Merge branch 'master' into singbox

app/i18n.php

@@ -262,8 +262,8 @@ $i = [
         'ru' => 'очистить',
     ],
     'xray'  => [
-        'en' => 'Xray',
-        'ru' => 'Xray',
+        'en' => 'Sing-box',
+        'ru' => 'Sing-box',
     ],
     'geodb'  => [
         'en' => 'GeoIp/GeoSite',

config/nginx.conf

@@ -2,7 +2,6 @@ user  nginx;
 worker_processes  auto;
 
 error_log  /logs/nginx_error;
-pid        /var/run/nginx.pid;
 
 events {
     worker_connections  1024;
@@ -22,8 +21,8 @@ http {
   set_real_ip_from    10.10.0.10;
 
   server {
-    listen 10.10.0.2:80 default_server;
-    listen 10.10.0.2:443 ssl http2 default_server proxy_protocol;
+    listen 80 default_server;
+    listen 443 ssl http2 default_server proxy_protocol;
     ssl_certificate /certs/self_public;
     ssl_certificate_key /certs/self_private;
 
@@ -64,17 +63,6 @@ http {
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection "upgrade";
     }
-    location /ws {
-        proxy_pass http://xr:443;
-        proxy_redirect off;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_read_timeout 5d;
-    }
     location ~\.well-known {
       access_log /logs/nginx_certbot_access;
       root /certs/;
@@ -86,12 +74,11 @@ http {
 
 #-domain
   # server {
-  #   listen 10.10.0.2:80;
+  #   listen 80;
   #   server_name ;
 #-domain
 #-ssl
-    # listen 10.10.0.2:443 ssl http2 proxy_protocol;
-    # listen 10.10.1.2:443 ssl http2;
+    # listen 443 ssl http2 proxy_protocol;
     # ssl_certificate /certs/cert_public;
     # ssl_certificate_key /certs/cert_private;
 #-ssl
@@ -135,17 +122,6 @@ http {
   #     proxy_set_header Upgrade $http_upgrade;
   #     proxy_set_header Connection "upgrade";
   #   }
-  #   location /ws {
-  #       proxy_pass http://xr:443;
-  #       proxy_redirect off;
-  #       proxy_http_version 1.1;
-  #       proxy_set_header Upgrade $http_upgrade;
-  #       proxy_set_header Connection "upgrade";
-  #       proxy_set_header Host $host;
-  #       proxy_set_header X-Real-IP $remote_addr;
-  #       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-  #       proxy_read_timeout 5d;
-  #    }
 #-domain
 #-ssl
   #   # The DoH server block

config/nginx_default.conf

@@ -2,7 +2,6 @@ user  nginx;
 worker_processes  auto;
 
 error_log  /logs/nginx_error;
-pid        /var/run/nginx.pid;
 
 events {
     worker_connections  1024;
@@ -22,8 +21,8 @@ http {
   set_real_ip_from    10.10.0.10;
 
   server {
-    listen 10.10.0.2:80 default_server;
-    listen 10.10.0.2:443 ssl http2 default_server proxy_protocol;
+    listen 80 default_server;
+    listen 443 ssl http2 default_server proxy_protocol;
     ssl_certificate /certs/self_public;
     ssl_certificate_key /certs/self_private;
 
@@ -64,17 +63,6 @@ http {
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection "upgrade";
     }
-    location /ws {
-        proxy_pass http://xr:443;
-        proxy_redirect off;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_read_timeout 5d;
-    }
     location ~\.well-known {
       access_log /logs/nginx_certbot_access;
       root /certs/;
@@ -86,12 +74,11 @@ http {
 
 #-domain
   # server {
-  #   listen 10.10.0.2:80;
+  #   listen 80;
   #   server_name ;
 #-domain
 #-ssl
-    # listen 10.10.0.2:443 ssl http2 proxy_protocol;
-    # listen 10.10.1.2:443 ssl http2;
+    # listen 443 ssl http2 proxy_protocol;
     # ssl_certificate /certs/cert_public;
     # ssl_certificate_key /certs/cert_private;
 #-ssl
@@ -135,17 +122,6 @@ http {
   #     proxy_set_header Upgrade $http_upgrade;
   #     proxy_set_header Connection "upgrade";
   #   }
-  #   location /ws {
-  #       proxy_pass http://xr:443;
-  #       proxy_redirect off;
-  #       proxy_http_version 1.1;
-  #       proxy_set_header Upgrade $http_upgrade;
-  #       proxy_set_header Connection "upgrade";
-  #       proxy_set_header Host $host;
-  #       proxy_set_header X-Real-IP $remote_addr;
-  #       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-  #       proxy_read_timeout 5d;
-  #    }
 #-domain
 #-ssl
   #   # The DoH server block

