Initial commit: sing-box Reality + Hysteria2 deploy for 66.hyf2.cc

Ubuntu deployment at /opt/jiedian with pre-filled env for 47.76.87.111. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-16 08:21:49 +08:00
commit cd0639d55c
16 changed files with 1080 additions and 0 deletions
@@ -0,0 +1,13 @@
+# VPS 环境配置（66.hyf2.cc @ 47.76.87.111）
+# 部署路径：/opt/jiedian
+
+VPS_IP=47.76.87.111
+DOMAIN=66.hyf2.cc
+ACME_EMAIL=admin@hyf2.cc
+REALITY_SERVER_NAME=www.microsoft.com
+
+UUID=42f5b04d-292d-4f13-b892-b70553a714d5
+REALITY_PRIVATE_KEY=IPKtaw1aVb4fS0TPcimu8zwaVGml-JJ5H1rj-_TFQHM
+REALITY_PUBLIC_KEY=51H_ikqYdDRgCpjq3pvMYNbqrX8S3zuow1UEjqTN-nI
+REALITY_SHORT_ID=e126b4ef9d36adfc
+HY2_PASSWORD=npDFaGfRzAPLS3Hh7iM6TEOk
@@ -0,0 +1,21 @@
+# 复制为 .env 后填写，部署脚本会读取这些变量
+# cp .env.example .env
+
+# VPS 公网 IP
+VPS_IP=47.76.87.111
+
+# 域名（Hysteria2 证书用）
+DOMAIN=66.hyf2.cc
+
+# Let's Encrypt 申请证书邮箱
+ACME_EMAIL=admin@hyf2.cc
+
+# Reality 伪装目标（真实大站，不要用你自己的域名）
+REALITY_SERVER_NAME=www.microsoft.com
+
+# 以下由 scripts/generate-keys.sh 自动生成，也可手动填写
+# UUID=
+# REALITY_PRIVATE_KEY=
+# REALITY_PUBLIC_KEY=
+# REALITY_SHORT_ID=
+# HY2_PASSWORD=
@@ -0,0 +1,5 @@
+# 部署生成的客户端配置
+client/generated/
+# 临时文件
+*.log
+.DS_Store
@@ -0,0 +1,108 @@
+# jiedian — VPS 自建节点
+
+个人/家庭自用的 **VLESS + Reality（主力）** + **Hysteria2（备用）** 双栈方案，基于 [sing-box](https://github.com/SagerNet/sing-box)。
+
+**仓库**：https://git.bz121.com/dekun/jiedian.git  
+**部署路径**：`/opt/jiedian`（Ubuntu）
+
+| 项目 | 值 |
+|------|-----|
+| VPS IP | `47.76.87.111` |
+| 域名 | `66.hyf2.cc` |
+
+> 完整部署步骤见 **[docs/DEPLOY.md](docs/DEPLOY.md)**
+
+---
+
+## 快速部署（Ubuntu VPS）
+
+```bash
+ssh root@47.76.87.111
+
+apt update && apt install -y git
+git clone https://git.bz121.com/dekun/jiedian.git /opt/jiedian
+cd /opt/jiedian
+bash scripts/install.sh
+```
+
+安装完成后：
+
+```bash
+cat /opt/jiedian/client/generated/share-links.txt
+```
+
+客户端导入见 [docs/client-import.md](docs/client-import.md)。
+
+---
+
+## 架构
+
+```
+客户端 (Win/iOS/Android)
+    │
+    ├─ TCP 443 ──► sing-box VLESS+Reality ──► 直连出站
+    │
+    └─ UDP 8443 ─► sing-box Hysteria2 ─────► 直连出站
+
+Nginx 127.0.0.1:8080  ← 伪装静态页（fallback）
+```
+
+详细选型见 [docs/STACK.md](docs/STACK.md)。
+
+---
+
+## 目录结构
+
+```
+/opt/jiedian/
+├── .env                        # 环境变量（IP/域名/密钥，已预填）
+├── scripts/
+│   ├── generate-keys.sh        # 生成 UUID / Reality 密钥 / Hy2 密码
+│   ├── install.sh              # 一键部署
+│   └── render-client.sh        # 本地渲染客户端配置
+├── server/
+│   ├── sing-box.json.template
+│   └── nginx/                  # fallback 伪装站
+├── client/
+│   └── sing-box-client.json.template
+└── docs/
+    ├── DEPLOY.md               # Ubuntu 部署指南（主文档）
+    ├── client-import.md        # 客户端导入
+    └── troubleshooting.md      # 故障排查
+```
+
+---
+
+## 端口与防火墙
+
+| 端口 | 协议 | 用途 |
+|------|------|------|
+| 22 | TCP | SSH |
+| 443 | TCP | VLESS + Reality |
+| 8443 | UDP | Hysteria2 |
+
+---
+
+## 常用运维
+
+```bash
+systemctl status sing-box
+journalctl -u sing-box -f
+sing-box check -c /etc/sing-box/config.json && systemctl restart sing-box
+/root/.acme.sh/acme.sh --renew -d 66.hyf2.cc --force
+```
+
+---
+
+## 防墙要点
+
+1. 不要公开分享节点链接
+2. Reality SNI 使用 `www.microsoft.com`，不要用 `66.hyf2.cc`
+3. 客户端开启 uTLS / chrome 指纹
+4. 被封后：换 serverName → 换 IP → 换 VPS 地区
+
+---
+
+## 免责声明
+
+本项目仅供学习网络技术使用。请遵守当地法律法规。
@@ -0,0 +1,106 @@
+{
+  "log": {
+    "level": "info"
+  },
+  "dns": {
+    "servers": [
+      {
+        "tag": "remote",
+        "address": "tls://8.8.8.8",
+        "detour": "proxy"
+      },
+      {
+        "tag": "local",
+        "address": "223.5.5.5",
+        "detour": "direct"
+      }
+    ],
+    "rules": [
+      {
+        "outbound": "any",
+        "server": "local"
+      }
+    ],
+    "final": "remote"
+  },
+  "inbounds": [
+    {
+      "type": "mixed",
+      "tag": "mixed-in",
+      "listen": "127.0.0.1",
+      "listen_port": 7890
+    },
+    {
+      "type": "tun",
+      "tag": "tun-in",
+      "interface_name": "sing-tun",
+      "address": ["172.19.0.1/30"],
+      "mtu": 9000,
+      "auto_route": true,
+      "strict_route": true,
+      "stack": "mixed"
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "selector",
+      "tag": "proxy",
+      "outbounds": ["reality", "hysteria2", "direct"]
+    },
+    {
+      "type": "vless",
+      "tag": "reality",
+      "server": "${VPS_IP}",
+      "server_port": 443,
+      "uuid": "${UUID}",
+      "flow": "xtls-rprx-vision",
+      "tls": {
+        "enabled": true,
+        "server_name": "${REALITY_SERVER_NAME}",
+        "utls": {
+          "enabled": true,
+          "fingerprint": "chrome"
+        },
+        "reality": {
+          "enabled": true,
+          "public_key": "${REALITY_PUBLIC_KEY}",
+          "short_id": "${REALITY_SHORT_ID}"
+        }
+      }
+    },
+    {
+      "type": "hysteria2",
+      "tag": "hysteria2",
+      "server": "${DOMAIN}",
+      "server_port": 8443,
+      "password": "${HY2_PASSWORD}",
+      "tls": {
+        "enabled": true,
+        "server_name": "${DOMAIN}",
+        "alpn": ["h3"]
+      }
+    },
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "dns",
+      "tag": "dns-out"
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "protocol": "dns",
+        "outbound": "dns-out"
+      },
+      {
+        "ip_is_private": true,
+        "outbound": "direct"
+      }
+    ],
+    "final": "proxy",
+    "auto_detect_interface": true
+  }
+}
@@ -0,0 +1,165 @@
+# Ubuntu 部署指南
+
+仓库：[https://git.bz121.com/dekun/jiedian.git](https://git.bz121.com/dekun/jiedian.git)
+
+| 项目 | 值 |
+|------|-----|
+| VPS IP | `47.76.87.111` |
+| 域名 | `66.hyf2.cc` |
+| 部署目录 | `/opt/jiedian` |
+| 系统 | Ubuntu 22.04 / 24.04 |
+
+---
+
+## 部署前准备
+
+### 1. DNS 解析
+
+在域名控制台添加 **A 记录**：
+
+```
+66.hyf2.cc  →  47.76.87.111
+```
+
+验证（本地或 VPS 上执行）：
+
+```bash
+dig +short A 66.hyf2.cc
+# 应返回 47.76.87.111
+```
+
+### 2. SSH 登录 VPS
+
+```bash
+ssh root@47.76.87.111
+```
+
+---
+
+## 一键部署（推荐）
+
+在 VPS 上以 **root** 执行：
+
+```bash
+# 安装 git
+apt update && apt install -y git
+
+# 克隆到 /opt/jiedian
+git clone https://git.bz121.com/dekun/jiedian.git /opt/jiedian
