添加 server_config：jp 服务器端配置（nginx/sing-box/流量监控/脚本/存档），已脱敏

README.md

@@ -1,11 +1,4 @@
 ## 警告
 - 包含 WireGuard 的 common 版本转发器永久不再维护，推荐使用 Lite 版本
 > common 版本现在有许多未修复的 bug (如部分 UI 的显示问题) 、令人难以忍受的代码逻辑 (如 PAC 规则直接写在代码里)和安全性问题 (认证凭据的暴露与证书忽略)，而 Lite 版本修复了这些问题，并会收到持续的更新 
-- 本程序完全没有 Linux 与 CLI 功能兼容，默认构建为带有图形界面的 Windows .exe
+- 当前任何版本内 PAC 规则模式的配置、节点列表的获取随文件一起打包，不具有实时更新可用性，可自行添加
-
-
-## 如何区分 common 版本与 Lite 版本
-- Lite 版本的版本号前四位固定为 9999，后续为从月份开始的构建时间戳，而 common 版本的版本号为包含年份的完整的构建时间戳
-
-## 服务器侧配置手册 (部分内容过时)
-https://rrrosmontis.icu/articles/index.html?id=00005

lite/RRPP_Lite.spec

@@ -0,0 +1,78 @@
+# -*- mode: python ; coding: utf-8 -*-
+
+from PyInstaller.utils.hooks import collect_all
+
+# 强制收集 PyQt5 全部模块及二进制文件
+qt_datas, qt_binaries, qt_hiddenimports = collect_all('PyQt5')
+
+# 自定义 manifest：普通权限运行 + 声明 PerMonitorV2 DPI 感知，
+# 避免程序在不同缩放比例的显示器之间移动时被 Windows 位图拉伸。
+_MANIFEST = r'''<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+  <assemblyIdentity version="1.0.0.0" name="RRPP_Lite" type="win32"/>
+  <description>Royirin Rosmontis Private Proxy Lite</description>
+  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
+    <security>
+      <requestedPrivileges>
+        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
+      </requestedPrivileges>
+    </security>
+  </trustInfo>
+  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
+    <application>
+      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
+      <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
+    </application>
+  </compatibility>
+  <application xmlns="urn:schemas-microsoft-com:asm.v3">
+    <windowsSettings>
+      <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2, PerMonitor, system</dpiAwareness>
+      <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware>
+    </windowsSettings>
+  </application>
+  <dependency>
+    <dependentAssembly>
+      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"/>
+    </dependentAssembly>
+  </dependency>
+</assembly>
+'''
+
+a = Analysis(
+    ['proxy_lite.py'],
+    pathex=['..\\.venv\\Lib\\site-packages'],
+    binaries=qt_binaries,
+    datas=[('..\\ico.ico', '.'), ('pac_domains.json', '.'), ('pac_ip_cn.json', '.')] + qt_datas,
+    hiddenimports=qt_hiddenimports,
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=[],
+    noarchive=False,
+    optimize=0,
+)
+pyz = PYZ(a.pure)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    a.binaries,
+    a.datas,
+    [],
+    name='Royirin Rosmontis Private Proxy Lite',
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=False,
+    # UPX 会压缩资源段（含图标），冷缓存下 Explorer 可能提取不到图标导致任务栏空白
+    upx=False,
+    upx_exclude=[],
+    runtime_tmpdir=None,
+    console=False,
+    disable_windowed_traceback=False,
+    argv_emulation=False,
+    target_arch=None,
+    codesign_identity=None,
+    entitlements_file=None,
+    icon=['..\\ico.ico'],
+    manifest=_MANIFEST,
+)

lite/build_lite.bat

@@ -0,0 +1,6 @@
+@echo off
+cd /d "%~dp0"
+call ..\.venv\Scripts\python.exe -m PyInstaller RRPP_Lite.spec
+echo.
+echo Build complete. Output: dist\Royirin Rosmontis Private Proxy Lite.exe
+pause

lite/config.json

@@ -1,6 +0,0 @@
-{
-  "version": "",
-  "update_url": "",
-  "pac_base_url": "",
-  "nodes_url": ""
-}

