fix(fix3): runtime env hardening and public endpoint source-of-truth

package/config/hy2xs.env

@@ -1,7 +1,7 @@
 # HY2XS canonical production runtime config (packaged baseline)
 HY2XS_IPV6_ENABLED=false
-HY2XS_DOMAIN=
-HY2XS_PUBLIC_HOST=127.0.0.1
+HY2XS_DOMAIN=replace-with-your-domain.example
+HY2XS_PUBLIC_HOST=replace-with-your-domain.example
 HY2XS_PUBLIC_PORT=443
 HY2XS_SSH_PORT=22
 HY2XS_FIREWALL_ENABLED=true
@@ -9,10 +9,11 @@ HY2XS_FIREWALL_STAGED_APPLY=true
 HY2XS_UI_BIND_HOST=127.0.0.1
 HY2XS_UI_PORT=8080
 HY2XS_ADMIN_USER=admin
-HY2XS_ADMIN_INITIAL_PASSWORD=
+HY2XS_ADMIN_INITIAL_PASSWORD=__GENERATE__
 HY2XS_FORCE_PASSWORD_CHANGE=true
-HY2XS_TLS_MODE=self_signed_dev
-HY2XS_ACME_EMAIL=
+HY2XS_TLS_MODE=acme
+HY2XS_ACME_TYPE=http
+HY2XS_ACME_EMAIL=replace-with-your-email@example.com
 HY2XS_TLS_CERT_PATH=/etc/hysteria/server.crt
 HY2XS_TLS_KEY_PATH=/etc/hysteria/server.key
 HY2XS_HYSTERIA_BIND_HOST=0.0.0.0
@@ -21,9 +22,9 @@ HY2XS_HYSTERIA_AUTH_MODE=http
 HY2XS_HYSTERIA_AUTH_URL=http://127.0.0.1:8080/hui/hysteria2/auth
 HY2XS_HYSTERIA_TRAFFIC_STATS_HOST=127.0.0.1
 HY2XS_HYSTERIA_TRAFFIC_STATS_PORT=36712
-HY2XS_HYSTERIA_TRAFFIC_STATS_SECRET=
+HY2XS_HYSTERIA_TRAFFIC_STATS_SECRET=__GENERATE__
 HY2XS_HYSTERIA_OBFS_TYPE=salamander
-HY2XS_HYSTERIA_OBFS_PASSWORD=
+HY2XS_HYSTERIA_OBFS_PASSWORD=__GENERATE__
 HY2XS_HYSTERIA_BANDWIDTH_UP=50 mbps
 HY2XS_HYSTERIA_BANDWIDTH_DOWN=50 mbps
 HY2XS_HYSTERIA_IGNORE_CLIENT_BANDWIDTH=false

package/systemd/hy2xs-admin.service

@@ -8,9 +8,9 @@ Type=simple
 User=hy2xs-admin
 Group=hy2xs-admin
 WorkingDirectory={{INSTALL_DIR}}
+EnvironmentFile=/etc/hy2xs/hy2xs.env
 Environment=HUI_DATA={{DATA_DIR}}/
-Environment=HY2XS_UI_BIND_HOST={{UI_BIND_HOST}}
-Environment=HY2XS_UI_PORT={{UI_PORT}}
+Environment=HUI_LOG={{LOG_DIR}}
 ExecStart={{INSTALL_DIR}}/hy2xs-admin -p {{UI_PORT}}
 Restart=on-failure
 RestartSec=5s