# Pangolin Phase-0 数据面:Xray(VLESS+REALITY) + sing-box(Hysteria2)
# 独立 project 名 pangolin,与现网 marzban/blog/jiu 完全隔离。
# 镜像固定版本,避免 latest 漂移(EC2 实测:Xray 26.3.27 / sing-box 1.13.12)。
name: pangolin

services:
  xray:
    image: ghcr.io/xtls/xray-core:26.3.27
    container_name: pangolin-xray
    restart: unless-stopped
    # 仅监听本地 11443,由宿主 nginx 的 ssl_preread 按 SNI(www.apple.com)转入
    ports:
      - "127.0.0.1:11443:11443"
    volumes:
      - ./xray/config.json:/etc/xray/config.json:ro
    command: ["run", "-c", "/etc/xray/config.json"]

  singbox:
    image: ghcr.io/sagernet/sing-box:v1.13.12
    container_name: pangolin-singbox
    restart: unless-stopped
    # Hysteria2 直接对外暴露 UDP 443(与 TCP 443 不同协议栈,互不冲突)
    ports:
      - "443:443/udp"
    volumes:
      - ./singbox/config.json:/etc/sing-box/config.json:ro
      - ./secrets/hy2:/etc/sing-box/cert:ro
    command: ["run", "-c", "/etc/sing-box/config.json"]