lite/nodes.json

@@ -1,10 +0,0 @@
-[
-  {
-    "domain": "",
-    "port": "",
-    "country": "",
-    "username": "",
-    "password": "",
-    "remark": ""
-  }
-]

lite/pac_domains.json

@@ -1,6 +1,216 @@
 {
-  "_comment": "强制走代理隧道的域名后缀模板（数据字段为空）。生成与更新：others/update_pac_domains/update_pac_domains.py；客户端按文件内 version/date 从 CDN 在线更新。",
+  "_comment": "强制走代理隧道的域名后缀（IP 智能分流的补充规则）：命中这些域名的连接即使解析到国内 IP 也强制走隧道。匹配规则：host == 条目 或 host 以 \".条目\" 结尾。该文件可选：EXE 同目录的 pac_domains.json 优先于打包内置版本，可自行增删。",
-  "version": "",
+  "domains": [
-  "date": "",
+    "1e100.net",
-  "domains": []
+    "aistudio.google.com",
-}
+    "akamaihd.net",
+    "anthropic.com",
+    "apexlegends.com",
+    "azure.com",
+    "azureedge.net",
+    "azurefd.net",
+    "battle.net",
+    "bing.com",
+    "bing.net",
+    "bingapis.com",
+    "blizzard.com",
+    "canva.com",
+    "cdninstagram.com",
+    "cf-cdn.com",
+    "chatgpt.com",
+    "clau.de",
+    "claude.ai",
+    "claudeusercontent.com",
+    "cloudflare.com",
+    "cloudflare.net",
+    "cloudflarecdn.com",
+    "cloudflareinsights.com",
+    "cloudflarestatus.com",
+    "cloudfront.net",
+    "cloudinary.com",
+    "crunchyroll.com",
+    "deepmind.com",
+    "deepmind.google.com",
+    "discord.com",
+    "discord.gg",
+    "discord.media",
+    "discordapp.com",
+    "discordapp.net",
+    "disney-plus.net",
+    "disneyplus.com",
+    "docker.com",
+    "docker.io",
+    "dssott.com",
+    "duckduckgo.com",
+    "ea.com",
+    "eaassets.com",
+    "epicgames.com",
+    "facebook.com",
+    "fastly.net",
+    "fastlylb.net",
+    "fb.com",
+    "fbcdn.net",
+    "fbsbx.com",
+    "figma.com",
+    "gemini.google.com",
+    "generativeai.googleapis.com",
+    "ggpht.com",
+    "ghcr.io",
+    "github.com",
+    "github.io",
+    "githubassets.com",
+    "githubcopilot.com",
+    "githubusercontent.com",
+    "gitlab.com",
+    "gitlab.io",
+    "gog.com",
+    "google",
+    "google-analytics.com",
+    "google.co.jp",
+    "google.com",
+    "google.com.hk",
+    "googleapis.com",
+    "googlehosted.com",
+    "googletagmanager.com",
+    "googleusercontent.com",
+    "googlevideo.com",
+    "grok.com",
+    "gstatic.com",
+    "hf.co",
+    "huggingface.co",
+    "huggingfacecdn.com",
+    "hulu.com",
+    "imgur.com",
+    "instagram.com",
+    "itch.io",
+    "jsdelivr.net",
+    "leagueoflegends.com",
+    "licdn.com",
+    "line-apps.com",
+    "line-scdn.net",
+    "line.me",
+    "linkedin.com",
+    "linux.do",
+    "live.com",
+    "max.com",
+    "medium.com",
