用 Docker 部署 sing-box 服务端：与 Caddy 并存且共用 443

Proxy/
├── .env                         # 域名、密钥和密码（不要提交到 Git）
├── compose.yml
├── caddy/
│   ├── Dockerfile               # 构建带 caddy-l4 的 Caddy
│   ├── conf/Caddyfile
│   ├── data/                    # Caddy/证书数据
│   ├── config/
│   └── site/                    # 博客静态文件
└── sing-box/
    ├── config.json.template     # envsubst 输入
    ├── config.json              # 渲染后的配置，不要提交
    └── certmagic/               # sing-box ACME 数据

HY2_DOMAIN=hy2.example.com
REALITY_DOMAIN=www.example.net
MAIN_DOMAIN=example.com
BLOG_DOMAIN=blog.example.com
ACME_EMAIL=admin@example.com
VLESS_UUID=00000000-0000-0000-0000-000000000000
REALITY_PRIVATE_KEY=replace-with-reality-private-key
REALITY_SHORT_ID=0123456789abcdef
HY2_PASSWORD=replace-with-a-long-random-password

services:
  config-render:
    image: dibi/envsubst:latest
    container_name: config-render
    restart: "no"
    env_file:
      - ./.env
    volumes:
      - ./sing-box/config.json.template:/workdir/config.json:ro
      - ./sing-box:/processed

  caddy:
    build:
      context: ./caddy
      dockerfile: Dockerfile
    container_name: caddy
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    ports:
      - "80:80/tcp"
      - "443:443/tcp"
      - "443:443/udp"
    env_file:
      - ./.env
    volumes:
      - ./caddy/conf:/etc/caddy
      - ./caddy/data:/data
      - ./caddy/config:/config
      - ./caddy/site:/srv

  sing-box:
    image: ghcr.io/sagernet/sing-box:latest-testing
    container_name: sing-box
    restart: always
    depends_on:
      config-render:
        condition: service_completed_successfully
      caddy:
        condition: service_started
    volumes:
      - ./sing-box:/workdir
    command: -D /workdir run

FROM caddy:2-builder AS builder

RUN xcaddy build \
  --with github.com/mholt/caddy-l4@v0.1.1

FROM caddy:2
COPY --from=builder /usr/bin/caddy /usr/bin/caddy

{
  http_port 80
  https_port 8443

  layer4 {
    tcp/:443 {
      @singbox tls sni {$HY2_DOMAIN} {$REALITY_DOMAIN}
      route @singbox { proxy tcp/sing-box:443 }
      route { proxy tcp/127.0.0.1:8443 }
    }

    udp/:443 {
      @singbox quic sni {$HY2_DOMAIN} {$REALITY_DOMAIN}
      route @singbox { proxy udp/sing-box:443 }
      route { proxy udp/127.0.0.1:8443 }
    }
  }
}

http://:80 {
  @singbox_acme {
    host {$HY2_DOMAIN} {$REALITY_DOMAIN}
    path /.well-known/acme-challenge/*
  }
  @main { host {$MAIN_DOMAIN} }
  route {
    reverse_proxy @singbox_acme sing-box:80
    respond @main "OK" 200
    respond 404
  }
}

{$MAIN_DOMAIN} { respond "OK" 200 }
{$BLOG_DOMAIN} {
  root * /srv
  file_server
}

{
  "log": { "level": "error" },
  "http_clients": [
    { "tag": "direct", "engine": "go", "version": 2 }
  ],
  "certificate_providers": [
    {
      "type": "acme",
      "tag": "MyCert",
      "domain": ["${HY2_DOMAIN}"],
      "data_directory": "/workdir/certmagic",
      "email": "${ACME_EMAIL}",
      "provider": "letsencrypt",
      "http_client": "direct"
    }
  ],
  "inbounds": [
    {
      "type": "vless",
      "tag": "vless-in",
      "listen": "0.0.0.0",
      "listen_port": 443,
      "users": [{
        "name": "user",
        "uuid": "${VLESS_UUID}",
        "flow": "xtls-rprx-vision"
      }],
      "tls": {
        "enabled": true,
        "server_name": "${REALITY_DOMAIN}",
        "reality": {
          "enabled": true,
          "handshake": {
            "server": "${REALITY_DOMAIN}",
            "server_port": 443
          },
          "private_key": "${REALITY_PRIVATE_KEY}",
          "short_id": ["${REALITY_SHORT_ID}"],
          "max_time_difference": "1m"
        }
      }
    },
    {
      "type": "hysteria2",
      "tag": "hy2-in",
      "listen": "0.0.0.0",
      "listen_port": 443,
      "users": [{
        "name": "user",
        "password": "${HY2_PASSWORD}"
      }],
      "tls": {
        "enabled": true,
        "server_name": "${HY2_DOMAIN}",
        "certificate_provider": "MyCert"
      }
    }
  ],
  "outbounds": [{ "type": "direct", "tag": "direct" }],
  "route": {
    "rules": [{ "ip_is_private": true, "action": "reject" }],
    "final": "direct",
    "auto_detect_interface": true
  }
}