feat: migrate Osaka node to full sing-box

servers/bwh-hk-dc3/sing-box/etc/sing-box/config.json.template

@@ -1,43 +0,0 @@
-{
-  "inbounds": [
-    {
-      "type": "trojan",
-      "tag": "trojan-in",
-      "listen": "::",
-      "listen_port": ${LISTEN_PORT},
-      "sniff": true,
-      "sniff_override_destination": true,
-      "users": [
-        {
-          "name": "user1",
-          "password": "${USER1_PASSWORD}"
-        }
-      ],
-      "tls": {
-        "enabled": true,
-        "server_name": "${DOMAIN}",
-        "acme": {
-          "domain": "${DOMAIN}",
-          "email": "${ACME_EMAIL}",
-          "dns01_challenge": {
-            "provider": "cloudflare",
-            "api_token": "${CLOUDFLARE_API_TOKEN}"
-          }
-        }
-      },
-      "multiplex": {
-        "enabled": true
-      }
-    }
-  ],
-  "outbounds": [
-    {
-      "type": "direct"
-    }
-  ],
-  "log": {
-    "disabled": false,
-    "level": "info",
-    "timestamp": true
-  }
-}

servers/bwh-jp-osaka/litellm/README.md

@@ -1,6 +1,6 @@
-# LiteLLM Vertex AI Relay
+# Osaka LiteLLM Vertex AI Relay
 
-- 仅通过 HK 节点的 Tailscale IPv4 地址监听；`LISTEN_IP` 不要填写公网地址或 `0.0.0.0`。
+- 仅通过 Osaka 节点的 Tailscale IPv4 地址监听；`LISTEN_IP` 不要填写公网地址或 `0.0.0.0`。
 - ADC、LiteLLM key 仅存放于 Arcane `.env`，不得提交 Git。
 - 默认监听端口为 `1049`；需要修改时设置 `LITELLM_PORT`。
 - 后续 Vertex Anthropic 模型在 `config.yaml` 增加独立模型项。

servers/bwh-jp-osaka/litellm/compose.yaml

@@ -1,6 +1,6 @@
 services:
   adc-init:
-    image: alpine:3.22
+    image: alpine:3.24
     restart: "no"
     environment:
       GOOGLE_ADC_B64: ${GOOGLE_ADC_B64}

servers/bwh-jp-osaka/litellm/config.yaml

@@ -1,3 +1,4 @@
+# Osaka node model routing.
 model_list:
   - model_name: gemini-3.6-flash
     litellm_params:

servers/bwh-jp-osaka/sing-box/compose.yaml

@@ -1,12 +1,25 @@
 services:
   config-render:
-    image: alpine:3.20
+    image: alpine:3.24
     environment:
       DOMAIN: ${DOMAIN}
       ACME_EMAIL: ${ACME_EMAIL}
       LISTEN_PORT: ${LISTEN_PORT}
       USER1_PASSWORD: ${USER1_PASSWORD}
       CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN}
+      ANYTLS_HY2_PORT: ${ANYTLS_HY2_PORT}
+      ANYTLS_PASSWORD: ${ANYTLS_PASSWORD}
+      HY2_PASSWORD: ${HY2_PASSWORD}
+      HY2_OBFS_PASSWORD: ${HY2_OBFS_PASSWORD}
+      VLESS_PORT: ${VLESS_PORT}
+      VLESS_UUID: ${VLESS_UUID}
+      REALITY_SERVER_NAME: ${REALITY_SERVER_NAME}
+      REALITY_PRIVATE_KEY: ${REALITY_PRIVATE_KEY}
+      REALITY_SHORT_ID: ${REALITY_SHORT_ID}
+      SNELL_V4_PORT: ${SNELL_V4_PORT}
+      SNELL_V4_PSK: ${SNELL_V4_PSK}
+      SNELL_V6_PORT: ${SNELL_V6_PORT}
+      SNELL_V6_PSK: ${SNELL_V6_PSK}
     volumes:
       - ./etc/sing-box/config.json.template:/template/config.json.template:ro
       - sing-box-config:/output
@@ -20,7 +33,7 @@ services:
     restart: "no"
 
   sing-box:
-    image: ghcr.io/sagernet/sing-box:v1.12.13
+    image: ghcr.io/sagernet/sing-box:v1.14.0
     restart: unless-stopped
     depends_on:
       config-render:

