Полный продовый фикс fix22: DNS preflight, inet firewall, idempotent bootstrap, auth-semantics и redact-config

orchestrator/src/commands/diagnostics.ts

@@ -1,26 +1,12 @@
 import type { CommonOptions } from "../types/context";
 import { info, setOperationContext } from "../lib/log";
 import { run } from "../lib/process";
+import { redactEnv, redactYaml } from "../lib/redaction";
 
 function shellEscapeSingleQuotes(value: string): string {
   return value.replaceAll("'", "'\\''");
 }
 
-function redactEnv(content: string): string {
-  return content
-    .replace(/^(HY2XS_ADMIN_INITIAL_PASSWORD=).*$/gm, "$1<redacted>")
-    .replace(/^(HY2XS_ADMIN_CON_PASS=).*$/gm, "$1<redacted>")
-    .replace(/^(HY2XS_HYSTERIA_TRAFFIC_STATS_SECRET=).*$/gm, "$1<redacted>")
-    .replace(/^(HY2XS_HYSTERIA_OBFS_PASSWORD=).*$/gm, "$1<redacted>");
-}
-
-function redactYaml(content: string): string {
-  return content
-    .replace(/(password:\s*).*/gi, "$1<redacted>")
-    .replace(/(secret:\s*).*/gi, "$1<redacted>")
-    .replace(/(auth:\s*).*/gi, "$1<redacted>");
-}
-
 export async function diagnosticsCollect(_options: CommonOptions): Promise<void> {
   const opId = `diag-${Date.now().toString(36)}`;
   setOperationContext(opId);
@@ -49,6 +35,13 @@ export async function diagnosticsCollect(_options: CommonOptions): Promise<void>
     // noop
   }
 
+  try {
+    const postInstallRaw = await Bun.file(`${outDir}/post-install.env`).text();
+    await Bun.write(`${outDir}/post-install.env`, redactEnv(postInstallRaw));
+  } catch {
+    // noop
+  }
+
   try {
     const cfgRaw = await Bun.file(`${outDir}/hysteria-config.yaml`).text();
     await Bun.write(`${outDir}/hysteria-config.yaml`, redactYaml(cfgRaw));