Реализован production-hardening по fix1: env/reconfigure, IPv4-only, TLS, secrets, firewall, docs

orchestrator/src/commands/install.ts

@@ -1,7 +1,9 @@
 import { randomBytes } from "node:crypto";
 import type { InstallContext, InstallOptions } from "../types/context";
-import { readText } from "../lib/fs";
+import { exists, readText, writeText } from "../lib/fs";
+import { runVisible } from "../lib/process";
 import { step } from "../lib/log";
+import { defaultRuntimeConfig, parseRuntimeEnv, renderRuntimeEnv } from "../config/env";
 import { preflight } from "../steps/preflight";
 import { installDeps } from "../steps/deps";
 import { prepareFilesystem } from "../steps/filesystem";
@@ -26,15 +28,16 @@ function secret(): string {
 }
 
 export async function install(options: InstallOptions): Promise<void> {
+  const hasConfig = await exists(options.configPath);
+  const config = hasConfig ? parseRuntimeEnv(await readText(options.configPath)) : defaultRuntimeConfig();
+
   const context: InstallContext = {
     options,
+    config,
     packageVersion: await readPackageValue(options.packageDir, "package.version", "unknown"),
     packageBuildId: await readPackageValue(options.packageDir, "package.build_id", "unknown"),
     installDate: new Date().toISOString(),
     hysteriaAuthPassword: secret(),
-    hysteriaObfsPassword: secret(),
-    hysteriaApiSecret: secret(),
-    hysteriaApiPort: 36712,
     hysteriaVersion: "unknown"
   };
 
@@ -44,6 +47,11 @@ export async function install(options: InstallOptions): Promise<void> {
   await installDeps(context);
   step("filesystem");
   await prepareFilesystem(context);
+  if (!hasConfig) {
+    step("write runtime env");
+    await runVisible`mkdir -p /etc/hy2xs`;
+    await writeText(options.configPath, renderRuntimeEnv(config), 0o600);
+  }
   step("bundled UI");
   await deployUi(context);
   step("Hysteria2 upstream install");