jocay/singbox-script
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: initial commit of clean multi-protocol singbox core script

Browse Source
This commit is contained in:
jocay
2026-09-27 13:11:24 +08:00
commit 34565faa6b
10 changed files with 1475 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/cert.sh
+48
View File
@@ -0,0 +1,48 @@
#!/usr/bin/env bash
# ==============================================================================
# 模块：TLS 证书自动化生成与管理 (支持 ECDSA 现代自签与自定义证书)
# ==============================================================================
CERT_DIR="${INSTALL_DIR}/cert"
CERT_FILE="${CERT_DIR}/cert.pem"
KEY_FILE="${CERT_DIR}/private.key"
# 生成现代椭圆曲线 (prime256v1) 自签名证书
generate_self_signed_cert() {
local sni="${1:-www.bing.com}"
mkdir -p "${CERT_DIR}"
# 如果证书已存在且有效期超过30天，直接复用
if [[ -f "${CERT_FILE}" && -f "${KEY_FILE}" ]]; then
if openssl x509 -checkend 2592000 -noout -in "${CERT_FILE}" >/dev/null 2>&1; then
log_info "现有 TLS 证书有效，直接复用: ${CERT_FILE}"
return 0
fi
fi
log_info "正在为伪装域名 [${sni}] 自动化生成 ECDSA (P-256) 高性能自签名 TLS 证书..."
# 生成 EC 私钥
openssl ecparam -name prime256v1 -genkey -noout -out "${KEY_FILE}" 2>/dev/null
# 生成 10 年有效期的自签名证书
openssl req -new -x509 -days 3650 \
-key "${KEY_FILE}" \
-out "${CERT_FILE}" \
-subj "/CN=${sni}" \
-addext "subjectAltName=DNS:${sni}" 2>/dev/null || \
openssl req -new -x509 -days 3650 \
-key "${KEY_FILE}" \
-out "${CERT_FILE}" \
-subj "/CN=${sni}" 2>/dev/null
chmod 600 "${KEY_FILE}" "${CERT_FILE}"
if [[ ! -s "${CERT_FILE}" || ! -s "${KEY_FILE}" ]]; then
log_error "TLS 自签名证书生成失败，请检查 openssl 环境！"
return 1
fi
log_success "TLS 证书自动化生成完成！"
return 0
}
lib/config.sh
+339
View File
@@ -0,0 +1,339 @@
#!/usr/bin/env bash
# ==============================================================================
# 模块：多协议配置生成器 (VLESS-Reality / Hysteria2 / TUIC / VMess / AnyTLS)
# ==============================================================================
# 获取或生成统一 UUID
get_or_create_uuid() {
local uuid="${1:-}"
if [[ -z "$uuid" ]]; then
if command -v "${BIN_PATH}" >/dev/null 2>&1; then
uuid=$("${BIN_PATH}" generate uuid 2>/dev/null)
fi
if [[ -z "$uuid" && -f /proc/sys/kernel/random/uuid ]]; then
uuid=$(cat /proc/sys/kernel/random/uuid)
fi
if [[ -z "$uuid" ]]; then
uuid=$(openssl rand -hex 16 | sed -E 's/(.{8})(.{4})(.{4})(.{4})(.{12})/\1-\2-\3-\4-\5/')
fi
fi
echo "$uuid"
}
# 1. 组装 VLESS-Reality 入站 JSON
build_vless_inbound() {
local port="$1"
local uuid="$2"
local sni="$3"
local priv_key="$4"
local short_id="$5"
cat <<EOF
{
"type": "vless",
"tag": "vless-in",
"listen": "::",
"listen_port": ${port},
"sniff": true,
"sniff_override_destination": true,
"users": [
{
"uuid": "${uuid}",
"flow": "xtls-rprx-vision"
}
],
"tls": {
"enabled": true,
"server_name": "${sni}",
"reality": {
"enabled": true,
"handshake": {
"server": "${sni}",
"server_port": 443
},
"private_key": "${priv_key}",
"short_id": [
"${short_id}"
]
}
}
}
EOF
}
# 2. 组装 Hysteria 2 入站 JSON
build_hy2_inbound() {
local port="$1"
local password="$2"
cat <<EOF
{
"type": "hysteria2",
"tag": "hy2-in",
"listen": "::",
"listen_port": ${port},
"sniff": true,
"sniff_override_destination": true,
"users": [
{
"password": "${password}"
}
],
"ignore_client_bandwidth": false,
