prod/HY2XS_flamy
5
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

Усилен firewall rollback lifecycle и безопасная запись конфигов/секретов

Browse Source
This commit is contained in:
Crimson
2026-05-01 21:42:26 +05:00
parent 7c0b79588f
commit 18ff86058a
6 changed files with 152 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
orchestrator/src/steps/env.ts
+12 -9
View File
@@ -1,6 +1,5 @@
import type { RuntimeContext } from "../types/context";
import { readText, renderTemplate, writeText } from "../lib/fs";
import { runVisible } from "../lib/process";
import { readText, renderTemplate, writeTextAtomic } from "../lib/fs";
export async function writePostInstallEnv(context: RuntimeContext): Promise<void> {
const rendered = renderTemplate(await readText(`${context.options.packageDir}/templates/env/post-install.env.tpl`), {
@@ -30,21 +29,25 @@ export async function writePostInstallEnv(context: RuntimeContext): Promise<void
LOG_DIR: context.config.logDir
});
await writeText("/etc/hysteria/post-install.env", rendered, 0o600);
await runVisible`chown root:root /etc/hysteria/post-install.env`;
await runVisible`chmod 0600 /etc/hysteria/post-install.env`;
await writeTextAtomic("/etc/hysteria/post-install.env", rendered, {
mode: 0o600,
owner: "root",
group: "root"
});
}
export async function writeBootstrapAdminSecret(context: RuntimeContext): Promise<void> {
await writeText(
await writeTextAtomic(
context.config.bootstrapAdminSecretPath,
[
`ADMIN_USER=${context.config.adminUser}`,
`ADMIN_INITIAL_PASSWORD=${context.config.adminInitialPassword}`,
`ADMIN_CON_PASS=${context.config.adminConPass}`
].join("\n") + "\n",
0o600
{
mode: 0o600,
owner: "root",
group: "root"
}
);
await runVisible`chown root:root ${context.config.bootstrapAdminSecretPath}`;
await runVisible`chmod 0600 ${context.config.bootstrapAdminSecretPath}`;
}
orchestrator/src/steps/filesystem.ts
+53 -32
View File
@@ -1,41 +1,62 @@
import type { InstallContext } from "../types/context";
import { runRawVisible, runVisible } from "../lib/process";
import { run } from "../lib/process";
async function userExists(user: string): Promise<boolean> {
try {
await run`id -u ${user} >/dev/null 2>&1`;
return true;
} catch {
return false;
}
}
async function getUserField(user: string, field: number): Promise<string> {
return (await run`getent passwd ${user} | cut -d: -f${field}`).trim();
}
async function getPrimaryGroup(user: string): Promise<string> {
return (await run`id -gn ${user}`).trim();
}
async function ensureDir(path: string, mode: string, ownerGroup: string): Promise<void> {
await run`install -d -m ${mode} -o ${ownerGroup.split(":")[0]} -g ${ownerGroup.split(":")[1]} ${path}`;
}
async function makeUser(user: string, expectedHome: string): Promise<void> {
await run`useradd --system --home ${expectedHome} --shell /usr/sbin/nologin ${user}`;
}
async function ensureRuntimeIdentity(user: string, expectedHome: string): Promise<void> {
const checkCmd = `
if id -u ${user} >/dev/null 2>&1; then
shell="$(getent passwd ${user} | cut -d: -f7)"
home="$(getent passwd ${user} | cut -d: -f6)"
group="$(id -gn ${user})"
if [ "$shell" != "/usr/sbin/nologin" ] && [ "$shell" != "/bin/false" ]; then
