fix(runtime): закрыть fix2 P0 runtime pass без legacy

orchestrator/src/steps/firewall.ts

@@ -9,11 +9,17 @@ export async function applyFirewall(context: InstallContext): Promise<void> {
     return;
   }
 
+  const acmeChallengePort = context.config.acmeType === "tls" ? 443 : 80;
+  const acmeRule = context.config.tlsMode === "acme"
+    ? `tcp dport ${acmeChallengePort} accept`
+    : "# acme challenge port disabled";
+
   const rendered = renderTemplate(await readText(`${context.options.packageDir}/templates/nftables/hy2xs.nft.tpl`), {
     SSH_PORT: context.config.sshPort,
     HYSTERIA_PORT: context.config.hysteriaPort,
     UI_PORT: context.config.uiPort,
-    UI_BIND_HOST: context.config.uiBindHost
+    UI_BIND_HOST: context.config.uiBindHost,
+    ACME_RULE: acmeRule
   });
 
   await runVisible`cp -a /etc/nftables.d/hy2xs.nft /etc/nftables.d/hy2xs.nft.bak 2>/dev/null || true`;
@@ -30,7 +36,6 @@ export async function applyFirewall(context: InstallContext): Promise<void> {
   await runVisible`systemctl enable --now nftables`;
 
   await runVisible`ss -H -ltn | grep -q ':${context.config.sshPort} ' || (echo 'ssh port check failed' >&2; exit 1)`;
-  await runVisible`ss -H -lun | grep -q ':${context.config.hysteriaPort} ' || (echo 'hysteria udp port check failed' >&2; exit 1)`;
 
   if (context.config.firewallStagedApply) {
     await runVisible`systemctl stop hy2xs-fw-rollback || true`;