"tls": {
"enabled": true,
"alpn": [
"h3"
],
"certificate_path": "${CERT_FILE}",
"key_path": "${KEY_FILE}"
}
}
EOF
}
# 3. 组装 TUIC v5 入站 JSON
build_tuic_inbound() {
local port="$1"
local uuid="$2"
cat <<EOF
{
"type": "tuic",
"tag": "tuic-in",
"listen": "::",
"listen_port": ${port},
"sniff": true,
"sniff_override_destination": true,
"users": [
{
"uuid": "${uuid}",
"password": "${uuid}"
}
],
"congestion_control": "bbr",
"tls": {
"enabled": true,
"alpn": [
"h3"
],
"certificate_path": "${CERT_FILE}",
"key_path": "${KEY_FILE}"
}
}
EOF
}
# 4. 组装 VMess-WS 入站 JSON
build_vmess_inbound() {
local port="$1"
local uuid="$2"
cat <<EOF
{
"type": "vmess",
"tag": "vmess-in",
"listen": "::",
"listen_port": ${port},
"sniff": true,
"sniff_override_destination": true,
"users": [
{
"uuid": "${uuid}",
"alterId": 0
}
],
"transport": {
"type": "ws",
"path": "/${uuid}-vm",
"max_early_data": 2048,
"early_data_header_name": "Sec-WebSocket-Protocol"
}
}
EOF
}
# 5. 组装 AnyTLS 入站 JSON
build_anytls_inbound() {
local port="$1"
local password="$2"
cat <<EOF
{
"type": "anytls",
"tag": "anytls-in",
"listen": "::",
"listen_port": ${port},
"users": [
{
"password": "${password}"
}
],
"padding_scheme": [],
"tls": {
"enabled": true,
"certificate_path": "${CERT_FILE}",
"key_path": "${KEY_FILE}"
}
}
EOF
}
# 组合入站并生成最终完整服务配置与元数据
generate_suite_config() {
local mode="$1" # all | vless | hy2 | tuic | vmess | anytls
shift
local uuid
uuid=$(get_or_create_uuid)
local reality_sni="www.apple.com"
local cert_sni="www.bing.com"
mkdir -p "${INSTALL_DIR}"
# 如涉及需证书的协议，预先生成自签证书
if [[ "$mode" == "all" || "$mode" == "hy2" || "$mode" == "tuic" || "$mode" == "anytls" ]]; then
generate_self_signed_cert "$cert_sni" || return 1
fi
# 如涉及 Reality，预先生成密钥对
local priv_key="" pub_key="" short_id=""
if [[ "$mode" == "all" || "$mode" == "vless" ]]; then
local keypair
keypair=$("${BIN_PATH}" generate reality-keypair)
priv_key=$(echo "$keypair" | awk '/PrivateKey/ {print $2}' | tr -d ' "\r\n')
pub_key=$(echo "$keypair" | awk '/PublicKey/ {print $2}' | tr -d ' "\r\n')
short_id=$("${BIN_PATH}" generate rand --hex 4 2>/dev/null || openssl rand -hex 4)
short_id=$(echo "$short_id" | tr -d ' "\r\n')
fi
local inbounds_arr=()
local meta_protocols="{}"
case "$mode" in
all)
local p_vless="${1:-443}"
local p_hy2="${2:-8443}"
local p_tuic="${3:-9443}"
local p_vmess="${4:-8080}"
local p_anytls="${5:-10443}"
inbounds_arr+=("$(build_vless_inbound "$p_vless" "$uuid" "$reality_sni" "$priv_key" "$short_id")")
inbounds_arr+=("$(build_hy2_inbound "$p_hy2" "$uuid")")
inbounds_arr+=("$(build_tuic_inbound "$p_tuic" "$uuid")")
inbounds_arr+=("$(build_vmess_inbound "$p_vmess" "$uuid")")
inbounds_arr+=("$(build_anytls_inbound "$p_anytls" "$uuid")")
meta_protocols=$(cat <<EOF
{
"vless_reality": { "enabled": true, "port": ${p_vless}, "sni": "${reality_sni}", "public_key": "${pub_key}", "short_id": "${short_id}" },
"hysteria2": { "enabled": true, "port": ${p_hy2}, "sni": "${cert_sni}" },
"tuic": { "enabled": true, "port": ${p_tuic}, "sni": "${cert_sni}" },
"vmess_ws": { "enabled": true, "port": ${p_vmess}, "path": "/${uuid}-vm" },
"anytls": { "enabled": true, "port": ${p_anytls}, "sni": "${cert_sni}" }
}
EOF
)
;;
vless)
