Add HAProxy TLS routing for HK CMI

servers/bwh-hk-cmi/litellm/README.md

@@ -1,6 +1,6 @@
-# Osaka LiteLLM Vertex AI Relay
+# Hong Kong CMI LiteLLM Vertex AI Relay
 
-- 仅通过 Osaka 节点的 Tailscale IPv4 地址监听；`LISTEN_IP` 不要填写公网地址或 `0.0.0.0`。
+- 仅通过 Hong Kong CMI 节点的 Tailscale IPv4 地址监听；`LISTEN_IP` 不要填写公网地址或 `0.0.0.0`。
 - ADC、LiteLLM key 仅存放于 Arcane `.env`，不得提交 Git。
 - 默认监听端口为 `1049`；需要修改时设置 `LITELLM_PORT`。
 - 后续 Vertex Anthropic 模型在 `config.yaml` 增加独立模型项。

servers/bwh-hk-cmi/litellm/config.yaml

@@ -1,4 +1,4 @@
-# Osaka node model routing.
+# Hong Kong CMI node model routing.
 model_list:
   - model_name: gemini-3.6-flash
     litellm_params:

servers/bwh-hk-cmi/sing-box/compose.yaml

@@ -3,19 +3,16 @@ services:
     image: alpine:3.24
     environment:
       DOMAIN: ${DOMAIN}
+      ANYTLS_DOMAIN: ${ANYTLS_DOMAIN}
       ACME_EMAIL: ${ACME_EMAIL}
       LISTEN_PORT: ${LISTEN_PORT}
       USER1_PASSWORD: ${USER1_PASSWORD}
       CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN}
-      ANYTLS_HY2_PORT: ${ANYTLS_HY2_PORT}
+      ANYTLS_PORT: ${ANYTLS_PORT}
       ANYTLS_PASSWORD: ${ANYTLS_PASSWORD}
       HY2_PASSWORD: ${HY2_PASSWORD}
       HY2_OBFS_PASSWORD: ${HY2_OBFS_PASSWORD}
-      VLESS_PORT: ${VLESS_PORT}
+      HY2_PORT: ${HY2_PORT}
-      VLESS_UUID: ${VLESS_UUID}
-      REALITY_SERVER_NAME: ${REALITY_SERVER_NAME}
-      REALITY_PRIVATE_KEY: ${REALITY_PRIVATE_KEY}
-      REALITY_SHORT_ID: ${REALITY_SHORT_ID}
       SNELL_V4_PORT: ${SNELL_V4_PORT}
       SNELL_V4_PSK: ${SNELL_V4_PSK}
       SNELL_V6_PORT: ${SNELL_V6_PORT}

servers/bwh-hk-cmi/sing-box/etc/sing-box/config.json.template

@@ -4,7 +4,8 @@
       "type": "acme",
       "tag": "public-cert",
       "domain": [
-        "${DOMAIN}"
+        "${DOMAIN}",
+        "${ANYTLS_DOMAIN}"
       ],
       "email": "${ACME_EMAIL}",
       "dns01_challenge": {
@@ -13,14 +14,6 @@
       }
     }
   ],
-  "dns": {
-    "servers": [
-      {
-        "type": "local",
-        "tag": "local"
-      }
-    ]
-  },
   "inbounds": [
     {
       "type": "trojan",
@@ -46,7 +39,7 @@
       "type": "anytls",
       "tag": "anytls-in",
       "listen": "::",
-      "listen_port": ${ANYTLS_HY2_PORT},
+      "listen_port": ${ANYTLS_PORT},
       "users": [
         {
           "name": "user1",
@@ -55,7 +48,7 @@
       ],
       "tls": {
         "enabled": true,
-        "server_name": "${DOMAIN}",
+        "server_name": "${ANYTLS_DOMAIN}",
         "certificate_provider": "public-cert"
       }
     },
@@ -63,7 +56,7 @@
       "type": "hysteria2",
       "tag": "hysteria2-in",
       "listen": "0.0.0.0",
-      "listen_port": ${ANYTLS_HY2_PORT},
+      "listen_port": ${HY2_PORT},
       "obfs": {
         "type": "salamander",
         "password": "${HY2_OBFS_PASSWORD}"
@@ -83,39 +76,6 @@
         "certificate_provider": "public-cert"
       }
     },
-    {
-      "type": "vless",
-      "tag": "vless-reality-in",
-      "listen": "::",
-      "listen_port": ${VLESS_PORT},
-      "users": [
-        {
-          "name": "user1",
-          "uuid": "${VLESS_UUID}",
-          "flow": "xtls-rprx-vision"
-        }
-      ],
-      "tls": {
-        "enabled": true,
-        "server_name": "${REALITY_SERVER_NAME}",
-        "reality": {
-          "enabled": true,
-          "handshake": {
-            "server": "${REALITY_SERVER_NAME}",
-            "server_port": 443,
-            "domain_resolver": {
-              "server": "local",
-              "strategy": "prefer_ipv4"
-            }
-          },
-          "private_key": "${REALITY_PRIVATE_KEY}",
-          "short_id": [
-            "${REALITY_SHORT_ID}"
-          ],
-          "max_time_difference": "2m"
-        }
-      }
-    },
     {
       "type": "snell",
       "tag": "snell-v4-compatible-in",