config/pac.json

@@ -1,99 +1,3 @@
 {
-    "zapret": false,
-    "excludelist": {
-        "(?:v|w)ul(?:c|k)an": true,
-        "^\\d": true,
-        "^a\\w-": true,
-        "^admiral": true,
-        "^avtomaty": true,
-        "^azart": true,
-        "^azimob": true,
-        "^baltplay": true,
-        "a(?:s|z)ino": true,
-        "adrenalin": true,
-        "alco": true,
-        "bet": true,
-        "prostitut": true,
-        "zenit": true,
-        "zerkalo": true,
-        "777": true
-    },
-    "includelist": {},
-    "reverselist": {},
-    "subzoneslist": {
-        "3dn": false,
-        "3nx": true,
-        "akadns": true,
-        "appspot": true,
-        "azurewebsites": true,
-        "beget": true,
-        "berlogovo": true,
-        "biz": true,
-        "brightcove": true,
-        "cc": true,
-        "cloudfront": true,
-        "co": true,
-        "com": true,
-        "cu": true,
-        "ddns": true,
-        "deviantart": true,
-        "dn": true,
-        "dp": true,
-        "dyndns": true,
-        "edgecastcdn": true,
-        "edu": true,
-        "eu": true,
-        "fastly": true,
-        "force": true,
-        "github": true,
-        "google": true,
-        "googleusercontent": true,
-        "gov": true,
-        "herokuapp": true,
-        "hldns": true,
-        "ho": true,
-        "hopto": true,
-        "hwcdn": true,
-        "i": true,
-        "iboards": true,
-        "in": true,
-        "info": true,
-        "int": true,
-        "itch": true,
-        "keenetic": true,
-        "kiev": true,
-        "kirov": true,
-        "linode": true,
-        "livejournal": true,
-        "maryno": true,
-        "mil": true,
-        "msk": true,
-        "my1": true,
-        "mybb2": true,
-        "ne": true,
-        "net": true,
-        "netdna-ssl": true,
-        "nnov": true,
-        "notion": true,
-        "nov": true,
-        "od": true,
-        "org": true,
-        "pp": true,
-        "pximg": true,
-        "pythonanywhere": true,
-        "ru": true,
-        "scaleway": true,
-        "sl": true,
-        "sl-reverse": true,
-        "spb": true,
-        "tilda": true,
-        "trafficmanager": true,
-        "tut": true,
-        "u-stream": true,
-        "ucoz": true,
-        "v": true,
-        "vercel": true,
-        "wix": true,
-        "wixmp": true
-    }
-}
+    "includelist": []
+}

config/sing.json

@@ -54,54 +54,10 @@
                 "detour": "direct"
             }
         ],
-        "rules": [
-            {
-                "outbound": "any",
-                "server": "dns-direct",
-                "disable_cache": false
-            }
-        ],
         "strategy": "ipv4_only",
         "independent_cache": true
     },
-    "outbounds": [
-        {
-            "flow": "xtls-rprx-vision",
-            "packet_encoding": "",
-            "server": "",
-            "server_port": 443,
-            "tls": {
-                "enabled": true,
-                "insecure": false,
-                "reality": {
-                    "enabled": true,
-                    "public_key": "",
-                    "short_id": ""
-                },
-                "server_name": "",
-                "utls": {
-                    "enabled": true,
-                    "fingerprint": "chrome"
-                }
-            },
-            "uuid": "",
-            "type": "vless",
-            "domain_strategy": "ipv4_only",
-            "tag": "proxy"
-        },
-        {
-            "type": "direct",
-            "tag": "direct"
-        },
-        {
-            "type": "block",
-            "tag": "block"
-        },
-        {
-            "type": "dns",
-            "tag": "dns-out"
-        }
-    ],
+    "outbounds": [],
     "route": {
         "auto_detect_interface": true,
         "override_android_vpn": true,

config/singbox.json

@@ -0,0 +1,26 @@
+{
+    "inbounds": [],
+    "log": {
+        "level": "info"
+    },
+    "outbounds": [
+        {
+            "type": "direct",
+            "tag": "direct"
+        },
+        {
+            "type": "block",
+            "tag": "block"
+        },
+        {
+            "type": "socks",
+            "tag": "warp",
+            "server": "10.10.0.13",
+            "server_port": 4000
+        }
+    ],
+    "route" : {
+        "rules": [],
+        "final": "direct"
+    }
+}

config/upstream.conf

@@ -15,8 +15,12 @@ stream {
         server ng:443;
     }
 
-    upstream reality {
-        server xr:443;
+    upstream si {
+        server si:443;
+    }
+
+    upstream singbox {
+        server 127.0.0.1:4443;
     }
 
     upstream ocserv {
@@ -30,7 +34,7 @@ stream {
     map_hash_bucket_size 128;
     map $ssl_preread_server_name $sni_name {
         #domain
-        www.microsoft.com reality;
+        vk.com singbox;
         #domain
 
