docs: update docs

This commit is contained in:
lxien
2026-08-29 23:30:11 +08:00
parent 1326a478c9
commit 63f0d14d2f
12 changed files with 199 additions and 103 deletions
+38
View File
@@ -0,0 +1,38 @@
---
sidebar_position: 4
sidebar_label: 数据压缩
title: 数据压缩
---
# 数据压缩
开启数据压缩可以节省带宽,开启后,数据连接上转发的数据按块压缩,仅在体积更小时发送压缩结果,否则原样转发。
- `compression = "none"`:关闭(默认)
- `compression = "lz4"`:启用 LZ4
## 示例:启用 LZ4
```toml
# orbien.toml
server = "YOUR_SERVER_IP:9527"
[[tunnels]]
name = "ssh"
protocol = "tcp"
service = "127.0.0.1:22"
remotePort = 9000
transport.compression = "lz4"
```
:::tip
- 已加密或已压缩内容通常压缩不会带来收益,还会增加 CPU,建议不要开启压缩
- 文本、日志等可压流量,在带宽受限链路上开启压缩更有收益
:::
## 参数
| 参数 | 必填 | 默认值 | 说明 |
|-------------------------|----|--------|---------------------|
| `transport.compression` | 否 | `none` | 压缩算法:`none` / `lz4` |
+15 -14
View File
@@ -93,17 +93,18 @@ hostHeaderRewrite = "127.0.0.1"
## 参数
| 参数 | 必填 | 默认值 | 说明 |
|----------------------------------|-----|-------------|-------------------------------------------------------|
| `name` | 是 | | 隧道名称,唯一 |
| `protocol` | 是 | | 固定为 `http` |
| `service` | 是 | | 本地服务地址,如 `127.0.0.1:8080` |
| `domains` | 是 | | 域名列表,至少一个;完整域名或无 `.` 的前缀(前缀需服务端 `rootDomain` |
| `locations` | 否 | | 路径前缀,如 `/api`;空表示全部 |
| `basicAuthUser` | 否 | | HTTP Basic 鉴权用户名;与 `basicAuthPassword` 都为空则不鉴权 |
| `basicAuthPassword` | 否 | | HTTP Basic 鉴权密码 |
| `routeByHTTPUser` | 否 | | 按请求 Basic 用户名选路由;空表示匹配任意用户(精确用户优先) |
| `hostHeaderRewrite` | 否 | | 改写转发到本地服务的 Host;空表示不改 |
| `transport.bandwidth` | 否 | `0` | 带宽上限(Mbps);`0` 表示不限制 |
| `transport.bandwidthLimitSide` | 否 | `client` | 限速端:`client` / `server` |
| `transport.proxyProtocolVersion` | 否 | | PROXY Protocol`v1` / `v2` |
| 参数 | 必填 | 默认值 | 说明 |
|----------------------------------|----|----------|------------------------------------------------|
| `name` | 是 | | 隧道名称,唯一 |
| `protocol` | 是 | | 固定为 `http` |
| `service` | 是 | | 本地服务地址,如 `127.0.0.1:8080` |
| `domains` | 是 | | 域名列表,至少一个;完整域名或无 `.` 的前缀(前缀需服务端 `rootDomain` |
| `locations` | 否 | | 路径前缀,如 `/api`;空表示全部 |
| `basicAuthUser` | 否 | | HTTP Basic 鉴权用户名;与 `basicAuthPassword` 都为空则不鉴权 |
| `basicAuthPassword` | 否 | | HTTP Basic 鉴权密码 |
| `routeByHTTPUser` | 否 | | 按请求 Basic 用户名选路由;空表示匹配任意用户(精确用户优先) |
| `hostHeaderRewrite` | 否 | | 改写转发到本地服务的 Host;空表示不改 |
| `transport.bandwidth` | 否 | `0` | 带宽上限(Mbps);`0` 表示不限制 |
| `transport.bandwidthLimitSide` | 否 | `client` | 限速端:`client` / `server` |
| `transport.proxyProtocolVersion` | 否 | | PROXY Protocol`v1` / `v2` |
| `transport.compression` | 否 | `none` | 压缩算法:`none` / `lz4` |
