From fe6589cc03d6775455efa6bb27d249d6d9a70975 Mon Sep 17 00:00:00 2001
From: wangjia <809946525@qq.com>
Date: Sun, 5 Jul 2026 23:20:25 +0800
Subject: [PATCH] =?UTF-8?q?fix(proxy):=20mihomo=20=E4=B8=8A=E6=B8=B8=20ec2?=
 =?UTF-8?q?-sg=20=E2=86=92=20pangolin1-us=EF=BC=88ec2=202026-07-04=20?=
 =?UTF-8?q?=E9=80=80=E5=BD=B9=E6=BC=8F=E6=94=B9=E4=BE=9D=E8=B5=96=EF=BC=8C?=
 =?UTF-8?q?NAS=20=E6=96=AD=E5=A4=96=E7=BD=91=E5=A4=8D=E7=9B=98=E4=BF=AE?=
 =?UTF-8?q?=E5=A4=8D=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

根因：ec2 退役释放 EIP 18.136.60.128，但 NAS mihomo 唯一上游仍指向它，
所有走代理的境外流量拨号超时。切换到 pangolin1（103.119.13.48）的
sing-box VLESS Reality :443（flow xtls-rprx-vision，SNI www.apple.com），
route-exclude 同步更新。NAS 实机已于 2026-07-05 切换并验证恢复。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 README.md                       |  3 ++-
 docker/proxy/mihomo/config.yaml | 17 ++++++++++-------
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index ac6f271..c02ee37 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ Synology DS925+（192.168.3.200）的 Docker 服务配置管理。
 | 服务 | 说明 | 地址 |
 |------|------|------|
 | Forgejo | 自托管 Git 服务 + CI/CD runner | http://git.51yanmei.com |
-| mihomo | 透明代理网关（VLESS + Reality） | 局域网网关 192.168.3.200 |
+| mihomo | 透明代理网关（VLESS + Reality，上游 pangolin1 103.119.13.48） | 局域网网关 192.168.3.200 |
 | dnsmasq | DHCP/DNS（预备，暂未启用） | — |
 
 ## 目录
@@ -28,6 +28,7 @@ cp docker/forgejo/.env.example docker/forgejo/.env
 
 cp docker/proxy/mihomo/.env.example docker/proxy/mihomo/.env
 # 填入 VLESS_UUID（然后手动更新 config.yaml 中的 <VLESS_UUID>）
+# 2026-07-05 起 UUID = pangolin1 sing-box 443 入站的第一个用户（查看：ssh pangolin1 查 /etc/sing-box/config.json）
 ```
 
 ### 启动服务
diff --git a/docker/proxy/mihomo/config.yaml b/docker/proxy/mihomo/config.yaml
index e1450c7..8da0fbe 100644
--- a/docker/proxy/mihomo/config.yaml
+++ b/docker/proxy/mihomo/config.yaml
@@ -14,7 +14,7 @@ tun:
   auto-route: true
   auto-detect-interface: true
   route-exclude-address:
-    - 18.136.60.128/32
+    - 103.119.13.48/32
   dns-hijack:
     - any:53
 
@@ -46,25 +46,28 @@ dns:
     geoip-code: CN
 
 proxies:
-  - name: "ec2-sg"
+  # 上游 = pangolin1（103.119.13.48，sing-box VLESS Reality :443，伪装 www.apple.com）
+  # 2026-07-05 由 ec2-sg 切换而来（ec2 已于 2026-07-04 退役，EIP 已释放）
+  - name: "pangolin1-us"
     type: vless
-    server: 18.136.60.128
+    server: 103.119.13.48
     port: 443
     uuid: <VLESS_UUID>
     network: tcp
+    flow: xtls-rprx-vision
     tls: true
     udp: true
     reality-opts:
-      public-key: fHHr9qWw2JuqNxpv3XTcZTi5k73HWfjipa4vnXFu9W8
-      short-id: 6eb28f1a766a
-    servername: www.cloudflare.com
+      public-key: TAPOvsNOTm9faWdqXz4vkpK_dVQJWjwWqS_PKK6ytBg
+      short-id: 69ddbef9f69d07d3
+    servername: www.apple.com
     client-fingerprint: chrome
 
 proxy-groups:
   - name: "Proxy"
     type: select
     proxies:
-      - ec2-sg
+      - pangolin1-us
       - DIRECT
 
 rules: