Реализован production-hardening по fix1: env/reconfigure, IPv4-only, TLS, secrets, firewall, docs

2026-04-26 07:27:06 +05:00
parent 2b4a45ad23
commit 3fccd5c442
109 changed files with 1773 additions and 569 deletions
@@ -1,14 +1,47 @@
-# post-install.env example
-# Baseline reference file for a clean Debian 12 deployment.
+# HY2XS post-install reference file.
+# Файл создаётся оркестратором после первичной установки и не является runtime-конфигом.

-HY2XS_PACKAGE_VERSION=0.1.0
-HY2XS_PACKAGE_BUILD_ID=build-20260413-001
-HY2XS_ORCHESTRATOR_STACK=Bun+TypeScript
-HY2XS_INSTALL_DATE=2026-04-13T10:00:00Z
-HY2XS_DOMAIN=example.com
-HY2XS_HYSTERIA_VERSION=v2.8.1
-HY2XS_HYSTERIA_PORT=443
-HY2XS_UI_BIND_HOST=127.0.0.1
-HY2XS_UI_PORT=8081
-HY2XS_ADMIN_PATH=/opt/hy2xs-admin
-HY2XS_CONFIG_PATH=/etc/hysteria/config.yaml
+DEPLOY_TARGET_OS=debian12
+DEPLOY_TIMESTAMP=2026-04-13T10:00:00Z
+PACKAGE_NAME=hy2xs-install-package
+PACKAGE_BUILD_ID=build-20260413-001
+PACKAGE_VERSION=0.1.0
+
+ORCH_SOURCE_STACK=bun-typescript
+ORCH_BUILD_MODE=bun-compile
+ORCH_BUILD_ID=build-20260413-001
+ORCH_ENTRYPOINT=/usr/local/lib/hy2xs/hy2xs-orchestrator
+
+DEPLOY_DOMAIN=example.com
+PUBLIC_HOST=example.com
+PUBLIC_PORT=443
+SSH_PORT=22
+HY2XS_FIREWALL_ENABLED=true
+HY2XS_FIREWALL_STAGED_APPLY=true
+
+HY2_SOURCE=official-upstream
+HY2_VERSION=v2.8.1
+HY2_TLS_MODE=acme
+HY2_ACME_EMAIL=admin@example.com
+HY2_TLS_CERT_PATH=
+HY2_TLS_KEY_PATH=
+HY2_LISTEN_HOST=0.0.0.0
+HY2_PORT=443
+HY2_AUTH_MODE=http
+HY2_AUTH_URL=http://127.0.0.1:8081/hui/hysteria2/auth
+HY2_TRAFFIC_STATS_LISTEN=127.0.0.1:25413
+HY2_OBFS_TYPE=salamander
+HY2_OBFS_PASSWORD=CHANGE_ME
+HY2_BANDWIDTH_UP_Mbps=50
+HY2_BANDWIDTH_DOWN_Mbps=50
+HY2_IGNORE_CLIENT_BANDWIDTH=false
+HY2_CONFIG_PATH=/etc/hysteria/config.yaml
+
+HUI_ENABLED=true
+HUI_FORK_REF=packaged
+HUI_BUILD_ID=build-20260413-001
+HUI_BIND_HOST=127.0.0.1
+HUI_PORT=8081
+HUI_INSTALL_DIR=/opt/hy2xs-admin
+HUI_DATA_DIR=/var/lib/hy2xs-admin
+HUI_LOG_DIR=/var/log/hy2xs-admin
@@ -5,13 +5,23 @@ Wants=network-online.target

 [Service]
 Type=simple
-WorkingDirectory=/opt/hy2xs-admin
-Environment=HUI_DATA=/var/lib/hy2xs-admin/
+User=hy2xs-admin
+Group=hy2xs-admin
+WorkingDirectory={{INSTALL_DIR}}
+Environment=HUI_DATA={{DATA_DIR}}/
 Environment=HY2XS_UI_BIND_HOST={{UI_BIND_HOST}}
-ExecStart=/opt/hy2xs-admin/hy2xs-admin -p {{UI_PORT}}
+Environment=HY2XS_UI_PORT={{UI_PORT}}
+ExecStart={{INSTALL_DIR}}/hy2xs-admin -p {{UI_PORT}}
 Restart=on-failure
 RestartSec=5s
 NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadWritePaths={{DATA_DIR}} {{LOG_DIR}}
+RestrictAddressFamilies=AF_INET AF_UNIX
+CapabilityBoundingSet=
+AmbientCapabilities=

