add tun mode

Author: AbaoFromCUG

config/hypr/hyprland.conf

@@ -290,25 +290,24 @@ submap=reset
 source = ~/.config/hypr/workspaces.conf
 
 # See https://wiki.hypr.land/Configuring/Workspace-Rules/ for workspace rules
-windowrule = float, class:^(clash_win)$
-windowrule = float, class:^(ario)$
-windowrule = float, class:^(QQ)$
-windowrule = float, title:^(Picture in picture)$
-windowrule = float, title:^(Picture-in-Picture)$
-windowrule = float, class:(io.crow_translate.CrowTranslate)
-windowrule = float, class:(pot), title:(Translate|Translator|OCR|PopClip|Screenshot Translate) # Translation window floating
-windowrule = move cursor 0 0, class:(pot), title:(Translate|Translator|PopClip|Screenshot Translate) # Translation window follows the mouse position.
-windowrule = float, class:^(org.telegram.desktop)$,title:^(Media viewer)$
-windowrule = float, title:^Demo-
-windowrule = size 30% 50%, class:^(org.fcitx.fcitx5-config-qt)$,title:^(Classic User Interface — Fcitx Configuration)$
-windowrule = float, class:^(org.fcitx.fcitx5-config-qt)$,title:^(Fcitx Configuration)$
-windowrule = float, class:^(Zotero)$,title:^(Zotero Settings)$
-windowrule = float, class:^(xdg-desktop-portal-gtk)$
-windowrule = float, class:^(Meeting)$,title:^(Feishu Meetings)$
-windowrule = noblur, title:^(LarkSSPromptWindow)$
-windowrule = nofocus, title:^(LarkSSPromptWindow)$
-# windowrule = noblur, title:^(wemeetapp)$
-# windowrule = nofocus, title:^(wemeetapp)$
+windowrule = match:class ^(clash_win)$, float on
+windowrule = match:class ^(ario)$, float on
+windowrule = match:class ^(QQ)$, float on
+windowrule = match:title ^(Picture in picture)$, float on
+windowrule = match:title ^(Picture-in-Picture)$, float on
+windowrule = match:class ^(io.crow_translate.CrowTranslate)$, float on
+windowrule = match:class (pot), match:title (Translate|Translator|OCR|PopClip|Screenshot Translate), float on
+windowrule = match:class ^(org.telegram.desktop)$, match:title ^(Media viewer)$, float on
+windowrule = match:title ^(Demo-Mode)$, float on
+windowrule = match:class ^(org.fcitx.fcitx5-config-qt)$, match:title ^(Classic User Interface — Fcitx Configuration)$, size 30% 50%
+windowrule = match:class ^(org.fcitx.fcitx5-config-qt)$, match:title ^(Fcitx Configuration)$, float on
+windowrule = match:class ^(Zotero)$, match:title ^(Zotero Settings)$, float on
+windowrule = match:class ^(xdg-desktop-portal-gtk)$, float on
+windowrule = match:class ^(Meeting)$, match:title ^(Feishu Meetings)$, float on
+windowrule = match:title ^(LarkSSPromptWindow)$, no_blur on
+windowrule = match:title ^(LarkSSPromptWindow)$, no_focus on
+windowrule = match:title ^(wemeetapp)$, no_blur on
+windowrule = match:title ^(wemeetapp)$, no_focus on
 
 ##############################
 ### PLUGINS ###

mise.toml

@@ -360,7 +360,8 @@ docker run --rm --device /dev/net/tun --cap-add NET_ADMIN -ti \
 depends = ["install go-yq"]
 usage = '''
 arg "<action>" help="action: up | down | restart | logs"
-flag "-e --easyconnect" help="start easyconnect vpn before starting the proxy service"
+flag "-t --enable-tun" help="enable system tuning"
+flag "-e --enable-easyconnect" help="start easyconnect vpn before starting the proxy service"
 flag "--ec-domain <domain>" help="easyconnect VPN domain"
 flag "--ec-username <username>" help="easyconnect VPN username"
 flag "--ec-password <password>" help="easyconnect VPN password"
@@ -369,34 +370,48 @@ flag "--ec-password <password>" help="easyconnect VPN password"
 
 run = '''
 #!/usr/bin/env bash
+set -e pipefail
 
 pushd ./service/proxy/
 if [ ! -f mihomo/config.local.yaml ]; then
     # 参考config.example.yaml 创建
     echo "Please create the config.local.yaml file in the service/proxy/mihomo directory based on the config.example.yaml"
     exit 1
 fi
+mihomo_configs=(mihomo/config.base.yaml)
+compose_files=(docker-compose.base.yaml)
+
 
