方案C:分发层容器化(edge nginx)+ Hy2 + DNS-01 续期

- edge: 容器化 nginx 接管 80/443,逐字移植现网 vhost(blog/jiu/marzban/pay)+ stream SNI 分流
- singbox: Hysteria2(host 网络,UDP 443)
- certbot: DNS-01(Cloudflare)续期,容器化
- xray: REALITY 仅 profile newnode(本台沿用 Marzban)
- deploy.sh 幂等且切换感知;cutover.sh 一次性停宿主 nginx 切容器(可秒级回滚)
- 弃用方案A 的 host nginx-apply/sudoers/root-setup
- 部署目录改 ~/pangolin(免 root);CI 注入 CF_API_TOKEN

EC2 实测:edge nginx -t 通过(真实证书)、compose 校验通过

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/docker-compose.yml

@@ -1,28 +1,58 @@
-# Pangolin Phase-0 数据面:Xray(VLESS+REALITY) + sing-box(Hysteria2)
-# 独立 project 名 pangolin,与现网 marzban/blog/jiu 完全隔离。
-# 镜像固定版本,避免 latest 漂移(EC2 实测:Xray 26.3.27 / sing-box 1.13.12)。
-name: pangolin
+# pangolin 数据/分发面(方案 C)。
+# 与现网 marzban/jiu/billing/blog 并存:edge 反代到它们,其余容器不动。
+# 镜像固定版本(EC2 实测:nginx 1.27 / sing-box 1.13.12 / xray 26.3.27)。
+# project 名由命令行 `-p pangolin` 指定(兼容宿主 docker-compose 版本)。
 
 services:
+  # 分发层:接管 80/443,移植现网全部路由(host 网络才能绑端口并回连 127.0.0.1 后端)
+  edge:
+    image: nginx:1.27-alpine
+    container_name: pangolin-edge
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - ./edge/nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./edge/stream.conf:/etc/nginx/stream.conf:ro
+      - ./edge/conf.d:/etc/nginx/conf.d:ro
+      - /etc/letsencrypt:/etc/letsencrypt:ro     # 证书(只读)
+      - /opt/jiu:/opt/jiu:ro                     # jiu 静态(images/web/marketing)
+      - /var/www/pay:/var/www/pay:ro             # 收款页静态
+    healthcheck:
+      test: ["CMD", "nginx", "-t"]
+      interval: 1m
+      timeout: 10s
+      retries: 3
+
+  # Hysteria2 加速线(UDP 443)
+  singbox:
+    image: ghcr.io/sagernet/sing-box:v1.13.12
+    container_name: pangolin-singbox
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - ./singbox/config.json:/etc/sing-box/config.json:ro
+      - ./secrets/hy2:/etc/sing-box/cert:ro
+    command: ["run", "-c", "/etc/sing-box/config.json"]
+
+  # 证书续期(DNS-01 / Cloudflare)—— 按需运行:`docker compose run --rm certbot renew`
+  # 由宿主 cron 每日调用,renew 后宿主再 `docker exec pangolin-edge nginx -s reload`。
+  certbot:
+    image: certbot/dns-cloudflare:latest
+    container_name: pangolin-certbot
+    profiles: ["certbot"]
+    volumes:
+      - /etc/letsencrypt:/etc/letsencrypt
+      - ./secrets/cloudflare.ini:/etc/cloudflare.ini:ro
+    entrypoint: ["certbot"]
+
+  # 新节点用的 REALITY —— 本台不启用(REALITY 仍由 Marzban 提供)
   xray:
     image: ghcr.io/xtls/xray-core:26.3.27
     container_name: pangolin-xray
+    profiles: ["newnode"]
     restart: unless-stopped
-    # 仅监听本地 11443,由宿主 nginx 的 ssl_preread 按 SNI(www.apple.com)转入
     ports:
       - "127.0.0.1:11443:11443"
     volumes:
       - ./xray/config.json:/etc/xray/config.json:ro
     command: ["run", "-c", "/etc/xray/config.json"]
-
-  singbox:
-    image: ghcr.io/sagernet/sing-box:v1.13.12
-    container_name: pangolin-singbox
-    restart: unless-stopped
-    # Hysteria2 直接对外暴露 UDP 443(与 TCP 443 不同协议栈,互不冲突)
-    ports:
-      - "443:443/udp"
-    volumes:
-      - ./singbox/config.json:/etc/sing-box/config.json:ro
-      - ./secrets/hy2:/etc/sing-box/cert:ro
-    command: ["run", "-c", "/etc/sing-box/config.json"]