48 lines
1.6 KiB
YAML
48 lines
1.6 KiB
YAML
|
# sing-box HTTP forward proxy on us4.wsvc.info, published through Traefik :6443.
|
||
|
|
#
|
||
|
|
# TLS terminates in Traefik (entrypoint `proxyin`); sing-box only speaks plain
|
||
|
|
# HTTP-proxy on the private `proxy` Docker network, so it publishes NO host port.
|
||
|
|
# The credential lives in the server-side ./config.json (mode 0600) and is never
|
||
|
|
# committed here.
|
||
|
|
#
|
||
|
|
# Repo-owned copy of /opt/sing-box/compose.yml (static mechanism, not yet wired
|
||
|
|
# to compose-deploy). Change record: Plane VPS-99. Health: runbooks/proxy-health.md.
|
||
|
|
services:
|
||
|
|
sing-box:
|
||
|
|
image: ghcr.io/sagernet/sing-box:v1.14.2@sha256:afbffd294c5eb3519cc7b4587299ef189bb0a2ca2f667cb6301fdb6b9bce9558
|
||
|
|
container_name: sing-box
|
||
|
|
restart: unless-stopped
|
||
|
|
security_opt:
|
||
|
|
- no-new-privileges:true
|
||
|
|
logging:
|
||
|
|
driver: json-file
|
||
|
|
options:
|
||
|
|
max-size: "10m"
|
||
|
|
max-file: "3"
|
||
|
|
command:
|
||
|
|
- run
|
||
|
|
- -c
|
||
|
|
- /etc/sing-box/config.json
|
||
|
|
volumes:
|
||
|
|
- ./config.json:/etc/sing-box/config.json:ro
|
||
|
|
networks:
|
||
|
|
- proxy
|
||
|
|
labels:
|
||
|
|
- "traefik.enable=true"
|
||
|
|
- "traefik.docker.network=proxy"
|
||
|
|
|
||
|
|
# TCP router: TLS terminates here, decrypted bytes go to sing-box.
|
||
|
|
- "traefik.tcp.routers.singbox-proxy.rule=HostSNI(`us4.wsvc.info`)"
|
||
|
|
- "traefik.tcp.routers.singbox-proxy.entrypoints=proxyin"
|
||
|
|
- "traefik.tcp.routers.singbox-proxy.tls=true"
|
||
|
|
- "traefik.tcp.routers.singbox-proxy.tls.certresolver=letsencrypt"
|
||
|
|
|
||
|
|
# TCP service: in-container HTTP proxy port.
|
||
|
|
- "traefik.tcp.routers.singbox-proxy.service=singbox-proxy"
|
||
|
|
- "traefik.tcp.services.singbox-proxy.loadbalancer.server.port=8080"
|
||
|
|
|
||
|
|
networks:
|
||
|
|
proxy:
|
||
|
|
name: proxy
|
||
|
|
external: true
|