Полный продовый фикс HY2XS/Hysteria2: auth DTO, валидация bind, smoke, URI, preflight и env-контракт

orchestrator/src/config/env.ts

@@ -127,6 +127,22 @@ function normalizeAcmeType(value: string): "http" | "tls" | "dns" {
   throw new Error(`invalid HY2XS_ACME_TYPE: ${value}`);
 }
 
+function normalizeFixedHysteriaAuthMode(value: string | undefined): "http" {
+  const mode = value || "http";
+  if (mode !== "http") {
+    throw new Error("HY2XS_HYSTERIA_AUTH_MODE is fixed in HY2XS production profile: http");
+  }
+  return "http";
+}
+
+function normalizeFixedHysteriaObfsType(value: string | undefined): "salamander" {
+  const obfsType = value || "salamander";
+  if (obfsType !== "salamander") {
+    throw new Error("HY2XS_HYSTERIA_OBFS_TYPE is fixed in HY2XS production profile: salamander");
+  }
+  return "salamander";
+}
+
 function normalizeSafeAbsolutePath(name: string, value: string, options?: { disallowTmp?: boolean }): string {
   const v = value.trim();
   if (!v.startsWith("/")) {
@@ -157,6 +173,8 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
   const tlsMode = normalizeTlsMode(env.HY2XS_TLS_MODE || "acme");
   const acmeType = normalizeAcmeType(env.HY2XS_ACME_TYPE || "http");
   const firewallMode = normalizeFirewallMode(env);
+  const hysteriaAuthMode = normalizeFixedHysteriaAuthMode(env.HY2XS_HYSTERIA_AUTH_MODE);
+  const hysteriaObfsType = normalizeFixedHysteriaObfsType(env.HY2XS_HYSTERIA_OBFS_TYPE);
 
   const config: RuntimeConfig = {
     domain: env.HY2XS_DOMAIN || "",
@@ -181,14 +199,14 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
     tlsKeyPath: normalizeSafeAbsolutePath("HY2XS_TLS_KEY_PATH", env.HY2XS_TLS_KEY_PATH || "/etc/hysteria/server.key"),
     hysteriaBindHost: normalizeIpv4Host("HY2XS_HYSTERIA_BIND_HOST", env.HY2XS_HYSTERIA_BIND_HOST || "0.0.0.0"),
     hysteriaPort,
-    hysteriaAuthMode: "http",
+    hysteriaAuthMode,
     hysteriaTrafficStatsHost: normalizeIpv4Host(
       "HY2XS_HYSTERIA_TRAFFIC_STATS_HOST",
       env.HY2XS_HYSTERIA_TRAFFIC_STATS_HOST || "127.0.0.1"
     ),
     hysteriaTrafficStatsPort: trafficStatsPort,
     hysteriaTrafficStatsSecret: valueOrGenerate(env.HY2XS_HYSTERIA_TRAFFIC_STATS_SECRET),
-    hysteriaObfsType: "salamander",
+    hysteriaObfsType,
     hysteriaObfsPassword: requireValue("HY2XS_HYSTERIA_OBFS_PASSWORD", valueOrGenerate(env.HY2XS_HYSTERIA_OBFS_PASSWORD)),
     hysteriaBandwidthUp: env.HY2XS_HYSTERIA_BANDWIDTH_UP || "50 mbps",
     hysteriaBandwidthDown: env.HY2XS_HYSTERIA_BANDWIDTH_DOWN || "50 mbps",