+cd /opt/jiedian
+
+# .env 已预填 IP/域名/密钥，直接安装
+bash scripts/install.sh
+```
+
+安装完成后查看节点链接：
+
+```bash
+cat /opt/jiedian/client/generated/share-links.txt
+```
+
+---
+
+## 分步部署（如需手动控制）
+
+```bash
+apt update && apt install -y git
+git clone https://git.bz121.com/dekun/jiedian.git /opt/jiedian
+cd /opt/jiedian
+
+# 检查 .env（已预配置，一般无需修改）
+cat .env
+
+# 若需重新生成密钥
+bash scripts/generate-keys.sh
+
+# 执行安装
+bash scripts/install.sh
+```
+
+---
+
+## 安装脚本做了什么
+
+1. 安装 sing-box、nginx、ufw
+2. 防火墙放行：`22/tcp`、`443/tcp`、`8443/udp`
+3. Nginx 伪装站监听 `127.0.0.1:8080`
+4. acme.sh 为 `66.hyf2.cc` 申请 Let's Encrypt 证书
+5. 生成 `/etc/sing-box/config.json` 并启动 systemd 服务
+6. 输出客户端分享链接到 `client/generated/share-links.txt`
+
+---
+
+## 节点信息
+
+| 节点 | 协议 | 地址 | 端口 |
+|------|------|------|------|
+| 主力 | VLESS + Reality | `47.76.87.111` | 443/TCP |
+| 备用 | Hysteria2 | `66.hyf2.cc` | 8443/UDP |
+
+Reality 伪装 SNI：`www.microsoft.com`（不是你的域名）
+
+---
+
+## 部署后验证
+
+```bash
+# sing-box 运行状态
+systemctl status sing-box
+
+# 端口监听
+ss -tlnp | grep 443
+ss -ulnp | grep 8443
+
+# 配置语法检查
+sing-box check -c /etc/sing-box/config.json
+
+# 查看日志
+journalctl -u sing-box -f
+```
+
+客户端导入见 [client-import.md](client-import.md)。
+
+---
+
+## 常用运维
+
+```bash
+cd /opt/jiedian
+
+# 拉取最新配置（若仓库有更新）
+git pull
+
+# 重新安装/更新
+bash scripts/install.sh
+
+# 证书手动续期
+/root/.acme.sh/acme.sh --renew -d 66.hyf2.cc --force
+systemctl restart sing-box
+```
+
+---
+
+## 故障排查
+
+| 问题 | 处理 |
+|------|------|
+| `dig` 未返回正确 IP | 等待 DNS 生效或检查解析记录 |
+| acme 证书失败 | 确认 80 端口可访问：`curl -I http://66.hyf2.cc` |
+| sing-box 启动失败 | `journalctl -u sing-box -n 50` 查看报错 |
+| 客户端连不上 | 核对 `share-links.txt` 与 `.env` 中密钥一致 |
+
+更多见 [troubleshooting.md](troubleshooting.md)。
+
+---
+
+## 更新仓库（本地开发机）
+
+```bash
+cd 节点
+git add .
+git commit -m "update config"
+git push origin main
+```
+
+VPS 上 `git pull` 后重新运行 `bash scripts/install.sh` 即可同步。
@@ -0,0 +1,20 @@
+# 方案决策记录
+
+## 已确认选型
+
+| 项目 | 选择 | 理由 |
+|------|------|------|
+| 协议栈 | **VLESS + Reality + Hysteria2 双栈** | Reality 抗主动探测；Hysteria2 作 UDP 备用与流媒体 |
+| 服务端 | **sing-box** | 单进程同时跑 Reality 与 Hysteria2，配置统一 |
+| 系统 | **Ubuntu 22.04/24.04 或 Debian 12** | 脚本基于 apt，其他发行版需手动适配 |
+| 面板 | **无** | 个人 1–5 人，手改 `.env` + 模板即可 |
+
+## 端口规划
+
+- `443/TCP` — VLESS + Reality（主力）
+- `8443/UDP` — Hysteria2（备用）
+- `127.0.0.1:8080` — Nginx 伪装静态页（Reality fallback 场景）
+
+## 单协议简化
+
+若只想维护一种协议，删除 `server/sing-box.json.template` 中的 `hysteria2-in` inbound，并跳过证书申请步骤即可，仅保留 Reality。
@@ -0,0 +1,152 @@
+# 客户端导入与测试指南
+
+部署完成后，在 VPS 上查看 `client/generated/share-links.txt`，或本地运行 `bash scripts/render-client.sh` 生成链接。
+
+---
+
+## 一、连通性测试（推荐顺序）
+
+### 1. Reality（TCP 443）
+
+在**国内网络**下测试（不要在 VPS 本机 curl 自己）：
+
+```bash
+# Windows PowerShell — 仅测端口是否可达
+Test-NetConnection -ComputerName YOUR_VPS_IP -Port 443
+```
+
+客户端连上后访问 https://www.google.com 或 https://ip.sb 确认出口 IP 为 VPS。
+
+### 2. Hysteria2（UDP 8443）
+
+UDP 无法用普通 TCP 工具测。直接导入客户端测试；若 Reality 可用但 Hysteria2 不通，可能是运营商 QoS/封锁 UDP，可继续只用 Reality。
+
+### 3. 故障判断
+
+| 现象 | 可能原因 |
+|------|----------|
