test

deployments/openvpn/Dockerfile

@@ -0,0 +1,25 @@
+# 戎行专用：OpenVPN 客户端 + SOCKS5（仅内网代理，不接管默认路由）
+FROM alpine:3.21
+
+RUN apk add --no-cache \
+    openvpn \
+    bash \
+    iproute2 \
+    microsocks \
+    curl
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+ENV VPN_DIR=/vpn \
+    SOCKS_HOST=0.0.0.0 \
+    SOCKS_PORT=1080 \
+    RONGXING_HOST=192.168.3.43
+
+VOLUME ["/vpn"]
+EXPOSE 1080
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=45s --retries=5 \
+  CMD ip link show tun0 >/dev/null 2>&1 || exit 1
+
+ENTRYPOINT ["/entrypoint.sh"]

deployments/openvpn/README.md

@@ -0,0 +1,13 @@
+# Rongxing OpenVPN（部署附件）
+
+完整方案见：[docs/戎行OpenVPN接入方案.md](../../docs/戎行OpenVPN接入方案.md)
+
+| 文件 | 用途 |
+|------|------|
+| `Dockerfile` | OpenVPN + microsocks 自建镜像 |
+| `entrypoint.sh` | 启动 VPN（仅路由戎行 IP）并监听 SOCKS5 `:1080` |
+| `tiany0721.ovpn.example` | ovpn 模板 |
+| `docker-compose.rongxing-vpn.snippet.yml` | 独立编排参考（prod 已内置） |
+| `upload-checklist.txt` | 上传清单 |
+
+**真实证书放到服务器 secrets 目录或 `./secrets/openvpn/`，不要提交 Git。**

deployments/openvpn/docker-compose.rongxing-vpn.snippet.yml

@@ -0,0 +1,31 @@
+# 已并入 docker-compose.prod.yml 的 rongxing-vpn 服务。
+# 保留本文件便于 1Panel 单独编排时参考。
+#
+# 1Panel 机密目录示例：
+#   RONGXING_VPN_CONFIG=/opt/1panel/apps/hyapi-secrets/openvpn
+#
+# 独立栈时需 external 网络（名称以 docker network ls 为准）：
+# networks:
+#   hyapi-network:
+#     external: true
+#     name: hyapi-server_hyapi-network
+
+services:
+  rongxing-vpn:
+    build:
+      context: ./deployments/openvpn
+      dockerfile: Dockerfile
+    image: hyapi-rongxing-vpn:local
+    container_name: hyapi-rongxing-vpn
+    environment:
+      TZ: Asia/Shanghai
+      RONGXING_HOST: "192.168.3.43"
+    volumes:
+      - ${RONGXING_VPN_CONFIG:-./secrets/openvpn}:/vpn:ro
+    cap_add:
+      - NET_ADMIN
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    networks:
+      - hyapi-network
+    restart: unless-stopped

