Cloud Delivery Gateway
This edge cluster provides global asset distribution, caching optimizations, and routing infrastructure.
● All Systems Operational
EOF
# 7. 配置 Caddyfile 并启动以申请正式 SSL 证书
info "配置 Caddy 并申请正式 HTTPS 证书..."
cat << EOF > /etc/caddy/Caddyfile
$DOMAIN {
root * /var/www/html
file_server
@grpc {
header Content-Type application/grpc*
path /$GRPC_SERVICE/*
}
reverse_proxy @grpc 127.0.0.1:$GRPC_PORT {
transport http {
versions h2c 2
}
}
@h2 {
path $H2_PATH
}
reverse_proxy @h2 127.0.0.1:$H2_PORT {
transport http {
versions h2c 2
}
}
}
EOF
systemctl daemon-reload
systemctl enable --now caddy
systemctl restart caddy
CERT_DIR="/etc/sing-box/cert"
mkdir -p "$CERT_DIR"
info "正在验证 Caddy 证书申请状态..."
# 等待 Caddy 申请证书 (最多等待 25 秒)
CADDY_CERT_FOUND=false
for i in {1..25}; do
CERT_FILE=$(find /var/lib/caddy/.local/share/caddy/certificates -type f -name "$DOMAIN.crt" 2>/dev/null | head -n 1)
KEY_FILE=$(find /var/lib/caddy/.local/share/caddy/certificates -type f -name "$DOMAIN.key" 2>/dev/null | head -n 1)
if [[ -n "$CERT_FILE" && -n "$KEY_FILE" && -s "$CERT_FILE" && -s "$KEY_FILE" ]]; then
CADDY_CERT_FOUND=true
break
fi
sleep 1
done
if [[ "$CADDY_CERT_FOUND" == "true" ]]; then
info "成功捕获 Caddy 正规正式 SSL 证书！同步至 Sing-Box..."
cp -L "$CERT_FILE" "$CERT_DIR/server.crt"
cp -L "$KEY_FILE" "$CERT_DIR/server.key"
chmod 644 "$CERT_DIR/server.crt"
chmod 600 "$CERT_DIR/server.key"
HY2_INSECURE_PARAM=""
HY2_INSECURE_NOTE="启用严格校验证书 (抗中间人攻击)"
else
warn "未能在限定时间内直接获取 Caddy 签发证书 (可能 ACME 速率限制或 DNS 解析刚生效)。"
info "临时启用高质量 ECC 自签名证书兜底，可在证书生效后随时执行同步..."
openssl req -x509 -nodes -newkey ec:<(openssl ecparam -name prime256v1) \
-keyout "$CERT_DIR/server.key" \
-out "$CERT_DIR/server.crt" \
-days 3650 \
-subj "/CN=$DOMAIN" \
-addext "subjectAltName=DNS:$DOMAIN" >/dev/null 2>&1
chmod 644 "$CERT_DIR/server.crt"
chmod 600 "$CERT_DIR/server.key"
HY2_INSECURE_PARAM="&insecure=1"
HY2_INSECURE_NOTE="当前使用备用证书 (insecure=1)"
fi
# 8. 生成 Sing-Box 配置文件 (隔离各用户凭据)
info "生成 Sing-Box 配置文件..."