+| ping 通 IP，客户端 timeout | 协议层问题，检查 UUID/密钥/SNI |
+| ping 不通 | IP 可能被封，考虑换 IP |
+| 连接成功但无网 | 检查 VPS 防火墙、sing-box 日志 `journalctl -u sing-box -f` |
+| Hysteria2 不通，Reality 正常 | UDP 被干扰，备用节点可忽略 |
+
+---
+
+## 二、Windows
+
+### 方案 A：v2rayN（推荐，上手快）
+
+1. 下载 [v2rayN](https://github.com/2dust/v2rayN/releases)（选 `v2rayN-With-Core.zip`）
+2. 解压运行，托盘图标 → **服务器** → **从剪贴板导入批量 URL**
+3. 复制 `share-links.txt` 中的 `vless://...` 行到剪贴板，导入
+4. 再导入 `hy2://...` 行作为备用
+5. 右键节点 → **设为活动服务器**，路由选 **绕过大陆**
+6. 系统代理 → **自动配置系统代理**
+
+**手动核对 Reality 参数：**
+
+| 字段 | 值 |
+|------|-----|
+| 地址 | VPS IP |
+| 端口 | 443 |
+| 用户 ID | `.env` 中的 UUID |
+| 流控 | xtls-rprx-vision |
+| 传输 | tcp |
+| 安全 | reality |
+| SNI | www.microsoft.com（或你设的 REALITY_SERVER_NAME） |
+| Fingerprint | chrome |
+| Public Key | REALITY_PUBLIC_KEY |
+| Short ID | REALITY_SHORT_ID |
+
+### 方案 B：sing-box 客户端
+
+1. 下载 [sing-box for Windows](https://github.com/SagerNet/sing-box/releases)
+2. 将 `client/generated/sing-box-client.json` 放入配置目录
+3. 以管理员运行（TUN 模式需要），启动后选择 `reality` 出站
+
+### 方案 C：Nekoray
+
+1. 下载 [Nekoray](https://github.com/MatsuriDayo/nekoray/releases)
+2. **Program → Add profile from clipboard**，粘贴 `vless://` 链接
+3. 右键 → **Start**
+
+---
+
+## 三、Android
+
+### v2rayNG（推荐）
+
+1. [Google Play](https://play.google.com/store/apps/details?id=com.v2ray.ang) 或 [GitHub Releases](https://github.com/2dust/v2rayNG/releases) 安装
+2. 右上角 **+** → **从剪贴板导入**（先复制 `vless://` 链接）
+3. 再导入 `hy2://` 备用节点
+4. 点击右下角 **V** 连接
+5. 设置 → **路由设置** → **绕过局域网及大陆地址**
+
+### sing-box for Android
+
+1. [GitHub Releases](https://github.com/SagerNet/sing-box/releases) 安装 APK
+2. **Profiles** → **+** → 导入 `sing-box-client.json`
+3. 开启 **Service**
+
+---
+
+## 四、iOS
+
+需要美区 Apple ID 或已有购买记录。
+
+### Shadowrocket（小火箭）
+
+1. App Store 购买安装 Shadowrocket
+2. 首页右上角 **+** → **类型选 NONE** → 右上角 **扫描或从剪贴板导入**
+3. 粘贴 `vless://` 链接，自动填充 Reality 参数
+4. 再添加 `hy2://` 备用
+5. 连接后 **连通性测试** 应显示延迟
+
+**手动添加 Reality：**
+
+- 类型：VLESS
+- 地址：VPS IP
+- 端口：443
+- UUID：你的 UUID
+- 传输方式：none
+- TLS：开启 → 类型 **REALITY**
+- SNI：REALITY_SERVER_NAME
+- Public Key / Short ID：从 `.env` 复制
+- uTLS：chrome
+- Flow：xtls-rprx-vision
+
+### Streisand
+
+1. App Store 安装 Streisand
+2. **+** → **Import from Clipboard**，粘贴链接
+3. 连接
+
+---
+
+## 五、macOS
+
+与 Windows 类似：
+
+- **V2rayU** / **Nekoray** / **sing-box for Apple platforms**
+- 从剪贴板导入 `vless://` 和 `hy2://` 链接
+
+---
+
+## 六、日常使用建议
+
+1. **默认节点**：Reality（`vless://`）
+2. **备用节点**：Hysteria2（看视频卡顿时可切换）
+3. **不要分享**节点链接；每设备保存一份即可
+4. **每月检查**：`systemctl status sing-box`、证书是否续期（acme.sh 自动）
+
+---
+
+## 七、分享链接格式参考
+
+```
+vless://UUID@IP:443?encryption=none&flow=xtls-rprx-vision&security=reality&sni=SNI&fp=chrome&pbk=PUBLIC_KEY&sid=SHORT_ID&type=tcp#名称
+
+hy2://PASSWORD@DOMAIN:8443?sni=DOMAIN#名称
+```
+
+完整链接见部署后生成的 `client/generated/share-links.txt`。
@@ -0,0 +1,75 @@
+# 运维与故障排查
+
+## 服务检查
+
+```bash
+# sing-box 是否运行
+systemctl is-active sing-box
+
+# 配置语法
+sing-box check -c /etc/sing-box/config.json
+
+# 端口监听
+ss -tlnp | grep 443    # Reality TCP
+ss -ulnp | grep 8443   # Hysteria2 UDP
+
