方案C:分发层容器化(edge nginx)+ Hy2 + DNS-01 续期

- edge: 容器化 nginx 接管 80/443,逐字移植现网 vhost(blog/jiu/marzban/pay)+ stream SNI 分流
- singbox: Hysteria2(host 网络,UDP 443)
- certbot: DNS-01(Cloudflare)续期,容器化
- xray: REALITY 仅 profile newnode(本台沿用 Marzban)
- deploy.sh 幂等且切换感知;cutover.sh 一次性停宿主 nginx 切容器(可秒级回滚)
- 弃用方案A 的 host nginx-apply/sudoers/root-setup
- 部署目录改 ~/pangolin(免 root);CI 注入 CF_API_TOKEN

EC2 实测:edge nginx -t 通过(真实证书)、compose 校验通过

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/scripts/print-clients.sh

@@ -1,13 +1,12 @@
 #!/usr/bin/env bash
-# print-clients.sh —— 生成两条客户端导入串,写入 ./secrets/clients.txt。
-# 注意:含口令/密钥,【不打印到 stdout】以免进入 CI 日志;手动 `ssh ec2 cat` 取用。
+# print-clients.sh —— 生成 pangolin 自有线路(本台仅 Hy2)的导入串,写 ./secrets/clients.txt。
+# 含口令,不打印到 stdout(避免进 CI 日志)。REALITY 仍由 Marzban 提供,不在此列。
 set -euo pipefail
 cd "$(dirname "$0")/.."   # -> deploy/
 
 # shellcheck disable=SC1091
 source ./secrets/pangolin.env
 
-# 公网 IP:优先 IMDSv2,可用 PANGOLIN_PUBLIC_IP 覆盖
 HOST="${PANGOLIN_PUBLIC_IP:-}"
 if [[ -z "$HOST" ]]; then
   TOKEN="$(curl -s -X PUT 'http://169.254.169.254/latest/api/token' -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' || true)"
@@ -15,27 +14,18 @@ if [[ -z "$HOST" ]]; then
 fi
 [[ -z "$HOST" ]] && HOST="YOUR_SERVER_IP"
 
-REALITY_LINK="vless://${UUID}@${HOST}:443?encryption=none&flow=xtls-rprx-vision&security=reality&sni=www.apple.com&fp=chrome&pbk=${REALITY_PUBLIC_KEY}&sid=${REALITY_SHORT_ID}&type=tcp#pangolin-reality"
 HY2_LINK="hysteria2://${HY2_PASSWORD}@${HOST}:443?insecure=1&sni=www.bing.com#pangolin-hy2"
 
 OUT="./secrets/clients.txt"
 umask 177
 cat > "$OUT" <<EOF
-# pangolin Phase-0 客户端导入信息  (生成于 $(date -u +%FT%TZ))
-# 含敏感信息,勿外泄。
+# pangolin 自有线路导入信息(生成于 $(date -u +%FT%TZ))。含敏感信息,勿外泄。
 
-[REALITY / VLESS+Vision]  —— 平时主线
-${REALITY_LINK}
-
-[Hysteria2]  —— 晚高峰加速线(自签证书,客户端需允许不安全/insecure)
+[Hysteria2]  —— 晚高峰加速线(自签证书,客户端需允许 insecure)
 ${HY2_LINK}
 
-字段速查:
-  server       = ${HOST}
-  REALITY sni  = www.apple.com   port=443/tcp   flow=xtls-rprx-vision
-  REALITY pbk  = ${REALITY_PUBLIC_KEY}
-  REALITY sid  = ${REALITY_SHORT_ID}
-  uuid         = ${UUID}
-  Hy2 sni      = www.bing.com    port=443/udp   insecure=1
+  server = ${HOST}   port = 443/udp   sni = www.bing.com   insecure = 1
+
+# 注:REALITY 主线仍由 Marzban 管理(SNI=www.cloudflare.com),不在此文件。
 EOF
-echo "[print-clients] 已写入 ${OUT}(用 'ssh ec2 cat /opt/pangolin/secrets/clients.txt' 取用)"
+echo "[print-clients] 已写入 ${OUT}(ssh ec2 cat /opt/pangolin/secrets/clients.txt 取用)"