阿里云VPS打造家庭网络中枢：内网穿透+远程桌面+代理一站式搭建

系统：Ubuntu 22.04.5 LTS
CPU：2核 Intel Xeon Platinum
内存：1.6GB
硬盘：40GB SSD

# 更新系统
apt update && apt upgrade -y

# 安装基础工具
apt install -y curl wget git vim htop net-tools

# 安装 Docker
curl -fsSL https://get.docker.com | sh
systemctl enable docker
systemctl start docker

# 下载最新版 FRP
wget https://github.com/fatedier/frp/releases/download/v0.62.1/frp_0.62.1_linux_amd64.tar.gz
tar -xzf frp_0.62.1_linux_amd64.tar.gz
mv frp_0.62.1_linux_amd64 /opt/frp

mkdir -p /etc/frp
cat > /etc/frp/frps.toml << 'EOF'
bindPort = 7000
vhostHTTPPort = 8081

auth.method = "token"
auth.token = "你的安全密钥"

webServer.addr = "0.0.0.0"
webServer.port = 81
webServer.user = "admin"
webServer.password = "你的管理密码"
EOF

cat > /etc/systemd/system/frps.service << 'EOF'
[Unit]
Description=Frp Server Service
After=network.target

[Service]
Type=simple
ExecStart=/opt/frp/frps -c /etc/frp/frps.toml
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

systemctl enable frps
systemctl start frps

# frpc.toml
serverAddr = "VPS公网IP"
serverPort = 7000
auth.token = "你的安全密钥"

# 映射 SubStore 服务
[[proxies]]
name = "substore"
type = "tcp"
localIP = "127.0.0.1"
localPort = 3000
remotePort = 3003

# 映射 SSH
[[proxies]]
name = "ssh"
type = "tcp"
localIP = "127.0.0.1"
localPort = 22
remotePort = 2222

# 创建目录
mkdir -p /opt/rustdesk

# 运行 hbbs (ID/信号服务器)
docker run --name hbbs \
  -d --restart always \
  -p 21115:21115 \
  -p 21116:21116 \
  -p 21116:21116/udp \
  -p 21118:21118 \
  -v /opt/rustdesk:/root \
  rustdesk/rustdesk-server:latest \
  hbbs -r VPS公网IP

# 运行 hbbr (中继服务器)
docker run --name hbbr \
  -d --restart always \
  -p 21117:21117 \
  -p 21119:21119 \
  -v /opt/rustdesk:/root \
  rustdesk/rustdesk-server:latest \
  hbbr

docker run --restart always \
  --name derper \
  -d \
  -p 59443:443 \
  -p 3478:3478/udp \
  ghcr.io/yangchuansheng/ip_derper:latest

"derpMap": {
  "OmitDefaultRegions": false,
  "Regions": {
    "901": {
      "RegionID": 901,
      "RegionCode": "sh",
      "RegionName": "Shanghai Aliyun",
      "Nodes": [{
        "Name": "901",
        "RegionID": 901,
        "HostName": "VPS公网IP",
        "DERPPort": 59443,
        "IPv4": "VPS公网IP",
        "InsecureForTests": true,
        "STUNPort": 3478
      }]
    }
  }
}

# 安装
export url='https://fastly.jsdelivr.net/gh/juewuy/ShellCrash@master' && sh -c "$(curl -kfsSl $url/install.sh)" && source /etc/profile &> /dev/null

# 测试是否能访问 Google
curl -sI https://www.google.com

apt install -y nginx certbot python3-certbot-nginx

cat > /etc/nginx/sites-available/sub.example.com << 'EOF'
server {
    listen 80;
    server_name sub.example.com;

    location / {
        proxy_pass http://127.0.0.1:3003;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}
EOF

ln -sf /etc/nginx/sites-available/sub.example.com /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx

# 在 DNS 添加 A 记录指向 VPS IP 后执行
certbot --nginx -d sub.example.com --non-interactive --agree-tos --email [email protected]

                    ┌─────────────────────────────────────┐
                    │       阿里云 VPS (上海节点)          │
                    │                                     │
    外网访问 ───────►│  ┌─────────┐  ┌─────────────────┐  │
                    │  │  Nginx  │  │   ShellCrash    │  │
                    │  │ :80/:443│  │   透明代理       │  │
                    │  └────┬────┘  └─────────────────┘  │
                    │       │                             │
                    │  ┌────▼────┐  ┌─────────────────┐  │
                    │  │   FRP   │  │    RustDesk     │  │
                    │  │  :7000  │  │  :21115-21119   │  │
                    │  └────┬────┘  └─────────────────┘  │
                    │       │                             │
                    │  ┌────▼────┐  ┌─────────────────┐  │
                    │  │内网穿透 │  │  DERP (Tailscale)│  │
                    │  │:3003等  │  │  :59443/:3478   │  │
                    │  └────┬────┘  └─────────────────┘  │
                    └───────│─────────────────────────────┘
                            │
                    ┌───────▼─────────┐
                    │   家庭 NAS/Mac   │
                    │   (FRP 客户端)   │
                    │   SubStore 等    │
                    └─────────────────┘

apt install -y fail2ban
systemctl enable fail2ban