free-dam-man/cf-global-edge-node-skill

- 节点程序:[cmliu/edgetunnel](https://github.com/cmliu/edgetunnel),GPL-2.0。本包**不包含、不修改、不再分发** `_worker.js`,运行时从上游钉版 commit `66f1c51c4ecee058b959104cb0517e073cdb1213` 下载并校验 SHA-256。使用、修改、再分发 edgetunnel 请遵守其 GPL-2.0 条款。

- 部署工具:Cloudflare [Wrangler](https://github.com/cloudflare/workers-sdk)(MIT/Apache-2.0),运行时通过 npx 获取。

按这个仓库的 SKILL.md「★通用 Agent 全自动模式」，帮我在 Cloudflare 上搭一个免费节点，最后给我小火箭订阅二维码： https://github.com/free-dam-man/cf-global-edge-node-skill

https://github.com/free-dam-man/cf-global-edge-node-skill

3. 明确禁止：不要登录或使用任何真实 Cloudflare 账号，不要使用真实域名、真实 UUID、真实令牌、真实订阅链接，不要碰任何现有 Worker、KV、节点或 3x-ui。 4. 用占位值继续本地验证：主机名用 node.example.com，占位 UUID 只用 skill 里标明的公开代码占位 00000000-0000-4000-8000-000000000000，入口 IP 只用 RFC 5737 文档 IP（如 192.0.2.10）。按 skill 的

[Credential-related source omitted]

[Credential-related source omitted]

按这个仓库的 SKILL.md「★通用 Agent 全自动模式」，帮我在 Cloudflare 上搭一个免费节点，最后给我小火箭订阅二维码： https://github.com/free-dam-man/cf-global-edge-node-skill

https://github.com/free-dam-man/cf-global-edge-node-skill

ADD.txt / PINNED.txt 只保留"从中国大陆能连通"的 Cloudflare 自有 IP。 1. 读 KV 的 ADD.txt,再加候选:Cloudflare 官方 IPv4 段内的优选 IP(如 cloudflare.com/ips-v4 里的 104.16.0.0/13、172.64.0.0/13、162.159.0.0/16 中你已知好用的),只收 CF 自有 IP,不收第三方反代 IP、不收域名。 2. 对每个 IP:端口,调用 POST https:

1. 读 KV 的 ADD.txt,再加候选:Cloudflare 官方 IPv4 段内的优选 IP(如 cloudflare.com/ips-v4 里的 104.16.0.0/13、172.64.0.0/13、162.159.0.0/16 中你已知好用的),只收 CF 自有 IP,不收第三方反代 IP、不收域名。 2. 对每个 IP:端口,调用 POST https://api.globalping.io/v1/measurements,    type=ping, mea

2. 对每个 IP:端口,调用 POST https://api.globalping.io/v1/measurements,

没域名也有路(第2/6步子分支 D1-D4): 第2步选 3,AI 先问是否主要在大陆网络用,不在大陆可直接跳过域名用 workers.dev;在大陆又想稳,AI 会自己打开它的云端浏览器去 [DNSHE 免费域名](https://my.dnshe.com/clientarea.php?language=chinese&autolang=1) 和 Cloudflare 全程操作注册(该站有不同年限，优先选10年期；若只有1年期，老实告知续期规则：到期前180天内免费续；以站

1. 能力自检:`node -v`、`python3 -V`、`curl --version`。缺什么自己装(Node ≥ 20)。在**包外**工作目录(默认 `~/cf-edge-work`)干活,不往本仓库写任何真实值。

4. 脚本任何一步失败:按第 9 节排障表处理一次;同一步失败两次就停,原样报错给用户。**只删除本次新建的 Worker/KV**,绝不碰账号里已有资源。 5. 交付只给三样:二维码图片、订阅链接(私下给)、面板地址+ADMIN 密码(私下给)。告诉用户:小火箭首页右上角扫码 → 添加订阅 → 下拉刷新 → 选节点连接;自己手机显示的二维码扫不了,就复制链接到小火箭「+ → 类型 Subscribe」粘贴。 6. 收尾:请用户连上后打开 `https://www.cloud

