231 lines
8.6 KiB
TypeScript
231 lines
8.6 KiB
TypeScript
import { randomBytes } from "node:crypto";
|
|
import type { RuntimeConfig, TlsMode } from "../types/context";
|
|
|
|
type EnvMap = Record<string, string>;
|
|
|
|
function randomSecret(): string {
|
|
return randomBytes(24).toString("base64url");
|
|
}
|
|
|
|
function valueOrGenerate(value: string | undefined): string {
|
|
if (!value || value === "__GENERATE__") {
|
|
return randomSecret();
|
|
}
|
|
return value;
|
|
}
|
|
|
|
function parseEnv(content: string): EnvMap {
|
|
const result: EnvMap = {};
|
|
for (const rawLine of content.split(/\r?\n/)) {
|
|
const line = rawLine.trim();
|
|
if (!line || line.startsWith("#")) {
|
|
continue;
|
|
}
|
|
const separator = line.indexOf("=");
|
|
if (separator < 1) {
|
|
throw new Error(`invalid env line: ${rawLine}`);
|
|
}
|
|
const key = line.slice(0, separator).trim();
|
|
const value = line.slice(separator + 1).trim();
|
|
result[key] = value;
|
|
}
|
|
return result;
|
|
}
|
|
|
|
function parsePort(name: string, raw: string, fallback: number): number {
|
|
const value = raw ? Number(raw) : fallback;
|
|
if (!Number.isInteger(value) || value < 1 || value > 65535) {
|
|
throw new Error(`invalid ${name}: ${raw}`);
|
|
}
|
|
return value;
|
|
}
|
|
|
|
function parseBool(name: string, raw: string, fallback: boolean): boolean {
|
|
if (!raw) {
|
|
return fallback;
|
|
}
|
|
if (raw === "true") {
|
|
return true;
|
|
}
|
|
if (raw === "false") {
|
|
return false;
|
|
}
|
|
throw new Error(`invalid ${name}: ${raw}`);
|
|
}
|
|
|
|
function requireValue(name: string, value: string): string {
|
|
if (!value || !value.trim()) {
|
|
throw new Error(`missing required ${name}`);
|
|
}
|
|
return value.trim();
|
|
}
|
|
|
|
function normalizeIpv4Host(name: string, value: string): string {
|
|
if (value === "0.0.0.0" || value === "127.0.0.1") {
|
|
return value;
|
|
}
|
|
if (/^(25[0-5]|2[0-4]\d|1?\d?\d)(\.(25[0-5]|2[0-4]\d|1?\d?\d)){3}$/.test(value)) {
|
|
return value;
|
|
}
|
|
if (value.includes(":")) {
|
|
throw new Error(`${name} must be IPv4-only`);
|
|
}
|
|
throw new Error(`invalid ${name}: ${value}`);
|
|
}
|
|
|
|
function normalizePublicHost(value: string): string {
|
|
if (!value) {
|
|
throw new Error("missing required HY2XS_PUBLIC_HOST");
|
|
}
|
|
if (value.includes(":")) {
|
|
throw new Error("HY2XS_PUBLIC_HOST must not contain IPv6");
|
|
}
|
|
return value;
|
|
}
|
|
|
|
function normalizeTlsMode(value: string): TlsMode {
|
|
if (value === "acme" || value === "file" || value === "self_signed_dev") {
|
|
return value;
|
|
}
|
|
throw new Error(`invalid HY2XS_TLS_MODE: ${value}`);
|
|
}
|
|
|
|
function normalizeAcmeType(value: string): "http" | "tls" | "dns" {
|
|
if (value === "http" || value === "tls" || value === "dns") {
|
|
return value;
|
|
}
|
|
throw new Error(`invalid HY2XS_ACME_TYPE: ${value}`);
|
|
}
|
|
|
|
export function parseRuntimeEnv(content: string): RuntimeConfig {
|
|
const env = parseEnv(content);
|
|
|
|
const uiPort = parsePort("HY2XS_UI_PORT", env.HY2XS_UI_PORT, 8080);