servers/bwh-hk-cmi/snell/README.md

@@ -1,4 +1,4 @@
-# Osaka Snell Server (rollback only)
+# Hong Kong CMI Snell Server (rollback only)
 
 - 当前锁定 Snell Server 5.0.1，由本目录 Dockerfile 从官方包构建并校验 SHA-256。
 - 客户端因禁用 QUIC 显示 `version=4` 属现有兼容用法，不改变服务端 5.0.1 部署。

servers/bwh-hk-cmi/snell/entrypoint.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# Osaka rollback-only Snell entrypoint.
+# Hong Kong CMI rollback-only Snell entrypoint.
 set -eu
 
 : "${PSK:?PSK is required}"

servers/bwh-hk-cmi/web/Caddyfile

@@ -1,4 +1,10 @@
-# Osaka web endpoints. MeTube is intentionally not routed here.
+{
+    servers {
+        protocols h1 h2
+    }
+}
+
+# Hong Kong CMI web endpoints. MeTube is intentionally not routed here.
 rules.kais.cloud {
     root * /srv/web
     reverse_proxy filebrowser:80

servers/bwh-hk-cmi/web/README.md

@@ -0,0 +1,8 @@
+# Hong Kong CMI Web Services
+
+- Arcane 项目名：`web-managed`
+- 复用旧项目 `/opt/stacks/web` 下的持久化数据。
+- Secret 仅存 Arcane `.env`：`WEBDAV_PASSWORD`。
+- HAProxy 使用 SNI passthrough 接管 TCP 443：`cmi-tls-a7f29c.opfo.xyz` 转发至 AnyTLS，`conn.opfo.xyz` 转发至 Trojan，其余连接转发至 Caddy。
+- Caddy HTTPS 仅发布在宿主机 `127.0.0.1:8443`，并关闭 HTTP/3，将 UDP 443 留给 Hysteria2。
+- `metacubexd` 与 `metube` 不迁移。

servers/bwh-hk-cmi/web/compose.yaml

@@ -1,12 +1,26 @@
 services:
+  haproxy:
+    image: haproxy:3.4.4-alpine3.24
+    container_name: haproxy
+    restart: unless-stopped
+    network_mode: host
+    depends_on:
+      - caddy
+    volumes:
+      - ./haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
+    logging:
+      driver: json-file
+      options:
+        max-size: 200k
+        max-file: "2"
+
   caddy:
     image: caddy:2.11.4
     container_name: caddy
     restart: unless-stopped
     ports:
       - "80:80"
-      - "443:443"
+      - "127.0.0.1:8443:443"
-      - "443:443/udp"
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
       - /opt/stacks/web/caddy/site:/srv

servers/bwh-hk-cmi/web/haproxy/haproxy.cfg

@@ -0,0 +1,32 @@
+global
+    log stdout format raw local0
+    maxconn 4096
+
+defaults
+    log global
+    mode tcp
+    option tcplog
+    timeout connect 5s
+    timeout client 24h
+    timeout server 24h
+
+frontend tls_443
+    bind 0.0.0.0:443
+    tcp-request inspect-delay 5s
+    tcp-request content accept if { req.ssl_hello_type 1 }
+
+    acl sni_anytls req.ssl_sni -i cmi-tls-a7f29c.opfo.xyz
+    acl sni_trojan req.ssl_sni -i conn.opfo.xyz
+
+    use_backend singbox_anytls if sni_anytls
+    use_backend singbox_trojan if sni_trojan
+    default_backend caddy_https
+
+backend singbox_anytls
+    server anytls 127.0.0.1:28443
+
+backend singbox_trojan
+    server trojan 127.0.0.1:32700
+
+backend caddy_https
+    server caddy 127.0.0.1:8443

servers/bwh-jp-osaka/web/README.md

@@ -1,7 +0,0 @@
-# Osaka Web Services
-
-- Arcane 项目名：`web-managed`
-- 复用旧项目 `/opt/stacks/web` 下的持久化数据。
-- Secret 仅存 Arcane `.env`：`WEBDAV_PASSWORD`。
-- 切换前先停止旧 `/opt/stacks/web/compose.yaml`，再启动本项目。
-- `metacubexd` 与 `metube` 不迁移。