From 60e4f08fd383ead81b2bc3cb01a0f94fa2820b43 Mon Sep 17 00:00:00 2001
From: NetworkCats <networkcatlol@gmail.com>
Date: Wed, 11 Mar 2026 05:06:58 +0800
Subject: [PATCH] docs: update installation guides for IPv4 domain
 configuration

---
 INSTALL.md        | 34 ++++++++++++++++++++++++++++++++++
 deploy/INSTALL.md |  3 +++
 2 files changed, 37 insertions(+)

diff --git a/INSTALL.md b/INSTALL.md
index e5ce9c3..1971387 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -37,6 +37,13 @@ cat origin-cert.pem origin-key.pem > haproxy/certs/origin.pem
 
 The file must contain the certificate followed by the private key.
 
+If you are using an IPv4-only domain for dual-stack detection (see below), generate a separate Origin certificate for that domain and place it at `haproxy/certs-ipv4/origin.pem`:
+
+```bash
+mkdir -p haproxy/certs-ipv4
+cat ipv4-origin-cert.pem ipv4-origin-key.pem > haproxy/certs-ipv4/origin.pem
+```
+
 ### 3. Start the stack
 
 A prebuilt image is available on Docker Hub at [`networkcat/rustyip`](https://hub.docker.com/r/networkcat/rustyip). Update the `app` service in `docker-compose.yml` to use it:
@@ -67,6 +74,31 @@ In the Cloudflare dashboard for your domain:
 1. Add a DNS A record pointing to your server IP with the proxy enabled (orange cloud).
 2. Set **SSL/TLS** mode to **Full (strict)**.
 
+### 5. Dual-Stack Detection (Optional)
+
+To show both IPv4 and IPv6 addresses to dual-stack users, you can configure an IPv4-only domain. When a user connects via IPv6, the frontend makes a JS request to this domain (which has no AAAA DNS record) to discover their IPv4 address and display full IP information for both protocols.
+
+1. Register or use a separate domain (e.g. `noipv6.org`) and point it to the same server.
+2. In the Cloudflare dashboard for the IPv4-only domain:
+   - Add only an **A record** (no AAAA record) pointing to your server IP with the proxy enabled.
+   - Set **SSL/TLS** mode to **Full (strict)**.
+   - Generate a separate Origin certificate under **SSL/TLS > Origin Server**.
+3. Set `IPV4_DOMAIN` in `.env`:
+   ```
+   IPV4_DOMAIN=noipv6.org
+   ```
+4. Place the Origin certificate at `haproxy/certs-ipv4/origin.pem` (see step 2 above).
+5. Add the domain name to `haproxy/ipv4_domain.lst`:
+   ```
+   noipv6.org
+   ```
+6. Restart the stack:
+   ```bash
+   docker compose restart
+   ```
+
+For IPv4-only users, the frontend also attempts to detect an IPv6 address by making a same-domain request. If the browser connects via IPv6 (possible when the main domain has both A and AAAA records), the IPv6 address and its full information are displayed alongside the IPv4 information.
+
 ## Local Development
 
 ```bash
@@ -88,8 +120,10 @@ The server starts at `http://localhost:3000` by default. Set `DEV_MODE=true` in
 | `DB_UPDATE_URL` | *(GitHub release URL)* | URL to download the MMDB database from |
 | `DB_UPDATE_INTERVAL_HOURS` | `24` | How often to check for database updates |
 | `SITE_DOMAIN` | `localhost` | Domain name used for display and metadata |
+| `IPV4_DOMAIN` | *(empty)* | IPv4-only domain for dual-stack detection (e.g. `noipv6.org`). Leave empty to disable. |
 | `DEV_MODE` | `false` | Uses `1.1.1.1` as fallback when `CF-Connecting-IP` is absent |
 | `CERT_PATH` | `./haproxy/certs` | Path to the TLS certificate directory for HAProxy |
+| `IPV4_CERT_PATH` | `./haproxy/certs-ipv4` | Path to the TLS certificate directory for the IPv4-only domain |
 
 ## Automated CI/CD Deployment
 
diff --git a/deploy/INSTALL.md b/deploy/INSTALL.md
index acac713..18d3c7c 100644
--- a/deploy/INSTALL.md
+++ b/deploy/INSTALL.md
@@ -29,6 +29,7 @@ If you are using environments, add them under the `production` environment (**Se
 |---|---|
 | `SITE_DOMAIN` | Production domain name (e.g. `ip.nc.gy`) |
 | `DB_UPDATE_URL` | URL to download the MMDB database from |
+| `IPV4_DOMAIN` | *(Optional)* IPv4-only domain for dual-stack detection (e.g. `noipv6.org`). Omit to disable. |
 
 #### TLS
 
@@ -36,6 +37,8 @@ If you are using environments, add them under the `production` environment (**Se
 |---|---|
 | `ORIGIN_CERT` | Cloudflare Origin certificate (PEM) for TLS termination at HAProxy |
 | `ORIGIN_KEY` | Corresponding private key (PEM) for the Origin certificate |
+| `IPV4_ORIGIN_CERT` | *(Optional)* Cloudflare Origin certificate (PEM) for the IPv4-only domain. Required when `IPV4_DOMAIN` is set. |
+| `IPV4_ORIGIN_KEY` | *(Optional)* Corresponding private key (PEM) for the IPv4-only domain certificate. Required when `IPV4_DOMAIN` is set. |
 
 #### Docker Hub