wireguardNode = wireguard,interface-ip=192.168.2.2,interface-ipV6=2402:4e00:1200:ed00:0:9089:6dac:96b6,private-key="qF22B3ezOhWGJA4SHwQSsgMa9d6mPGHyFdZMaDTae2E=",mtu=1280,dns=192.168.2.1,dnsV6=2402:4e00:1200:ed00:0:9089:6dac:96b6,keepalive=45,peers=[{public-key="JFuTIJEcFnt8R04UnAE5o2WfIPJUsumSxsD2ayXzoWY=",preshared-key="yVNv5K05AwVnWaR4OB8BlMX3jJlkS74aKlYC3PD95IE=",reserved=[1,2,3],allowed-ips="0.0.0.0/0",endpoint=192.168.3.17:51820}],udp=true

{"name":"wg","type":"wireguard","server":"162.159.192.1","port":2480,"ip":"172.16.0.2","ipv6":"fd01:5ca1:ab1e:80fa:ab85:6eea:213f:f4a5","public-key":"Cr8hWlKvtDt7nrvf+f0brNQQzabAqrjfBvas9pmowjo=","pre-shared-key":"31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=","private-key":"eCtXsJZ27+4PbhDkHnB923tkUn2Gj59wZw5wFA75MnU=","udp":true,"reserved":[209,98,59],"remote-dns-resolve":true,"dns":["1.1.1.1","8.8.8.8"],"refresh-server-ip-interval":60,"peers":[{"server":"162.159.192.1","port":2480,"public-key":"Cr8hWlKvtDt7nrvf+f0brNQQzabAqrjfBvas9pmowjo=","pre-shared-key":"31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=","allowed-ips":["0.0.0.0/0"],"reserved":[209,98,59]}],"preshared-key":"31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM="}

proxies:
  - name: "wg"
    type: wireguard
    server: 162.159.192.1
    port: 2480
    ip: 172.16.0.2
    ipv6: fd01:5ca1:ab1e:80fa:ab85:6eea:213f:f4a5
    public-key: Cr8hWlKvtDt7nrvf+f0brNQQzabAqrjfBvas9pmowjo=
    pre-shared-key: 31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=
    private-key: eCtXsJZ27+4PbhDkHnB923tkUn2Gj59wZw5wFA75MnU=
    udp: true
    # reserved: "U4An"
    reserved: [209,98,59]
    remote-dns-resolve: true
    dns: [ 1.1.1.1, 8.8.8.8 ]
    refresh-server-ip-interval: 60
    peers:
      - server: 162.159.192.1
        port: 2480
        public-key: Cr8hWlKvtDt7nrvf+f0brNQQzabAqrjfBvas9pmowjo=
        pre-shared-key: 31aIhAPwktDGpH4JDhA8GNvjFXEf/a6+UaQRyOAiyfM=
        allowed-ips: ['0.0.0.0/0']
        reserved: [209,98,59]

services:
  sub-store:
    environment:
      SUB_STORE_MMDB_CRON: 0 15 * * *
      # 注意 不会首次无数据不会自动下载, 会按上面这个定时任务下载
      SUB_STORE_MMDB_COUNTRY_URL: https://github.com/xream/geoip/releases/latest/download/ipinfo.country.mmdb
      SUB_STORE_MMDB_COUNTRY_PATH: /opt/app/data/GeoLite2-Country.mmdb
      SUB_STORE_MMDB_ASN_URL: https://github.com/xream/geoip/releases/latest/download/ipinfo.asn.mmdb
      SUB_STORE_MMDB_ASN_PATH: /opt/app/data/GeoLite2-ASN.mmdb
    volumes:
      - ./data:/opt/app/data

const tls = require("tls");
const crypto = require("crypto");

function getCertificateInfo(host, port = 443) {
  return new Promise((resolve) => {
    const socket = tls.connect(
      {
        host,
        port,
        servername: host,
        rejectUnauthorized: false,
      },
      () => {
        try {
          const cert = socket.getPeerCertificate(true);

          if (!cert || !cert.raw) {
            socket.end();
            return resolve({
              fingerprint: "",
              publicKeySha256: "",
            });
          }

          const x509 = new crypto.X509Certificate(cert.raw);

