Add HAProxy TLS routing for HK CMI

2026-09-02 22:11:50 -07:00
parent 1b65bba73a
commit dc04ab9eac
14 changed files with 76 additions and 66 deletions
@@ -1,6 +1,6 @@
-# Osaka LiteLLM Vertex AI Relay
+# Hong Kong CMI LiteLLM Vertex AI Relay

- 仅通过 Osaka 节点的 Tailscale IPv4 地址监听；`LISTEN_IP` 不要填写公网地址或 `0.0.0.0`。
+- 仅通过 Hong Kong CMI 节点的 Tailscale IPv4 地址监听；`LISTEN_IP` 不要填写公网地址或 `0.0.0.0`。
 - ADC、LiteLLM key 仅存放于 Arcane `.env`，不得提交 Git。
 - 默认监听端口为 `1049`；需要修改时设置 `LITELLM_PORT`。
 - 后续 Vertex Anthropic 模型在 `config.yaml` 增加独立模型项。
@@ -1,4 +1,4 @@
-# Osaka node model routing.
+# Hong Kong CMI node model routing.
 model_list:
  - model_name: gemini-3.6-flash
    litellm_params:
@@ -3,19 +3,16 @@ services:
    image: alpine:3.24
    environment:
      DOMAIN: ${DOMAIN}
+      ANYTLS_DOMAIN: ${ANYTLS_DOMAIN}
      ACME_EMAIL: ${ACME_EMAIL}
      LISTEN_PORT: ${LISTEN_PORT}
      USER1_PASSWORD: ${USER1_PASSWORD}
      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN}
-      ANYTLS_HY2_PORT: ${ANYTLS_HY2_PORT}
+      ANYTLS_PORT: ${ANYTLS_PORT}
      ANYTLS_PASSWORD: ${ANYTLS_PASSWORD}
      HY2_PASSWORD: ${HY2_PASSWORD}
      HY2_OBFS_PASSWORD: ${HY2_OBFS_PASSWORD}
-      VLESS_PORT: ${VLESS_PORT}
-      VLESS_UUID: ${VLESS_UUID}
-      REALITY_SERVER_NAME: ${REALITY_SERVER_NAME}
-      REALITY_PRIVATE_KEY: ${REALITY_PRIVATE_KEY}
-      REALITY_SHORT_ID: ${REALITY_SHORT_ID}
+      HY2_PORT: ${HY2_PORT}
      SNELL_V4_PORT: ${SNELL_V4_PORT}
      SNELL_V4_PSK: ${SNELL_V4_PSK}
      SNELL_V6_PORT: ${SNELL_V6_PORT}
@@ -4,7 +4,8 @@
      "type": "acme",
      "tag": "public-cert",
      "domain": [
-        "${DOMAIN}"
+        "${DOMAIN}",
+        "${ANYTLS_DOMAIN}"
      ],
      "email": "${ACME_EMAIL}",
      "dns01_challenge": {
@@ -13,14 +14,6 @@
      }
    }
  ],
-  "dns": {
-    "servers": [
-      {
-        "type": "local",
-        "tag": "local"
-      }
-    ]
-  },
  "inbounds": [
    {
      "type": "trojan",
@@ -46,7 +39,7 @@
      "type": "anytls",
      "tag": "anytls-in",
      "listen": "::",
-      "listen_port": ${ANYTLS_HY2_PORT},
+      "listen_port": ${ANYTLS_PORT},
      "users": [
        {
          "name": "user1",
@@ -55,7 +48,7 @@
      ],
      "tls": {
        "enabled": true,
-        "server_name": "${DOMAIN}",
+        "server_name": "${ANYTLS_DOMAIN}",
        "certificate_provider": "public-cert"
      }
    },
@@ -63,7 +56,7 @@
      "type": "hysteria2",
      "tag": "hysteria2-in",
      "listen": "0.0.0.0",
-      "listen_port": ${ANYTLS_HY2_PORT},
+      "listen_port": ${HY2_PORT},
      "obfs": {
        "type": "salamander",
        "password": "${HY2_OBFS_PASSWORD}"
@@ -83,39 +76,6 @@
        "certificate_provider": "public-cert"
      }
    },
-    {
-      "type": "vless",
-      "tag": "vless-reality-in",
-      "listen": "::",
-      "listen_port": ${VLESS_PORT},
-      "users": [
-        {
-          "name": "user1",
-          "uuid": "${VLESS_UUID}",
-          "flow": "xtls-rprx-vision"
-        }
-      ],
-      "tls": {
-        "enabled": true,
-        "server_name": "${REALITY_SERVER_NAME}",
-        "reality": {
-          "enabled": true,
-          "handshake": {
-            "server": "${REALITY_SERVER_NAME}",
-            "server_port": 443,
-            "domain_resolver": {
-              "server": "local",
-              "strategy": "prefer_ipv4"
-            }
-          },
-          "private_key": "${REALITY_PRIVATE_KEY}",
-          "short_id": [
-            "${REALITY_SHORT_ID}"
-          ],
-          "max_time_difference": "2m"
-        }
-      }
-    },
    {
      "type": "snell",
      "tag": "snell-v4-compatible-in",
@@ -1,4 +1,4 @@
-# Osaka Snell Server (rollback only)
+# Hong Kong CMI Snell Server (rollback only)

