Add HAProxy TLS routing for HK CMI

servers/bwh-hk-cmi/snell/Dockerfile

@@ -0,0 +1,21 @@
+FROM alpine:3.24 AS downloader
+
+ARG SNELL_VERSION=5.0.1
+ARG SNELL_ZIP_SHA256=9bea1c2b9e35b73b31634856c04d18c393072b9e5dcde6a32781d8b8f908c539
+
+RUN apk add --no-cache curl unzip \
+    && curl -fsSL "https://dl.nssurge.com/snell/snell-server-v${SNELL_VERSION}-linux-amd64.zip" -o /tmp/snell.zip \
+    && echo "${SNELL_ZIP_SHA256}  /tmp/snell.zip" | sha256sum -c - \
+    && unzip -p /tmp/snell.zip snell-server > /snell-server \
+    && chmod 755 /snell-server
+
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates libstdc++6 \
+    && rm -rf /var/lib/apt/lists/*
+COPY --from=downloader /snell-server /usr/local/bin/snell-server
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod 755 /usr/local/bin/entrypoint.sh
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

servers/bwh-hk-cmi/snell/README.md

@@ -0,0 +1,5 @@
+# Hong Kong CMI Snell Server (rollback only)
+
+- 当前锁定 Snell Server 5.0.1，由本目录 Dockerfile 从官方包构建并校验 SHA-256。
+- 客户端因禁用 QUIC 显示 `version=4` 属现有兼容用法，不改变服务端 5.0.1 部署。
+- Snell 6 与 5 不兼容。迁移时新增独立 `snell-v6` 服务、端口和 PSK，与 v5 并存；客户端迁移完成后再停 v5。

servers/bwh-hk-cmi/snell/compose.yaml

@@ -0,0 +1,20 @@
+# Retained temporarily as a rollback target during the sing-box migration.
+services:
+  snell-v5:
+    build:
+      context: .
+      args:
+        SNELL_VERSION: 5.0.1
+        SNELL_ZIP_SHA256: 9bea1c2b9e35b73b31634856c04d18c393072b9e5dcde6a32781d8b8f908c539
+    image: local/snell-server:5.0.1
+    restart: unless-stopped
+    ports:
+      - "${HOST_PORT:-47854}:9102/tcp"
+    environment:
+      PSK: ${PSK}
+      PORT: 9102
+    logging:
+      driver: json-file
+      options:
+        max-size: 200k
+        max-file: "2"

servers/bwh-hk-cmi/snell/entrypoint.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+# Hong Kong CMI rollback-only Snell entrypoint.
+set -eu
+
+: "${PSK:?PSK is required}"
+: "${PORT:?PORT is required}"
+
+case "$PORT" in
+  *[!0-9]*|'') echo "PORT must be numeric" >&2; exit 1 ;;
+esac
+
+umask 077
+cat > /tmp/snell-server.conf <<EOF
+[snell-server]
+listen = :::${PORT}
+psk = ${PSK}
+EOF
+
+exec /usr/local/bin/snell-server -c /tmp/snell-server.conf