|
|
const uiBindHost = normalizeIpv4Host("HY2XS_UI_BIND_HOST", env.HY2XS_UI_BIND_HOST || "127.0.0.1");
|
|
const hysteriaPort = parsePort("HY2XS_HYSTERIA_PORT", env.HY2XS_HYSTERIA_PORT, 443);
|
|
const trafficStatsPort = parsePort("HY2XS_HYSTERIA_TRAFFIC_STATS_PORT", env.HY2XS_HYSTERIA_TRAFFIC_STATS_PORT, 36712);
|
|
const tlsMode = normalizeTlsMode(env.HY2XS_TLS_MODE || "acme");
|
|
const acmeType = normalizeAcmeType(env.HY2XS_ACME_TYPE || "http");
|
|
|
|
const config: RuntimeConfig = {
|
|
domain: env.HY2XS_DOMAIN || "",
|
|
publicHost: normalizePublicHost(env.HY2XS_PUBLIC_HOST || env.HY2XS_DOMAIN || ""),
|
|
publicPort: parsePort("HY2XS_PUBLIC_PORT", env.HY2XS_PUBLIC_PORT, hysteriaPort),
|
|
ipv6Enabled: false,
|
|
sshPort: parsePort("HY2XS_SSH_PORT", env.HY2XS_SSH_PORT, 22),
|
|
firewallEnabled: parseBool("HY2XS_FIREWALL_ENABLED", env.HY2XS_FIREWALL_ENABLED, true),
|
|
firewallStagedApply: parseBool("HY2XS_FIREWALL_STAGED_APPLY", env.HY2XS_FIREWALL_STAGED_APPLY, true),
|
|
uiBindHost,
|
|
uiPort,
|
|
adminUser: requireValue("HY2XS_ADMIN_USER", env.HY2XS_ADMIN_USER || "admin"),
|
|
adminInitialPassword: valueOrGenerate(env.HY2XS_ADMIN_INITIAL_PASSWORD),
|
|
forcePasswordChange: parseBool("HY2XS_FORCE_PASSWORD_CHANGE", env.HY2XS_FORCE_PASSWORD_CHANGE, true),
|
|
tlsMode,
|
|
acmeType,
|
|
acmeEmail: env.HY2XS_ACME_EMAIL || "",
|
|
tlsCertPath: env.HY2XS_TLS_CERT_PATH || "/etc/hysteria/server.crt",
|
|
tlsKeyPath: env.HY2XS_TLS_KEY_PATH || "/etc/hysteria/server.key",
|
|
hysteriaBindHost: normalizeIpv4Host("HY2XS_HYSTERIA_BIND_HOST", env.HY2XS_HYSTERIA_BIND_HOST || "0.0.0.0"),
|
|
hysteriaPort,
|
|
hysteriaAuthMode: "http",
|
|
hysteriaAuthUrl: env.HY2XS_HYSTERIA_AUTH_URL || `http://127.0.0.1:${uiPort}/hui/hysteria2/auth`,
|
|
hysteriaTrafficStatsHost: normalizeIpv4Host(
|
|
"HY2XS_HYSTERIA_TRAFFIC_STATS_HOST",
|
|
env.HY2XS_HYSTERIA_TRAFFIC_STATS_HOST || "127.0.0.1"
|
|
),
|
|
hysteriaTrafficStatsPort: trafficStatsPort,
|
|
hysteriaTrafficStatsSecret: valueOrGenerate(env.HY2XS_HYSTERIA_TRAFFIC_STATS_SECRET),
|
|
hysteriaObfsType: "salamander",
|
|
hysteriaObfsPassword: requireValue("HY2XS_HYSTERIA_OBFS_PASSWORD", valueOrGenerate(env.HY2XS_HYSTERIA_OBFS_PASSWORD)),
|
|
hysteriaBandwidthUp: env.HY2XS_HYSTERIA_BANDWIDTH_UP || "50 mbps",
|
|
hysteriaBandwidthDown: env.HY2XS_HYSTERIA_BANDWIDTH_DOWN || "50 mbps",
|
|
hysteriaIgnoreClientBandwidth: parseBool(
|
|
"HY2XS_HYSTERIA_IGNORE_CLIENT_BANDWIDTH",
|
|
env.HY2XS_HYSTERIA_IGNORE_CLIENT_BANDWIDTH,
|
|
false
|
|
),
|
|
hysteriaConfigPath: env.HY2XS_HYSTERIA_CONFIG_PATH || "/etc/hysteria/config.yaml",
|
|
hysteriaVersionPolicy: env.HY2XS_HYSTERIA_VERSION || "latest",
|
|
installDir: env.HY2XS_INSTALL_DIR || "/opt/hy2xs-admin",
|
|
dataDir: env.HY2XS_DATA_DIR || "/var/lib/hy2xs-admin",
|
|
logDir: env.HY2XS_LOG_DIR || "/var/log/hy2xs",
|
|
bootstrapAdminSecretPath: "/etc/hy2xs/bootstrap-admin.secret"
|
|
};
|
|
|
|
validateRuntimeConfig(config);
|
|
return config;
|
|
}
|
|
|
|
export function validateRuntimeConfig(config: RuntimeConfig): void {
