给 Claude 一条干净的线路：一台 VPS 和两台虚拟机

# 安装（以脚本文档为准）
bash <(wget -qO- -o- https://github.com/233boy/sing-box/raw/main/install.sh)

sing-box url        # 打印 vless:// 链接，后面喂给网关
sing-box status     # 运行状态
sing-box log        # 看日志
sing-box port <name> auto   # 换端口
sing-box sni  <name> <域名>  # 换 REALITY 的伪装站点

sudo timedatectl set-timezone America/Los_Angeles
sudo apt install -y language-pack-en
sudo localectl set-locale LANG=en_US.UTF-8
timedatectl   # Time zone: America/Los_Angeles (PST, -0800)

vless://<UUID>@<VPS_IP>:<PORT>?encryption=none&flow=xtls-rprx-vision&security=reality&sni=<SNI>&fp=chrome&pbk=<PUBLIC_KEY>&sid=<SHORT_ID>&type=tcp#<NAME>

mkdir -p /etc/apt/keyrings
curl -fsSL https://sing-box.app/gpg.key -o /etc/apt/keyrings/sagernet.asc
chmod a+r /etc/apt/keyrings/sagernet.asc
cat > /etc/apt/sources.list.d/sagernet.sources <<'EOS'
Types: deb
URIs: https://deb.sagernet.org/
Suites: *
Components: *
Enabled: yes
Signed-By: /etc/apt/keyrings/sagernet.asc
EOS
apt-get update && apt-get install -y sing-box

#!/usr/bin/env bash
# Debian + sing-box 透明代理网关（整理版）
# 用法（root）：bash setup-gateway.sh 'vless://<UUID>@<VPS_IP>:<PORT>?...'
set -euo pipefail
LINK="${1:?请传入 vless:// 链接}"
CONF="${SB_CONF:-/etc/sing-box/config.json}"

# 上网口 = 有默认路由的网卡；私有网口 = 另一张网卡
WAN=$(ip route show default | awk '{print $5; exit}')
LAN=$(ls /sys/class/net | grep -v -E "^(lo|tun.*|$WAN)$" | head -n1)
[ -n "$WAN" ] && [ -n "$LAN" ] || { echo "没找到两张网卡，请检查虚拟机网卡设置"; exit 1; }
echo "上网口: $WAN   私有网口: $LAN"
LAN_IP=10.10.10.1

if [ -z "${SKIP_SYSTEM:-}" ]; then
  apt-get update && apt-get install -y curl dnsmasq python3

  # 1. LAN 静态地址
  cat > /etc/network/interfaces.d/lan <<C
28 collapsed lines
auto $LAN
iface $LAN inet static
    address $LAN_IP/24
C
  ifup "$LAN" || ip addr add $LAN_IP/24 dev "$LAN"; ip link set "$LAN" up

  # 2. 转发
  echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-fwd.conf && sysctl --system >/dev/null

  # 3. DHCP（只发地址，DNS 交给 sing-box 劫持）
  cat > /etc/dnsmasq.d/lan.conf <<C
interface=$LAN
bind-interfaces
port=0
dhcp-range=10.10.10.100,10.10.10.200,12h
dhcp-option=3,$LAN_IP
dhcp-option=6,$LAN_IP
C
  systemctl restart dnsmasq && systemctl enable dnsmasq

  # 4. 安装 sing-box：走 SagerNet 官方 apt 源（GitHub API 限流时 install.sh 会失败）
  if ! command -v sing-box >/dev/null; then
    mkdir -p /etc/apt/keyrings
    curl -fsSL https://sing-box.app/gpg.key -o /etc/apt/keyrings/sagernet.asc
    chmod a+r /etc/apt/keyrings/sagernet.asc
    printf 'Types: deb\nURIs: https://deb.sagernet.org/\nSuites: *\nComponents: *\nEnabled: yes\nSigned-By: /etc/apt/keyrings/sagernet.asc\n' \
      > /etc/apt/sources.list.d/sagernet.sources
    apt-get update && apt-get install -y sing-box
  fi
fi

