tourcoder/trojan-go-fml repository overview

⁠Trojan-Go Docker Research Project

This project is for educational purposes to demonstrate how to build and structure a Docker image that supports interactive post-deployment configuration.

⁠🚀 Quick Start

⁠1. Start the Container

Run the container in the background. It will start in a "Pending" state, waiting for your configuration.

docker run -d \
    --name trojan-go \
    --net host \
    --restart unless-stopped \
    -v $(pwd)/ssl:/ssl \
    -v $(pwd)/config:/etc/trojan-go \
    -v $(pwd)/logs:/var/log/supervisor \
    -v acme-data:/root/.acme.sh \
    tourcoder/trojan-go-fml

⁠2. Configure a New Domain (The "FML" Step)

Once the container is running, enter the interactive configuration wizard:

docker exec -it trojan-go fml

Follow the prompts to:

• Set your domain and password.
• Choose a fallback (mask) website.
• Enter your email for SSL certificate notifications.
• Automatically issue SSL certificates via Acme.sh.

⁠🔁 Changing Domains

Certificates are stored per-domain by Acme.sh in the acme-data volume, but Trojan-Go only ever reads one fixed pair of files: /ssl/private.key and /ssl/fullchain.cer. Each run of the wizard overwrites that pair. This means a previously used domain still has a valid certificate — it just isn't the one currently installed.

First, check what you already have:

docker exec -it trojan-go /root/.acme.sh/acme.sh --list

⁠Case A — A brand-new domain (never issued here)

Point the domain's DNS A record at this server, wait for it to propagate, make sure port 80 is free (Acme.sh uses standalone mode), then run the wizard:

docker exec -it trojan-go fml

⁠Case B — A domain already listed above

Do not re-run the wizard. Acme.sh will skip issuance because the existing certificate is still valid, and because the install step only runs after a successful issuance, /ssl will keep serving the other domain's certificate. The connection will fail on an SNI mismatch.

Instead, reinstall the stored certificate and update the config by hand:

# 1. Copy the stored certificate into the path Trojan-Go reads
docker exec -it trojan-go /root/.acme.sh/acme.sh --install-cert -d a.example.com \
    --key-file /ssl/private.key \
    --fullchain-file /ssl/fullchain.cer

# 2. Update the domain in the config (host-side, it's a mounted volume)
#    Edit ssl.sni — and ssl.cert / ssl.key if you use per-domain paths.
vi config/config.json

# 3. Restart
docker restart trojan-go

Add --ecc to the --install-cert command if the certificate was issued as ECC.

Never add --force to re-issue a certificate you already hold. Let's Encrypt allows only 5 duplicate certificates per week for the same domain set, and switching back and forth will exhaust that quota quickly.

⁠Tip: store certificates per domain

If you switch between domains regularly, keep them in separate directories so they stop overwriting each other:

docker exec -it trojan-go sh -c 'mkdir -p /ssl/a.example.com'
docker exec -it trojan-go /root/.acme.sh/acme.sh --install-cert -d a.example.com \
    --key-file /ssl/a.example.com/private.key \
    --fullchain-file /ssl/a.example.com/fullchain.cer

Point ssl.cert and ssl.key in config.json at the per-domain paths. After that, switching between known domains is just a config edit plus a restart.

⁠Expired certificates

Certificates are valid for 90 days. If a domain has been idle long enough for its certificate to expire, it counts as new again — use Case A.

⁠🔬 Educational Purpose

This repository is a reference for learning how to create advanced Docker images, specifically focusing on:

1. Separation of Runtime and Config: How to let a container start without initial environment variables and configure it later.
2. Interactive Scripts: Using shell scripts (fml) within a container to handle complex tasks like SSL issuance.
3. Process Management: Using supervisord to manage multiple services inside a single container.
4. Persistence: Proper use of volumes for certificates, logs, and configuration files.

⁠License

MIT