自建代理订阅管理

机场订阅 · 自建节点
      ↓
Sub-Store · 合并 / 去重 / 改名 / 过滤 / 分组
      ↓  纯节点订阅
subconverter (+ sub-web GUI) · 套 ACL4SSR · 转目标格式
      ↓
客户端 · Mihomo / Surge / sing-box

apt update && apt upgrade -y && apt install -y curl ca-certificates
timedatectl set-timezone Asia/Shanghai
adduser evan && usermod -aG sudo evan
curl -fsSL https://get.docker.com | sh
systemctl enable --now docker
usermod -aG docker evan

sudo -iu evan
mkdir -p ~/sherpa/{sub-store-data,subconverter/{snippets,rules}}
cd ~/sherpa

x-logging: &log
  driver: json-file
  options: { max-size: "10m", max-file: "3" }

services:
  sub-store:
    image: xream/sub-store:latest
    container_name: sub-store
    restart: unless-stopped
    ports: ["127.0.0.1:3001:3001"]
    volumes: [./sub-store-data:/opt/app/data]
    environment:
      - "SUB_STORE_FRONTEND_BACKEND_PATH=${SUB_STORE_FRONTEND_BACKEND_PATH:?missing in .env}"
      - SUB_STORE_FRONTEND_HOST=0.0.0.0
      - SUB_STORE_FRONTEND_PORT=3001
      - SUB_STORE_DATA_BASE_PATH=/opt/app/data
    networks: [sherpa-net]
    logging: *log

  # MetaCubeX fork 跟进 Hysteria2 / TUIC / Reality;tindy2013 原版更新慢
  subconverter:
    image: ghcr.io/metacubex/subconverter:latest
    container_name: subconverter
    restart: unless-stopped
    ports: ["127.0.0.1:25500:25500"]
    volumes:
      - ./subconverter/pref.toml:/base/pref.toml:ro
      - ./subconverter/snippets:/base/snippets:ro
      - ./subconverter/rules:/base/rules:ro
    networks: [sherpa-net]
    logging: *log

  sub-web:
    image: careywong/subweb:latest
    container_name: sub-web
    restart: unless-stopped
    environment: [API_URL=https://${SUB_DOMAIN}]
    ports: ["127.0.0.1:25580:80"]
    depends_on: [subconverter]
    networks: [sherpa-net]
    logging: *log

# 显式 name,Caddy 子项目 external 引用;容器之间用服务名通信,不走宿主机 loopback
networks:
  sherpa-net:
    driver: bridge
    name: sherpa-net

cat > .env <<EOF
SUB_DOMAIN=sub.example.com
SUB_STORE_FRONTEND_BACKEND_PATH=/api-$(openssl rand -hex 16)
SSH_HOST=evan@<vps-ip>
EOF
chmod 600 .env

cat > subconverter/pref.toml <<EOF
[common]
api_mode = true
api_access_token = "$(openssl rand -hex 32)"

[node_pref]
udp_flag = true
filter_deprecated_nodes = true
append_sub_userinfo = true
clash_use_new_field_name = true

[managed_config]
write_managed_config = true
# 必须真实公网域名,客户端按这个 URL 自动刷新;写 localhost 客户端更新不了
managed_config_prefix = "https://sub.example.com"

[emojis]
add_emoji = true
remove_old_emoji = true

[ruleset]
enabled = true
overwrite_original_rules = true
EOF
chmod 600 subconverter/pref.toml

docker compose up -d
curl -s http://127.0.0.1:25500/version       # subconverter vx.x.x backend
curl -sI http://127.0.0.1:3001/ | head -1    # HTTP/1.1 200 OK

sub.example.com {
    encode gzip
    @blocked not header User-Agent *Clash* *Quantumult* *Surge* *Shadowrocket* *Stash* *Loon* *Mihomo* *sing-box* *curl* *wget*
    respond @blocked 403
    reverse_proxy 127.0.0.1:25500
}

# caddy/docker-compose.yml
services:
  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports: ["80:80", "443:443"]
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    networks: [caddy-net, sherpa-net]

networks:
  caddy-net: { driver: bridge, name: caddy-net }
  sherpa-net: { external: true, name: sherpa-net }   # 引用主项目同名网络

volumes: { caddy_data: {}, caddy_config: {} }

curl -i https://sub.example.com/version            # 403,UA 被挡
curl -iA "Mihomo" https://sub.example.com/version  # 200

SOCK=/tmp/sherpa-tunnel-$(id -u).sock
ssh -S "$SOCK" -O check sherpa 2>/dev/null || \
  ssh -fN -M -S "$SOCK" sherpa     # 启动(已有则跳过)
ssh -S "$SOCK" -O check sherpa     # 查
ssh -S "$SOCK" -O exit  sherpa     # 关

https://sub.example.com/sub
  ?target=clash
  &url=<URL-encoded 第 2 层 URL>
  &config=<URL-encoded 远程 config>
  &access_token=<pref.toml 的 api_access_token>
  &emoji=true&list=false&udp=true

git clone --depth=1 https://github.com/ACL4SSR/ACL4SSR.git ~/sherpa/subconverter/rules/ACL4SSR
# config 改成 config/ACL4SSR/Clash/config/ACL4SSR_Online_Full.ini