6. 收尾:请用户连上后打开 `https://www.cloudflare.com/cdn-cgi/trace` 看 `loc=`/`colo=`,作为最终验收。地区不满意 → 换 `REGION` 重跑第 8 步(脚本可重复执行,已存在的密钥会复用)。

ADD.txt / PINNED.txt 只保留"从中国大陆能连通"的 Cloudflare 自有 IP。 1. 读 KV 的 ADD.txt,再加候选:Cloudflare 官方 IPv4 段内的优选 IP(如 cloudflare.com/ips-v4 里的 104.16.0.0/13、172.64.0.0/13、162.159.0.0/16 中你已知好用的),只收 CF 自有 IP,不收第三方反代 IP、不收域名。 2. 对每个 IP:端口,调用 POST https:

1. 读 KV 的 ADD.txt,再加候选:Cloudflare 官方 IPv4 段内的优选 IP(如 cloudflare.com/ips-v4 里的 104.16.0.0/13、172.64.0.0/13、162.159.0.0/16 中你已知好用的),只收 CF 自有 IP,不收第三方反代 IP、不收域名。 2. 对每个 IP:端口,调用 POST https://api.globalping.io/v1/measurements,    type=ping, mea

2. 对每个 IP:端口,调用 POST https://api.globalping.io/v1/measurements,

- v4 的候选池全是 CF 官方 IP,Worker `connect()` 连不了 CF 自家段,实测一个节点 10/10 都是 unverifiable,自愈形同虚设。 - v4.1:候选源改为先第三方反代 IP(`https://raw.githubusercontent.com/cmliu/WorkerVless2sub/main/addressesapi.txt`、`https://raw.githubusercontent.com/ymyuuu/IPDB/mai

- v4.1:候选源改为先第三方反代 IP(`https://raw.githubusercontent.com/cmliu/WorkerVless2sub/main/addressesapi.txt`、`https://raw.githubusercontent.com/ymyuuu/IPDB/main/bestproxy.txt`、`.../proxy.txt`),CF 官方清单兜底;远程清单只收 IP 条目。CF 官方 IPv4 段按官方 ips-v4(104.16.0

- "Cloudflare 账号:必须要。这是整套东西的地基,没有账号就没有 Worker 和 KV,搭不了。注册免费。" - "域名:不必须,但有就优先用。你已经有绑在 Cloudflare 上的域名,我们就优先绑一个新子域名当正式地址;没有域名也可以先用 Cloudflare 免费送的 workers.dev 地址部署,但要先说清:workers.dev 在中国大陆网络上常见整批节点在 TLS/WS 握手阶段超时(面板和订阅在浏览器里能打开不代表节点能连),这时不要承诺能

- No-domain route (Branch D, see below): if the operator has no domain, offer the free-domain onboarding at [DNSHE](https://my.dnshe.com/clientarea.php?language=chinese&autolang=1) as one option — free domains there exist in different terms

- D1 选路 (ask): "第2/6步(D1): 你主要在大陆网络用吗?不在大陆用可以跳过域名、直接用 workers.dev;在大陆用又想要稳,建议走免费域名路线,我带你注册一个再绑到 Cloudflare。你选:回 A 跳过域名用免费地址,回 B 走免费域名。" If A, return to W2 route 1. If B, continue to D2. - D2 注册 (Agent 云端浏览器全程操作,用户只过确认点): YOU (the deploying 

- D2 注册 (Agent 云端浏览器全程操作,用户只过确认点): YOU (the deploying Agent) open YOUR OWN cloud/browser environment and perform the registration flows yourself on Cloudflare (dash.cloudflare.com) and on [DNSHE 免费域名](https://my.dnshe.com/clientarea.php?lan

- Local verified file `/workspace/_worker.js` is byte-identical to upstream main on 2026-10-17: SHA-256 `1e84d11af0544654bf56a06fa833e77184a57193288a9ffccf62c031a9fb7d65`, size 5,142,235 bytes, header line 1 `const Version = '2026-10-08 22:

- Code facts used below, with line hints: env/UUID derivation L30-37; quick-sub redirect L87-90; login and admin routes L91-111, L208-299; subscription route and token L304-315; per-client format dispatch L332-347; local subscription genera

- Cloudflare platform facts checked 2026-10-17 in official docs: Workers Free 100,000 requests/day then error 1027, reset midnight UTC (https://developers.cloudflare.com/workers/platform/limits/); KV Free 100,000 reads/day, 1,000 writes/day