+# Nginx fallback
+curl -s http://127.0.0.1:8080
+```
+
+## 常见问题
+
+### acme.sh 证书申请失败
+
+```bash
+# 确认 DNS 已生效
+dig +short A your.domain.com
+
+# 确认 80 端口未被占用（nginx 需先启动）
+ss -tlnp | grep :80
+
+# 手动重试
+/root/.acme.sh/acme.sh --issue -d your.domain.com --nginx --force
+```
+
+### sing-box 无法启动
+
+```bash
+journalctl -u sing-box -n 50 --no-pager
+```
+
+常见原因：证书路径错误、JSON 语法错误、443 被占用。
+
+### 客户端能连但速度慢
+
+- 换 Hysteria2 节点（UDP/QUIC 抗丢包）
+- 检查 VPS 带宽：`wget -O /dev/null http://speedtest.tele2.net/100MB.zip`
+- 避免高峰时段长时间 4K 流媒体
+
+### IP 被封
+
+1. 向 VPS 商申请更换 IP
+2. 修改 `.env` 中 `REALITY_SERVER_NAME` 为其他大站（如 `www.apple.com`）
+3. 重新运行 `install.sh` 或手动更新 `/etc/sing-box/config.json` 并 restart
+
+### 改用 Xray 替代 sing-box（可选）
+
+若更熟悉 Xray，可使用 `server/xray-server.json.template`：
+
+```bash
+# 安装 Xray
+bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
+
+# 渲染配置
+sed -e "s|\${UUID}|...|g" ... server/xray-server.json.template > /usr/local/etc/xray/config.json
+
+systemctl restart xray
+```
+
+Hysteria2 仍需单独部署（或使用 sing-box 仅跑 Hy2  inbound）。
+
+## 安全建议
+
+- SSH 改用密钥登录，禁用密码：`PermitRootLogin prohibit-password`
+- 可选修改 SSH 端口，ufw 放行新端口后再删 22
+- 不要将 `.env` 或 `share-links.txt` 上传到公开仓库
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# 生成 Reality 与 Hysteria2 所需密钥，输出到 stdout 并写入 .env
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(dirname "$SCRIPT_DIR")"
+ENV_FILE="${ROOT_DIR}/.env"
+
+# 依赖 sing-box 生成 reality 密钥对
+if ! command -v sing-box &>/dev/null; then
+  echo "sing-box 未安装，使用临时下载..." >&2
+  TMP="$(mktemp -d)"
+  ARCH="$(uname -m)"
+  case "$ARCH" in
+    x86_64)  SB_ARCH="amd64" ;;
+    aarch64) SB_ARCH="arm64" ;;
+    *) echo "不支持的架构: $ARCH" >&2; exit 1 ;;
+  esac
+  curl -fsSL "https://github.com/SagerNet/sing-box/releases/latest/download/sing-box-1.11.0-linux-${SB_ARCH}.tar.gz" \
+    | tar -xz -C "$TMP" --strip-components=1
+  SB="$TMP/sing-box"
+else
+  SB="sing-box"
+fi
+
+UUID="$("$SB" generate uuid)"
+KEYPAIR="$("$SB" generate reality-keypair)"
+PRIVATE_KEY="$(echo "$KEYPAIR" | grep 'PrivateKey:' | awk '{print $2}')"
+PUBLIC_KEY="$(echo "$KEYPAIR" | grep 'PublicKey:' | awk '{print $2}')"
+SHORT_ID="$("$SB" generate rand --hex 8)"
+HY2_PASSWORD="$("$SB" generate rand --base64 32 | tr -d '/+=' | head -c 24)"
+
+echo "========== 生成的密钥 =========="
+echo "UUID:              $UUID"
+echo "REALITY_PRIVATE_KEY: $PRIVATE_KEY"
+echo "REALITY_PUBLIC_KEY:  $PUBLIC_KEY"
+echo "REALITY_SHORT_ID:    $SHORT_ID"
+echo "HY2_PASSWORD:        $HY2_PASSWORD"
+echo "================================"
+
+if [[ -f "$ENV_FILE" ]]; then
+  # 更新或追加 .env 中的密钥字段
+  for var in UUID REALITY_PRIVATE_KEY REALITY_PUBLIC_KEY REALITY_SHORT_ID HY2_PASSWORD; do
+    val="${!var}"
+    if grep -q "^${var}=" "$ENV_FILE" 2>/dev/null; then
+      sed -i "s|^${var}=.*|${var}=${val}|" "$ENV_FILE"
+    else
+      echo "${var}=${val}" >> "$ENV_FILE"
+    fi
+  done
+  echo "已写入 $ENV_FILE"
+else
+  echo "提示: 先复制 .env.example 为 .env 并填写 VPS_IP、DOMAIN 等，再重新运行本脚本" >&2
+fi
@@ -0,0 +1,171 @@
+#!/usr/bin/env bash
