From def3bb34b8a63b43a25a953241da70420af42ce2 Mon Sep 17 00:00:00 2001 From: wangjia <809946525@qq.com> Date: Sun, 9 Aug 2026 10:02:10 +0800 Subject: [PATCH] =?UTF-8?q?fix(server):=20=E6=8E=A7=E5=88=B6=E9=9D=A2=2080?= =?UTF-8?q?80=20=E6=94=B6=E5=8F=A3=E2=80=94=E2=80=94=E9=BB=98=E8=AE=A4?= =?UTF-8?q?=E7=BB=91=20loopback=20+=20=E9=83=A8=E7=BD=B2=E6=97=B6=E5=B9=82?= =?UTF-8?q?=E7=AD=89=E7=BA=A0=E5=81=8F=20ADDR/ufw?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 现网 server.env 漂移成 ADDR=:8080(全网卡),ufw 又放行 8080 → 控制面 API 明文 裸奔公网(http://:8080),绕过 cloudflared/CF 的 TLS 层。两处硬化: - main.go:ADDR 未设时默认由 :8080 改 127.0.0.1:8080(防御纵深;跨主机监听须显式设 ADDR) - deploy-server.sh:部署重启前幂等把 ADDR=:8080 纠回 127.0.0.1:8080(备份原文件)+ 撤 ufw allow 8080/tcp。收口随 server-v* 发版自动落地,不再手改线上。 Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD --- scripts/ci/deploy-server.sh | 12 ++++++++++++ server/cmd/server/main.go | 6 ++++-- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/scripts/ci/deploy-server.sh b/scripts/ci/deploy-server.sh index 91b3414..419b51e 100644 --- a/scripts/ci/deploy-server.sh +++ b/scripts/ci/deploy-server.sh @@ -52,6 +52,18 @@ install -m755 /tmp/pangolin-server "$BIN/pangolin-server" install -m755 /tmp/pangolin-agent "$BIN/pangolin-agent" install -m755 /tmp/pangolin-migrate "$BIN/pangolin-migrate" install -m755 /tmp/pangolin-nodectl "$BIN/pangolin-nodectl" +# ── 控制面收口(幂等):HTTP API 只绑 loopback,经 cloudflared 隧道对外,关公网 8080 ── +# 现网 server.env 曾漂移成 ADDR=:8080(全网卡明文暴露 http://<公网IP>:8080,绕过 CF/TLS)。 +# 这里在重启前把它纠回 127.0.0.1:8080 并撤掉 ufw 放行,随本次部署自动生效——不再手改线上。 +# 幂等:仅当精确匹配公网形态 ADDR=:8080 才改;已收口则跳过。备份原文件。 +if grep -qxF 'ADDR=:8080' /etc/pangolin/server.env; then + cp -p /etc/pangolin/server.env "/etc/pangolin/server.env.bak-addr-$TAG" + sed -i 's/^ADDR=:8080\$/ADDR=127.0.0.1:8080/' /etc/pangolin/server.env + echo "==> deploy-server: ADDR 收口 :8080 -> 127.0.0.1:8080" +fi +if command -v ufw >/dev/null 2>&1; then + ufw delete allow 8080/tcp >/dev/null 2>&1 || true +fi systemctl start pangolin-server systemctl is-active pangolin-server REMOTE diff --git a/server/cmd/server/main.go b/server/cmd/server/main.go index 036951d..fd9e54b 100644 --- a/server/cmd/server/main.go +++ b/server/cmd/server/main.go @@ -48,14 +48,16 @@ import ( ) func main() { - listenAddr := flag.String("addr", "", "HTTP listen address (default :8080, overridden by ADDR env)") + listenAddr := flag.String("addr", "", "HTTP listen address (default 127.0.0.1:8080, overridden by ADDR env)") flag.Parse() if *listenAddr == "" { if v := os.Getenv("ADDR"); v != "" { *listenAddr = v } else { - *listenAddr = ":8080" + // 默认只绑 loopback:控制面对外一律经 cloudflared 隧道(见 CLAUDE.md), + // 源站不该裸监听公网。要跨主机监听须显式设 ADDR=:8080(明知代价)。 + *listenAddr = "127.0.0.1:8080" } }