         #ocserv
@@ -43,17 +47,22 @@ stream {
         default other;
     }
 
+    server {
+        listen          4443 reuseport proxy_protocol;
+        proxy_pass      si;
+    }
+
     server {
         listen          443 reuseport;
         proxy_pass      $sni_name;
-        proxy_protocol  on;
         ssl_preread     on;
+        proxy_protocol  on;
     }
 
     server {
         listen          443 udp;
         proxy_pass      $sni_name;
-        proxy_protocol  on;
         ssl_preread     on;
+        proxy_protocol  on;
     }
 }

config/xray.json

@@ -1,61 +0,0 @@
-{
-    "inbounds": [
-        {
-            "port": 443,
-            "protocol": "vless",
-            "settings": {
-                "clients": [
-                ],
-                "decryption": "none"
-            },
-            "sniffing": {
-                "destOverride": [
-                    "http",
-                    "tls"
-                ],
-                "enabled": true
-            },
-            "streamSettings": {
-                "network": "tcp",
-                "realitySettings": {
-                    "dest": "www.microsoft.com:443",
-                    "maxClientVer": "",
-                    "maxTimeDiff": 0,
-                    "minClientVer": "",
-                    "privateKey": "",
-                    "serverNames": [
-                        "www.microsoft.com"
-                    ],
-                    "shortIds": [],
-                    "show": false,
-                    "xver": 0
-                },
-                "tcpSettings": {
-                    "acceptProxyProtocol": true
-                },
-                "sockopt": {
-                    "acceptProxyProtocol": true
-                },
-                "security": "reality"
-            },
-            "tag": "vless_tls"
-        }
-    ],
-    "log": {
-        "loglevel": "info"
-    },
-    "outbounds": [
-        {
-            "protocol": "freedom",
-            "tag": "direct"
-        },
-        {
-            "protocol": "blackhole",
-            "tag": "block"
-        }
-    ],
-    "routing": {
-        "domainStrategy": "AsIs",
-        "rules": []
-    }
-}

docker-compose.yml

@@ -10,10 +10,6 @@ networks:
         ipam:
             config:
                 - subnet: 10.10.0.0/24
-    xray:
-        ipam:
-            config:
-                - subnet: 10.10.1.0/24
 volumes:
     adguard:
 
@@ -27,9 +23,9 @@ services:
                 image: ${IMAGE}
         volumes:
             - ./config/.profile:/root/.ashrc:ro
-            - ./config/upstream.conf:/etc/nginx/nginx.conf
             - ./scripts/start_upstream.sh:/start_upstream.sh
             - ./ssh:/ssh
+            - ./config:/config
             - ./config/sshd_config:/etc/ssh/sshd_config
             - ./logs/:/logs/
         ports:
@@ -63,9 +59,7 @@ services:
                 image: ${IMAGE}
         volumes:
             - ./config/.profile:/root/.ashrc:ro
-            - ./config/nginx.conf:/etc/nginx/nginx.conf
-            - ./config/include.conf:/etc/nginx/include.conf
-            - ./config/nginx_default.conf:/nginx_default.conf
+            - ./config:/config
             - ./scripts/start_ng.sh:/start_ng.sh
             - ./certs/:/certs/
             - ./ssh:/ssh
@@ -89,8 +83,6 @@ services:
         networks:
             default:
                 ipv4_address: 10.10.0.2
-            xray:
-                ipv4_address: 10.10.1.2
         logging: *default-logging
     php:
         image: mercurykd/vpnbot-php:1.5
@@ -187,7 +179,7 @@ services:
             - ad
             - ss
             - tg
-            - xr
+            - si
             - oc
             - np
     proxy:
@@ -398,20 +390,21 @@ services:
             default:
                 ipv4_address: 10.10.0.8
         logging: *default-logging
-    xr:
-        image: mercurykd/vpnbot-xr:1.3
+    si:
+        image: mercurykd/vpnbot-sb:1.2
         build:
-            dockerfile: dockerfile/xray.dockerfile
+            dockerfile: dockerfile/singbox.dockerfile
             args:
                 image: ${IMAGE}
         volumes:
             - ./config/.profile:/root/.ashrc:ro
             - ./ssh:/ssh
             - ./config/sshd_config:/etc/ssh/sshd_config
-            - ./config/xray.json:/xray.json
-            - ./scripts/start_xray.sh:/start_xray.sh
-        hostname: xray
-        container_name: xray-${VER}
+            - ./config:/config
+            - ./certs:/certs
+            - ./scripts/start_sing.sh:/start_sing.sh
+        hostname: singbox
+        container_name: singbox-${VER}
         depends_on:
             php:
                 condition: service_healthy
@@ -421,12 +414,10 @@ services:
             - path: ./override.env
               required: false
         stop_grace_period: 1s
-        command: ["/bin/sh", "/start_xray.sh"]
+        command: ["/bin/sh", "/start_sing.sh"]
         networks:
             default:
                 ipv4_address: 10.10.0.9
-            xray:
-                ipv4_address: 10.10.1.9
         logging: *default-logging
     oc:
         image: mercurykd/vpnbot-oc:1.2