+18 -16
View File
@@ -64,7 +64,8 @@ certFile = "/path/to/cert.pem"
keyFile = "/path/to/key.pem"
```
`certFile` / `keyFile` 可省略,省略时使用临时自签证书(浏览器会提示不受信任)。启用插件后使用 `plugin.service` 指向本地 HTTP,不再使用隧道级 `service`,且不可配置 PROXY Protocol。
`certFile` / `keyFile` 可省略,省略时使用临时自签证书(浏览器会提示不受信任)。启用插件后使用 `plugin.service` 指向本地
HTTP,不再使用隧道级 `service`,且不可配置 PROXY Protocol。
## 示例:TLS 终止时改写 Host
@@ -106,18 +107,19 @@ X-From = "orbien"
## 参数
| 参数 | 必填 | 默认值 | 说明 |
|----------------------------------|----|-------------|-------------------------------------------------------|
| `name` | 是 | | 隧道名称,唯一 |
| `protocol` | 是 | | 固定为 `https` |
| `service` | 条件 | | 本地服务地址(透传必填),如 `127.0.0.1:443` |
| `domains` | 是 | | 域名列表,至少一个;完整域名或无 `.` 的前缀(前缀需服务端 `rootDomain` |
| `plugin.type` | 否 | | `tls-term`:客户端终止 TLS |
| `plugin.service` | 条件 | | `tls-term` 时必填,如 `127.0.0.1:80` |
| `plugin.certFile` | 否 | | 证书路径;空则临时自签 |
| `plugin.keyFile` | 否 | | 私钥路径;空则临时自签 |
| `plugin.hostHeaderRewrite` | 否 | | 改写转发到本地服务的 Host;空表示不改 |
| `plugin.requestHeaders.set` | 否 | | 向后端追加请求头,键值对 |
| `transport.bandwidth` | 否 | `0` | 带宽上限(Mbps);`0` 表示不限制 |
| `transport.bandwidthLimitSide` | 否 | `client` | 限速端:`client` / `server` |
| `transport.proxyProtocolVersion` | 否 | | PROXY Protocol`v1` / `v2``tls-term` 不可用) |
| 参数 | 必填 | 默认值 | 说明 |
|----------------------------------|----|----------|-----------------------------------------------|
| `name` | 是 | | 隧道名称,唯一 |
| `protocol` | 是 | | 固定为 `https` |
| `service` | 条件 | | 本地服务地址(透传必填),如 `127.0.0.1:443` |
| `domains` | 是 | | 域名列表,至少一个;完整域名或无 `.` 的前缀(前缀需服务端 `rootDomain` |
| `plugin.type` | 否 | | `tls-term`:客户端终止 TLS |
| `plugin.service` | 条件 | | `tls-term` 时必填,如 `127.0.0.1:80` |
| `plugin.certFile` | 否 | | 证书路径;空则临时自签 |
| `plugin.keyFile` | 否 | | 私钥路径;空则临时自签 |
| `plugin.hostHeaderRewrite` | 否 | | 改写转发到本地服务的 Host;空表示不改 |
| `plugin.requestHeaders.set` | 否 | | 向后端追加请求头,键值对 |
| `transport.bandwidth` | 否 | `0` | 带宽上限(Mbps);`0` 表示不限制 |
| `transport.bandwidthLimitSide` | 否 | `client` | 限速端:`client` / `server` |
| `transport.proxyProtocolVersion` | 否 | | PROXY Protocol`v1` / `v2``tls-term` 不可用) |
| `transport.compression` | 否 | `none` | 压缩算法:`none` / `lz4` |
+1
View File
@@ -55,3 +55,4 @@ curl --socks5 YOUR_SERVER_IP:9000 -U admin:123456 http://example.com
| `transport.bandwidth` | 否 | `0` | 带宽上限(Mbps);`0` 表示不限制 |
| `transport.bandwidthLimitSide` | 否 | `client` | 限速端:`client` / `server` |
| `transport.proxyProtocolVersion` | 否 | | PROXY Protocol`v1` / `v2` |
| `transport.compression` | 否 | `none` | 压缩算法:`none` / `lz4` |
+10 -9
