Подготовить HY2XS к production-сборке

package/docs/README.md

@@ -0,0 +1,11 @@
+# HY2XS install package
+
+This package is generated by the local builder layer. It is intended for a clean Debian 12 target and contains a compiled install-only orchestrator, bundled HY2XS admin files, templates, systemd units, and package metadata.
+
+Run as root:
+
+```sh
+./install.sh --non-interactive --domain example.com
+```
+
+No target-side JavaScript or TypeScript build step is part of the baseline.

package/examples/post-install.env.example

@@ -0,0 +1,14 @@
+# post-install.env example
+# Baseline reference file for a clean Debian 12 deployment.
+
+HY2XS_PACKAGE_VERSION=0.1.0
+HY2XS_PACKAGE_BUILD_ID=build-20260413-001
+HY2XS_ORCHESTRATOR_STACK=Bun+TypeScript
+HY2XS_INSTALL_DATE=2026-04-13T10:00:00Z
+HY2XS_DOMAIN=example.com
+HY2XS_HYSTERIA_VERSION=v2.8.1
+HY2XS_HYSTERIA_PORT=443
+HY2XS_UI_BIND_HOST=127.0.0.1
+HY2XS_UI_PORT=8081
+HY2XS_ADMIN_PATH=/opt/hy2xs-admin
+HY2XS_CONFIG_PATH=/etc/hysteria/config.yaml

package/install.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env sh
+set -eu
+
+PACKAGE_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+ORCHESTRATOR="$PACKAGE_DIR/orchestrator/hy2xs-orchestrator"
+
+log() {
+  printf '[hy2xs-install] %s\n' "$*"
+}
+
+fail() {
+  printf '[hy2xs-install] ERROR: %s\n' "$*" >&2
+  exit 1
+}
+
+if [ "$(id -u)" != "0" ]; then
+  fail "HY2XS install must run as root."
+fi
+
+if [ ! -x "$ORCHESTRATOR" ]; then
+  fail "Missing executable orchestrator artifact: $ORCHESTRATOR"
+fi
+
+log "package directory: $PACKAGE_DIR"
+log "starting install-only orchestrator"
+exec "$ORCHESTRATOR" install --package-dir "$PACKAGE_DIR" "$@"

package/systemd/hy2xs-admin.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=HY2XS admin
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/hy2xs-admin
+Environment=HUI_DATA=/var/lib/hy2xs-admin/
+Environment=HY2XS_UI_BIND_HOST={{UI_BIND_HOST}}
+ExecStart=/opt/hy2xs-admin/hy2xs-admin -p {{UI_PORT}}
+Restart=on-failure
+RestartSec=5s
+NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target

package/systemd/hysteria-server.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=HY2XS Hysteria2 server
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=hysteria
+Group=hysteria
+ExecStart=/usr/local/bin/hysteria server -c /etc/hysteria/config.yaml
+Restart=on-failure
+RestartSec=5s
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target

package/templates/env/post-install.env.tpl

@@ -0,0 +1,38 @@
+# HY2XS post-install reference file.
+# Файл создаётся оркестратором после первичной установки и не является runtime-конфигом.
+
+DEPLOY_TARGET_OS=debian12
+DEPLOY_TIMESTAMP={{INSTALL_DATE}}
+PACKAGE_NAME=hy2xs-install-package
+PACKAGE_BUILD_ID={{PACKAGE_BUILD_ID}}
+PACKAGE_VERSION={{PACKAGE_VERSION}}
+
+ORCH_SOURCE_STACK=bun-typescript
+ORCH_BUILD_MODE=bun-compile
+ORCH_BUILD_ID={{PACKAGE_BUILD_ID}}
+ORCH_ENTRYPOINT=/usr/local/lib/hy2xs/hy2xs-orchestrator
+
+DEPLOY_DOMAIN={{DOMAIN}}
+SSH_PORT={{SSH_PORT}}
+
+HY2_SOURCE=official-upstream
+HY2_VERSION={{HYSTERIA_VERSION}}
+HY2_LISTEN_HOST=0.0.0.0
+HY2_PORT={{HYSTERIA_PORT}}
+HY2_AUTH_MODE=http
+HY2_AUTH_URL=http://127.0.0.1:{{UI_PORT}}/hui/hysteria2/auth
+HY2_TRAFFIC_STATS_LISTEN=127.0.0.1:{{HYSTERIA_API_PORT}}
+HY2_OBFS_TYPE=salamander
+HY2_OBFS_PASSWORD={{HYSTERIA_OBFS_PASSWORD}}
+HY2_BANDWIDTH_UP_Mbps=50
+HY2_BANDWIDTH_DOWN_Mbps=50
+HY2_IGNORE_CLIENT_BANDWIDTH=false
+HY2_CONFIG_PATH=/etc/hysteria/config.yaml
+
+HUI_ENABLED=true
+HUI_FORK_REF=packaged
+HUI_BUILD_ID={{PACKAGE_BUILD_ID}}
+HUI_BIND_HOST={{UI_BIND_HOST}}
+HUI_PORT={{UI_PORT}}
+HUI_INSTALL_DIR=/opt/hy2xs-admin
+HUI_DATA_DIR=/var/lib/hy2xs-admin

package/templates/hysteria/config.yaml.tpl

@@ -0,0 +1,30 @@
+listen: :{{HYSTERIA_PORT}}
+
+tls:
+  cert: /etc/hysteria/server.crt
+  key: /etc/hysteria/server.key
+
+auth:
+  type: http
+  http:
+    url: http://127.0.0.1:{{UI_PORT}}/hui/hysteria2/auth
+    insecure: true
+
+obfs:
+  type: salamander
+  salamander:
+    password: "{{HYSTERIA_OBFS_PASSWORD}}"
+
+bandwidth:
+  up: "{{BANDWIDTH_UP}}"
+  down: "{{BANDWIDTH_DOWN}}"
+
+trafficStats:
+  listen: 127.0.0.1:{{HYSTERIA_API_PORT}}
+  secret: "{{HYSTERIA_API_SECRET}}"
+
+quic:
+  initStreamReceiveWindow: 8388608
+  maxStreamReceiveWindow: 8388608
+  initConnReceiveWindow: 20971520
+  maxConnReceiveWindow: 20971520

package/templates/nftables/hy2xs.nft.tpl

@@ -0,0 +1,14 @@
+table inet hy2xs {
+  chain input {
+    type filter hook input priority 0; policy drop;
+
+    iif lo accept
+    ct state established,related accept
+    tcp dport {{SSH_PORT}} accept
+    udp dport {{HYSTERIA_PORT}} accept
+    tcp dport {{UI_PORT}} ip saddr 127.0.0.1 accept
+    icmp type echo-request accept
+    ip6 nexthdr ipv6-icmp accept
+    ip protocol icmp accept
+  }
+}