fix: 限制边缘节点仅使用 IPv4 并记录维护约定

.claude/skills/edge-node-multi-protocol/references/dns-records.md

@@ -5,14 +5,13 @@ whatever `ACME_DNS_PLUGIN` you set — acme.sh supports Cloudflare, DNSPod, Aliy
 GoDaddy, and dozens more. That part is provider-agnostic.
 
 The only thing that is *not* automated for non-Cloudflare providers is creating the host
-**A/AAAA records**. That's just two names. Create them in your DNS provider's console/API:
+**A records**. The current fleet is IPv4-only: keep `SERVER_IPV6` empty and do not create
+AAAA records. Create these two names in your DNS provider's console/API:
 
 | Name | Type | Value | Proxy/CDN |
 |---|---|---|---|
 | `<DOMAIN_ROOT>` (e.g. `nodeA.example.com`) | A | `SERVER_IP` | **off** (DNS-only / grey cloud) |
 | `*.<DOMAIN_ROOT>` | A | `SERVER_IP` | **off** |
-| `<DOMAIN_ROOT>` | AAAA | `SERVER_IPV6` | off (skip if no IPv6) |
-| `*.<DOMAIN_ROOT>` | AAAA | `SERVER_IPV6` | off |
 
 Notes:
 - Keep them **unproxied** — the node terminates its own TLS and needs the real client IP path; a proxy/CDN in front would break the WS cover and the panel anti-scan logic.
@@ -21,10 +20,14 @@ Notes:
 
 ## Cloudflare shortcut
 
-If your zone is on Cloudflare, skip the manual step — `02-cf-dns.py` upserts all four
+If your zone is on Cloudflare, skip the manual step — `02-cf-dns.py` upserts the two A
-records for you via the API (`CF_API_TOKEN` with `Zone:DNS:Edit`). Run it from wherever the
+records when `SERVER_IPV6` is empty (`CF_API_TOKEN` with `Zone:DNS:Edit`). Run it from wherever the
 token lives; it never touches the VPS.
 
+Leaving `SERVER_IPV6` empty does **not** delete existing AAAA records. For an existing
+node, back up DNS records, remove the AAAA records under that node's domain, then check
+the API and public DNS. See [IPv4-only fleet policy](../../../../docs/EDGE-IPV4-ONLY.md).
+
 ## Picking the acme.sh plugin + creds
 
 Set `ACME_DNS_PLUGIN` and the matching credential vars in `config.env` (acme.sh reads them

.claude/skills/edge-node-multi-protocol/references/pitfalls.md

@@ -32,6 +32,7 @@ Every item here cost real debugging time on a live deployment. They are ordered
 
 ## Cloudflare WARP
 
+- **Disabling host IPv6 does not disable IPv6 inside WARP's proxy tunnel.** Keep the IPv4-only guards in Xray and sing-box: force IPv4 domain resolution and reject `::/0` before WARP routing. `UseIPv4` can fall back to system resolution in Xray; use `ForceIPv4`. Do not pass unresolved target domains to WARP. See [fleet policy](../../../../docs/EDGE-IPV4-ONLY.md).
 - **`gpg` must be installed first.** On a minimal Debian, `gpg --dearmor` for the repo keyring fails with `gpg: command not found`, and the later `apt update` then errors `Failed to parse keyring … sqv returned an error code`. `apt-get install -y gnupg` before adding the repo.
 - Use the **`bookworm`** repo line even on Debian 13 (trixie) — the bookworm package works.
 - **WARP can lie about being connected.** The control plane shows `Connected` while the SOCKS proxy stops egressing. The watchdog (`warp-healthcheck.*`) checks `warp=on` *through the proxy* and restarts `warp-svc` when it isn't.

