{"id":26,"date":"2026-06-24T16:45:27","date_gmt":"2026-06-24T16:45:27","guid":{"rendered":"https:\/\/jyy7998.tk\/?p=26"},"modified":"2026-09-18T00:57:20","modified_gmt":"2026-09-18T00:57:20","slug":"docker-%e6%90%ad%e5%bb%ba-nginx-proxy-manager-mysql-wordpress-%e6%9c%80%e7%ae%80%e6%95%99%e7%a8%8b","status":"publish","type":"post","link":"https:\/\/wp.jyy7998.tk\/?p=26","title":{"rendered":"Docker \u642d\u5efa Nginx Proxy Manager + MySQL + WordPress \u6700\u7b80\u6559\u7a0b"},"content":{"rendered":"<div class=\"doc\" style=\"--doc-accent:#2c3e50;--doc-accent-soft:#eef0f1\">\n<div class=\"doc-meta\">\n    \ud83d\udcc5 \u6700\u540e\u66f4\u65b0\uff1a2026-09-16 &nbsp;|&nbsp;<br \/>\n    \ud83d\udda5\ufe0f \u5b9e\u6d4b\u73af\u5883\uff1aDebian 13 VPS\uff081 vCPU \/ 1GB \u5185\u5b58\uff09 &nbsp;|&nbsp;<br \/>\n    \ud83c\udff7\ufe0f \u6807\u7b7e\uff1aDocker, NPM, MySQL, WordPress, 3x-ui, Reality, VLESS-WS-TLS, Hysteria2, AimiliVPN\n<\/div>\n<p>\u672c\u6559\u7a0b\u4ece\u96f6\u5728 VPS \u4e0a\u90e8\u7f72\u4e00\u6574\u5957 Docker \u670d\u52a1\u6808\uff0c\u6240\u6709\u547d\u4ee4\u3001JSON \u8f7d\u8377\u3001\u5751\u70b9\u5747\u4e3a<strong>\u5b9e\u6d4b\u901a\u8fc7\u540e<\/strong>\u624d\u5199\u8fdb\u6765\u7684\uff1a<\/p>\n<ul>\n<li><strong>NPM \u4e2d\u6587\u7248<\/strong>\uff08Nginx Proxy Manager\uff09\u2014 \u56fe\u5f62\u5316\u53cd\u5411\u4ee3\u7406 + Let&#8217;s Encrypt \u8bc1\u4e66\u7ba1\u7406<\/li>\n<li><strong>MySQL 5.7<\/strong> \u2014 WordPress \u6570\u636e\u5e93<\/li>\n<li><strong>WordPress<\/strong> \u2014 \u5bf9\u5916\u4f2a\u88c5\u7684\u535a\u5ba2\u7ad9<\/li>\n<li><strong>3x-ui<\/strong>\uff08Xray \u9762\u677f\uff09\u2014 Reality \/ VLESS-WS-TLS \/ Hysteria2 \u4e09\u79cd\u8282\u70b9<\/li>\n<li><strong>AimiliVPN<\/strong>\uff08\u53ef\u9009\uff09\u2014 \u8ba9\u673a\u623f VPS \u4e5f\u80fd\u8bbf\u95ee OpenAI \u7b49\u7ad9\u70b9<\/li>\n<\/ul>\n<div class=\"doc-note doc-note--tip\">\n    \ud83d\udccc <strong>\u76ee\u6807\uff1a\u4e2a\u4eba\u81ea\u7528\u3002<\/strong>\u8bf7\u52ff\u7528\u4e8e\u5546\u4e1a\u552e\u5356\u8282\u70b9\u3002\n<\/div>\n<nav class=\"doc-toc\">\n    <strong>\ud83d\udcd6 \u76ee\u5f55<\/strong><\/p>\n<nav>\n<ul>\n<li><a href=\"#ph\">\u5173\u4e8e\u5360\u4f4d\u7b26\uff08\u7167\u6284\u524d\u5148\u770b\uff09<\/a><\/li>\n<li><a href=\"#arch\">\u67b6\u6784\uff1a\u5148\u7406\u89e3\u8fd9\u4e2a<\/a><\/li>\n<li><a href=\"#ch0\">0. \u524d\u7f6e\u6761\u4ef6<\/a><\/li>\n<li><a href=\"#ch1\">1. \u7cfb\u7edf\u51c6\u5907<\/a><\/li>\n<li><a href=\"#ch2\">2. \u51ed\u636e\u4e0e\u76ee\u5f55<\/a><\/li>\n<li><a href=\"#ch3\">3. Docker \u7f51\u7edc<\/a><\/li>\n<li><a href=\"#ch4\">4. MySQL 5.7<\/a><\/li>\n<li><a href=\"#ch5\">5. NPM\uff08\u53ea\u53d1\u5e03 80\uff09<\/a><\/li>\n<li><a href=\"#ch6\">6. 3x-ui<\/a><\/li>\n<li><a href=\"#ch7\">7. WordPress<\/a><\/li>\n<li><a href=\"#ch8\">8. NPM \u53cd\u4ee3 + \u8bc1\u4e66<\/a><\/li>\n<\/ul>\n<ul>\n<li><a href=\"#ch9\">9. AimiliVPN + \u5206\u6d41<\/a><\/li>\n<li><a href=\"#ch10\">10. \u4e09\u4e2a\u8282\u70b9<\/a><\/li>\n<li><a href=\"#ch11\">11. \u9632\u706b\u5899\uff08\u6700\u6613\u505a\u9519\uff09<\/a><\/li>\n<li><a href=\"#ch12\">12. \u8ba2\u9605<\/a><\/li>\n<li><a href=\"#ch13\">13. AimiliVPN \u9762\u677f\u4e0a\u516c\u7f51<\/a><\/li>\n<li><a href=\"#ch14\">14. \u5ef6\u8fdf\u8c03\u4f18<\/a><\/li>\n<li><a href=\"#ch15\">15. \u9a8c\u8bc1\u6e05\u5355<\/a><\/li>\n<li><a href=\"#ch16\">16. \u8e29\u5751\u901f\u67e5\u8868<\/a><\/li>\n<li><a href=\"#ch17\">17. \u5173\u4e8e CF \u5c0f\u9ec4\u4e91<\/a><\/li>\n<li><a href=\"#ch18\">18. \u8fd0\u7ef4\u5907\u5fd8<\/a><\/li>\n<\/ul>\n<\/nav>\n<\/div>\n<hr>\n<h2 id=\"ph\">\u5173\u4e8e\u5360\u4f4d\u7b26\uff08\u7167\u6284\u524d\u5148\u770b\u8fd9\u6bb5\uff09<\/h2>\n<p>\u672c\u6587\u4e0d\u5305\u542b\u4efb\u4f55\u771f\u5b9e\u57df\u540d\u3001IP\u3001\u8d26\u53f7\u6216\u5bc6\u7801\u3002\u5168\u6587\u7edf\u4e00\u4f7f\u7528\u4e0b\u5217\u5360\u4f4d\u7b26\uff1a<\/p>\n<div class=\"doc-table-wrap\">\n<table class=\"doc-table\">\n<thead>\n<tr>\n<th>\u5360\u4f4d\u7b26<\/th>\n<th>\u542b\u4e49<\/th>\n<th>\u793a\u4f8b\u503c<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>203.0.113.10<\/code><\/td>\n<td>\u670d\u52a1\u5668\u516c\u7f51 IP<\/td>\n<td>RFC 5737 \u6587\u6863\u4e13\u7528\u5730\u5740\uff0c<strong>\u6c38\u8fdc\u4e0d\u8981\u7167\u6284<\/strong><\/td>\n<\/tr>\n<tr>\n<td><code>example.com<\/code><\/td>\n<td>\u4e3b\u57df\u540d\uff08\u535a\u5ba2\u7ad9\uff09<\/td>\n<td>\u4f60\u81ea\u5df1\u7684\u57df\u540d<\/td>\n<\/tr>\n<tr>\n<td><code>panel.example.com<\/code><\/td>\n<td>3x-ui \u9762\u677f\u57df\u540d<\/td>\n<td>\u4f60\u81ea\u5df1\u7684\u57df\u540d<\/td>\n<\/tr>\n<tr>\n<td><code>npm.example.com<\/code><\/td>\n<td>NPM \u7ba1\u7406\u9762\u677f\u57df\u540d<\/td>\n<td>\u4f60\u81ea\u5df1\u7684\u57df\u540d<\/td>\n<\/tr>\n<tr>\n<td><code>\/ws<\/code><\/td>\n<td>VLESS+WS \u7684\u8def\u5f84<\/td>\n<td>\u81ea\u5df1\u5b9a\uff0c<strong>\u522b\u7528\u6709\u610f\u4e49\/\u53ef\u731c\u7684\u8bcd<\/strong><\/td>\n<\/tr>\n<tr>\n<td><code>&lt;\u5f3a\u5bc6\u7801&gt;<\/code><\/td>\n<td>\u6240\u6709\u5bc6\u7801<\/td>\n<td>\u7528\u5bc6\u7801\u7ba1\u7406\u5668\u751f\u6210<\/td>\n<\/tr>\n<tr>\n<td><code>you@example.com<\/code><\/td>\n<td>\u7ba1\u7406\u5458\u90ae\u7bb1<\/td>\n<td>\u8981\u80fd\u6536\u4fe1\uff08Let&#8217;s Encrypt \u7528\uff09<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f <strong>\u52a8\u624b\u524d\u5148\u628a\u5b83\u4eec\u5168\u90e8\u66ff\u6362\u6210\u4f60\u81ea\u5df1\u7684\u503c\u3002<\/strong><br \/>\n    \u4e0b\u9762 <a href=\"#ch2\">\u00a72<\/a> \u4f1a\u628a\u5b83\u4eec\u96c6\u4e2d\u5199\u8fdb <code>.env<\/code>\uff0c<br \/>\n    \u540e\u7eed\u547d\u4ee4\u76f4\u63a5\u5f15\u7528\u53d8\u91cf\uff0c\u5c31\u4e0d\u9700\u8981\u6ee1\u7bc7\u6539\u5b57\u7b26\u4e32\u4e86\u3002\n<\/div>\n<hr>\n<h2 id=\"arch\">\u67b6\u6784\uff08\u5148\u7406\u89e3\u8fd9\u4e2a\uff0c\u540e\u9762\u624d\u4e0d\u4f1a\u7ed5\uff09<\/h2>\n<p>\u6838\u5fc3\u8bbe\u8ba1\u53ea\u6709\u4e00\u53e5\u8bdd\uff1a<strong>\u8ba9 3x-ui \u72ec\u5360 443\uff0c\u975e Reality \u6d41\u91cf fallback \u5230 NPM<\/strong>\u3002<br \/>\n\u8fd9\u6837\u670d\u52a1\u5668\u5bf9\u5916\u770b\u8d77\u6765\u5c31\u662f\u4e00\u4e2a\u6b63\u5e38\u7684\u4e2d\u6587\u535a\u5ba2\u7ad9\uff0c\u800c\u4ee3\u7406\u529f\u80fd\u85cf\u5728\u540c\u4e00\u4e2a\u7aef\u53e3\u91cc\u3002<\/p>\n<pre data-lang=\"\u6d41\u91cf\u8def\u5f84\" class=\"doc-arch\"><code>\u5916\u90e8 443\/tcp   \u2500\u2500\u25ba 3x-ui \u5bb9\u5668 (Xray)\r\n                    \u251c\u2500 Reality \u5ba2\u6237\u7aef\uff08\u8ba4\u8bc1\u901a\u8fc7\uff09\u2500\u2500\u25ba \u8d70\u4ee3\u7406\u51fa\u7f51\r\n                    \u2514\u2500 \u5176\u4ed6 TLS\uff08\u6d4f\u89c8\u5668 \/ \u626b\u63cf\u5668\uff09\u2500\u2500\u25ba fallback \u2500\u2500\u25ba NPM:443 \u2500\u2500\u25ba \u771f\u5b9e\u7f51\u7ad9\r\n\u5916\u90e8 80\/tcp    \u2500\u2500\u25ba NPM \u5bb9\u5668\uff08Let's Encrypt HTTP-01 \u6821\u9a8c + HTTP\u2192HTTPS \u8df3\u8f6c\uff09\r\n\u5916\u90e8 12703\/udp \u2500\u2500\u25ba 3x-ui \u5bb9\u5668\uff08Hysteria2\uff09<\/code><\/pre>\n<p>\u5bb9\u5668\u4e0e\u56fa\u5b9a IP\uff08\u81ea\u5efa bridge \u7f51\u7edc <code>web<\/code> = <code>172.20.0.0\/16<\/code>\uff09\uff1a<\/p>\n<div class=\"doc-table-wrap\">\n<table class=\"doc-table\">\n<thead>\n<tr>\n<th>\u5bb9\u5668<\/th>\n<th>IP<\/th>\n<th>\u7aef\u53e3<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>mysql57<\/code><\/td>\n<td><code>172.20.0.10<\/code><\/td>\n<td>3306\uff08\u4ec5\u5185\u7f51\uff09<\/td>\n<\/tr>\n<tr>\n<td><code>npm<\/code><\/td>\n<td><code>172.20.0.20<\/code><\/td>\n<td><strong>\u53ea\u53d1\u5e03 80<\/strong>\uff1b81 \/ 443 \u4ec5\u5bb9\u5668\u5185<\/td>\n<\/tr>\n<tr>\n<td><code>wordpress<\/code><\/td>\n<td><code>172.20.0.30<\/code><\/td>\n<td>80\uff08\u4ec5\u5185\u7f51\uff09<\/td>\n<\/tr>\n<tr>\n<td><code>3xui<\/code><\/td>\n<td><code>172.20.0.50<\/code><\/td>\n<td>\u53d1\u5e03 <code>443<\/code>\u3001<code>12700-12710<\/code>\u3001<code>12703\/udp<\/code><\/td>\n<\/tr>\n<tr>\n<td><code>aimilivpn<\/code><\/td>\n<td>host \u7f51\u7edc<\/td>\n<td>\u4ee3\u7406 <code>7928<\/code> \/ \u7ba1\u7406\u9875 <code>8787<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<div class=\"doc-note doc-note--tip\">\n    \ud83d\udccc <strong>\u4e3a\u4ec0\u4e48 NPM \u4e0d\u53d1\u5e03 443\uff1a<\/strong>443 \u5df2\u7ecf\u88ab 3x-ui \u5360\u7528\uff0cNPM \u7684 443 \u53ea\u5728\u5bb9\u5668\u5185\u76d1\u542c\uff0c<br \/>\n    \u7531 Xray \u7684 fallback \u8f6c\u53d1\u8fdb\u6765\u3002<br \/>\n    \ud83d\udccc <strong>\u4e3a\u4ec0\u4e48 NPM \u4e0d\u53d1\u5e03 81\uff1a<\/strong>\u7ba1\u7406\u9762\u677f\u6ca1\u5fc5\u8981\u66b4\u9732\u516c\u7f51\uff0c\u8d70 <code>npm.example.com<\/code> \u53cd\u4ee3\u5373\u53ef\u3002\n<\/div>\n<hr>\n<h2 id=\"ch0\">0. \u524d\u7f6e\u6761\u4ef6<\/h2>\n<ul>\n<li>VPS\uff1aDebian 12\/13\uff0c\u5efa\u8bae \u2265 1 vCPU \/ 1GB \u5185\u5b58<\/li>\n<li>\u57df\u540d\u6258\u7ba1\u5728 Cloudflare\uff0c\u5148\u8bbe <strong>\u7070\u4e91\uff08DNS Only\uff09<\/strong>\uff0c\u6307\u5411 VPS IP\uff1a\n<ul>\n<li><code>example.com<\/code>\uff08\u7ad9\u70b9\uff09\u3001<code>panel.example.com<\/code>\uff08\u9762\u677f\uff09\u3001<code>npm.example.com<\/code>\uff08NPM \u9762\u677f\uff09<\/li>\n<\/ul>\n<\/li>\n<li>\u4e91\u5382\u5546\u5b89\u5168\u7ec4\u653e\u884c\uff1aSSH \u7aef\u53e3\u3001<code>80\/tcp<\/code>\u3001<code>443\/tcp<\/code>\u3001<code>12703\/udp<\/code><\/li>\n<\/ul>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f <strong>\u5148\u7070\u4e91\uff0c\u522b\u6025\u7740\u5f00\u5c0f\u9ec4\u4e91\u3002<\/strong>\u539f\u56e0\u89c1\u6587\u672b\u300c<a href=\"#ch17\">CF \u6a59\u4e91<\/a>\u300d\u4e00\u8282\u3002\n<\/div>\n<hr>\n<h2 id=\"ch1\">1. \u7cfb\u7edf\u51c6\u5907<\/h2>\n<pre data-lang=\"bash\"><code>apt update &amp;&amp; apt -y upgrade\r\ntimedatectl set-timezone Etc\/UTC            # \u6362\u6210\u79bb\u4f60\u673a\u5668\u6700\u8fd1\u7684\u65f6\u533a\uff08\u4f8b Asia\/Tokyo\uff09\r\napt -y install curl git python3 net-tools\r\ncurl -fsSL https:\/\/get.docker.com | sh\r\ndocker version --format '{{.Server.Version}}'   # \u671f\u671b 24+<\/code><\/pre>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f <strong>\u4e0d\u8981\u7528\u7b2c\u4e09\u65b9\u4e00\u952e\u811a\u672c<\/strong>\uff08\u5982 <code>kejilion.sh<\/code>\uff09\u2014\u2014\u5b83\u4f1a\u7559\u4e0b<br \/>\n    <code>@reboot iptables-restore<\/code> \u4e4b\u7c7b\u7684\u5b9a\u65f6\u4efb\u52a1\uff0c\u540e\u9762\u4f1a\u628a\u4f60\u7684\u9632\u706b\u5899\u7b56\u7565\u8986\u76d6\u6389<br \/>\n    \uff08<a href=\"#ch11\">\u00a711<\/a> \u4f1a\u8bb2\u600e\u4e48\u6e05\uff09\u3002\n<\/div>\n<hr>\n<h2 id=\"ch2\">2. \u51ed\u636e\u4e0e\u76ee\u5f55<\/h2>\n<pre data-lang=\"bash\"><code>mkdir -p \/root\/vps-stack &amp;&amp; cd \/root\/vps-stack\r\ncat &gt; .env &lt;&lt;'EOF'\r\nSERVER_IP=203.0.113.10\r\nSSH_PORT=22\r\nDOMAIN_MAIN=example.com\r\nDOMAIN_PANEL=panel.example.com\r\nDOMAIN_NPM=npm.example.com\r\nWS_PATH=\/ws\r\nMYSQL_ROOT_PASSWORD=&lt;\u5f3a\u5bc6\u7801&gt;\r\nWP_DB_NAME=wp\r\nWP_DB_USER=wp\r\nWP_DB_PASSWORD=&lt;\u5f3a\u5bc6\u7801&gt;\r\nNPM_ADMIN_EMAIL=you@example.com\r\nNPM_ADMIN_PASSWORD=&lt;\u5f3a\u5bc6\u7801&gt;\r\nXUI_USERNAME=admin\r\nXUI_PASSWORD=&lt;\u5f3a\u5bc6\u7801&gt;\r\nEOF\r\nchmod 600 .env\r\nset -a; . \/root\/vps-stack\/.env; set +a    # \u540e\u7eed\u547d\u4ee4\u76f4\u63a5\u5f15\u7528 $DOMAIN_MAIN \u7b49<\/code><\/pre>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f \u7528\u540c\u4e00\u4e2a\u5f3a\u5bc6\u7801\u4e5f\u884c\uff0c\u4f46 <code>.env<\/code> \u5fc5\u987b <code>chmod 600<\/code>\uff0c<br \/>\n    \u4e14<strong>\u6c38\u8fdc\u4e0d\u8981\u628a\u8fd9\u4e2a\u6587\u4ef6\u63d0\u4ea4\u5230 git \u6216\u8d34\u7ed9\u522b\u4eba<\/strong>\u3002\n<\/div>\n<hr>\n<h2 id=\"ch3\">3. Docker \u7f51\u7edc<\/h2>\n<pre data-lang=\"bash\"><code>docker network create --driver bridge --subnet 172.20.0.0\/16 --gateway 172.20.0.1 web<\/code><\/pre>\n<hr>\n<h2 id=\"ch4\">4. MySQL 5.7<\/h2>\n<pre data-lang=\"bash\"><code>mkdir -p \/home\/mysql\/data\r\ndocker run --name mysql57 --net web --ip 172.20.0.10 \\\r\n  -v \/home\/mysql\/data:\/var\/lib\/mysql \\\r\n  -e MYSQL_ROOT_PASSWORD=\"$MYSQL_ROOT_PASSWORD\" \\\r\n  --restart unless-stopped -d mysql:5.7 \\\r\n  --character-set-server=utf8 --collation-server=utf8_unicode_ci\r\n\r\nsleep 20   # \u7b49\u5b83\u521d\u59cb\u5316\u5b8c\r\ndocker exec mysql57 mysql -uroot -p\"$MYSQL_ROOT_PASSWORD\" -e \"\r\nCREATE DATABASE IF NOT EXISTS wp DEFAULT CHARACTER SET utf8 COLLATE utf8_unicode_ci;\r\nCREATE USER IF NOT EXISTS 'wp'@'%' IDENTIFIED BY '$WP_DB_PASSWORD';\r\nGRANT ALL PRIVILEGES ON wp.* TO 'wp'@'%';\r\nFLUSH PRIVILEGES;\"<\/code><\/pre>\n<div class=\"doc-note doc-note--info\">\n    \ud83d\udccc <code>mysql:5.7<\/code> \u5df2 EOL\uff0c\u4e2a\u4eba\u81ea\u7528\u53ef\u63a5\u53d7\uff1b\u8981\u6362 <code>mysql:8.0<\/code>\uff0c\u4e0a\u9762 SQL \u5b8c\u5168\u517c\u5bb9\u3002\n<\/div>\n<hr>\n<h2 id=\"ch5\">5. NPM\uff08\u4e2d\u6587\u7248\uff0c<strong>\u53ea\u53d1\u5e03 80<\/strong>\uff09<\/h2>\n<pre data-lang=\"bash\"><code>mkdir -p \/home\/npm\/data \/home\/npm\/letsencrypt\r\ndocker run --name npm --net web --ip 172.20.0.20 \\\r\n  -v \/home\/npm\/data:\/data \\\r\n  -v \/home\/npm\/letsencrypt:\/etc\/letsencrypt \\\r\n  -p 80:80 \\\r\n  --restart unless-stopped -d chishin\/nginx-proxy-manager-zh:release<\/code><\/pre>\n<p><strong>\u9996\u6b21\u767b\u5f55\u5e76\u6539\u5bc6\u7801<\/strong>\uff08\u9762\u677f <code>http:\/\/172.20.0.20:81<\/code>\uff0c\u9ed8\u8ba4 <code>admin@example.com<\/code> \/ <code>changeme<\/code>\uff09\uff1a<\/p>\n<pre data-lang=\"bash\"><code># \u53d6 token\r\nTOKEN=$(curl -s -X POST http:\/\/172.20.0.20:81\/api\/tokens \\\r\n  -H 'Content-Type: application\/json' \\\r\n  -d '{\"identity\":\"admin@example.com\",\"secret\":\"changeme\"}' | python3 -c 'import sys,json;print(json.load(sys.stdin)[\"token\"])')\r\necho \"$TOKEN\" &gt; \/root\/vps-stack\/.npm_token\r\n\r\n# \u6539\u5bc6\u7801\uff08body \u5fc5\u987b\u662f\u8fd9\u4e2a\u5f62\u72b6\uff09\r\ncurl -s -X PUT http:\/\/172.20.0.20:81\/api\/users\/1\/auth \\\r\n  -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\/json' \\\r\n  -d \"{\\\"type\\\":\\\"password\\\",\\\"current\\\":\\\"changeme\\\",\\\"secret\\\":\\\"$NPM_ADMIN_PASSWORD\\\"}\"\r\n\r\n# \u6539\u8d44\u6599\uff08\u6ce8\u610f\uff1abody \u53ea\u80fd\u6709 name\/nickname\/email\/roles\uff0c\u5e26 avatar \u4f1a 400\uff09\r\ncurl -s -X PUT http:\/\/172.20.0.20:81\/api\/users\/1 \\\r\n  -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\/json' \\\r\n  -d \"{\\\"name\\\":\\\"Admin\\\",\\\"nickname\\\":\\\"Admin\\\",\\\"email\\\":\\\"$NPM_ADMIN_EMAIL\\\",\\\"roles\\\":[\\\"admin\\\"]}\"<\/code><\/pre>\n<hr>\n<h2 id=\"ch6\">6. 3x-ui<\/h2>\n<pre data-lang=\"bash\"><code>mkdir -p \/home\/3xui\/db \/home\/3xui\/cert\r\ndocker run -d --name 3xui --net web --ip 172.20.0.50 \\\r\n  --restart unless-stopped \\\r\n  -p 443:443 \\\r\n  -p 12700-12710:12700-12710 \\\r\n  -p 12703:12703\/udp \\\r\n  -v \/home\/3xui\/db:\/etc\/x-ui\/ \\\r\n  -v \/home\/3xui\/cert:\/root\/cert\/ \\\r\n  -v \/home\/npm\/letsencrypt:\/npm-certs \\\r\n  -e XRAY_VMESS_AEAD_FORCED=false \\\r\n  ghcr.io\/mhsanaei\/3x-ui:latest<\/code><\/pre>\n<p><strong>\u6539\u9ed8\u8ba4\u51ed\u636e<\/strong>\uff083.8.0 \u6709 CSRF\uff0c\u76f4\u63a5\u6539\u5e93\u6700\u7701\u4e8b\uff09\uff1a<\/p>\n<pre data-lang=\"bash\"><code>docker exec 3xui \/app\/x-ui setting -username \"$XUI_USERNAME\" -password \"$XUI_PASSWORD\"\r\ndocker restart 3xui          # \u6539\u5b8c\u5fc5\u987b\u91cd\u542f\u624d\u751f\u6548<\/code><\/pre>\n<p><strong>\u62ff API token<\/strong>\uff08<strong>\u6ce8\u610f\uff1a\u6bcf\u6b21\u8c03\u7528\u90fd\u4f1a\u4f5c\u5e9f\u4e0a\u4e00\u4e2a<\/strong>\uff09\uff1a<\/p>\n<pre data-lang=\"bash\"><code>docker exec 3xui \/app\/x-ui setting -getApiToken\r\necho '&lt;\u4e0a\u9762\u8f93\u51fa\u7684token&gt;' &gt; \/root\/vps-stack\/.xui_token<\/code><\/pre>\n<p><strong>\u4e24\u4e2a\u6551\u547d\u63a5\u53e3<\/strong>\uff1a<\/p>\n<pre data-lang=\"bash\"><code># \u5168\u91cf API \u89c4\u8303\uff08180+ \u6761\u8def\u7531 + schema\uff09\uff0c\u6bd4\u7ffb\u4e8c\u8fdb\u5236\u5feb\u5f97\u591a\r\ncurl -s -H \"Authorization: Bearer $TOKEN\" http:\/\/172.20.0.50:2053\/panel\/api\/openapi.json\r\n# \u751f\u6210 Reality \u5bc6\u94a5\u5bf9\r\ncurl -s -H \"Authorization: Bearer $TOKEN\" http:\/\/172.20.0.50:2053\/panel\/api\/server\/getNewX25519Cert<\/code><\/pre>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f v3 \u7684\u5ba2\u6237\u7aef\/\u5165\u7ad9\u7ed3\u6784<strong>\u4e0e v2 \u5b8c\u5168\u4e0d\u540c<\/strong>\uff08<code>inbounds<\/code> \/ <code>clients<\/code> \/<br \/>\n    <code>client_inbounds<\/code> \/ <code>hosts<\/code>\uff09\uff0c\u7f51\u4e0a v2 \u7684\u6559\u7a0b\u4e0d\u80fd\u7167\u6284\u3002\n<\/div>\n<hr>\n<h2 id=\"ch7\">7. WordPress<\/h2>\n<p><code>\/home\/wp\/docker-compose.yml<\/code>\uff1a<\/p>\n<pre data-lang=\"yaml\"><code>services:\r\n  wordpress:\r\n    image: wordpress:latest\r\n    container_name: wordpress\r\n    restart: unless-stopped\r\n    environment:\r\n      WORDPRESS_DB_HOST: mysql57:3306\r\n      WORDPRESS_DB_NAME: wp\r\n      WORDPRESS_DB_USER: wp\r\n      WORDPRESS_DB_PASSWORD: &lt;\u5f3a\u5bc6\u7801&gt;\r\n    volumes:\r\n      - \/home\/wordpress\/data:\/var\/www\/html\r\n    networks:\r\n      web:\r\n        ipv4_address: 172.20.0.30\r\nnetworks:\r\n  web:\r\n    external: true<\/code><\/pre>\n<pre data-lang=\"bash\"><code>mkdir -p \/home\/wordpress\/data &amp;&amp; cd \/home\/wp &amp;&amp; docker compose up -d\r\ndocker exec npm sh -c 'curl -s -o \/dev\/null -w \"%{http_code}\\n\" http:\/\/172.20.0.30:80\/'   # \u671f\u671b 200<\/code><\/pre>\n<p>\u6d4f\u89c8\u5668\u6253\u5f00 <code>http:\/\/203.0.113.10\/<\/code> \u8d70\u5b8c\u5b89\u88c5\u5411\u5bfc\u3002<br \/>\n<strong>\u88c5\u5b8c\u540e\u628a\u7ad9\u70b9\u5730\u5740\u6539\u6210 https<\/strong>\uff08\u5426\u5219\u540e\u9762\u53cd\u4ee3\u4f1a\u8df3\u6765\u8df3\u53bb\uff09\uff1a<\/p>\n<pre data-lang=\"bash\"><code>docker exec wordpress wp option update siteurl \"https:\/\/$DOMAIN_MAIN\" --allow-root 2&gt;\/dev\/null \\\r\n || docker exec mysql57 mysql -uroot -p\"$MYSQL_ROOT_PASSWORD\" wp \\\r\n      -e \"UPDATE wp_options SET option_value='https:\/\/$DOMAIN_MAIN' WHERE option_name IN ('siteurl','home');\"<\/code><\/pre>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f <strong>\u987a\u624b\u505a\u4e00\u4ef6\u4e8b\uff1a<\/strong>\u628a WordPress \u7ad9\u70b9\u6807\u9898\/\u526f\u6807\u9898\u6539\u6210\u901a\u7528\u7684\uff08\u6bd4\u5982\u300c\u6211\u7684\u535a\u5ba2\u300d\uff09\uff0c<br \/>\n    \u522b\u7528\u5e26\u4e2a\u4eba\u4fe1\u606f\u7684\u540d\u5b57\u2014\u2014443 \u7aef\u53e3\u5bf9\u5916\u4f2a\u88c5\u7684\u5c31\u662f\u8fd9\u4e2a\u7ad9\uff0c\u6807\u9898\u4f1a\u66b4\u9732\u5728\u63a2\u6d4b\u7ed3\u679c\u91cc\u3002\n<\/div>\n<hr>\n<h2 id=\"ch8\">8. NPM \u53cd\u4ee3 + \u8bc1\u4e66<\/h2>\n<p><strong>\u5148\u7533\u8bf7\u8bc1\u4e66<\/strong>\uff08HTTP-01\uff0c\u8981\u6c42 80 \u7aef\u53e3\u76f4\u8fbe NPM\u3001\u57df\u540d\u662f\u7070\u4e91\uff09\uff1a<\/p>\n<pre data-lang=\"bash\"><code>TOKEN=$(cat \/root\/vps-stack\/.npm_token)\r\nfor D in \"$DOMAIN_MAIN\" \"$DOMAIN_PANEL\" \"$DOMAIN_NPM\"; do\r\n  curl -s -X POST http:\/\/172.20.0.20:81\/api\/nginx\/certificates \\\r\n    -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\/json' \\\r\n    -d \"{\\\"provider\\\":\\\"letsencrypt\\\",\\\"domain_names\\\":[\\\"$D\\\"],\\\"meta\\\":{\\\"letsencrypt_email\\\":\\\"$NPM_ADMIN_EMAIL\\\",\\\"letsencrypt_agree\\\":true,\\\"dns_challenge\\\":false}}\"\r\n  echo\r\ndone\r\n# \u8bb0\u4e0b\u8fd4\u56de\u7684 id\uff08\u672c\u4f8b\u4f9d\u6b21\u662f 1 \/ 2 \/ 3\uff09<\/code><\/pre>\n<p><strong>\u5efa\u4e09\u4e2a\u4ee3\u7406\u4e3b\u673a<\/strong>\uff08JSON \u7528 heredoc \u5199\uff0c<code>$\u53d8\u91cf<\/code> \u4f1a\u88ab shell \u5c55\u5f00\uff09\uff1a<\/p>\n<pre data-lang=\"bash\"><code>TOKEN=$(cat \/root\/vps-stack\/.npm_token)\r\n\r\n# 1) \u4e3b\u7ad9 \u2192 WordPress\uff0c\u5e76\u6302\u4e0a WS \u7684\u81ea\u5b9a\u4e49\u4f4d\u7f6e\r\ncat &gt; \/tmp\/host1.json &lt;&lt;EOF\r\n{\"domain_names\":[\"$DOMAIN_MAIN\"],\"forward_scheme\":\"http\",\"forward_host\":\"172.20.0.30\",\"forward_port\":80,\r\n \"certificate_id\":1,\"ssl_forced\":true,\"block_exploits\":true,\"caching_enabled\":false,\r\n \"allow_websocket_upgrade\":true,\"http2_support\":true,\"advanced_config\":\"\",\r\n \"meta\":{\"letsencrypt_agree\":true,\"dns_challenge\":false},\r\n \"locations\":[{\"path\":\"$WS_PATH\",\"forward_scheme\":\"http\",\"forward_host\":\"172.20.0.50\",\r\n               \"forward_port\":12702,\"advanced_config\":\"\",\"forward_path\":\"\"}]}\r\nEOF\r\ncurl -s -X POST http:\/\/172.20.0.20:81\/api\/nginx\/proxy-hosts \\\r\n  -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\/json' -d @\/tmp\/host1.json\r\n\r\n# 2) 3x-ui \u9762\u677f\r\ncat &gt; \/tmp\/host2.json &lt;&lt;EOF\r\n{\"domain_names\":[\"$DOMAIN_PANEL\"],\"forward_scheme\":\"http\",\"forward_host\":\"172.20.0.50\",\"forward_port\":2053,\r\n \"certificate_id\":2,\"ssl_forced\":true,\"block_exploits\":true,\"allow_websocket_upgrade\":true,\r\n \"meta\":{\"letsencrypt_agree\":true,\"dns_challenge\":false},\"locations\":[]}\r\nEOF\r\ncurl -s -X POST http:\/\/172.20.0.20:81\/api\/nginx\/proxy-hosts \\\r\n  -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\/json' -d @\/tmp\/host2.json\r\n\r\n# 3) NPM \u81ea\u8eab\u9762\u677f\r\ncat &gt; \/tmp\/host3.json &lt;&lt;EOF\r\n{\"domain_names\":[\"$DOMAIN_NPM\"],\"forward_scheme\":\"http\",\"forward_host\":\"172.20.0.20\",\"forward_port\":81,\r\n \"certificate_id\":3,\"ssl_forced\":true,\"block_exploits\":true,\"allow_websocket_upgrade\":true,\r\n \"meta\":{\"letsencrypt_agree\":true,\"dns_challenge\":false},\"locations\":[]}\r\nEOF\r\ncurl -s -X POST http:\/\/172.20.0.20:81\/api\/nginx\/proxy-hosts \\\r\n  -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\/json' -d @\/tmp\/host3.json<\/code><\/pre>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f <strong><code>locations<\/code> \u6570\u7ec4\u662f\u5168\u91cf\u8986\u76d6<\/strong>\uff1a\u4ee5\u540e\u8981\u52a0\/\u6539\u81ea\u5b9a\u4e49\u4f4d\u7f6e\uff0c\u5fc5\u987b\u628a\u5df2\u6709\u7684<br \/>\n    \uff08\u5982 <code>$WS_PATH<\/code>\uff09\u4e00\u8d77\u5e26\u4e0a\uff0c\u5426\u5219\u4f1a\u88ab\u5220\u6389\u3002\u6539\u5df2\u6709\u4e3b\u673a\u7528<br \/>\n    <code>GET<\/code> \u2192 \u6539 \u2192 <code>PUT \/api\/nginx\/proxy-hosts\/{id}<\/code>\u3002\n<\/div>\n<div class=\"doc-note doc-note--ok\">\n    \u2705 \u6b64\u65f6 443 \u8fd8\u6ca1\u901a\uff083x-ui \u91cc\u8fd8\u6ca1\u6709 443 \u5165\u7ad9\uff09\uff0c<strong>\u8fd9\u662f\u6b63\u5e38\u7684<\/strong>\u2014\u2014\u5efa\u5b8c<br \/>\n    <a href=\"#ch10\">\u00a710<\/a> \u5c31\u901a\u4e86\u3002\n<\/div>\n<hr>\n<h2 id=\"ch9\">9. AimiliVPN + \u5206\u6d41 <span class=\"doc-badge doc-badge--opt\">\u53ef\u9009<\/span><\/h2>\n<p>\u7528\u4e8e\u8ba9\u673a\u623f VPS \u4e5f\u80fd\u8bbf\u95ee OpenAI \u7b49\u7ad9\u70b9\u3002<\/p>\n<pre data-lang=\"bash\"><code>mkdir -p \/opt &amp;&amp; cd \/opt\r\ngit clone https:\/\/github.com\/xiaoxinkeji\/aimili-vpngate.git aimilivpn\r\ncd \/opt\/aimilivpn\r\nsed -i 's\/COPY proxy_server.py\/COPY metrics.py proxy_server.py\/' Dockerfile   # \u5173\u952e\u8865\u4e01\r\nmkdir -p \/opt\/aimilivpn\/vpngate_data<\/code><\/pre>\n<p><code>\/opt\/aimilivpn\/docker-compose.yml<\/code>\uff1a<\/p>\n<pre data-lang=\"yaml\"><code>services:\r\n  aimilivpn:\r\n    build: {context: ., args: {IMAGE_VERSION: dev, BUILD_DATE: unknown, GIT_COMMIT: unknown}}\r\n    image: ghcr.io\/xiaoxinkeji\/aimili-vpngate:latest\r\n    container_name: aimilivpn\r\n    restart: unless-stopped\r\n    network_mode: host\r\n    cap_add: [NET_ADMIN, NET_RAW]\r\n    devices: [\"\/dev\/net\/tun:\/dev\/net\/tun\"]\r\n    volumes: [\"\/opt\/aimilivpn\/vpngate_data:\/opt\/aimilivpn\/vpngate_data\"]\r\n    environment:\r\n      - VPNGATE_DATA_DIR=\/opt\/aimilivpn\/vpngate_data\r\n      - LOCAL_PROXY_HOST=172.20.0.1     # host \u7f51\u7edc\u5fc5\u987b\u7ed1 web \u7f51\u6865\u7f51\u5173\uff0c\u5bb9\u5668\u624d\u8fde\u5f97\u4e0a\r\n      - LOCAL_PROXY_PORT=7928\r\n      - UI_HOST=172.20.0.1\r\n      - UI_PORT=8787\r\n      - METRICS_ENABLED=true\r\n      - METRICS_PORT=9798\r\n      - METRICS_REFRESH_INTERVAL=15<\/code><\/pre>\n<pre data-lang=\"bash\"><code>cat &gt; \/etc\/sysctl.d\/99-zz-aimilivpn.conf &lt;&lt;'EOF'\r\nnet.ipv4.ip_forward=1\r\nnet.ipv4.conf.all.rp_filter=2\r\nnet.ipv4.conf.default.rp_filter=2\r\nEOF\r\nsysctl --system\r\n# \u26a0\ufe0f \u6587\u4ef6\u540d\u5fc5\u987b\u5e26 zz- \u524d\u7f00\uff1asysctl.d \u6309\u6587\u4ef6\u540d\u5b57\u5178\u5e8f\u52a0\u8f7d\uff0czz- \u624d\u80fd\u6392\u5728\u522b\u7684\u4f18\u5316\u6587\u4ef6\u4e4b\u540e\u751f\u6548\r\n\r\n# daemon.json \u5fc5\u987b\u300c\u5408\u5e76\u300d\u800c\u4e0d\u662f\u8986\u76d6\r\npython3 - &lt;&lt;'PY'\r\nimport json\r\nfrom pathlib import Path\r\np = Path(\"\/etc\/docker\/daemon.json\"); d = {}\r\nif p.exists():\r\n    try: d = json.loads(p.read_text()) or {}\r\n    except Exception: d = {}\r\nd[\"ip-forward-no-drop\"] = True\r\np.write_text(json.dumps(d, indent=2) + \"\\n\")\r\nPY\r\nsystemctl restart docker\r\n\r\ncd \/opt\/aimilivpn &amp;&amp; docker compose up -d --build<\/code><\/pre>\n<p><strong>\u5728 3x-ui \u91cc\u52a0\u5206\u6d41\u89c4\u5219<\/strong>\uff1a\u51fa\u7ad9\u65b0\u589e\u4e00\u4e2a <code>AIMILI-VPN<\/code>\uff08<code>http<\/code>\uff0c\u6307\u5411<br \/>\n<code>172.20.0.1:7928<\/code>\uff09\uff0crouting \u91cc\u628a <code>openai.com<\/code> \/ <code>chatgpt.com<\/code> \/<br \/>\n<code>oaistatic.com<\/code> \/ <code>oaiusercontent.com<\/code> \/ <code>ai.com<\/code> \u6307\u8fc7\u53bb\uff0c\u5176\u4f59\u8d70 <code>direct<\/code>\u3002<\/p>\n<p><strong>\u9a8c\u8bc1<\/strong>\uff1a<\/p>\n<pre data-lang=\"bash\"><code>docker exec 3xui sh -c 'curl -s -4 --max-time 15 --proxy http:\/\/172.20.0.1:7928 https:\/\/api.ipify.org'\r\n# \u8fd4\u56de VPN \u51fa\u53e3 IP \u5373\u6210\u529f\uff08\u4e0d\u662f\u4f60\u7684\u670d\u52a1\u5668 IP\uff09<\/code><\/pre>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f <strong>\u91cd\u542f\u540e\u8981\u7b49 2~3 \u5206\u949f<\/strong>\uff1a\u514d\u8d39 vpngate \u8282\u70b9\u8981\u5148\u626b\u63cf\u8bd5\u8fde\uff0c\u671f\u95f4 <code>tun0<\/code> \u4e0d\u5b58\u5728\uff0c<br \/>\n    \u4ee3\u7406\u4f1a\u62a5 <code>ERR_ROUTE_DEV_NOT_FOUND<\/code>\u3002<strong>\u8fd9\u662f\u6b63\u5e38\u73b0\u8c61\uff0c\u4e0d\u662f\u6545\u969c\u3002<\/strong><br \/>\n    \u53e6\u5916\u514d\u8d39\u8282\u70b9\u5f88\u4e0d\u7a33\u5b9a\uff0c\u51fa\u53e3 IP \u6bcf\u6b21\u90fd\u53ef\u80fd\u4e0d\u4e00\u6837\uff1b\u5982\u679c\u5728\u9762\u677f\u91cc\u628a\u8def\u7531\u9501\u6210<br \/>\n    \u300c\u56fa\u5b9a\u5730\u533a + \u53ea\u6311\u4f4f\u5b85 IP\u300d\uff0c\u53ef\u7528\u8282\u70b9\u6c60\u4f1a\u5927\u5e45\u6536\u7a84\uff0c\u4e2d\u65ad\u4f1a\u66f4\u9891\u7e41\u3001\u6062\u590d\u66f4\u6162\u3002\n<\/div>\n<hr>\n<h2 id=\"ch10\">10. \u4e09\u4e2a\u8282\u70b9<\/h2>\n<div class=\"doc-note doc-note--info\">\n    \ud83d\udccc \u5efa\u8bae\u76f4\u63a5\u5728\u9762\u677f\u91cc\u5efa\uff08\u5b57\u6bb5\u503c\u7167\u6284\u4e0b\u8868\uff09\u3002Reality \u7684\u5bc6\u94a5\u70b9\u9762\u677f\u4e0a\u7684\u300c\u751f\u6210\u300d\uff0c<br \/>\n    \u6216 <code>GET \/panel\/api\/server\/getNewX25519Cert<\/code>\u3002\n<\/div>\n<h3>10.1 Reality\uff08443\uff0c\u672c\u9879\u76ee\u6700\u5173\u952e\u7684\u4e00\u6b65\uff09<\/h3>\n<div class=\"doc-table-wrap\">\n<table class=\"doc-table\">\n<thead>\n<tr>\n<th>\u5b57\u6bb5<\/th>\n<th>\u503c<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u534f\u8bae \/ \u7aef\u53e3<\/td>\n<td><code>vless<\/code> \/ <strong>443<\/strong><\/td>\n<\/tr>\n<tr>\n<td>\u4f20\u8f93 \/ \u5b89\u5168<\/td>\n<td><code>tcp<\/code> \/ <code>reality<\/code><\/td>\n<\/tr>\n<tr>\n<td><strong>\u76ee\u6807 (target)<\/strong><\/td>\n<td><strong><code>172.20.0.20:443<\/code><\/strong> \u2190 NPM \u5bb9\u5668\uff0c<strong>\u4e0d\u662f<\/strong> <code>www.cloudflare.com:443<\/code><\/td>\n<\/tr>\n<tr>\n<td>SNI \/ serverNames<\/td>\n<td><code>example.com,panel.example.com,npm.example.com<\/code>\uff08\u4f60\u81ea\u5df1\u7684\u4e09\u4e2a\u57df\u540d\uff09<\/td>\n<\/tr>\n<tr>\n<td>Flow<\/td>\n<td><code>xtls-rprx-vision<\/code><\/td>\n<\/tr>\n<tr>\n<td>\u6307\u7eb9<\/td>\n<td><code>chrome<\/code><\/td>\n<\/tr>\n<tr>\n<td>\u516c\u94a5\/\u79c1\u94a5\u3001ShortId<\/td>\n<td>\u70b9\u300c\u751f\u6210\u300d<\/td>\n<\/tr>\n<tr>\n<td>xver<\/td>\n<td><code>0<\/code>\uff08\u4e0d\u7528 PROXY protocol\uff09<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>\u5b9e\u9645\u751f\u6210\u51fa\u7684 <code>streamSettings<\/code>\uff1a<\/p>\n<pre data-lang=\"json\"><code>{\"network\":\"tcp\",\"security\":\"reality\",\"realitySettings\":{\r\n  \"show\":false,\"xver\":0,\r\n  \"target\":\"172.20.0.20:443\",\r\n  \"serverNames\":[\"example.com\",\"panel.example.com\",\"npm.example.com\"],\r\n  \"privateKey\":\"&lt;\u79c1\u94a5&gt;\",\"shortIds\":[\"&lt;shortId&gt;\"],\r\n  \"settings\":{\"publicKey\":\"&lt;\u516c\u94a5&gt;\",\"fingerprint\":\"chrome\",\"serverName\":\"example.com\",\"spiderX\":\"\/\"}}}<\/code><\/pre>\n<div class=\"doc-note doc-note--tip\">\n    \ud83d\udccc v3 \u91cc\u5b57\u6bb5\u540d\u662f <strong><code>target<\/code><\/strong>\uff08<code>dest<\/code> \u53ea\u662f\u517c\u5bb9\u522b\u540d\uff09\u3002<br \/>\n    \ud83d\udccc <code>target<\/code> \u7684\u62e8\u53f7\u662f Xray <strong>\u5185\u90e8\u76f4\u8fde<\/strong>\uff0c\u4e0d\u8d70 outbound \u8def\u7531\uff0c<br \/>\n    \u6240\u4ee5\u6a21\u677f\u91cc <code>direct<\/code> \u51fa\u7ad9\u7684 <code>block geoip:private<\/code> \u4e0d\u4f1a\u963b\u65ad\u5b83\u3002\n<\/div>\n<h3>10.2 VLESS + WS + TLS\uff0812702\uff0c\u7ecf NPM \u7684 <code>$WS_PATH<\/code>\uff09<\/h3>\n<div class=\"doc-table-wrap\">\n<table class=\"doc-table\">\n<thead>\n<tr>\n<th>\u5b57\u6bb5<\/th>\n<th>\u503c<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u534f\u8bae \/ \u7aef\u53e3<\/td>\n<td><code>vless<\/code> \/ <code>12702<\/code><\/td>\n<\/tr>\n<tr>\n<td>\u4f20\u8f93 \/ \u5b89\u5168<\/td>\n<td><code>ws<\/code> \/ <code>none<\/code>\uff08TLS \u7531 NPM \u8d1f\u8d23\uff09<\/td>\n<\/tr>\n<tr>\n<td>\u8def\u5f84<\/td>\n<td><code>\/ws<\/code>\uff08\u81ea\u5df1\u5b9a\uff09<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<pre data-lang=\"json\"><code>{\"network\":\"ws\",\"security\":\"none\",\"wsSettings\":{\"path\":\"\/ws\",\"host\":\"\"}}<\/code><\/pre>\n<p>\u5bf9\u5916\u94fe\u8def\uff1a<\/p>\n<pre data-lang=\"\u94fe\u8def\" class=\"doc-arch\"><code>\u5ba2\u6237\u7aef \u2192 example.com:443 \u2192 Xray(\u975e Reality) \u2192 NPM:443 \u2192 \u81ea\u5b9a\u4e49\u4f4d\u7f6e \/ws \u2192 172.20.0.50:12702<\/code><\/pre>\n<h3>10.3 Hysteria2\uff0812703\/udp\uff0c\u590d\u7528 NPM \u7684\u8bc1\u4e66\uff09<\/h3>\n<div class=\"doc-table-wrap\">\n<table class=\"doc-table\">\n<thead>\n<tr>\n<th>\u5b57\u6bb5<\/th>\n<th>\u503c<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u534f\u8bae \/ \u7aef\u53e3<\/td>\n<td><code>hysteria<\/code> \/ <code>12703<\/code><\/td>\n<\/tr>\n<tr>\n<td>\u7248\u672c \/ UDP \u7a7a\u95f2\u8d85\u65f6<\/td>\n<td><code>2<\/code> \/ <code>60<\/code><\/td>\n<\/tr>\n<tr>\n<td>\u5b89\u5168 \/ SNI \/ ALPN<\/td>\n<td><code>tls<\/code> \/ <code>example.com<\/code> \/ <code>h3<\/code><\/td>\n<\/tr>\n<tr>\n<td>\u8bc1\u4e66<\/td>\n<td><code>\/npm-certs\/live\/npm-N\/fullchain.pem<\/code> + <code>privkey.pem<\/code><\/td>\n<\/tr>\n<tr>\n<td>UDP Mask<\/td>\n<td><strong>\u4e0d\u7528<\/strong>\uff08\u5ba2\u6237\u7aef\u522b\u586b Salamander\uff09<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<pre data-lang=\"json\"><code>{\"network\":\"hysteria\",\"security\":\"tls\",\r\n \"tlsSettings\":{\"serverName\":\"example.com\",\"alpn\":[\"h3\"],\r\n   \"certificates\":[{\"certificateFile\":\"\/npm-certs\/live\/npm-1\/fullchain.pem\",\r\n                    \"keyFile\":\"\/npm-certs\/live\/npm-1\/privkey.pem\"}]},\r\n \"hysteriaSettings\":{\"version\":2,\"udpIdleTimeout\":60}}<\/code><\/pre>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f <strong><code>npm-N<\/code> \u7684\u7f16\u53f7\u4e0d\u8981\u786c\u7f16\u7801<\/strong>\uff0c\u5148\u67e5\uff1a<br \/>\n    <code>docker exec 3xui ls -la \/npm-certs\/live\/<\/code><br \/>\n    \uff08symlink \u6307\u5411 <code>archive\/<\/code>\uff0c\u7eed\u671f\u540e\u8def\u5f84\u4e0d\u53d8\uff0c\u5b89\u5168\u3002\uff09\n<\/div>\n<h3>10.4 \u6539\u5b8c\u91cd\u542f Xray<\/h3>\n<p><strong>\u4e0d\u8981\u624b\u52a8\u8dd1 xray \u4e8c\u8fdb\u5236<\/strong>\uff0c\u5728\u9762\u677f\u70b9\u300c\u91cd\u542f Xray\u300d\uff0c\u6216\uff1a<\/p>\n<pre data-lang=\"bash\"><code>curl -s -X POST -H \"Authorization: Bearer $TOKEN\" http:\/\/172.20.0.50:2053\/panel\/api\/server\/restartXrayService<\/code><\/pre>\n<hr>\n<h2 id=\"ch11\">11. \u9632\u706b\u5899\uff08\u8fd9\u4e00\u6b65\u6700\u5bb9\u6613\u505a\u9519\uff09<\/h2>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f <strong>\u6838\u5fc3\u8ba4\u77e5\uff1a<\/strong>Docker <code>-p<\/code> \u53d1\u5e03\u7684\u7aef\u53e3\u8d70<br \/>\n    <code>nat\/PREROUTING<\/code> DNAT + <code>FORWARD<\/code>\uff0c<br \/>\n    <strong>\u6839\u672c\u4e0d\u7ecf\u8fc7 <code>INPUT<\/code><\/strong>\u3002\u6240\u4ee5\u7f51\u4e0a\u90a3\u4e9b<br \/>\n    <code>iptables -I INPUT --dport 12701 -j ACCEPT<\/code> \u5168\u662f\u65e0\u6548\u7684<br \/>\n    \uff08<code>iptables -L INPUT<\/code> \u80fd\u770b\u5230\u89c4\u5219\uff0c\u5f88\u5bb9\u6613\u8bef\u5224\u6210\u529f\uff09\u3002<\/p>\n<p>    <strong>\u7aef\u53e3\u8bbf\u95ee\u63a7\u5236\u5fc5\u987b\u5199\u5728 <code>DOCKER-USER<\/code> \u94fe\u3002<\/strong>\n<\/div>\n<p><code>\/usr\/local\/sbin\/docker-firewall.sh<\/code>\uff08\u5e42\u7b49\uff0c\u53ef\u91cd\u590d\u6267\u884c\uff09\uff1a<\/p>\n<pre data-lang=\"bash\"><code>#!\/bin\/bash\r\nset -e\r\nIPTABLES=\"\/usr\/sbin\/iptables\"\r\n\r\n# 1) FORWARD \u9ed8\u8ba4\u7b56\u7565 DROP\r\n$IPTABLES -P FORWARD DROP\r\n\r\n# 2) \u5bb9\u5668 \u2192 \u5bbf\u4e3b\u673a\u7684 AimiliVPN \u4ee3\u7406\/\u7ba1\u7406\u9875\uff08\u8fd9\u4e24\u6761\u624d\u8d70 INPUT\uff09\r\nfor P in 7928 8787; do\r\n  $IPTABLES -C INPUT -s 172.20.0.0\/16 -d 172.20.0.1 -p tcp --dport $P -j ACCEPT 2&gt;\/dev\/null || \\\r\n  $IPTABLES -I INPUT 1 -s 172.20.0.0\/16 -d 172.20.0.1 -p tcp --dport $P -j ACCEPT\r\ndone\r\n\r\n# 3) \u72ec\u7acb\u94fe\uff1a\u767d\u540d\u5355\u653e\u884c + \u5176\u4f59\u5168 DROP\uff08\u4e0d\u8981\u7528\"\u679a\u4e3e\u8981 DROP \u7684\u7aef\u53e3\"\uff0c\u5bb9\u6613\u6f0f\uff09\r\n$IPTABLES -N AIMILI-3XUI 2&gt;\/dev\/null || true\r\n$IPTABLES -F AIMILI-3XUI\r\n$IPTABLES -A AIMILI-3XUI -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT\r\n$IPTABLES -A AIMILI-3XUI -d 172.20.0.50 -p tcp --dport 443   -j ACCEPT\r\n$IPTABLES -A AIMILI-3XUI -d 172.20.0.50 -p udp --dport 12703 -j ACCEPT\r\n$IPTABLES -A AIMILI-3XUI -d 172.20.0.50 -j DROP\r\n\r\n# 4) \u6302\u5230 DOCKER-USER \u9996\u4f4d\uff08\u5148\u6e05\u65e7\u8df3\u8f6c\uff0c\u4fdd\u8bc1\u5e42\u7b49\uff09\r\nwhile $IPTABLES -C DOCKER-USER -j AIMILI-3XUI 2&gt;\/dev\/null; do\r\n  $IPTABLES -D DOCKER-USER -j AIMILI-3XUI\r\ndone\r\n$IPTABLES -I DOCKER-USER 1 -j AIMILI-3XUI<\/code><\/pre>\n<p><code>\/etc\/systemd\/system\/docker-firewall.service<\/code>\uff1a<\/p>\n<pre data-lang=\"ini\"><code>[Unit]\r\nDescription=Apply custom Docker