echo "existing user '${user}' has unsupported shell: $shell" >&2
exit 1
fi
if [ "$group" != "${user}" ]; then
echo "existing user '${user}' must have primary group '${user}', got: $group" >&2
exit 1
fi
if [ "$home" != "${expectedHome}" ]; then
echo "existing user '${user}' has unexpected home: $home (expected ${expectedHome})" >&2
exit 1
fi
else
useradd --system --home ${expectedHome} --shell /usr/sbin/nologin ${user}
fi
`;
await runRawVisible(checkCmd);
if (!(await userExists(user))) {
await makeUser(user, expectedHome);
return;
}
const shell = await getUserField(user, 7);
const home = await getUserField(user, 6);
const group = await getPrimaryGroup(user);
if (shell !== "/usr/sbin/nologin" && shell !== "/bin/false") {
throw new Error(`existing user '${user}' has unsupported shell: ${shell}`);
}
if (group !== user) {
throw new Error(`existing user '${user}' must have primary group '${user}', got: ${group}`);
}
if (home !== expectedHome) {
throw new Error(`existing user '${user}' has unexpected home: ${home} (expected ${expectedHome})`);
}
}
export async function prepareFilesystem(context: InstallContext): Promise<void> {
await ensureRuntimeIdentity("hysteria", "/var/lib/hysteria");
await ensureRuntimeIdentity("hy2xs-admin", context.config.dataDir);
await runVisible`install -d -m 0700 -o root -g root /etc/hy2xs`;
await runVisible`install -d -m 0755 -o root -g root /etc/hysteria`;
await runVisible`install -d -m 0750 -o hysteria -g hysteria /var/lib/hysteria`;
await runVisible`install -d -m 0750 -o hy2xs-admin -g hy2xs-admin ${context.config.dataDir}`;
await runVisible`install -d -m 0750 -o hy2xs-admin -g hy2xs-admin ${context.config.logDir}`;
await runVisible`install -d -m 0755 -o root -g root ${context.config.installDir}`;
await runVisible`install -d -m 0755 -o root -g root /usr/local/lib/hy2xs`;
await runVisible`install -d -m 0755 -o root -g root /etc/nftables.d`;
await runVisible`chmod -R go-w ${context.config.installDir}`;
await ensureDir("/etc/hy2xs", "0700", "root:root");
await ensureDir("/etc/hysteria", "0755", "root:root");
await ensureDir("/var/lib/hysteria", "0750", "hysteria:hysteria");
await ensureDir(context.config.dataDir, "0750", "hy2xs-admin:hy2xs-admin");
await ensureDir(context.config.logDir, "0750", "hy2xs-admin:hy2xs-admin");
await ensureDir(context.config.installDir, "0755", "root:root");
await ensureDir("/usr/local/lib/hy2xs", "0755", "root:root");
await ensureDir("/etc/nftables.d", "0755", "root:root");
await run`chmod -R go-w ${context.config.installDir}`;
}
orchestrator/src/steps/firewall.ts
+14 -6
View File
@@ -10,8 +10,15 @@ const FW_BACKUP_FILES = [
"/etc/nftables.d/hy2xs.nft.candidate",
"/etc/nftables.d/hy2xs.nft.existed",
"/etc/nftables.d/hy2xs.nft.include.existed",
"/etc/nftables.d/nftables.conf.existed"
].join(" ");
"/etc/nftables.d/nftables.conf.existed",
"/etc/nftables.d/hy2xs.rollback.prepared"
];
async function cleanupFirewallBackupFiles(): Promise<void> {
for (const file of FW_BACKUP_FILES) {
await runVisible`rm -f ${file}`;
}
}
function stripNftComments(content: string): string {
return content
@@ -62,6 +69,7 @@ export async function applyFirewall(context: RuntimeContext): Promise<void> {