# 5. 解析 vless 链接生成配置
mkdir -p "$(dirname "$CONF")"
python3 - "$LINK" "$WAN" "$CONF" <<'PY'
import sys, json, urllib.parse as u
link, wan, conf = sys.argv[1:4]
l = u.urlparse(link); q = dict(u.parse_qsl(l.query))
node = {"type": "vless", "tag": "my-node", "server": l.hostname, "server_port": l.port or 443,
        "uuid": u.unquote(l.username), "flow": q.get("flow", ""),
        "tls": {"enabled": True, "server_name": q.get("sni", ""),
                "utls": {"enabled": True, "fingerprint": q.get("fp", "chrome")},
                "reality": {"enabled": True, "public_key": q.get("pbk", ""), "short_id": q.get("sid", "")}}}
cfg = {
  "log": {"level": "warn"},
  "dns": {"servers": [{"type": "https", "tag": "remote", "server": "1.1.1.1", "detour": "my-node"}]},
  "inbounds": [{"type": "tun", "tag": "tun-in", "address": ["172.19.0.1/30"],
                "auto_route": True, "auto_redirect": True, "strict_route": True}],
  "outbounds": [node, {"type": "direct", "tag": "direct"}],
  "route": {
    "rules": [
      {"action": "sniff"},
      {"protocol": "dns", "action": "hijack-dns"},
      # 连节点本身的流量必须直连，否则会“自己代理自己”
      {"ip_cidr": [f"{l.hostname}/32"], "outbound": "direct"},
    ],
    "final": "my-node",
    # 这台 VM 上 auto_detect_interface 会报 missing default interface，直接写死上网口
    "default_interface": wan,
  },
}
json.dump(cfg, open(conf, "w"), indent=2)
PY

sing-box check -c "$CONF"
[ -n "${SKIP_SYSTEM:-}" ] && exit 0
systemctl enable sing-box && systemctl restart sing-box
echo "完成：Windows 接到私有网络后会自动拿到 10.10.10.x 地址。"
echo "检查状态: systemctl status sing-box ; 换节点: 重新运行本脚本并传入新链接"

systemctl is-active sing-box dnsmasq       # 两个都该是 active
systemctl status sing-box --no-pager -l
journalctl -u sing-box -n 50 --no-pager
ip -br a | grep -E 'tun|enp'
curl -s https://api.ipify.org; echo        # 应该是 <VPS_IP>

table inet killswitch {
  chain forward {
    type filter hook forward priority 0; policy accept;
    iifname "enp10s0" oifname "enp2s0" drop
  }
}

tzutil /g                                   # 查看当前时区 ID
tzutil /s "Pacific Standard Time"   # (UTC-08:00) Pacific Time (US & Canada)，夏令时自动切换
Get-TimeZone

Get-WinSystemLocale
Get-Culture
Get-WinUserLanguageList

# 保持英文界面，追加中文输入
$list = Get-WinUserLanguageList
$list.Add("zh-CN")
Set-WinUserLanguageList $list -Force

services:
  cli-proxy-api:
    image: eceasy/cli-proxy-api:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:<PORT>:<PORT>"   # 只给本机的 Caddy 用
    environment:
      - TZ=America/Los_Angeles
    volumes:
      - ./cli-proxy-api/config.yaml:/CLIProxyAPI/config.yaml
      - ./cli-proxy-api/auth:/root/.cli-proxy-api   # OAuth 凭证在这里
      - /etc/localtime:/etc/localtime:ro

config-version: 8
server:
  port: <PORT>
management:
  allow-remote: true            # 要在别的机器上开管理面板才需要
  secret-key: "<MANAGEMENT_KEY>"
access:
  api-keys:
    - "<API_KEY>"               # 给客户端用的 key，不是 Claude 的

<你的域名> {
    reverse_proxy 127.0.0.1:<PORT>
}

export ANTHROPIC_BASE_URL="https://<你的域名>"
export ANTHROPIC_AUTH_TOKEN="<API_KEY>"
claude

bypass_tunnel_proxy:
  - "<VPS_IP>/32"
vif_excluded_routes:
  - "<VPS_IP>/32"

VMRUN="/Applications/VMware Fusion.app/Contents/Library/vmrun"
GW_VMX="$HOME/Virtual Machines.localized/Debian 12 AI Agent Gateway.vmwarevm/Debian 12 AI Agent Gateway.vmx"

alias gw-up='"$VMRUN" -T fusion start "$GW_VMX" nogui'
alias gw-down='"$VMRUN" -T fusion stop "$GW_VMX" soft'
alias gw-ip='"$VMRUN" -T fusion getGuestIPAddress "$GW_VMX" -wait'
alias vms='"$VMRUN" list'

Intl.DateTimeFormat().resolvedOptions().timeZone   // "America/Los_Angeles"
new Date().getTimezoneOffset()                     // 480，也就是 UTC-8（夏令时是 420）