Реализован production-hardening по fix1: env/reconfigure, IPv4-only, TLS, secrets, firewall, docs

apps/cmd/cmd.go

@@ -48,4 +48,3 @@ func Execute() {
 		os.Exit(1)
 	}
 }
-

apps/cmd/reset.go

@@ -36,8 +36,12 @@ func runReset(cmd *cobra.Command, args []string) {
 	}
 	if err = dao.UpdateAccount([]int64{1}, map[string]interface{}{
 		"username": username,
-		"pass":     util.SHA224String(password),
-		"con_pass": fmt.Sprintf("%s.%s", username, password)}); err != nil {
+		"pass": func() string {
+			hash, _ := util.HashPassword(password)
+			return hash
+		}(),
+		"force_password_change": 1,
+		"con_pass":              fmt.Sprintf("%s.%s", username, password)}); err != nil {
 		fmt.Println(err.Error())
 		os.Exit(1)
 	}
@@ -49,4 +53,3 @@ func runReset(cmd *cobra.Command, args []string) {
 	fmt.Println(fmt.Sprintf("HY2XS admin Login Password: %s", password))
 	fmt.Println(fmt.Sprintf("HY2XS admin Connection Password: %s", fmt.Sprintf("%s.%s", username, password)))
 }
-

apps/cmd/server.go

@@ -11,10 +11,23 @@ import (
 	"hy2xs-admin/router"
 	"hy2xs-admin/service"
 	"hy2xs-admin/util"
+	"net"
 	"net/http"
 	"os"
 )
 
+func resolveUiBindHost() (string, error) {
+	host := os.Getenv("HY2XS_UI_BIND_HOST")
+	if host == "" {
+		host = "127.0.0.1"
+	}
+	ip := net.ParseIP(host)
+	if ip == nil || ip.To4() == nil {
+		return "", errors.New("HY2XS_UI_BIND_HOST must be IPv4")
+	}
+	return host, nil
+}
+
 func runServer(port string) error {
 	defer releaseResource()
 
@@ -32,12 +45,6 @@ func runServer(port string) error {
 	if err := service.InitHysteria2(); err != nil {
 		return err
 	}
-	if err := service.InitTableAndChain(); err != nil {
-		logrus.Errorf(err.Error())
-	}
-	if err := service.InitPortHopping(); err != nil {
-		logrus.Errorf(err.Error())
-	}
 	config, err := dao.GetConfig("key = ?", constant.HUIWebContext)
 	if err != nil {
 		return err
@@ -50,8 +57,12 @@ func runServer(port string) error {
 	if err != nil {
 		return err
 	}
+	bindHost, err := resolveUiBindHost()
+	if err != nil {
+		return err
+	}
 
-	service.InitServer(fmt.Sprintf(":%d", serverPort), r)
+	service.InitServer(fmt.Sprintf("%s:%d", bindHost, serverPort), r)
 	if err := service.StartServer(crtPath, keyPath); err != nil && err != http.ErrServerClosed {
 		logrus.Errorf("start server err: %v", err)
 		return errors.New("start server err")
@@ -83,4 +94,3 @@ func initFile() error {
 	}
 	return nil
 }
-

apps/cmd/version.go

@@ -20,4 +20,3 @@ func init() {
 func runVersion(cmd *cobra.Command, args []string) {
 	fmt.Println("HY2XS admin version", constant.Version)
 }
-