.claude/skills/edge-node-multi-protocol/scripts/08-xui-bootstrap.py

@@ -107,22 +107,26 @@ TEMPLATE = {
     "inbounds": [{"listen": "127.0.0.1", "port": 62789, "protocol": "dokodemo-door",
                   "settings": {"address": "127.0.0.1"}, "tag": "api"}],
     "outbounds": [
-        {"protocol": "freedom", "settings": {}},
+        {"protocol": "freedom", "settings": {"domainStrategy": "ForceIPv4"},
+         "streamSettings": {"sockopt": {"domainStrategy": "ForceIPv4"}}},
         {"tag": "warp-outbound", "protocol": "freedom",
-         "settings": {"domainStrategy": "UseIPv6v4"}, "proxySettings": {"tag": "warp-socks"}},
+         "settings": {"domainStrategy": "ForceIPv4"},
+         "streamSettings": {"sockopt": {"domainStrategy": "ForceIPv4"}},
+         "proxySettings": {"tag": "warp-socks"}},
         {"tag": "warp-socks", "protocol": "socks",
          "settings": {"servers": [{"address": "127.0.0.1", "port": WARP_SOCKS_PORT}]}},
         {"protocol": "blackhole", "settings": {}, "tag": "blocked"},
     ],
     "policy": {"system": {"statsInboundDownlink": True, "statsInboundUplink": True}},
     "routing": {"rules": [
+        {"ip": ["::/0"], "outboundTag": "blocked", "type": "field"},
         {"inboundTag": ["api"], "outboundTag": "api", "type": "field"},
         {"inboundTag": [], "outboundTag": "warp-outbound", "type": "field"},  # tags filled in below
         {"ip": ["geoip:private"], "outboundTag": "blocked", "type": "field"},
         {"protocol": ["bittorrent"], "outboundTag": "blocked", "type": "field"},
     ]},
     "stats": {},
-    "dns": {"servers": ["1.1.1.1"], "queryStrategy": "UseIP"},
+    "dns": {"servers": ["1.1.1.1"], "queryStrategy": "UseIPv4"},
 }
 
 
@@ -258,6 +262,16 @@ def main():
     # WARP routing rule: read-modify-write (fix #4) -- append, never clobber.
     row = cur.execute("SELECT value FROM settings WHERE key='xrayTemplateConfig'").fetchone()
     tmpl = json.loads(row[0]) if row else TEMPLATE
+    # Enforce the fleet's IPv4-only policy when extending an existing template too.
+    for outbound in tmpl["outbounds"]:
+        if outbound.get("protocol") == "freedom":
+            outbound.setdefault("settings", {})["domainStrategy"] = "ForceIPv4"
+            outbound.setdefault("streamSettings", {}).setdefault("sockopt", {})["domainStrategy"] = "ForceIPv4"
+    tmpl.setdefault("dns", {})["queryStrategy"] = "UseIPv4"
+    blocked_tag = next(o["tag"] for o in tmpl["outbounds"] if o.get("protocol") == "blackhole")
+    ipv6_rule = {"ip": ["::/0"], "outboundTag": blocked_tag, "type": "field"}
+    if ipv6_rule not in tmpl["routing"]["rules"]:
+        tmpl["routing"]["rules"].insert(0, ipv6_rule)
     for rule in tmpl["routing"]["rules"]:
         if rule.get("outboundTag") == "warp-outbound":
             for t in warp_tags:
@@ -269,7 +283,8 @@ def main():
         cur.execute("INSERT INTO settings (key, value) VALUES ('xrayTemplateConfig', ?)", (json.dumps(tmpl, ensure_ascii=False),))
     conn.commit()
     conn.close()
-    print("  xrayTemplateConfig written, warp rule tags:", tmpl["routing"]["rules"][1]["inboundTag"])
+    print("  xrayTemplateConfig written, warp rule tags:",
+          next(r["inboundTag"] for r in tmpl["routing"]["rules"] if r.get("outboundTag") == "warp-outbound"))
 
     subprocess.run(["systemctl", "restart", "x-ui"], check=True)
     time.sleep(6)