 - 当前锁定 Snell Server 5.0.1，由本目录 Dockerfile 从官方包构建并校验 SHA-256。
 - 客户端因禁用 QUIC 显示 `version=4` 属现有兼容用法，不改变服务端 5.0.1 部署。
@@ -1,5 +1,5 @@
 #!/bin/sh
-# Osaka rollback-only Snell entrypoint.
+# Hong Kong CMI rollback-only Snell entrypoint.
 set -eu

 : "${PSK:?PSK is required}"
@@ -1,4 +1,10 @@
-# Osaka web endpoints. MeTube is intentionally not routed here.
+{
+    servers {
+        protocols h1 h2
+    }
+}
+
+# Hong Kong CMI web endpoints. MeTube is intentionally not routed here.
 rules.kais.cloud {
    root * /srv/web
    reverse_proxy filebrowser:80
@@ -0,0 +1,8 @@
+# Hong Kong CMI Web Services
+
+- Arcane 项目名：`web-managed`
+- 复用旧项目 `/opt/stacks/web` 下的持久化数据。
+- Secret 仅存 Arcane `.env`：`WEBDAV_PASSWORD`。
+- HAProxy 使用 SNI passthrough 接管 TCP 443：`cmi-tls-a7f29c.opfo.xyz` 转发至 AnyTLS，`conn.opfo.xyz` 转发至 Trojan，其余连接转发至 Caddy。
+- Caddy HTTPS 仅发布在宿主机 `127.0.0.1:8443`，并关闭 HTTP/3，将 UDP 443 留给 Hysteria2。
+- `metacubexd` 与 `metube` 不迁移。
@@ -1,12 +1,26 @@
 services:
+  haproxy:
+    image: haproxy:3.4.4-alpine3.24
+    container_name: haproxy
+    restart: unless-stopped
+    network_mode: host
+    depends_on:
+      - caddy
+    volumes:
+      - ./haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
+    logging:
+      driver: json-file
+      options:
+        max-size: 200k
+        max-file: "2"
+
  caddy:
    image: caddy:2.11.4
    container_name: caddy
    restart: unless-stopped
    ports:
      - "80:80"
-      - "443:443"
-      - "443:443/udp"
+      - "127.0.0.1:8443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - /opt/stacks/web/caddy/site:/srv
@@ -0,0 +1,32 @@
+global
+    log stdout format raw local0
+    maxconn 4096
+
+defaults
+    log global
+    mode tcp
+    option tcplog
+    timeout connect 5s
+    timeout client 24h
+    timeout server 24h
+
+frontend tls_443
+    bind 0.0.0.0:443
+    tcp-request inspect-delay 5s
+    tcp-request content accept if { req.ssl_hello_type 1 }
+
+    acl sni_anytls req.ssl_sni -i cmi-tls-a7f29c.opfo.xyz
+    acl sni_trojan req.ssl_sni -i conn.opfo.xyz
+
+    use_backend singbox_anytls if sni_anytls
+    use_backend singbox_trojan if sni_trojan
+    default_backend caddy_https
+
+backend singbox_anytls
+    server anytls 127.0.0.1:28443
+
+backend singbox_trojan
+    server trojan 127.0.0.1:32700
+
+backend caddy_https
+    server caddy 127.0.0.1:8443
@@ -1,7 +0,0 @@
-# Osaka Web Services
-
- Arcane 项目名：`web-managed`
- 复用旧项目 `/opt/stacks/web` 下的持久化数据。
- Secret 仅存 Arcane `.env`：`WEBDAV_PASSWORD`。
- 切换前先停止旧 `/opt/stacks/web/compose.yaml`，再启动本项目。
- `metacubexd` 与 `metube` 不迁移。