Довёл fix20: firewall-mode, staged state, diagnostics, readiness и build-gate

orchestrator/src/config/env.ts

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import type { RuntimeConfig, TlsMode } from "../types/context";
+import type { FirewallMode, RuntimeConfig, TlsMode } from "../types/context";
 
 type EnvMap = Record<string, string>;
 
@@ -53,6 +53,21 @@ function parseBool(name: string, raw: string, fallback: boolean): boolean {
   throw new Error(`invalid ${name}: ${raw}`);
 }
 
+function parseFirewallMode(value: string): FirewallMode {
+  if (value === "managed" || value === "takeover" || value === "external" || value === "off") {
+    return value;
+  }
+  throw new Error(`invalid HY2XS_FIREWALL_MODE: ${value}`);
+}
+
+function normalizeFirewallMode(env: EnvMap): FirewallMode {
+  const raw = env.HY2XS_FIREWALL_MODE;
+  if (!raw) {
+    throw new Error("missing required HY2XS_FIREWALL_MODE");
+  }
+  return parseFirewallMode(raw);
+}
+
 function requireValue(name: string, value: string): string {
   if (!value || !value.trim()) {
     throw new Error(`missing required ${name}`);
@@ -141,6 +156,7 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
   const trafficStatsPort = parsePort("HY2XS_HYSTERIA_TRAFFIC_STATS_PORT", env.HY2XS_HYSTERIA_TRAFFIC_STATS_PORT, 36712);
   const tlsMode = normalizeTlsMode(env.HY2XS_TLS_MODE || "acme");
   const acmeType = normalizeAcmeType(env.HY2XS_ACME_TYPE || "http");
+  const firewallMode = normalizeFirewallMode(env);
 
   const config: RuntimeConfig = {
     domain: env.HY2XS_DOMAIN || "",
@@ -148,9 +164,8 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
     publicPort: parsePort("HY2XS_PUBLIC_PORT", env.HY2XS_PUBLIC_PORT, hysteriaPort),
     ipv6Enabled: parseBool("HY2XS_IPV6_ENABLED", env.HY2XS_IPV6_ENABLED, false),
     sshPort: parsePort("HY2XS_SSH_PORT", env.HY2XS_SSH_PORT, 22),
-    firewallEnabled: parseBool("HY2XS_FIREWALL_ENABLED", env.HY2XS_FIREWALL_ENABLED, true),
+    firewallMode,
     firewallStagedApply: parseBool("HY2XS_FIREWALL_STAGED_APPLY", env.HY2XS_FIREWALL_STAGED_APPLY, true),
-    firewallAllowTakeover: parseBool("HY2XS_FIREWALL_ALLOW_TAKEOVER", env.HY2XS_FIREWALL_ALLOW_TAKEOVER, false),
     uiBindHost,
     uiPublicAccess: parseBool("HY2XS_UI_PUBLIC_ACCESS", env.HY2XS_UI_PUBLIC_ACCESS, false),
     uiPort,
@@ -245,9 +260,8 @@ export function renderRuntimeEnv(config: RuntimeConfig): string {
     `HY2XS_PUBLIC_HOST=${config.publicHost}`,
     `HY2XS_PUBLIC_PORT=${config.publicPort}`,
     `HY2XS_SSH_PORT=${config.sshPort}`,
-    `HY2XS_FIREWALL_ENABLED=${config.firewallEnabled}`,
+    `HY2XS_FIREWALL_MODE=${config.firewallMode}`,
     `HY2XS_FIREWALL_STAGED_APPLY=${config.firewallStagedApply}`,
-    `HY2XS_FIREWALL_ALLOW_TAKEOVER=${config.firewallAllowTakeover}`,
     `HY2XS_UI_BIND_HOST=${config.uiBindHost}`,
     `HY2XS_UI_PUBLIC_ACCESS=${config.uiPublicAccess}`,
     `HY2XS_UI_PORT=${config.uiPort}`,