feat(proj): init

scripts/open_xray_listen.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Run on the Ubuntu host (not inside Docker).
+# Makes Xray SOCKS/HTTP inbounds listen on 0.0.0.0 so containers can reach them.
+set -euo pipefail
+
+CONFIG="${XRAY_CONFIG:-/usr/local/etc/xray/config.json}"
+
+if [[ ! -f "$CONFIG" ]]; then
+  echo "Xray config not found: $CONFIG" >&2
+  exit 1
+fi
+
+if ! command -v python3 >/dev/null; then
+  echo "python3 is required" >&2
+  exit 1
+fi
+
+sudo python3 - "$CONFIG" <<'PY'
+import json
+import sys
+from pathlib import Path
+
+path = Path(sys.argv[1])
+data = json.loads(path.read_text(encoding="utf-8"))
+changed = False
+
+for inbound in data.get("inbounds", []):
+    port = inbound.get("port")
+    tag = inbound.get("tag", "")
+    if port in (10808, 10809) or tag in ("socks-in", "http-in"):
+        if inbound.get("listen") != "0.0.0.0":
+            inbound["listen"] = "0.0.0.0"
+            changed = True
+            print(f"set listen=0.0.0.0 for inbound port={port} tag={tag!r}")
+
+if not changed:
+    print("no changes needed (already 0.0.0.0 or ports not found)")
+else:
+    path.write_text(json.dumps(data, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+    print(f"updated {path}")
+PY
+
+sudo systemctl restart xray
+sudo systemctl --no-pager --full status xray | head -n 20
+
+echo
+echo "Security: 0.0.0.0 exposes the proxy on all interfaces."
+echo "Restrict with firewall, e.g. allow only Docker bridge:"
+echo "  sudo ufw allow from 172.17.0.0/16 to any port 10808 proto tcp"
+echo "  sudo ufw allow from 172.17.0.0/16 to any port 10809 proto tcp"
+echo "  sudo ufw deny 10808/tcp"
+echo "  sudo ufw deny 10809/tcp"