+# VPS 一键部署：sing-box (Reality + Hysteria2) + Nginx fallback
+# 适用：Ubuntu 22.04/24.04、Debian 12
+# 用法：sudo bash scripts/install.sh
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(dirname "$SCRIPT_DIR")"
+ENV_FILE="${ROOT_DIR}/.env"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+NC='\033[0m'
+
+log()  { echo -e "${GREEN}[+]${NC} $*"; }
+err()  { echo -e "${RED}[!]${NC} $*" >&2; exit 1; }
+
+[[ $EUID -eq 0 ]] || err "请使用 root 运行: sudo bash scripts/install.sh"
+[[ -f "$ENV_FILE" ]] || err "缺少 .env 文件，请先: cp .env.example .env 并填写"
+
+# shellcheck disable=SC1090
+source "$ENV_FILE"
+
+: "${VPS_IP:?请在 .env 中设置 VPS_IP}"
+: "${DOMAIN:?请在 .env 中设置 DOMAIN}"
+: "${ACME_EMAIL:?请在 .env 中设置 ACME_EMAIL}"
+: "${REALITY_SERVER_NAME:=www.microsoft.com}"
+
+if [[ -z "${UUID:-}" || -z "${REALITY_PRIVATE_KEY:-}" ]]; then
+  log "未检测到密钥，运行 generate-keys.sh ..."
+  bash "$SCRIPT_DIR/generate-keys.sh"
+  source "$ENV_FILE"
+fi
+
+: "${UUID:?}"
+: "${REALITY_PRIVATE_KEY:?}"
+: "${REALITY_SHORT_ID:?}"
+: "${HY2_PASSWORD:?}"
+
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64)  SB_ARCH="amd64" ;;
+  aarch64) SB_ARCH="arm64" ;;
+  *) err "不支持的架构: $ARCH" ;;
+esac
+
+SB_VERSION="1.11.0"
+SB_URL="https://github.com/SagerNet/sing-box/releases/download/v${SB_VERSION}/sing-box-${SB_VERSION}-linux-${SB_ARCH}.tar.gz"
+
+log "更新系统包 ..."
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -qq
+apt-get install -y -qq curl wget nginx ufw ca-certificates
+
+log "安装 sing-box ${SB_VERSION} ..."
+TMP="$(mktemp -d)"
+curl -fsSL "$SB_URL" | tar -xz -C "$TMP" --strip-components=1
+install -m 755 "$TMP/sing-box" /usr/local/bin/sing-box
+rm -rf "$TMP"
+
+log "配置防火墙 ..."
+ufw --force reset
+ufw default deny incoming
+ufw default allow outgoing
+ufw allow 22/tcp comment 'SSH'
+ufw allow 443/tcp comment 'Reality'
+ufw allow 8443/udp comment 'Hysteria2'
+ufw --force enable
+
+log "部署 Nginx fallback 站点 ..."
+mkdir -p /var/www/fallback
+cp "$ROOT_DIR/server/nginx/index.html" /var/www/fallback/
+cp "$ROOT_DIR/server/nginx/fallback.conf" /etc/nginx/sites-available/fallback
+ln -sf /etc/nginx/sites-available/fallback /etc/nginx/sites-enabled/fallback
+rm -f /etc/nginx/sites-enabled/default
+nginx -t && systemctl enable nginx && systemctl restart nginx
+
+log "申请 TLS 证书 (Let's Encrypt) ..."
+mkdir -p /etc/sing-box/certs
+if [[ ! -f /root/.acme.sh/acme.sh ]]; then
+  curl -fsSL https://get.acme.sh | sh -s email="$ACME_EMAIL"
+fi
+# shellcheck disable=SC1091
+source /root/.acme.sh/acme.sh.env || true
+
+# 确保域名已解析到本机
+CURRENT_IP="$(curl -4 -fsSL ifconfig.me 2>/dev/null || curl -4 -fsSL ip.sb)"
+if [[ "$CURRENT_IP" != "$VPS_IP" ]]; then
+  err "域名 $DOMAIN 需先解析到 VPS IP ($VPS_IP)，当前 VPS 出口 IP 为 $CURRENT_IP"
+fi
+
+/root/.acme.sh/acme.sh --set-default-ca --server letsencrypt
+/root/.acme.sh/acme.sh --issue -d "$DOMAIN" --nginx --force
+/root/.acme.sh/acme.sh --install-cert -d "$DOMAIN" \
+  --key-file /etc/sing-box/certs/privkey.pem \
+  --fullchain-file /etc/sing-box/certs/fullchain.pem \
+  --reloadcmd "systemctl restart sing-box"
+
+log "生成 sing-box 服务端配置 ..."
