🤞 Sync 2026-09-30 09:28:31

luci-app-homeproxy-pro/root/etc/homeproxy-pro/scripts/runtime/service.sh

@@ -127,6 +127,24 @@ hp_prepare_runtime_files() {
 	local client_enabled="$4"
 	local server_enabled="$5"
 
+	# The route rule that keeps mainland destinations direct matches a local
+	# rule-set generated from china_ip4.txt, the same list the firewall
+	# renders its nft set from, so both sides decide from one source.  It is
+	# regenerated here as well as by the resource updater: an install that
+	# predates this file (or a list replaced while the service was stopped)
+	# must still get one, or the client config would reference a missing
+	# file and sing-box would refuse to start.  A missing source list is not
+	# an error - the generator then emits no route-side rule at all.
+	if [ "$client_enabled" = "1" ] && [ -f "$hp_dir/resources/china_ip4.txt" ]; then
+		if ucode -S "$hp_dir/scripts/runtime/china_ip_ruleset.uc" \
+			"$hp_dir/resources/china_ip4.txt" "$hp_dir/resources/china_ip4.json" >>"$LOG_PATH" 2>&1; then
+			chown sing-box:sing-box "$hp_dir/resources/china_ip4.json" 2>"/dev/null" \
+				|| log "Warning: failed to hand ${hp_dir}/resources/china_ip4.json to sing-box."
+		else
+			log "Warning: could not generate ${hp_dir}/resources/china_ip4.json; the route side keeps the previous list."
+		fi
+	fi
+
 	# cache_file is enabled for bypass_mainland_china and custom alike
 	# (generator/common.uc:attachExperimental).  The file has to exist before
 	# the client jail binds it, or sing-box cannot create it in there.
@@ -219,13 +237,16 @@ hp_procd_client_instance() {
 		# guessed subset.  procd orders the mounts by path, so this parent is
 		# bound before the read-write cache.db below and cannot shadow it.
 		procd_add_jail_mount "$hp_dir/"
-		# cache_file is enabled for bypass_mainland_china and custom alike
-		# (generator/common.uc:attachExperimental), so both need the file
-		# writable inside the jail.
-		case "$routing_mode" in
-		"bypass_mainland_china"|"custom")
-			procd_add_jail_mount_rw "$hp_dir/cache.db" ;;
-		esac
+		# cache_file is emitted unconditionally (generator/common.uc:
+		# attachExperimental takes the routing mode and never reads it), so
+		# every mode's sing-box opens this file and dies with
+		#   initialize cache-file: open /etc/homeproxy-pro/cache.db: read-only file system
+		# if it is bound read-only - which is what the mode-gated mount here
+		# did for global / gfwlist / proxy_mainland_china.  The instance then
+		# failed its health gate and the intercept layer was reverted, so
+		# switching to one of those modes took the whole network off the
+		# proxy.
+		procd_add_jail_mount_rw "$hp_dir/cache.db"
 		procd_add_jail_mount "$hp_dir/certs/"
 		# The certificate path gate accepts /etc/acme as well (a client TLS
 		# certificate managed by acme.sh), so the client jail has to carry it