jocay
340 lines
8.4 KiB
Bash
340 lines
8.4 KiB
Bash
#!/usr/bin/env bash
|
|
# ==============================================================================
|
|
# 模块：多协议配置生成器 (VLESS-Reality / Hysteria2 / TUIC / VMess / AnyTLS)
|
|
# ==============================================================================
|
|
|
|
# 获取或生成统一 UUID
|
|
get_or_create_uuid() {
|
|
local uuid="${1:-}"
|
|
if [[ -z "$uuid" ]]; then
|
|
if command -v "${BIN_PATH}" >/dev/null 2>&1; then
|
|
uuid=$("${BIN_PATH}" generate uuid 2>/dev/null)
|
|
fi
|
|
if [[ -z "$uuid" && -f /proc/sys/kernel/random/uuid ]]; then
|
|
uuid=$(cat /proc/sys/kernel/random/uuid)
|
|
fi
|
|
if [[ -z "$uuid" ]]; then
|
|
uuid=$(openssl rand -hex 16 | sed -E 's/(.{8})(.{4})(.{4})(.{4})(.{12})/\1-\2-\3-\4-\5/')
|
|
fi
|
|
fi
|
|
echo "$uuid"
|
|
}
|
|
|
|
# 1. 组装 VLESS-Reality 入站 JSON
|
|
build_vless_inbound() {
|
|
local port="$1"
|
|
local uuid="$2"
|
|
local sni="$3"
|
|
local priv_key="$4"
|
|
local short_id="$5"
|
|
|
|
cat <<EOF
|
|
{
|
|
"type": "vless",
|
|
"tag": "vless-in",
|
|
"listen": "::",
|
|
"listen_port": ${port},
|
|
"sniff": true,
|
|
"sniff_override_destination": true,
|
|
"users": [
|
|
{
|
|
"uuid": "${uuid}",
|
|
"flow": "xtls-rprx-vision"
|
|
}
|
|
],
|
|
"tls": {
|
|
"enabled": true,
|
|
"server_name": "${sni}",
|
|
"reality": {
|
|
"enabled": true,
|
|
"handshake": {
|
|
"server": "${sni}",
|
|
"server_port": 443
|
|
},
|
|
"private_key": "${priv_key}",
|
|
"short_id": [
|
|
"${short_id}"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
EOF
|
|
}
|
|
|
|
# 2. 组装 Hysteria 2 入站 JSON
|
|
build_hy2_inbound() {
|
|
local port="$1"
|
|
local password="$2"
|
|
|
|
cat <<EOF
|
|
{
|
|
"type": "hysteria2",
|
|
"tag": "hy2-in",
|
|
"listen": "::",
|
|
"listen_port": ${port},
|
|
"sniff": true,
|
|
"sniff_override_destination": true,
|
|
"users": [
|
|
{
|
|
"password": "${password}"
|
|
}
|
|
],
|
|
"ignore_client_bandwidth": false,
|
|
"tls": {
|
|
"enabled": true,
|
|
"alpn": [
|
|
"h3"
|
|
],
|
|
"certificate_path": "${CERT_FILE}",
|
|
"key_path": "${KEY_FILE}"
|
|
}
|
|
}
|
|
EOF
|
|
}
|
|
|
|
# 3. 组装 TUIC v5 入站 JSON
|
|
build_tuic_inbound() {
|
|
local port="$1"
|
|
local uuid="$2"
|
|
|
|
cat <<EOF
|
|
{
|
|
"type": "tuic",
|
|
"tag": "tuic-in",
|
|
"listen": "::",
|
|
"listen_port": ${port},
|
|
"sniff": true,
|
|
"sniff_override_destination": true,
|
|
"users": [
|
|
{
|
|
"uuid": "${uuid}",
|
|
"password": "${uuid}"
|
|
}
|
|
],
|
|
"congestion_control": "bbr",
|
|
"tls": {
|
|
"enabled": true,
|
|
"alpn": [
|
|
"h3"
|
|
],
|
|
"certificate_path": "${CERT_FILE}",
|
|
"key_path": "${KEY_FILE}"
|
|
}
|
|
}
|
|
EOF
|
|
}
|
|
|
|
# 4. 组装 VMess-WS 入站 JSON
|
