Доведены пункты fix1 14/15/16: hardening install flow Hysteria, расширен smoke, синхронизированы docs

orchestrator/src/steps/hysteria.ts

@@ -1,8 +1,49 @@
 import type { InstallContext } from "../types/context";
 import { run, runVisible } from "../lib/process";
 
-export async function installHysteria(context: InstallContext): Promise<void> {
-  await runVisible`curl -fsSL https://get.hy2.sh/ -o /tmp/hy2xs-install-hysteria.sh`;
-  await runVisible`sh /tmp/hy2xs-install-hysteria.sh`;
-  context.hysteriaVersion = await run`/usr/local/bin/hysteria version`;
+function normalizeInstalledVersion(raw: string): string {
+  const match = raw.match(/v\d+\.\d+\.\d+/);
+  if (match) {
+    return match[0];
+  }
+  return raw.trim();
+}
+
+function validateVersionPolicy(value: string): void {
+  if (value === "latest") {
+    return;
+  }
+  if (/^v\d+\.\d+\.\d+$/.test(value)) {
+    return;
+  }
+  throw new Error(`invalid HY2XS_HYSTERIA_VERSION policy: ${value}`);
+}
+
+export async function installHysteria(context: InstallContext): Promise<void> {
+  const policy = context.config.hysteriaVersionPolicy;
+  validateVersionPolicy(policy);
+
+  const scriptPath = "/tmp/hy2xs-install-hysteria.sh";
+  await runVisible`curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location https://get.hy2.sh/ -o ${scriptPath}`;
+  await runVisible`test -s ${scriptPath}`;
+  await runVisible`chmod 700 ${scriptPath}`;
+
+  if (policy === "latest") {
+    await runVisible`bash ${scriptPath}`;
+  } else {
+    await runVisible`HYSTERIA_VERSION=${policy} bash ${scriptPath}`;
+  }
+
+  await runVisible`test -x /usr/local/bin/hysteria`;
+  const versionOutput = await run`/usr/local/bin/hysteria version`;
+  const installedVersion = normalizeInstalledVersion(versionOutput);
+  context.hysteriaVersion = installedVersion;
+
+  if (policy !== "latest" && installedVersion !== policy) {
+    throw new Error(
+      `installed Hysteria version mismatch: expected ${policy}, got ${installedVersion}. Review upstream installer env contract.`
+    );
+  }
+
+  await runVisible`rm -f ${scriptPath}`;
 }

orchestrator/src/steps/smoke.ts

@@ -18,6 +18,7 @@ export async function smoke(context: InstallContext): Promise<void> {
   await runVisible`test -s ${context.config.bootstrapAdminSecretPath}`;
   await runVisible`test "$(stat -c '%a' /etc/hysteria/config.yaml)" = '600'`;
   await runVisible`test "$(stat -c '%a' /etc/hy2xs/hy2xs.env)" = '600'`;
+  await runVisible`test "$(stat -c '%a' /etc/hysteria/post-install.env)" = '600'`;
   await runVisible`test "$(stat -c '%a' ${context.config.bootstrapAdminSecretPath})" = '600'`;
   await runVisible`ss -H -ltn | grep -q '${context.config.uiBindHost}:${context.config.uiPort} '`;
   if (context.config.uiBindHost === "127.0.0.1") {
@@ -25,5 +26,25 @@ export async function smoke(context: InstallContext): Promise<void> {
   }
   await runVisible`ss -H -lun | grep -q '0.0.0.0:${context.config.hysteriaPort} '`;
   await runVisible`! ss -H -ltnu | grep -q '\[::\]'`;
-  await runVisible`curl -fsS --max-time 5 http://127.0.0.1:${context.config.uiPort}/ >/dev/null`;
+  await runVisible`curl -fsS --max-time 5 http://127.0.0.1:${context.config.uiPort}/hui/hysteria2/auth >/dev/null`;
+
+  await runVisible`curl -fsS --max-time 5 -H 'Authorization: ${context.config.hysteriaTrafficStatsSecret}' http://127.0.0.1:${context.config.hysteriaTrafficStatsPort}/online >/dev/null`;
+  await runVisible`curl -fsS --max-time 5 -o /dev/null -w '%{http_code}' -H 'Authorization: invalid-hy2xs-secret' http://127.0.0.1:${context.config.hysteriaTrafficStatsPort}/online | grep -Eq '401|403'`;
+
+  await runVisible`nft -c -f /etc/nftables.conf`;
+
+  if (context.config.tlsMode === "acme") {
+    await runVisible`grep -q '^acme:' /etc/hysteria/config.yaml`;
+    await runVisible`! grep -q '^tls:' /etc/hysteria/config.yaml`;
+  }
+  if (context.config.tlsMode === "file") {
+    await runVisible`grep -q '^tls:' /etc/hysteria/config.yaml`;
+    await runVisible`! grep -q '^acme:' /etc/hysteria/config.yaml`;
+    await runVisible`grep -q 'insecure: false' /etc/hysteria/config.yaml`;
+  }
+  if (context.config.tlsMode === "self_signed_dev") {
+    await runVisible`grep -q '^tls:' /etc/hysteria/config.yaml`;
+    await runVisible`! grep -q '^acme:' /etc/hysteria/config.yaml`;
+    await runVisible`grep -q 'insecure: true' /etc/hysteria/config.yaml`;
+  }
 }