 # 检查变量是否定义
 if [ "${usage_easyconnect}" == "true" ]; then
+    # 插入 easyconnect 配置文件
     if [ -z "${usage_ec_domain}" ] || [ -z "${usage_ec_username}" ] || [ -z "${usage_ec_password}" ]; then
         echo "When --easyconnect is specified, --ec-domain, --ec-username, and --ec-password must also be provided."
         exit 1
     fi
 
+    mihomo_configs+=("mihomo/config.easyconnect.yaml")
+    compose_files+=("docker-compose.easyconnect.yaml")
 
-    yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1) * select(fileIndex == 2)' mihomo/config.base.yaml mihomo/config.easyconnect.yaml mihomo/config.local.yaml > mihomo/config.yaml
     export EC_DOMAIN="${usage_ec_domain}"
     export EC_USERNAME="${usage_ec_username}"
     export EC_PASSWORD="${usage_ec_password}"
-    yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' docker-compose.base.yaml docker-compose.easyconnect.yaml > docker-compose.yaml
-else
-    yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' mihomo/config.base.yaml mihomo/config.local.yaml > mihomo/config.yaml
-    cp docker-compose.base.yaml docker-compose.yaml
 fi
 
+if [ "${usage_enable_tun}" == "true" ]; then
+    mihomo_configs+=("mihomo/config.tun.yaml")
+fi
+
+mihomo_configs+=("mihomo/config.local.yaml")
 
+# 使用yq合并配置文件与docker compose文件
+yq ea '. as $item ireduce ({}; . * $item )' "${mihomo_configs[@]}" > mihomo/config.yaml
 
+if [ "${usage_action}" == "down" ] || [ "${usage_action}" == "restart" ]; then
+    echo "Bringing down existing proxy service..."
+else
+    yq ea '. as $item ireduce ({}; . * $item )' "${compose_files[@]}" > docker-compose.yaml
+fi
 docker compose ${usage_action}
 
 '''

service/proxy/docker-compose.base.yaml

@@ -4,11 +4,9 @@ services:
     image: ghcr.io/metacubex/metacubexd:latest
     restart: always
     ports:
-      - '8091:80'
+      - "8091:80"
     environment:
-      - DEFAULT_BACKEND_URL=http://127.0.0.1:8092
-
-  # Optional: mihomo instance
+      DEFAULT_BACKEND_URL: http://127.0.0.1:8092
   mihomo:
     container_name: mihomo
     image: docker.io/metacubex/mihomo:Alpha
@@ -19,4 +17,5 @@ services:
     volumes:
       - ./mihomo/config.yaml:/root/.config/mihomo/config.yaml
       - /dev/net/tun:/dev/net/tun
-
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro

service/proxy/docker-compose.easyconnect.yaml

@@ -1,10 +1,3 @@
-
-
-# docker run --rm --device /dev/net/tun --cap-add NET_ADMIN -ti \
-#     -p 127.0.0.1:${usage_socks_port}:1080 \
-#     -p 127.0.0.1:${usage_http_port}:8888 \
-#     -e EC_VER=7.6.7 \
-#     -e CLI_OPTS="-d ${usage_domain} -u ${usage_username} -p ${usage_password}" \
 services:
   easyconnect:
     container_name: easyconnect
@@ -17,7 +10,6 @@ services:
     environment:
       EC_VER: 7.6.7
       CLI_OPTS: "-d ${EC_DOMAIN} -u ${EC_USERNAME} -p ${EC_PASSWORD}"
-
     ports:
-      - '8093:1080'
-      - '8094:8888'
+      - "8093:1080"
+      - "8094:8888"

