commit bab0625575f52bf4dd62d349648198c2eb337e7e
Author: Codex <codex@local>
Date:   Sun Jul 19 08:11:52 2026 -0700

    feat: add per-edge sing-box GitOps projects

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..5bc111f
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,6 @@
+.env
+*.key
+*.pem
+secrets/
+acme/
+
diff --git a/servers/bwh-hk-dc3/sing-box/.env.example b/servers/bwh-hk-dc3/sing-box/.env.example
new file mode 100644
index 0000000..705a466
--- /dev/null
+++ b/servers/bwh-hk-dc3/sing-box/.env.example
@@ -0,0 +1,5 @@
+DOMAIN=hk.example.com
+ACME_EMAIL=admin@example.com
+USER1_PASSWORD=change-me
+CLOUDFLARE_API_TOKEN=change-me
+
diff --git a/servers/bwh-hk-dc3/sing-box/compose.yaml b/servers/bwh-hk-dc3/sing-box/compose.yaml
new file mode 100644
index 0000000..b3e7940
--- /dev/null
+++ b/servers/bwh-hk-dc3/sing-box/compose.yaml
@@ -0,0 +1,40 @@
+services:
+  config-render:
+    image: alpine:3.20
+    environment:
+      DOMAIN: ${DOMAIN}
+      ACME_EMAIL: ${ACME_EMAIL}
+      USER1_PASSWORD: ${USER1_PASSWORD}
+      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN}
+    volumes:
+      - ./etc/sing-box/config.json.template:/template/config.json.template:ro
+      - sing-box-config:/output
+    command:
+      - /bin/sh
+      - -ec
+      - |
+        apk add --no-cache gettext
+        envsubst < /template/config.json.template > /output/config.json
+        chmod 600 /output/config.json
+    restart: "no"
+
+  sing-box:
+    image: ghcr.io/sagernet/sing-box:v1.12.13
+    restart: unless-stopped
+    depends_on:
+      config-render:
+        condition: service_completed_successfully
+    volumes:
+      - sing-box-config:/etc/sing-box:ro
+      - sing-box-data:/var/lib/sing-box
+    command: -D /var/lib/sing-box -C /etc/sing-box/ run
+    network_mode: host
+    logging:
+      driver: json-file
+      options:
+        max-size: 200k
+
+volumes:
+  sing-box-config:
+  sing-box-data:
+
diff --git a/servers/bwh-hk-dc3/sing-box/etc/sing-box/config.json.template b/servers/bwh-hk-dc3/sing-box/etc/sing-box/config.json.template
new file mode 100644
index 0000000..fb77577
--- /dev/null
+++ b/servers/bwh-hk-dc3/sing-box/etc/sing-box/config.json.template
@@ -0,0 +1,43 @@
+{
+  "inbounds": [
+    {
+      "type": "trojan",
+      "tag": "trojan-in",
+      "listen": "::",
+      "listen_port": 7364,
+      "sniff": true,
+      "sniff_override_destination": true,
+      "users": [
+        {
+          "name": "user1",
+          "password": "${USER1_PASSWORD}"
+        }
+      ],
+      "tls": {
+        "enabled": true,
+        "server_name": "${DOMAIN}",
+        "acme": {
+          "domain": "${DOMAIN}",
+          "email": "${ACME_EMAIL}",
+          "dns01_challenge": {
+            "provider": "cloudflare",
+            "api_token": "${CLOUDFLARE_API_TOKEN}"
+          }
+        }
+      },
+      "multiplex": {
+        "enabled": true
+      }
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct"
+    }
+  ],
+  "log": {
+    "disabled": false,
+    "level": "info",
+    "timestamp": true
+  }
+}
diff --git a/servers/bwh-us-dc9/sing-box/.env.example b/servers/bwh-us-dc9/sing-box/.env.example
new file mode 100644
index 0000000..9077497
--- /dev/null
+++ b/servers/bwh-us-dc9/sing-box/.env.example
@@ -0,0 +1,5 @@
+DOMAIN=dc9.example.com
+ACME_EMAIL=admin@example.com
+USER1_PASSWORD=change-me
+CLOUDFLARE_API_TOKEN=change-me
+
diff --git a/servers/bwh-us-dc9/sing-box/compose.yaml b/servers/bwh-us-dc9/sing-box/compose.yaml
new file mode 100644
index 0000000..b3e7940
--- /dev/null
+++ b/servers/bwh-us-dc9/sing-box/compose.yaml
@@ -0,0 +1,40 @@
+services:
+  config-render:
+    image: alpine:3.20
+    environment:
+      DOMAIN: ${DOMAIN}
+      ACME_EMAIL: ${ACME_EMAIL}
+      USER1_PASSWORD: ${USER1_PASSWORD}
+      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN}
+    volumes:
+      - ./etc/sing-box/config.json.template:/template/config.json.template:ro
+      - sing-box-config:/output
+    command:
+      - /bin/sh
+      - -ec
+      - |
+        apk add --no-cache gettext
+        envsubst < /template/config.json.template > /output/config.json
+        chmod 600 /output/config.json
+    restart: "no"
+
+  sing-box:
+    image: ghcr.io/sagernet/sing-box:v1.12.13
+    restart: unless-stopped
+    depends_on:
+      config-render:
+        condition: service_completed_successfully
+    volumes:
+      - sing-box-config:/etc/sing-box:ro
+      - sing-box-data:/var/lib/sing-box
+    command: -D /var/lib/sing-box -C /etc/sing-box/ run
+    network_mode: host
+    logging:
+      driver: json-file
+      options:
+        max-size: 200k
+
+volumes:
+  sing-box-config:
+  sing-box-data:
+
diff --git a/servers/bwh-us-dc9/sing-box/etc/sing-box/config.json.template b/servers/bwh-us-dc9/sing-box/etc/sing-box/config.json.template
new file mode 100644
index 0000000..bf3fa0c
--- /dev/null
+++ b/servers/bwh-us-dc9/sing-box/etc/sing-box/config.json.template
@@ -0,0 +1,44 @@
+{
+  "inbounds": [
+    {
+      "type": "trojan",
+      "tag": "trojan-in",
+      "listen": "::",
+      "listen_port": 7364,
+      "sniff": true,
+      "sniff_override_destination": true,
+      "users": [
+        {
+          "name": "user1",
+          "password": "${USER1_PASSWORD}"
+        }
+      ],
+      "tls": {
+        "enabled": true,
+        "server_name": "${DOMAIN}",
+        "acme": {
+          "domain": "${DOMAIN}",
+          "email": "${ACME_EMAIL}",
+          "dns01_challenge": {
+            "provider": "cloudflare",
+            "api_token": "${CLOUDFLARE_API_TOKEN}"
+          }
+        }
+      },
+      "multiplex": {
+        "enabled": true
+      }
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct"
+    }
+  ],
+  "log": {
+    "disabled": false,
+    "level": "info",
+    "timestamp": true
+  }
+}
+