local port="${1:-443}"
local custom_sni="${2:-$reality_sni}"
inbounds_arr+=("$(build_vless_inbound "$port" "$uuid" "$custom_sni" "$priv_key" "$short_id")")
meta_protocols=$(cat <<EOF
{
"vless_reality": { "enabled": true, "port": ${port}, "sni": "${custom_sni}", "public_key": "${pub_key}", "short_id": "${short_id}" }
}
EOF
)
;;
hy2)
local port="${1:-8443}"
inbounds_arr+=("$(build_hy2_inbound "$port" "$uuid")")
meta_protocols=$(cat <<EOF
{
"hysteria2": { "enabled": true, "port": ${port}, "sni": "${cert_sni}" }
}
EOF
)
;;
tuic)
local port="${1:-9443}"
inbounds_arr+=("$(build_tuic_inbound "$port" "$uuid")")
meta_protocols=$(cat <<EOF
{
"tuic": { "enabled": true, "port": ${port}, "sni": "${cert_sni}" }
}
EOF
)
;;
vmess)
local port="${1:-8080}"
inbounds_arr+=("$(build_vmess_inbound "$port" "$uuid")")
meta_protocols=$(cat <<EOF
{
"vmess_ws": { "enabled": true, "port": ${port}, "path": "/${uuid}-vm" }
}
EOF
)
;;
anytls)
local port="${1:-10443}"
inbounds_arr+=("$(build_anytls_inbound "$port" "$uuid")")
meta_protocols=$(cat <<EOF
{
"anytls": { "enabled": true, "port": ${port}, "sni": "${cert_sni}" }
}
EOF
)
;;
esac
# 拼装 inbounds 数组逗号
local inbounds_joined
inbounds_joined=$(IFS=,; echo "${inbounds_arr[*]}")
# 写入最终 config.json
cat > "${CONFIG_FILE}" <<EOF
{
"log": {
"disabled": false,
"level": "info",
"timestamp": true
},
"inbounds": [
${inbounds_joined}
],
"outbounds": [
{
"type": "direct",
"tag": "direct"
},
{
"type": "block",
"tag": "block"
}
]
}
EOF
# 原生语法校验
if ! "${BIN_PATH}" check -c "${CONFIG_FILE}" >/dev/null 2>&1; then
log_error "生成的配置文件未能通过 Sing-box 语法检测！请检查端口是否有冲突或参数错误。"
return 1
fi
# 写入持久化元数据
cat > "${META_FILE}" <<EOF
{
"mode": "${mode}",
"uuid": "${uuid}",
"protocols": ${meta_protocols},
"updated_at": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
}
EOF
chmod 600 "${CONFIG_FILE}" "${META_FILE}"
log_success "Sing-box 核心配置部署成功，语法校验通过！"
return 0
}
lib/env.sh
+48
View File
@@ -0,0 +1,48 @@
#!/usr/bin/env bash
# ==============================================================================
# 模块：基础环境、常量定义与通用日志工具
# ==============================================================================
# 颜色代码
CLR_RED="\033[31m"
CLR_GREEN="\033[32m"
CLR_YELLOW="\033[33m"
CLR_BLUE="\033[36m"
CLR_PURPLE="\033[35m"
CLR_RESET="\033[0m"
CLR_BOLD="\033[1m"
# 路径常量
INSTALL_DIR="/etc/sing-box"
CONFIG_FILE="${INSTALL_DIR}/config.json"
META_FILE="${INSTALL_DIR}/meta.json"
BIN_DIR="/usr/local/bin"
BIN_PATH="${BIN_DIR}/sing-box"
SERVICE_NAME="sing-box"
SERVICE_FILE="/etc/systemd/system/${SERVICE_NAME}.service"
SCRIPT_LINK="${BIN_DIR}/sb"
# 日志输出函数
log_info() {
echo -e "${CLR_BLUE}[INFO]${CLR_RESET} $1"
}
log_success() {
echo -e "${CLR_GREEN}[SUCCESS]${CLR_RESET} $1"
}
log_warn() {
echo -e "${CLR_YELLOW}[WARN]${CLR_RESET} $1"
}
log_error() {
echo -e "${CLR_RED}[ERROR]${CLR_RESET} $1" >&2
}
# 权限校验：必须以 root 权限运行
check_root() {
if [[ $EUID -ne 0 ]]; then
log_error "本脚本需要 root 权限，请使用 sudo 或切换至 root 用户执行！"
exit 1
fi
}
lib/info.sh
+328
View File
@@ -0,0 +1,328 @@
#!/usr/bin/env bash
# ==============================================================================
# 模块：多协议分享链接生成、聚合订阅与多客户端配置导出
# ==============================================================================
show_node_info() {
