Реализован production-hardening по fix1: env/reconfigure, IPv4-only, TLS, secrets, firewall, docs

package/templates/env/post-install.env.tpl

@@ -13,15 +13,23 @@ ORCH_BUILD_ID={{PACKAGE_BUILD_ID}}
 ORCH_ENTRYPOINT=/usr/local/lib/hy2xs/hy2xs-orchestrator
 
 DEPLOY_DOMAIN={{DOMAIN}}
+PUBLIC_HOST={{PUBLIC_HOST}}
+PUBLIC_PORT={{PUBLIC_PORT}}
 SSH_PORT={{SSH_PORT}}
+HY2XS_FIREWALL_ENABLED={{FIREWALL_ENABLED}}
+HY2XS_FIREWALL_STAGED_APPLY={{FIREWALL_STAGED_APPLY}}
 
 HY2_SOURCE=official-upstream
 HY2_VERSION={{HYSTERIA_VERSION}}
-HY2_LISTEN_HOST=0.0.0.0
+HY2_TLS_MODE={{TLS_MODE}}
+HY2_ACME_EMAIL={{ACME_EMAIL}}
+HY2_TLS_CERT_PATH={{TLS_CERT_PATH}}
+HY2_TLS_KEY_PATH={{TLS_KEY_PATH}}
+HY2_LISTEN_HOST={{HYSTERIA_BIND_HOST}}
 HY2_PORT={{HYSTERIA_PORT}}
 HY2_AUTH_MODE=http
 HY2_AUTH_URL=http://127.0.0.1:{{UI_PORT}}/hui/hysteria2/auth
-HY2_TRAFFIC_STATS_LISTEN=127.0.0.1:{{HYSTERIA_API_PORT}}
+HY2_TRAFFIC_STATS_LISTEN={{HYSTERIA_API_HOST}}:{{HYSTERIA_API_PORT}}
 HY2_OBFS_TYPE=salamander
 HY2_OBFS_PASSWORD={{HYSTERIA_OBFS_PASSWORD}}
 HY2_BANDWIDTH_UP_Mbps=50
@@ -34,5 +42,6 @@ HUI_FORK_REF=packaged
 HUI_BUILD_ID={{PACKAGE_BUILD_ID}}
 HUI_BIND_HOST={{UI_BIND_HOST}}
 HUI_PORT={{UI_PORT}}
-HUI_INSTALL_DIR=/opt/hy2xs-admin
-HUI_DATA_DIR=/var/lib/hy2xs-admin
+HUI_INSTALL_DIR={{INSTALL_DIR}}
+HUI_DATA_DIR={{DATA_DIR}}
+HUI_LOG_DIR={{LOG_DIR}}

package/templates/hysteria/config.yaml.tpl

@@ -1,14 +1,13 @@
-listen: :{{HYSTERIA_PORT}}
+listen: {{HYSTERIA_BIND_HOST}}:{{HYSTERIA_PORT}}
 
-tls:
-  cert: /etc/hysteria/server.crt
-  key: /etc/hysteria/server.key
+{{TLS_ACME_BLOCK}}
+{{TLS_FILE_BLOCK}}
 
 auth:
   type: http
   http:
     url: http://127.0.0.1:{{UI_PORT}}/hui/hysteria2/auth
-    insecure: true
+    insecure: {{AUTH_INSECURE}}
 
 obfs:
   type: salamander
@@ -20,7 +19,7 @@ bandwidth:
   down: "{{BANDWIDTH_DOWN}}"
 
 trafficStats:
-  listen: 127.0.0.1:{{HYSTERIA_API_PORT}}
+  listen: {{HYSTERIA_API_HOST}}:{{HYSTERIA_API_PORT}}
   secret: "{{HYSTERIA_API_SECRET}}"
 
 quic:

package/templates/nftables/hy2xs.nft.tpl

@@ -1,4 +1,4 @@
-table inet hy2xs {
+table ip hy2xs {
   chain input {
     type filter hook input priority 0; policy drop;
 
@@ -6,9 +6,7 @@ table inet hy2xs {
     ct state established,related accept
     tcp dport {{SSH_PORT}} accept
     udp dport {{HYSTERIA_PORT}} accept
-    tcp dport {{UI_PORT}} ip saddr 127.0.0.1 accept
+    tcp dport {{UI_PORT}} ip saddr {{UI_BIND_HOST}} accept
     icmp type echo-request accept
-    ip6 nexthdr ipv6-icmp accept
-    ip protocol icmp accept
   }
 }