Add HAProxy TLS routing for HK CMI

2026-09-02 22:11:50 -07:00
parent 1b65bba73a
commit dc04ab9eac
14 changed files with 76 additions and 66 deletions
@@ -0,0 +1,26 @@
+{
+    servers {
+        protocols h1 h2
+    }
+}
+
+# Hong Kong CMI web endpoints. MeTube is intentionally not routed here.
+rules.kais.cloud {
+    root * /srv/web
+    reverse_proxy filebrowser:80
+}
+
+dav.kais.cloud {
+    root * /srv/web
+    reverse_proxy webdav:80
+}
+
+share.kais.cloud {
+    root * /srv/share
+    encode zstd gzip
+    file_server browse
+}
+
+api.opfo.xyz {
+    reverse_proxy 100.100.130.66:1049
+}
@@ -0,0 +1,8 @@
+# Hong Kong CMI Web Services
+
+- Arcane 项目名：`web-managed`
+- 复用旧项目 `/opt/stacks/web` 下的持久化数据。
+- Secret 仅存 Arcane `.env`：`WEBDAV_PASSWORD`。
+- HAProxy 使用 SNI passthrough 接管 TCP 443：`cmi-tls-a7f29c.opfo.xyz` 转发至 AnyTLS，`conn.opfo.xyz` 转发至 Trojan，其余连接转发至 Caddy。
+- Caddy HTTPS 仅发布在宿主机 `127.0.0.1:8443`，并关闭 HTTP/3，将 UDP 443 留给 Hysteria2。
+- `metacubexd` 与 `metube` 不迁移。
@@ -0,0 +1,49 @@
+services:
+  haproxy:
+    image: haproxy:3.4.4-alpine3.24
+    container_name: haproxy
+    restart: unless-stopped
+    network_mode: host
+    depends_on:
+      - caddy
+    volumes:
+      - ./haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
+    logging:
+      driver: json-file
+      options:
+        max-size: 200k
+        max-file: "2"
+
+  caddy:
+    image: caddy:2.11.4
+    container_name: caddy
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "127.0.0.1:8443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - /opt/stacks/web/caddy/site:/srv
+      - /opt/stacks/web/caddy/data:/data
+      - /opt/stacks/web/caddy/config:/config
+
+  filebrowser:
+    image: filebrowser/filebrowser:s6
+    container_name: filebrowser
+    restart: unless-stopped
+    environment:
+      PUID: 65534
+      PGID: 65534
+    volumes:
+      - /opt/stacks/web/filebrowser/database:/database
+      - /opt/stacks/web/filebrowser/config:/config
+      - /opt/stacks/web/filebrowser/storage:/srv/web
+
+  webdav:
+    image: jinlife/docker-cwebdav
+    restart: always
+    environment:
+      USERNAME: dav
+      PASSWORD: ${WEBDAV_PASSWORD}
+    volumes:
+      - /opt/stacks/web/dav:/media
@@ -0,0 +1,32 @@
+global
+    log stdout format raw local0
+    maxconn 4096
+
+defaults
+    log global
+    mode tcp
+    option tcplog
+    timeout connect 5s
+    timeout client 24h
+    timeout server 24h
+
+frontend tls_443
+    bind 0.0.0.0:443
+    tcp-request inspect-delay 5s
+    tcp-request content accept if { req.ssl_hello_type 1 }
+
+    acl sni_anytls req.ssl_sni -i cmi-tls-a7f29c.opfo.xyz
+    acl sni_trojan req.ssl_sni -i conn.opfo.xyz
+
+    use_backend singbox_anytls if sni_anytls
+    use_backend singbox_trojan if sni_trojan
+    default_backend caddy_https
+
+backend singbox_anytls
+    server anytls 127.0.0.1:28443
+
+backend singbox_trojan
+    server trojan 127.0.0.1:32700
+
+backend caddy_https
+    server caddy 127.0.0.1:8443