.claude/skills/edge-node-multi-protocol/scripts/13-singbox-config.py

@@ -52,7 +52,7 @@ for tag, pvar in (("hy2-direct", "PORT_HY2_DIRECT"), ("hy2-warp", "PORT_HY2_WARP
     p = port(pvar)
     if not p:
         continue
-    ib = {"type": "hysteria2", "tag": tag, "listen": "::", "listen_port": p,
+    ib = {"type": "hysteria2", "tag": tag, "listen": "0.0.0.0", "listen_port": p,
           "up_mbps": up, "down_mbps": down,
           "users": [{"name": "node-main", "password": os.environ["NODE_PASSWORD"]}],
           "tls": tls()}
@@ -67,7 +67,7 @@ for tag, pvar in (("tuic-direct", "PORT_TUIC_DIRECT"), ("tuic-warp", "PORT_TUIC_
     if not p:
         continue
     inbounds.append({
-        "type": "tuic", "tag": tag, "listen": "::", "listen_port": p,
+        "type": "tuic", "tag": tag, "listen": "0.0.0.0", "listen_port": p,
         "users": [{"name": "node-main", "uuid": os.environ["XUI_UUID"],
                    "password": os.environ["NODE_PASSWORD"]}],
         "congestion_control": tuic_cc, "auth_timeout": "3s",
@@ -79,7 +79,10 @@ if not inbounds:
 warp_tags = [i["tag"] for i in inbounds if i["tag"].endswith("-warp")]
 direct_tags = [i["tag"] for i in inbounds if i["tag"].endswith("-direct")]
 
-rules = []
+rules = [
+    {"action": "resolve", "strategy": "ipv4_only", "server": "ipv4-dns"},
+    {"ip_cidr": ["::/0"], "action": "reject"},
+]
 if warp_tags:
     rules.append({"inbound": warp_tags, "outbound": "warp"})
 if direct_tags:
@@ -88,6 +91,8 @@ rules.append({"protocol": "bittorrent", "outbound": "block"})
 
 cfg = {
     "log": {"level": "warn", "timestamp": True},
+    "dns": {"servers": [{"type": "udp", "tag": "ipv4-dns", "server": "1.1.1.1",
+                         "server_port": 53}], "strategy": "ipv4_only", "final": "ipv4-dns"},
     "inbounds": inbounds,
     "outbounds": [
         {"type": "direct", "tag": "direct"},

.claude/skills/edge-node-multi-protocol/scripts/config.env.example

@@ -3,7 +3,7 @@
 
 # --- target VPS ---
 SERVER_IP="203.0.113.10"                       # public IPv4
-SERVER_IPV6="2001:db8::10"                      # public IPv6 (optional; leave empty to skip AAAA)
+SERVER_IPV6=""                                  # fleet is IPv4-only; do not create AAAA
 SSH_USER="root"                                 # root, or a sudo user (scripts escalate via sudo)
 SSH_KEY="$HOME/.ssh/your-vps-key.pem"           # private key for the VPS
 TZ="UTC"                                          # server timezone (e.g. UTC, Asia/Shanghai, America/Los_Angeles)
@@ -16,7 +16,7 @@ DOMAIN_ROOT="nodeA.example.com"                  # this node owns *.nodeA.exampl
 # Cloudflare is the default & has a turnkey record-creation script (02-cf-dns.py).
 # Any acme.sh-supported DNS provider works for the wildcard cert — set ACME_DNS_PLUGIN and
 # the matching credential vars below. For A/AAAA records on a non-CF provider, create them
-# yourself (see references/dns-records.md — it's two names, A + AAAA, DNS-only).
+# yourself (see references/dns-records.md — two names with A records, DNS-only).
 DNS_PROVIDER="cloudflare"                         # informational: cloudflare | dnspod | aliyun | route53 | other
 ACME_DNS_PLUGIN="dns_cf"                          # acme.sh plugin: dns_cf | dns_dp | dns_ali | dns_aws | dns_gd | ...
 

