fix(runtime): закрыть fix2 P0 runtime pass без legacy

orchestrator/src/steps/firewall.ts

@@ -9,11 +9,17 @@ export async function applyFirewall(context: InstallContext): Promise<void> {
     return;
   }
 
+  const acmeChallengePort = context.config.acmeType === "tls" ? 443 : 80;
+  const acmeRule = context.config.tlsMode === "acme"
+    ? `tcp dport ${acmeChallengePort} accept`
+    : "# acme challenge port disabled";
+
   const rendered = renderTemplate(await readText(`${context.options.packageDir}/templates/nftables/hy2xs.nft.tpl`), {
     SSH_PORT: context.config.sshPort,
     HYSTERIA_PORT: context.config.hysteriaPort,
     UI_PORT: context.config.uiPort,
-    UI_BIND_HOST: context.config.uiBindHost
+    UI_BIND_HOST: context.config.uiBindHost,
+    ACME_RULE: acmeRule
   });
 
   await runVisible`cp -a /etc/nftables.d/hy2xs.nft /etc/nftables.d/hy2xs.nft.bak 2>/dev/null || true`;
@@ -30,7 +36,6 @@ export async function applyFirewall(context: InstallContext): Promise<void> {
   await runVisible`systemctl enable --now nftables`;
 
   await runVisible`ss -H -ltn | grep -q ':${context.config.sshPort} ' || (echo 'ssh port check failed' >&2; exit 1)`;
-  await runVisible`ss -H -lun | grep -q ':${context.config.hysteriaPort} ' || (echo 'hysteria udp port check failed' >&2; exit 1)`;
 
   if (context.config.firewallStagedApply) {
     await runVisible`systemctl stop hy2xs-fw-rollback || true`;

orchestrator/src/steps/hysteria.ts

@@ -31,7 +31,7 @@ export async function installHysteria(context: InstallContext): Promise<void> {
   if (policy === "latest") {
     await runVisible`bash ${scriptPath}`;
   } else {
-    await runVisible`HYSTERIA_VERSION=${policy} bash ${scriptPath}`;
+    await runVisible`bash ${scriptPath} --version ${policy}`;
   }
 
   await runVisible`test -x /usr/local/bin/hysteria`;

orchestrator/src/steps/smoke.ts

@@ -1,6 +1,6 @@
 import type { InstallContext } from "../types/context";
 import { info } from "../lib/log";
-import { runVisible } from "../lib/process";
+import { runHidden, runSecret, runVisible } from "../lib/process";
 
 export async function smoke(context: InstallContext): Promise<void> {
   if (context.options.skipStart) {
@@ -26,10 +26,13 @@ export async function smoke(context: InstallContext): Promise<void> {
   }
   await runVisible`ss -H -lun | grep -q '0.0.0.0:${context.config.hysteriaPort} '`;
   await runVisible`! ss -H -ltnu | grep -q '\[::\]'`;
-  await runVisible`curl -fsS --max-time 5 http://127.0.0.1:${context.config.uiPort}/hui/hysteria2/auth >/dev/null`;
+  await runHidden`curl -fsS --max-time 5 -X POST -H 'Content-Type: application/json' --data '{"addr":"127.0.0.1:12345","auth":"invalid","tx":"0"}' http://127.0.0.1:${context.config.uiPort}/hui/hysteria2/auth >/dev/null`;
 
-  await runVisible`curl -fsS --max-time 5 -H 'Authorization: ${context.config.hysteriaTrafficStatsSecret}' http://127.0.0.1:${context.config.hysteriaTrafficStatsPort}/online >/dev/null`;
-  await runVisible`curl -fsS --max-time 5 -o /dev/null -w '%{http_code}' -H 'Authorization: invalid-hy2xs-secret' http://127.0.0.1:${context.config.hysteriaTrafficStatsPort}/online | grep -Eq '401|403'`;
+  await runHidden`curl -fsS --max-time 5 -H 'Authorization: ${context.config.hysteriaTrafficStatsSecret}' http://127.0.0.1:${context.config.hysteriaTrafficStatsPort}/online >/dev/null`;
+  const deniedCode = await runSecret`curl -fsS --max-time 5 -o /dev/null -w '%{http_code}' -H 'Authorization: invalid-hy2xs-secret' http://127.0.0.1:${context.config.hysteriaTrafficStatsPort}/online`;
+  if (!/(401|403)/.test(deniedCode)) {
+    throw new Error(`unexpected trafficStats status for invalid secret: ${deniedCode}`);
+  }
 
   await runVisible`nft -c -f /etc/nftables.conf`;