          // SHA256 证书指纹
          const fingerprint = cert.fingerprint256 || "";

          // SHA256 公钥（SPKI）
          const publicKeyDer = x509.publicKey.export({
            type: "spki",
            format: "der",
          });

          const publicKeySha256 = crypto
            .createHash("sha256")
            .update(publicKeyDer)
            .digest("base64");

          socket.end();

          resolve({
            fingerprint,
            publicKeySha256,
          });
        } catch {
          socket.end();
          resolve({
            fingerprint: "",
            publicKeySha256: "",
          });
        }
      }
    );

    socket.on("error", () => {
      resolve({
        fingerprint: "",
        publicKeySha256: "",
      });
    });
  });
}

async function operator(proxies, targetPlatform, context) {
  console.log(`[证书] INFO: 开始处理 ${proxies.length} 个节点`);

  for await (const proxy of proxies) {
    const host = proxy.sni || proxy.server;

    if (!host || ProxyUtils.isIP(host)) {
      console.log(
        `[证书] WARN: [${proxy.name}] 跳过，目标为 IP 或为空 (${host || "-"})`
      );
      continue;
    }

    console.log(
      `[证书] INFO: [${proxy.name}] 正在获取 ${host} 的证书信息`
    );

    const cert = await getCertificateInfo(host);

    proxy.fingerprint = cert.fingerprint;

    if (cert.publicKeySha256) {
      proxy._certificate_public_key_sha256 = [cert.publicKeySha256];
    }

    if (cert.fingerprint) {
      console.log(
        `[证书] LOG: [${proxy.name}] fingerprint=${cert.fingerprint}, public_key_sha256=${cert.publicKeySha256}`
      );
    } else {
      console.log(`[证书] WARN: [${proxy.name}] 获取证书失败`);
    }
  }

  console.log(`[证书] INFO: 全部节点处理完成`);

  return proxies;
}

config dhcp 'lan
  ...
  option ra 'relay'
  option dhcpv6 'relay'
  option ndp 'relay'
  option ndproxy_routing '0
config dhcp 'wan'
  ...
  option ra 'relay'
  option dhcpv6 'relay'
  option ndp 'relay'
  option master '1'
  option ndproxy_routing '0'

if [ "$ACTION" = "ifup" -a "$INTERFACE" = "wan6"  ]; then
        ip -6 route add `ip -6 route show default | sed -n -e 's/default from //' -e 's/ via .*$//g' -e '/64$/p'` dev br-lan metric 128 #根据默认路由获取ipv6网段前缀，添加指向br-lan，metric（跃点数）128比原来256小，表示优先级更高
        logger -t IPV6 "Route resetting for $INTERFACE up" #输出log日志
fi

重启会丢失, 可以把脚本放在 /data 里, 启动逻辑里加入复制+权限等逻辑
比如你可以简单点, 脚本放在 `/data/auto_ssh/99-v6 /etc/hotplug.d/iface/99-v6`
在 `/data/auto_ssh/auto_ssh.sh` 里加入
```
cp /data/auto_ssh/99-v6 /etc/hotplug.d/iface/99-v6
chmod +x /etc/hotplug.d/iface/99-v6
```