+mkdir -p /etc/sing-box
+sed -e "s|\${UUID}|${UUID}|g" \
+    -e "s|\${REALITY_SERVER_NAME}|${REALITY_SERVER_NAME}|g" \
+    -e "s|\${REALITY_PRIVATE_KEY}|${REALITY_PRIVATE_KEY}|g" \
+    -e "s|\${REALITY_SHORT_ID}|${REALITY_SHORT_ID}|g" \
+    -e "s|\${HY2_PASSWORD}|${HY2_PASSWORD}|g" \
+    -e "s|\${DOMAIN}|${DOMAIN}|g" \
+    "$ROOT_DIR/server/sing-box.json.template" > /etc/sing-box/config.json
+
+sing-box check -c /etc/sing-box/config.json
+
+log "创建 systemd 服务 ..."
+cat > /etc/systemd/system/sing-box.service <<'UNIT'
+[Unit]
+Description=sing-box service
+After=network-online.target nginx.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/sing-box run -c /etc/sing-box/config.json
+Restart=on-failure
+RestartSec=5
+LimitNOFILE=1048576
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+
+systemctl daemon-reload
+systemctl enable sing-box
+systemctl restart sing-box
+
+log "生成客户端配置 ..."
+CLIENT_DIR="${ROOT_DIR}/client/generated"
+mkdir -p "$CLIENT_DIR"
+: "${REALITY_PUBLIC_KEY:?请在 .env 中设置 REALITY_PUBLIC_KEY（运行 generate-keys.sh 可自动生成）}"
+
+sed -e "s|\${VPS_IP}|${VPS_IP}|g" \
+    -e "s|\${DOMAIN}|${DOMAIN}|g" \
+    -e "s|\${UUID}|${UUID}|g" \
+    -e "s|\${REALITY_SERVER_NAME}|${REALITY_SERVER_NAME}|g" \
+    -e "s|\${REALITY_PUBLIC_KEY}|${REALITY_PUBLIC_KEY}|g" \
+    -e "s|\${REALITY_SHORT_ID}|${REALITY_SHORT_ID}|g" \
+    -e "s|\${HY2_PASSWORD}|${HY2_PASSWORD}|g" \
+    "$ROOT_DIR/client/sing-box-client.json.template" > "$CLIENT_DIR/sing-box-client.json"
+
+# 生成分享链接
+cat > "$CLIENT_DIR/share-links.txt" <<EOF
+========== VLESS + Reality (主力) ==========
+vless://${UUID}@${VPS_IP}:443?encryption=none&flow=xtls-rprx-vision&security=reality&sni=${REALITY_SERVER_NAME}&fp=chrome&pbk=${REALITY_PUBLIC_KEY}&sid=${REALITY_SHORT_ID}&type=tcp#Reality-Main
+
+========== Hysteria2 (备用) ==========
+hy2://${HY2_PASSWORD}@${DOMAIN}:8443?sni=${DOMAIN}#Hysteria2-Backup
+
+========== 参数明细 ==========
+VPS IP:           ${VPS_IP}
+UUID:             ${UUID}
+Reality SNI:      ${REALITY_SERVER_NAME}
+Reality PublicKey: ${REALITY_PUBLIC_KEY}
+Reality ShortId:  ${REALITY_SHORT_ID}
+Hysteria2 域名:   ${DOMAIN}
+Hysteria2 密码:   ${HY2_PASSWORD}
+EOF
+
+log "部署完成！"
+echo ""
+cat "$CLIENT_DIR/share-links.txt"
+echo ""
+log "客户端配置文件: ${CLIENT_DIR}/sing-box-client.json"
+log "sing-box 状态: systemctl status sing-box"
+log "查看日志: journalctl -u sing-box -f"
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# 本地根据 .env 渲染客户端配置（无需在 VPS 上运行）
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(dirname "$SCRIPT_DIR")"
+ENV_FILE="${ROOT_DIR}/.env"
+OUT_DIR="${ROOT_DIR}/client/generated"
+
+[[ -f "$ENV_FILE" ]] || { echo "缺少 .env，请先 cp .env.example .env 并填写"; exit 1; }
+# shellcheck disable=SC1090
+source "$ENV_FILE"
+
+for var in VPS_IP DOMAIN UUID REALITY_SERVER_NAME REALITY_PUBLIC_KEY REALITY_SHORT_ID HY2_PASSWORD; do
+  [[ -n "${!var:-}" ]] || { echo "缺少 .env 变量: $var"; exit 1; }
+done
+
+mkdir -p "$OUT_DIR"
+
+sed -e "s|\${VPS_IP}|${VPS_IP}|g" \
+    -e "s|\${DOMAIN}|${DOMAIN}|g" \
+    -e "s|\${UUID}|${UUID}|g" \
+    -e "s|\${REALITY_SERVER_NAME}|${REALITY_SERVER_NAME}|g" \
+    -e "s|\${REALITY_PUBLIC_KEY}|${REALITY_PUBLIC_KEY}|g" \
+    -e "s|\${REALITY_SHORT_ID}|${REALITY_SHORT_ID}|g" \
+    -e "s|\${HY2_PASSWORD}|${HY2_PASSWORD}|g" \
+    "$ROOT_DIR/client/sing-box-client.json.template" > "$OUT_DIR/sing-box-client.json"
+
+cat > "$OUT_DIR/share-links.txt" <<EOF
+========== VLESS + Reality (主力) ==========