View File
@@ -38,12 +38,13 @@ ssh -p 9000 user@YOUR_SERVER_IP
## 参数
| 参数 | 必填 | 默认值 | 说明 |
|----------------------------------|----|-------------|-----------------------------|
| `name` | 是 | | 隧道名称,唯一 |
| `protocol` | 是 | | 固定为 `tcp` |
| `service` | 是 | | 本地服务地址,如 `127.0.0.1:22` |
| `remotePort` | 是 | | 服务端对外监听端口 |
| `transport.bandwidth` | 否 | `0` | 带宽上限(Mbps);`0` 表示不限制 |
| `transport.bandwidthLimitSide` | 否 | `client` | 限速端:`client` / `server` |
| `transport.proxyProtocolVersion` | 否 | | PROXY Protocol`v1` / `v2` |
| 参数 | 必填 | 默认值 | 说明 |
|----------------------------------|----|----------|----------------------------|
| `name` | 是 | | 隧道名称,唯一 |
| `protocol` | 是 | | 固定为 `tcp` |
| `service` | 是 | | 本地服务地址,如 `127.0.0.1:22` |
| `remotePort` | 是 | | 服务端对外监听端口 |
| `transport.bandwidth` | 否 | `0` | 带宽上限(Mbps);`0` 表示不限制 |
| `transport.bandwidthLimitSide` | 否 | `client` | 限速端:`client` / `server` |
| `transport.proxyProtocolVersion` | 否 | | PROXY Protocol`v1` / `v2` |
| `transport.compression` | 否 | `none` | 压缩算法:`none` / `lz4` |
+11 -10
View File
@@ -38,13 +38,14 @@ dig @YOUR_SERVER_IP -p 9000 example.com
## 参数
| 参数 | 必填 | 默认值 | 说明 |
|----------------------------------|----|-------------|-----------------------------|
| `udpPacketSize` | 否 | `1500` | UDP 最大报文长度,客户端与服务端需一致 |
| `name` | 是 | | 隧道名称,唯一 |
| `protocol` | 是 | | 固定为 `udp` |
| `service` | 是 | | 本地服务地址,如 `127.0.0.1:53` |
| `remotePort` | 是 | | 服务端对外监听端口 |
| `transport.bandwidth` | 否 | `0` | 带宽上限(Mbps);`0` 表示不限制 |
| `transport.bandwidthLimitSide` | 否 | `client` | 限速端:`client` / `server` |
| `transport.proxyProtocolVersion` | 否 | | PROXY Protocol`v1` / `v2` |
| 参数 | 必填 | 默认值 | 说明 |
|----------------------------------|----|----------|----------------------------|
| `udpPacketSize` | 否 | `1500` | UDP 最大报文长度,客户端与服务端需一致 |
| `name` | 是 | | 隧道名称,唯一 |
| `protocol` | 是 | | 固定为 `udp` |
| `service` | 是 | | 本地服务地址,如 `127.0.0.1:53` |
| `remotePort` | 是 | | 服务端对外监听端口 |
| `transport.bandwidth` | 否 | `0` | 带宽上限(Mbps);`0` 表示不限制 |
| `transport.bandwidthLimitSide` | 否 | `client` | 限速端:`client` / `server` |
| `transport.proxyProtocolVersion` | 否 | | PROXY Protocol`v1` / `v2` |
| `transport.compression` | 否 | `none` | 压缩算法:`none` / `lz4` |
@@ -0,0 +1,40 @@
---
sidebar_position: 4
sidebar_label: Data Compression
title: Data Compression
---
# Data Compression
Data compression saves bandwidth. When enabled, data forwarded on data connections is compressed in chunks; the
compressed form is sent only when it is smaller, otherwise the original bytes are forwarded unchanged.