if [[ ! -f "${META_FILE}" ]]; then
log_error "未检测到已安装的节点配置元数据，请先执行安装！"
return 1
fi
local uuid server_ip
uuid=$(jq -r '.uuid' "${META_FILE}")
server_ip=$(get_public_ip)
local share_links=()
local clash_proxies=""
local sb_outbounds=()
local summary_text=""
# --------------------------------------------------------------------------
# 1. VLESS-Reality
# --------------------------------------------------------------------------
if [[ $(jq -r '.protocols.vless_reality.enabled // false' "${META_FILE}") == "true" ]]; then
local vl_port vl_sni vl_pub vl_sid vl_name vl_link
vl_port=$(jq -r '.protocols.vless_reality.port' "${META_FILE}")
vl_sni=$(jq -r '.protocols.vless_reality.sni' "${META_FILE}")
vl_pub=$(jq -r '.protocols.vless_reality.public_key' "${META_FILE}")
vl_sid=$(jq -r '.protocols.vless_reality.short_id' "${META_FILE}")
vl_name="VLESS-Reality-${server_ip}"
vl_link="vless://${uuid}@${server_ip}:${vl_port}?security=reality&encryption=none&pbk=${vl_pub}&headerType=none&fp=chrome&type=tcp&flow=xtls-rprx-vision&sni=${vl_sni}&sid=${vl_sid}#${vl_name}"
share_links+=("$vl_link")
summary_text+="[VLESS-Reality-Vision] 端口: ${vl_port}/tcp | SNI: ${vl_sni} | PublicKey: ${vl_pub} | ShortID: ${vl_sid}\n${vl_link}\n\n"
clash_proxies+=$(cat <<EOF
- name: "${vl_name}"
type: vless
server: ${server_ip}
port: ${vl_port}
uuid: ${uuid}
network: tcp
tls: true
udp: true
flow: xtls-rprx-vision
servername: ${vl_sni}
reality-opts:
public-key: ${vl_pub}
short-id: ${vl_sid}
client-fingerprint: chrome
EOF
)
sb_outbounds+=("$(cat <<EOF
{
"type": "vless",
"tag": "${vl_name}",
"server": "${server_ip}",
"server_port": ${vl_port},
"uuid": "${uuid}",
"flow": "xtls-rprx-vision",
"tls": {
"enabled": true,
"server_name": "${vl_sni}",
"utls": { "enabled": true, "fingerprint": "chrome" },
"reality": { "enabled": true, "public_key": "${vl_pub}", "short_id": "${vl_sid}" }
},
"packet_encoding": "xudp"
}
EOF
)")
fi
# --------------------------------------------------------------------------
# 2. Hysteria 2
# --------------------------------------------------------------------------
if [[ $(jq -r '.protocols.hysteria2.enabled // false' "${META_FILE}") == "true" ]]; then
local hy_port hy_sni hy_name hy_link
hy_port=$(jq -r '.protocols.hysteria2.port' "${META_FILE}")
hy_sni=$(jq -r '.protocols.hysteria2.sni' "${META_FILE}")
hy_name="Hysteria2-${server_ip}"
hy_link="hy2://${uuid}@${server_ip}:${hy_port}?insecure=1&sni=${hy_sni}#${hy_name}"
share_links+=("$hy_link")
summary_text+="[Hysteria-2] 端口: ${hy_port}/udp | SNI: ${hy_sni} | 密码: ${uuid}\n${hy_link}\n\n"
clash_proxies+=$(cat <<EOF
- name: "${hy_name}"
type: hysteria2
server: ${server_ip}
port: ${hy_port}
password: ${uuid}
sni: ${hy_sni}
skip-cert-verify: true
alpn:
- h3
EOF
)
sb_outbounds+=("$(cat <<EOF
{
"type": "hysteria2",
"tag": "${hy_name}",
"server": "${server_ip}",
"server_port": ${hy_port},
"password": "${uuid}",
"tls": {
"enabled": true,
"server_name": "${hy_sni}",
"insecure": true,
"alpn": ["h3"]
}
}
EOF
)")
fi
# --------------------------------------------------------------------------
# 3. TUIC v5
# --------------------------------------------------------------------------
if [[ $(jq -r '.protocols.tuic.enabled // false' "${META_FILE}") == "true" ]]; then