- Fast-route docs: Worker Custom Domains (API/Wrangler binding on an already-Active zone creates DNS + certificate automatically) https://developers.cloudflare.com/workers/configuration/routing/custom-domains/ ; Pages custom domains, includ

- Community preferred-IP sources (third-party, runtime-reference only, no licence stated, may die or change without notice — never vendor/copy their data files into this package, never treat as guaranteed): primary scanned top-20, country-l

curl -L -o _worker.js https://raw.githubusercontent.com/cmliu/edgetunnel/66f1c51c4ecee058b959104cb0517e073cdb1213/_worker.js

| Route | When it applies | How | Speed / wait | Hard limits | |---|---|---|---|---| | **A. Worker Custom Domain on an already-Active CF zone** | Domain zone already shows Active on this Cloudflare account | Bind `node.<YOUR_DOMAIN>` as a W

|---|---|---|---|---| | **A. Worker Custom Domain on an already-Active CF zone** | Domain zone already shows Active on this Cloudflare account | Bind `node.<YOUR_DOMAIN>` as a Worker Custom Domain via Cloudflare API (`PUT /client/v4/account

| **A. Worker Custom Domain on an already-Active CF zone** | Domain zone already shows Active on this Cloudflare account | Bind `node.<YOUR_DOMAIN>` as a Worker Custom Domain via Cloudflare API (`PUT /client/v4/accounts/{account_id}/workers

| **B. Pages + external CNAME subdomain** | Domain is at DNSHE/another registrar and the operator can edit its DNS, but the zone is not on Cloudflare | Deploy the Pages variant (Section 6 alternative), set the custom domain in Pages for a s

[Credential-related source omitted]

python3 -c "import base64; d=base64.b64decode(open('sub.txt').read().strip()); print(d.decode()[:500]); print('lines:', len([l for l in d.decode().splitlines() if l.strip()]))"

Fork https://github.com/cmliu/edgetunnel, Dashboard -> Pages -> Connect to Git, add env `ADMIN` at setup, deploy, then Settings -> Bindings -> KV namespace with variable name `KV`, redeploy so the binding takes effect, optionally add the cu

2. Curated list: switch `本地IP库.随机IP` to `false` in the panel config, then the builder reads KV `ADD.txt` (L359-361). Source candidates only from lists you can re-test (your own measurements, or a public preferred-IP project whose update tim

3. Residential-entry lists: same handling, plus verify the entry is not hosting/datacenter via an IP-intelligence lookup before calling it residential. An earlier audit estimate found only about 60-70% of upstream residential-marked entries

4. Two-stage community ADD.txt (the fast path, mandatory wording): edgetunnel natively fetches `https://` lines placed in `ADD.txt`, so a community list can be referenced at runtime instead of hand-copying IPs.

- **Stage 1 — fast subscription (minutes):** `ADD.txt` may contain exactly ONE line = a community preferred-IP API/list URL whose candidates are filtered/intersected with the operator's chosen region (Section 0B). Primary: `https://raw.gith

for host, port in candidates:     try:         with socket.create_connection((host, port), timeout=5) as s:

try:         with socket.create_connection((host, port), timeout=5) as s:             with ctx.wrap_socket(s, server_hostname="<HOST>") as tls:

with socket.create_connection((host, port), timeout=5) as s:

1. Panel: `https://<HOST>/admin` loads after login; `/admin/config.json` shows your UUID, canonical HOST/HOSTS, and TOKEN. 2. Subscription: Section 5 base64 check passes; node count and labels match `ADD.txt` line count (or 16 random entrie

2. Subscription: Section 5 base64 check passes; node count and labels match `ADD.txt` line count (or 16 random entries if still on random mode); every URI matches the Section 5 shape. 3. End-to-end: client connected through one node, open a

3. End-to-end: client connected through one node, open an IP-lookup page; exit shows Cloudflare network addresses. Any source claiming a residential exit from this setup is wrong. Strongest evidence (explicit client-trace standard): when th

4. Region: with the client connected, open `https://www.cloudflare.com/cdn-cgi/trace` and compare `colo=` with the `ADD.txt` label for that entry; relabel or drop mismatches. Note: trace shows the colo you exit through, so test one entry at

