RoyirinRosmontis/Private-Proxy
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 21 Wiki Activity

server_config: 重写为完整部署规范（BBR/nginx CONNECT/sing-box/mtg）

Browse Source 
- 新增完整 README.md 部署规范：架构、端口规划、BBR 跨境优化、
  nginx 源码编译+CONNECT 隧道、sing-box(VLESS+REALITY/SS)、mtg(MTProto)、
  本机 IP 自动识别、systemd、启动顺序与验证清单
- nginx/nginx.conf：占位符版，proxy_connect_allow all + 回环保护
- sing-box/config.json：占位符版，VLESS+REALITY + SS
- systemd/：nginx/sing-box/mtg 服务文件
- scripts/sync-nginx-local-ips.sh：去除真实域名，占位符版
- fake-site/index.html：伪装页（清除真实品牌域名）
- 移除过时：traffic-monitor/、pac/、conf.d 具体站点配置
- 所有敏感值（IP/域名/端口/密钥）均以 <占位符> 表示
This commit is contained in:
RRRosmontis
2026-09-10 00:22:03 +08:00
parent 17cdb276ea
commit 20d2532e8f
18 changed files with 550 additions and 2156 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server_config/nginx/conf.d/api.aeolianchi.me.conf
-19
View File
@@ -1,19 +0,0 @@
server {
listen 443 ssl;
http2 on;
server_name api.aeolianchi.me;
ssl_certificate /etc/nginx/ssl/api.aeolianchi.me/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/api.aeolianchi.me/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
location /vpn/status/traffic {
proxy_pass http://127.0.0.1:18080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
server_config/nginx/conf.d/autodiscover.aeolianchi.me.conf
-44
View File
@@ -1,44 +0,0 @@
# autodiscover.aeolianchi.me -> jp 反代 -> bj autodiscover.rrrosmontis.icu
server {
listen 80;
listen [::]:80;
server_name autodiscover.aeolianchi.me;
location /.well-known/acme-challenge/ {
root /var/www/acme;
}
location / {
return 301 https://$host$request_uri;
}
}
# autodiscover.aeolianchi.me 443 -> 反代 -> bj autodiscover.rrrosmontis.icu
server {
listen 443 ssl;
http2 on;
server_name autodiscover.aeolianchi.me;
ssl_certificate /etc/nginx/ssl/aeolianchi.me/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/aeolianchi.me/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
add_header Strict-Transport-Security "max-age=31536000";
error_page 497 https://$host$request_uri;
location / {
proxy_pass https://autodiscover.rrrosmontis.icu;
proxy_set_header Host autodiscover.rrrosmontis.icu;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_ssl_server_name on;
proxy_ssl_name autodiscover.rrrosmontis.icu;
}
access_log /var/log/nginx/autodiscover.aeolianchi.me.log;
error_log /var/log/nginx/autodiscover.aeolianchi.me.error.log;
}
server_config/nginx/local_ip_rules.conf.example
+3 -2
View File
@@ -1,4 +1,5 @@
# nginx 本机公网 IP 直连规则（自动生成，勿手改；由 sync-nginx-local-ips.sh 维护）
# 公网 IP 变更后本文件会被重写并 reload nginx
if ($host = "<PUBLIC_IP>") { rewrite ^(.*)$ /__local$1 last; }
if ($host = "<PUBLIC_IP>") { rewrite ^(.*)$ /__local$1 last; }
# 每条规则对应一个本机公网 IP（出站 IP + 节点域名 A 记录）
if ($host = "<PUBLIC_IP_1>") { rewrite ^(.*)$ /__local$1 last; }
if ($host = "<PUBLIC_IP_2>") { rewrite ^(.*)$ /__local$1 last; }
server_config/nginx/nginx.conf
+12 -43
View File
@@ -1,4 +1,3 @@
load_module /usr/lib/nginx/modules/ngx_http_proxy_connect_module.so;
worker_processes auto;
worker_rlimit_nofile 65535;
events {
@@ -25,45 +24,15 @@ http {
keepalive_timeout 65;
keepalive_requests 100;
# 80 端口：iam.aeolianchi.me 强制跳转到 HTTPS（保留 ACME 验证路径）
# <nginx端口>：主域名 HTTPS 站点 + 认证 CONNECT 代理
server {
listen 80;
server_name iam.aeolianchi.me;
location /.well-known/acme-challenge/ {
root /var/www/acme;
}
location / {
return 301 https://$host$request_uri;
}
}
# 80 端口：默认站点只做静态伪装，不提供代理、不弹认证
server {
listen 80 default_server;
server_name _;
root /var/www/html;
index index.html;
location /.well-known/acme-challenge/ {
root /var/www/acme;
}
location / {
try_files $uri $uri/ =404;
}
}
server {
listen 443 ssl;
listen <nginx端口> ssl;
http2 on;
server_name XXX;
server_name <节点域名>;
root /var/www/html;
ssl_certificate /etc/nginx/ssl/XXX/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/XXX/privkey.pem;
ssl_certificate /etc/nginx/ssl/<节点域名>/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/<节点域名>/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_session_cache shared:SSL:10m;
@@ -74,14 +43,14 @@ http {
auth_basic_user_file /etc/nginx/.htpasswd;
proxy_connect;
proxy_connect_allow 443 563;
proxy_connect_allow all;
proxy_connect_connect_timeout 60s;
proxy_connect_read_timeout 120s;
proxy_connect_send_timeout 120s;
location / {
auth_basic off;
if ($host != "iam.aeolianchi.me") {
if ($host != "<节点域名>") {
rewrite ^ /__proxy last;
}
index index.html;
@@ -104,14 +73,14 @@ http {
}
}
# 443 端口 fallback：其他 SNI 也可用 CONNECT 代理；普通 GET 只返回伪装页
# <nginx端口> fallback：其他 SNI 也可用 CONNECT 代理；普通 GET 只返回伪装页
server {
listen 443 ssl default_server;
listen <nginx端口> ssl default_server;
http2 on;
server_name _;
ssl_certificate /etc/nginx/ssl/iam.aeolianchi.me/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/iam.aeolianchi.me/privkey.pem;
ssl_certificate /etc/nginx/ssl/<节点域名>/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/<节点域名>/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_session_cache shared:SSL:10m;
@@ -122,7 +91,7 @@ http {
auth_basic_user_file /etc/nginx/.htpasswd;
proxy_connect;
proxy_connect_allow 443 563;
proxy_connect_allow all;
proxy_connect_connect_timeout 60s;
proxy_connect_read_timeout 120s;
proxy_connect_send_timeout 120s;