Реализован production-hardening по fix1: env/reconfigure, IPv4-only, TLS, secrets, firewall, docs

2026-04-26 07:27:06 +05:00
parent 2b4a45ad23
commit 3fccd5c442
109 changed files with 1773 additions and 569 deletions
@@ -1,14 +1,47 @@
-# post-install.env example
-# Baseline reference file for a clean Debian 12 deployment.
+# HY2XS post-install reference file.
+# Файл создаётся оркестратором после первичной установки и не является runtime-конфигом.

-HY2XS_PACKAGE_VERSION=0.1.0
-HY2XS_PACKAGE_BUILD_ID=build-20260413-001
-HY2XS_ORCHESTRATOR_STACK=Bun+TypeScript
-HY2XS_INSTALL_DATE=2026-04-13T10:00:00Z
-HY2XS_DOMAIN=example.com
-HY2XS_HYSTERIA_VERSION=v2.8.1
-HY2XS_HYSTERIA_PORT=443
-HY2XS_UI_BIND_HOST=127.0.0.1
-HY2XS_UI_PORT=8081
-HY2XS_ADMIN_PATH=/opt/hy2xs-admin
-HY2XS_CONFIG_PATH=/etc/hysteria/config.yaml
+DEPLOY_TARGET_OS=debian12
+DEPLOY_TIMESTAMP=2026-04-13T10:00:00Z
+PACKAGE_NAME=hy2xs-install-package
+PACKAGE_BUILD_ID=build-20260413-001
+PACKAGE_VERSION=0.1.0
+
+ORCH_SOURCE_STACK=bun-typescript
+ORCH_BUILD_MODE=bun-compile
+ORCH_BUILD_ID=build-20260413-001
+ORCH_ENTRYPOINT=/usr/local/lib/hy2xs/hy2xs-orchestrator
+
+DEPLOY_DOMAIN=example.com
+PUBLIC_HOST=example.com
+PUBLIC_PORT=443
+SSH_PORT=22
+HY2XS_FIREWALL_ENABLED=true
+HY2XS_FIREWALL_STAGED_APPLY=true
+
+HY2_SOURCE=official-upstream
+HY2_VERSION=v2.8.1
+HY2_TLS_MODE=acme
+HY2_ACME_EMAIL=admin@example.com
+HY2_TLS_CERT_PATH=
+HY2_TLS_KEY_PATH=
+HY2_LISTEN_HOST=0.0.0.0
+HY2_PORT=443
+HY2_AUTH_MODE=http
+HY2_AUTH_URL=http://127.0.0.1:8081/hui/hysteria2/auth
+HY2_TRAFFIC_STATS_LISTEN=127.0.0.1:25413
+HY2_OBFS_TYPE=salamander
+HY2_OBFS_PASSWORD=CHANGE_ME
+HY2_BANDWIDTH_UP_Mbps=50
+HY2_BANDWIDTH_DOWN_Mbps=50
+HY2_IGNORE_CLIENT_BANDWIDTH=false
+HY2_CONFIG_PATH=/etc/hysteria/config.yaml
+
+HUI_ENABLED=true
+HUI_FORK_REF=packaged
+HUI_BUILD_ID=build-20260413-001
+HUI_BIND_HOST=127.0.0.1
+HUI_PORT=8081
+HUI_INSTALL_DIR=/opt/hy2xs-admin
+HUI_DATA_DIR=/var/lib/hy2xs-admin
+HUI_LOG_DIR=/var/log/hy2xs-admin