dockerfile/singbox.dockerfile

@@ -0,0 +1,9 @@
+ARG image
+FROM $image
+RUN apk add openssh openssl jq \
+    && mkdir /root/.ssh \
+    && wget https://github.com/SagerNet/sing-box/releases/download/v1.9.3/sing-box-1.9.3-linux-amd64.tar.gz \
+    && tar -xf sing-box-1.9.3-linux-amd64.tar.gz \
+    && mv sing-box-1.9.3-linux-amd64/sing-box /usr/bin \
+    && rm sing-box-1.9.3-linux-amd64.tar.gz \
+    && rm -rf /sing-box-1.9.3-linux-amd64

dockerfile/xray.dockerfile

@@ -1,12 +0,0 @@
-ARG image
-FROM $image
-RUN apk add openssh openssl jq \
-    && mkdir /root/.ssh \
-    && wget -O Xray-linux-64.zip $(wget -q -O - https://api.github.com/repos/XTLS/Xray-core/releases/latest | grep browser_download_url | cut -d\" -f4 | egrep 'Xray-linux-64.zip$') \
-    && unzip Xray-linux-64.zip \
-    && mv xray /usr/bin/ \
-    && rm Xray-linux-64.zip \
-    && rm geoip.dat \
-    && rm geosite.dat \
-    && chmod +x /usr/bin/xray
-ENV ENV="/root/.ashrc"

makefile

@@ -36,8 +36,8 @@ proxy: # консоль сервиса
 	docker compose exec proxy /bin/sh
 tg: # консоль сервиса
 	docker compose exec tg /bin/sh
-xr: # консоль сервиса
-	docker compose exec xr /bin/sh
+si: # консоль сервиса
+	docker compose exec si /bin/sh
 oc: # консоль сервиса
 	docker compose exec oc /bin/sh
 clean:

scripts/start_ng.sh

@@ -1,8 +1,8 @@
 cat /ssh/key.pub > /root/.ssh/authorized_keys
 ssh-keygen -A
 exec /usr/sbin/sshd -D -e "$@" &
-sed "s/ss:[0-9]\+/ss:$SSPORT/" /nginx_default.conf > change_port
-cat change_port > /nginx_default.conf
-sed "s/ss:[0-9]\+/ss:$SSPORT/" /etc/nginx/nginx.conf > change_port
-cat change_port > /etc/nginx/nginx.conf
-nginx -g "daemon off;"
+sed "s/ss:[0-9]\+/ss:$SSPORT/" /config/nginx_default.conf > change_port
+cat change_port > /config/nginx_default.conf
+sed "s/ss:[0-9]\+/ss:$SSPORT/" /config/nginx.conf > change_port
+cat change_port > /config/nginx.conf
+nginx -g "daemon off;" -c /config/nginx.conf

scripts/start_sing.sh

@@ -0,0 +1,5 @@
+cat /ssh/key.pub > /root/.ssh/authorized_keys
+ssh-keygen -A
+exec /usr/sbin/sshd -D -e "$@" &
+sing-box run -c /config/singbox.json > /dev/null &
+tail -f /dev/null

scripts/start_upstream.sh

@@ -1,4 +1,4 @@
 cat /ssh/key.pub > /root/.ssh/authorized_keys
 ssh-keygen -A
 exec /usr/sbin/sshd -D -e "$@" &
-nginx -g "daemon off;"
+nginx -g "daemon off;" -c /config/upstream.conf

scripts/start_xray.sh

@@ -1,8 +0,0 @@
-cat /ssh/key.pub > /root/.ssh/authorized_keys
-ssh-keygen -A
-exec /usr/sbin/sshd -D -e "$@" &
-if [ $(cat /xray.json | jq -r '.inbounds[0].settings.clients[0].id' | wc -c) -gt 1 ]
-then
-    xray run -config /xray.json > /dev/null &
-fi
-tail -f /dev/null

version

@@ -1,10 +1,3 @@
-03.09.2024 v1.46.1
-- fix import
-- fix websocket domain
-03.09.2024 v1.46
-- возможность добавить кастомный поддомен для Letsencrypt
-03.09.2024 v1.45
-- выбор транспорта reality/websocket
 26.08.2024 v1.44
 - qr для xtls
 - фикс действий на элементом списков