+    "messenger.com",
+    "meta.ai",
+    "meta.com",
+    "microsoft.com",
+    "microsoft365.com",
+    "microsoftonline.com",
+    "midjourney.com",
+    "msecnd.net",
+    "msftncsi.com",
+    "msn.com",
+    "netflix.com",
+    "netlify.app",
+    "netlify.com",
+    "nflxext.com",
+    "nflximg.net",
+    "nflxvideo.net",
+    "nico.ms",
+    "nicovideo.jp",
+    "nintendo.com",
+    "nintendowifi.net",
+    "oaistatic.com",
+    "oaiusercontent.com",
+    "office.com",
+    "office.net",
+    "openai.com",
+    "openaiusercontent.com",
+    "origin.com",
+    "pages.dev",
+    "paramountplus.com",
+    "patreon.com",
+    "paypal.com",
+    "paypalobjects.com",
+    "perplexity.ai",
+    "pinimg.com",
+    "pinterest.com",
+    "pixiv.net",
+    "playstation.com",
+    "poe.com",
+    "primevideo.com",
+    "proton.me",
+    "protonmail.com",
+    "protonvpn.com",
+    "pximg.net",
+    "quora.com",
+    "redd.it",
+    "reddit.com",
+    "redditmedia.com",
+    "redditstatic.com",
+    "riotgames.com",
+    "s-microsoft.com",
+    "s.team",
+    "sc-cdn.net",
+    "scdn.co",
+    "search.brave.com",
+    "serverfault.com",
+    "signal.org",
+    "slack-edge.com",
+    "slack-imgs.com",
+    "slack.com",
+    "snapchat.com",
+    "sonyentertainmentnetwork.com",
+    "spotify.com",
+    "spotifycdn.com",
+    "stackexchange.com",
+    "stackoverflow.com",
+    "statically.io",
+    "steam-api.com",
+    "steam-chat.com",
+    "steam.com",
+    "steamcdn-a.akamaihd.net",
+    "steamcommunity-a.akamaihd.net",
+    "steamcommunity.com",
+    "steamcontent.com",
+    "steamgames.com",
+    "steampowered.com",
+    "steamserver.net",
+    "steamstatic.com",
+    "steamstore-a.akamaihd.net",
+    "steamusercontent.com",
+    "steamuserimages-a.akamaihd.net",
+    "superuser.com",
+    "t.me",
+    "telega.one",
+    "telegram-cdn.org",
+    "telegram.org",
+    "threads.net",
+    "tiktok.com",
+    "tiktokcdn.com",
+    "tiktokv.com",
+    "ttvnw.net",
+    "tumblr.com",
+    "tv.apple.com",
+    "tvplus.apple.com",
+    "twimg.com",
+    "twitch.tv",
+    "twitchcdn.net",
+    "twitter.com",
+    "ubi.com",
+    "ubisoft.com",
+    "unpkg.com",
+    "unrealengine.com",
+    "valorant.com",
+    "valvesoftware.com",
+    "vercel.app",
+    "vercel.com",
+    "whatsapp.com",
+    "whatsapp.net",
+    "wikimedia.org",
+    "wikipedia.org",
+    "workers.dev",
+    "x.ai",
+    "x.com",
+    "xai.com",
+    "youtube.com",
+    "ytimg.com",
+    "zoom.com",
+    "zoom.us",
+    "zoomgov.com"
+  ]
+}

