支持统一代理配置

README.md

@@ -25,6 +25,7 @@ Required runtime secrets:
 
 The container sets `CAPTCHA_PROVIDER_URL=http://127.0.0.1:9876` so the proxy can fetch captcha tokens from the internal provider.
 If the internal provider cannot get an Aliyun token from the current Space egress IP, set `FALLBACK_CAPTCHA_PROVIDER_URL` to another compatible captcha token service.
+If Z.AI rejects the Space egress IP, set `PROXY_SERVER` to an HTTP(S)/SOCKS proxy URL; both the captcha provider and Go proxy use it.
 
 > 将 [Z.AI](https://chat.z.ai) 转换为 OpenAI 兼容 API 的代理服务。
 >

internal/tls_http.go

@@ -1,9 +1,11 @@
 package internal
 
-import (
-	"fmt"
-	"sync"
-	"time"
+import (
+	"fmt"
+	"os"
+	"strings"
+	"sync"
+	"time"
 
 	fhttp "github.com/bogdanfinn/fhttp"
 	tls_client "github.com/bogdanfinn/tls-client"
@@ -22,27 +24,41 @@ var (
 )
 
 // TLSHTTPClient 返回按超时（秒）复用的 tls-client 实例；所有出站 HTTPS 应通过此处以统一指纹。
-func TLSHTTPClient(timeout time.Duration) (tls_client.HttpClient, error) {
-	sec := int(timeout.Round(time.Second) / time.Second)
-	if sec < 1 {
-		sec = 1
-	}
-	tlsClientMu.Lock()
-	defer tlsClientMu.Unlock()
-	if c, ok := tlsBySec[sec]; ok {
-		return c, nil
-	}
-	c, err := tls_client.NewHttpClient(tls_client.NewNoopLogger(),
-		tls_client.WithTimeoutSeconds(sec),
-		tls_client.WithClientProfile(DefaultBrowserProfile),
-		tls_client.WithRandomTLSExtensionOrder(),
-	)
-	if err != nil {
-		return nil, fmt.Errorf("tls-client: %w", err)
-	}
-	tlsBySec[sec] = c
-	return c, nil
-}
+func TLSHTTPClient(timeout time.Duration) (tls_client.HttpClient, error) {
+	sec := int(timeout.Round(time.Second) / time.Second)
+	if sec < 1 {
+		sec = 1
+	}
+	proxyURL := resolveProxyURL()
+	tlsClientMu.Lock()
+	defer tlsClientMu.Unlock()
+	if c, ok := tlsBySec[sec]; ok {
+		return c, nil
+	}
+	options := []tls_client.HttpClientOption{
+		tls_client.WithTimeoutSeconds(sec),
+		tls_client.WithClientProfile(DefaultBrowserProfile),
+		tls_client.WithRandomTLSExtensionOrder(),
+	}
+	if proxyURL != "" {
+		options = append(options, tls_client.WithProxyUrl(proxyURL))
+	}
+	c, err := tls_client.NewHttpClient(tls_client.NewNoopLogger(), options...)
+	if err != nil {
+		return nil, fmt.Errorf("tls-client: %w", err)
+	}
+	tlsBySec[sec] = c
+	return c, nil
+}
+
+func resolveProxyURL() string {
+	for _, name := range []string{"PROXY_SERVER", "ZAI_PROXY", "HTTPS_PROXY", "HTTP_PROXY"} {
+		if value := strings.TrimSpace(os.Getenv(name)); value != "" {
+			return value
+		}
+	}
+	return ""
+}
 
 // ApplyBrowserFingerprintHeaders 设置与 Chrome 133 一致的 User-Agent 与 Sec-CH-UA（配合 TLSHTTPClient 的 TLS/H2 指纹）。
 func ApplyBrowserFingerprintHeaders(h fhttp.Header) {