firewall rules after Docker starts\r\nRequires=docker.service\r\nAfter=docker.service\r\nPartOf=docker.service\r\n\r\n[Service]\r\nType=oneshot\r\nExecStart=\/usr\/local\/sbin\/docker-firewall.sh\r\nRemainAfterExit=yes\r\n\r\n[Install]\r\nWantedBy=multi-user.target<\/code><\/pre>\n<pre data-lang=\"bash\"><code>chmod 755 \/usr\/local\/sbin\/docker-firewall.sh\r\nsystemctl daemon-reload\r\nsystemctl enable --now docker-firewall.service<\/code><\/pre>\n<p><strong>\u6e05\u7406\u7b2c\u4e09\u65b9\u811a\u672c\u7684\u9057\u7559<\/strong>\uff08<strong>\u5fc5\u505a<\/strong>\uff0c\u5426\u5219\u91cd\u542f\u540e FORWARD \u4f1a\u53d8\u56de ACCEPT\uff09\uff1a<\/p>\n<pre data-lang=\"bash\"><code>crontab -l                                  # \u770b\u770b\u6709\u6ca1\u6709 @reboot iptables-restore\r\ncrontab -l | grep -v iptables-restore | crontab -\r\ngrep -rn \"iptables\" \/etc\/cron.d\/ \/etc\/cron.daily\/ 2&gt;\/dev\/null\r\n# \u987a\u624b\u628a rules.v4 \u7684\u7b56\u7565\u4e5f\u6539\u6210 DROP\uff0c\u4ee5\u9632\u4e07\u4e00\r\nsed -i 's\/^:FORWARD ACCEPT\/:FORWARD DROP\/' \/etc\/iptables\/rules.v4<\/code><\/pre>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f <strong>\u4e0d\u8981\u88c5 <code>iptables-persistent<\/code><\/strong>\uff1a\u5b83\u4f1a\u628a Docker \u7684\u52a8\u6001\u94fe<br \/>\n    \uff08<code>DOCKER<\/code> \/ <code>DOCKER-FORWARD<\/code> \/ nat \u8868 DNAT\uff09\u4e00\u8d77\u4fdd\u5b58\uff0c<br \/>\n    \u91cd\u542f\u540e\u548c Docker \u81ea\u5efa\u89c4\u5219\u6253\u67b6\u3002\u4ea4\u7ed9\u4e0a\u9762\u8fd9\u4e2a systemd \u670d\u52a1\u5728 Docker \u8d77\u6765\u540e\u5e94\u7528\u5373\u53ef\u3002\n<\/div>\n<p><strong>\u9a8c\u8bc1<\/strong>\uff1a<\/p>\n<pre data-lang=\"bash\"><code>iptables -L FORWARD -n | head -1              # policy DROP\r\niptables -L DOCKER-USER -n --line-numbers     # \u7b2c 1 \u6761 AIMILI-3XUI\r\niptables -L AIMILI-3XUI -n --line-numbers     # 443\/tcp + 12703\/udp ACCEPT\uff0c\u5176\u4f59 DROP<\/code><\/pre>\n<hr>\n<h2 id=\"ch12\">12. \u8ba2\u9605 <span class=\"doc-badge doc-badge--opt\">\u53ef\u9009<\/span><\/h2>\n<p>3x-ui \u7684\u8ba2\u9605\u670d\u52a1\u5728\u5bb9\u5668\u5185\u76d1\u542c <code>2096<\/code>\uff0c\u4f46<strong>\u6ca1\u53d1\u5e03\u5230\u5bbf\u4e3b\u673a<\/strong>\uff0c\u6240\u4ee5\u8981\u7ecf NPM \u53cd\u4ee3\u51fa\u53bb\u3002<\/p>\n<h3>12.1 \u5173\u952e\u524d\u63d0\uff1a<code>subId<\/code> \u5168\u5c40\u552f\u4e00<\/h3>\n<p>v3 \u91cc <code>subId<\/code> \u5728\u5ba2\u6237\u7aef\u4e4b\u95f4<strong>\u5fc5\u987b\u552f\u4e00<\/strong>\uff08\u91cd\u590d\u4f1a\u62a5 <code>Duplicate subId<\/code>\uff09\u3002<br \/>\n\u6240\u4ee5\u300c<strong>\u4e00\u4e2a\u8ba2\u9605\u5305\u542b\u591a\u4e2a\u8282\u70b9<\/strong>\u300d\u7684\u6b63\u786e\u505a\u6cd5\u662f\uff1a<strong>\u5efa\u4e00\u4e2a\u5ba2\u6237\u7aef\uff0c\u540c\u65f6\u6302\u5230\u591a\u4e2a\u5165\u7ad9\u4e0a<\/strong>\u3002<\/p>\n<pre data-lang=\"bash\"><code>TOKEN=$(cat \/root\/vps-stack\/.xui_token)\r\n# \u4e00\u4e2a\u5ba2\u6237\u7aef\u6302 3 \u4e2a\u5165\u7ad9\uff1buuid(vless) \u4e0e auth(hysteria) \u670d\u52a1\u7aef\u4f1a\u81ea\u52a8\u751f\u6210\r\ncurl -s -X POST -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\/json' \\\r\n  -d '{\"client\":{\"email\":\"sub-all\",\"subId\":\"&lt;\u4f60\u81ea\u5df1\u751f\u6210\u7684\u968f\u673a\u4e32&gt;\",\"flow\":\"\",\"enable\":true},\r\n       \"inboundIds\":[1,2,3]}' \\\r\n  http:\/\/172.20.0.50:2053\/panel\/api\/clients\/add<\/code><\/pre>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f <code>flow<\/code> \u5fc5\u987b\u7559\u7a7a\uff1a\u7edf\u4e00\u5ba2\u6237\u7aef\u8981\u517c\u5bb9 WS\uff0c\u8bbe\u4e86 <code>xtls-rprx-vision<\/code> \u4f1a\u7834\u574f WS \u90a3\u6761\u3002\n<\/div>\n<h3>12.2 \u6253\u5f00\u8ba2\u9605\u670d\u52a1\u5e76\u8bbe\u7f6e\u8def\u5f84<\/h3>\n<pre data-lang=\"bash\"><code>curl -s -X POST -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\/json' \\\r\n  http:\/\/172.20.0.50:2053\/panel\/api\/setting\/all &gt; \/tmp\/settings.json\r\npython3 - &lt;&lt;PY\r\nimport json, os\r\nd = json.load(open(\"\/tmp\/settings.json\"))[\"obj\"]\r\nd[\"subEnable\"] = True\r\nd[\"subPort\"]   = 2096\r\nd[\"subPath\"]   = \"\/sub\/\"\r\nd[\"subDomain\"] = os.environ[\"DOMAIN_MAIN\"]\r\nd[\"subURI\"]    = \"https:\/\/\" + os.environ[\"DOMAIN_MAIN\"] + \"\/sub\/\"\r\njson.dump(d, open(\"\/tmp\/settings_new.json\",\"w\"), ensure_ascii=False)\r\nPY\r\ncurl -s -X POST -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\/json' \\\r\n  -d @\/tmp\/settings_new.json http:\/\/172.20.0.50:2053\/panel\/api\/setting\/update\r\ndocker restart 3xui        # \u6539 subPath \u540e\u5fc5\u987b\u91cd\u542f\u624d\u4f1a\u751f\u6548<\/code><\/pre>\n<div class=\"doc-note doc-note--info\">\n    \ud83d\udccc <code>setting\/update<\/code> \u8981\u4f20<strong>\u5b8c\u6574\u8bbe\u7f6e\u5bf9\u8c61<\/strong>\uff08<code>setting\/all<\/code> \u8fd4\u56de\u7684<br \/>\n    <code>obj<\/code>\uff0c\u7ea6 150+ \u4e2a\u952e\uff09\u3002<br \/>\n    \ud83d\udccc \u597d\u6d88\u606f\uff1a<code>xrayTemplateConfig<\/code> \u4e0d\u5728 <code>\/all<\/code> \u8fd4\u56de\u91cc\uff0c\u6240\u4ee5\u6574\u4f53\u56de\u5199\u4e0d\u4f1a\u78b0\u5230\u5b83\u3002\n<\/div>\n<h3>12.3 \u8ba9 Reality \/ Hy2 \u5bfc\u51fa IP\uff0cWS \u5bfc\u51fa\u57df\u540d<\/h3>\n<p><code>subDomain<\/code> \u4f1a<strong>\u7edf\u4e00<\/strong>\u628a\u5730\u5740\u6539\u6210\u57df\u540d\u3002\u60f3\u6309\u5165\u7ad9\u5206\u522b\u6307\u5b9a\uff0c\u7528<br \/>\n<code>hosts<\/code> \u8bb0\u5f55\uff08<strong>\u5b83\u4f1a\u8986\u76d6 <code>subDomain<\/code><\/strong>\uff09\uff1a<\/p>\n<pre data-lang=\"bash\"><code># Reality \u2192 IP\r\ncurl -s -X POST -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\/json' \\\r\n  -d \"{\\\"inboundIds\\\":[1],\\\"remark\\\":\\\"reality-ip\\\",\\\"hosts\\\":[\\\"$SERVER_IP\\\"],\\\"port\\\":443,\\\"security\\\":\\\"same\\\",\\\"tags\\\":[\\\"Reality\\\"]}\" \\\r\n  http:\/\/172.20.0.50:2053\/panel\/api\/hosts\/add\r\n# Hysteria2 \u2192 IP\r\ncurl -s -X POST -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\/json' \\\r\n  -d \"{\\\"inboundIds\\\":[3],\\\"remark\\\":\\\"hy2-ip\\\",\\\"hosts\\\":[\\\"$SERVER_IP\\\"],\\\"port\\\":12703,\\\"security\\\":\\\"same\\\",\\\"tags\\\":[\\\"Hysteria2\\\"]}\" \\\r\n  http:\/\/172.20.0.50:2053\/panel\/api\/hosts\/add\r\n# WS \u2192 \u57df\u540d\uff08TLS \u5fc5\u9700\uff0csecurity \u8981\u663e\u5f0f\u5199 tls\uff0c\u56e0\u4e3a\u5165\u7ad9\u672c\u8eab\u662f none\uff09\r\ncurl -s -X POST -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\/json' \\\r\n  -d \"{\\\"inboundIds\\\":[2],\\\"remark\\\":\\\"ws-tls\\\",\\\"hosts\\\":[\\\"$DOMAIN_MAIN\\\"],\\\"port\\\":443,\\\"security\\\":\\\"tls\\\",\r\n       \\\"sni\\\":\\\"$DOMAIN_MAIN\\\",\\\"hostHeader\\\":\\\"$DOMAIN_MAIN\\\",\\\"path\\\":\\\"$WS_PATH\\\",\\\"tags\\\":[\\\"WS\\\"]}\" \\\r\n  http:\/\/172.20.0.50:2053\/panel\/api\/hosts\/add<\/code><\/pre>\n<div class=\"doc-note doc-note--ok\">\n    \u2705 <strong>\u4e3a\u4ec0\u4e48\u503c\u5f97\u8fd9\u4e48\u505a\uff1a<\/strong>Reality \u548c Hy2 \u7528 IP \u5c31<strong>\u5b8c\u5168\u4e0d\u4f9d\u8d56 DNS<\/strong>\u2014\u2014<br \/>\n    \u4ee5\u540e\u5c31\u7b97\u57df\u540d\u5f00\u4e86 CF \u5c0f\u9ec4\u4e91\uff08\u89e3\u6790\u5230 CF IP\uff09\uff0c\u8fd9\u4e24\u4e2a\u8282\u70b9\u7167\u6837\u80fd\u7528\u3002\n<\/div>\n<h3>12.4 \u7528 NPM \u628a 2096 \u66b4\u9732\u51fa\u53bb<\/h3>\n<pre data-lang=\"bash\"><code>TOKEN=$(cat \/root\/vps-stack\/.npm_token)\r\ncurl -s -H \"Authorization: Bearer $TOKEN\" http:\/\/172.20.0.20:81\/api\/nginx\/proxy-hosts\/1 &gt; \/tmp\/h1.json\r\npython3 - &lt;&lt;'PY'\r\nimport json\r\nd = json.load(open(\"\/tmp\/h1.json\"))\r\nd[\"locations\"] = [l for l in d[\"locations\"] if l[\"path\"] != \"\/sub\"]\r\nd[\"locations\"].append({\"path\":\"\/sub\",\"forward_scheme\":\"http\",\"forward_host\":\"172.20.0.50\",\r\n                       \"forward_port\":2096,\"advanced_config\":\"\",\"forward_path\":\"\"})\r\njson.dump(d, open(\"\/tmp\/h1_new.json\",\"w\"), ensure_ascii=False)\r\nPY\r\ncurl -s -X PUT -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\/json' \\\r\n  -d @\/tmp\/h1_new.json http:\/\/172.20.0.20:81\/api\/nginx\/proxy-hosts\/1<\/code><\/pre>\n<p>\u8ba2\u9605\u5730\u5740\u5c31\u662f\uff1a<strong><code>https:\/\/example.com\/sub\/&lt;\u4f60\u7684subId&gt;<\/code><\/strong><\/p>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f \u8ba2\u9605\u670d\u52a1\u4f1a<strong>\u6821\u9a8c Host \u5934<\/strong>\uff0c\u5fc5\u987b\u7528\u57df\u540d\u8bbf\u95ee\uff1b\u7528 IP \u4f1a\u8fd4\u56de <strong>403<\/strong>\u3002\n<\/div>\n<hr>\n<h2 id=\"ch13\">13. \u628a AimiliVPN \u7ba1\u7406\u9875\u653e\u5230\u516c\u7f51 <span class=\"doc-badge doc-badge--opt\">\u53ef\u9009<\/span><\/h2>\n<p>AimiliVPN \u7684\u7ba1\u7406\u9875\uff08<code>172.20.0.1:8787<\/code>\uff09\u9ed8\u8ba4\u53ea\u80fd\u8d70 SSH \u96a7\u9053\u3002\u60f3\u7528\u57df\u540d\u8bbf\u95ee\uff0c<br \/>\n<strong>\u5148\u8981\u7406\u89e3\u8fd9\u4e2a UI \u7684\u8def\u5f84\u5b88\u536b<\/strong>\u2014\u2014\u5b83\u4e0d\u662f\u4e00\u4e2a\u666e\u901a Web \u5e94\u7528\uff1a<\/p>\n<ul>\n<li>\u5b83\u53ea\u670d\u52a1 <code>\/{secret_path}\/<\/code> \u524d\u7f00\u4e0b\u7684\u8bf7\u6c42\uff0c\u5176\u4f59\u4e00\u5f8b <strong>404<\/strong>\uff1b\u8bbf\u95ee <code>\/<\/code> \u4f1a <strong>302<\/strong> \u5230 <code>\/{secret_path}\/<\/code><br \/>\n        \uff08<code>secret_path<\/code> \u662f\u9996\u6b21\u542f\u52a8\u81ea\u52a8\u751f\u6210\u7684\u968f\u673a\u4e32\uff0c\u5b58\u5728 <code>vpngate_data\/ui_auth.json<\/code>\uff09<\/li>\n<li>\u767b\u5f55 cookie \u7684 <code>Path<\/code> \u88ab<strong>\u786c\u7f16\u7801<\/strong>\u6210 <code>\/{secret_path}\/<\/code><\/li>\n<li>\u6240\u6709 POST \u90fd\u6709 CSRF \u6821\u9a8c\uff1a<code>Origin<\/code> \/ <code>Referer<\/code> \u7684 netloc \u5fc5\u987b\u7b49\u4e8e <code>Host<\/code> \u5934<\/li>\n<li>\u524d\u7aef\u6240\u6709\u8bf7\u6c42\u90fd\u662f<strong>\u76f8\u5bf9\u8def\u5f84<\/strong>\uff08<code>fetch(\".