local tu_port tu_sni tu_name tu_link
tu_port=$(jq -r '.protocols.tuic.port' "${META_FILE}")
tu_sni=$(jq -r '.protocols.tuic.sni' "${META_FILE}")
tu_name="TUIC5-${server_ip}"
tu_link="tuic://${uuid}:${uuid}@${server_ip}:${tu_port}?congestion_control=bbr&alpn=h3&sni=${tu_sni}&allow_insecure=1#${tu_name}"
share_links+=("$tu_link")
summary_text+="[TUIC-v5] 端口: ${tu_port}/udp | SNI: ${tu_sni} | UUID/密码: ${uuid}\n${tu_link}\n\n"
clash_proxies+=$(cat <<EOF
- name: "${tu_name}"
type: tuic
server: ${server_ip}
port: ${tu_port}
uuid: ${uuid}
password: ${uuid}
congestion-controller: bbr
skip-cert-verify: true
sni: ${tu_sni}
alpn:
- h3
EOF
)
sb_outbounds+=("$(cat <<EOF
{
"type": "tuic",
"tag": "${tu_name}",
"server": "${server_ip}",
"server_port": ${tu_port},
"uuid": "${uuid}",
"password": "${uuid}",
"congestion_control": "bbr",
"udp_relay_mode": "native",
"tls": {
"enabled": true,
"server_name": "${tu_sni}",
"insecure": true,
"alpn": ["h3"]
}
}
EOF
)")
fi
# --------------------------------------------------------------------------
# 4. VMess-WS
# --------------------------------------------------------------------------
if [[ $(jq -r '.protocols.vmess_ws.enabled // false' "${META_FILE}") == "true" ]]; then
local vm_port vm_path vm_name vm_json vm_b64 vm_link
vm_port=$(jq -r '.protocols.vmess_ws.port' "${META_FILE}")
vm_path=$(jq -r '.protocols.vmess_ws.path' "${META_FILE}")
vm_name="VMess-WS-${server_ip}"
vm_json="{\"v\":\"2\",\"ps\":\"${vm_name}\",\"add\":\"${server_ip}\",\"port\":\"${vm_port}\",\"id\":\"${uuid}\",\"aid\":\"0\",\"scy\":\"auto\",\"net\":\"ws\",\"type\":\"none\",\"host\":\"\",\"path\":\"${vm_path}\",\"tls\":\"\"}"
vm_b64=$(echo -n "$vm_json" | base64 | tr -d '\r\n ')
vm_link="vmess://${vm_b64}"
share_links+=("$vm_link")
summary_text+="[VMess-WS] 端口: ${vm_port}/tcp | Path: ${vm_path} | UUID: ${uuid}\n${vm_link}\n\n"
clash_proxies+=$(cat <<EOF
- name: "${vm_name}"
type: vmess
server: ${server_ip}
port: ${vm_port}
uuid: ${uuid}
alterId: 0
cipher: auto
udp: true
network: ws
ws-opts:
path: "${vm_path}"
EOF
)
sb_outbounds+=("$(cat <<EOF
{
"type": "vmess",
"tag": "${vm_name}",
"server": "${server_ip}",
"server_port": ${vm_port},
"uuid": "${uuid}",
"security": "auto",
"transport": {
"type": "ws",
"path": "${vm_path}"
}
}
EOF
)")
fi
# --------------------------------------------------------------------------
# 5. AnyTLS
# --------------------------------------------------------------------------
if [[ $(jq -r '.protocols.anytls.enabled // false' "${META_FILE}") == "true" ]]; then
local an_port an_sni an_name an_link
an_port=$(jq -r '.protocols.anytls.port' "${META_FILE}")
an_sni=$(jq -r '.protocols.anytls.sni' "${META_FILE}")
an_name="AnyTLS-${server_ip}"
an_link="anytls://${uuid}@${server_ip}:${an_port}?sni=${an_sni}&insecure=1#${an_name}"
share_links+=("$an_link")
summary_text+="[AnyTLS] 端口: ${an_port}/tcp | SNI: ${an_sni} | 密码: ${uuid}\n${an_link}\n\n"
clash_proxies+=$(cat <<EOF
- name: "${an_name}"
type: anytls
server: ${server_ip}
port: ${an_port}
password: ${uuid}
sni: ${an_sni}
skip-cert-verify: true
EOF
)
sb_outbounds+=("$(cat <<EOF
{
"type": "anytls",
"tag": "${an_name}",
"server": "${server_ip}",
