feat(v1): Gecko-обфускация, latest-stable Hysteria на сборке и forward-compatible admin
Сквозная миграция HY2XS на современную Hysteria (2.12.2) и переход на v1. Build: - версия Hysteria резолвится на этапе сборки из HyNetworks/hysteria и замораживается в metadata пакета (version + immutable url + sha256); - compatibility gate: реальный бинарник должен принять канонический конфиг HY2XS для gecko и salamander до создания пакета; - сборка прогоняет тесты оркестратора и админки. Конфигурационный контракт: - HY2XS_CONFIG_SCHEMA_VERSION=2, чужая схема отклоняется fail-fast; - obfs стал настоящим union gecko|salamander, gecko — default; - obfs-блок рендерится оркестратором целиком, два подтипа одновременно структурно невозможны; - современный baseline: congestion bbr/standard, disableLossCompensation=false, disableStatelessReset=false, полный quic-блок. Исправления: - share URI для gecko: генератор был завязан на Obfs.Salamander.Password и выдавал нерабочую ссылку при любой другой обфускации; - SNI брался только из ACME-блока и уходил пустым при HY2XS_TLS_MODE=file; - экспорт конфига выносил trafficStats.secret, access_token и obfs-пароль; - экспорт терял неизвестные upstream-поля при round-trip через типизированную модель; - renderRuntimeEnv печатал тип обфускации литералом, расходясь с конфигом; - namedotcom удалён из ACME-реестра (нет в Hysteria с 2.11.0). Тесты: - 95 тестов оркестратора: env, рендер, семантика профиля, резолвер, rollover; - тесты URI и экспорта в Go; - tools/test/e2e-hysteria.sh с реальным клиентом Hysteria. UX: - подсказки и примеры в форме создания пира. Прочее: CHANGELOG.md, .gitattributes (LF для target-side файлов), документация на русском.
This commit is contained in:
@@ -30,6 +30,87 @@ run_fix20_acceptance_subset() {
|
||||
log_step "Acceptance: force password change production default"
|
||||
grep -q '^HY2XS_FORCE_PASSWORD_CHANGE=false$' "$package_dir/config/hy2xs.env" || fail "acceptance: HY2XS_FORCE_PASSWORD_CHANGE must default to false"
|
||||
|
||||
log_step "Acceptance: config schema version is declared"
|
||||
grep -q '^HY2XS_CONFIG_SCHEMA_VERSION=2$' "$package_dir/config/hy2xs.env" \
|
||||
|| fail "acceptance: HY2XS_CONFIG_SCHEMA_VERSION must be 2 in the packaged baseline"
|
||||
|
||||
log_step "Acceptance: fresh install defaults to Gecko obfuscation"
|
||||
grep -q '^HY2XS_HYSTERIA_OBFS_TYPE=gecko$' "$package_dir/config/hy2xs.env" \
|
||||
|| fail "acceptance: fresh installations must default to HY2XS_HYSTERIA_OBFS_TYPE=gecko"
|
||||
|
||||
log_step "Acceptance: obfs type is not hardcoded in the Hysteria template"
|
||||
grep -q '{{OBFS_BLOCK}}' "$package_dir/templates/hysteria/config.yaml.tpl" \
|
||||
|| fail "acceptance: hysteria template must render the obfs block from the orchestrator"
|
||||
! grep -Eq '^\s*type:\s*(gecko|salamander)\s*$' "$package_dir/templates/hysteria/config.yaml.tpl" \
|
||||
|| fail "acceptance: hysteria template must not hardcode an obfs type"
|
||||
|
||||
log_step "Acceptance: modern server baseline is present in the template"
|
||||
grep -q 'disableLossCompensation: {{DISABLE_LOSS_COMPENSATION}}' "$package_dir/templates/hysteria/config.yaml.tpl" \
|
||||
|| fail "acceptance: bandwidth.disableLossCompensation missing from hysteria template"
|
||||
grep -q '{{CONGESTION_BLOCK}}' "$package_dir/templates/hysteria/config.yaml.tpl" \
|
||||
|| fail "acceptance: congestion block missing from hysteria template"
|
||||
grep -q '{{QUIC_BLOCK}}' "$package_dir/templates/hysteria/config.yaml.tpl" \
|
||||
|| fail "acceptance: quic block missing from hysteria template"
|
||||
|
||||
log_step "Acceptance: post-install env derives obfs type from resolved context"
|
||||
grep -q '^HY2_OBFS_TYPE={{OBFS_TYPE}}$' "$package_dir/templates/env/post-install.env.tpl" \
|
||||
|| fail "acceptance: post-install env must render the resolved obfs type, not a second set of defaults"
|
||||
! grep -Eq '^HY2_OBFS_TYPE=(gecko|salamander)$' "$package_dir/templates/env/post-install.env.tpl" \
|
||||
|| fail "acceptance: post-install env must not hardcode an obfs type"