|
build_vmess_inbound() {
|
|
local port="$1"
|
|
local uuid="$2"
|
|
|
|
cat <<EOF
|
|
{
|
|
"type": "vmess",
|
|
"tag": "vmess-in",
|
|
"listen": "::",
|
|
"listen_port": ${port},
|
|
"sniff": true,
|
|
"sniff_override_destination": true,
|
|
"users": [
|
|
{
|
|
"uuid": "${uuid}",
|
|
"alterId": 0
|
|
}
|
|
],
|
|
"transport": {
|
|
"type": "ws",
|
|
"path": "/${uuid}-vm",
|
|
"max_early_data": 2048,
|
|
"early_data_header_name": "Sec-WebSocket-Protocol"
|
|
}
|
|
}
|
|
EOF
|
|
}
|
|
|
|
# 5. 组装 AnyTLS 入站 JSON
|
|
build_anytls_inbound() {
|
|
local port="$1"
|
|
local password="$2"
|
|
|
|
cat <<EOF
|
|
{
|
|
"type": "anytls",
|
|
"tag": "anytls-in",
|
|
"listen": "::",
|
|
"listen_port": ${port},
|
|
"users": [
|
|
{
|
|
"password": "${password}"
|
|
}
|
|
],
|
|
"padding_scheme": [],
|
|
"tls": {
|
|
"enabled": true,
|
|
"certificate_path": "${CERT_FILE}",
|
|
"key_path": "${KEY_FILE}"
|
|
}
|
|
}
|
|
EOF
|
|
}
|
|
|
|
# 组合入站并生成最终完整服务配置与元数据
|
|
generate_suite_config() {
|
|
local mode="$1" # all | vless | hy2 | tuic | vmess | anytls
|
|
shift
|
|
|
|
local uuid
|
|
uuid=$(get_or_create_uuid)
|
|
|
|
local reality_sni="www.apple.com"
|
|
local cert_sni="www.bing.com"
|
|
|
|
mkdir -p "${INSTALL_DIR}"
|
|
|
|
# 如涉及需证书的协议，预先生成自签证书
|
|
if [[ "$mode" == "all" || "$mode" == "hy2" || "$mode" == "tuic" || "$mode" == "anytls" ]]; then
|
|
generate_self_signed_cert "$cert_sni" || return 1
|
|
fi
|
|
|
|
# 如涉及 Reality，预先生成密钥对
|
|
local priv_key="" pub_key="" short_id=""
|
|
if [[ "$mode" == "all" || "$mode" == "vless" ]]; then
|
|
local keypair
|
|
keypair=$("${BIN_PATH}" generate reality-keypair)
|
|
priv_key=$(echo "$keypair" | awk '/PrivateKey/ {print $2}' | tr -d ' "\r\n')
|
|
pub_key=$(echo "$keypair" | awk '/PublicKey/ {print $2}' | tr -d ' "\r\n')
|
|
short_id=$("${BIN_PATH}" generate rand --hex 4 2>/dev/null || openssl rand -hex 4)
|
|
short_id=$(echo "$short_id" | tr -d ' "\r\n')
|
|
fi
|
|
|
|
local inbounds_arr=()
|
|
local meta_protocols="{}"
|
|
|
|
case "$mode" in
|
|
all)
|
|
local p_vless="${1:-443}"
|
|
local p_hy2="${2:-8443}"
|
|
local p_tuic="${3:-9443}"
|
|
local p_vmess="${4:-8080}"
|
|
local p_anytls="${5:-10443}"
|
|
|
|
inbounds_arr+=("$(build_vless_inbound "$p_vless" "$uuid" "$reality_sni" "$priv_key" "$short_id")")
|
|
inbounds_arr+=("$(build_hy2_inbound "$p_hy2" "$uuid")")
|
|
inbounds_arr+=("$(build_tuic_inbound "$p_tuic" "$uuid")")
|
|
inbounds_arr+=("$(build_vmess_inbound "$p_vmess" "$uuid")")
|
|
inbounds_arr+=("$(build_anytls_inbound "$p_anytls" "$uuid")")
|
|
|
|
meta_protocols=$(cat <<EOF
|
|
{
|
|
"vless_reality": { "enabled": true, "port": ${p_vless}, "sni": "${reality_sni}", "public_key": "${pub_key}", "short_id": "${short_id}" },
