eric/proxy-station
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 合并边缘节点运维并完善 Surge 配置安全

Browse Source 
迁入通用节点部署工具、离线交付页生成器和共用技能，隔离真实配置与交付产物。统一 Codex 与 Claude Code 开发约定，补充节点迁移与运维文档。

完善 FINAL、策略组引用、输入校验、Surge 字段编码与 AI DNS 例外保护，增加隔离测试和订阅验证工具。

验证：全量类型检查、44 项单测、前端构建、脚本语法、技能入口与凭据隔离检查均通过。
This commit is contained in:
杨建宽
2026-10-03 23:19:59 +08:00
parent 7358008936
commit 5326c572a2
93 changed files with 6780 additions and 320 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
server/assets/surge-template.conf
View File

@@ -8,7 +8,7 @@ all-hybrid = false
udp-priority = false
# Latency Benchmark / 延迟基准测试
internet-test-url = http://connectivitycheck.gstatic.com/generate_204
proxy-test-url = http://captive.apple.com/generate_204
proxy-test-url = http://cp.cloudflare.com/generate_204
test-timeout = 3
# GeoIP Database / GeoIP 数据库
geoip-maxmind-url = https://github.com/Hackl0us/GeoIP2-CN/raw/release/Country.mmdb
@@ -23,10 +23,6 @@ http-listen = 0.0.0.0
socks5-listen = 0.0.0.0
allow-hotspot-access = true
# --- REMOTE CONTROLLER / 远程控制器 ---
external-controller-access = surge@0.0.0.0:6160
http-api = clashconnectrules@0.0.0.0:6166
http-api-tls = true
http-api-web-dashboard = true
# --- COMPATIBILITY / 兼容性 ---
compatibility-mode = 1
# --- NETWORK / 网络 ---
@@ -47,7 +43,7 @@ force-http-engine-hosts = *.ott.cibntv.net, 123.59.31.1, 119.18.193.135, 122.14.
always-real-ip = link-ip.nextdns.io, *.msftconnecttest.com, *.msftncsi.com, *.srv.nintendo.net, *.stun.playstation.net, xbox.*.microsoft.com, *.xboxlive.com, *.logon.battlenet.com.cn, *.logon.battle.net, stun.l.google.com
hijack-dns = 8.8.8.8:53, 8.8.4.4:53
udp-policy-not-supported-behaviour = REJECT
proxy-restricted-to-lan = false
proxy-restricted-to-lan = true
[Proxy]
@@ -113,6 +109,7 @@ Speedtest = select, Mainland, Automatic, AllServer, no-alert=0, hidden=0, includ
[Rule]
# 阻断 STUN，避免未匹配请求落到直连兜底
PROTOCOL,STUN,REJECT
AND,((PROTOCOL,UDP), (DOMAIN-SUFFIX,googlevideo.com)),REJECT-NO-DROP
# >> 规则修正 (Unbreak Rules)
RULE-SET,https://raw.githubusercontent.com/zxfccmm4/Profiles/refs/heads/main/Surge/Ruleset/Unbreak.list,DIRECT
@@ -121,7 +118,7 @@ RULE-SET,https://raw.githubusercontent.com/zxfccmm4/Profiles/refs/heads/main/Sur
DOMAIN-SET,https://ruleset.skk.moe/List/domainset/reject.conf,REJECT
RULE-SET,https://ruleset.skk.moe/List/non_ip/reject-drop.conf,REJECT-DROP
RULE-SET,https://ruleset.skk.moe/List/non_ip/reject.conf,REJECT
RULE-SET,https://ruleset.skk.moe/List/ip/reject.conf,REJECT-DROP
RULE-SET,https://ruleset.skk.moe/List/ip/reject.conf,REJECT-DROP,no-resolve
# >> 隐私保护 (Privacy Protection)
DOMAIN,app-site-association.cdn-apple.com,REJECT
@@ -222,7 +219,6 @@ RULE-SET,https://ruleset.skk.moe/List/non_ip/global_plus.conf,Automatic
RULE-SET,https://ruleset.skk.moe/List/non_ip/global.conf,Automatic
# >> 网络优化与特殊规则 (Network Optimization)
AND,((PROTOCOL,UDP), (DOMAIN-SUFFIX,googlevideo.com)),REJECT-NO-DROP
DOMAIN-SUFFIX,smtp,DIRECT
URL-REGEX,(Subject|HELO|SMTP),DIRECT
@@ -298,7 +294,7 @@ http-request ^https:\/\/github\.com\/ header-replace Accept-Language en-us
http-request ^https:\/\/(raw|gist)\.githubusercontent\.com\/ header-replace Accept-Language en-us
[MITM]
skip-server-cert-verify = true
skip-server-cert-verify = false
tcp-connection = true
h2 = true
hostname = www.google.cn, api.abema.io, *.zhihu.com, -CUSTOMMitM, sub.store