 [Install]
 WantedBy=multi-user.target
@@ -13,15 +13,23 @@ ORCH_BUILD_ID={{PACKAGE_BUILD_ID}}
 ORCH_ENTRYPOINT=/usr/local/lib/hy2xs/hy2xs-orchestrator

 DEPLOY_DOMAIN={{DOMAIN}}
+PUBLIC_HOST={{PUBLIC_HOST}}
+PUBLIC_PORT={{PUBLIC_PORT}}
 SSH_PORT={{SSH_PORT}}
+HY2XS_FIREWALL_ENABLED={{FIREWALL_ENABLED}}
+HY2XS_FIREWALL_STAGED_APPLY={{FIREWALL_STAGED_APPLY}}

 HY2_SOURCE=official-upstream
 HY2_VERSION={{HYSTERIA_VERSION}}
-HY2_LISTEN_HOST=0.0.0.0
+HY2_TLS_MODE={{TLS_MODE}}
+HY2_ACME_EMAIL={{ACME_EMAIL}}
+HY2_TLS_CERT_PATH={{TLS_CERT_PATH}}
+HY2_TLS_KEY_PATH={{TLS_KEY_PATH}}
+HY2_LISTEN_HOST={{HYSTERIA_BIND_HOST}}
 HY2_PORT={{HYSTERIA_PORT}}
 HY2_AUTH_MODE=http
 HY2_AUTH_URL=http://127.0.0.1:{{UI_PORT}}/hui/hysteria2/auth
-HY2_TRAFFIC_STATS_LISTEN=127.0.0.1:{{HYSTERIA_API_PORT}}
+HY2_TRAFFIC_STATS_LISTEN={{HYSTERIA_API_HOST}}:{{HYSTERIA_API_PORT}}
 HY2_OBFS_TYPE=salamander
 HY2_OBFS_PASSWORD={{HYSTERIA_OBFS_PASSWORD}}
 HY2_BANDWIDTH_UP_Mbps=50
@@ -34,5 +42,6 @@ HUI_FORK_REF=packaged
 HUI_BUILD_ID={{PACKAGE_BUILD_ID}}
 HUI_BIND_HOST={{UI_BIND_HOST}}
 HUI_PORT={{UI_PORT}}
-HUI_INSTALL_DIR=/opt/hy2xs-admin
-HUI_DATA_DIR=/var/lib/hy2xs-admin
+HUI_INSTALL_DIR={{INSTALL_DIR}}
+HUI_DATA_DIR={{DATA_DIR}}
+HUI_LOG_DIR={{LOG_DIR}}
@@ -1,14 +1,13 @@
-listen: :{{HYSTERIA_PORT}}
+listen: {{HYSTERIA_BIND_HOST}}:{{HYSTERIA_PORT}}

-tls:
-  cert: /etc/hysteria/server.crt
-  key: /etc/hysteria/server.key
+{{TLS_ACME_BLOCK}}
+{{TLS_FILE_BLOCK}}

 auth:
  type: http
  http:
    url: http://127.0.0.1:{{UI_PORT}}/hui/hysteria2/auth
-    insecure: true
+    insecure: {{AUTH_INSECURE}}

 obfs:
  type: salamander
@@ -20,7 +19,7 @@ bandwidth:
  down: "{{BANDWIDTH_DOWN}}"

 trafficStats:
-  listen: 127.0.0.1:{{HYSTERIA_API_PORT}}
+  listen: {{HYSTERIA_API_HOST}}:{{HYSTERIA_API_PORT}}
  secret: "{{HYSTERIA_API_SECRET}}"

 quic:
@@ -1,4 +1,4 @@
-table inet hy2xs {
+table ip hy2xs {
  chain input {
    type filter hook input priority 0; policy drop;

@@ -6,9 +6,7 @@ table inet hy2xs {
    ct state established,related accept
    tcp dport {{SSH_PORT}} accept
    udp dport {{HYSTERIA_PORT}} accept
-    tcp dport {{UI_PORT}} ip saddr 127.0.0.1 accept
+    tcp dport {{UI_PORT}} ip saddr {{UI_BIND_HOST}} accept
    icmp type echo-request accept
-    ip6 nexthdr ipv6-icmp accept
-    ip protocol icmp accept
  }
 }