PeaNUT:
  description: PVE
  icon: https://raw.githubusercontent.com/Brandawg93/PeaNUT/main/src/app/icon.svg
  href: http://10.0.0.2:55518
  server: my-docker
  container: peanut
  showStats: true
  # widget:
  #     type: peanut
  #     url: http://10.0.0.2:55518
  #     key: ups
  widget:
      type: customapi
      url: http://10.0.0.2:55518/api/v1/devices/ups
      mappings:
          - field: battery.charge
            label: Battery Charge
            format: percent
          - field: battery.runtime
            label: Battery Runtime
            format: text
          - field: ups.load
            label: UPS Load
            format: percent
          - field: ups.status
            label: UPS Status
            format: text
            remap:
              - value: OL
                to: Online
              - value: OB
                to: On Battery
              - value: LB
                to: Low Battery
              - any: true
                to: Unknown

mihomo:
  icon: https://github.com/MetaCubeX/mihomo/raw/Alpha/Meta.png
  # description: desc
  href: http://10.0.0.2:55527/ui
  widget:
    type: customapi
    url: http://10.0.0.2:55527/connections
    refreshInterval: 5000 # optional - in milliseconds, defaults to 10s
    method: GET
    headers:
      Authorization: Bearer YOUR_PASSWORD
    mappings:
      - field: connections
        label: Active
        format: size
      - field: memory
        label: Memory
        format: number
        scale: 0.000001
        suffix: MB
      - field: uploadTotal
        label: ↑
        format: number
        scale: 0.000001
        suffix: MB
      - field: downloadTotal
        label: ↓
        format: number
        scale: 0.000001
        suffix: MB

const server = 'https://223.6.6.6/dns-query'; // DoH 阿里和腾讯的可能会触发限速 可以换别的试试
const edns = [{ name: '联通', ip: '119.36.124.169' }, { name: '电信', ip: '116.207.181.162' }, { name: '移动', ip: '111.47.229.151' }]; // 不同运营商/地区的 IP, 作为 EDNS Client Subnet (ECS)
const type = 'A'; // A 或 AAAA

if (!ProxyUtils.isIP($server.server)) {
    const cache = scriptResourceCache;
    const resolve = async (url, domain, type, { name, ip }) => {
        const id = `${url}:${domain}:${type}:${name}:${ip}`;
        const cached = cache.get(id);
        // 使用缓存
        if (cached) return cached;
        const res = await ProxyUtils.doh({
            url,
            domain,
            type,
            edns: ip,
        });
        const { answers } = res;
        if (!Array.isArray(answers) || answers.length === 0) {
            throw new Error('No answers');
        }
        let result = answers
            .filter((i) => i?.type === type)
            .map((i) => i?.data)
            .filter((i) => i);
        if (result.length === 0) {
            throw new Error('No answers');
        }
        result = [...new Set(result.flat())];
        const data = {
          ip,
          name,
          result,
        }
        cache.set(id, data);
        return data;
    };

    $server._domain = $server.server
    $server._resolved_ips = await Promise.all(
        edns.map(({ip, name}) => resolve(server, $server.server, type, { ip, name })),
    );
}

function operator(proxies = []) {
  const list = []
  proxies.map((p = {}) => {
    let ips = p._resolved_ips
    if (Array.isArray(ips) && ips.length > 0) {
      ips.map(({ name, ip, result }) => {
        result.map((server, index) => {
          list.push({
            ...p,
            name: `${name} ${index + 1} - ${p.name}`,
            server,
          })
        })
      })
      // 取消下面几行的注释, 可以添加一个原始域名的节点
      // list.push({
      //   ...p,
      //   name: `原始 - ${p.name}`,
      //   server: p._domain,
      // })
    } else {
      list.push(p)
    }
  })
  return list
}

function operator(proxies = []) {
  const list = []
  proxies.map((p = {}) => {
    let ips = p._resolved_ips
    if (Array.isArray(ips) && ips.length > 0) {
      ips.map((server, index) => {
        list.push({
          ...p,
          name: `${p.name}${index + 1}`,
          server,
        })
      })
      // 取消下面几行的注释, 可以添加一个原始域名的节点
      // list.push({
      //   ...p,
      //   name: `原始 - ${p.name}`,
      //   server: p._domain,
      // })
    } else {
      list.push(p)
    }
  })
  return list
}

