Реализован production-hardening по fix1: env/reconfigure, IPv4-only, TLS, secrets, firewall, docs

apps/dao/sqlite.go

@@ -9,6 +9,8 @@ import (
 	"gorm.io/gorm/logger"
 	"gorm.io/gorm/schema"
 	"hy2xs-admin/model/constant"
+	"hy2xs-admin/model/entity"
+	"hy2xs-admin/util"
 	"log"
 	"os"
 	"strings"
@@ -69,6 +71,66 @@ func InitSql(port string) error {
 			}
 		}
 	}
+
+	if err := ensureSecureBootstrapAdmin(); err != nil {
+		return err
+	}
+	if err := ensureTrafficStatsSecret(); err != nil {
+		return err
+	}
+	if tx := sqliteDB.Exec("ALTER TABLE account ADD COLUMN force_password_change INTEGER NOT NULL DEFAULT 0"); tx.Error != nil && !strings.Contains(tx.Error.Error(), "duplicate column name") {
+		logrus.Errorf("sqlite exec err: %v", tx.Error)
+		return errors.New("sqlite exec err")
+	}
+
+	return nil
+}
+
+func ensureSecureBootstrapAdmin() error {
+	admin, err := GetAccount("role = 'admin' and deleted = 0")
+	if err != nil {
+		return nil
+	}
+	if admin.Pass == nil {
+		return nil
+	}
+	if !util.IsBcryptHash(*admin.Pass) {
+		password, pwdErr := util.RandomString(18)
+		if pwdErr != nil {
+			return pwdErr
+		}
+		hash, hashErr := util.HashPassword(password)
+		if hashErr != nil {
+			return hashErr
+		}
+		conPass, conErr := util.RandomString(28)
+		if conErr != nil {
+			return conErr
+		}
+		if updateErr := UpdateAccount([]int64{*admin.Id}, map[string]interface{}{
+			"pass":                  hash,
+			"force_password_change": 1,
+			"con_pass":              fmt.Sprintf("%s.%s", *admin.Username, conPass),
+		}); updateErr != nil {
+			return updateErr
+		}
+	}
+	return nil
+}
+
+func ensureTrafficStatsSecret() error {
+	if _, err := GetConfig("key = ?", constant.Hysteria2TrafficStatsSecret); err == nil {
+		return nil
+	}
+	secret, secErr := util.RandomString(32)
+	if secErr != nil {
+		return secErr
+	}
+	key := constant.Hysteria2TrafficStatsSecret
+	remark := "Hysteria2 trafficStats API secret"
+	if _, saveErr := SaveConfig(entity.Config{Key: &key, Value: &secret, Remark: &remark}); saveErr != nil {
+		return saveErr
+	}
 	return nil
 }
 
@@ -117,4 +179,3 @@ func Paginate(pageNum *int64, pageSize *int64) func(db *gorm.DB) *gorm.DB {
 		return db.Offset(int((num - 1) * size)).Limit(int(size))
 	}
 }
-