"server_port": ${an_port},
"password": "${uuid}",
"tls": {
"enabled": true,
"server_name": "${an_sni}",
"insecure": true
}
}
EOF
)")
fi
# --------------------------------------------------------------------------
# 导出客户端配置文件
# --------------------------------------------------------------------------
local sb_outbounds_joined
sb_outbounds_joined=$(IFS=,; echo "${sb_outbounds[*]}")
local all_links_raw=""
for link in "${share_links[@]}"; do
all_links_raw+="${link}"$'\n'
done
local sub_base64
sub_base64=$(echo -n "$all_links_raw" | base64 | tr -d '\r\n ')
local info_file="${INSTALL_DIR}/node_info.txt"
local clash_file="${INSTALL_DIR}/clash_meta.yaml"
local sb_client_file="${INSTALL_DIR}/singbox_client.json"
local b64_file="${INSTALL_DIR}/sub_base64.txt"
echo "$sub_base64" > "$b64_file"
cat > "$clash_file" <<EOF
# Clash-Meta / Mihomo 节点配置片段
proxies:${clash_proxies}
EOF
cat > "$sb_client_file" <<EOF
{
"outbounds": [
${sb_outbounds_joined}
]
}
EOF
cat > "$info_file" <<EOF
================================================================================
Sing-box 多协议节点与订阅信息汇总
================================================================================
服务器 IP : ${server_ip}
统一 UUID : ${uuid}
--------------------------------------------------------------------------------
$(echo -e "$summary_text")--------------------------------------------------------------------------------
【聚合 Base64 订阅内容 (可整段复制导入 v2rayN / Nekobox / Shadowrocket)】：
${sub_base64}
================================================================================
EOF
chmod 600 "$info_file" "$clash_file" "$sb_client_file" "$b64_file"
# 终端高亮打印
echo ""
echo -e "${CLR_GREEN}================================================================================${CLR_RESET}"
echo -e "${CLR_BOLD}${CLR_GREEN} Sing-box 核心代理节点与订阅信息汇总${CLR_RESET}"
echo -e "${CLR_GREEN}================================================================================${CLR_RESET}"
echo -e "${CLR_BOLD}服务器 IP${CLR_RESET} : ${CLR_YELLOW}${server_ip}${CLR_RESET}"
echo -e "${CLR_BOLD}统一 UUID${CLR_RESET} : ${CLR_BLUE}${uuid}${CLR_RESET}"
echo -e "${CLR_GREEN}--------------------------------------------------------------------------------${CLR_RESET}"
echo -e "$summary_text"
echo -e "${CLR_GREEN}--------------------------------------------------------------------------------${CLR_RESET}"
echo -e "${CLR_BOLD}${CLR_YELLOW}【聚合 Base64 订阅串】(一键复制导入客户端即可识别所有已装协议):${CLR_RESET}"
echo -e "${CLR_PURPLE}${sub_base64}${CLR_RESET}"
echo -e "${CLR_GREEN}--------------------------------------------------------------------------------${CLR_RESET}"
echo -e "${CLR_BOLD}本地导出的配置文件路径：${CLR_RESET}"
echo -e " • 节点详情汇总 : ${CLR_BLUE}${info_file}${CLR_RESET}"
echo -e " • Clash/Mihomo : ${CLR_BLUE}${clash_file}${CLR_RESET}"
echo -e " • Sing-box客户端: ${CLR_BLUE}${sb_client_file}${CLR_RESET}"
echo -e " • Base64 订阅串 : ${CLR_BLUE}${b64_file}${CLR_RESET}"
echo -e "${CLR_GREEN}================================================================================${CLR_RESET}"
echo ""
}
lib/singbox.sh
+119
View File
@@ -0,0 +1,119 @@
#!/usr/bin/env bash
