const http = require("http");
@@ -22,29 +22,6 @@ http.globalAgent = new http.Agent({ keepAlive: false });
 https.globalAgent = new https.Agent({ keepAlive: false });
 // ─────────────────────────────────────────────────────────────────────────────
 
-// ── TCP Connection Diagnostics ────────────────────────────────────────────────
-// Temporarily patch net.createConnection to log all outgoing TCP connections
-// and their errors so we can identify the exact IP and failure mode.
-const net = require("net");
-const _origConnect = net.createConnection.bind(net);
-net.createConnection = function (options, ...args) {
-  const host = options.host || options;
-  const port = options.port;
-  // Only log external connections (skip loopback)
-  if (host && host !== "127.0.0.1" && host !== "localhost" && host !== "::1") {
-    console.error(`[DNS-FIX] TCP connect → ${host}:${port}`);
-    const sock = _origConnect(options, ...args);
-    sock.on("connect", () =>
-      console.error(`[DNS-FIX] TCP connected ✓ ${host}:${port}`),
-    );
-    sock.on("error", (err) =>
-      console.error(`[DNS-FIX] TCP error ✗ ${host}:${port} — ${err.code}: ${err.message}`),
-    );
-    return sock;
-  }
-  return _origConnect(options, ...args);
-};
-// ─────────────────────────────────────────────────────────────────────────────
 
 // In-memory cache for runtime DoH resolutions
 const runtimeCache = new Map(); // hostname -> { ip, expiry }