目前有一台vmiss的US.LA.CMIN2

CONTAINER ID   IMAGE                                   COMMAND                  CREATED       STATUS      PORTS                        NAMES
95e5d8dc7e49   teddysun/v2ray                          "/usr/bin/v2ray run …"   9 days ago    Up 9 days   127.0.0.1:10000->10000/tcp   v2ray
e7a34972ab5a   metacubex/mihomo:latest                 "/mihomo -d /root/.c…"   10 days ago   Up 9 days                                mihomo
af41c5a1448f   ghcr.io/7sageer/sublink-worker:latest   "docker-entrypoint.s…"   4 weeks ago   Up 9 days   127.0.0.1:8787->8787/tcp     sublink-worker-worker-1
3034db28e197   redis:7-alpine                          "docker-entrypoint.s…"   4 weeks ago   Up 9 days   6379/tcp                     sublink-worker-redis-1
ebad8f87eba3   tobyxdd/hysteria:v2                     "hysteria server -c …"   5 weeks ago   Up 9 days                                hysteria
321d9b83d570   neilpang/acme.sh                        "/entry.sh daemon"       5 weeks ago   Up 9 days                                acme-sh
88e516ee1832   ghcr.io/xtls/xray-core:26.6.1           "/usr/local/bin/xray…"   5 weeks ago   Up 9 days                                xray

其中v2ray的协议是最传统的vmess+ws+tls+web形式，配置文件是

{
  "log": {
    "loglevel": "warning"
  },
  "inbounds": [
    {
      "port": 10000,
      "listen": "0.0.0.0",
      "protocol": "vmess",
      "settings": {
        "clients": [
          {
            "id": "uuid",
            "alterId": 0
          }
        ]
      },
      "streamSettings": {
        "network": "ws",
        "wsSettings": {
        // 这里是配置代理路径
          "path": "/rasdx2y"
        }
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom"
    }
  ]
}

web用的是caddy,因为会自动配置证书更新，现在用caddy比nginx多了。

example.com:5443 {
    handle /rasdx2y* {
        reverse_proxy 127.0.0.1:10000   #转发到10000端口
    }
    handle {
        respond "Not Found" 404
    }
}

因为现在anytls比较流行，听说可以解决tls in tls的套娃问题，但是xray内核目前没有支持，我就用mihomo内核配置了一个，配置文件是

# 基础配置
mixed-port: 7890
allow-lan: false
mode: rule
log-level: info
ipv6: false

# 核心监听器配置：接收 AnyTLS 流量
listeners:
  - name: anytls-in
    type: anytls
    listen: 0.0.0.0
    port: 8444 # 设置端口
    users:
      Tom: 设置密码
    # 使用容器内的相对路径，避免触发安全路径报错
    certificate: ./certs/server.crt
    private-key: ./certs/server.key

hysteria2 因为udp暴力发包容易被运营商Qos，我主要用作备用，配置文件如下

listen: :443

# 证书配置（注意：这里的路径必须是【容器内部】能看得到的路径）
tls:
  cert: /acme/fullchain.cer
  key: /acme/私钥.key

# 验证配置
auth:
  type: password
  password: abc123 # 👈 改成你想设置的连接密码

# 网页伪装（防主动探测：当有人直接用浏览器访问 https://证书域名 时展示的网页）
masquerade:
  type: proxy
  proxy:
    url: https://example.com # 可以换成任意你喜欢的正规独立站或网页
    rewriteHost: true

这里的网页伪装实测好像不会生效，不知道什么原因。

xray-core用的协议也是这个内核作者RPRX推荐的vless+reality. 不需要自己配置tls.目前测试运行比较稳定 配置文件是

{
  "log": {
    "access": "/var/log/xray/access.log",
    "error": "/var/log/xray/error.log",
    // 这个日志可以按需改成info
    "loglevel": "none"
  },
  "inbounds": [
    {
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "uuid",
            "flow": "xtls-rprx-vision"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "dest": "addons.mozilla.org:443",
          "xver": 0,
          "serverNames": [
            // 目前微软和苹果大厂域名好像会有点问题，偷的是小众一点的域名。
            "addons.mozilla.org"
          ],
          "privateKey": "公钥",
          "shortIds": [
            "随机生成"
          ]
        }
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "tag": "direct"
    },
    {
      "protocol": "blackhole",
      "tag": "blocked"
    }
  ]
}

像mihomo内核现在应该也可以直接配置hysteria2的，xray-core也可以配置vmess+ws+tls+web。目前为了把这几个协议做下隔离，就分别配置了。 还有一台Racknerd上是用的sing-box内核，不是优化线路，用作备用节点，配置文件如下：

{
  "log": {
    "level": "info",
    "timestamp": true
  },
  "inbounds": [
    {
      "type": "hysteria2",
      "tag": "hy2-in",
      "listen": "::",
      "listen_port": 9443,
      "users": [
        {
          "password": "设置密码"
        }
      ],
      "tls": {
        "enabled": true,
        "server_name": "example.com",
        "certificate_path": "/etc/letsencrypt/live/example.com/fullchain.pem",
        "key_path": "/etc/letsencrypt/live/example.com/privkey.pem"
      }
    },
    {
      "type": "vmess",
      "tag": "vmess-ws-tls-in",
      "listen": "::",
      "listen_port": 8443,
      "users": [
        {
          "name": "rn",
          "uuid": "xxxxx-xxxxx-xxxxx",
          "alterId": 0
        }
      ],
      "tls": {
        "enabled": true,
        "server_name": "example.com/",
        "certificate_path": "/etc/letsencrypt/live/example.com//fullchain.pem",
        "key_path": "/etc/letsencrypt/live/example.com//privkey.pem"
      },
      "transport": {
        "type": "ws",
        "path": "/vcmess48sssdddc8s1",
        "max_early_data": 2048,
        "early_data_header_name": "Sec-WebSocket-Protocol"
      }
    }
  ],
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct"
    }
  ]
}

目前还是喜欢老款的vmess+ws+tls+web的形式。

PUBLIC_UTTERANCES_REPO=你的 GitHub 仓库名，例如 owner/repo
PUBLIC_UTTERANCES_ISSUE_TERM=pathname
PUBLIC_UTTERANCES_LABEL=comment
PUBLIC_UTTERANCES_THEME=github-light