prod/AWG2_harness
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Документация и postinst UX: безопасная проверка checksum и preflight-first

Browse Source
This commit is contained in:
Crimson
2026-05-12 20:46:57 +05:00
parent c78015f76e
commit 8e3e924952
4 changed files with 29 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -159,7 +159,7 @@ Security note:
cd awg2_harness
./tools/build.sh --prepare-build-env --bootstrap-rust --yes
./tools/build.sh --package --version 0.1.6
sha256sum -c dist/SHA256SUMS
(cd dist && sha256sum -c SHA256SUMS)
dpkg-deb -I dist/awg2-harness_0.1.6_amd64.deb
dpkg-deb -c dist/awg2-harness_0.1.6_amd64.deb | sort
```
docs/INSTALLATION.md
+22 -1
View File
@@ -40,7 +40,7 @@ cargo test --locked --workspace --release --manifest-path Cargo.toml
```bash
./tools/build.sh --package --version 0.1.6
sha256sum -c dist/SHA256SUMS
(cd dist && sha256sum -c SHA256SUMS)
dpkg-deb -I dist/awg2-harness_0.1.6_amd64.deb
dpkg-deb -c dist/awg2-harness_0.1.6_amd64.deb | sort
```
@@ -176,6 +176,27 @@ ports={"53/tcp":null,"53/udp":null}
Это означает, что DNS не опубликован на публичном host-интерфейсе и остаётся доступным только через VPN/Docker path.
Negative-check публичного DNS:
```bash
nslookup example.com <server-public-ip>
```
Ожидаемое поведение: публичный DNS-запрос **не должен успешно резолвиться**. Типичные безопасные варианты ответа: `connection refused`, `timeout` или `no servers could be reached`.
Optional deep-check DNS path (если нужна углублённая проверка):
```bash
apt install -y dnsutils
DNS_PID="$(docker inspect -f '{{.State.Pid}}' amnezia-dns)"
AWG_PID="$(docker inspect -f '{{.State.Pid}}' amnezia-awg2)"
nsenter -t "$DNS_PID" -n ss -lntup
nsenter -t "$AWG_PID" -n ip route
nsenter -t "$AWG_PID" -n dig @172.29.172.254 example.com A +short
```
## C. Transfer artifacts
Ниже два production-сценария установки.
tools/README.md
+2 -2
View File
@@ -25,7 +25,7 @@ cd awg2_harness
chmod +x tools/build.sh
./tools/build.sh --prepare-build-env --bootstrap-rust --yes
./tools/build.sh --package --version 0.1.6
sha256sum -c dist/SHA256SUMS
(cd dist && sha256sum -c SHA256SUMS)
dpkg-deb -I dist/awg2-harness_0.1.6_amd64.deb
dpkg-deb -c dist/awg2-harness_0.1.6_amd64.deb | sort
```
@@ -41,7 +41,7 @@ dpkg-deb -c dist/awg2-harness_0.1.6_amd64.deb | sort
## Проверка пакета перед переносом
```bash
sha256sum -c dist/SHA256SUMS
(cd dist && sha256sum -c SHA256SUMS)
dpkg-deb -I dist/awg2-harness_<version>_amd64.deb
dpkg-deb -c dist/awg2-harness_<version>_amd64.deb | sort
```
tools/build.sh
+4 -1
View File
@@ -376,8 +376,11 @@ echo "Create /etc/awg2-harness/config.toml manually before enabling services:"
echo " install -d -m 0755 /etc/awg2-harness"
echo " cp /usr/share/doc/awg2-harness/repo/config.example.toml /etc/awg2-harness/config.toml"
echo " nano /etc/awg2-harness/config.toml"
echo "Then validate and enable services:"
echo "Then run preflight before enabling services:"
echo " awg2-harness --config /etc/awg2-harness/config.toml validate-config"
echo " awg2-harness --config /etc/awg2-harness/config.toml validate-runtime"
echo " awg2-harness --config /etc/awg2-harness/config.toml status"
echo "Enable services only after SSH, Amnezia port and peer CIDR are verified."
echo " systemctl enable --now awg2-harness.service awg2-reboot-scheduler.service"
exit 0