- `compression = "none"`: off (default)
- `compression = "lz4"`: enable LZ4
## Example: Enable LZ4
```toml
# orbien.toml
server = "YOUR_SERVER_IP:9527"
[[tunnels]]
name = "ssh"
protocol = "tcp"
service = "127.0.0.1:22"
remotePort = 9000
transport.compression = "lz4"
```
:::tip
- Already encrypted or compressed payloads usually gain little from compression and cost extra CPU; leave compression
off
- Text, logs, and other compressible traffic benefit more on bandwidth-constrained links
:::
## Parameters
| Parameter | Required | Default | Description |
|-------------------------|----------|---------|---------------------------------------|
| `transport.compression` | No | `none` | Compression algorithm: `none` / `lz4` |
@@ -6,9 +6,11 @@ title: HTTP
# HTTP
Expose an internal HTTP service to the public internet by domain. The server must enable the domain gateway; see [Domains](./domains.md).
Expose an internal HTTP service to the public internet by domain. The server must enable the domain gateway;
see [Domains](./domains.md).
`domains` is required and must be non-empty: a full domain (e.g. `web.example.com`), or a short prefix with no `.` (e.g. `web`, which requires server `rootDomain`). Wildcards are not supported.
`domains` is required and must be non-empty: a full domain (e.g. `web.example.com`), or a short prefix with no `.` (e.g.
`web`, which requires server `rootDomain`). Wildcards are not supported.
## Example: Expose a web service
@@ -59,7 +61,8 @@ curl -u alice:secret http://web.example.com
## Example: Route by HTTP user
On the same domain, different Basic users can be routed to different local services. If no dedicated route matches, traffic falls back to a tunnel without `routeByHTTPUser` (if one exists).
On the same domain, different Basic users can be routed to different local services. If no dedicated route matches,
traffic falls back to a tunnel without `routeByHTTPUser` (if one exists).
```toml
[[tunnels]]
@@ -93,17 +96,18 @@ hostHeaderRewrite = "127.0.0.1"
## Parameters
| Parameter | Required | Default | Description |
|----------------------------------|----------|-------------|--------------------------------------------------------------------------------------------------|
| `name` | Yes | | Tunnel name; must be unique |
| `protocol` | Yes | | Always `http` |
| `service` | Yes | | Local service address, e.g. `127.0.0.1:8080` |
| `domains` | Yes | | Domain list; at least one; full domain or a prefix with no `.` (prefix requires server `rootDomain`) |
| `locations` | No | | Path prefix, e.g. `/api`; empty means all paths |
| `basicAuthUser` | No | | HTTP Basic username; if both this and `basicAuthPassword` are empty, auth is disabled |
| `basicAuthPassword` | No | | HTTP Basic password |
| `routeByHTTPUser` | No | | Select a route by the request Basic username; empty matches any user (exact user takes priority) |
| `hostHeaderRewrite` | No | | Rewrite Host when forwarding to the local service; empty means no rewrite |
| `transport.bandwidth` | No | `0` | Bandwidth cap (Mbps); `0` means unlimited |
| `transport.bandwidthLimitSide` | No | `client` | Limit side: `client` / `server` |
| `transport.proxyProtocolVersion` | No | | PROXY Protocol: `v1` / `v2` |
| Parameter | Required | Default | Description |
|----------------------------------|----------|----------|------------------------------------------------------------------------------------------------------|
| `name` | Yes | | Tunnel name; must be unique |
| `protocol` | Yes | | Always `http` |
| `service` | Yes | | Local service address, e.g. `127.0.0.1:8080` |
| `domains` | Yes | | Domain list; at least one; full domain or a prefix with no `.` (prefix requires server `rootDomain`) |
| `locations` | No | | Path prefix, e.g. `/api`; empty means all paths |
| `basicAuthUser` | No | | HTTP Basic username; if both this and `basicAuthPassword` are empty, auth is disabled |
| `basicAuthPassword` | No | | HTTP Basic password |
| `routeByHTTPUser` | No | | Select a route by the request Basic username; empty matches any user (exact user takes priority) |
| `hostHeaderRewrite` | No | | Rewrite Host when forwarding to the local service; empty means no rewrite |
| `transport.bandwidth` | No | `0` | Bandwidth cap (Mbps); `0` means unlimited |
| `transport.bandwidthLimitSide` | No | `client` | Limit side: `client` / `server` |
| `transport.proxyProtocolVersion` | No | | PROXY Protocol: `v1` / `v2` |
| `transport.compression` | No | `none` | Compression algorithm: `none` / `lz4` |
@@ -6,9 +6,11 @@ title: HTTPS
# HTTPS
Expose an internal service to the public internet by domain. The server must enable the domain gateway; see [Domains](./domains.md).