AGENTS.md

@@ -20,6 +20,7 @@
 - 通用部署脚本、参考资料与占位交付模板唯一源码在 `.claude/skills/edge-node-multi-protocol/`，Codex 从 `.agents/skills/edge-node-multi-protocol` 相对链接加载。部署／重建／维护 VPS 节点使用此技能；发布 Proxy Station 应用用 `deploy`，生产订阅数据查询与修改用 `update-db`。
 - 真实配置、面板入口、分享链接、二维码、交付文档和各站点脚本工作副本在 `edge-nodes/private/<id>-edge-node-docs/`，全部禁止入 Git 或公开静态托管，也不发送到在线二维码服务。新增配置／产物用 `umask 077`，私有目录用受控备份转交，新克隆不会携带这些文件。
 - 当前舰队为 sg（AWS 新加坡）、la（DMIT 洛杉矶，同时承载 Proxy Station）、rn（RackNerd 洛杉矶，当前工作副本为 `rn2-edge-node-docs/`）、jp（VMISS 东京，裸 nginx）。`rn-edge-node-docs/` 与 `private/archive/` 是历史资料，不作为当前配置来源；原兄弟目录仅保留为迁移前备份，后续在本仓库维护。
+- 舰队自 2026-10-03 统一使用 IPv4：系统接口禁用 IPv6，Xray／sing-box 仅解析 IPv4 并拒绝 IPv6 目标（含 WARP），节点域名不保留 AAAA。重建或扩展线路须保留这些约束，详见 `docs/EDGE-IPV4-ONLY.md`；仅禁用网卡或删除 AAAA 不能阻止 WARP 隧道内的 IPv6 转发。
 - TCP 基础线路由 nginx＋3x-ui/Xray 承载 VMess／Trojan／SS × direct／WARP，QUIC（HY2／TUIC）由 sing-box 独立承载。3x-ui 客户端不能只写投影表，必须保留 `settings.clients`，否则升级迁移会丢失认证。改远端前读取节点交付记录与技能参考，备份受影响配置和数据库，并保留已有证书续期动作。
 - 迁移工程、修改脚本或复制文件不会授权远端部署；节点与应用的部署各自按任务执行。应用运行时仍通过管理 API／Web 导入节点，不自动读取私有目录。TUIC／SOCKS5 交付线路不属于本系统当前支持的导入类型。
 

