打造一条干净的 RSS 订阅流：RSSHub + 透明代理图床 + Reeder 体验优化，彻底搞定 RSSHub 防盗链与图片超时

+-------------------------------------------------------------------------------+
| QNAP NAS (Host 宿主机)                                                        |
|   代理监听端口：Mihomo/Clash -> 172.29.8.1:7891 (SOCKS5/HTTP 混合)              |
|                                                                               |
|  +-------------------------------------------------------------------------+  |
|  | Container Station (Docker Compose)                                      |  |
|  |                                                                         |  |
|  |  +-------------------------------------------------------------------+  |  |
|  |  | tun2socks-gateway (网关容器, 对外映射 8888:80)                   |  |  |
|  |  |   [虚拟网卡 tun0] <-- SOCKS5 转发 --> 172.29.8.1:7891             |  |  |
|  |  |         ^                                                         |  |  |
|  |  |         | (共享同一个命名空间与虚拟网卡 network_mode: service:...)  |  |  |
|  |  |  imgproxy (Nginx 缓存与防盗链伪装)                                 |  |  |
|  |  +-------------------------------------------------------------------+  |  |
|  |                                                                         |  |
|  |  +-------------------------------------------------------------------+  |  |
|  |  | rsshub (独立的 RSS 源生产容器, 输出正文与图片链接)                  |  |  |
|  |  +-------------------------------------------------------------------+  |  |
|  +-------------------------------------------------------------------------+  |
+-------------------------------------------------------------------------------+
       ^
       | HTTP/HTTPS 请求
+-------------------------------------------------------------------------------+
| 终端客户端：Reeder 5                                        |
| 读取 RSSHub 源 -> 遇到图片标签访问 http://NAS_IP:8888/imgproxy?url=...        |
+-------------------------------------------------------------------------------+

version: '3.8'

services:
  rsshub:
    image: diygod/rsshub:latest
    container_name: rsshub
    restart: always
    environment:
      - NODE_ENV=production
      - CACHE_TYPE=memory
      - CACHE_EXPIRE=3600
      - PUPPETEER_WS_ENDPOINT=
      # 如果想让 RSSHub 也能正常解析外网源，配置单独的代理即可：
      - PROXY_URI=http://172.29.8.1:7891
    ports:
      - "1200:1200"

events {
    worker_connections 1024;
}

http {
    # 使用国内外通用公共 DNS，配合 SOCKS5 代理确保抗污染和干净解析
    resolver 223.5.5.5 119.29.29.29 8.8.8.8 valid=300s ipv6=off;
    resolver_timeout 5s;

    # 磁盘缓存设置：最多占用 1G，最长保存 7 天
    proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=img_cache:100m inactive=7d max_size=1g;

    map $arg_url $matched_referer {
        default                         "";
        "~*sspai\.com"                  "https://sspai.com/";
        "~*zhimg\.com"                  "https://www.zhihu.com/";
        "~*yuque\.com"                  "https://www.yuque.com/";
        "~*doubanio\.com"               "https://www.douban.com/";
        "~*douban\.com"                 "https://www.douban.com/";
        "~*chongdiantou\.com"           "https://www.chongdiantou.com/";
        "~*qpic\.cn"                    "https://mp.weixin.qq.com/";
        "~*sinaimg\.cn"                 "https://weibo.com/";
    }

    server {
        listen 80;
        server_name _;

        location /imgproxy {
            if ($arg_url !~* "^https?://") {
                return 400 "Invalid URL";
            }

            proxy_cache img_cache;
            proxy_cache_valid 200 7d;
            # 当源站网络抖动或超时时，允许使用陈旧的本地过期缓存先给阅读器展示
            proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;

            proxy_pass $arg_url;
            
            proxy_set_header Referer $matched_referer;
            proxy_set_header User-Agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36";
            proxy_set_header Accept "image/avif,image/webp,image/apng,image/*,*/*;q=0.8";
            
            proxy_ssl_server_name on;
            proxy_ssl_protocols TLSv1.2 TLSv1.3;
            
            proxy_hide_header Access-Control-Allow-Origin;
            add_header Access-Control-Allow-Origin *;
            
            proxy_hide_header Cache-Control;
            add_header Cache-Control "public, max-age=604800";
        }
    }
}

version: '3.8'

services:
  # 1. 透明代理网关容器：创建虚拟网卡，接管同网络栈下所有的 TCP/UDP 流量
  tun2socks-gateway:
    image: xjasonlyu/tun2socks:v2.5.2
    container_name: tun2socks-gateway
    restart: always
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      # 必须指向 NAS 上支持 SOCKS5 协议的监听端口 (默认 mixed 端口可写 7890/7891)
      - PROXY=socks5://172.29.8.1:7891
    ports:
      # Nginx 对外提供服务的 8888 端口在这里声明
      - "8888:80"

  # 2. 寄生于网关的 Nginx 中转图床容器
  imgproxy:
    image: nginx:alpine
    container_name: imgproxy
    restart: always
    # 核心：复用伴生容器的网络栈，自动具备透明抓墙能力
    network_mode: "service:tun2socks-gateway"
    depends_on:
      - tun2socks-gateway
    volumes:
      - /share/Container/imgproxy/nginx.conf:/etc/nginx/nginx.conf:ro
      - /share/Container/imgproxy/cache:/tmp/nginx_cache

http://NAS_IP:18888/imgproxy?url=真实图片URL

原始：<img src="https://cdn1.telesco.pe/file/xxx.jpg">
替换后：<img src="http://NAS_IP:8888/imgproxy?url=https://cdn1.telesco.pe/file/xxx.jpg">

flowchart TD
    subgraph Client ["终端设备 (iPhone / Mac)"]
        R["Reeder 5"]
    end

    subgraph NAS_Docker ["QNAP NAS : Container Station (Docker Bridge)"]
        subgraph Sidecar_Pod ["共享网络空间 (network_mode: service:tun2socks-gateway)"]
            GW["tun2socks-gateway<br/>监听: 8888:80<br/>虚拟网卡: tun0"]
            NG["imgproxy (Nginx)<br/>防盗链 Referer + 7天磁盘缓存"]
        end
        RH["rsshub<br/>监听: 1200<br/>生成带 /imgproxy 前缀的图片 URL"]
    end

    subgraph NAS_Host ["QNAP NAS : 宿主机主机网络"]
        MI["Mihomo / Clash 代理服务<br/>监听: 172.29.8.1:7891 (SOCKS5/HTTP)"]
    end

    subgraph CDN ["目标图片源站"]
        CN["国内图床 (微信/知乎/少数派)<br/>校验 Referer 正常放行"]
        TG["海外被墙图床 (Telegram cdn1.telesco.pe)<br/>通过代理出境"]
    end

    %% 数据流向
    R -- "1. 订阅文本请求" --> RH
    R -- "2. 图片请求 http://NAS_IP:8888/imgproxy?url=" --> GW
    GW <-->|网络命名空间共享| NG
    NG -- "3. 命中缓存直接高速返回" --> R
    NG -- "4. 未命中缓存 (TCP抓取 / UDP 53 DNS)" --> GW
    GW -- "5. SOCKS5 代理穿透" --> MI
    MI -- "国内规则" --> CN
    MI -- "代理规则" --> TG