wangjia
1a346c32c1
deploy-pangolin / deploy (push) Has been cancelled
- edge: 容器化 nginx 接管 80/443,逐字移植现网 vhost(blog/jiu/marzban/pay)+ stream SNI 分流 - singbox: Hysteria2(host 网络,UDP 443) - certbot: DNS-01(Cloudflare)续期,容器化 - xray: REALITY 仅 profile newnode(本台沿用 Marzban) - deploy.sh 幂等且切换感知;cutover.sh 一次性停宿主 nginx 切容器(可秒级回滚) - 弃用方案A 的 host nginx-apply/sudoers/root-setup - 部署目录改 ~/pangolin(免 root);CI 注入 CF_API_TOKEN EC2 实测:edge nginx -t 通过(真实证书)、compose 校验通过 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
46 lines
1.5 KiB
Bash
Executable File
46 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# gen-secrets.sh —— 幂等生成本台所需密钥/证书,持久化到 ./secrets/(700,gitignore)。
|
|
# - pangolin.env : HY2_PASSWORD
|
|
# - hy2/hy2.crt,hy2.key: Hysteria2 自签证书(ECDSA)
|
|
# - cloudflare.ini : 由 $CF_API_TOKEN 渲染(证书续期用),600
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.." # -> deploy/
|
|
|
|
SECRETS_DIR="./secrets"
|
|
ENV_FILE="${SECRETS_DIR}/pangolin.env"
|
|
HY2_DIR="${SECRETS_DIR}/hy2"
|
|
MASQ_CN="www.bing.com"
|
|
|
|
mkdir -p "$HY2_DIR"
|
|
chmod 700 "$SECRETS_DIR"
|
|
|
|
# Hy2 口令
|
|
if [[ -f "$ENV_FILE" ]]; then
|
|
echo "[gen-secrets] $ENV_FILE 已存在,跳过"
|
|
else
|
|
HY2_PASSWORD="$(openssl rand -base64 18 | tr -d '/+=' | cut -c1-24)"
|
|
umask 177
|
|
printf 'HY2_PASSWORD=%s\n' "$HY2_PASSWORD" > "$ENV_FILE"
|
|
echo "[gen-secrets] 已写入 $ENV_FILE"
|
|
fi
|
|
|
|
# Hy2 自签证书
|
|
if [[ -f "${HY2_DIR}/hy2.crt" && -f "${HY2_DIR}/hy2.key" ]]; then
|
|
echo "[gen-secrets] Hy2 证书已存在,跳过"
|
|
else
|
|
openssl ecparam -genkey -name prime256v1 -out "${HY2_DIR}/hy2.key"
|
|
openssl req -new -x509 -days 3650 -key "${HY2_DIR}/hy2.key" \
|
|
-out "${HY2_DIR}/hy2.crt" -subj "/CN=${MASQ_CN}"
|
|
chmod 644 "${HY2_DIR}/hy2.crt" "${HY2_DIR}/hy2.key"
|
|
echo "[gen-secrets] 已写入 Hy2 证书"
|
|
fi
|
|
|
|
# Cloudflare 续期凭据(有 token 才渲染)
|
|
if [[ -n "${CF_API_TOKEN:-}" ]]; then
|
|
umask 177
|
|
sed "s|__CF_API_TOKEN__|${CF_API_TOKEN}|g" ./certbot/cloudflare.ini.tmpl > "${SECRETS_DIR}/cloudflare.ini"
|
|
echo "[gen-secrets] 已渲染 cloudflare.ini"
|
|
else
|
|
echo "[gen-secrets] 未设置 CF_API_TOKEN,跳过 cloudflare.ini(续期前需补)"
|
|
fi
|