wangjia
5d90610649
为小内存机收尾单机栈,已在 racknerd(107.172.55.251)实跑验证通过: - 数据库:MySQL(docker)→ SQLite 文件(DB_DRIVER=sqlite);Redis 改 apt 原生 (免 Docker);依赖 redis-server/sqlite3/polkitd/sing-box 由 deploy.sh 自动装 - 运行身份:三 systemd 单元 User=root → User=pangolin;sing-box 经 AmbientCapabilities 绑 443;新增 polkit 规则让 pangolin 仅可重启 sing-box - 二进制:支持预置(机上无 go 时用交叉编译产物;SQLite 纯 Go 免 CGO) - 端口:REALITY 默认 443/tcp(对齐 bootstrap 防火墙);deploy.sh 放行 8080/tcp - 修 sing-box.service:ExecStart 按实际安装路径渲染(官方 .deb 在 /usr/bin) - Hy2 默认关闭:控制面尚未下发 Hy2 TLS 证书(handler_grpc.go 仅发 ListenPort) → 开启会 missing certificate;待补全证书后传 HY2_PORT=443 开启 - 删 docker-compose.yml;seed TRUE→1;README 同步 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
23 lines
764 B
Desktop File
23 lines
764 B
Desktop File
[Unit]
|
|
Description=sing-box data plane (pangolin node server)
|
|
Documentation=https://sing-box.sagernet.org
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
# Config is rendered by pangolin-agent; this unit may fail-restart until the
|
|
# agent's first Register populates /etc/sing-box/config.json — that is expected
|
|
# on a fresh box and self-heals once the agent enrolls.
|
|
ExecStart=/usr/local/bin/sing-box run -c /etc/sing-box/config.json
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
LimitNOFILE=1048576
|
|
# 非特权运行;AmbientCapabilities 让 pangolin 也能绑 443(REALITY/Hy2)。
|
|
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
|
User=pangolin
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|