docs/EDGE-IPV4-ONLY.md

@@ -0,0 +1,28 @@
+# 边缘舰队 IPv4-only
+
+2026-10-03 按用户授权对 SG、LA、RN、JP 四台现役节点统一禁用 IPv6。目标是经任何代理线路访问目标时，直连与 WARP 均只使用 IPv4；IPv6 地址及仅有 AAAA 的目标直接失败，不回退到 IPv6。
+
+## 三层约束
+
+1. 系统：`/etc/sysctl.d/99-z-proxy-station-ipv4-only.conf` 将 `net.ipv6.conf.all.disable_ipv6`、`default.disable_ipv6`、`lo.disable_ipv6` 设为 `1`。`proxy-station-ipv4-only.service` 已启用，在 `network-online.target` 之后、Xray／sing-box／WARP 之前重新应用。检查每个接口，不只检查 `all`；`ip -6 addr` 与 `ip -6 route` 应无地址／路由。
+2. 代理：Xray 的每个 freedom 出站使用 `settings.domainStrategy=ForceIPv4` 与 `streamSettings.sockopt.domainStrategy=ForceIPv4`，内置 DNS 使用 `queryStrategy=UseIPv4`；`::/0` 拒绝规则在 WARP 分流之前。持久配置写在 3x-ui 数据库的 `xrayTemplateConfig`，不能只改生成的 `bin/config.json`。sing-box 在路由开始先 `resolve`（`ipv4_only`），再拒绝 `::/0`，之后才进入原有 direct／WARP 规则；DNS 经 IPv4 UDP 服务器，QUIC 入站监听 `0.0.0.0`。
+3. DNS：节点根域、通配符及其他节点子域不保留 AAAA，A 记录为 DNS-only。私有 `config.env` 的 `SERVER_IPV6` 清空，防止重新创建 AAAA；清空变量不会删除已存在的记录。
+
+WARP 在用户态代理隧道中仍有双栈能力，因此主机没有公网 IPv6 也不能替代代理层限制。Xray 的 `UseIPv4` 允许解析失败后回退；当前策略使用 `ForceIPv4`。依据：[Linux 内核 sysctl](https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html)、[Xray sockopt](https://xtls.github.io/config/transports/sockopt.html)、[sing-box resolve](https://sing-box.sagernet.org/configuration/route/rule_action/#resolve)。
+
+## 维护与回滚
+
+通用 `08-xui-bootstrap.py` 与 `13-singbox-config.py` 已保留代理层防护；前者扩展已有模板时也应用 IPv4-only，后者需要 sing-box 1.12+。新建／重建服务器还须配置上述系统 sysctl 与开机服务，不要只依赖生成器。当前私有脚本工作副本已同步相关修改。
+
+本次每台机器先通过 SQLite backup API 在线备份 3x-ui 数据库，并打包受影响配置、系统网络设置、systemd 单元、nginx、acme.sh 与 WARP 状态。备份在远端 `/root/ipv4-only-backup-<UTC时间>/`，具体路径、Cloudflare 删除前的记录及验收结果在 Git 忽略的 `edge-nodes/private/ipv4-only-20261003/`。不要将这些内容公开托管或入 Git。证书续期动作未修改。
+
+回滚应读取本机的私有维护记录和该服务器快照，仅恢复受影响的 3x-ui 模板、sing-box 配置及 sysctl／开机单元；不要用整个目录快照覆盖后来新增的配置。恢复 IPv6 或 AAAA 须有用户授权。
+
+## 本次验证与边界
+
+- 四台服务器全部接口的 `disable_ipv6=1`，无 IPv6 地址；持久文件与开机服务均已配置。未进行整机重启验收。
+- 服务器侧真实协议客户端验证 33 条线路（SG 8、LA 6、RN 11、JP 8）：IPv4 出口正常，direct 的 `warp=off`、WARP 的 `warp=on`；IPv6 字面地址与仅 IPv6 域名均失败。
+- 从本机经公网验证线路：Trojan／Hysteria2／TUIC／SOCKS5 使用 sing-box，VMess／SS over WS 使用 mihomo。临时客户端只监听本机回环，不修改活动代理配置。具体结果见私有记录。
+- Cloudflare 删除 SG、LA 的 4 条 AAAA；RN、JP 原本无 AAAA。实际 HTTPS Surge 订阅通过官方 CLI 校验。
+
+代理入站使用的 QUIC UDP 已做真实连接验证；未逐条进行被代理 UDP 负载、手机真机或本地直连 IPv6 泄漏验收。这项策略限制服务器代理转发，不改变客户端绕过代理的本地网络行为。当前不需要通过 VPS 厂商面板才能达到代理仅 IPv4 的目标。

edge-nodes/README.md

@@ -34,6 +34,8 @@ edge-nodes/
 
 站点信息是迁移时的工作记录；维护前仍需读取私有交付文档并核对实际机器。`rn-edge-node-docs/` 的旧链接不作为当前 RN 节点导入来源。
 
+2026-10-03 四台现役节点已统一使用 IPv4：系统接口禁用 IPv6，代理层拒绝 IPv6 目标（含 WARP），Cloudflare 不保留节点 AAAA。后续重建与扩展遵守 [IPv4-only 维护约定](../docs/EDGE-IPV4-ONLY.md)；具体备份与验收在各站点的私有 `04-IPv4-only.md`。
+
 ## 日常工作
 
 在仓库根目录启动 Codex／Claude Code。节点部署或维护使用 `edge-node-multi-protocol` 技能，应用发布使用 `deploy`，线上订阅数据使用 `update-db`。技能只维护一份源码，Codex 通过 `.agents/skills/` 相对链接发现。