fix(runtime): закрыть fix2 P0 runtime pass без legacy

package/config/hy2xs.env

@@ -0,0 +1,34 @@
+# HY2XS canonical production runtime config (packaged baseline)
+HY2XS_IPV6_ENABLED=false
+HY2XS_DOMAIN=
+HY2XS_PUBLIC_HOST=127.0.0.1
+HY2XS_PUBLIC_PORT=443
+HY2XS_SSH_PORT=22
+HY2XS_FIREWALL_ENABLED=true
+HY2XS_FIREWALL_STAGED_APPLY=true
+HY2XS_UI_BIND_HOST=127.0.0.1
+HY2XS_UI_PORT=8080
+HY2XS_ADMIN_USER=admin
+HY2XS_ADMIN_INITIAL_PASSWORD=
+HY2XS_FORCE_PASSWORD_CHANGE=true
+HY2XS_TLS_MODE=self_signed_dev
+HY2XS_ACME_EMAIL=
+HY2XS_TLS_CERT_PATH=/etc/hysteria/server.crt
+HY2XS_TLS_KEY_PATH=/etc/hysteria/server.key
+HY2XS_HYSTERIA_BIND_HOST=0.0.0.0
+HY2XS_HYSTERIA_PORT=443
+HY2XS_HYSTERIA_AUTH_MODE=http
+HY2XS_HYSTERIA_AUTH_URL=http://127.0.0.1:8080/hui/hysteria2/auth
+HY2XS_HYSTERIA_TRAFFIC_STATS_HOST=127.0.0.1
+HY2XS_HYSTERIA_TRAFFIC_STATS_PORT=36712
+HY2XS_HYSTERIA_TRAFFIC_STATS_SECRET=
+HY2XS_HYSTERIA_OBFS_TYPE=salamander
+HY2XS_HYSTERIA_OBFS_PASSWORD=
+HY2XS_HYSTERIA_BANDWIDTH_UP=50 mbps
+HY2XS_HYSTERIA_BANDWIDTH_DOWN=50 mbps
+HY2XS_HYSTERIA_IGNORE_CLIENT_BANDWIDTH=false
+HY2XS_HYSTERIA_CONFIG_PATH=/etc/hysteria/config.yaml
+HY2XS_HYSTERIA_VERSION=latest
+HY2XS_INSTALL_DIR=/opt/hy2xs-admin
+HY2XS_DATA_DIR=/var/lib/hy2xs-admin
+HY2XS_LOG_DIR=/var/log/hy2xs

package/examples/post-install.env.example

@@ -1,47 +0,0 @@
-# HY2XS post-install reference file.
-# Файл создаётся оркестратором после первичной установки и не является runtime-конфигом.
-
-DEPLOY_TARGET_OS=debian12
-DEPLOY_TIMESTAMP=2026-04-13T10:00:00Z
-PACKAGE_NAME=hy2xs-install-package
-PACKAGE_BUILD_ID=build-20260413-001
-PACKAGE_VERSION=0.1.0
-
-ORCH_SOURCE_STACK=bun-typescript
-ORCH_BUILD_MODE=bun-compile
-ORCH_BUILD_ID=build-20260413-001
-ORCH_ENTRYPOINT=/usr/local/lib/hy2xs/hy2xs-orchestrator
-
-DEPLOY_DOMAIN=example.com
-PUBLIC_HOST=example.com
-PUBLIC_PORT=443
-SSH_PORT=22
-HY2XS_FIREWALL_ENABLED=true
-HY2XS_FIREWALL_STAGED_APPLY=true
-
-HY2_SOURCE=official-upstream
-HY2_VERSION=v2.8.1
-HY2_TLS_MODE=acme
-HY2_ACME_EMAIL=admin@example.com
-HY2_TLS_CERT_PATH=
-HY2_TLS_KEY_PATH=
-HY2_LISTEN_HOST=0.0.0.0
-HY2_PORT=443
-HY2_AUTH_MODE=http
-HY2_AUTH_URL=http://127.0.0.1:8081/hui/hysteria2/auth
-HY2_TRAFFIC_STATS_LISTEN=127.0.0.1:25413
-HY2_OBFS_TYPE=salamander
-HY2_OBFS_PASSWORD=CHANGE_ME
-HY2_BANDWIDTH_UP_Mbps=50
-HY2_BANDWIDTH_DOWN_Mbps=50
-HY2_IGNORE_CLIENT_BANDWIDTH=false
-HY2_CONFIG_PATH=/etc/hysteria/config.yaml
-
-HUI_ENABLED=true
-HUI_FORK_REF=packaged
-HUI_BUILD_ID=build-20260413-001
-HUI_BIND_HOST=127.0.0.1
-HUI_PORT=8081
-HUI_INSTALL_DIR=/opt/hy2xs-admin
-HUI_DATA_DIR=/var/lib/hy2xs-admin
-HUI_LOG_DIR=/var/log/hy2xs-admin

package/install.sh

@@ -3,6 +3,8 @@ set -eu
 
 PACKAGE_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
 ORCHESTRATOR="$PACKAGE_DIR/orchestrator/hy2xs-orchestrator"
+ORCHESTRATOR_INSTALL_PATH="/usr/local/lib/hy2xs/hy2xs-orchestrator"
+ORCHESTRATOR_SYMLINK="/usr/local/bin/hy2xs-orchestrator"
 
 log() {
   printf '[hy2xs-install] %s\n' "$*"
@@ -21,6 +23,10 @@ if [ ! -x "$ORCHESTRATOR" ]; then
   fail "Missing executable orchestrator artifact: $ORCHESTRATOR"
 fi
 
+install -d -m 0755 /usr/local/lib/hy2xs
+install -m 0755 "$ORCHESTRATOR" "$ORCHESTRATOR_INSTALL_PATH"
+ln -sf "$ORCHESTRATOR_INSTALL_PATH" "$ORCHESTRATOR_SYMLINK"
+
 log "package directory: $PACKAGE_DIR"
 log "starting install-only orchestrator"
-exec "$ORCHESTRATOR" install --package-dir "$PACKAGE_DIR" "$@"
+exec "$ORCHESTRATOR_INSTALL_PATH" install --package-dir "$PACKAGE_DIR" "$@"

package/templates/nftables/hy2xs.nft.tpl

@@ -5,6 +5,7 @@ table ip hy2xs {
     iif lo accept
     ct state established,related accept
     tcp dport {{SSH_PORT}} accept
+    {{ACME_RULE}}
     udp dport {{HYSTERIA_PORT}} accept
     tcp dport {{UI_PORT}} ip saddr {{UI_BIND_HOST}} accept
     icmp type echo-request accept