- deploy/: Xray VLESS+REALITY (11443, 经宿主 nginx SNI 分流) + sing-box Hysteria2 (UDP 443) docker-compose - 幂等 deploy.sh / gen-secrets.sh / print-clients.sh;受限 nginx-apply 特权脚本 + 一次性 root-setup - .gitea/workflows/deploy.yml: NAS runner 经 SSH 远程部署到 EC2 - docs/ plan/: 设计方案与实施计划 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
wangjia
Executable
+61
@@ -0,0 +1,61 @@
|
||||
#!/usr/bin/env bash
|
||||
# deploy.sh —— 在 EC2 上幂等编排 pangolin 数据面。
|
||||
# 由 CI(NAS runner via ssh)调用,也可手动 `ssh ec2 'cd /opt/pangolin && ./scripts/deploy.sh'`。
|
||||
#
|
||||
# 步骤:生成密钥 -> 渲染配置 -> docker-compose up -> (幂等)加 nginx 路由 -> 健康检查 -> 输出客户端信息
|
||||
# 全程不触碰 marzban/blog/jiu;唯一特权动作是 sudo 调用受限的 nginx-apply 脚本。
|
||||
set -euo pipefail
|
||||
cd "$(dirname "$0")/.." # -> deploy/
|
||||
|
||||
COMPOSE="docker-compose -p pangolin"
|
||||
NGINX_APPLY="/usr/local/sbin/pangolin-nginx-apply.sh"
|
||||
|
||||
echo "==> [1/5] 生成/复用密钥与证书"
|
||||
./scripts/gen-secrets.sh
|
||||
|
||||
echo "==> [2/5] 渲染配置(模板 -> config.json)"
|
||||
# shellcheck disable=SC1091
|
||||
source ./secrets/pangolin.env
|
||||
render() { # render <tmpl> <out>
|
||||
sed -e "s|__UUID__|${UUID}|g" \
|
||||
-e "s|__REALITY_PRIVATE_KEY__|${REALITY_PRIVATE_KEY}|g" \
|
||||
-e "s|__REALITY_SHORT_ID__|${REALITY_SHORT_ID}|g" \
|
||||
-e "s|__HY2_PASSWORD__|${HY2_PASSWORD}|g" \
|
||||
"$1" > "$2"
|
||||
}
|
||||
render ./xray/config.tmpl.json ./xray/config.json
|
||||
render ./singbox/config.tmpl.json ./singbox/config.json
|
||||
|
||||
echo "==> [3/5] 拉起容器(docker-compose up -d)"
|
||||
$COMPOSE pull --quiet || true
|
||||
$COMPOSE up -d
|
||||
$COMPOSE ps
|
||||
|
||||
echo "==> [4/5] nginx SNI 路由(幂等)"
|
||||
if grep -qF "127.0.0.1:11443" /etc/nginx/stream.conf 2>/dev/null; then
|
||||
echo " 路由已存在,跳过"
|
||||
elif [[ -x "$NGINX_APPLY" ]]; then
|
||||
sudo "$NGINX_APPLY"
|
||||
else
|
||||
echo " !! 未找到 $NGINX_APPLY(需先执行一次性 root 前置 setup/root-setup.sh)" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "==> [5/5] 健康检查"
|
||||
ok=1
|
||||
# REALITY:经宿主 nginx 用 www.apple.com 做 TLS 握手应成功
|
||||
if echo | timeout 10 openssl s_client -connect 127.0.0.1:443 -servername www.apple.com >/dev/null 2>&1; then
|
||||
echo " [REALITY] 443/www.apple.com 握手 OK"
|
||||
else
|
||||
echo " [REALITY] 握手失败"; ok=0
|
||||
fi
|
||||
# Hy2:UDP 443 应有 sing-box 在监听
|
||||
if ss -uln 2>/dev/null | grep -q ":443 "; then
|
||||
echo " [Hy2] UDP 443 监听 OK"
|
||||
else
|
||||
echo " [Hy2] UDP 443 未监听"; ok=0
|
||||
fi
|
||||
|
||||
./scripts/print-clients.sh
|
||||
|
||||
[[ "$ok" == "1" ]] && echo "==> 部署完成 ✅" || { echo "==> 健康检查未通过 ❌"; exit 1; }
|
||||
Executable
+53
@@ -0,0 +1,53 @@
|
||||
#!/usr/bin/env bash
|
||||
# gen-secrets.sh —— 首次在 EC2 生成并持久化密钥/证书(幂等)。
|
||||
# 产物存于 ./secrets/(700,gitignore,绝不进仓库/CI 日志)。
|
||||
# - pangolin.env : UUID / REALITY 公私钥 / shortId / Hy2 口令
|
||||
# - hy2/hy2.crt, hy2/hy2.key : Hysteria2 自签证书(ECDSA)
|
||||
set -euo pipefail
|
||||
cd "$(dirname "$0")/.." # -> deploy/
|
||||
|
||||
SECRETS_DIR="./secrets"
|
||||
ENV_FILE="${SECRETS_DIR}/pangolin.env"
|
||||
HY2_DIR="${SECRETS_DIR}/hy2"
|
||||
XRAY_IMAGE="ghcr.io/xtls/xray-core:26.3.27"
|
||||
MASQ_CN="www.bing.com"
|
||||
|
||||
mkdir -p "$HY2_DIR"
|
||||
chmod 700 "$SECRETS_DIR"
|
||||
|
||||
if [[ -f "$ENV_FILE" ]]; then
|
||||
echo "[gen-secrets] $ENV_FILE 已存在,跳过密钥生成(幂等)"
|
||||
else
|
||||
echo "[gen-secrets] 生成 REALITY 密钥对 / UUID / shortId / Hy2 口令 ..."
