wangjia
cf96989e01
deploy-pangolin / deploy (push) Has been cancelled
- deploy/: Xray VLESS+REALITY (11443, 经宿主 nginx SNI 分流) + sing-box Hysteria2 (UDP 443) docker-compose - 幂等 deploy.sh / gen-secrets.sh / print-clients.sh;受限 nginx-apply 特权脚本 + 一次性 root-setup - .gitea/workflows/deploy.yml: NAS runner 经 SSH 远程部署到 EC2 - docs/ plan/: 设计方案与实施计划 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
34 lines
1.2 KiB
Bash
Executable File
34 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# root-setup.sh —— 一次性 root 前置(在 EC2 上以 root 执行一次)。
|
|
# sudo bash /opt/pangolin/setup/root-setup.sh
|
|
#
|
|
# 作用:
|
|
# 1. 安装受限特权脚本到 /usr/local/sbin/pangolin-nginx-apply.sh(root:root 0755)
|
|
# 2. 安装 sudoers 片段,授权 ec2-user 仅 NOPASSWD 调用上述脚本
|
|
# 之后 CI(ec2-user)即可非交互地增量更新 nginx 路由,且无法获得通用 root。
|
|
set -euo pipefail
|
|
|
|
if [[ "$(id -u)" -ne 0 ]]; then
|
|
echo "请以 root 运行:sudo bash $0" >&2
|
|
exit 1
|
|
fi
|
|
|
|
SRC_DIR="$(cd "$(dirname "$0")/.." && pwd)" # -> /opt/pangolin/deploy 或仓库 deploy/
|
|
APPLY_SRC="${SRC_DIR}/nginx/pangolin-nginx-apply.sh"
|
|
APPLY_DST="/usr/local/sbin/pangolin-nginx-apply.sh"
|
|
SUDOERS="/etc/sudoers.d/pangolin"
|
|
DEPLOY_USER="${PANGOLIN_DEPLOY_USER:-ec2-user}"
|
|
|
|
[[ -f "$APPLY_SRC" ]] || { echo "找不到 $APPLY_SRC" >&2; exit 1; }
|
|
|
|
install -o root -g root -m 0755 "$APPLY_SRC" "$APPLY_DST"
|
|
echo "[root-setup] 已安装 $APPLY_DST"
|
|
|
|
cat > "$SUDOERS" <<EOF
|
|
${DEPLOY_USER} ALL=(root) NOPASSWD: ${APPLY_DST}
|
|
EOF
|
|
chmod 0440 "$SUDOERS"
|
|
visudo -cf "$SUDOERS" >/dev/null && echo "[root-setup] 已安装并校验 $SUDOERS"
|
|
|
|
echo "[root-setup] 完成。现在 ${DEPLOY_USER} 可执行: sudo ${APPLY_DST}"
|