feat: add DC9 Snell v4 and v6 inbounds

servers/bwh-us-dc9/sing-box/.env.example

@@ -15,3 +15,9 @@ VLESS_UUID=00000000-0000-4000-8000-000000000000
 REALITY_SERVER_NAME=www.cloudflare.com
 REALITY_PRIVATE_KEY=change-me
 REALITY_SHORT_ID=0123456789abcdef
+
+# sing-box uses version 5 for the Snell v4-compatible TCP wire protocol.
+SNELL_V4_PORT=53469
+SNELL_V4_PSK=change-me
+SNELL_V6_PORT=35737
+SNELL_V6_PSK=change-me-at-least-12-bytes

servers/bwh-us-dc9/sing-box/README.md

@@ -0,0 +1,20 @@
+# DC9 sing-box
+
+The managed sing-box service runs Trojan, AnyTLS, Hysteria2, VLESS Reality,
+and two Snell compatibility generations.
+
+## Snell compatibility
+
+- `SNELL_V4_PORT` renders a Snell inbound with `version: 5`. sing-box does not
+  implement Snell v5 QUIC, so its v5 TCP wire protocol is compatible with
+  clients configured as Snell v4.
+- `SNELL_V6_PORT` renders a separate `version: 6` inbound. Snell v6 is not wire
+  compatible with v4/v5 and therefore requires its own port and PSK.
+- Keep the existing standalone `snell-managed` project running during the
+  migration. Retire it only after the new v4-compatible inbound passes a
+  sustained client test.
+- Current Mihomo releases support Snell through v5, not v6. Use the v4-compatible
+  endpoint from Mihomo and reserve the v6 endpoint for a sing-box 1.14 client.
+
+The real PSKs live only in the Arcane Environment-local `.env`; never commit
+them to this repository.

servers/bwh-us-dc9/sing-box/compose.yaml

@@ -17,6 +17,10 @@ services:
       REALITY_SERVER_NAME: ${REALITY_SERVER_NAME}
       REALITY_PRIVATE_KEY: ${REALITY_PRIVATE_KEY}
       REALITY_SHORT_ID: ${REALITY_SHORT_ID}
+      SNELL_V4_PORT: ${SNELL_V4_PORT}
+      SNELL_V4_PSK: ${SNELL_V4_PSK}
+      SNELL_V6_PORT: ${SNELL_V6_PORT}
+      SNELL_V6_PSK: ${SNELL_V6_PSK}
     volumes:
       - ./etc/sing-box/config.json.template:/template/config.json.template:ro
       - sing-box-config:/output

servers/bwh-us-dc9/sing-box/etc/sing-box/config.json.template

@@ -113,6 +113,24 @@
           "max_time_difference": "2m"
         }
       }
+    },
+    {
+      "type": "snell",
+      "tag": "snell-v4-compatible-in",
+      "listen": "::",
+      "listen_port": ${SNELL_V4_PORT},
+      "version": 5,
+      "psk": "${SNELL_V4_PSK}",
+      "obfs_mode": "none"
+    },
+    {
+      "type": "snell",
+      "tag": "snell-v6-in",
+      "listen": "::",
+      "listen_port": ${SNELL_V6_PORT},
+      "version": 6,
+      "psk": "${SNELL_V6_PSK}",
+      "mode": "default"
     }
   ],
   "outbounds": [