diff --git a/servers/bwh-jp-osaka/litellm/README.md b/servers/bwh-hk-cmi/litellm/README.md similarity index 57% rename from servers/bwh-jp-osaka/litellm/README.md rename to servers/bwh-hk-cmi/litellm/README.md index a39b7e3..684d967 100644 --- a/servers/bwh-jp-osaka/litellm/README.md +++ b/servers/bwh-hk-cmi/litellm/README.md @@ -1,6 +1,6 @@ -# Osaka LiteLLM Vertex AI Relay +# Hong Kong CMI LiteLLM Vertex AI Relay -- 仅通过 Osaka 节点的 Tailscale IPv4 地址监听；`LISTEN_IP` 不要填写公网地址或 `0.0.0.0`。 +- 仅通过 Hong Kong CMI 节点的 Tailscale IPv4 地址监听；`LISTEN_IP` 不要填写公网地址或 `0.0.0.0`。 - ADC、LiteLLM key 仅存放于 Arcane `.env`，不得提交 Git。 - 默认监听端口为 `1049`；需要修改时设置 `LITELLM_PORT`。 - 后续 Vertex Anthropic 模型在 `config.yaml` 增加独立模型项。 diff --git a/servers/bwh-jp-osaka/litellm/compose.yaml b/servers/bwh-hk-cmi/litellm/compose.yaml similarity index 100% rename from servers/bwh-jp-osaka/litellm/compose.yaml rename to servers/bwh-hk-cmi/litellm/compose.yaml diff --git a/servers/bwh-jp-osaka/litellm/config.yaml b/servers/bwh-hk-cmi/litellm/config.yaml similarity index 92% rename from servers/bwh-jp-osaka/litellm/config.yaml rename to servers/bwh-hk-cmi/litellm/config.yaml index 5072a65..6a15498 100644 --- a/servers/bwh-jp-osaka/litellm/config.yaml +++ b/servers/bwh-hk-cmi/litellm/config.yaml @@ -1,4 +1,4 @@ -# Osaka node model routing. +# Hong Kong CMI node model routing. model_list: - model_name: gemini-3.6-flash litellm_params: diff --git a/servers/bwh-jp-osaka/sing-box/compose.yaml b/servers/bwh-hk-cmi/sing-box/compose.yaml similarity index 84% rename from servers/bwh-jp-osaka/sing-box/compose.yaml rename to servers/bwh-hk-cmi/sing-box/compose.yaml index 74d39e8..2932e9f 100644 --- a/servers/bwh-jp-osaka/sing-box/compose.yaml +++ b/servers/bwh-hk-cmi/sing-box/compose.yaml @@ -3,19 +3,16 @@ services: image: alpine:3.24 environment: DOMAIN: ${DOMAIN} + ANYTLS_DOMAIN: ${ANYTLS_DOMAIN} ACME_EMAIL: ${ACME_EMAIL} LISTEN_PORT: ${LISTEN_PORT} USER1_PASSWORD: ${USER1_PASSWORD} CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN} - ANYTLS_HY2_PORT: ${ANYTLS_HY2_PORT} + ANYTLS_PORT: ${ANYTLS_PORT} ANYTLS_PASSWORD: ${ANYTLS_PASSWORD} HY2_PASSWORD: ${HY2_PASSWORD} HY2_OBFS_PASSWORD: ${HY2_OBFS_PASSWORD} - VLESS_PORT: ${VLESS_PORT} - VLESS_UUID: ${VLESS_UUID} - REALITY_SERVER_NAME: ${REALITY_SERVER_NAME} - REALITY_PRIVATE_KEY: ${REALITY_PRIVATE_KEY} - REALITY_SHORT_ID: ${REALITY_SHORT_ID} + HY2_PORT: ${HY2_PORT} SNELL_V4_PORT: ${SNELL_V4_PORT} SNELL_V4_PSK: ${SNELL_V4_PSK} SNELL_V6_PORT: ${SNELL_V6_PORT} diff --git a/servers/bwh-jp-osaka/sing-box/etc/sing-box/config.json.template b/servers/bwh-hk-cmi/sing-box/etc/sing-box/config.json.template similarity index 65% rename from servers/bwh-jp-osaka/sing-box/etc/sing-box/config.json.template rename to servers/bwh-hk-cmi/sing-box/etc/sing-box/config.json.template index d8ea77d..c149976 100644 --- a/servers/bwh-jp-osaka/sing-box/etc/sing-box/config.json.template +++ b/servers/bwh-hk-cmi/sing-box/etc/sing-box/config.json.template @@ -4,7 +4,8 @@ "type": "acme", "tag": "public-cert", "domain": [ - "${DOMAIN}" + "${DOMAIN}", + "${ANYTLS_DOMAIN}" ], "email": "${ACME_EMAIL}", "dns01_challenge": { @@ -13,14 +14,6 @@ } } ], - "dns": { - "servers": [ - { - "type": "local", - "tag": "local" - } - ] - }, "inbounds": [ { "type": "trojan", @@ -46,7 +39,7 @@ "type": "anytls", "tag": "anytls-in", "listen": "::", - "listen_port": ${ANYTLS_HY2_PORT}, + "listen_port": ${ANYTLS_PORT}, "users": [ { "name": "user1", @@ -55,7 +48,7 @@ ], "tls": { "enabled": true, - "server_name": "${DOMAIN}", + "server_name": "${ANYTLS_DOMAIN}", "certificate_provider": "public-cert" } }, @@ -63,7 +56,7 @@ "type": "hysteria2", "tag": "hysteria2-in", "listen": "0.0.0.0", - "listen_port": ${ANYTLS_HY2_PORT}, + "listen_port": ${HY2_PORT}, "obfs": { "type": "salamander", "password": "${HY2_OBFS_PASSWORD}" @@ -83,39 +76,6 @@ "certificate_provider": "public-cert" } }, - { - "type": "vless", - "tag": "vless-reality-in", - "listen": "::", - "listen_port": ${VLESS_PORT}, - "users": [ - { - "name": "user1", - "uuid": "${VLESS_UUID}", - "flow": "xtls-rprx-vision" - } - ], - "tls": { - "enabled": true, - "server_name": "${REALITY_SERVER_NAME}", - "reality": { - "enabled": true, - "handshake": { - "server": "${REALITY_SERVER_NAME}", - "server_port": 443, - "domain_resolver": { - "server": "local", - "strategy": "prefer_ipv4" - } - }, - "private_key": "${REALITY_PRIVATE_KEY}", - "short_id": [ - "${REALITY_SHORT_ID}" - ], - "max_time_difference": "2m" - } - } - }, { "type": "snell", "tag": "snell-v4-compatible-in", diff --git a/servers/bwh-jp-osaka/snell/Dockerfile b/servers/bwh-hk-cmi/snell/Dockerfile similarity index 100% rename from servers/bwh-jp-osaka/snell/Dockerfile rename to servers/bwh-hk-cmi/snell/Dockerfile diff --git a/servers/bwh-jp-osaka/snell/README.md b/servers/bwh-hk-cmi/snell/README.md similarity index 88% rename from servers/bwh-jp-osaka/snell/README.md rename to servers/bwh-hk-cmi/snell/README.md index 8f09675..05adb47 100644 --- a/servers/bwh-jp-osaka/snell/README.md +++ b/servers/bwh-hk-cmi/snell/README.md @@ -1,4 +1,4 @@ -# Osaka Snell Server (rollback only) +# Hong Kong CMI Snell Server (rollback only) - 当前锁定 Snell Server 5.0.1，由本目录 Dockerfile 从官方包构建并校验 SHA-256。 - 客户端因禁用 QUIC 显示 `version=4` 属现有兼容用法，不改变服务端 5.0.1 部署。 diff --git a/servers/bwh-jp-osaka/snell/compose.yaml b/servers/bwh-hk-cmi/snell/compose.yaml similarity index 100% rename from servers/bwh-jp-osaka/snell/compose.yaml rename to servers/bwh-hk-cmi/snell/compose.yaml diff --git a/servers/bwh-jp-osaka/snell/entrypoint.sh b/servers/bwh-hk-cmi/snell/entrypoint.sh similarity index 86% rename from servers/bwh-jp-osaka/snell/entrypoint.sh rename to servers/bwh-hk-cmi/snell/entrypoint.sh index 3773ef2..800e8c0 100644 --- a/servers/bwh-jp-osaka/snell/entrypoint.sh +++ b/servers/bwh-hk-cmi/snell/entrypoint.sh @@ -1,5 +1,5 @@ #!