Add HAProxy TLS routing for HK CMI

2026-09-02 22:11:50 -07:00
parent 1b65bba73a
commit dc04ab9eac
14 changed files with 76 additions and 66 deletions
@@ -0,0 +1,51 @@
+services:
+  config-render:
+    image: alpine:3.24
+    environment:
+      DOMAIN: ${DOMAIN}
+      ANYTLS_DOMAIN: ${ANYTLS_DOMAIN}
+      ACME_EMAIL: ${ACME_EMAIL}
+      LISTEN_PORT: ${LISTEN_PORT}
+      USER1_PASSWORD: ${USER1_PASSWORD}
+      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN}
+      ANYTLS_PORT: ${ANYTLS_PORT}
+      ANYTLS_PASSWORD: ${ANYTLS_PASSWORD}
+      HY2_PASSWORD: ${HY2_PASSWORD}
+      HY2_OBFS_PASSWORD: ${HY2_OBFS_PASSWORD}
+      HY2_PORT: ${HY2_PORT}
+      SNELL_V4_PORT: ${SNELL_V4_PORT}
+      SNELL_V4_PSK: ${SNELL_V4_PSK}
+      SNELL_V6_PORT: ${SNELL_V6_PORT}
+      SNELL_V6_PSK: ${SNELL_V6_PSK}
+    volumes:
+      - ./etc/sing-box/config.json.template:/template/config.json.template:ro
+      - sing-box-config:/output
+    command:
+      - /bin/sh
+      - -ec
+      - |
+        apk add --no-cache gettext
+        envsubst < /template/config.json.template > /output/config.json
+        chmod 600 /output/config.json
+    restart: "no"
+
+  sing-box:
+    image: ghcr.io/sagernet/sing-box:v1.14.0
+    restart: unless-stopped
+    depends_on:
+      config-render:
+        condition: service_completed_successfully
+    volumes:
+      - sing-box-config:/etc/sing-box:ro
+      - sing-box-data:/var/lib/sing-box
+    command: -D /var/lib/sing-box -C /etc/sing-box/ run
+    network_mode: host
+    logging:
+      driver: json-file
+      options:
+        max-size: 200k
+        max-file: "2"
+
+volumes:
+  sing-box-config:
+  sing-box-data:
@@ -0,0 +1,108 @@
+{
+  "certificate_providers": [
+    {
+      "type": "acme",
+      "tag": "public-cert",
+      "domain": [
+        "${DOMAIN}",
+        "${ANYTLS_DOMAIN}"
+      ],
+      "email": "${ACME_EMAIL}",
+      "dns01_challenge": {
+        "provider": "cloudflare",
+        "api_token": "${CLOUDFLARE_API_TOKEN}"
+      }
+    }
+  ],
+  "inbounds": [
+    {
+      "type": "trojan",
+      "tag": "trojan-in",
+      "listen": "::",
+      "listen_port": ${LISTEN_PORT},
+      "users": [
+        {
+          "name": "user1",
+          "password": "${USER1_PASSWORD}"
+        }
+      ],
+      "tls": {
+        "enabled": true,
+        "server_name": "${DOMAIN}",
+        "certificate_provider": "public-cert"
+      },
+      "multiplex": {
+        "enabled": true
+      }
+    },
+    {
+      "type": "anytls",
+      "tag": "anytls-in",
+      "listen": "::",
+      "listen_port": ${ANYTLS_PORT},
+      "users": [
+        {
+          "name": "user1",
+          "password": "${ANYTLS_PASSWORD}"
+        }
+      ],
+      "tls": {
+        "enabled": true,
+        "server_name": "${ANYTLS_DOMAIN}",
+        "certificate_provider": "public-cert"
+      }
+    },
+    {
+      "type": "hysteria2",
+      "tag": "hysteria2-in",
+      "listen": "0.0.0.0",
+      "listen_port": ${HY2_PORT},
+      "obfs": {
+        "type": "salamander",
+        "password": "${HY2_OBFS_PASSWORD}"
+      },
+      "users": [
+        {
+          "name": "user1",
+          "password": "${HY2_PASSWORD}"
+        }
+      ],
+      "tls": {
+        "enabled": true,
+        "server_name": "${DOMAIN}",
+        "alpn": [
+          "h3"
+        ],
+        "certificate_provider": "public-cert"
+      }
+    },
+    {
+      "type": "snell",
+      "tag": "snell-v4-compatible-in",
+      "listen": "::",
+      "listen_port": ${SNELL_V4_PORT},
+      "version": 5,
+      "psk": "${SNELL_V4_PSK}",
+      "obfs_mode": "none"
+    },
+    {
+      "type": "snell",
+      "tag": "snell-v6-in",
+      "listen": "::",
+      "listen_port": ${SNELL_V6_PORT},
+      "version": 6,
+      "psk": "${SNELL_V6_PSK}",
+      "mode": "default"
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct"
+    }
+  ],
+  "log": {
+    "disabled": false,
+    "level": "info",
+    "timestamp": true
+  }
+}