Реализован production-hardening по fix1: env/reconfigure, IPv4-only, TLS, secrets, firewall, docs

apps/util/arr.go

@@ -30,4 +30,3 @@ func SplitArr[T any](arr []T, num int) [][]T {
 
 	return segments
 }
-

apps/util/encrypt.go

@@ -2,7 +2,11 @@ package util
 
 import (
 	"crypto/sha256"
+	"errors"
 	"fmt"
+	"strings"
+
+	"golang.org/x/crypto/bcrypt"
 )
 
 func SHA224String(password string) string {
@@ -16,3 +20,25 @@ func SHA224String(password string) string {
 	return str
 }
 
+func HashPassword(password string) (string, error) {
+	if len(strings.TrimSpace(password)) < 6 {
+		return "", errors.New("password too short")
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return "", err
+	}
+	return string(hash), nil
+}
+
+func IsBcryptHash(hash string) bool {
+	return strings.HasPrefix(hash, "$2a$") || strings.HasPrefix(hash, "$2b$") || strings.HasPrefix(hash, "$2y$")
+}
+
+func VerifyPassword(password string, storedHash string) (ok bool, legacy bool) {
+	if IsBcryptHash(storedHash) {
+		err := bcrypt.CompareHashAndPassword([]byte(storedHash), []byte(password))
+		return err == nil, false
+	}
+	return SHA224String(password) == storedHash, true
+}

apps/util/encrypt_test.go

@@ -5,4 +5,3 @@ import "testing"
 func TestSHA224String(t *testing.T) {
 	println(SHA224String("sysadmin"))
 }
-

apps/util/export.go

@@ -38,4 +38,3 @@ func ExportFile(filePath string, data any, t int) error {
 	}
 	return nil
 }
-

apps/util/file.go

@@ -86,4 +86,3 @@ func FindFile(dir, filename string) (string, error) {
 	}
 	return result, nil
 }
-

apps/util/github.go

@@ -1,58 +0,0 @@
-package util
-
-import (
-	"context"
-	"fmt"
-	"github.com/google/go-github/v39/github"
-)
-
-var githubClient *github.Client
-
-func init() {
-	githubClient = github.NewClient(nil)
-}
-
-func GetReleaseAssetURL(owner, repo, version, fileName string) (string, error) {
-	ctx := context.Background()
-
-	var release *github.RepositoryRelease
-	var err error
-	if version != "" {
-		release, _, err = githubClient.Repositories.GetReleaseByTag(ctx, owner, repo, version)
-		if err != nil {
-			return "", fmt.Errorf("failed to get release for version %s: %v", version, err)
-		}
-	} else {
-		releases, _, err := githubClient.Repositories.ListReleases(ctx, owner, repo, nil)
-		if err != nil {
-			return "", fmt.Errorf("failed to list releases: %v", err)
-		}
-		if len(releases) == 0 {
-			return "", fmt.Errorf("no releases found")
-		}
-		release = releases[0]
-	}
-
-	assets, _, err := githubClient.Repositories.ListReleaseAssets(ctx, owner, repo, release.GetID(), nil)
-	if err != nil {
-		return "", fmt.Errorf("failed to list release assets: %v", err)
-	}
-
-	for _, asset := range assets {
-		if asset.GetName() == fileName {
-			return asset.GetBrowserDownloadURL(), nil
-		}
-	}
-
-	return "", fmt.Errorf("file '%s' not found in release '%s'", fileName, release.GetTagName())
-}
-
-func ListRelease(owner, repo string) ([]*github.RepositoryRelease, error) {
-	ctx := context.Background()
-	releases, _, err := githubClient.Repositories.ListReleases(ctx, owner, repo, nil)
-	if err != nil {
-		return nil, fmt.Errorf("failed to list releases: %v", err)
-	}
-	return releases, nil
-}
-

apps/util/hysteria2.go

@@ -1,66 +1,9 @@
 package util
 
 import (
-	"fmt"
 	"hy2xs-admin/model/constant"
-	"io"
-	"net/http"
-	"os"
-	"runtime"
 )
 
 func GetHysteria2BinPath() string {
 	return constant.Hysteria2BinPath
 }
-
-func GetHysteria2BinName() string {
-	hysteria2FileName := fmt.Sprintf("hysteria-%s-%s", runtime.GOOS, runtime.GOARCH)
-	if runtime.GOOS == "windows" {
-		hysteria2FileName += ".exe"
-	}
-	return hysteria2FileName
-}
-
-func DownloadHysteria2(version string) error {
-	hysteria2BinName := GetHysteria2BinName()
-	hysteria2BinPath := GetHysteria2BinPath()
-
-	// Download the latest version of Hysteria2
-	url, err := GetReleaseAssetURL("apernet", "hysteria", version, hysteria2BinName)
-	if err != nil {
-		return err
-	}
-
-	resp, err := http.Get(url)
-	defer resp.Body.Close()
-	if err != nil {
-		return fmt.Errorf("failed to download file: %v", err)
-	}
-
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("failed to download file, status code: %d", resp.StatusCode)
-	}
-
-	if Exists(hysteria2BinPath) {
-		if err = os.Remove(hysteria2BinPath); err != nil {
-			return fmt.Errorf("failed to remove existing file: %v", err)
-		}
-	}
-
-	file, err := os.Create(hysteria2BinPath)
-	defer file.Close()
-	if err != nil {
-		return fmt.Errorf("failed to create file %s: %v", hysteria2BinPath, err)
-	}
-
-	_, err = io.Copy(file, resp.Body)
-	if err != nil {
-		return fmt.Errorf("failed to write to file: %v", err)
-	}
-
-	if err = os.Chmod(hysteria2BinPath, 0755); err != nil {
-		return fmt.Errorf("failed to change file permissions: %v", err)
-	}
-	return nil
-}
-

apps/util/linux.go

@@ -98,4 +98,3 @@ func VerifyPort(port string) error {
 	}
 	return nil
 }
-

apps/util/map.go

@@ -21,4 +21,3 @@ func SplitMap[T any](inputMap map[string]T, chunkSize int) []map[string]T {
 
 	return segments
 }
-

apps/util/rand.go

@@ -17,4 +17,3 @@ func RandomString(length int) (string, error) {
 
 	return string(bytes), nil
 }
-

apps/util/string.go

@@ -34,4 +34,3 @@ func CompareVersion(version1, version2 string) int {
 	// The version number is exactly the same
 	return 0
 }
-