service/proxy/mihomo/config.base.yaml

@@ -1,107 +1,83 @@
 mixed-port: 8090
 external-controller: 127.0.0.1:8092
-
 geodata-mode: true
 geo-auto-update: false
-
 rule-providers:
   reject:
     type: http
     behavior: domain
     url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/reject.txt"
     path: ./ruleset/reject.yaml
     interval: 86400
-
   icloud:
     type: http
     behavior: domain
     url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/icloud.txt"
     path: ./ruleset/icloud.yaml
     interval: 86400
-
   apple:
     type: http
     behavior: domain
     url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/apple.txt"
     path: ./ruleset/apple.yaml
     interval: 86400
-
   google:
     type: http
     behavior: domain
     url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/google.txt"
     path: ./ruleset/google.yaml
     interval: 86400
-
   proxy:
     type: http
     behavior: domain
     url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/proxy.txt"
     path: ./ruleset/proxy.yaml
     interval: 86400
-
   direct:
     type: http
     behavior: domain
     url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/direct.txt"
     path: ./ruleset/direct.yaml
     interval: 86400
-
   private:
     type: http
     behavior: domain
     url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/private.txt"
     path: ./ruleset/private.yaml
     interval: 86400
-
   gfw:
     type: http
     behavior: domain
     url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/gfw.txt"
     path: ./ruleset/gfw.yaml
     interval: 86400
-
   tld-not-cn:
     type: http
     behavior: domain
     url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/tld-not-cn.txt"
     path: ./ruleset/tld-not-cn.yaml
     interval: 86400
-
   telegramcidr:
     type: http
     behavior: ipcidr
     url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/telegramcidr.txt"
     path: ./ruleset/telegramcidr.yaml
     interval: 86400
-
   cncidr:
     type: http
     behavior: ipcidr
     url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/cncidr.txt"
     path: ./ruleset/cncidr.yaml
     interval: 86400
-
   lancidr:
     type: http
     behavior: ipcidr
     url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/lancidr.txt"
     path: ./ruleset/lancidr.yaml
     interval: 86400
-
   applications:
     type: http
     behavior: classical
     url: "https://cdn.jsdelivr.net/gh/Loyalsoldier/clash-rules@release/applications.txt"
     path: ./ruleset/applications.yaml
     interval: 86400
-
-
-tun:
-  enable: true
-  auto-route: true
-  auto-redirect: true
-  auto-detect-interface: true
-  device: utun-mihomo
-
-

service/proxy/mihomo/config.easyconnect.yaml

@@ -1,6 +1,5 @@
 proxies:
-- name: "easyconnect"
-  type: http
-  server: 127.0.0.1
-  port: 8094
-
+  - name: "easyconnect"
+    type: http
+    server: 127.0.0.1
+    port: 8094

service/proxy/mihomo/config.local.example.yaml

@@ -4,7 +4,12 @@ proxy-providers:
     url: "https://xxxx"
     type: http
     interval: 86400
-    health-check: {enable: true, url: "https://www.gstatic.com/generate_204", interval: 300}
+    health-check:
+      {
+        enable: true,
+        url: "https://www.gstatic.com/generate_204",
+        interval: 300,
+      }
     exclude-filter: "套餐|流量|群组|频道|官网|推荐使用|测试|电报|订阅|地址"
     header:
       User-Agent:

service/proxy/mihomo/config.tun.yaml

@@ -0,0 +1,55 @@
+
+#------------------------TUN 配置------------------------#
+tun:
+  enable: true
+  stack: system
+  auto-route: true
+  auto-detect-interface: true
+  dns-hijack:
+    - any:53
+    - tcp://any:53
+
+#------------------------DNS 配置------------------------#
+dns:
+  enable: true              # 启用DNS服务器
+  prefer-h3: true          # 优先使用HTTP/3查询
+  ipv6: false              # DNS解析IPv6
+  listen: 0.0.0.0:53       # DNS监听地址
+  enhanced-mode: redir-host   # DNS模式: fake-ip或redir-host
+  use-hosts: true          # 使用hosts文件
+
+  # 默认DNS服务器(用于解析其他DNS服务器的域名)
+  default-nameserver:
+    - 223.5.5.5            # 阿里DNS
+    - 119.29.29.29         # 腾讯DNS
+
+  # DNS服务器分流策略
+  nameserver-policy:
+    'www.google.com': 'https://dns.google/dns-query'      # Google域名使用Google DNS
+    'www.facebook.com': 'https://dns.google/dns-query'    # Facebook域名使用Google DNS
+    '.cn': 'https://doh.pub/dns-query'                    # 中国域名使用国内DNS
+
+  # Fake-IP配置
+  fake-ip-range: 198.18.0.1/16    # Fake-IP地址段
+  fake-ip-filter:                 # Fake-IP过滤清单
+    - "*.lan"                     # 本地域名
+    - "localhost.ptlogin2.qq.com" # QQ登录
+
+  # 主要DNS服务器
+  nameserver:
+    # 国内DNS服务器
+    - https://doh.pub/dns-query#h3=true                # DNSPod DOH
+    - https://dns.alidns.com/dns-query#h3=true         # 阿里 DOH
+    - tls://223.5.5.5:853                              # 阿里 DOT
+
+    # 国外DNS服务器
+    - https://dns.google/dns-query#h3=true             # Google DOH
+    - https://cloudflare-dns.com/dns-query#h3=true     # Cloudflare DOH
+    - quic://dns.adguard.com:784                       # AdGuard DOQ
+
+  # 备用DNS服务器(用于解析国外域名)
+  fallback:
+    - https://dns.google/dns-query#h3=true
+    - https://1.1.1.1/dns-query#h3=true
+    - tls://8.8.8.8:853
+