wangjia
cf96989e01
deploy-pangolin / deploy (push) Has been cancelled
- deploy/: Xray VLESS+REALITY (11443, 经宿主 nginx SNI 分流) + sing-box Hysteria2 (UDP 443) docker-compose - 幂等 deploy.sh / gen-secrets.sh / print-clients.sh;受限 nginx-apply 特权脚本 + 一次性 root-setup - .gitea/workflows/deploy.yml: NAS runner 经 SSH 远程部署到 EC2 - docs/ plan/: 设计方案与实施计划 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
62 lines
2.1 KiB
Bash
Executable File
62 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# deploy.sh —— 在 EC2 上幂等编排 pangolin 数据面。
|
|
# 由 CI(NAS runner via ssh)调用,也可手动 `ssh ec2 'cd /opt/pangolin && ./scripts/deploy.sh'`。
|
|
#
|
|
# 步骤:生成密钥 -> 渲染配置 -> docker-compose up -> (幂等)加 nginx 路由 -> 健康检查 -> 输出客户端信息
|
|
# 全程不触碰 marzban/blog/jiu;唯一特权动作是 sudo 调用受限的 nginx-apply 脚本。
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.." # -> deploy/
|
|
|
|
COMPOSE="docker-compose -p pangolin"
|
|
NGINX_APPLY="/usr/local/sbin/pangolin-nginx-apply.sh"
|
|
|
|
echo "==> [1/5] 生成/复用密钥与证书"
|
|
./scripts/gen-secrets.sh
|
|
|
|
echo "==> [2/5] 渲染配置(模板 -> config.json)"
|
|
# shellcheck disable=SC1091
|
|
source ./secrets/pangolin.env
|
|
render() { # render <tmpl> <out>
|
|
sed -e "s|__UUID__|${UUID}|g" \
|
|
-e "s|__REALITY_PRIVATE_KEY__|${REALITY_PRIVATE_KEY}|g" \
|
|
-e "s|__REALITY_SHORT_ID__|${REALITY_SHORT_ID}|g" \
|
|
-e "s|__HY2_PASSWORD__|${HY2_PASSWORD}|g" \
|
|
"$1" > "$2"
|
|
}
|
|
render ./xray/config.tmpl.json ./xray/config.json
|
|
render ./singbox/config.tmpl.json ./singbox/config.json
|
|
|
|
echo "==> [3/5] 拉起容器(docker-compose up -d)"
|
|
$COMPOSE pull --quiet || true
|
|
$COMPOSE up -d
|
|
$COMPOSE ps
|
|
|
|
echo "==> [4/5] nginx SNI 路由(幂等)"
|
|
if grep -qF "127.0.0.1:11443" /etc/nginx/stream.conf 2>/dev/null; then
|
|
echo " 路由已存在,跳过"
|
|
elif [[ -x "$NGINX_APPLY" ]]; then
|
|
sudo "$NGINX_APPLY"
|
|
else
|
|
echo " !! 未找到 $NGINX_APPLY(需先执行一次性 root 前置 setup/root-setup.sh)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> [5/5] 健康检查"
|
|
ok=1
|
|
# REALITY:经宿主 nginx 用 www.apple.com 做 TLS 握手应成功
|
|
if echo | timeout 10 openssl s_client -connect 127.0.0.1:443 -servername www.apple.com >/dev/null 2>&1; then
|
|
echo " [REALITY] 443/www.apple.com 握手 OK"
|
|
else
|
|
echo " [REALITY] 握手失败"; ok=0
|
|
fi
|
|
# Hy2:UDP 443 应有 sing-box 在监听
|
|
if ss -uln 2>/dev/null | grep -q ":443 "; then
|
|
echo " [Hy2] UDP 443 监听 OK"
|
|
else
|
|
echo " [Hy2] UDP 443 未监听"; ok=0
|
|
fi
|
|
|
|
./scripts/print-clients.sh
|
|
|
|
[[ "$ok" == "1" ]] && echo "==> 部署完成 ✅" || { echo "==> 健康检查未通过 ❌"; exit 1; }
|