/bin/sh -# Osaka rollback-only Snell entrypoint. +# Hong Kong CMI rollback-only Snell entrypoint. set -eu : "${PSK:?PSK is required}" diff --git a/servers/bwh-jp-osaka/web/Caddyfile b/servers/bwh-hk-cmi/web/Caddyfile similarity index 70% rename from servers/bwh-jp-osaka/web/Caddyfile rename to servers/bwh-hk-cmi/web/Caddyfile index 4a12517..2b5b27e 100644 --- a/servers/bwh-jp-osaka/web/Caddyfile +++ b/servers/bwh-hk-cmi/web/Caddyfile @@ -1,4 +1,10 @@ -# Osaka web endpoints. MeTube is intentionally not routed here. +{ + servers { + protocols h1 h2 + } +} + +# Hong Kong CMI web endpoints. MeTube is intentionally not routed here. rules.kais.cloud { root * /srv/web reverse_proxy filebrowser:80 diff --git a/servers/bwh-hk-cmi/web/README.md b/servers/bwh-hk-cmi/web/README.md new file mode 100644 index 0000000..45d69c4 --- /dev/null +++ b/servers/bwh-hk-cmi/web/README.md @@ -0,0 +1,8 @@ +# Hong Kong CMI Web Services + +- Arcane 项目名：`web-managed` +- 复用旧项目 `/opt/stacks/web` 下的持久化数据。 +- Secret 仅存 Arcane `.env`：`WEBDAV_PASSWORD`。 +- HAProxy 使用 SNI passthrough 接管 TCP 443：`cmi-tls-a7f29c.opfo.xyz` 转发至 AnyTLS，`conn.opfo.xyz` 转发至 Trojan，其余连接转发至 Caddy。 +- Caddy HTTPS 仅发布在宿主机 `127.0.0.1:8443`，并关闭 HTTP/3，将 UDP 443 留给 Hysteria2。 +- `metacubexd` 与 `metube` 不迁移。 diff --git a/servers/bwh-jp-osaka/web/compose.yaml b/servers/bwh-hk-cmi/web/compose.yaml similarity index 69% rename from servers/bwh-jp-osaka/web/compose.yaml rename to servers/bwh-hk-cmi/web/compose.yaml index 771ca56..4e11b5c 100644 --- a/servers/bwh-jp-osaka/web/compose.yaml +++ b/servers/bwh-hk-cmi/web/compose.yaml @@ -1,12 +1,26 @@ services: + haproxy: + image: haproxy:3.4.4-alpine3.24 + container_name: haproxy + restart: unless-stopped + network_mode: host + depends_on: + - caddy + volumes: + - ./haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro + logging: + driver: json-file + options: + max-size: 200k + max-file: "2" + caddy: image: caddy:2.11.4 container_name: caddy restart: unless-stopped ports: - "80:80" - - "443:443" - - "443:443/udp" + - "127.0.0.1:8443:443" volumes: - ./Caddyfile:/etc/caddy/Caddyfile:ro - /opt/stacks/web/caddy/site:/srv diff --git a/servers/bwh-hk-cmi/web/haproxy/haproxy.cfg b/servers/bwh-hk-cmi/web/haproxy/haproxy.cfg new file mode 100644 index 0000000..292668e --- /dev/null +++ b/servers/bwh-hk-cmi/web/haproxy/haproxy.cfg @@ -0,0 +1,32 @@ +global + log stdout format raw local0 + maxconn 4096 + +defaults + log global + mode tcp + option tcplog + timeout connect 5s + timeout client 24h + timeout server 24h + +frontend tls_443 + bind 0.0.0.0:443 + tcp-request inspect-delay 5s + tcp-request content accept if { req.ssl_hello_type 1 } + + acl sni_anytls req.ssl_sni -i cmi-tls-a7f29c.opfo.xyz + acl sni_trojan req.ssl_sni -i conn.opfo.xyz + + use_backend singbox_anytls if sni_anytls + use_backend singbox_trojan if sni_trojan + default_backend caddy_https + +backend singbox_anytls + server anytls 127.0.0.1:28443 + +backend singbox_trojan + server trojan 127.0.0.1:32700 + +backend caddy_https + server caddy 127.0.0.1:8443 diff --git a/servers/bwh-jp-osaka/web/README.md b/servers/bwh-jp-osaka/web/README.md deleted file mode 100644 index 2c2e74c..0000000 --- a/servers/bwh-jp-osaka/web/README.md +++ /dev/null @@ -1,7 +0,0 @@ -# Osaka Web Services - -- Arcane 项目名：`web-managed` -- 复用旧项目 `/opt/stacks/web` 下的持久化数据。 -- Secret 仅存 Arcane `.env`：`WEBDAV_PASSWORD`。 -- 切换前先停止旧 `/opt/stacks/web/compose.yaml`，再启动本项目。 -- `metacubexd` 与 `metube` 不迁移。