Expose an internal service to the public internet by domain. The server must enable the domain gateway;
see [Domains](./domains.md).
`domains` is required and must be non-empty: a full domain (e.g. `web.example.com`), or a short prefix with no `.` (e.g. `web`, which requires server `rootDomain`). Wildcards are not supported.
`domains` is required and must be non-empty: a full domain (e.g. `web.example.com`), or a short prefix with no `.` (e.g.
`web`, which requires server `rootDomain`). Wildcards are not supported.
Two modes:
@@ -64,7 +66,9 @@ certFile = "/path/to/cert.pem"
keyFile = "/path/to/key.pem"
```
`certFile` / `keyFile` may be omitted. If omitted, a temporary self-signed certificate is used (browsers will warn that it is untrusted). When the plugin is enabled, use `plugin.service` to point at local HTTP; the tunnel-level `service` is not used, and PROXY Protocol cannot be configured.
`certFile` / `keyFile` may be omitted. If omitted, a temporary self-signed certificate is used (browsers will warn that
it is untrusted). When the plugin is enabled, use `plugin.service` to point at local HTTP; the tunnel-level `service` is
not used, and PROXY Protocol cannot be configured.
## Example: Rewrite Host with TLS termination
@@ -106,18 +110,19 @@ X-From = "orbien"
## Parameters
| Parameter | Required | Default | Description |
|----------------------------------|-------------|-------------|--------------------------------------------------------------------------------------------------|
| `name` | Yes | | Tunnel name; must be unique |
| `protocol` | Yes | | Always `https` |
| `service` | Conditional | | Local service address (required for passthrough), e.g. `127.0.0.1:443` |
| `domains` | Yes | | Domain list; at least one; full domain or a prefix with no `.` (prefix requires server `rootDomain`) |
| `plugin.type` | No | | `tls-term`: terminate TLS on the client |
| `plugin.service` | Conditional | | Required for `tls-term`, e.g. `127.0.0.1:80` |
| `plugin.certFile` | No | | Certificate path; empty uses a temporary self-signed cert |
| `plugin.keyFile` | No | | Private key path; empty uses a temporary self-signed cert |
| `plugin.hostHeaderRewrite` | No | | Rewrite Host when forwarding to the local service; empty means no rewrite |
| `plugin.requestHeaders.set` | No | | Extra request headers to send to the backend; key-value pairs |
| `transport.bandwidth` | No | `0` | Bandwidth cap (Mbps); `0` means unlimited |
| `transport.bandwidthLimitSide` | No | `client` | Limit side: `client` / `server` |
| `transport.proxyProtocolVersion` | No | | PROXY Protocol: `v1` / `v2` (not available with `tls-term`) |
| Parameter | Required | Default | Description |
|----------------------------------|-------------|----------|------------------------------------------------------------------------------------------------------|
| `name` | Yes | | Tunnel name; must be unique |
| `protocol` | Yes | | Always `https` |
| `service` | Conditional | | Local service address (required for passthrough), e.g. `127.0.0.1:443` |
| `domains` | Yes | | Domain list; at least one; full domain or a prefix with no `.` (prefix requires server `rootDomain`) |
| `plugin.type` | No | | `tls-term`: terminate TLS on the client |
| `plugin.service` | Conditional | | Required for `tls-term`, e.g. `127.0.0.1:80` |
| `plugin.certFile` | No | | Certificate path; empty uses a temporary self-signed cert |
| `plugin.keyFile` | No | | Private key path; empty uses a temporary self-signed cert |
| `plugin.hostHeaderRewrite` | No | | Rewrite Host when forwarding to the local service; empty means no rewrite |
| `plugin.requestHeaders.set` | No | | Extra request headers to send to the backend; key-value pairs |
