prod/HY2XS_flamy
5
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

Production hardening: host-aware install, ownership contracts, firewall safety

Browse Source
This commit is contained in:
Crimson
2026-04-30 03:26:14 +05:00
parent 0545990968
commit c10ab1fafd
25 changed files with 190 additions and 262 deletions
Download Patch File Download Diff File Expand all files Collapse all files
orchestrator/src/config/env.ts
+13 -1
View File
@@ -115,7 +115,9 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
sshPort: parsePort("HY2XS_SSH_PORT", env.HY2XS_SSH_PORT, 22),
firewallEnabled: parseBool("HY2XS_FIREWALL_ENABLED", env.HY2XS_FIREWALL_ENABLED, true),
firewallStagedApply: parseBool("HY2XS_FIREWALL_STAGED_APPLY", env.HY2XS_FIREWALL_STAGED_APPLY, true),
firewallAllowTakeover: parseBool("HY2XS_FIREWALL_ALLOW_TAKEOVER", env.HY2XS_FIREWALL_ALLOW_TAKEOVER, false),
uiBindHost,
uiPublicAccess: parseBool("HY2XS_UI_PUBLIC_ACCESS", env.HY2XS_UI_PUBLIC_ACCESS, false),
uiPort,
adminUser: requireValue("HY2XS_ADMIN_USER", env.HY2XS_ADMIN_USER || "admin"),
adminInitialPassword: valueOrGenerate(env.HY2XS_ADMIN_INITIAL_PASSWORD),
@@ -146,7 +148,8 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
false
),
hysteriaConfigPath: env.HY2XS_HYSTERIA_CONFIG_PATH || "/etc/hysteria/config.yaml",
hysteriaVersionPolicy: env.HY2XS_HYSTERIA_VERSION || "latest",
allowLatestHysteria: parseBool("HY2XS_ALLOW_LATEST_HYSTERIA", env.HY2XS_ALLOW_LATEST_HYSTERIA, false),
hysteriaVersionPolicy: env.HY2XS_HYSTERIA_VERSION || "v2.6.0",
installDir: env.HY2XS_INSTALL_DIR || "/opt/hy2xs-admin",
dataDir: env.HY2XS_DATA_DIR || "/var/lib/hy2xs-admin",
logDir: env.HY2XS_LOG_DIR || "/var/log/hy2xs",
@@ -170,6 +173,12 @@ export function validateRuntimeConfig(config: RuntimeConfig): void {
if (config.hysteriaBindHost !== "0.0.0.0") {
throw new Error("HY2XS_HYSTERIA_BIND_HOST must be 0.0.0.0 in production profile");
}
if (!config.uiPublicAccess && config.uiBindHost !== "127.0.0.1") {
throw new Error("HY2XS UI must bind to 127.0.0.1 in production baseline");
}
if (config.hysteriaConfigPath !== "/etc/hysteria/config.yaml") {
throw new Error("HY2XS_HYSTERIA_CONFIG_PATH is fixed in production baseline: /etc/hysteria/config.yaml");
}
if (config.tlsMode === "acme") {
if (!config.domain) {
@@ -205,7 +214,9 @@ export function renderRuntimeEnv(config: RuntimeConfig): string {
`HY2XS_SSH_PORT=${config.sshPort}`,
`HY2XS_FIREWALL_ENABLED=${config.firewallEnabled}`,
`HY2XS_FIREWALL_STAGED_APPLY=${config.firewallStagedApply}`,
`HY2XS_FIREWALL_ALLOW_TAKEOVER=${config.firewallAllowTakeover}`,
`HY2XS_UI_BIND_HOST=${config.uiBindHost}`,
`HY2XS_UI_PUBLIC_ACCESS=${config.uiPublicAccess}`,
`HY2XS_UI_PORT=${config.uiPort}`,
`HY2XS_ADMIN_USER=${config.adminUser}`,
`HY2XS_ADMIN_INITIAL_PASSWORD=${config.adminInitialPassword}`,
@@ -229,6 +240,7 @@ export function renderRuntimeEnv(config: RuntimeConfig): string {
`HY2XS_HYSTERIA_BANDWIDTH_DOWN=${config.hysteriaBandwidthDown}`,
`HY2XS_HYSTERIA_IGNORE_CLIENT_BANDWIDTH=${config.hysteriaIgnoreClientBandwidth}`,
`HY2XS_HYSTERIA_CONFIG_PATH=${config.hysteriaConfigPath}`,
`HY2XS_ALLOW_LATEST_HYSTERIA=${config.allowLatestHysteria}`,
`HY2XS_HYSTERIA_VERSION=${config.hysteriaVersionPolicy}`,
`HY2XS_INSTALL_DIR=${config.installDir}`,
`HY2XS_DATA_DIR=${config.dataDir}`,