# ==============================================================================
# 模块：Sing-box 官方二进制安装、版本管理与 Systemd 服务管理
# ==============================================================================
# 获取官方最新版本号
get_latest_singbox_version() {
local version=""
# 优先尝试 GitHub API
version=$(curl -sL --max-time 5 "https://api.github.com/repos/SagerNet/sing-box/releases/latest" 2>/dev/null | jq -r '.tag_name' 2>/dev/null | sed 's/^v//')
# 备用方案：重定向网页抓取
if [[ -z "$version" || "$version" == "null" ]]; then
version=$(curl -sL --max-time 5 "https://github.com/SagerNet/sing-box/releases/latest" 2>/dev/null | grep -oP 'tag/v\K[0-9.]+' | head -n 1)
fi
# 兜底固定稳定版本 (如果 GitHub 无法连接)
if [[ -z "$version" || "$version" == "null" ]]; then
version="1.11.0"
fi
echo "$version"
}
# 下载并安装官方原版 Sing-box 二进制
install_singbox_binary() {
local arch
arch=$(detect_arch) || return 1
local version
version=$(get_latest_singbox_version)
log_info "准备安装 Sing-box 官方核心版本: v${version} (架构: ${arch})..."
local pkg_name="sing-box-${version}-linux-${arch}"
local download_url="https://github.com/SagerNet/sing-box/releases/download/v${version}/${pkg_name}.tar.gz"
local temp_tar="/tmp/${pkg_name}.tar.gz"
local temp_dir="/tmp/${pkg_name}"
log_info "正在从 GitHub Releases 官方通道下载..."
if ! curl -L --fail --retry 3 --connect-timeout 10 -o "$temp_tar" "$download_url"; then
log_error "下载 Sing-box 失败，请检查服务器连接 GitHub 的网络状况！"
return 1
fi
# 解压并部署
rm -rf "$temp_dir"
mkdir -p "$temp_dir"
tar -xzf "$temp_tar" -C /tmp/ || {
log_error "解压 Sing-box 压缩包失败！"
rm -f "$temp_tar"
return 1
}
mkdir -p "${BIN_DIR}"
cp -f "${temp_dir}/sing-box" "${BIN_PATH}"
chmod +x "${BIN_PATH}"
chown root:root "${BIN_PATH}"
# 清理临时下载文件
rm -rf "$temp_tar" "$temp_dir"
# 验证是否可用
if ! "${BIN_PATH}" version >/dev/null 2>&1; then
log_error "Sing-box 二进制文件执行测试失败！"
return 1
fi
local installed_ver
installed_ver=$("${BIN_PATH}" version | head -n 1)
log_success "Sing-box 核心安装成功: ${installed_ver}"
return 0
}
# 配置安全可靠的 Systemd 服务文件
setup_systemd_service() {
log_info "配置 Sing-box Systemd 系统守护进程..."
cat > "${SERVICE_FILE}" <<EOF
[Unit]
Description=Sing-box Service
Documentation=https://sing-box.sagernet.org
After=network.target nss-lookup.target
[Service]
Type=simple
User=root
WorkingDirectory=${INSTALL_DIR}
ExecStart=${BIN_PATH} run -c ${CONFIG_FILE}
Restart=on-failure
RestartSec=5s
LimitNOFILE=65535
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable "${SERVICE_NAME}" >/dev/null 2>&1
log_success "Systemd 守护服务配置完成！"
}
# 服务启停控制
start_service() {
systemctl start "${SERVICE_NAME}"
}
stop_service() {
systemctl stop "${SERVICE_NAME}"
}
restart_service() {
systemctl restart "${SERVICE_NAME}"
}
is_service_active() {
systemctl is-active --quiet "${SERVICE_NAME}"
}
lib/system.sh
+139
View File
@@ -0,0 +1,139 @@
#!/usr/bin/env bash
# ==============================================================================
# 模块：系统架构识别、依赖安装与安全防火墙配置
# ==============================================================================
# 识别系统架构
detect_arch() {
local raw_arch
raw_arch=$(uname -m)
case "${raw_arch}" in
x86_64|amd64)
echo "amd64"
;;
aarch64|arm64)
echo "arm64"
;;
armv7*|armv8l)
echo "armv7"
;;
*)
log_error "暂不支持的 CPU 架构: ${raw_arch}"
return 1
;;
esac
}
# 识别系统包管理器并安装基础依赖
install_dependencies() {
log_info "检查并安装必要系统工具 (curl, tar, jq, openssl, ca-certificates)..."
