TUIC

第一次连接：
客户端 --[完整握手]--> 服务端（1-RTT）

后续连接复用：
客户端 --[0-RTT 恢复]--> 服务端（0-RTT，几乎无握手延迟）

客户端
  |
  | 1. 向服务端发起 QUIC 握手（UDP，含 TLS 1.3）
  | 2. 在 QUIC 连接上发送 TUIC 认证信息（UUID + 密码）
  | 3. 认证成功后，通过 QUIC Stream 发送代理请求
  v
服务端
  |
  | 4. 验证 UUID 和密码
  | 5. 解析代理目标地址
  | 6. 建立到目标的连接
  v
目标服务器

QUIC 连接（单一 UDP 连接）
  ├── Stream 1 → 请求 A（Google）
  ├── Stream 2 → 请求 B（GitHub）
  ├── Stream 3 → 请求 C（YouTube）
  └── Datagram  → UDP 请求 D（DNS）

# 查看最新版本，替换下面的版本号
wget https://github.com/EAimTY/tuic/releases/latest/download/tuic-server-1.x.x-x86_64-unknown-linux-musl
chmod +x tuic-server-*
mv tuic-server-* /usr/local/bin/tuic-server

# 使用 acme.sh 申请 Let's Encrypt 证书
curl https://get.acme.sh | sh
~/.acme.sh/acme.sh --issue -d your.domain.com --webroot /var/www/html
~/.acme.sh/acme.sh --install-cert -d your.domain.com \
  --cert-file /etc/tuic/cert.crt \
  --key-file /etc/tuic/private.key \
  --reloadcmd "systemctl restart tuic-server"

# Linux 系统工具
cat /proc/sys/kernel/random/uuid

# 或者使用 Python
python3 -c "import uuid; print(uuid.uuid4())"

{
    "server": "[::]:443",
    "users": {
        "your-uuid-here": "your-strong-password"
    },
    "certificate": "/etc/tuic/cert.crt",
    "private_key": "/etc/tuic/private.key",
    "congestion_control": "bbr",
    "alpn": ["h3"],
    "log_level": "warn"
}

{
    "server": "[::]:443",
    "users": {
        "uuid-for-user1": "password-for-user1",
        "uuid-for-user2": "password-for-user2",
        "uuid-for-user3": "password-for-user3"
    },
    "certificate": "/etc/tuic/cert.crt",
    "private_key": "/etc/tuic/private.key",
    "congestion_control": "bbr",
    "alpn": ["h3"],
    "log_level": "warn"
}

[Unit]
Description=TUIC Server
After=network.target

[Service]
Type=simple
User=nobody
ExecStart=/usr/local/bin/tuic-server -c /etc/tuic/config.json
Restart=on-failure
RestartSec=10

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable tuic-server
systemctl start tuic-server
systemctl status tuic-server

# 查看日志
journalctl -u tuic-server -f

# 开放 UDP 443 端口
ufw allow 443/udp

{
  "type": "tuic",
  "tag": "tuic-node",
  "server": "your.domain.com",
  "server_port": 443,
  "uuid": "your-uuid-here",
  "password": "your-strong-password",
  "congestion_control": "bbr",
  "tls": {
    "enabled": true,
    "server_name": "your.domain.com",
    "alpn": ["h3"]
  }
}

proxies:
  - name: "tuic-node"
    type: tuic
    server: your.domain.com
    port: 443
    uuid: your-uuid-here
    password: your-strong-password
    alpn:
      - h3
    congestion-controller: bbr
    sni: your.domain.com
    skip-cert-verify: false