wangjia
cf96989e01
deploy-pangolin / deploy (push) Has been cancelled
- deploy/: Xray VLESS+REALITY (11443, 经宿主 nginx SNI 分流) + sing-box Hysteria2 (UDP 443) docker-compose - 幂等 deploy.sh / gen-secrets.sh / print-clients.sh;受限 nginx-apply 特权脚本 + 一次性 root-setup - .gitea/workflows/deploy.yml: NAS runner 经 SSH 远程部署到 EC2 - docs/ plan/: 设计方案与实施计划 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
54 lines
2.0 KiB
Bash
Executable File
54 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# gen-secrets.sh —— 首次在 EC2 生成并持久化密钥/证书(幂等)。
|
|
# 产物存于 ./secrets/(700,gitignore,绝不进仓库/CI 日志)。
|
|
# - pangolin.env : UUID / REALITY 公私钥 / shortId / Hy2 口令
|
|
# - hy2/hy2.crt, hy2/hy2.key : Hysteria2 自签证书(ECDSA)
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.." # -> deploy/
|
|
|
|
SECRETS_DIR="./secrets"
|
|
ENV_FILE="${SECRETS_DIR}/pangolin.env"
|
|
HY2_DIR="${SECRETS_DIR}/hy2"
|
|
XRAY_IMAGE="ghcr.io/xtls/xray-core:26.3.27"
|
|
MASQ_CN="www.bing.com"
|
|
|
|
mkdir -p "$HY2_DIR"
|
|
chmod 700 "$SECRETS_DIR"
|
|
|
|
if [[ -f "$ENV_FILE" ]]; then
|
|
echo "[gen-secrets] $ENV_FILE 已存在,跳过密钥生成(幂等)"
|
|
else
|
|
echo "[gen-secrets] 生成 REALITY 密钥对 / UUID / shortId / Hy2 口令 ..."
|
|
# REALITY x25519 密钥对(从 xray 输出解析 Private/Public)
|
|
KP="$(docker run --rm "$XRAY_IMAGE" x25519)"
|
|
REALITY_PRIVATE_KEY="$(printf '%s\n' "$KP" | awk -F': ' '/Private/{print $2}')"
|
|
REALITY_PUBLIC_KEY="$(printf '%s\n' "$KP" | awk -F': ' '/Public/{print $2}')"
|
|
UUID="$(cat /proc/sys/kernel/random/uuid)"
|
|
REALITY_SHORT_ID="$(openssl rand -hex 8)"
|
|
HY2_PASSWORD="$(openssl rand -base64 18 | tr -d '/+=' | cut -c1-24)"
|
|
|
|
umask 177
|
|
cat > "$ENV_FILE" <<EOF
|
|
# pangolin Phase-0 secrets —— 切勿提交/外泄
|
|
UUID=${UUID}
|
|
REALITY_PRIVATE_KEY=${REALITY_PRIVATE_KEY}
|
|
REALITY_PUBLIC_KEY=${REALITY_PUBLIC_KEY}
|
|
REALITY_SHORT_ID=${REALITY_SHORT_ID}
|
|
HY2_PASSWORD=${HY2_PASSWORD}
|
|
EOF
|
|
echo "[gen-secrets] 已写入 $ENV_FILE"
|
|
fi
|
|
|
|
# Hysteria2 自签证书(幂等)
|
|
if [[ -f "${HY2_DIR}/hy2.crt" && -f "${HY2_DIR}/hy2.key" ]]; then
|
|
echo "[gen-secrets] Hy2 证书已存在,跳过"
|
|
else
|
|
echo "[gen-secrets] 生成 Hy2 自签证书 (CN=${MASQ_CN}) ..."
|
|
openssl ecparam -genkey -name prime256v1 -out "${HY2_DIR}/hy2.key"
|
|
openssl req -new -x509 -days 3650 -key "${HY2_DIR}/hy2.key" \
|
|
-out "${HY2_DIR}/hy2.crt" -subj "/CN=${MASQ_CN}"
|
|
# sing-box 容器内以 root 运行,证书需可读
|
|
chmod 644 "${HY2_DIR}/hy2.crt" "${HY2_DIR}/hy2.key"
|
|
echo "[gen-secrets] 已写入 Hy2 证书"
|
|
fi
|