fail("existing non-HY2XS nftables.conf found; set HY2XS_FIREWALL_ALLOW_TAKEOVER=true or HY2XS_FIREWALL_ENABLED=false");
}
await runVisible`touch /etc/nftables.d/hy2xs.rollback.prepared`;
await runVisible`cp -a /etc/nftables.conf /etc/nftables.conf.hy2xs.bak 2>/dev/null || true`;
await runVisible`cp -a /etc/nftables.d/hy2xs.nft /etc/nftables.d/hy2xs.nft.bak 2>/dev/null || true`;
await runVisible`test -f /etc/nftables.conf && echo 1 > /etc/nftables.d/nftables.conf.existed || rm -f /etc/nftables.d/nftables.conf.existed`;
@@ -95,7 +103,7 @@ include "/etc/nftables.d/hy2xs.nft"
await runVisible`nft -c -f /etc/nftables.conf`;
if (context.config.firewallStagedApply) {
await runVisible`systemd-run --unit hy2xs-fw-rollback --on-active=45s /bin/sh -c 'if [ -f /etc/nftables.d/nftables.conf.existed ]; then cp -a /etc/nftables.conf.hy2xs.bak /etc/nftables.conf 2>/dev/null || true; else rm -f /etc/nftables.conf; fi; if [ -f /etc/nftables.d/hy2xs.nft.existed ]; then cp -a /etc/nftables.d/hy2xs.nft.bak /etc/nftables.d/hy2xs.nft 2>/dev/null || true; else rm -f /etc/nftables.d/hy2xs.nft; fi; nft -f /etc/nftables.conf >/dev/null 2>&1 || true'`;
await runVisible`systemd-run --unit hy2xs-fw-rollback --on-active=45s /bin/sh -c 'if [ -f /etc/nftables.d/hy2xs.rollback.prepared ]; then if [ -f /etc/nftables.d/nftables.conf.existed ]; then cp -a /etc/nftables.conf.hy2xs.bak /etc/nftables.conf 2>/dev/null || true; else rm -f /etc/nftables.conf; fi; if [ -f /etc/nftables.d/hy2xs.nft.existed ]; then cp -a /etc/nftables.d/hy2xs.nft.bak /etc/nftables.d/hy2xs.nft 2>/dev/null || true; else rm -f /etc/nftables.d/hy2xs.nft; fi; if [ -f /etc/nftables.d/nftables.conf.existed ]; then nft -f /etc/nftables.conf >/dev/null 2>&1 || true; else nft flush ruleset >/dev/null 2>&1 || true; fi; fi'`;
}
await runVisible`nft -f /etc/nftables.conf`;
@@ -116,7 +124,7 @@ export async function cancelFirewallRollback(context: RuntimeContext): Promise<v
await runVisible`systemctl reset-failed hy2xs-fw-rollback || true`;
}
await runVisible`rm -f ${FW_BACKUP_FILES}`;
await cleanupFirewallBackupFiles();
}
export async function rollbackFirewallNow(context: RuntimeContext): Promise<void> {
@@ -124,7 +132,7 @@ export async function rollbackFirewallNow(context: RuntimeContext): Promise<void
return;
}
if (!(await exists("/etc/nftables.d/nftables.conf.existed")) && !(await exists("/etc/nftables.d/hy2xs.nft.existed"))) {
if (!(await exists("/etc/nftables.d/hy2xs.rollback.prepared"))) {
info("firewall rollback skipped: no HY2XS rollback markers found");
return;
}
@@ -137,5 +145,5 @@ export async function rollbackFirewallNow(context: RuntimeContext): Promise<void
await runVisible`if [ -f /etc/nftables.d/nftables.conf.existed ]; then cp -a /etc/nftables.conf.hy2xs.bak /etc/nftables.conf 2>/dev/null || true; else rm -f /etc/nftables.conf; fi`;
await runVisible`if [ -f /etc/nftables.d/hy2xs.nft.existed ]; then cp -a /etc/nftables.d/hy2xs.nft.bak /etc/nftables.d/hy2xs.nft 2>/dev/null || true; else rm -f /etc/nftables.d/hy2xs.nft; fi`;
await runVisible`if [ -f /etc/nftables.d/nftables.conf.existed ]; then nft -f /etc/nftables.conf >/dev/null 2>&1 || true; else nft flush ruleset >/dev/null 2>&1 || true; fi`;
await runVisible`rm -f ${FW_BACKUP_FILES}`;
await cleanupFirewallBackupFiles();
}