From 4ed88a46c5d25031e4fdfdbebf49a29a4a2d12f1 Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Tue, 1 Sep 2026 19:26:25 -0700
Subject: [PATCH] feat: add DC9 Snell v4 and v6 inbounds

---
 servers/bwh-us-dc9/sing-box/.env.example      |  6 ++++++
 servers/bwh-us-dc9/sing-box/README.md         | 20 +++++++++++++++++++
 servers/bwh-us-dc9/sing-box/compose.yaml      |  4 ++++
 .../etc/sing-box/config.json.template         | 18 +++++++++++++++++
 4 files changed, 48 insertions(+)
 create mode 100644 servers/bwh-us-dc9/sing-box/README.md

diff --git a/servers/bwh-us-dc9/sing-box/.env.example b/servers/bwh-us-dc9/sing-box/.env.example
index 126552d..2dfa9a8 100644
--- a/servers/bwh-us-dc9/sing-box/.env.example
+++ b/servers/bwh-us-dc9/sing-box/.env.example
@@ -15,3 +15,9 @@ VLESS_UUID=00000000-0000-4000-8000-000000000000
 REALITY_SERVER_NAME=www.cloudflare.com
 REALITY_PRIVATE_KEY=change-me
 REALITY_SHORT_ID=0123456789abcdef
+
+# sing-box uses version 5 for the Snell v4-compatible TCP wire protocol.
+SNELL_V4_PORT=53469
+SNELL_V4_PSK=change-me
+SNELL_V6_PORT=35737
+SNELL_V6_PSK=change-me-at-least-12-bytes
diff --git a/servers/bwh-us-dc9/sing-box/README.md b/servers/bwh-us-dc9/sing-box/README.md
new file mode 100644
index 0000000..a63ae88
--- /dev/null
+++ b/servers/bwh-us-dc9/sing-box/README.md
@@ -0,0 +1,20 @@
+# DC9 sing-box
+
+The managed sing-box service runs Trojan, AnyTLS, Hysteria2, VLESS Reality,
+and two Snell compatibility generations.
+
+## Snell compatibility
+
+- `SNELL_V4_PORT` renders a Snell inbound with `version: 5`. sing-box does not
+  implement Snell v5 QUIC, so its v5 TCP wire protocol is compatible with
+  clients configured as Snell v4.
+- `SNELL_V6_PORT` renders a separate `version: 6` inbound. Snell v6 is not wire
+  compatible with v4/v5 and therefore requires its own port and PSK.
+- Keep the existing standalone `snell-managed` project running during the
+  migration. Retire it only after the new v4-compatible inbound passes a
+  sustained client test.
+- Current Mihomo releases support Snell through v5, not v6. Use the v4-compatible
+  endpoint from Mihomo and reserve the v6 endpoint for a sing-box 1.14 client.
+
+The real PSKs live only in the Arcane Environment-local `.env`; never commit
+them to this repository.
diff --git a/servers/bwh-us-dc9/sing-box/compose.yaml b/servers/bwh-us-dc9/sing-box/compose.yaml
index d389c67..89b2d95 100644
--- a/servers/bwh-us-dc9/sing-box/compose.yaml
+++ b/servers/bwh-us-dc9/sing-box/compose.yaml
@@ -17,6 +17,10 @@ services:
       REALITY_SERVER_NAME: ${REALITY_SERVER_NAME}
       REALITY_PRIVATE_KEY: ${REALITY_PRIVATE_KEY}
       REALITY_SHORT_ID: ${REALITY_SHORT_ID}
+      SNELL_V4_PORT: ${SNELL_V4_PORT}
+      SNELL_V4_PSK: ${SNELL_V4_PSK}
+      SNELL_V6_PORT: ${SNELL_V6_PORT}
+      SNELL_V6_PSK: ${SNELL_V6_PSK}
     volumes:
       - ./etc/sing-box/config.json.template:/template/config.json.template:ro
       - sing-box-config:/output
diff --git a/servers/bwh-us-dc9/sing-box/etc/sing-box/config.json.template b/servers/bwh-us-dc9/sing-box/etc/sing-box/config.json.template
index c7faf0b..9e36b57 100644
--- a/servers/bwh-us-dc9/sing-box/etc/sing-box/config.json.template
+++ b/servers/bwh-us-dc9/sing-box/etc/sing-box/config.json.template
@@ -113,6 +113,24 @@
           "max_time_difference": "2m"
         }
       }
+    },
+    {
+      "type": "snell",
+      "tag": "snell-v4-compatible-in",
+      "listen": "::",
+      "listen_port": ${SNELL_V4_PORT},
+      "version": 5,
+      "psk": "${SNELL_V4_PSK}",
+      "obfs_mode": "none"
+    },
+    {
+      "type": "snell",
+      "tag": "snell-v6-in",
+      "listen": "::",
+      "listen_port": ${SNELL_V6_PORT},
+      "version": 6,
+      "psk": "${SNELL_V6_PSK}",
+      "mode": "default"
     }
   ],
   "outbounds": [