\/api\/...\")<\/code>\uff09<\/li>\n<\/ul>\n<div class=\"doc-note doc-note--tip\">\n    \ud83d\udccc <strong>\u6240\u4ee5\u6b63\u786e\u505a\u6cd5\u662f\u8ba9 <code>secret_path<\/code> \u672c\u8eab\u7b49\u4e8e\u5bf9\u5916\u8def\u5f84\u6bb5<\/strong>\uff0c<br \/>\n    \u800c\u4e0d\u662f\u5728 nginx \u91cc\u6539\u5199\u8def\u5f84\uff08\u6539\u5199\u4f1a\u8ba9 cookie <code>Path<\/code> \u5bf9\u4e0d\u4e0a\uff0c\u767b\u5f55\u9759\u9ed8\u5931\u8d25\uff09\u3002\n<\/div>\n<pre data-lang=\"bash\"><code># 1) \u9009\u4e00\u4e2a\u5bf9\u5916\u8def\u5f84\uff0c\u6bd4\u5982 \/vp\uff0c\u7136\u540e\u628a\u5b83\u8bbe\u6210 secret_path\r\n#    \u8be5\u503c\u53ea\u5728\u8fdb\u7a0b\u542f\u52a8\u65f6\u8bfb\u5165\uff0c\u8fd0\u884c\u671f\u6539\u6587\u4ef6\u4f1a\u88ab\u8986\u76d6 \u2192 \u5fc5\u987b\u5148\u505c\u5bb9\u5668\r\ndocker stop aimilivpn\r\npython3 - &lt;&lt;'PY'\r\nimport json\r\np = \"\/opt\/aimilivpn\/vpngate_data\/ui_auth.json\"\r\nd = json.load(open(p))\r\nd[\"secret_path\"] = \"vp\"          # \u53ea\u7528\u5b57\u6bcd\u6570\u5b57\uff0c\u4e14\u522b\u7528\u53ef\u731c\u7684\u8bcd\r\njson.dump(d, open(p, \"w\"), indent=2, ensure_ascii=False)\r\nPY\r\ndocker start aimilivpn           # \u91cd\u542f\u540e\u4ee3\u7406\u8981 2~3 \u5206\u949f\u624d\u6062\u590d\uff0c\u6b63\u5e38\r\n\r\n# 2) \u5728 NPM \u7684\u300c\u9762\u677f\u57df\u540d\u300d\u4e0a\u6302\u4e00\u6761\u81ea\u5b9a\u4e49\u4f4d\u7f6e\r\nTOKEN=$(cat \/root\/vps-stack\/.npm_token)\r\ncurl -s -H \"Authorization: Bearer $TOKEN\" http:\/\/172.20.0.20:81\/api\/nginx\/proxy-hosts\/2 &gt; \/tmp\/h2.json\r\npython3 - &lt;&lt;'PY'\r\nimport json\r\nd = json.load(open(\"\/tmp\/h2.json\"))\r\nd[\"locations\"] = [l for l in d[\"locations\"] if l[\"path\"] != \"\/vp\"]\r\nd[\"locations\"].insert(0, {\"path\":\"\/vp\",\"forward_scheme\":\"http\",\"forward_host\":\"172.20.0.1\",\r\n                          \"forward_port\":8787,\"advanced_config\":\"\",\"forward_path\":\"\"})\r\njson.dump(d, open(\"\/tmp\/h2_new.json\",\"w\"), ensure_ascii=False)\r\nPY\r\ncurl -s -X PUT -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\/json' \\\r\n  -d @\/tmp\/h2_new.json http:\/\/172.20.0.20:81\/api\/nginx\/proxy-hosts\/2<\/code><\/pre>\n<p>\u8bbf\u95ee <code>https:\/\/panel.example.com\/vp\/<\/code> \u5373\u53ef\u3002<\/p>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f <strong><code>proxy_pass<\/code> \u4e0d\u80fd\u5e26 URI \u6bb5<\/strong>\uff08\u8981\u5199\u6210 <code>http:\/\/172.20.0.1:8787<\/code>\uff09\uff0c<br \/>\n    \u5426\u5219\u8def\u5f84\u6539\u5199\u4f1a\u7834\u574f cookie \u4e0e CSRF \u7684\u4e00\u81f4\u6027\u3002NPM \u751f\u6210\u7684\u81ea\u5b9a\u4e49\u4f4d\u7f6e\u5757\u672c\u8eab\u4f1a\u5e26<br \/>\n    <code>proxy_set_header Host $host<\/code>\uff0c\u6240\u4ee5 CSRF \u6821\u9a8c\u80fd\u81ea\u7136\u901a\u8fc7\u3002\n<\/div>\n<div class=\"doc-note doc-note--warn\">\n    \ud83d\udd12 <strong>\u5b89\u5168\u63d0\u9192\uff1a<\/strong>\u8fd9\u4e48\u505a\u7b49\u4e8e\u628a\u7ba1\u7406\u9875\u653e\u5230\u516c\u7f51\uff0c\u800c <code>secret_path<\/code> \u4ece\u968f\u673a\u4e32\u53d8\u6210\u4e86\u53ef\u731c\u7684\u8bcd\u2014\u2014<br \/>\n    <strong>\u5b89\u5168\u6027\u5c31\u53ea\u5269\u8d26\u53f7\u5bc6\u7801\u4e86<\/strong>\u3002\u60f3\u6536\u7d27\u4e8c\u9009\u4e00\uff1a<\/p>\n<ul>\n<li>\u5728 NPM \u8fd9\u6761 location \u4e0a\u52a0 Access List \/ basic auth<\/li>\n<li>\u6216\u7ed9\u8fd9\u4e2a\u9762\u677f\u5355\u72ec\u8bbe\u4e00\u4e2a\u5f3a\u5bc6\u7801\uff08\u522b\u548c\u670d\u52a1\u5668\u4e0a\u5176\u5b83\u670d\u52a1\u5171\u7528\uff09<\/li>\n<\/ul>\n<\/div>\n<p><strong>\u6539\u8fd9\u4e2a\u9762\u677f\u7684\u8d26\u53f7\u5bc6\u7801<\/strong>\u7528\u5b83\u81ea\u5e26\u7684\u63a5\u53e3\uff08\u6539\u5b8c\u7acb\u5373\u751f\u6548\uff0c\u4e0d\u7528\u91cd\u542f\uff09\uff1a<\/p>\n<pre data-lang=\"bash\"><code>B=\"https:\/\/panel.example.com\"; P=\"vp\"\r\ncurl -s -c \/tmp\/cj -X POST -H 'Content-Type: application\/json' \\\r\n  -H \"Origin: $B\" -H \"Referer: $B\/$P\/\" \\\r\n  -d '{\"username\":\"&lt;\u8d26\u53f7&gt;\",\"password\":\"&lt;\u5f3a\u5bc6\u7801&gt;\"}' \"$B\/$P\/api\/login\"\r\ncurl -s -b \/tmp\/cj -X POST -H 'Content-Type: application\/json' \\\r\n  -H \"Origin: $B\" -H \"Referer: $B\/$P\/\" \\\r\n  -d \"{\\\"username\\\":\\\"&lt;\u8d26\u53f7&gt;\\\",\\\"password\\\":\\\"&lt;\u5f3a\u5bc6\u7801&gt;\\\",\\\"port\\\":8787,\\\"secret_path\\\":\\\"$P\\\"}\" \\\r\n  \"$B\/$P\/api\/update_credentials\"<\/code><\/pre>\n<div class=\"doc-note doc-note--info\">\n    \ud83d\udccc \u6ce8\u610f\uff1a\u6539<strong>\u7528\u6237\u540d\u6216\u5bc6\u7801<\/strong>\u4f1a\u6e05\u7a7a\u6240\u6709\u4f1a\u8bdd\uff08\u9700\u91cd\u65b0\u767b\u5f55\uff09\uff0c\u4e0d\u91cd\u542f\u8fdb\u7a0b\uff1b<br \/>\n    \u6539<strong>\u7aef\u53e3\u6216 secret_path<\/strong> \u4f1a\u8ba9\u8fdb\u7a0b\u81ea\u6740\u5e76\u7531 entrypoint \u81ea\u52a8\u91cd\u542f\u3002<br \/>\n    \ud83d\udccc \u53e6\u5916\u5b83\u4f1a\u5728\u6570\u636e\u76ee\u5f55\u5199\u4e00\u4efd <code>CREDENTIALS.txt<\/code>\uff0c\u4f46<strong>\u6bcf\u6b21\u5bb9\u5668\u542f\u52a8\u90fd\u4f1a\u91cd\u65b0\u751f\u6210<\/strong>\uff0c<br \/>\n    \u4e14\u91cc\u9762\u7684\u300c\u5bc6\u7801\u300d\u5b57\u6bb5\u662f\u54c8\u5e0c\u4e0d\u662f\u660e\u6587\u2014\u2014\u522b\u628a\u5b83\u5f53\u5bc6\u7801\u6765\u6e90\uff0c\u771f\u6b63\u7684\u51ed\u636e\u653e\u4f60\u81ea\u5df1\u7684 <code>.env<\/code>\u3002\n<\/div>\n<hr>\n<h2 id=\"ch14\">14. \u5ef6\u8fdf\u8c03\u4f18 <span class=\"doc-badge doc-badge--opt\">\u53ef\u9009<\/span><\/h2>\n<h3>14.1 \u5148\u63a5\u53d7\u4e00\u4e2a\u4e8b\u5b9e\uff1aReality \u4f1a\u6bd4 Hysteria2 \u6162<\/h3>\n<p>\u5ba2\u6237\u7aef\u91cc Reality \u7684\u5ef6\u8fdf\u901a\u5e38\u662f Hysteria2 \u7684 <strong>2 \u500d\u5de6\u53f3<\/strong>\uff0c\u8fd9\u662f<strong>\u534f\u8bae\u8bbe\u8ba1\u5dee\u5f02\uff0c\u4e0d\u662f\u6545\u969c<\/strong>\uff1a<\/p>\n<div class=\"doc-table-wrap\">\n<table class=\"doc-table\">\n<thead>\n<tr>\n<th><\/th>\n<th>Reality<\/th>\n<th>Hysteria2<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u4f20\u8f93<\/td>\n<td>TCP + TLS 1.3<\/td>\n<td>QUIC \/ UDP<\/td>\n<\/tr>\n<tr>\n<td>\u9996\u5b57\u8282\u524d\u5f80\u8fd4<\/td>\n<td><strong>2 \u4e2a RTT<\/strong>\uff08TCP \u63e1\u624b + TLS \u63e1\u624b\uff09<\/td>\n<td><strong>1 \u4e2a RTT<\/strong>\uff08\u4f1a\u8bdd\u590d\u7528\u53ef 0-RTT\uff09<\/td>\n<\/tr>\n<tr>\n<td>\u4e22\u5305\u65f6<\/td>\n<td>\u91cd\u4f20\u3001\u6162\u542f\u52a8\u3001\u961f\u5934\u963b\u585e<\/td>\n<td>Brutal \u62e5\u585e\u63a7\u5236\u5ffd\u7565\u4e22\u5305<\/td>\n<\/tr>\n<tr>\n<td>\u5ba2\u6237\u7aef\u6d4b\u5ef6\u8fdf\u65f6<\/td>\n<td>\u6bcf\u6b21\u63a2\u6d4b\u5e38\u8981\u65b0\u5efa TCP+TLS<\/td>\n<td>\u5e38\u590d\u7528\u5df2\u5efa\u7acb\u7684 QUIC \u8fde\u63a5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>\u6392\u67e5\u65b9\u6cd5\uff1a\u6d4b\u4e00\u4e0b\u5230\u670d\u52a1\u5668\u7684 <code>TCP RTT<\/code> \u548c\u5b8c\u6574 <code>TLS 1.3<\/code> \u63e1\u624b\u8017\u65f6\uff0c<br \/>\n\u518d\u6d4b\u4e00\u4e2a<strong>\u5c31\u8fd1<\/strong>\u76ee\u6807\u505a\u5bf9\u7167\u3002\u5982\u679c\u5c31\u8fd1\u76ee\u6807\u7684 TLS \u63e1\u624b\u4e5f\u662f\u5b83 TCP RTT \u7684 2~3 \u500d\uff0c<br \/>\n\u8bf4\u660e\u662f<strong>\u63a5\u5165\u94fe\u8def<\/strong>\u8ba9\u989d\u5916\u5f80\u8fd4\u53d8\u8d35\uff0c\u4e0d\u662f\u670d\u52a1\u5668\u95ee\u9898\u3002<\/p>\n<h3>14.2 \u4e24\u4e2a\u4f4e\u98ce\u9669\u4f18\u5316\uff08\u90fd\u4e0d\u6539\u67b6\u6784\uff09<\/h3>\n<p><strong>\u2460 \u5173\u6389\u7a7a\u95f2\u540e\u7684\u6162\u542f\u52a8<\/strong>\uff08\u4ee3\u7406\u957f\u8fde\u63a5\u7a7a\u95f2\u518d\u7a81\u53d1\u65f6\uff0cTCP \u4f1a\u9000\u56de\u6162\u542f\u52a8\uff0c\u9996\u5c4f\u660e\u663e\u53d8\u6162\uff09\uff1a<\/p>\n<pre