|
|
if (config.ipv6Enabled) {
|
|
throw new Error("HY2XS is IPv4-only: HY2XS_IPV6_ENABLED must be false");
|
|
}
|
|
if (config.uiBindHost.includes(":")) {
|
|
throw new Error("HY2XS_UI_BIND_HOST must be IPv4-only");
|
|
}
|
|
if (config.hysteriaBindHost.includes(":")) {
|
|
throw new Error("HY2XS_HYSTERIA_BIND_HOST must be IPv4-only");
|
|
}
|
|
if (config.hysteriaBindHost !== "0.0.0.0") {
|
|
throw new Error("HY2XS_HYSTERIA_BIND_HOST must be 0.0.0.0 in production profile");
|
|
}
|
|
|
|
if (config.tlsMode === "acme") {
|
|
if (!config.domain) {
|
|
throw new Error("HY2XS_DOMAIN is required for TLS mode acme");
|
|
}
|
|
if (!config.acmeEmail) {
|
|
throw new Error("HY2XS_ACME_EMAIL is required for TLS mode acme");
|
|
}
|
|
}
|
|
if (config.tlsMode === "file") {
|
|
requireValue("HY2XS_TLS_CERT_PATH", config.tlsCertPath);
|
|
requireValue("HY2XS_TLS_KEY_PATH", config.tlsKeyPath);
|
|
}
|
|
|
|
if (config.publicHost === "0.0.0.0") {
|
|
throw new Error("HY2XS_PUBLIC_HOST must be a routable domain or IPv4, not 0.0.0.0");
|
|
}
|
|
}
|
|
|
|
export function renderRuntimeEnv(config: RuntimeConfig): string {
|
|
const lines = [
|
|
"# HY2XS runtime config (editable)",
|
|
"HY2XS_IPV6_ENABLED=false",
|
|
`HY2XS_DOMAIN=${config.domain}`,
|
|
`HY2XS_PUBLIC_HOST=${config.publicHost}`,
|
|
`HY2XS_PUBLIC_PORT=${config.publicPort}`,
|
|
`HY2XS_SSH_PORT=${config.sshPort}`,
|
|
`HY2XS_FIREWALL_ENABLED=${config.firewallEnabled}`,
|
|
`HY2XS_FIREWALL_STAGED_APPLY=${config.firewallStagedApply}`,
|
|
`HY2XS_UI_BIND_HOST=${config.uiBindHost}`,
|
|
`HY2XS_UI_PORT=${config.uiPort}`,
|
|
`HY2XS_ADMIN_USER=${config.adminUser}`,
|
|
`HY2XS_ADMIN_INITIAL_PASSWORD=${config.adminInitialPassword}`,
|
|
`HY2XS_FORCE_PASSWORD_CHANGE=${config.forcePasswordChange}`,
|
|
`HY2XS_TLS_MODE=${config.tlsMode}`,
|
|
`HY2XS_ACME_TYPE=${config.acmeType}`,
|
|
`HY2XS_ACME_EMAIL=${config.acmeEmail}`,
|
|
`HY2XS_TLS_CERT_PATH=${config.tlsCertPath}`,
|
|
`HY2XS_TLS_KEY_PATH=${config.tlsKeyPath}`,
|
|
`HY2XS_HYSTERIA_BIND_HOST=${config.hysteriaBindHost}`,
|
|
`HY2XS_HYSTERIA_PORT=${config.hysteriaPort}`,
|
|
"HY2XS_HYSTERIA_AUTH_MODE=http",
|
|
`HY2XS_HYSTERIA_AUTH_URL=${config.hysteriaAuthUrl}`,
|
|
`HY2XS_HYSTERIA_TRAFFIC_STATS_HOST=${config.hysteriaTrafficStatsHost}`,
|
|
`HY2XS_HYSTERIA_TRAFFIC_STATS_PORT=${config.hysteriaTrafficStatsPort}`,
|
|
`HY2XS_HYSTERIA_TRAFFIC_STATS_SECRET=${config.hysteriaTrafficStatsSecret}`,
|
|
"HY2XS_HYSTERIA_OBFS_TYPE=salamander",
|
|
`HY2XS_HYSTERIA_OBFS_PASSWORD=${config.hysteriaObfsPassword}`,
|
|
`HY2XS_HYSTERIA_BANDWIDTH_UP=${config.hysteriaBandwidthUp}`,
|
|
`HY2XS_HYSTERIA_BANDWIDTH_DOWN=${config.hysteriaBandwidthDown}`,
|
|
`HY2XS_HYSTERIA_IGNORE_CLIENT_BANDWIDTH=${config.hysteriaIgnoreClientBandwidth}`,
|
|
`HY2XS_HYSTERIA_CONFIG_PATH=${config.hysteriaConfigPath}`,
|
|
`HY2XS_HYSTERIA_VERSION=${config.hysteriaVersionPolicy}`,
|
|
`HY2XS_INSTALL_DIR=${config.installDir}`,
|
|
`HY2XS_DATA_DIR=${config.dataDir}`,
|
|
`HY2XS_LOG_DIR=${config.logDir}`
|
|
];
|
|
return `${lines.join("\n")}\n`;
|
|
}
|