server_config/README.md

@@ -1,26 +1,51 @@
-# server_config
+# server_config — 服务器端配置（已脱敏）
+
+来源：**jp 服务器**（`iam.aeolianchi.me`，Azure Japan East 学生订阅，Ubuntu 24.04）
+采集时间：2026-08-23
+
+> 本目录只收录**服务器端**配置；客户端（转发器 / PAC / WG）见仓库根目录的 `lite/` 与 `common/`。
+
+## 目录结构
 
 ```
 server_config/
-├── nginx/
+├── nginx/                      # jp nginx（HTTPS CONNECT 代理 + 明文 HTTP 转发 + 伪装站）
-│   ├── nginx.conf
+│   ├── nginx.conf              # 主配置（proxy_connect 模块 + /__proxy 转发 + 自代理环保护）
-│   ├── conf.d/
+│   ├── conf.d/                 # 附加站点
-│   │   ├── api.aeolianchi.me.conf
+│   │   ├── api.aeolianchi.me.conf          # 流量监控状态反代
-│   │   └── autodiscover.aeolianchi.me.conf
+│   │   └── autodiscover.aeolianchi.me.conf # autodiscover 反代（→ bj）
-│   └── local_ip_rules.conf.example
+│   └── local_ip_rules.conf.example         # 本机公网 IP 直连规则（自动生成，示例）
 ├── sing-box/
-│   └── config.json
+│   └── config.json             # VLESS + REALITY 入站（8443），密钥已脱敏
-├── traffic-monitor/
+├── traffic-monitor/            # Azure 门户口径流量监控（/home/agent）
-│   ├── config.json
+│   ├── config.json             # SMTP 凭据已脱敏
-│   ├── traffic_monitor.py
+│   ├── traffic_monitor.py      # 监控脚本（vnstat + Azure Usage Details API）
-│   └── traffic-monitor.service
+│   └── traffic-monitor.service # systemd 单元
 ├── scripts/
-│   ├── sync-nginx-local-ips.sh
+│   ├── sync-nginx-local-ips.sh # 每 5 分钟自动同步公网 IP 直连规则（cron）
-│   └── rrpp-stats
+│   └── rrpp-stats              # vnstat 统计输出（每分钟写入 stats.json）
-├── pac/
+├── pac/                        # 旧版 PAC（现客户端改为内存生成，仅存档）
 │   ├── proxy.pac
 │   └── proxy_wg.pac
 └── cron/
-    ├── crontab.txt
+    ├── crontab.txt             # RRRosmontis 用户 crontab
-    └── sync-nginx-local-ips
+    └── sync-nginx-local-ips    # /etc/cron.d 条目
 ```
+
+## 脱敏说明
+
+| 原文 | 替换为 | 说明 |
+|---|---|---|
+| 公网 IP（`20.48.32.251` / `20.89.52.88`） | `<PUBLIC_IP>` | 服务器公网地址（DNS 可解析，但按惯例遮蔽） |
+| VLESS UUID | `<VLESS_UUID>` | sing-box 入站用户 UUID |
+| REALITY 私钥 | `<REALITY_PRIVATE_KEY>` | TLS Reality 私钥（机密） |
+| REALITY short_id | `<REALITY_SHORT_ID>` | TLS Reality short id |
+| SMTP 账号 / 密码 / 收发地址 | `<SMTP_USER>` `<SMTP_PASSWORD>` `<SMTP_FROM>` `<SMTP_TO>` | 告警邮件凭据 |
+
+未收录：TLS 私钥/证书（仅保留 nginx 中的路径引用）、`/etc/nginx/.htpasswd`（认证哈希，用户名为 `user`）、Azure 订阅 ID 等。
+
+## 安全提示
+
+1. **`common/jp_client.conf`（WireGuard 客户端配置）此前已入库且含真实密钥**（客户端私钥、对端公钥、Endpoint）。若本仓库非私有，建议**轮换 WG 密钥与 sing-box REALITY 密钥**。
+2. `local_ip_rules.conf` 由 `sync-nginx-local-ips.sh` 每 5 分钟自动重写（cron），仓库内为脱敏示例；公网 IP 变更后无需手动改 nginx。
+3. 明文 HTTP 代理路径要求 Basic 认证（`user`）；无认证返回 401，不会成为开放代理。

server_config/nginx/nginx.conf

@@ -56,14 +56,15 @@ http {
         }
     }
 
+    # 443 端口：iam.aeolianchi.me HTTPS 站点 + 认证 CONNECT 代理
     server {
         listen 443 ssl;
         http2 on;
-        server_name XXX;
+        server_name iam.aeolianchi.me;
         root /var/www/html;
 
-        ssl_certificate /etc/nginx/ssl/XXX/fullchain.pem;
+        ssl_certificate /etc/nginx/ssl/iam.aeolianchi.me/fullchain.pem;
-        ssl_certificate_key /etc/nginx/ssl/XXX/privkey.pem;
+        ssl_certificate_key /etc/nginx/ssl/iam.aeolianchi.me/privkey.pem;
         ssl_protocols TLSv1.2 TLSv1.3;
         ssl_ciphers HIGH:!aNULL:!MD5;
         ssl_session_cache shared:SSL:10m;