deployments/openvpn/entrypoint.sh

@@ -0,0 +1,69 @@
+#!/bin/bash
+# OpenVPN 连通后拉起 SOCKS5；仅服务戎行内网代理。
+set -euo pipefail
+
+VPN_DIR="${VPN_DIR:-/vpn}"
+SOCKS_HOST="${SOCKS_HOST:-0.0.0.0}"
+SOCKS_PORT="${SOCKS_PORT:-1080}"
+RONGXING_HOST="${RONGXING_HOST:-192.168.3.43}"
+
+cd "$VPN_DIR"
+
+CONF=""
+for f in *.conf *.ovpn; do
+  if [ -f "$f" ]; then
+    CONF="$f"
+    break
+  fi
+done
+
+if [ -z "$CONF" ]; then
+  echo "[rongxing-vpn] 未在 ${VPN_DIR} 找到 .ovpn/.conf，请挂载证书目录"
+  exit 1
+fi
+
+echo "[rongxing-vpn] 使用配置: ${CONF}"
+echo "[rongxing-vpn] 仅路由 ${RONGXING_HOST}/32，SOCKS5 ${SOCKS_HOST}:${SOCKS_PORT}"
+
+openvpn \
+  --config "$CONF" \
+  --cd "$VPN_DIR" \
+  --route-nopull \
+  --route "$RONGXING_HOST" 255.255.255.255 \
+  --daemon \
+  --writepid /var/run/openvpn.pid \
+  --log /var/log/openvpn.log \
+  --verb 3
+
+for i in $(seq 1 90); do
+  if ip link show tun0 >/dev/null 2>&1; then
+    echo "[rongxing-vpn] tun0 已就绪 (${i}s)"
+    break
+  fi
+  if [ "$i" -eq 90 ]; then
+    echo "[rongxing-vpn] 等待 tun0 超时，OpenVPN 日志："
+    cat /var/log/openvpn.log || true
+    exit 1
+  fi
+  sleep 1
+done
+
+# 前台跑 microsocks，进程退出则容器退出；同时监控 openvpn
+microsocks -i "$SOCKS_HOST" -p "$SOCKS_PORT" &
+SOCKS_PID=$!
+
+cleanup() {
+  kill "$SOCKS_PID" 2>/dev/null || true
+  if [ -f /var/run/openvpn.pid ]; then
+    kill "$(cat /var/run/openvpn.pid)" 2>/dev/null || true
+  fi
+}
+trap cleanup EXIT INT TERM
+
+while kill -0 "$(cat /var/run/openvpn.pid)" 2>/dev/null && kill -0 "$SOCKS_PID" 2>/dev/null; do
+  sleep 5
+done
+
+echo "[rongxing-vpn] OpenVPN 或 SOCKS 已退出"
+cat /var/log/openvpn.log || true
+exit 1

deployments/openvpn/env.example

@@ -0,0 +1,6 @@
+# 可选：复制为 .env 供 docker compose 读取
+# 1Panel 推荐：
+RONGXING_VPN_CONFIG=/opt/1panel/apps/hyapi-secrets/openvpn
+
+# 本地默认（不设则用 compose 内 ./secrets/openvpn）：
+# RONGXING_VPN_CONFIG=./secrets/openvpn

deployments/openvpn/tiany0721.ovpn.example

@@ -0,0 +1,23 @@
+# 复制为服务器上的 tiany0721.ovpn，并与 ca.crt / 证书 / 密钥同目录放置。
+# 勿将真实证书提交到 Git。
+
+client
+dev tun
+proto tcp
+remote 111.31.14.226 32199
+resolv-retry infinite
+nobind
+persist-key
+persist-tun
+ca ca.crt
+cert tiany0721.crt
+key tiany0721.key
+remote-cert-tls server
+tls-auth ta.key 1
+cipher AES-256-CBC
+compress lz4-v2
+verb 3
+
+# 仅路由戎行主机，不接管默认网关（其它流量仍走容器原出口）
+route-nopull
+route 192.168.3.43 255.255.255.255

deployments/openvpn/upload-checklist.txt

@@ -0,0 +1,17 @@
+# 从本机 C:\Users\a1726\Desktop\11\OpenVPN\config 上传到服务器：
+#   /opt/1panel/apps/hyapi-secrets/openvpn/
+#
+# 需要：
+#   [ ] tiany0721.ovpn   （上传后按 example 加上 route-nopull + route）
+#   [ ] ca.crt
+#   [ ] tiany0721.crt
+#   [ ] tiany0721.key
+#   [ ] ta.key
+#
+# 不需要：
+#   [x] bin/、doc/、Uninstall.exe、openvpn-gui.exe 等 Windows 安装文件
+#
+# 权限：
+#   chmod 700 /opt/1panel/apps/hyapi-secrets /opt/1panel/apps/hyapi-secrets/openvpn
+#   chmod 600 *.key
+#   chmod 644 *.crt *.ovpn