+vless://${UUID}@${VPS_IP}:443?encryption=none&flow=xtls-rprx-vision&security=reality&sni=${REALITY_SERVER_NAME}&fp=chrome&pbk=${REALITY_PUBLIC_KEY}&sid=${REALITY_SHORT_ID}&type=tcp#Reality-Main
+
+========== Hysteria2 (备用) ==========
+hy2://${HY2_PASSWORD}@${DOMAIN}:8443?sni=${DOMAIN}#Hysteria2-Backup
+EOF
+
+echo "已生成:"
+echo "  $OUT_DIR/sing-box-client.json"
+echo "  $OUT_DIR/share-links.txt"
@@ -0,0 +1,9 @@
+server {
+    listen 127.0.0.1:8080;
+    server_name localhost;
+    root /var/www/fallback;
+    index index.html;
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Welcome</title>
+  <style>
+    body { font-family: system-ui, sans-serif; max-width: 640px; margin: 4rem auto; padding: 0 1rem; color: #333; }
+    h1 { font-weight: 600; }
+    p { line-height: 1.6; color: #666; }
+  </style>
+</head>
+<body>
+  <h1>Welcome</h1>
+  <p>This site is under construction.</p>
+</body>
+</html>
@@ -0,0 +1,69 @@
+{
+  "log": {
+    "level": "warn",
+    "timestamp": true
+  },
+  "inbounds": [
+    {
+      "type": "vless",
+      "tag": "vless-reality-in",
+      "listen": "::",
+      "listen_port": 443,
+      "users": [
+        {
+          "uuid": "${UUID}",
+          "flow": "xtls-rprx-vision"
+        }
+      ],
+      "tls": {
+        "enabled": true,
+        "server_name": "${REALITY_SERVER_NAME}",
+        "reality": {
+          "enabled": true,
+          "handshake": {
+            "server": "${REALITY_SERVER_NAME}",
+            "server_port": 443
+          },
+          "private_key": "${REALITY_PRIVATE_KEY}",
+          "short_id": ["${REALITY_SHORT_ID}"]
+        }
+      }
+    },
+    {
+      "type": "hysteria2",
+      "tag": "hysteria2-in",
+      "listen": "::",
+      "listen_port": 8443,
+      "users": [
+        {
+          "password": "${HY2_PASSWORD}"
+        }
+      ],
+      "tls": {
+        "enabled": true,
+        "server_name": "${DOMAIN}",
+        "certificate_path": "/etc/sing-box/certs/fullchain.pem",
+        "key_path": "/etc/sing-box/certs/privkey.pem"
+      }
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "block",
+      "tag": "block"
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "ip_is_private": true,
+        "outbound": "block"
+      }
+    ],
+    "final": "direct"
+  }
+}
@@ -0,0 +1,56 @@
+{
+  "log": {
+    "loglevel": "warning"
+  },
+  "inbounds": [
+    {
+      "listen": "0.0.0.0",
+      "port": 443,
+      "protocol": "vless",
+      "settings": {
+        "clients": [
+          {
+            "id": "${UUID}",
+            "flow": "xtls-rprx-vision"
+          }
+        ],
+        "decryption": "none"
+      },
+      "streamSettings": {
+        "network": "tcp",
+        "security": "reality",
+        "realitySettings": {
+          "show": false,
+          "dest": "${REALITY_SERVER_NAME}:443",
+          "xver": 0,
+          "serverNames": ["${REALITY_SERVER_NAME}"],
+          "privateKey": "${REALITY_PRIVATE_KEY}",
+          "shortIds": ["${REALITY_SHORT_ID}"]
+        }
+      },
+      "sniffing": {
+        "enabled": true,
+        "destOverride": ["http", "tls", "quic"]
+      }
+    }
+  ],
+  "outbounds": [
+    {
+      "protocol": "freedom",
+      "tag": "direct"
+    },
+    {
+      "protocol": "blackhole",
+      "tag": "block"
+    }
+  ],
+  "routing": {
+    "rules": [
+      {
+        "type": "field",
+        "ip": ["geoip:private"],
+        "outboundTag": "block"
+      }
+    ]
+  }
+}