|
|
"hysteria2": { "enabled": true, "port": ${p_hy2}, "sni": "${cert_sni}" },
|
|
"tuic": { "enabled": true, "port": ${p_tuic}, "sni": "${cert_sni}" },
|
|
"vmess_ws": { "enabled": true, "port": ${p_vmess}, "path": "/${uuid}-vm" },
|
|
"anytls": { "enabled": true, "port": ${p_anytls}, "sni": "${cert_sni}" }
|
|
}
|
|
EOF
|
|
)
|
|
;;
|
|
vless)
|
|
local port="${1:-443}"
|
|
local custom_sni="${2:-$reality_sni}"
|
|
inbounds_arr+=("$(build_vless_inbound "$port" "$uuid" "$custom_sni" "$priv_key" "$short_id")")
|
|
meta_protocols=$(cat <<EOF
|
|
{
|
|
"vless_reality": { "enabled": true, "port": ${port}, "sni": "${custom_sni}", "public_key": "${pub_key}", "short_id": "${short_id}" }
|
|
}
|
|
EOF
|
|
)
|
|
;;
|
|
hy2)
|
|
local port="${1:-8443}"
|
|
inbounds_arr+=("$(build_hy2_inbound "$port" "$uuid")")
|
|
meta_protocols=$(cat <<EOF
|
|
{
|
|
"hysteria2": { "enabled": true, "port": ${port}, "sni": "${cert_sni}" }
|
|
}
|
|
EOF
|
|
)
|
|
;;
|
|
tuic)
|
|
local port="${1:-9443}"
|
|
inbounds_arr+=("$(build_tuic_inbound "$port" "$uuid")")
|
|
meta_protocols=$(cat <<EOF
|
|
{
|
|
"tuic": { "enabled": true, "port": ${port}, "sni": "${cert_sni}" }
|
|
}
|
|
EOF
|
|
)
|
|
;;
|
|
vmess)
|
|
local port="${1:-8080}"
|
|
inbounds_arr+=("$(build_vmess_inbound "$port" "$uuid")")
|
|
meta_protocols=$(cat <<EOF
|
|
{
|
|
"vmess_ws": { "enabled": true, "port": ${port}, "path": "/${uuid}-vm" }
|
|
}
|
|
EOF
|
|
)
|
|
;;
|
|
anytls)
|
|
local port="${1:-10443}"
|
|
inbounds_arr+=("$(build_anytls_inbound "$port" "$uuid")")
|
|
meta_protocols=$(cat <<EOF
|
|
{
|
|
"anytls": { "enabled": true, "port": ${port}, "sni": "${cert_sni}" }
|
|
}
|
|
EOF
|
|
)
|
|
;;
|
|
esac
|
|
|
|
# 拼装 inbounds 数组逗号
|
|
local inbounds_joined
|
|
inbounds_joined=$(IFS=,; echo "${inbounds_arr[*]}")
|
|
|
|
# 写入最终 config.json
|
|
cat > "${CONFIG_FILE}" <<EOF
|
|
{
|
|
"log": {
|
|
"disabled": false,
|
|
"level": "info",
|
|
"timestamp": true
|
|
},
|
|
"inbounds": [
|
|
${inbounds_joined}
|
|
],
|
|
"outbounds": [
|
|
{
|
|
"type": "direct",
|
|
"tag": "direct"
|
|
},
|
|
{
|
|
"type": "block",
|
|
"tag": "block"
|
|
}
|
|
]
|
|
}
|
|
EOF
|
|
|
|
# 原生语法校验
|
|
if ! "${BIN_PATH}" check -c "${CONFIG_FILE}" >/dev/null 2>&1; then
|
|
log_error "生成的配置文件未能通过 Sing-box 语法检测！请检查端口是否有冲突或参数错误。"
|
|
return 1
|
|
fi
|
|
|
|
# 写入持久化元数据
|
|
cat > "${META_FILE}" <<EOF
|
|
{
|
|
"mode": "${mode}",
|
|
"uuid": "${uuid}",
|
|
"protocols": ${meta_protocols},
|
|
"updated_at": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
|
|
}
|
|
EOF
|
|
|
|
chmod 600 "${CONFIG_FILE}" "${META_FILE}"
|
|
log_success "Sing-box 核心配置部署成功，语法校验通过！"
|
|
return 0
|
|
}
|