mkdir -p /etc/sing-box
cat << EOF > /etc/sing-box/config.json
{
"log": {
"level": "warn",
"timestamp": true
},
"inbounds": [
{
"type": "vless",
"tag": "vless-h2-in",
"listen": "127.0.0.1",
"listen_port": $H2_PORT,
"users": [
{
"uuid": "$UUID_H2",
"flow": ""
}
],
"transport": {
"type": "http",
"host": [
"$DOMAIN"
],
"path": "$H2_PATH"
}
},
{
"type": "vless",
"tag": "vless-grpc-in",
"listen": "127.0.0.1",
"listen_port": $GRPC_PORT,
"users": [
{
"uuid": "$UUID_GRPC",
"flow": ""
}
],
"transport": {
"type": "grpc",
"service_name": "$GRPC_SERVICE"
}
},
{
"type": "vless",
"tag": "vless-reality-in",
"listen": "::",
"listen_port": $REALITY_PORT,
"users": [
{
"uuid": "$UUID_REALITY",
"flow": "xtls-rprx-vision"
}
],
"tls": {
"enabled": true,
"server_name": "$REALITY_DEST_DOMAIN",
"reality": {
"enabled": true,
"handshake": {
"server": "$REALITY_DEST_DOMAIN",
"server_port": 443
},
"private_key": "$REALITY_PRIVATE_KEY",
"short_id": [
"$REALITY_SHORT_ID"
]
}
}
},
{
"type": "hysteria2",
"tag": "hy2-in",
"listen": "::",
"listen_port": $HY2_PORT,
"users": [
{
"password": "$HY2_PASSWORD"
}
],
"ignore_client_bandwidth": false,
"tls": {
"enabled": true,
"server_name": "$DOMAIN",
"certificate_path": "$CERT_DIR/server.crt",
"key_path": "$CERT_DIR/server.key"
}
}
],
"outbounds": [
{
"type": "direct",
"tag": "direct"
}
]
}
EOF
# 9. 创建守护进程并启动
info "创建 systemd 服务守护..."
cat << EOF > /etc/systemd/system/sing-box.service
[Unit]
Description=sing-box service
Documentation=https://sing-box.sagernet.org
After=network.target nss-lookup.target
[Service]
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
ExecStart=/usr/local/bin/sing-box run -c /etc/sing-box/config.json
Restart=on-failure
RestartSec=10s
LimitNOFILE=infinity
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable --now sing-box
systemctl restart sing-box
# 构建独立链接
LINK_HY2="hysteria2://${HY2_PASSWORD}@${DOMAIN}:${HY2_PORT}/?sni=${DOMAIN}${HY2_INSECURE_PARAM}#Hy2-${DOMAIN}"
LINK_REALITY="vless://${UUID_REALITY}@${SERVER_IP}:${REALITY_PORT}?encryption=none&flow=xtls-rprx-vision&security=reality&sni=${REALITY_DEST_DOMAIN}&fp=chrome&pbk=${REALITY_PUBLIC_KEY}&sid=${REALITY_SHORT_ID}&type=tcp#Reality-${REALITY_DEST_DOMAIN}"
LINK_H2="vless://${UUID_H2}@${DOMAIN}:443?encryption=none&security=tls&sni=${DOMAIN}&type=http&path=$(echo -n "$H2_PATH" | jq -sRr @uri)&host=${DOMAIN}#${DOMAIN}-H2"
LINK_GRPC="vless://${UUID_GRPC}@${DOMAIN}:443?encryption=none&security=tls&sni=${DOMAIN}&type=grpc&serviceName=${GRPC_SERVICE}#${DOMAIN}-gRPC"
# 保存并输出配置信息
INFO_FILE="/etc/sing-box/node_info.txt"
cat << EOF > "$INFO_FILE"
==================================================================
Sing-Box 节点配置与连接信息 (安全加固版)
==================================================================
主域名 (SNI): $DOMAIN
VPS 公网 IP: $SERVER_IP
H2 UUID (独立): $UUID_H2
gRPC UUID (独立): $UUID_GRPC
Reality UUID (独立):$UUID_REALITY
Hy2 强密码: $HY2_PASSWORD
Hy2 证书状态: $HY2_INSECURE_NOTE
Hy2 端口 (UDP): $HY2_PORT
Reality 端口 (TCP): $REALITY_PORT
Reality 伪装 SNI: $REALITY_DEST_DOMAIN
Reality 公钥: $REALITY_PUBLIC_KEY
Reality Short ID: $REALITY_SHORT_ID
------------------------------------------------------------------
[1] VLESS + Reality 节点 (主力推荐 / 直连低延迟):
$LINK_REALITY
[2] Hysteria 2 节点 (UDP加速 / 晚高峰与拥塞优选):
$LINK_HY2
[3] VLESS + H2 节点 (Caddy TLS 443 伪装反代):
$LINK_H2
[4] VLESS + gRPC 节点 (Caddy TLS 443 伪装反代):
$LINK_GRPC
==================================================================
EOF
clear
cat "$INFO_FILE"
echo ""
echo -e "${GREEN}配置已保存至文件: ${INFO_FILE}${PLAIN}"
echo "日常查看节点信息命令: cat ${INFO_FILE}"