|
||||
# REALITY x25519 密钥对(从 xray 输出解析 Private/Public)
|
||||
KP="$(docker run --rm "$XRAY_IMAGE" x25519)"
|
||||
REALITY_PRIVATE_KEY="$(printf '%s\n' "$KP" | awk -F': ' '/Private/{print $2}')"
|
||||
REALITY_PUBLIC_KEY="$(printf '%s\n' "$KP" | awk -F': ' '/Public/{print $2}')"
|
||||
UUID="$(cat /proc/sys/kernel/random/uuid)"
|
||||
REALITY_SHORT_ID="$(openssl rand -hex 8)"
|
||||
HY2_PASSWORD="$(openssl rand -base64 18 | tr -d '/+=' | cut -c1-24)"
|
||||
|
||||
umask 177
|
||||
cat > "$ENV_FILE" <<EOF
|
||||
# pangolin Phase-0 secrets —— 切勿提交/外泄
|
||||
UUID=${UUID}
|
||||
REALITY_PRIVATE_KEY=${REALITY_PRIVATE_KEY}
|
||||
REALITY_PUBLIC_KEY=${REALITY_PUBLIC_KEY}
|
||||
REALITY_SHORT_ID=${REALITY_SHORT_ID}
|
||||
HY2_PASSWORD=${HY2_PASSWORD}
|
||||
EOF
|
||||
echo "[gen-secrets] 已写入 $ENV_FILE"
|
||||
fi
|
||||
|
||||
# Hysteria2 自签证书(幂等)
|
||||
if [[ -f "${HY2_DIR}/hy2.crt" && -f "${HY2_DIR}/hy2.key" ]]; then
|
||||
echo "[gen-secrets] Hy2 证书已存在,跳过"
|
||||
else
|
||||
echo "[gen-secrets] 生成 Hy2 自签证书 (CN=${MASQ_CN}) ..."
|
||||
openssl ecparam -genkey -name prime256v1 -out "${HY2_DIR}/hy2.key"
|
||||
openssl req -new -x509 -days 3650 -key "${HY2_DIR}/hy2.key" \
|
||||
-out "${HY2_DIR}/hy2.crt" -subj "/CN=${MASQ_CN}"
|
||||
# sing-box 容器内以 root 运行,证书需可读
|
||||
chmod 644 "${HY2_DIR}/hy2.crt" "${HY2_DIR}/hy2.key"
|
||||
echo "[gen-secrets] 已写入 Hy2 证书"
|
||||
fi
|
||||
Executable
+41
@@ -0,0 +1,41 @@
|
||||
#!/usr/bin/env bash
|
||||
# print-clients.sh —— 生成两条客户端导入串,写入 ./secrets/clients.txt。
|
||||
# 注意:含口令/密钥,【不打印到 stdout】以免进入 CI 日志;手动 `ssh ec2 cat` 取用。
|
||||
set -euo pipefail
|
||||
cd "$(dirname "$0")/.." # -> deploy/
|
||||
|
||||
# shellcheck disable=SC1091
|
||||
source ./secrets/pangolin.env
|
||||
|
||||
# 公网 IP:优先 IMDSv2,可用 PANGOLIN_PUBLIC_IP 覆盖
|
||||
HOST="${PANGOLIN_PUBLIC_IP:-}"
|
||||
if [[ -z "$HOST" ]]; then
|
||||
TOKEN="$(curl -s -X PUT 'http://169.254.169.254/latest/api/token' -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' || true)"
|
||||
HOST="$(curl -s -H "X-aws-ec2-metadata-token: ${TOKEN}" http://169.254.169.254/latest/meta-data/public-ipv4 || true)"
|
||||
fi
|
||||
[[ -z "$HOST" ]] && HOST="YOUR_SERVER_IP"
|
||||
|
||||
REALITY_LINK="vless://${UUID}@${HOST}:443?encryption=none&flow=xtls-rprx-vision&security=reality&sni=www.apple.com&fp=chrome&pbk=${REALITY_PUBLIC_KEY}&sid=${REALITY_SHORT_ID}&type=tcp#pangolin-reality"
|
||||
HY2_LINK="hysteria2://${HY2_PASSWORD}@${HOST}:443?insecure=1&sni=www.bing.com#pangolin-hy2"
|
||||
|
||||
OUT="./secrets/clients.txt"
|
||||
umask 177
|
||||
cat > "$OUT" <<EOF
|
||||
# pangolin Phase-0 客户端导入信息 (生成于 $(date -u +%FT%TZ))
|
||||
# 含敏感信息,勿外泄。
|
||||
|
||||
[REALITY / VLESS+Vision] —— 平时主线
|
||||
${REALITY_LINK}
|
||||
|
||||
[Hysteria2] —— 晚高峰加速线(自签证书,客户端需允许不安全/insecure)
|
||||
${HY2_LINK}
|
||||
|
||||
字段速查:
|
||||
server = ${HOST}
|
||||
REALITY sni = www.apple.com port=443/tcp flow=xtls-rprx-vision
|
||||
REALITY pbk = ${REALITY_PUBLIC_KEY}
|
||||
REALITY sid = ${REALITY_SHORT_ID}
|
||||
uuid = ${UUID}
|
||||
Hy2 sni = www.bing.com port=443/udp insecure=1
|
||||
EOF
|
||||
echo "[print-clients] 已写入 ${OUT}(用 'ssh ec2 cat /opt/pangolin/secrets/clients.txt' 取用)"
|
||||
Reference in New Issue
Block a user