eric/proxy-station
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 限制边缘节点仅使用 IPv4 并记录维护约定

Browse Source
This commit is contained in:
杨建宽
2026-10-04 00:21:36 +08:00
parent 5326c572a2
commit 349ab8329e
8 changed files with 69 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
.claude/skills/edge-node-multi-protocol/references/dns-records.md
View File

@@ -5,14 +5,13 @@ whatever `ACME_DNS_PLUGIN` you set — acme.sh supports Cloudflare, DNSPod, Aliy
GoDaddy, and dozens more. That part is provider-agnostic.
The only thing that is *not* automated for non-Cloudflare providers is creating the host
**A/AAAA records**. That's just two names. Create them in your DNS provider's console/API:
**A records**. The current fleet is IPv4-only: keep `SERVER_IPV6` empty and do not create
AAAA records. Create these two names in your DNS provider's console/API:
| Name | Type | Value | Proxy/CDN |
|---|---|---|---|
| `<DOMAIN_ROOT>` (e.g. `nodeA.example.com`) | A | `SERVER_IP` | **off** (DNS-only / grey cloud) |
| `*.<DOMAIN_ROOT>` | A | `SERVER_IP` | **off** |
| `<DOMAIN_ROOT>` | AAAA | `SERVER_IPV6` | off (skip if no IPv6) |
| `*.<DOMAIN_ROOT>` | AAAA | `SERVER_IPV6` | off |
Notes:
- Keep them **unproxied** — the node terminates its own TLS and needs the real client IP path; a proxy/CDN in front would break the WS cover and the panel anti-scan logic.
@@ -21,10 +20,14 @@ Notes:
## Cloudflare shortcut
If your zone is on Cloudflare, skip the manual step — `02-cf-dns.py` upserts all four
records for you via the API (`CF_API_TOKEN` with `Zone:DNS:Edit`). Run it from wherever the
If your zone is on Cloudflare, skip the manual step — `02-cf-dns.py` upserts the two A
records when `SERVER_IPV6` is empty (`CF_API_TOKEN` with `Zone:DNS:Edit`). Run it from wherever the
token lives; it never touches the VPS.
Leaving `SERVER_IPV6` empty does **not** delete existing AAAA records. For an existing
node, back up DNS records, remove the AAAA records under that node's domain, then check
the API and public DNS. See [IPv4-only fleet policy](../../../../docs/EDGE-IPV4-ONLY.md).
## Picking the acme.sh plugin + creds
Set `ACME_DNS_PLUGIN` and the matching credential vars in `config.env` (acme.sh reads them

1
.claude/skills/edge-node-multi-protocol/references/pitfalls.md
View File

@@ -32,6 +32,7 @@ Every item here cost real debugging time on a live deployment. They are ordered
## Cloudflare WARP
- **Disabling host IPv6 does not disable IPv6 inside WARP's proxy tunnel.** Keep the IPv4-only guards in Xray and sing-box: force IPv4 domain resolution and reject `::/0` before WARP routing. `UseIPv4` can fall back to system resolution in Xray; use `ForceIPv4`. Do not pass unresolved target domains to WARP. See [fleet policy](../../../../docs/EDGE-IPV4-ONLY.md).
- **`gpg` must be installed first.** On a minimal Debian, `gpg --dearmor` for the repo keyring fails with `gpg: command not found`, and the later `apt update` then errors `Failed to parse keyring … sqv returned an error code`. `apt-get install -y gnupg` before adding the repo.
- Use the **`bookworm`** repo line even on Debian 13 (trixie) — the bookworm package works.
- **WARP can lie about being connected.** The control plane shows `Connected` while the SOCKS proxy stops egressing. The watchdog (`warp-healthcheck.*`) checks `warp=on` *through the proxy* and restarts `warp-svc` when it isn't.