Реализован production-hardening по fix1: env/reconfigure, IPv4-only, TLS, secrets, firewall, docs

2026-04-26 07:27:06 +05:00
parent 2b4a45ad23
commit 3fccd5c442
109 changed files with 1773 additions and 569 deletions
@@ -11,10 +11,23 @@ import (
 	"hy2xs-admin/router"
 	"hy2xs-admin/service"
 	"hy2xs-admin/util"
+	"net"
 	"net/http"
 	"os"
 )

+func resolveUiBindHost() (string, error) {
+	host := os.Getenv("HY2XS_UI_BIND_HOST")
+	if host == "" {
+		host = "127.0.0.1"
+	}
+	ip := net.ParseIP(host)
+	if ip == nil || ip.To4() == nil {
+		return "", errors.New("HY2XS_UI_BIND_HOST must be IPv4")
+	}
+	return host, nil
+}
+
 func runServer(port string) error {
 	defer releaseResource()

@@ -32,12 +45,6 @@ func runServer(port string) error {
 	if err := service.InitHysteria2(); err != nil {
 		return err
 	}
-	if err := service.InitTableAndChain(); err != nil {
-		logrus.Errorf(err.Error())
-	}
-	if err := service.InitPortHopping(); err != nil {
-		logrus.Errorf(err.Error())
-	}
 	config, err := dao.GetConfig("key = ?", constant.HUIWebContext)
 	if err != nil {
 		return err
@@ -50,8 +57,12 @@ func runServer(port string) error {
 	if err != nil {
 		return err
 	}
+	bindHost, err := resolveUiBindHost()
+	if err != nil {
+		return err
+	}

-	service.InitServer(fmt.Sprintf(":%d", serverPort), r)
+	service.InitServer(fmt.Sprintf("%s:%d", bindHost, serverPort), r)
 	if err := service.StartServer(crtPath, keyPath); err != nil && err != http.ErrServerClosed {
 		logrus.Errorf("start server err: %v", err)
 		return errors.New("start server err")
@@ -83,4 +94,3 @@ func initFile() error {
 	}
 	return nil
 }
-