Self-host Signal TLS Proxy

Signal TLS Proxy is a small reverse-proxy stack from Signal that lets anyone run a TLS front end for Signal's service endpoints on their own server. You need a host with ports 80 and 443 free plus a domain pointing at it; an init script obtains a Let's Encrypt certificate through certbot, and Docker Compose then starts two nginx containers and a certbot renewal container. The terminate container handles TLS and forwards to a relay container, which uses SNI sniffing to pass traffic on to Signal servers such as chat.signal.org, storage.signal.org, the CDN hosts and the voice SFU, denying anything not in its map. Operators share their proxy with others through a signal.tube URL, and Signal asks operators to check for updates at least every thirty days. The project only accepts incremental improvements rather than significant architectural changes, and the repository ships no release versions or published container image of its own.