- This node hides traffic from the local network/ISP; sites see Cloudflare egress. It is not anonymity: Cloudflare operates edge and exit and the account is tied to the operator identity. - Volunteer/residential entry operators can see conn

- Volunteer/residential entry operators can see connection metadata; ordinary browsing only, never the sole protection for sensitive accounts. - Respect Cloudflare terms and local law; reselling free-tier nodes, public subscriptions for str

- Respect Cloudflare terms and local law; reselling free-tier nodes, public subscriptions for strangers, or quota evasion risks account suspension (check https://www.cloudflare.com/terms/).

#!/usr/bin/env bash

[Credential-related source omitted]

[Credential-related source omitted]

say "1/9 下载并校验上游 edgetunnel(钉版 $PIN)" [ -f _worker.js ] || curl -fsSL -o _worker.js "https://raw.githubusercontent.com/cmliu/edgetunnel/$PIN/_worker.js"

[ -f _worker.js ] || curl -fsSL -o _worker.js "https://raw.githubusercontent.com/cmliu/edgetunnel/$PIN/_worker.js"

write_toml "" OUT=$($WR deploy 2>&1 | tee deploy.log) WD=$(echo "$OUT" | grep -oE "https://$NAME\.[a-z0-9-]+\.workers\.dev" | head -1 | sed 's#https://##')

OUT=$($WR deploy 2>&1 | tee deploy.log) WD=$(echo "$OUT" | grep -oE "https://$NAME\.[a-z0-9-]+\.workers\.dev" | head -1 | sed 's#https://##') HOST="${DOMAIN:-$WD}"; [ -n "$HOST" ] || { echo "没拿到地址,看 deploy.log"; exit 1; }

WD=$(echo "$OUT" | grep -oE "https://$NAME\.[a-z0-9-]+\.workers\.dev" | head -1 | sed 's#https://##')

sleep 8 if [ -z "${PREFERRED_ONLY:-}" ]; then code=$(curl -s -o /dev/null -w '%{http_code}' "https://$HOST/login" || true)

if [ -z "${PREFERRED_ONLY:-}" ]; then code=$(curl -s -o /dev/null -w '%{http_code}' "https://$HOST/login" || true) echo "/login -> $code"

code=$(curl -s -o /dev/null -w '%{http_code}' "https://$HOST/login" || true)

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

curl -s -A v2rayN "$SUB" -o sub.b64

d=base64.b64decode(open("sub.b64").read().strip()).decode()

import sys,re,socket,ssl,urllib.request reg=sys.argv[1].upper() src=["https://raw.githubusercontent.com/LancelotRar/best-cf-ips/main/best-cf-ip-scanned-top20.txt",

reg=sys.argv[1].upper() src=["https://raw.githubusercontent.com/LancelotRar/best-cf-ips/main/best-cf-ip-scanned-top20.txt",      "https://raw.githubusercontent.com/joname1/BestCFip/main/ipv4.txt"]

src=["https://raw.githubusercontent.com/LancelotRar/best-cf-ips/main/best-cf-ip-scanned-top20.txt",

"https://raw.githubusercontent.com/joname1/BestCFip/main/ipv4.txt"]

cand=[] for s in src:     try: t=urllib.request.urlopen(s,timeout=15).read().decode("utf-8","ignore")

for s in src:     try: t=urllib.request.urlopen(s,timeout=15).read().decode("utf-8","ignore")     except Exception: continue

try: t=urllib.request.urlopen(s,timeout=15).read().decode("utf-8","ignore")

for ip,p,lab in cand[:40]:     try:         with socket.create_connection((ip,p),timeout=4) as s, ctx.wrap_socket(s,server_hostname="www.cloudflare.com"):

try:         with socket.create_connection((ip,p),timeout=4) as s, ctx.wrap_socket(s,server_hostname="www.cloudflare.com"):             ok.append(f"{ip}:{p}#{lab}")

with socket.create_connection((ip,p),timeout=4) as s, ctx.wrap_socket(s,server_hostname="www.cloudflare.com"):

import sys,re,subprocess,urllib.request,concurrent.futures as cf host=sys.argv[1]; L=[] for s in ["https://raw.githubusercontent.com/cmliu/WorkerVless2sub/main/addressesapi.txt",

host=sys.argv[1]; L=[] for s in ["https://raw.githubusercontent.com/cmliu/WorkerVless2sub/main/addressesapi.txt",           "https://raw.githubusercontent.com/ymyuuu/IPDB/main/bestproxy.txt",

for s in ["https://raw.githubusercontent.com/cmliu/WorkerVless2sub/main/addressesapi.txt",

