mirror of
https://github.com/SagerNet/sing-box.git
synced 2026-04-11 17:47:20 +10:00
Add cloudflared inbound
This commit is contained in:
世界
89
docs/configuration/inbound/cloudflared.md
Normal file
89
docs/configuration/inbound/cloudflared.md
Normal file
@@ -0,0 +1,89 @@
|
||||
---
|
||||
icon: material/new-box
|
||||
---
|
||||
|
||||
!!! question "Since sing-box 1.14.0"
|
||||
|
||||
`cloudflared` inbound runs an embedded Cloudflare Tunnel client and routes all
|
||||
incoming tunnel traffic (TCP, UDP, ICMP) through sing-box's routing engine.
|
||||
|
||||
### Structure
|
||||
|
||||
```json
|
||||
{
|
||||
"type": "cloudflared",
|
||||
"tag": "",
|
||||
|
||||
"token": "",
|
||||
"ha_connections": 0,
|
||||
"protocol": "",
|
||||
"post_quantum": false,
|
||||
"edge_ip_version": 0,
|
||||
"datagram_version": "",
|
||||
"grace_period": "",
|
||||
"region": "",
|
||||
"control_dialer": {
|
||||
... // Dial Fields
|
||||
},
|
||||
"tunnel_dialer": {
|
||||
... // Dial Fields
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Fields
|
||||
|
||||
#### token
|
||||
|
||||
==Required==
|
||||
|
||||
Base64-encoded tunnel token from the Cloudflare Zero Trust dashboard
|
||||
(`Networks → Tunnels → Install connector`).
|
||||
|
||||
#### ha_connections
|
||||
|
||||
Number of high-availability connections to the Cloudflare edge.
|
||||
|
||||
Capped by the number of discovered edge addresses.
|
||||
|
||||
#### protocol
|
||||
|
||||
Transport protocol for edge connections.
|
||||
|
||||
One of `quic` `http2`.
|
||||
|
||||
#### post_quantum
|
||||
|
||||
Enable post-quantum key exchange on the control connection.
|
||||
|
||||
#### edge_ip_version
|
||||
|
||||
IP version used when connecting to the Cloudflare edge.
|
||||
|
||||
One of `0` (automatic) `4` `6`.
|
||||
|
||||
#### datagram_version
|
||||
|
||||
Datagram protocol version used for UDP proxying over QUIC.
|
||||
|
||||
One of `v2` `v3`. Only meaningful when `protocol` is `quic`.
|
||||
|
||||
#### grace_period
|
||||
|
||||
Graceful shutdown window for in-flight edge connections.
|
||||
|
||||
#### region
|
||||
|
||||
Cloudflare edge region selector.
|
||||
|
||||
Conflict with endpoints embedded in `token`.
|
||||
|
||||
#### control_dialer
|
||||
|
||||
[Dial Fields](/configuration/shared/dial/) used when the tunnel client dials the
|
||||
Cloudflare control plane.
|
||||
|
||||
#### tunnel_dialer
|
||||
|
||||
[Dial Fields](/configuration/shared/dial/) used when the tunnel client dials the
|
||||
Cloudflare edge data plane.
|
||||
89
docs/configuration/inbound/cloudflared.zh.md
Normal file
89
docs/configuration/inbound/cloudflared.zh.md
Normal file
@@ -0,0 +1,89 @@
|
||||
---
|
||||
icon: material/new-box
|
||||
---
|
||||
|
||||
!!! question "自 sing-box 1.14.0 起"
|
||||
|
||||
`cloudflared` 入站运行一个内嵌的 Cloudflare Tunnel 客户端，并将所有传入的隧道流量
|
||||
（TCP、UDP、ICMP）通过 sing-box 的路由引擎转发。
|
||||
|
||||
### 结构
|
||||
|
||||
```json
|
||||
{
|
||||
"type": "cloudflared",
|
||||
"tag": "",
|
||||
|
||||
"token": "",
|
||||
"ha_connections": 0,
|
||||
"protocol": "",
|
||||
"post_quantum": false,
|
||||
"edge_ip_version": 0,
|
||||
"datagram_version": "",
|
||||
"grace_period": "",
|
||||
"region": "",
|
||||
"control_dialer": {
|
||||
... // 拨号字段
|
||||
},
|
||||
"tunnel_dialer": {
|
||||
... // 拨号字段
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### 字段
|
||||
|
||||
#### token
|
||||
|
||||
==必填==
|
||||
|
||||
来自 Cloudflare Zero Trust 仪表板的 Base64 编码隧道令牌
|
||||
（`Networks → Tunnels → Install connector`）。
|
||||
|