data-lang=\"bash\"><code>cat &gt; \/etc\/sysctl.d\/99-zz-proxy-tuning.conf &lt;&lt;'EOF'\r\n# \u4ee3\u7406\u6808 TCP \u8c03\u4f18\uff1a\u957f\u8fde\u63a5\u7a7a\u95f2\u540e\u4e0d\u9000\u56de\u6162\u542f\u52a8\r\n# \u56de\u6eda\uff1a\u5220\u9664\u672c\u6587\u4ef6\uff0c\u5e76 sysctl -w net.ipv4.tcp_slow_start_after_idle=1\r\nnet.ipv4.tcp_slow_start_after_idle = 0\r\nEOF\r\nsysctl --system\r\nsysctl -n net.ipv4.tcp_slow_start_after_idle      # \u671f\u671b 0<\/code><\/pre>\n<p><strong>\u2461 \u7ed9 Reality \u5165\u7ad9\u5f00 TCP Fast Open<\/strong>\uff08\u91cd\u590d\u8fde\u63a5\u7701\u6389 TCP \u63e1\u624b\u90a3 1 \u4e2a RTT\uff09\uff1a<\/p>\n<pre data-lang=\"bash\"><code># \u5148\u786e\u8ba4\u5185\u6838\u5df2\u5f00\uff1asysctl -n net.ipv4.tcp_fastopen   \u671f\u671b 3\uff081=\u5ba2\u6237\u7aef 2=\u670d\u52a1\u7aef 3=\u90fd\u5f00\uff09\r\n# \u518d\u7ed9\u5165\u7ad9\u52a0 sockopt\uff08\u6574\u5bf9\u8c61\u56de\u5199\uff0c\u4e0d\u80fd\u53ea\u4f20\u90e8\u5206\u5b57\u6bb5\uff09\r\nTOKEN=$(cat \/root\/vps-stack\/.xui_token)\r\ncurl -s -H \"Authorization: Bearer $TOKEN\" http:\/\/172.20.0.50:2053\/panel\/api\/inbounds\/get\/1 &gt; \/tmp\/ib1.json\r\npython3 - &lt;&lt;'PY'\r\nimport json\r\nd = json.load(open(\"\/tmp\/ib1.json\"))[\"obj\"]\r\nd[\"streamSettings\"].setdefault(\"sockopt\", {})[\"tcpFastOpen\"] = True\r\njson.dump(d, open(\"\/tmp\/ib1_new.json\", \"w\"), ensure_ascii=False)\r\nPY\r\ncurl -s -X POST -H \"Authorization: Bearer $TOKEN\" -H 'Content-Type: application\/json' \\\r\n  -d @\/tmp\/ib1_new.json http:\/\/172.20.0.50:2053\/panel\/api\/inbounds\/update\/1<\/code><\/pre>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f <strong>\u670d\u52a1\u5668\u5355\u8fb9\u5f00\u542f\u53ea\u662f\u300c\u5141\u8bb8\u300d\uff0c\u4e0d\u4f1a\u81ea\u52a8\u751f\u6548<\/strong>\u2014\u2014\u5ba2\u6237\u7aef\u4e5f\u8981\u6253\u5f00 TFO<br \/>\n    \uff08\u5ba2\u6237\u7aef\u8f6f\u4ef6\u91cc\u7684\u300cTCP Fast Open\u300d\u5f00\u5173\uff09\u3002\u6ca1\u5f00 TFO \u7684\u5ba2\u6237\u7aef\u884c\u4e3a\u5b8c\u5168\u4e0d\u53d8\uff0c<br \/>\n    \u6240\u4ee5\u8fd9\u4e2a\u6539\u52a8\u5bf9\u73b0\u6709\u5ba2\u6237\u7aef\u662f<strong>\u96f6\u98ce\u9669<\/strong>\u7684\u3002<br \/>\n    \u5c11\u6570\u8fd0\u8425\u5546\u4f1a\u4e22\u5f03\u300c\u5e26\u6570\u636e\u7684 SYN\u300d\uff0c\u5982\u679c\u5ba2\u6237\u7aef\u5f00\u4e86 TFO \u540e\u53cd\u800c\u8fde\u4e0d\u4e0a\uff0c\u4f18\u5148\u6000\u7591\u8fd9\u91cc\uff0c\u76f4\u63a5\u56de\u6eda\u3002\n<\/div>\n<div class=\"doc-note doc-note--ok\">\n    \u2705 <strong>\u8fd9\u4e24\u9879\u90fd\u52a8\u4e0d\u4e86\u300cQUIC \u5c11\u4e00\u4e2a\u5f80\u8fd4\u300d\u7684\u7ed3\u6784\u6027\u4f18\u52bf\u3002<\/strong><br \/>\n    \u5ef6\u8fdf\u654f\u611f\u5c31\u7528 Hysteria2\uff0c\u8981\u4f2a\u88c5\u548c\u6297\u5c01\u9501\u5c31\u7528 Reality\u2014\u2014\u522b\u5f3a\u6c42\u62c9\u5e73\u3002\n<\/div>\n<hr>\n<h2 id=\"ch15\">15. \u9a8c\u8bc1\u6e05\u5355<\/h2>\n<pre data-lang=\"bash\"><code># \u5bb9\u5668\u5168\u5728\r\ndocker ps --format 'table {{.Names}}\\t{{.Status}}'\r\n\r\n# \u51fa\u7ad9\u5206\u6d41\uff08\u8fd4\u56de VPN \u51fa\u53e3 IP\uff0c\u4e0d\u662f\u670d\u52a1\u5668 IP\uff09\r\ndocker exec 3xui sh -c 'curl -s -4 --max-time 15 --proxy http:\/\/172.20.0.1:7928 https:\/\/api.ipify.org'\r\n# \u76f4\u8fde\u51fa\u7f51\uff08\u8fd4\u56de\u670d\u52a1\u5668 IP\uff09\r\ndocker exec 3xui sh -c 'curl -s -4 --max-time 15 https:\/\/api.ipify.org'\r\n\r\n# \u4f2a\u88c5\u662f\u5426\u6b63\u5e38\uff08\u5e94\u62ff\u5230 WordPress \u9996\u9875\uff09\r\ncurl -k --resolve example.com:443:203.0.113.10 https:\/\/example.com\/ | grep -o '&lt;title&gt;[^&lt;]*&lt;\/title&gt;'\r\n\r\n# WS \u94fe\u8def\uff08\u671f\u671b 101\uff09\r\ncurl -k -o \/dev\/null -w '%{http_code}\\n' \\\r\n  -H 'Connection: Upgrade' -H 'Upgrade: websocket' \\\r\n  -H 'Sec-WebSocket-Version: 13' -H 'Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==' \\\r\n  --resolve example.com:443:203.0.113.10 https:\/\/example.com\/ws\r\n\r\n# \u8bc1\u4e66\u76ee\u5f55\u7f16\u53f7\r\ndocker exec 3xui ls -la \/npm-certs\/live\/<\/code><\/pre>\n<div class=\"doc-note doc-note--ok\">\n    \u2705 <strong>\u6700\u7ec8\u9a8c\u6536\uff1a<\/strong><code>reboot<\/code> \u4e4b\u540e\u2014\u2014\u5bb9\u5668\u5168\u81ea\u542f\u3001<code>FORWARD<\/code> \u4ecd DROP\u3001<br \/>\n    \u4e09\u4e2a\u8282\u70b9\u4ecd\u53ef\u8fde\u3001<code>https:\/\/\u4f60\u7684\u57df\u540d<\/code> \u6253\u5f97\u5f00\u7ad9\u70b9\u3002\n<\/div>\n<hr>\n<h2 id=\"ch16\">16. \u8e29\u5751\u901f\u67e5\u8868<\/h2>\n<div class=\"doc-table-wrap\">\n<table class=\"doc-table\">\n<thead>\n<tr>\n<th style=\"width:3em\">#<\/th>\n<th>\u5751<\/th>\n<th>\u89e3\u6cd5<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>1<\/td>\n<td>\u7528 <code>iptables -I INPUT --dport xxx<\/code> \u653e\u884c\u8282\u70b9\u7aef\u53e3<strong>\u65e0\u6548<\/strong><\/td>\n<td>Docker \u53d1\u5e03\u7684\u7aef\u53e3\u8d70 FORWARD\uff0c\u89c4\u5219\u8981\u5199 <strong><code>DOCKER-USER<\/code><\/strong><\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>\u7b2c\u4e09\u65b9\u811a\u672c\u7684 <code>@reboot iptables-restore<\/code> \u628a FORWARD \u6539\u56de ACCEPT<\/td>\n<td><strong>\u5220\u6389\u8be5 crontab<\/strong>\uff0c\u5e76\u4fee\u6b63 <code>rules.v4<\/code><\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td><code>\/etc\/docker\/daemon.json<\/code> \u88ab\u6574\u4f53\u8986\u76d6<\/td>\n<td>\u7528 Python <strong>\u5408\u5e76<\/strong>\u5199\u5165<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td><code>iptables-persistent<\/code> \u4fdd\u5b58\u4e86 Docker \u52a8\u6001\u94fe\u5bfc\u81f4\u91cd\u542f\u51b2\u7a81<\/td>\n<td><strong>\u4e0d\u88c5<\/strong>\uff0c\u4ea4\u7ed9 systemd \u670d\u52a1\u5728 Docker \u4e4b\u540e\u5e94\u7528<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>\u624b\u52a8\u8dd1 xray \u4e8c\u8fdb\u5236\u5bfc\u81f4\u914d\u7f6e\u9519\u4e71<\/td>\n<td>\u53ea\u4ece\u9762\u677f\u300c\u91cd\u542f Xray\u300d<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>Hysteria2 \u8bc1\u4e66\u8def\u5f84\u786c\u7f16\u7801 <code>npm-3<\/code><\/td>\n<td>\u5148 <code>ls \/npm-certs\/live\/<\/code> \u5b9e\u6d4b<\/td>\n<\/tr>\n<tr>\n<td>7<\/td>\n<td><code>mysql:5.7<\/code> \u5df2 EOL<\/td>\n<td>\u4e2a\u4eba\u81ea\u7528\u53ef\u63a5\u53d7\uff0c\u6216\u6362 8.0<\/td>\n<\/tr>\n<tr>\n<td>8<\/td>\n<td>NPM \u9ed8\u8ba4\u5bc6\u7801\u6ca1\u6539<\/td>\n<td>\u9996\u767b\u7acb\u523b\u6539<\/td>\n<\/tr>\n<tr>\n<td>9<\/td>\n<td><code>POST setting\/update<\/code> \u9759\u9ed8\u4e22\u5f03 <code>xrayTemplateConfig<\/code><\/td>\n<td>\u505c\u5bb9\u5668 \u2192 \u76f4\u63a5\u5199 SQLite \u2192 \u542f\u5bb9\u5668<\/td>\n<\/tr>\n<tr>\n<td>10<\/td>\n<td><code>POST clients\/update<\/code> \u7684 <code>allowedIPs<\/code> \u62a5 <code>cannot unmarshal string into []string<\/code><\/td>\n<td>\u4f20<strong>\u6700\u5c0f\u8f7d\u8377<\/strong>\uff08email\/uuid\/flow\/subId\/enable\uff09<\/td>\n<\/tr>\n<tr>\n<td>11<\/td>\n<td><code>subId<\/code> \u91cd\u590d\u62a5 <code>Duplicate subId<\/code><\/td>\n<td>\u4e00\u4e2a\u5ba2\u6237\u7aef\u6302\u591a\u4e2a\u5165\u7ad9\uff0c\u800c\u4e0d\u662f\u591a\u4e2a\u5ba2\u6237\u7aef\u5171\u7528\u4e00\u4e2a subId<\/td>\n<\/tr>\n<tr>\n<td>12<\/td>\n<td>\u6539 <code>subPath<\/code> \u4e0d\u751f\u6548<\/td>\n<td>\u8ba2\u9605\u670d\u52a1\u53ea\u5728\u542f\u52a8\u65f6\u8bfb\u8bbe\u7f6e \u2192 <code>docker restart 3xui<\/code><\/td>\n<\/tr>\n<tr>\n<td>13<\/td>\n<td>\u8ba2\u9605\u94fe\u63a5\u662f\u5185\u7f51\u5730\u5740 <code>172.20.0.50<\/code><\/td>\n<td>\u8bbe <code>subDomain<\/code>\uff0c\u6216\u7528 <code>hosts<\/code> \u6309\u5165\u7ad9\u6307\u5b9a<\/td>\n<\/tr>\n<tr>\n<td>14<\/td>\n<td>\u8ba2\u9605\u7528 IP \u8bbf\u95ee\u8fd4\u56de <strong>403<\/strong><\/td>\n<td>\u5fc5\u987b\u7528\u57df\u540d\uff08Host \u5934\u8981\u7b49\u4e8e <code>subDomain<\/code>\uff09<\/td>\n<\/tr>\n<tr>\n<td>15<\/td>\n<td>NPM \u7684 <code>locations<\/code> \u88ab\u6e05\u7a7a<\/td>\n<td>PUT \u65f6\u8981<strong>\u5e26\u4e0a\u5df2\u6709\u4f4d\u7f6e<\/strong>\uff08\u5168\u91cf\u8986\u76d6\uff09<\/td>\n<\/tr>\n<tr>\n<td>16<\/td>\n<td>\u91cd\u542f\u540e\u4ee3\u7406\u4e0d\u901a\uff0c\u65e5\u5fd7\u62a5 <code>tun0 \u4e0d\u5b58\u5728<\/code><\/td>\n<td>\u7b49 2~3 \u5206\u949f\uff0cAimiliVPN \u5728\u626b vpngate \u8282\u70b9\uff0c<strong>\u6b63\u5e38\u73b0\u8c61<\/strong><\/td>\n<\/tr>\n<tr>\n<td>17<\/td>\n<td>\u7528 IP \u5f53 SNI \u8bbf\u95ee 443 \u5931\u8d25<\/td>\n<td>Reality <strong>\u6b63\u5e38\u884c\u4e3a<\/strong>\uff08IP \u4e0d\u5728 <code>serverNames<\/code>\uff09\uff0c\u4e0d\u662f\u6545\u969c<\/td>\n<\/tr>\n<tr>\n<td>18<\/td>\n<td><code>pkill -f &lt;\u914d\u7f6e\u540d&gt;<\/code> \u628a ssh \u8fdc\u7a0b shell \u4e5f\u6740\u4e86<\/td>\n<td>\u7528 pidfile \u8bb0 PID\uff0c\u6309 PID kill<\/td>\n<\/tr>\n<tr>\n<td>19<\/td>\n<td>\u5bb9\u5668\u5185\u7aef\u53e3\u7528\u5bbf\u4e3b\u673a <code>ss<\/code> \u770b\u4e0d\u5230<\/td>\n<td>\u7528 <code>docker exec &lt;\u5bb9\u5668&gt; netstat -lntp<\/code><\/td>\n<\/tr>\n<tr>\n<td>20<\/td>\n<td>\u81ea\u5b9a\u4e49 sysctl \u4e0d\u751f\u6548<\/td>\n<td><code>sysctl.d<\/code> \u6309\u6587\u4ef6\u540d\u5b57\u5178\u5e8f\u52a0\u8f7d\uff0c\u6587\u4ef6\u540d\u8981\u5e26 <strong><code>zz-<\/code><\/strong> \u524d\u7f00\u624d\u6392\u6700\u540e<\/td>\n<\/tr>\n<tr>\n<td>21<\/td>\n<td>\u6539 AimiliVPN \u7684 <code>secret_path<\/code> \u4e0d\u751f\u6548 \/ \u88ab\u6539\u56de\u53bb<\/td>\n<td>\u8be5\u503c<strong>\u53ea\u5728\u8fdb\u7a0b\u542f\u52a8\u65f6\u8bfb\u5165<\/strong>\uff0c\u5fc5\u987b <code>docker stop<\/code> \u2192 \u6539 JSON \u2192 <code>docker start<\/code><\/td>\n<\/tr>\n<tr>\n<td>22<\/td>\n<td>AimiliVPN \u7ba1\u7406\u9875\u53cd\u4ee3\u540e\u767b\u5f55\u5931\u8d25<\/td>\n<td>\u5b83\u7684 cookie <code>Path<\/code> \u4e0e <code>secret_path<\/code> \u7ed1\u5b9a\uff0c<strong>\u4e0d\u80fd\u7528 nginx \u6539\u5199\u8def\u5f84<\/strong>\uff0c\u8981\u8ba9 <code>secret_path<\/code> \u7b49\u4e8e\u5bf9\u5916\u8def\u5f84<\/td>\n<\/tr>\n<tr>\n<td>23<\/td>\n<td>\u5f00\u4e86 TFO \u5374\u6ca1\u53d8\u5feb<\/td>\n<td>\u670d\u52a1\u5668\u53ea\u662f\u300c\u5141\u8bb8\u300d\uff0c<strong>\u5ba2\u6237\u7aef\u4e5f\u8981\u5f00<\/strong><\/td>\n<\/tr>\n<tr>\n<td>24<\/td>\n<td>\u670d\u52a1\u7aef <code>POST inbounds\/update<\/code> \u540e\u5b57\u6bb5\u4e22\u5931<\/td>\n<td>\u5fc5\u987b<strong>\u6574\u5bf9\u8c61\u56de\u5199<\/strong>\uff08\u5148 GET\uff0c\u6539\u5b8c\u518d POST \u56de\u53bb\uff09<\/td>\n<\/tr>\n<tr>\n<td>25<\/td>\n<td>\u9762\u677f\u91cc\u9501\u4e86\u300c\u56fa\u5b9a\u5730\u533a + \u53ea\u6311\u4f4f\u5b85 IP\u300d\u540e\u5206\u6d41\u9891\u7e41\u65ad<\/td>\n<td>\u514d\u8d39\u8282\u70b9\u6c60\u88ab\u6536\u7a84\uff0c\u628a IP \u7c7b\u578b\u653e\u56de <code>all<\/code> \u4f1a\u660e\u663e\u6539\u5584<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<hr>\n<h2 id=\"ch17\">17. \u5173\u4e8e CF \u5c0f\u9ec4\u4e91\uff08\u6a59\u4e91\uff09<\/h2>\n<p><strong>\u53ef\u4ee5\u5f00\uff0c\u4f46\u53ea\u6709 WS \u90a3\u6761\u8282\u70b9\u4f1a\u53d7\u5f71\u54cd<\/strong>\u2014\u2014\u524d\u63d0\u662f\u4f60\u6309<br \/>\n<a href=\"#ch12\">\u00a712.3<\/a> \u628a Reality \/ Hy2 \u5bfc\u51fa\u6210\u4e86 IP\u3002<\/p>\n<p>\u5f00\u4e4b\u524d\u5fc5\u987b\u786e\u8ba4 3 \u4ef6\u4e8b\uff1a<\/p>\n<div class=\"doc-table-wrap\">\n<table class=\"doc-table\">\n<thead>\n<tr>\n<th>\u68c0\u67e5\u9879<\/th>\n<th>\u4f4d\u7f6e<\/th>\n<th>\u8981\u8bbe\u6210<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>SSL\/TLS \u52a0\u5bc6\u6a21\u5f0f<\/strong><\/td>\n<td><code>SSL\/TLS<\/code> \u2192 <code>Overview<\/code> \u2192 Configure<\/td>\n<td><strong><code>Full<\/code> \u6216 <code>Full (strict)<\/code><\/strong>\uff0c<strong>\u7edd\u4e0d\u80fd <code>Flexible<\/code><\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>Always Use HTTPS<\/strong><\/td>\n<td><code>SSL\/TLS<\/code> \u2192 <code>Edge Certificates<\/code><\/td>\n<td><strong>\u5173\u95ed<\/strong>\uff08\u5426\u5219 LE \u7eed\u671f\u53ef\u80fd\u5931\u8d25\uff09<\/td>\n<\/tr>\n<tr>\n<td><strong>WebSockets<\/strong><\/td>\n<td><code>Network<\/code><\/td>\n<td>\u9ed8\u8ba4\u5168\u5c40\u652f\u6301\uff0c\u901a\u5e38\u6ca1\u6709\u5f00\u5173\uff0c\u770b\u4e0d\u5230\u5c31\u662f\u5f00\u7740<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<div class=\"doc-note doc-note--warn\">\n    \u26a0\ufe0f <strong>\u4e3a\u4ec0\u4e48\u4e0d\u80fd <code>Flexible<\/code>\uff1a<\/strong>NPM \u7684 80 \u7aef\u53e3\u662f <code>301 \u2192 HTTPS<\/code><br \/>\n    \uff08<code>ssl_forced=true<\/code>\uff09\u3002Flexible \u4e0b CF \u7528 HTTP \u56de\u6e90 80 \u2192 \u88ab 301 \u2192 \u518d\u56de\u6e90 \u2192<br \/>\n    <strong>\u65e0\u9650\u91cd\u5b9a\u5411<\/strong>\uff0c\u7ad9\u70b9\u548c\u9762\u677f\u5168\u6302\u3002\n<\/div>\n<hr>\n<h2 id=\"ch18\">18. \u8fd0\u7ef4\u5907\u5fd8<\/h2>\n<ol>\n<li><strong>\u8bc1\u4e66\u7eed\u671f\u540e\u8981\u91cd\u542f Xray<\/strong>\uff1aHysteria2 \u5728\u542f\u52a8\u65f6\u8bfb\u53d6 <code>live\/npm-N\/*.pem<\/code>\u3002<br \/>\n        NPM \u81ea\u52a8\u7eed\u671f\u540e\uff08\u4e00\u822c 90 \u5929\u4e00\u6b21\uff09\uff0c\u6267\u884c <code>docker restart 3xui<\/code> \u6216\u5728\u9762\u677f\u70b9\u300c\u91cd\u542f Xray\u300d\u3002<\/li>\n<li><strong>AimiliVPN \u91cd\u542f\u540e 2~3 \u5206\u949f\u624d\u9996\u8fde\u6210\u529f<\/strong>\uff0c\u514d\u8d39 vpngate \u8282\u70b9\u51fa\u53e3 IP \u6bcf\u6b21\u90fd\u53d8\u3002<\/li>\n<li><strong>\u5185\u5b58<\/strong>\uff1a1GB \u673a\u5668\u8dd1\u8fd9\u5957\u5927\u7ea6\u5269 300~400MB\uff0c\u52a0\u670d\u52a1\u524d\u5148\u770b <code>free -m<\/code>\u3002<\/li>\n<li><strong>\u51ed\u636e\u7ba1\u7406<\/strong>\uff1a\u6240\u6709\u5bc6\u7801\u53ea\u653e <code>\/root\/vps-stack\/.env<\/code>\uff08<code>chmod 600<\/code>\uff09\u3002<br \/>\n        \u5bf9\u5916\u5206\u4eab\u90e8\u7f72\u8bb0\u5f55\u65f6\uff0c\u628a\u57df\u540d\u3001IP\u3001\u8d26\u53f7\u3001\u5bc6\u7801\u3001UUID\u3001Reality \u516c\u79c1\u94a5\u3001shortId\u3001<br \/>\n        Hysteria2 \u5bc6\u7801\u3001subId\u3001\u4ee5\u53ca WS \u8def\u5f84\u5168\u90e8\u66ff\u6362\u6210\u5360\u4f4d\u7b26\u3002<\/li>\n<li><strong>\u7aef\u53e3\u4e0e\u5f52\u5c5e<\/strong>\uff08\u6539\u67b6\u6784\u524d\u5148\u770b\u8fd9\u5f20\u8868\uff0c\u907f\u514d\u8e29\u5230\u5171\u7528\u5173\u7cfb\uff09\uff1a<\/li>\n<\/ol>\n<div class=\"doc-table-wrap\">\n<table class=\"doc-table\">\n<thead>\n<tr>\n<th>\u5bbf\u4e3b\u673a\u7aef\u53e3<\/th>\n<th>\u5f52\u5c5e<\/th>\n<th>\u8bf4\u660e<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>443\/tcp<\/code><\/td>\n<td>3x-ui\uff08Xray\uff09<\/td>\n<td>Reality \u5165\u7ad9\uff1b\u975e Reality \u6d41\u91cf fallback \u5230 NPM \u5bb9\u5668\u5185 443<\/td>\n<\/tr>\n<tr>\n<td><code>80\/tcp<\/code><\/td>\n<td>NPM<\/td>\n<td>Let&#8217;s Encrypt HTTP-01 \u6821\u9a8c + HTTP\u2192HTTPS \u8df3\u8f6c<\/td>\n<\/tr>\n<tr>\n<td><code>81\/tcp<\/code><\/td>\n<td>NPM\uff08<strong>\u4e0d\u53d1\u5e03<\/strong>\uff09<\/td>\n<td>\u7ba1\u7406\u9762\u677f\uff0c\u4ec5\u7ecf\u53cd\u4ee3\u8bbf\u95ee<\/td>\n<\/tr>\n<tr>\n<td><code>12703\/udp<\/code><\/td>\n<td>3x-ui<\/td>\n<td>Hysteria2<\/td>\n<\/tr>\n<tr>\n<td><code>12700-12710\/tcp<\/code><\/td>\n<td>3x-ui<\/td>\n<td>\u4ec5\u53d1\u5e03\uff1b\u9664 443 \u5916\u5168\u90e8\u88ab\u9632\u706b\u5899 DROP<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<div class=\"doc-foot\">\n    \ud83c\udf89 \u90e8\u7f72\u5b8c\u6210\u3002<\/p>\n<p>    443 \u7531 3x-ui \u72ec\u5360\uff0c\u975e Reality \u6d41\u91cf fallback \u5230 NPM\uff0c\u5bf9\u5916\u53ea\u8868\u73b0\u4e3a\u4e00\u4e2a\u666e\u901a\u535a\u5ba2\u7ad9\u3002<br \/>\n    <br \/>\n    \u8282\u70b9\u7aef\u53e3\u8bbf\u95ee\u63a7\u5236\u5199\u5728 <code>DOCKER-USER<\/code> \u94fe\uff0c<code>FORWARD<\/code> \u9ed8\u8ba4 DROP\u3002<br \/>\n    <br \/>\n    \u56db\u4e2a\u5bb9\u5668\u5168\u90e8 <code>unless-stopped<\/code>\uff0c\u91cd\u542f\u540e\u81ea\u52a8\u6062\u590d\u3002<br \/>\n    <br \/>\n    <strong>\u52a8\u624b\u524d\u8bf7\u628a\u6240\u6709\u5360\u4f4d\u7b26\u66ff\u6362\u6210\u4f60\u81ea\u5df1\u7684\u503c\u3002<\/strong>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ud83d\udcc5 \u6700\u540e\u66f4\u65b0\uff1a2026-09-16 &nbsp;|&nbsp; \ud83d\udda5\ufe0f \u5b9e\u6d4b\u73af\u5883\uff1aDebian 13 VPS\uff081 vCPU \/ 1GB \u5185\u5b58\uff09 &nbsp;|&nbsp; \ud83c\udff7\ufe0f \u6807\u7b7e\uff1aDocker, NPM, MySQL, WordPress, 3x-ui, Reality, VLESS-WS-TLS, Hysteria2, AimiliVPN \u672c\u6559\u7a0b\u4ece\u96f6\u5728 VPS \u4e0a\u90e8\u7f72\u4e00\u6574\u5957 Docker \u670d\u52a1 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[38,40,21,20,34,33,39,37,35,36],"class_list":["post-26","post","type-post","status-publish","format-standard","hentry","category-server-ops","tag-3x-ui","tag-aimilivpn","tag-debian","tag-docker","tag-mysql","tag-nginx-proxy-manager","tag-reality","tag-vps","tag-wordpress","tag-reverse-proxy"],"_links":{"self":[{"href":"https:\/\/wp.jyy7998.tk\/index.php?rest_route=\/wp\/v2\/posts\/26","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wp.jyy7998.tk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wp.jyy7998.tk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wp.jyy7998.tk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wp.jyy7998.tk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=26"}],"version-history":[{"count":1,"href":"https:\/\/wp.jyy7998.tk\/index.php?rest_route=\/wp\/v2\/posts\/26\/revisions"}],"predecessor-version":[{"id":109,"href":"https:\/\/wp.jyy7998.tk\/index.php?rest_route=\/wp\/v2\/posts\/26\/revisions\/109"}],"wp:attachment":[{"href":"https:\/\/wp.jyy7998.tk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wp.jyy7998.tk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wp.jyy7998.tk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}