"https://raw.githubusercontent.com/ymyuuu/IPDB/main/bestproxy.txt",           "https://raw.githubusercontent.com/ymyuuu/IPDB/main/proxy.txt"]:     try: t=urllib.request.urlopen(s,timeout=15).read().decode("utf-8","ignore")

"https://raw.githubusercontent.com/ymyuuu/IPDB/main/proxy.txt"]:     try: t=urllib.request.urlopen(s,timeout=15).read().decode("utf-8","ignore")     except Exception: continue

try: t=urllib.request.urlopen(s,timeout=15).read().decode("utf-8","ignore")

[Credential-related source omitted]

[ "$HEAL" = "1" ] && echo "自愈已开:Cron \"$HEAL_CRON\" 每次探测 ADD.txt,坏的从 POOL.txt 补。查看: https://$HOST/heal-status?key=<你的UUID>"

say "9/9 生成订阅二维码并解码校验" [ -x .venv/bin/python ] || { python3 -m venv .venv && .venv/bin/pip -q install "qrcode[pil]" opencv-python-headless; } SUB_URL="$SUB" .venv/bin/python "$PKG/templates/make_sub_qr.py" --output "$WORK/cf-subscription-qr

[ -x .venv/bin/python ] || { python3 -m venv .venv && .venv/bin/pip -q install "qrcode[pil]" opencv-python-headless; } SUB_URL="$SUB" .venv/bin/python "$PKG/templates/make_sub_qr.py" --output "$WORK/cf-subscription-qr.png" cat <<R

SUB_URL="$SUB" .venv/bin/python "$PKG/templates/make_sub_qr.py" --output "$WORK/cf-subscription-qr.png"

订阅链接: $WORK/sub-url.txt   二维码:   $WORK/cf-subscription-qr.png   面板:     https://$HOST/admin  (密码在 SECRETS.local.json 的 ADMIN)

二维码:   $WORK/cf-subscription-qr.png   面板:     https://$HOST/admin  (密码在 SECRETS.local.json 的 ADMIN) $( [ -z "$DOMAIN" ] && echo "  注意: 用的是 workers.dev。大陆网络常见全部节点握手超时;超时就给我一个已在CF激活的域名,我绑子域名重发。")

面板:     https://$HOST/admin  (密码在 SECRETS.local.json 的 ADMIN)

Executable file

const POOL_SOURCES = [   "https://raw.githubusercontent.com/cmliu/WorkerVless2sub/main/addressesapi.txt", // edgetunnel 作者维护的反代IP(带端口/地区)

"https://raw.githubusercontent.com/cmliu/WorkerVless2sub/main/addressesapi.txt", // edgetunnel 作者维护的反代IP(带端口/地区)

"https://raw.githubusercontent.com/ymyuuu/IPDB/main/bestproxy.txt",             // 社区反代IP(精选)

"https://raw.githubusercontent.com/ymyuuu/IPDB/main/proxy.txt",                 // 社区反代IP(全量)

"https://raw.githubusercontent.com/LancelotRar/best-cf-ips/main/best-cf-ip-scanned-top20.txt",

"https://raw.githubusercontent.com/joname1/BestCFip/main/ipv4.txt",

for (const s of srcs) {       try {         const r = await fetch(s.trim(), { cf: { cacheTtl: 3600 } });

const r = await fetch(s.trim(), { cf: { cacheTtl: 3600 } });

export default {   async fetch(request, env, ctx) {

async fetch(request, env, ctx) {

return new Response((await env.KV.get("HEAL_STATUS.json")) || "{}", { headers: { "content-type": "application/json" } });     }     return upstream.fetch(request, env, ctx);

}     return upstream.fetch(request, env, ctx);   },

return upstream.fetch(request, env, ctx);

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]