Phase 0: 容器化数据面 + CI/CD 自动部署

- deploy/: Xray VLESS+REALITY (11443, 经宿主 nginx SNI 分流) + sing-box Hysteria2 (UDP 443) docker-compose
- 幂等 deploy.sh / gen-secrets.sh / print-clients.sh;受限 nginx-apply 特权脚本 + 一次性 root-setup
- .gitea/workflows/deploy.yml: NAS runner 经 SSH 远程部署到 EC2
- docs/ plan/: 设计方案与实施计划

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/scripts/print-clients.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# print-clients.sh —— 生成两条客户端导入串,写入 ./secrets/clients.txt。
+# 注意:含口令/密钥,【不打印到 stdout】以免进入 CI 日志;手动 `ssh ec2 cat` 取用。
+set -euo pipefail
+cd "$(dirname "$0")/.."   # -> deploy/
+
+# shellcheck disable=SC1091
+source ./secrets/pangolin.env
+
+# 公网 IP:优先 IMDSv2,可用 PANGOLIN_PUBLIC_IP 覆盖
+HOST="${PANGOLIN_PUBLIC_IP:-}"
+if [[ -z "$HOST" ]]; then
+  TOKEN="$(curl -s -X PUT 'http://169.254.169.254/latest/api/token' -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' || true)"
+  HOST="$(curl -s -H "X-aws-ec2-metadata-token: ${TOKEN}" http://169.254.169.254/latest/meta-data/public-ipv4 || true)"
+fi
+[[ -z "$HOST" ]] && HOST="YOUR_SERVER_IP"
+
+REALITY_LINK="vless://${UUID}@${HOST}:443?encryption=none&flow=xtls-rprx-vision&security=reality&sni=www.apple.com&fp=chrome&pbk=${REALITY_PUBLIC_KEY}&sid=${REALITY_SHORT_ID}&type=tcp#pangolin-reality"
+HY2_LINK="hysteria2://${HY2_PASSWORD}@${HOST}:443?insecure=1&sni=www.bing.com#pangolin-hy2"
+
+OUT="./secrets/clients.txt"
+umask 177
+cat > "$OUT" <<EOF
+# pangolin Phase-0 客户端导入信息  (生成于 $(date -u +%FT%TZ))
+# 含敏感信息,勿外泄。
+
+[REALITY / VLESS+Vision]  —— 平时主线
+${REALITY_LINK}
+
+[Hysteria2]  —— 晚高峰加速线(自签证书,客户端需允许不安全/insecure)
+${HY2_LINK}
+
+字段速查:
+  server       = ${HOST}
+  REALITY sni  = www.apple.com   port=443/tcp   flow=xtls-rprx-vision
+  REALITY pbk  = ${REALITY_PUBLIC_KEY}
+  REALITY sid  = ${REALITY_SHORT_ID}
+  uuid         = ${UUID}
+  Hy2 sni      = www.bing.com    port=443/udp   insecure=1
+EOF
+echo "[print-clients] 已写入 ${OUT}(用 'ssh ec2 cat /opt/pangolin/secrets/clients.txt' 取用)"