NaiveProxy

传统代理工具：
自定义 TLS 实现 → TLS 指纹与浏览器不同 → 可被识别

NaiveProxy：
直接使用 Chromium 网络栈 → TLS 指纹与 Chrome 完全一致 → 无法通过指纹区分

客户端（Chromium 网络栈）
  |
  | HTTPS CONNECT 请求（通过 HTTP/2 或 HTTP/3）
  | Host: your.domain.com
  | Proxy-Authorization: Basic [认证信息]
  v
代理服务端（通常是 Caddy + forward_proxy 模块）
  |
  | 验证认证信息
  | 建立到目标的连接
  v
目标服务器

# 从 GitHub Releases 下载预编译的 naive Caddy 服务端
# 访问 https://github.com/klzgrad/naiveproxy/releases 获取最新版本

wget https://github.com/klzgrad/naiveproxy/releases/latest/download/naiveproxy-plugin-linux-amd64.tar.xz
tar -xJf naiveproxy-plugin-linux-amd64.tar.xz

chmod +x caddy
mv caddy /usr/local/bin/caddy-naive

your.domain.com {
    route {
        forward_proxy {
            basic_auth your_username your_password
            hide_ip
            hide_via
            probe_resistance secret_token
        }
        reverse_proxy https://www.example.com {
            header_up Host {upstream_hostport}
        }
    }
}

{
  "apps": {
    "http": {
      "servers": {
        "naive": {
          "listen": [":443"],
          "routes": [
            {
              "handle": [
                {
                  "handler": "forward_proxy",
                  "auth_user_deprecated": "your_username",
                  "auth_pass_deprecated": "your_password",
                  "hide_ip": true,
                  "hide_via": true,
                  "probe_resistance": {
                    "domain": "secret.your.domain.com"
                  }
                }
              ]
            },
            {
              "handle": [
                {
                  "handler": "reverse_proxy",
                  "upstreams": [
                    {
                      "dial": "www.example.com:443"
                    }
                  ]
                }
              ]
            }
          ],
          "tls_connection_policies": [
            {
              "certificate_selection": {
                "any_tag": ["cert0"]
              }
            }
          ]
        }
      }
    },
    "tls": {
      "automation": {
        "policies": [
          {
            "subjects": ["your.domain.com"],
            "issuers": [
              {
                "module": "acme"
              }
            ]
          }
        ]
      }
    }
  }
}

[Unit]
Description=NaiveProxy Caddy Server
After=network.target

[Service]
Type=simple
User=caddy
Group=caddy
ExecStart=/usr/local/bin/caddy-naive run --config /etc/caddy/Caddyfile
ExecReload=/usr/local/bin/caddy-naive reload --config /etc/caddy/Caddyfile
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

# 创建 Caddy 运行用户（可选，提升安全性）
useradd -r -s /bin/false caddy

# 创建配置目录
mkdir -p /etc/caddy

# 将 Caddyfile 放入配置目录
cp Caddyfile /etc/caddy/

# 启动服务
systemctl daemon-reload
systemctl enable caddy-naive
systemctl start caddy-naive
systemctl status caddy-naive

# 查看日志
journalctl -u caddy-naive -f

ufw allow 80/tcp    # HTTP，用于 ACME 证书申请验证
ufw allow 443/tcp   # HTTPS

# https://github.com/klzgrad/naiveproxy/releases
# 选择对应系统架构的版本，如 naiveproxy-v*-linux-amd64.tar.xz

wget https://github.com/klzgrad/naiveproxy/releases/latest/download/naiveproxy-v127.x-linux-amd64.tar.xz
tar -xJf naiveproxy-*.tar.xz
chmod +x naive
mv naive /usr/local/bin/naive

{
  "listen": "socks://127.0.0.1:1080",
  "proxy": "https://your_username:your_password@your.domain.com"
}

{
  "listen": "http://127.0.0.1:8080",
  "proxy": "https://your_username:your_password@your.domain.com"
}

{
  "listen": "socks://127.0.0.1:1080",
  "proxy": "quic://your_username:your_password@your.domain.com"
}

naive --config=/path/to/config.json

{
  "type": "http",
  "tag": "naive-node",
  "server": "your.domain.com",
  "server_port": 443,
  "username": "your_username",
  "password": "your_password",
  "tls": {
    "enabled": true,
    "server_name": "your.domain.com"
  }
}