servers/bwh-jp-osaka/sing-box/etc/sing-box/config.json.template

@@ -0,0 +1,136 @@
+{
+  "certificate_providers": [
+    {
+      "type": "acme",
+      "tag": "public-cert",
+      "domain": [
+        "${DOMAIN}"
+      ],
+      "email": "${ACME_EMAIL}",
+      "dns01_challenge": {
+        "provider": "cloudflare",
+        "api_token": "${CLOUDFLARE_API_TOKEN}"
+      }
+    }
+  ],
+  "inbounds": [
+    {
+      "type": "trojan",
+      "tag": "trojan-in",
+      "listen": "::",
+      "listen_port": ${LISTEN_PORT},
+      "users": [
+        {
+          "name": "user1",
+          "password": "${USER1_PASSWORD}"
+        }
+      ],
+      "tls": {
+        "enabled": true,
+        "server_name": "${DOMAIN}",
+        "certificate_provider": "public-cert"
+      },
+      "multiplex": {
+        "enabled": true
+      }
+    },
+    {
+      "type": "anytls",
+      "tag": "anytls-in",
+      "listen": "::",
+      "listen_port": ${ANYTLS_HY2_PORT},
+      "users": [
+        {
+          "name": "user1",
+          "password": "${ANYTLS_PASSWORD}"
+        }
+      ],
+      "tls": {
+        "enabled": true,
+        "server_name": "${DOMAIN}",
+        "certificate_provider": "public-cert"
+      }
+    },
+    {
+      "type": "hysteria2",
+      "tag": "hysteria2-in",
+      "listen": "0.0.0.0",
+      "listen_port": ${ANYTLS_HY2_PORT},
+      "obfs": {
+        "type": "salamander",
+        "password": "${HY2_OBFS_PASSWORD}"
+      },
+      "users": [
+        {
+          "name": "user1",
+          "password": "${HY2_PASSWORD}"
+        }
+      ],
+      "tls": {
+        "enabled": true,
+        "server_name": "${DOMAIN}",
+        "alpn": [
+          "h3"
+        ],
+        "certificate_provider": "public-cert"
+      }
+    },
+    {
+      "type": "vless",
+      "tag": "vless-reality-in",
+      "listen": "::",
+      "listen_port": ${VLESS_PORT},
+      "users": [
+        {
+          "name": "user1",
+          "uuid": "${VLESS_UUID}",
+          "flow": "xtls-rprx-vision"
+        }
+      ],
+      "tls": {
+        "enabled": true,
+        "server_name": "${REALITY_SERVER_NAME}",
+        "reality": {
+          "enabled": true,
+          "handshake": {
+            "server": "${REALITY_SERVER_NAME}",
+            "server_port": 443
+          },
+          "private_key": "${REALITY_PRIVATE_KEY}",
+          "short_id": [
+            "${REALITY_SHORT_ID}"
+          ],
+          "max_time_difference": "2m"
+        }
+      }
+    },
+    {
+      "type": "snell",
+      "tag": "snell-v4-compatible-in",
+      "listen": "::",
+      "listen_port": ${SNELL_V4_PORT},
+      "version": 5,
+      "psk": "${SNELL_V4_PSK}",
+      "obfs_mode": "none"
+    },
+    {
+      "type": "snell",
+      "tag": "snell-v6-in",
+      "listen": "::",
+      "listen_port": ${SNELL_V6_PORT},
+      "version": 6,
+      "psk": "${SNELL_V6_PSK}",
+      "mode": "default"
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct"
+    }
+  ],
+  "log": {
+    "disabled": false,
+    "level": "info",
+    "timestamp": true
+  }
+}

servers/bwh-jp-osaka/snell/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.21 AS downloader
+FROM alpine:3.24 AS downloader
 
 ARG SNELL_VERSION=5.0.1
 ARG SNELL_ZIP_SHA256=9bea1c2b9e35b73b31634856c04d18c393072b9e5dcde6a32781d8b8f908c539

servers/bwh-jp-osaka/snell/README.md

@@ -1,4 +1,4 @@
-# Snell Server
+# Osaka Snell Server (rollback only)
 
 - 当前锁定 Snell Server 5.0.1，由本目录 Dockerfile 从官方包构建并校验 SHA-256。
 - 客户端因禁用 QUIC 显示 `version=4` 属现有兼容用法，不改变服务端 5.0.1 部署。

servers/bwh-jp-osaka/snell/compose.yaml

@@ -1,3 +1,4 @@
+# Retained temporarily as a rollback target during the sing-box migration.
 services:
   snell-v5:
     build:

servers/bwh-jp-osaka/snell/entrypoint.sh

@@ -1,4 +1,5 @@
 #!/bin/sh
+# Osaka rollback-only Snell entrypoint.
 set -eu
 
 : "${PSK:?PSK is required}"
@@ -16,4 +17,3 @@ psk = ${PSK}
 EOF
 
 exec /usr/local/bin/snell-server -c /tmp/snell-server.conf
-

servers/bwh-jp-osaka/web/Caddyfile

@@ -1,3 +1,4 @@
+# Osaka web endpoints. MeTube is intentionally not routed here.
 rules.kais.cloud {
     root * /srv/web
     reverse_proxy filebrowser:80

servers/bwh-jp-osaka/web/README.md

@@ -1,4 +1,4 @@
-# HK Web Services
+# Osaka Web Services
 
 - Arcane 项目名：`web-managed`
 - 复用旧项目 `/opt/stacks/web` 下的持久化数据。

servers/bwh-jp-osaka/web/compose.yaml

@@ -1,6 +1,6 @@
 services:
   caddy:
-    image: caddy:2.10.2
+    image: caddy:2.11.4
     container_name: caddy
     restart: unless-stopped
     ports: