wangjia/pangolin
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases 19 Wiki Activity
247 Commits 5 Branches 41 Tags
29ddd5b4532415e97c3de60b068eef829b3288e7
Commit Graph

17 Commits

Author SHA1 Message Date
wangjia 43b25c8aa0 feat: 国内流量直连分流(geoip-cn / geosite-cn)— #5
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
国内 IP/域名直连(不走隧道)→ 省流量 + 国内访问快;非国内走代理。

- clientconfig.go: BuildClientConfig 加 ClientConfigOpts{SplitCN,RulesBaseURL};
  开启时 route 加 {rule_set:[geoip-cn,geosite-cn]→direct} + 定义 rule_set
  (remote .srs,download_detour:direct 直连下载)
- rules.go: 控制面静态服务 /v1/rules/{name}.srs(白名单防穿越)——自托管避免
  GitHub 在国内被墙的鸡生蛋;客户端反正连控制面,可达性有保证
- nodes.go ConnectNode: 读 ?split_cn → opts;NodeAPI 加 rulesBaseURL
  (PANGOLIN_PUBLIC_URL);main.go 挂 /v1/rules 路由 + RulesHandler
- 客户端: connect_api splitCN→?split_cn=1;connection_provider 传 smartRoute 偏好
- deploy/single-node: 拉 geoip-cn/geosite-cn.srs 到 $DATA_DIR/rules +
  设 PANGOLIN_PUBLIC_URL/PANGOLIN_RULES_DIR

验证:go test(splitCN 开/关渲染 + RulesHandler 白名单/404)+ flutter analyze +
shellcheck;不需要节点。订阅链接暂用默认 opts、DNS 分流为后续增强。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-19 20:34:00 +08:00
wangjia a879494fe1 feat(monitor): 1 分钟采集 + 连续 N 次异常才告警(去抖)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
避免瞬时尖峰/部署窗口误报(此前 sing-box 部署期 activating 触发了一次误报)。
- 采集间隔 5min → 1min(MONITOR_INTERVAL_MIN=1)
- 新增 MONITOR_BREACH_RUNS=5:连续 5 次采样都异常才告警一次(状态存
  /var/lib/pangolin-monitor/breach_count);恢复后发一条恢复通知并清零
- 去掉 MONITOR_SEND_OK_PULSE(被去抖逻辑取代)
- 已在 racknerd 验证:连 4 次异常不报、恢复清零

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 08:05:09 +08:00
wangjia 5d90610649 feat(single-node): 改 SQLite + 非特权 pangolin 用户 + 免 Docker(512MB 可跑)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
为小内存机收尾单机栈,已在 racknerd(107.172.55.251)实跑验证通过:
- 数据库:MySQL(docker)→ SQLite 文件(DB_DRIVER=sqlite);Redis 改 apt 原生
  (免 Docker);依赖 redis-server/sqlite3/polkitd/sing-box 由 deploy.sh 自动装
- 运行身份:三 systemd 单元 User=root → User=pangolin;sing-box 经
  AmbientCapabilities 绑 443;新增 polkit 规则让 pangolin 仅可重启 sing-box
- 二进制:支持预置(机上无 go 时用交叉编译产物;SQLite 纯 Go 免 CGO)
- 端口:REALITY 默认 443/tcp(对齐 bootstrap 防火墙);deploy.sh 放行 8080/tcp
- 修 sing-box.service:ExecStart 按实际安装路径渲染(官方 .deb 在 /usr/bin)
- Hy2 默认关闭:控制面尚未下发 Hy2 TLS 证书(handler_grpc.go 仅发 ListenPort)
  → 开启会 missing certificate;待补全证书后传 HY2_PORT=443 开启
- 删 docker-compose.yml;seed TRUE→1;README 同步

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 07:46:54 +08:00
wangjia 1d76c00f66 chore(bootstrap): 监控阈值降至 80% + 关闭正常心跳(仅异常告警)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
CPU/MEM/DISK 阈值 90/90/85 → 统一 80;MONITOR_SEND_OK_PULSE true → false
(默认只在异常时推送,正常不打扰)。同步 init.sh 默认值与 bootstrap.env.example。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 07:17:22 +08:00
wangjia d8b8752ec4 fix(bootstrap): monitor env 含空格的值加引号(MONITOR_UNITS 等)
ci-pangolin / Lint — shellcheck (push) Has been cancelled
Details
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
Details
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
Details
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Details 
/etc/pangolin-monitor.env 既被 systemd EnvironmentFile 读、也被 monitor 脚本
source(shell)。未加引号时 `MONITOR_UNITS=sing-box pangolin-agent` 被 shell
解析成"带环境变量跑 pangolin-agent 命令" → command not found 且单元监控失效。
给 NODE_NAME/MONITOR_UNITS/MONITOR_NET_PROBE 加引号修复。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 07:13:26 +08:00
wangjia bf81c786b2 chore(deploy): 删除 EC2 部署栈,转向 RackNerd 自建节点栈 
EC2(marzban 共存)分发面不再由本仓库管理,全面转向新 VPS 自建。删除:
- deploy/{edge,singbox,xray,certbot,backup,scripts,docker-compose.yml,.env.example,README.md}
- .gitea/workflows/deploy.yml(EC2 自动部署 CD)
- ci/nginx-test.sh(edge nginx 校验)
保留 deploy/{bootstrap,single-node}(新节点初始化 + 全套自建)。

ci.yml 去掉 EC2 相关 job(compose/nginx 校验、edge 镜像构建),
shellcheck 改为校验 bootstrap/single-node 脚本;openapi/脱敏/flutter 不变。
deadman-watch 的"EC2"特指改为"任意常在线主机"。

注:EC2 上正在跑的服务不受影响(仅本仓库不再管理它)。文档(CLAUDE.md、
docs/回滚手册.md、app/kernel/poc/README.md)仍引用旧栈,待单独更新。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 06:55:25 +08:00
wangjia ff9a40277d feat(deploy/bootstrap): 节点幂等初始化脚本(加固+pangolin用户+监控+防火墙) 
全新 Debian 12 一键初始化,后续新机复用。四块:
- 系统:apt 升级+基础包(含 python3-systemd)、时区、swap 补足、sysctl(BBR/fq/句柄/队列)
- Pangolin:建 pangolin 非特权系统用户(/var/lib/pangolin, nologin)
- 网络安全:ufw 默认拒入站、放行 SSH+443(tcp/udp);fail2ban sshd jail
  (精简 Debian 无 rsyslog/auth.log → backend=systemd 读 journald)
- SSH 加固:root 仅密钥、可选禁密码(仅当已有 authorized_keys 时生效,防锁死)
- 监控:pangolin-monitor(systemd timer,CPU/内存/磁盘/进程/出网 → Telegram,
  异常+心跳);deadman-watch(EC2 侧主动探活,补"宕机/不上报"告警)

已在 racknerd(107.172.55.251)实跑验证全部步骤通过。密钥/真实配置 gitignore。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-18 01:30:55 +08:00
wangjia 912a495e91 feat(deploy): 单节点全套部署脚本 deploy/single-node（档 3 真机准备） 
一台全新 Ubuntu/Debian VPS 上一条命令起整套 pangolin：MySQL + Redis（docker）
+ 控制面（HTTP + gRPC agent 服务）+ 节点 agent + sing-box 数据面，客户端连该
VPS 公网 IP 真实出网。

- deploy.sh：幂等编排——构建二进制 → docker MySQL/Redis → 生成 JWT/webhook/
  derive 密钥 + Node CA + CA 签发的 gRPC server 证书（SAN localhost，匹配 agent
  enroll 后的 mTLS 校验）+ REALITY 密钥对（持久化跨重部署）→ migrate + seed 节点
  → 起控制面（走完整 gRPC 分支）→ nodectl bootstrap-token → 起 agent + sing-box。
- systemd/{pangolin-server,pangolin-agent,sing-box}.service、docker-compose.yml
  （MySQL/Redis 仅 loopback）、seed-node.sql.tmpl。
- README.md：架构图 + 部署/验证步骤 + 客户端接线（API URL / PANGOLIN_SINGBOX_BIN
  / sudoers / 真节点 uuid，客户端代码无改动）+ 排查指引。

本机验证：shellcheck + bash -n 通过；openssl CA ↔ mtls.NewCA + gRPC 证书链互通
已单测实测通过。VPS 端到端（出口 IP == VPS IP）待真机到位后执行。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-17 00:32:47 +08:00
wangjia 71a4cddf0b sync(edge): jiu.conf 反向同步线上版本(OG 注入 + /downloads + /app/product 重写) 
EC2 上的 jiu.conf 早于本次已含商品页反代后端注入微信 OG 标签、
/app/product 重写、/downloads 安装包下载,但从未同步回仓库。
本次以线上为准回灌,避免下次 deploy.sh 用旧版覆盖线上配置。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-16 08:38:27 +08:00
wangjia 20dbb5f363 feat(backup): 备份与灾备演练系统 [tsk_bYv-CoKSwgAC] 
实现 xtrabackup + binlog 增量备份、age 加密异地存储与月度 DR 演练。

## 交付内容

### deploy/backup/ —— 备份容器
- Dockerfile：Ubuntu 22.04 + xtrabackup 8.0 + age v1.2.0 + AWS CLI v2 + pg_client
- entrypoint.sh：初始化 AWS 凭据 / age 公钥，启动 crond
- crontab.txt：全量 02:00 / 增量每 15min / DR 演练每月 1 日
- scripts/lib.sh：日志 / age 加密 / S3 上传 / 连接测试等共用函数
- scripts/backup-full.sh：MySQL xtrabackup 全量 + pg_dump 全量 + SQLite 备份
- scripts/backup-inc.sh：MySQL xtrabackup 增量 + binlog flush & 归档 + pg_dump 快照
- scripts/restore.sh：从 S3 下载、解密、prepare / pg_restore 完整恢复
- scripts/dr-drill.sh：月度演练 —— RPO 验证 / 备份完整性 / MySQL 临时容器恢复 / RTO 度量
- scripts/verify-rpo-rto.sh：实时 RPO/RTO 状态检查（S3 最新备份时间戳）
- backup.env.example：配置模板（MySQL / PG / S3 / age 公钥）

### 修改已有文件
- deploy/docker-compose.yml：新增 pangolin-backup 服务
- deploy/scripts/gen-secrets.sh：幂等生成 age 密钥对 + backup.env 模板
- .gitignore：排除 age 私钥 / backup.env
- deploy/README.md：容器一览 + 备份快速命令

### docs/备份与灾备.md
S3 初始化、IAM 权限设计、age 密钥管理、MySQL 权限、DR 恢复步骤、RTO 测量标准

## 设计要点
- RPO ≤ 15min：每 15min xtrabackup 增量 + binlog flush + pg_dump 快照
- RTO ≤ 4h：月度演练度量，估算恢复时长约 2h
- 独立身份账号：备份 IAM 仅有 s3:PutObject，与生产账号完全隔离
- age 加密：公钥存服务器，私钥离线保存，S3 中无明文
- 无 crontab：cron 在容器内运行，绕过 ec2-user crontab 限制
- 幂等部署：backup.env 存在则跳过，age 密钥对存在则跳过

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-13 01:09:18 +08:00
wangjia 73e026a4df edge 容器自带证书续期(certbot in nginx 镜像)
deploy-pangolin / deploy (push) Has been cancelled
Details 
- edge 改为自定义镜像:官方 nginx + certbot + dns-cloudflare 插件
- pangolin-entrypoint.sh:后台每12h certbot renew,续期后本容器内 nginx -s reload
- 不再需要宿主 cron / docker socket / 独立 certbot 服务做日常续期
- /etc/letsencrypt 改 rw 挂载,挂入 cloudflare.ini
- compose 去掉 build:(宿主 docker-compose 不支持 compose build),改脚本 docker build
- deploy.sh/cutover.sh: docker build -t pangolin-edge:local 后再 up

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-30 23:10:17 +08:00
wangjia 39e7f2fc11 回滚:rollback.sh + docs/回滚手册.md
deploy-pangolin / deploy (push) Has been cancelled
Details 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-30 17:09:00 +08:00
wangjia 1bb3a26f0c cutover: 失败自动回滚到宿主 nginx
deploy-pangolin / deploy (push) Has been cancelled
Details 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-30 16:52:05 +08:00
wangjia fa3954724c print-clients: 修正提示路径为 ~/pangolin
deploy-pangolin / deploy (push) Has been cancelled
Details 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-30 16:45:15 +08:00
wangjia 1a346c32c1 方案C:分发层容器化(edge nginx)+ Hy2 + DNS-01 续期
deploy-pangolin / deploy (push) Has been cancelled
Details 
- edge: 容器化 nginx 接管 80/443,逐字移植现网 vhost(blog/jiu/marzban/pay)+ stream SNI 分流
- singbox: Hysteria2(host 网络,UDP 443)
- certbot: DNS-01(Cloudflare)续期,容器化
- xray: REALITY 仅 profile newnode(本台沿用 Marzban)
- deploy.sh 幂等且切换感知;cutover.sh 一次性停宿主 nginx 切容器(可秒级回滚)
- 弃用方案A 的 host nginx-apply/sudoers/root-setup
- 部署目录改 ~/pangolin(免 root);CI 注入 CF_API_TOKEN

EC2 实测:edge nginx -t 通过(真实证书)、compose 校验通过

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-30 16:42:30 +08:00
wangjia bc77e85b7d root-setup: 同时创建并授权 /opt/pangolin 部署目录
deploy-pangolin / deploy (push) Has been cancelled
Details 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-30 11:52:32 +08:00
wangjia cf96989e01 Phase 0: 容器化数据面 + CI/CD 自动部署
deploy-pangolin / deploy (push) Has been cancelled
Details 
- deploy/: Xray VLESS+REALITY (11443, 经宿主 nginx SNI 分流) + sing-box Hysteria2 (UDP 443) docker-compose
- 幂等 deploy.sh / gen-secrets.sh / print-clients.sh;受限 nginx-apply 特权脚本 + 一次性 root-setup
- .gitea/workflows/deploy.yml: NAS runner 经 SSH 远程部署到 EC2
- docs/ plan/: 设计方案与实施计划

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-05-30 11:48:47 +08:00