|
||||
|
||||
log_step "Acceptance: production defaults are declared in exactly one module"
|
||||
grep -q 'DEFAULT_HYSTERIA_OBFS_TYPE' orchestrator/src/config/profile.ts \
|
||||
|| fail "acceptance: the default obfs type must be declared in orchestrator/src/config/profile.ts"
|
||||
local default_declarations
|
||||
default_declarations="$(grep -rl 'DEFAULT_HYSTERIA_OBFS_TYPE\s*[:=]' orchestrator/src \
|
||||
| grep -v 'orchestrator/src/config/profile.ts' || true)"
|
||||
[ -z "$default_declarations" ] \
|
||||
|| fail "acceptance: the default obfs type must not be re-declared in: $default_declarations"
|
||||
|
||||
log_step "Acceptance: runtime env is derived from config, not literals"
|
||||
! grep -Eq 'HY2XS_HYSTERIA_OBFS_TYPE=(gecko|salamander)' orchestrator/src/config/env.ts \
|
||||
|| fail "acceptance: renderRuntimeEnv must not print a hardcoded obfs type"
|
||||
grep -q 'HY2XS_HYSTERIA_OBFS_TYPE=\${config.hysteriaObfsType}' orchestrator/src/config/env.ts \
|
||||
|| fail "acceptance: renderRuntimeEnv must derive the obfs type from the parsed config"
|
||||
! grep -Eq '\|\|\s*"(gecko|salamander)"' orchestrator/src/config/env.ts \
|
||||
|| fail "acceptance: env.ts must not carry its own obfs fallback default"
|
||||
|
||||
log_step "Acceptance: package metadata records how the Hysteria version was chosen"
|
||||
grep -q '^hysteria_resolution=' "$package_dir/metadata/package.env" \
|
||||
|| fail "acceptance: metadata must record hysteria_resolution"
|
||||
grep -q '^hysteria_resolved_at=' "$package_dir/metadata/package.env" \
|
||||
|| fail "acceptance: metadata must record hysteria_resolved_at"
|
||||
grep -q '^hysteria_compat_gate=true$' "$package_dir/metadata/package.env" \
|
||||
|| fail "acceptance: release packages must be built with the Hysteria compatibility gate enabled"
|
||||
grep -Eq '^hysteria_artifact_url=https://github\.com/HyNetworks/hysteria/' "$package_dir/metadata/package.env" \
|
||||
|| fail "acceptance: Hysteria artifact must come from the canonical HyNetworks upstream"
|
||||
|
||||
log_step "Acceptance: install-time never resolves a moving latest"
|
||||
! grep -rq 'api.github.com' orchestrator/src/commands orchestrator/src/steps \
|
||||
|| fail "acceptance: install-time code must not query the upstream release API"
|
||||
! grep -rq 'download.hysteria.network' orchestrator/src \
|
||||
|| fail "acceptance: install-time code must not use the moving latest download URL"
|
||||
|
||||
log_step "Acceptance: smoke verifies config semantics, not substrings"
|
||||
grep -q 'assertHysteriaConfigMatchesProfile' orchestrator/src/steps/smoke.ts \
|
||||
|| fail "acceptance: smoke must verify the effective config semantically"
|
||||
|
||||
log_step "Acceptance: admin export preserves unknown upstream fields and strips secrets"
|
||||
grep -q 'ExportHysteria2ConfigYaml' apps/controller/config.go \
|
||||
|| fail "acceptance: hysteria config export must go through the sanitizing raw-YAML path"
|
||||
grep -q 'GetRawHysteria2Config' apps/service/hysteria2_export.go \
|
||||
|| fail "acceptance: export must read the raw YAML instead of the typed model"
|
||||
|
||||
log_step "Acceptance: frontend ACME registry matches current upstream"
|
||||
# Ищем именно предлагаемое значение, а не упоминание в комментарии.
|
||||
! grep -q '"namedotcom"' apps/frontend/src/views/hysteria/list/index.vue \
|
||||
|| fail "acceptance: namedotcom was removed upstream in Hysteria 2.11.0 and must not be offered"
|
||||
local provider
|
||||
for provider in cloudflare duckdns gandi godaddy namecheap njalla porkbun vultr; do
|
||||
grep -q "\"${provider}\"" apps/frontend/src/views/hysteria/list/index.vue \
|
||||
|| fail "acceptance: ACME DNS provider ${provider} is missing from the UI registry"
|
||||
done
|
||||
|
||||
log_step "Acceptance: systemd unit production env"
|
||||
grep -q '^Environment=GIN_MODE=release$' "$package_dir/systemd/hy2xs-admin.service" || fail "acceptance: GIN_MODE=release missing"
|
||||
|
||||
|
||||
Reference in New Issue
Block a user