自签证书与配置文件参考:

openssl req -x509 -nodes -newkey ec:<(openssl ecparam -name prime256v1) -keyout /etc/mihomo/server.key -out /etc/mihomo/server.crt -subj "/CN=bing.com" -days 36500

配置文件

mixed-port: 65222 # HTTP(S) 和 SOCKS 代理混合端口
tcp-concurrent: true # TCP 并发连接所有 IP, 将使用最快握手的 TCP
allow-lan: false # 允许局域网连接
ipv6: true # 开启 IPv6 总开关，关闭阻断所有 IPv6 链接和屏蔽 DNS 请求 AAAA 记录
log-level: info # 日志等级 silent/error/warning/info/debug

rules:
  - MATCH,DIRECT

listeners:
  - name: anytls-in
    type: anytls
    port: 443
    listen: "::"
    users:
      974fdc85: 0cdfe9f1b663
    certificate: ./server.crt
    private-key: ./server.key
    # padding-scheme: "" # https://github.com/anytls/anytls-go/blob/main/docs/protocol.md#cmdupdatepaddingscheme

{
  log {
    output stdout
    format console
    level INFO
  }

  servers :443 {
    listener_wrappers {
      layer4 {
        @anytls tls sni a.foo.com
        route @anytls {
          tls
          proxy tcp/127.0.0.1:23556
        }
      }
      tls
    }
  }
}

# this block makes Caddy obtain a wildcard TLS certificate
*.foo.com {
  tls {
    issuer acme {
      email admin@foo.com
      dir https://acme.zerossl.com/v2/DV90
      dns cloudflare {env.CLOUDFLARE_API_TOKEN}
    }
    issuer acme {
      dir https://acme-v02.api.letsencrypt.org/directory
      dns cloudflare {env.CLOUDFLARE_API_TOKEN}
    }
  }
  respond "Hello World!" 200
}

proxies:
  - name: "direct"
    type: direct
    udp: true
    ip-version: ipv4-prefer
listeners:
  - name: anytls-in
    type: anytls
    proxy: direct
    port: 23556
    listen: "127.0.0.1"
    users:
      root: "xYbpwdF9vIELWoLmdC"
    certificate: ""
    private-key: ""
    allow-insecure: true
    # https://github.com/anytls/anytls-go/blob/main/docs/protocol.md#cmdupdatepaddingscheme
    padding-scheme: |-
      stop=10
      0=38-72
      1=180-420,520-960
      2=1050-1320,c,260-620,c,760-1240,c,260-680,c,900-1350
      3=90-220,780-1180
      4=700-1240,c,220-520,c,900-1360
      5=160-420
      6=760-1280
      7=220-640
      8=900-1360
      9=180-480

#! /usr/bin/env bash

# 检查 Surge 连接状态的函数
check_surge_status() {
    # 获取 Surge 的网络服务名称
    local surge_service=$(networksetup -listallnetworkservices| grep Surge)
    
    # 获取 Surge 的网络服务状态
    local surge_status=$(networksetup -showpppoestatus "$surge_service")
    
    if [ "$surge_status" = "connected" ]; then
        echo 0
    else
        echo 1
    fi
}

if [ $(check_surge_status) -eq 0 ]; then
    echo "✅ Surge 已连接"
else
    # echo "❌ Surge 未连接"
    echo "🔄 尝试重载配置"
    /Applications/Surge.app/Contents/Applications/surge-cli reload
    # echo "重载配置完成"
    sleep 2
    if [ $(check_surge_status) -eq 0 ]; then
        echo "✅ Surge 已连接"
    else
        # echo "❌ Surge 未连接"
        echo "🔄 尝试重启 Surge"
        /Applications/Surge.app/Contents/Applications/surge-cli stop
        open -a Surge
        osascript -e 'tell application "Surge" to set visible of its first window to false'
        sleep 2
        if [ $(check_surge_status) -eq 0 ]; then
            echo "✅ Surge 已连接"
        else
            echo "❌ Surge 未连接"
        fi

    fi
fi