| `transport.bandwidth` | No | `0` | Bandwidth cap (Mbps); `0` means unlimited |
| `transport.bandwidthLimitSide` | No | `client` | Limit side: `client` / `server` |
| `transport.proxyProtocolVersion` | No | | PROXY Protocol: `v1` / `v2` (not available with `tls-term`) |
| `transport.compression` | No | `none` | Compression algorithm: `none` / `lz4` |
@@ -56,3 +56,4 @@ curl --socks5 YOUR_SERVER_IP:9000 -U admin:123456 http://example.com
| `transport.bandwidth` | No | `0` | Bandwidth cap (Mbps); `0` means unlimited |
| `transport.bandwidthLimitSide` | No | `client` | Limit side: `client` / `server` |
| `transport.proxyProtocolVersion` | No | | PROXY Protocol: `v1` / `v2` |
| `transport.compression` | No | `none` | Compression algorithm: `none` / `lz4` |
@@ -38,12 +38,13 @@ ssh -p 9000 user@YOUR_SERVER_IP
## Parameters
| Parameter | Required | Default | Description |
|----------------------------------|----------|-------------|--------------------------------------------------|
| `name` | Yes | | Tunnel name; must be unique |
| `protocol` | Yes | | Always `tcp` |
| `service` | Yes | | Local service address, e.g. `127.0.0.1:22` |
| `remotePort` | Yes | | Public listen port on the server |
| `transport.bandwidth` | No | `0` | Bandwidth cap (Mbps); `0` means unlimited |
| `transport.bandwidthLimitSide` | No | `client` | Limit side: `client` / `server` |
| `transport.proxyProtocolVersion` | No | | PROXY Protocol: `v1` / `v2` |
| Parameter | Required | Default | Description |
|----------------------------------|----------|----------|--------------------------------------------|
| `name` | Yes | | Tunnel name; must be unique |
| `protocol` | Yes | | Always `tcp` |
| `service` | Yes | | Local service address, e.g. `127.0.0.1:22` |
| `remotePort` | Yes | | Public listen port on the server |
| `transport.bandwidth` | No | `0` | Bandwidth cap (Mbps); `0` means unlimited |
| `transport.bandwidthLimitSide` | No | `client` | Limit side: `client` / `server` |
| `transport.proxyProtocolVersion` | No | | PROXY Protocol: `v1` / `v2` |
| `transport.compression` | No | `none` | Compression algorithm: `none` / `lz4` |
@@ -38,13 +38,14 @@ dig @YOUR_SERVER_IP -p 9000 example.com
## Parameters
| Parameter | Required | Default | Description |
|----------------------------------|----------|-------------|--------------------------------------------------|
| `udpPacketSize` | No | `1500` | Max UDP datagram size; must match the server |
| `name` | Yes | | Tunnel name; must be unique |
| `protocol` | Yes | | Always `udp` |
| `service` | Yes | | Local service address, e.g. `127.0.0.1:53` |
| `remotePort` | Yes | | Public listen port on the server |
| `transport.bandwidth` | No | `0` | Bandwidth cap (Mbps); `0` means unlimited |
| `transport.bandwidthLimitSide` | No | `client` | Limit side: `client` / `server` |
| `transport.proxyProtocolVersion` | No | | PROXY Protocol: `v1` / `v2` |
| Parameter | Required | Default | Description |
|----------------------------------|----------|----------|----------------------------------------------|
| `udpPacketSize` | No | `1500` | Max UDP datagram size; must match the server |
| `name` | Yes | | Tunnel name; must be unique |
| `protocol` | Yes | | Always `udp` |
| `service` | Yes | | Local service address, e.g. `127.0.0.1:53` |
| `remotePort` | Yes | | Public listen port on the server |
| `transport.bandwidth` | No | `0` | Bandwidth cap (Mbps); `0` means unlimited |
| `transport.bandwidthLimitSide` | No | `client` | Limit side: `client` / `server` |
| `transport.proxyProtocolVersion` | No | | PROXY Protocol: `v1` / `v2` |
| `transport.compression` | No | `none` | Compression algorithm: `none` / `lz4` |