wangjia
192 lines
5.6 KiB
Bash
Executable File
192 lines
5.6 KiB
Bash
Executable File
#!/bin/bash
|
||
# 在 NAS 上执行（由 setup-frp-remote.sh 上传并调用，也可手动跑）：
|
||
# ① 写 frpc 配置 + docker compose 拉起（需 sudo，会提示输 DSM 密码）
|
||
# ② mihomo 加 hosts 覆盖 / fake-ip-filter / use-hosts（幂等，自动备份，热重载）
|
||
# ③ 端到端验证
|
||
# 前提：/tmp/frp-setup/token 里是 frp auth token（由远端脚本从 Bitwarden 送来）。
|
||
set -euo pipefail
|
||
|
||
FRP_DIR=/volume1/docker/frp
|
||
CFG=/volume1/docker/proxy/mihomo/config.yaml
|
||
TOKEN_FILE=/tmp/frp-setup/token
|
||
|
||
[ -s "$TOKEN_FILE" ] || { echo "!! 缺 token 文件 $TOKEN_FILE（应由 setup-frp-remote.sh 生成）"; exit 1; }
|
||
read -r TOKEN < "$TOKEN_FILE"
|
||
|
||
echo "==> 1/6 写 frpc.toml + docker-compose.yml（sudo）"
|
||
sudo mkdir -p "$FRP_DIR"
|
||
sudo tee "$FRP_DIR/frpc.toml" > /dev/null <<EOF
|
||
serverAddr = "103.119.13.48"
|
||
serverPort = 7000
|
||
auth.method = "token"
|
||
auth.token = "$TOKEN"
|
||
transport.tls.enable = true
|
||
|
||
[[proxies]]
|
||
name = "git-ssh"
|
||
type = "tcp"
|
||
localIP = "127.0.0.1"
|
||
localPort = 2222
|
||
remotePort = 2222
|
||
|
||
[[proxies]]
|
||
name = "git-web"
|
||
type = "tcp"
|
||
localIP = "127.0.0.1"
|
||
localPort = 3000
|
||
remotePort = 3000
|
||
|
||
[[proxies]]
|
||
name = "dsm"
|
||
type = "tcp"
|
||
localIP = "127.0.0.1"
|
||
localPort = 5001
|
||
remotePort = 5001
|
||
|
||
[[proxies]]
|
||
name = "nas-ssh"
|
||
type = "tcp"
|
||
localIP = "127.0.0.1"
|
||
localPort = 22
|
||
remotePort = 10022
|
||
|
||
[[proxies]]
|
||
name = "win-rdp"
|
||
type = "tcp"
|
||
localIP = "192.168.3.88"
|
||
localPort = 3389
|
||
remotePort = 3389
|
||
|
||
[[proxies]]
|
||
name = "win-ssh"
|
||
type = "tcp"
|
||
localIP = "192.168.3.88"
|
||
localPort = 22
|
||
remotePort = 10023
|
||
EOF
|
||
sudo chmod 600 "$FRP_DIR/frpc.toml"
|
||
sudo tee "$FRP_DIR/docker-compose.yml" > /dev/null <<'EOF'
|
||
services:
|
||
frpc:
|
||
image: snowdreamtech/frpc:0.70.0
|
||
container_name: frpc
|
||
network_mode: host
|
||
restart: unless-stopped
|
||
volumes:
|
||
- ./frpc.toml:/etc/frp/frpc.toml:ro
|
||
EOF
|
||
|
||
echo "==> 2/6 拉起 frpc 容器"
|
||
# DSM 的 docker 在 /usr/local/bin（Container Manager 符号链接），不在 sudo 的 secure_path 里，必须绝对路径
|
||
DOCKER=/usr/local/bin/docker
|
||
COMPOSE=/usr/local/bin/docker-compose
|
||
cd "$FRP_DIR"
|
||
if sudo "$COMPOSE" version >/dev/null 2>&1; then
|
||
sudo "$COMPOSE" up -d
|
||
else
|
||
sudo "$DOCKER" compose up -d
|
||
fi
|
||
|
||
echo "==> 3/6 mihomo：hosts 覆盖 + fake-ip-filter + use-hosts（幂等）"
|
||
cp "$CFG" "$CFG.bak.frp"
|
||
echo " 备份: $CFG.bak.frp"
|
||
python3 - "$CFG" <<'PY'
|
||
import re, sys
|
||
|
||
p = sys.argv[1]
|
||
text = open(p).read()
|
||
orig = text
|
||
|
||
HOSTS = {
|
||
"nas.yanmeiai.com": "192.168.3.200",
|
||
"git.yanmeiai.com": "192.168.3.200",
|
||
"win.yanmeiai.com": "192.168.3.88",
|
||
"git.51yanmei.com": "192.168.3.200", # 兼容既有 git remote
|
||
}
|
||
|
||
lines = text.splitlines(True)
|
||
|
||
# ---- ① fake-ip-filter 追加域名（防 fake-ip 吞掉 hosts 真实值）----
|
||
missing = [d for d in HOSTS if ("'" + d + "'") not in text and ('"' + d + '"') not in text and ("- " + d) not in text]
|
||
out = []
|
||
inserted_filter = False
|
||
for i, ln in enumerate(lines):
|
||
out.append(ln)
|
||
if (not inserted_filter) and re.match(r"\s*fake-ip-filter:\s*$", ln):
|
||
# 探测下一行列表项缩进
|
||
indent = " "
|
||
for nxt in lines[i+1:]:
|
||
m = re.match(r"(\s*)- ", nxt)
|
||
if m:
|
||
indent = m.group(1)
|
||
break
|
||
for d in missing:
|
||
out.append(indent + "- '" + d + "'\n")
|
||
inserted_filter = True
|
||
if missing and not inserted_filter:
|
||
print(" !! 没找到 fake-ip-filter: 段，请人工检查", file=sys.stderr)
|
||
sys.exit(1)
|
||
lines = out
|
||
|
||
# ---- ② hosts 段（家内答案：域名 → 内网 IP）----
|
||
text = "".join(lines)
|
||
have_hosts = re.search(r"^hosts:\s*$", text, re.M)
|
||
need = {d: ip for d, ip in HOSTS.items() if not re.search(r"^\s+" + re.escape(d) + ":", text, re.M)}
|
||
if need:
|
||
if have_hosts:
|
||
out = []
|
||
done = False
|
||
for ln in text.splitlines(True):
|
||
out.append(ln)
|
||
if (not done) and re.match(r"^hosts:\s*$", ln):
|
||
for d, ip in need.items():
|
||
out.append(" " + d + ": " + ip + "\n")
|
||
done = True
|
||
text = "".join(out)
|
||
else:
|
||
block = "\nhosts:\n"
|
||
for d, ip in need.items():
|
||
block += " " + d + ": " + ip + "\n"
|
||
text += block
|
||
|
||
# ---- ③ dns.use-hosts: true（mihomo 默认 false，不开 hosts 对 DNS 响应不生效）----
|
||
if re.search(r"^\s*use-hosts:", text, re.M):
|
||
text = re.sub(r"(^\s*use-hosts:\s*)false", r"\1true", text, flags=re.M)
|
||
else:
|
||
out = []
|
||
done = False
|
||
for ln in text.splitlines(True):
|
||
out.append(ln)
|
||
if (not done) and re.match(r"^dns:\s*$", ln):
|
||
out.append(" use-hosts: true\n")
|
||
done = True
|
||
if not done:
|
||
print(" !! 没找到 dns: 段，请人工检查", file=sys.stderr)
|
||
sys.exit(1)
|
||
text = "".join(out)
|
||
|
||
if text != orig:
|
||
open(p, "w").write(text)
|
||
print(" 已写入（hosts %d 条新增 / fake-ip-filter %d 条新增）" % (len(need), len(missing)))
|
||
else:
|
||
print(" 无需改动（已是目标状态）")
|
||
PY
|
||
|
||
echo "==> 4/6 热重载 mihomo"
|
||
curl -s -X PUT 'http://127.0.0.1:9090/configs?force=true' \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"path":"/root/.config/mihomo/config.yaml"}'
|
||
echo " reload 已请求"
|
||
|
||
echo "==> 5/6 验证家内解析（期望 192.168.3.200）"
|
||
sleep 1
|
||
nslookup git.yanmeiai.com 127.0.0.1 2>&1 | tail -3
|
||
|
||
echo "==> 6/6 验证 frpc 隧道"
|
||
sleep 2
|
||
sudo /usr/local/bin/docker logs frpc --tail 20 2>&1 || true
|
||
rm -f "$TOKEN_FILE"
|
||
echo ""
|
||
echo "完成。检查上方日志：应有 'login to server success'，且 git-ssh/git-web/dsm/nas-ssh/win-rdp/win-ssh 六个 proxy 'start proxy success'。"
|
||
echo "若 login 失败：token 不对或 pangolin1:7000 不通；若个别 proxy 失败：对应本地端口没起。"
|