From 9ab7ba66f3f846487344e3c9e59280d330e692fa Mon Sep 17 00:00:00 2001
From: Mrxs <18278715334@163.com>
Date: Thu, 23 Jul 2026 15:22:10 +0800
Subject: [PATCH] f

---
 deployments/openvpn/Dockerfile          | 19 +++++++++++--------
 deployments/openvpn/README.md           |  3 ++-
 deployments/openvpn/entrypoint.sh       | 14 ++++++++++----
 deployments/openvpn/sockd.conf.template | 14 ++++++++++++++
 4 files changed, 37 insertions(+), 13 deletions(-)
 create mode 100644 deployments/openvpn/sockd.conf.template

diff --git a/deployments/openvpn/Dockerfile b/deployments/openvpn/Dockerfile
index ae3c004..e48987b 100644
--- a/deployments/openvpn/Dockerfile
+++ b/deployments/openvpn/Dockerfile
@@ -1,14 +1,17 @@
-# 戎行专用：OpenVPN 客户端 + SOCKS5（仅内网代理，不接管默认路由）
-FROM alpine:3.21
+# 戎行专用：OpenVPN 客户端 + Dante SOCKS5（仅内网代理）
+FROM alpine:3.19
 
-RUN apk add --no-cache \
-    openvpn \
-    bash \
-    iproute2 \
-    microsocks \
-    curl
+# 与业务镜像一致，使用国内 apk 源
+RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories \
+    && apk add --no-cache \
+        openvpn \
+        bash \
+        iproute2 \
+        dante-server \
+        curl
 
 COPY entrypoint.sh /entrypoint.sh
+COPY sockd.conf.template /etc/sockd.conf.template
 RUN chmod +x /entrypoint.sh
 
 ENV VPN_DIR=/vpn \
diff --git a/deployments/openvpn/README.md b/deployments/openvpn/README.md
index e253e96..6a88074 100644
--- a/deployments/openvpn/README.md
+++ b/deployments/openvpn/README.md
@@ -4,8 +4,9 @@
 
 | 文件 | 用途 |
 |------|------|
-| `Dockerfile` | OpenVPN + microsocks 自建镜像 |
+| `Dockerfile` | OpenVPN + dante-server（sockd）自建镜像 |
 | `entrypoint.sh` | 启动 VPN（仅路由戎行 IP）并监听 SOCKS5 `:1080` |
+| `sockd.conf.template` | Dante SOCKS 配置模板 |
 | `tiany0721.ovpn.example` | ovpn 模板 |
 | `docker-compose.rongxing-vpn.snippet.yml` | 独立编排参考（prod 已内置） |
 | `upload-checklist.txt` | 上传清单 |
diff --git a/deployments/openvpn/entrypoint.sh b/deployments/openvpn/entrypoint.sh
index 4190986..fcacefe 100644
--- a/deployments/openvpn/entrypoint.sh
+++ b/deployments/openvpn/entrypoint.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# OpenVPN 连通后拉起 SOCKS5；仅服务戎行内网代理。
+# OpenVPN 连通后拉起 SOCKS5（dante/sockd）；仅服务戎行内网代理。
 set -euo pipefail
 
 VPN_DIR="${VPN_DIR:-/vpn}"
@@ -48,9 +48,15 @@ for i in $(seq 1 90); do
   sleep 1
 done
 
-# 前台跑 microsocks，进程退出则容器退出；同时监控 openvpn
-microsocks -i "$SOCKS_HOST" -p "$SOCKS_PORT" &
-SOCKS_PID=$!
+# 生成 dante 配置并后台启动 sockd
+sed "s/__SOCKS_PORT__/${SOCKS_PORT}/g" /etc/sockd.conf.template > /etc/sockd.conf
+sockd -f /etc/sockd.conf -D
+SOCKS_PID="$(pidof sockd | awk '{print $1}')"
+if [ -z "${SOCKS_PID}" ]; then
+  echo "[rongxing-vpn] sockd 启动失败"
+  exit 1
+fi
+echo "[rongxing-vpn] SOCKS5 已监听 :${SOCKS_PORT} (pid=${SOCKS_PID})"
 
 cleanup() {
   kill "$SOCKS_PID" 2>/dev/null || true
diff --git a/deployments/openvpn/sockd.conf.template b/deployments/openvpn/sockd.conf.template
new file mode 100644
index 0000000..3539b3b
--- /dev/null
+++ b/deployments/openvpn/sockd.conf.template
@@ -0,0 +1,14 @@
+# Dante SOCKS5 — entrypoint 会替换 __SOCKS_PORT__
+logoutput: stderr
+internal: 0.0.0.0 port = __SOCKS_PORT__
+external: eth0
+socksmethod: none
+clientmethod: none
+
+client pass {
+    from: 0.0.0.0/0 to: 0.0.0.0/0
+}
+
+socks pass {
+    from: 0.0.0.0/0 to: 0.0.0.0/0
+}