# DC1 sing-box

The managed sing-box service provides:

- Trojan on internal TCP 34795, exposed only on TCP 443 through HAProxy
- AnyTLS on internal TCP 40887, exposed only on TCP 443 through HAProxy
- Hysteria2 on UDP 443
- Snell v4-compatible on TCP 31385 (`version: 5` server wire format)
- Snell v6 on TCP 27276

Credentials and the Cloudflare API token live only in the Arcane
Environment-local `.env`. Reality is intentionally omitted because it did not
pass repeat interoperability tests on the existing HK and DC9 nodes. The ACME
provider is ZeroSSL; sing-box automatically obtains ZeroSSL EAB credentials
from the configured account email.