local pkgs=("curl" "tar" "jq" "openssl" "ca-certificates")
if command -v apt-get >/dev/null 2>&1; then
apt-get update -y >/dev/null 2>&1
apt-get install -y "${pkgs[@]}" >/dev/null 2>&1
elif command -v dnf >/dev/null 2>&1; then
dnf install -y "${pkgs[@]}" >/dev/null 2>&1
elif command -v yum >/dev/null 2>&1; then
yum install -y "${pkgs[@]}" >/dev/null 2>&1
elif command -v apk >/dev/null 2>&1; then
apk update >/dev/null 2>&1
apk add --no-cache "${pkgs[@]}" >/dev/null 2>&1
else
log_warn "未识别的包管理器，请手动确保安装了: ${pkgs[*]}"
fi
# 验证关键工具安装结果
for cmd in curl tar jq openssl; do
if ! command -v "$cmd" >/dev/null 2>&1; then
log_error "关键依赖工具 [${cmd}] 安装失败，请检查网络或系统源设置！"
return 1
fi
done
log_success "系统基础依赖检测通过！"
return 0
}
# 获取公网 IP（具备多节点故障自动切换机制）
get_public_ip() {
local ip=""
local apis=(
"https://api.ipify.org"
"https://icanhazip.com"
"https://ifconfig.me/ip"
"https://checkip.amazonaws.com"
)
for api in "${apis[@]}"; do
ip=$(curl -s4m 4 "$api" 2>/dev/null | tr -d '[:space:]')
if [[ -n "$ip" && "$ip" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
echo "$ip"
return 0
fi
done
# 尝试获取 IPv6 (如果仅有 IPv6)
ip=$(curl -s6m 4 "https://api64.ipify.org" 2>/dev/null | tr -d '[:space:]')
if [[ -n "$ip" ]]; then
echo "$ip"
return 0
fi
echo "127.0.0.1"
}
# 安全配置防火墙：精准仅开放代理端口，杜绝关闭防火墙或全盘清空规则
open_firewall_port() {
local port="$1"
local protocol="${2:-tcp}"
[[ -z "$port" ]] && return 0
log_info "正在配置防火墙放行端口: ${port}/${protocol}..."
# 1. 检测 UFW
if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -qw "active"; then
ufw allow "${port}/${protocol}" comment "sing-box" >/dev/null 2>&1
log_success "UFW 已放行端口 ${port}/${protocol}"
return 0
fi
# 2. 检测 Firewalld
if command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld 2>/dev/null; then
firewall-cmd --permanent --add-port="${port}/${protocol}" >/dev/null 2>&1
firewall-cmd --reload >/dev/null 2>&1
log_success "Firewalld 已放行端口 ${port}/${protocol}"
return 0
fi
# 3. iptables 兜底安全追加（不重置现有规则链）
if command -v iptables >/dev/null 2>&1; then
if ! iptables -C INPUT -p "${protocol}" --dport "${port}" -j ACCEPT 2>/dev/null; then
iptables -I INPUT -p "${protocol}" --dport "${port}" -j ACCEPT 2>/dev/null
log_success "iptables 已安全追加放行规则: ${port}/${protocol}"
fi
fi
}
# 卸载或更换端口时安全移除端口规则
close_firewall_port() {
local port="$1"
local protocol="${2:-tcp}"
[[ -z "$port" ]] && return 0
log_info "正在清理防火墙放行规则: ${port}/${protocol}..."
if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -qw "active"; then
ufw delete allow "${port}/${protocol}" >/dev/null 2>&1 || true
fi
if command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld 2>/dev/null; then
firewall-cmd --permanent --remove-port="${port}/${protocol}" >/dev/null 2>&1 || true
firewall-cmd --reload >/dev/null 2>&1 || true
fi
if command -v iptables >/dev/null 2>&1; then
iptables -D INPUT -p "${protocol}" --dport "${port}" -j ACCEPT 2>/dev/null || true
fi
}