Реализован production-hardening по fix1: env/reconfigure, IPv4-only, TLS, secrets, firewall, docs

apps/service/hysteria2.go

@@ -65,16 +65,33 @@ func setHysteria2ConfigYAML() error {
 		logrus.Errorf("marshal hysteria2 config err: %v", err)
 		return errors.New("marshal hysteria2 config err")
 	}
-	file, err := os.OpenFile(constant.Hysteria2ConfigPath, os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0644)
+	tmpPath := fmt.Sprintf("%s.tmp", constant.Hysteria2ConfigPath)
+	file, err := os.OpenFile(tmpPath, os.O_WRONLY|os.O_TRUNC|os.O_CREATE, 0600)
 	if err != nil {
 		logrus.Errorf("create hysteria2 server config file err: %v", err)
 		return errors.New("create hysteria2 server config file err")
 	}
+	defer file.Close()
 	_, err = file.WriteString(string(hysteria2Config))
 	if err != nil {
 		logrus.Errorf("write hysteria2 config.json file err: %v", err)
 		return errors.New("hysteria2 config.json file write err")
 	}
+	if syncErr := file.Sync(); syncErr != nil {
+		return syncErr
+	}
+	if closeErr := file.Close(); closeErr != nil {
+		return closeErr
+	}
+	if renameErr := os.Rename(tmpPath, constant.Hysteria2ConfigPath); renameErr != nil {
+		return renameErr
+	}
+	if chmodErr := os.Chmod(constant.Hysteria2ConfigPath, 0600); chmodErr != nil {
+		return chmodErr
+	}
+	if chownErr := os.Chown(constant.Hysteria2ConfigPath, 0, 0); chownErr != nil {
+		return chownErr
+	}
 	return nil
 }
 
@@ -147,4 +164,3 @@ func Hysteria2AcmePath() (vo.Hysteria2AcmePathVo, error) {
 	}
 	return vo.Hysteria2AcmePathVo{}, errors.New("cert not found")
 }
-