SHADOWSOCKS 补完

{
  "server": "0.0.0.0",
  "server_port": 443,
  "password": "<strong-random-password>",
  "method": "aes-256-gcm",
  "mode": "tcp_only",
  "plugin": "/usr/local/bin/http2-obfs",
  "plugin_opts": "mode=server;host=example.com;path=/cdn-cgi/trace"
}

[Unit]
Description=Shadowsocks Rust Server
After=network-online.target
Wants=network-online.target

[Service]
User=shadowsocks
Group=shadowsocks
ExecStart=/usr/local/bin/ssserver -c /etc/shadowsocks-rust/server.json
Restart=on-failure
RestartSec=3
AmbientCapabilities=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
LimitNOFILE=1048576

[Install]
WantedBy=multi-user.target

{
  "server": "<vps-public-ip-or-domain>",
  "server_port": 443,
  "local_address": "127.0.0.1",
  "local_port": 1080,
  "password": "<same-strong-random-password>",
  "method": "aes-256-gcm",
  "plugin": "/usr/local/bin/http2-obfs",
  "plugin_opts": "mode=client;host=example.com;path=/cdn-cgi/trace"
}

type Config struct {
    LocalAddr  string
    RemoteAddr string
    Mode       string
    Host       string
    Path       string
}

func loadConfig() Config {
    opts := parseOpts(os.Getenv("SS_PLUGIN_OPTIONS"))

    local := net.JoinHostPort(
        env("SS_LOCAL_HOST", "127.0.0.1"),
        mustEnv("SS_LOCAL_PORT"),
    )

    remote := net.JoinHostPort(
        mustEnv("SS_REMOTE_HOST"),
        mustEnv("SS_REMOTE_PORT"),
    )

    return Config{
        LocalAddr:  local,
        RemoteAddr: remote,
        Mode:       opts["mode"],
        Host:       valueOr(opts["host"], "example.com"),
        Path:       valueOr(opts["path"], "/cdn-cgi/trace"),
    }
}

func chooseRoute(c Config) (listenAddr string, forwardAddr string) {
    if c.Mode == "server" {
        return c.RemoteAddr, c.LocalAddr
    }
    return c.LocalAddr, c.RemoteAddr
}

type frameWriter struct {
    mu sync.Mutex
    f  *http2.Framer
}

func newFrameWriter(w io.Writer) *frameWriter {
    return &frameWriter{f: http2.NewFramer(w, nil)}
}

func (w *frameWriter) writeData(streamID uint32, payload []byte) error {
    w.mu.Lock()
    defer w.mu.Unlock()
    return w.f.WriteData(streamID, true, payload)
}

func rawToHTTP2(raw io.Reader, fw *frameWriter, host, path string) error {
    streamID := uint32(1)
    buf := make([]byte, 16*1024)

    for {
        n, err := raw.Read(buf)
        if err != nil {
            return err
        }

        var header bytes.Buffer
        enc := hpack.NewEncoder(&header)
        _ = enc.WriteField(hpack.HeaderField{Name: ":method", Value: "POST"})
        _ = enc.WriteField(hpack.HeaderField{Name: ":scheme", Value: "https"})
        _ = enc.WriteField(hpack.HeaderField{Name: ":authority", Value: host})
        _ = enc.WriteField(hpack.HeaderField{Name: ":path", Value: path})
        _ = enc.WriteField(hpack.HeaderField{Name: "content-type", Value: "application/octet-stream"})

        fw.mu.Lock()
        _ = fw.f.WriteHeaders(http2.HeadersFrameParam{
            StreamID:      streamID,
            EndHeaders:    true,
            BlockFragment: header.Bytes(),
        })
        err = fw.f.WriteData(streamID, true, buf[:n])
        fw.mu.Unlock()

        if err != nil {
            return err
        }

        streamID += 2
    }
}

systemctl status ssserver --no-pager
systemctl is-enabled ssserver
ss -ltnp | grep ':443'
journalctl -u ssserver -n 100 --no-pager
curl --proxy socks5h://127.0.0.1:1080 https://example.com -I
curl --proxy socks5h://127.0.0.1:1080 https://ifconfig.me
for i in $(seq 1 100); do
  curl -fsS --proxy socks5h://127.0.0.1:1080 https://example.com >/dev/null || exit 1
done
echo "100 requests passed"