Phase 0: 容器化数据面 + CI/CD 自动部署

- deploy/: Xray VLESS+REALITY (11443, 经宿主 nginx SNI 分流) + sing-box Hysteria2 (UDP 443) docker-compose - 幂等 deploy.sh / gen-secrets.sh / print-clients.sh;受限 nginx-apply 特权脚本 + 一次性 root-setup - .gitea/workflows/deploy.yml: NAS runner 经 SSH 远程部署到 EC2 - docs/ plan/: 设计方案与实施计划 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-05-30 11:48:21 +08:00
parent 833b8365da
commit cf96989e01
23 changed files with 1048 additions and 2 deletions
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# gen-secrets.sh —— 首次在 EC2 生成并持久化密钥/证书(幂等)。
+# 产物存于 ./secrets/(700,gitignore,绝不进仓库/CI 日志)。
+#   - pangolin.env : UUID / REALITY 公私钥 / shortId / Hy2 口令
+#   - hy2/hy2.crt, hy2/hy2.key : Hysteria2 自签证书(ECDSA)
+set -euo pipefail
+cd "$(dirname "$0")/.."   # -> deploy/
+
+SECRETS_DIR="./secrets"
+ENV_FILE="${SECRETS_DIR}/pangolin.env"
+HY2_DIR="${SECRETS_DIR}/hy2"
+XRAY_IMAGE="ghcr.io/xtls/xray-core:26.3.27"
+MASQ_CN="www.bing.com"
+
+mkdir -p "$HY2_DIR"
+chmod 700 "$SECRETS_DIR"
+
+if [[ -f "$ENV_FILE" ]]; then
+  echo "[gen-secrets] $ENV_FILE 已存在,跳过密钥生成(幂等)"
+else
+  echo "[gen-secrets] 生成 REALITY 密钥对 / UUID / shortId / Hy2 口令 ..."
+  # REALITY x25519 密钥对(从 xray 输出解析 Private/Public)
+  KP="$(docker run --rm "$XRAY_IMAGE" x25519)"
+  REALITY_PRIVATE_KEY="$(printf '%s\n' "$KP" | awk -F': ' '/Private/{print $2}')"
+  REALITY_PUBLIC_KEY="$(printf '%s\n' "$KP" | awk -F': ' '/Public/{print $2}')"
+  UUID="$(cat /proc/sys/kernel/random/uuid)"
+  REALITY_SHORT_ID="$(openssl rand -hex 8)"
+  HY2_PASSWORD="$(openssl rand -base64 18 | tr -d '/+=' | cut -c1-24)"
+
+  umask 177
+  cat > "$ENV_FILE" <<EOF
+# pangolin Phase-0 secrets —— 切勿提交/外泄
+UUID=${UUID}
+REALITY_PRIVATE_KEY=${REALITY_PRIVATE_KEY}
+REALITY_PUBLIC_KEY=${REALITY_PUBLIC_KEY}
+REALITY_SHORT_ID=${REALITY_SHORT_ID}
+HY2_PASSWORD=${HY2_PASSWORD}
+EOF
+  echo "[gen-secrets] 已写入 $ENV_FILE"
+fi
+
+# Hysteria2 自签证书(幂等)
+if [[ -f "${HY2_DIR}/hy2.crt" && -f "${HY2_DIR}/hy2.key" ]]; then
+  echo "[gen-secrets] Hy2 证书已存在,跳过"
+else
+  echo "[gen-secrets] 生成 Hy2 自签证书 (CN=${MASQ_CN}) ..."
+  openssl ecparam -genkey -name prime256v1 -out "${HY2_DIR}/hy2.key"
+  openssl req -new -x509 -days 3650 -key "${HY2_DIR}/hy2.key" \
+    -out "${HY2_DIR}/hy2.crt" -subj "/CN=${MASQ_CN}"
+  # sing-box 容器内以 root 运行,证书需可读
+  chmod 644 "${HY2_DIR}/hy2.crt" "${HY2_DIR}/hy2.key"
+  echo "[gen-secrets] 已写入 Hy2 证书"
+fi