||||
#### ha_connections
|
||||
|
||||
到 Cloudflare edge 的高可用连接数。
|
||||
|
||||
上限为已发现的 edge 地址数量。
|
||||
|
||||
#### protocol
|
||||
|
||||
edge 连接使用的传输协议。
|
||||
|
||||
`quic` `http2` 之一。
|
||||
|
||||
#### post_quantum
|
||||
|
||||
在控制连接上启用后量子密钥交换。
|
||||
|
||||
#### edge_ip_version
|
||||
|
||||
连接 Cloudflare edge 时使用的 IP 版本。
|
||||
|
||||
`0`（自动）`4` `6` 之一。
|
||||
|
||||
#### datagram_version
|
||||
|
||||
通过 QUIC 进行 UDP 代理时使用的数据报协议版本。
|
||||
|
||||
`v2` `v3` 之一。仅在 `protocol` 为 `quic` 时有效。
|
||||
|
||||
#### grace_period
|
||||
|
||||
正在处理的 edge 连接的优雅关闭窗口。
|
||||
|
||||
#### region
|
||||
|
||||
Cloudflare edge 区域选择器。
|
||||
|
||||
与 `token` 中嵌入的 endpoint 冲突。
|
||||
|
||||
#### control_dialer
|
||||
|
||||
隧道客户端拨向 Cloudflare 控制面时使用的
|
||||
[拨号字段](/zh/configuration/shared/dial/)。
|
||||
|
||||
#### tunnel_dialer
|
||||
|
||||
隧道客户端拨向 Cloudflare edge 数据面时使用的
|
||||
[拨号字段](/zh/configuration/shared/dial/)。
|
||||
@@ -34,6 +34,7 @@
|
||||
| `tun` | [Tun](./tun/) | :material-close: |
|
||||
| `redirect` | [Redirect](./redirect/) | :material-close: |
|
||||
| `tproxy` | [TProxy](./tproxy/) | :material-close: |
|
||||
| `cloudflared` | [Cloudflared](./cloudflared/) | :material-close: |
|
||||
|
||||
#### tag
|
||||
|
||||
|
||||
@@ -34,6 +34,7 @@
|
||||
| `tun` | [Tun](./tun/) | :material-close: |
|
||||
| `redirect` | [Redirect](./redirect/) | :material-close: |
|
||||
| `tproxy` | [TProxy](./tproxy/) | :material-close: |
|
||||
| `cloudflared` | [Cloudflared](./cloudflared/) | :material-close: |
|
||||
|
||||
#### tag
|
||||
|
||||
|
||||
@@ -61,6 +61,7 @@ go build -tags "tag_a tag_b" ./cmd/sing-box
|
||||
| `with_ccm` | :material-check: | Build with Claude Code Multiplexer service support. |
|
||||
| `with_ocm` | :material-check: | Build with OpenAI Codex Multiplexer service support. |
|
||||
| `with_naive_outbound` | :material-check: | Build with NaiveProxy outbound support, see [NaiveProxy outbound](/configuration/outbound/naive/). |
|
||||
| `with_cloudflared` | :material-check: | Build with Cloudflare Tunnel inbound support, see [Cloudflared inbound](/configuration/inbound/cloudflared/). |
|
||||
| `badlinkname` | :material-check: | Enable `go:linkname` access to internal standard library functions. Required because the Go standard library does not expose many low-level APIs needed by this project, and reimplementing them externally is impractical. Used for kTLS (kernel TLS offload) and raw TLS record manipulation. |
|
||||
| `tfogo_checklinkname0` | :material-check: | Companion to `badlinkname`. Go 1.23+ enforces `go:linkname` restrictions via the linker; this tag signals the build uses `-checklinkname=0` to bypass that enforcement. |
|
||||
|
||||
|
||||
@@ -65,6 +65,7 @@ go build -tags "tag_a tag_b" ./cmd/sing-box
|
||||
| `with_ccm` | :material-check: | 构建 Claude Code Multiplexer 服务支持。 |
|
||||
| `with_ocm` | :material-check: | 构建 OpenAI Codex Multiplexer 服务支持。 |
|
||||
| `with_naive_outbound` | :material-check: | 构建 NaiveProxy 出站支持，参阅 [NaiveProxy 出站](/zh/configuration/outbound/naive/)。 |
|
||||
| `with_cloudflared` | :material-check: | 构建 Cloudflare Tunnel 入站支持，参阅 [Cloudflared 入站](/zh/configuration/inbound/cloudflared/)。 |
|
||||
| `badlinkname` | :material-check: | 启用 `go:linkname` 以访问标准库内部函数。Go 标准库未提供本项目需要的许多底层 API，且在外部重新实现不切实际。用于 kTLS（内核 TLS 卸载）和原始 TLS 记录操作。 |
|
||||
| `tfogo_checklinkname0` | :material-check: | `badlinkname` 的伴随标记。Go 1.23+ 链接器强制限制 `go:linkname` 使用；此标记表示构建使用 `-checklinkname=0` 以绕过该限制。 |
|
||||
|
||||
|
||||
Reference in New Issue
Block a user