founder
ddf0ddf71e
Сквозная миграция HY2XS на современную Hysteria (2.12.2) и переход на v1. Build: - версия Hysteria резолвится на этапе сборки из HyNetworks/hysteria и замораживается в metadata пакета (version + immutable url + sha256); - compatibility gate: реальный бинарник должен принять канонический конфиг HY2XS для gecko и salamander до создания пакета; - сборка прогоняет тесты оркестратора и админки. Конфигурационный контракт: - HY2XS_CONFIG_SCHEMA_VERSION=2, чужая схема отклоняется fail-fast; - obfs стал настоящим union gecko|salamander, gecko — default; - obfs-блок рендерится оркестратором целиком, два подтипа одновременно структурно невозможны; - современный baseline: congestion bbr/standard, disableLossCompensation=false, disableStatelessReset=false, полный quic-блок. Исправления: - share URI для gecko: генератор был завязан на Obfs.Salamander.Password и выдавал нерабочую ссылку при любой другой обфускации; - SNI брался только из ACME-блока и уходил пустым при HY2XS_TLS_MODE=file; - экспорт конфига выносил trafficStats.secret, access_token и obfs-пароль; - экспорт терял неизвестные upstream-поля при round-trip через типизированную модель; - renderRuntimeEnv печатал тип обфускации литералом, расходясь с конфигом; - namedotcom удалён из ACME-реестра (нет в Hysteria с 2.11.0). Тесты: - 95 тестов оркестратора: env, рендер, семантика профиля, резолвер, rollover; - тесты URI и экспорта в Go; - tools/test/e2e-hysteria.sh с реальным клиентом Hysteria. UX: - подсказки и примеры в форме создания пира. Прочее: CHANGELOG.md, .gitattributes (LF для target-side файлов), документация на русском.
138 lines
9.4 KiB
Bash
138 lines
9.4 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
run_fix20_acceptance_subset() {
|
|
local package_dir="$1"
|
|
[ -d "$package_dir" ] || fail "acceptance: package dir not found: $package_dir"
|
|
|
|
log_step "Acceptance: package layout sanity"
|
|
[ -x "$package_dir/install.sh" ] || fail "acceptance: install.sh is missing or not executable"
|
|
[ -x "$package_dir/orchestrator/hy2xs-orchestrator" ] || fail "acceptance: orchestrator artifact is missing"
|
|
|
|
log_step "Acceptance: project license is shipped with the package"
|
|
[ -f "$package_dir/LICENSE" ] || fail "acceptance: LICENSE is missing from the package"
|
|
grep -q 'GNU AFFERO GENERAL PUBLIC LICENSE' "$package_dir/LICENSE" \
|
|
|| fail "acceptance: packaged LICENSE must be AGPL-3.0-only"
|
|
grep -q '^license=AGPL-3.0-only$' "$package_dir/metadata/package.env" \
|
|
|| fail "acceptance: package metadata must declare license=AGPL-3.0-only"
|
|
|
|
log_step "Acceptance: orchestrator CLI help path"
|
|
"$package_dir/orchestrator/hy2xs-orchestrator" diagnostics collect --package-dir "$package_dir" >/dev/null 2>&1 || true
|
|
|
|
log_step "Acceptance: firewall mode defaults in config"
|
|
grep -q '^HY2XS_FIREWALL_MODE=' "$package_dir/config/hy2xs.env" || fail "acceptance: HY2XS_FIREWALL_MODE missing in runtime config"
|
|
|
|
log_step "Acceptance: baseline domain/public host/ssh defaults"
|
|
grep -q '^HY2XS_DOMAIN=fi.api.withen.pro$' "$package_dir/config/hy2xs.env" || fail "acceptance: HY2XS_DOMAIN must default to fi.api.withen.pro"
|
|
grep -q '^HY2XS_PUBLIC_HOST=fi.api.withen.pro$' "$package_dir/config/hy2xs.env" || fail "acceptance: HY2XS_PUBLIC_HOST must default to fi.api.withen.pro"
|
|
grep -q '^HY2XS_SSH_PORT=2323$' "$package_dir/config/hy2xs.env" || fail "acceptance: HY2XS_SSH_PORT must default to 2323"
|
|
|
|
log_step "Acceptance: force password change production default"
|
|
grep -q '^HY2XS_FORCE_PASSWORD_CHANGE=false$' "$package_dir/config/hy2xs.env" || fail "acceptance: HY2XS_FORCE_PASSWORD_CHANGE must default to false"
|
|
|
|
log_step "Acceptance: config schema version is declared"
|
|
grep -q '^HY2XS_CONFIG_SCHEMA_VERSION=2$' "$package_dir/config/hy2xs.env" \
|
|
|| fail "acceptance: HY2XS_CONFIG_SCHEMA_VERSION must be 2 in the packaged baseline"
|
|
|
|
log_step "Acceptance: fresh install defaults to Gecko obfuscation"
|
|
grep -q '^HY2XS_HYSTERIA_OBFS_TYPE=gecko$' "$package_dir/config/hy2xs.env" \
|
|
|| fail "acceptance: fresh installations must default to HY2XS_HYSTERIA_OBFS_TYPE=gecko"
|
|
|
|
log_step "Acceptance: obfs type is not hardcoded in the Hysteria template"
|
|
grep -q '{{OBFS_BLOCK}}' "$package_dir/templates/hysteria/config.yaml.tpl" \
|
|
|| fail "acceptance: hysteria template must render the obfs block from the orchestrator"
|
|
! grep -Eq '^\s*type:\s*(gecko|salamander)\s*$' "$package_dir/templates/hysteria/config.yaml.tpl" \
|
|
|| fail "acceptance: hysteria template must not hardcode an obfs type"
|
|
|
|
log_step "Acceptance: modern server baseline is present in the template"
|
|
grep -q 'disableLossCompensation: {{DISABLE_LOSS_COMPENSATION}}' "$package_dir/templates/hysteria/config.yaml.tpl" \
|
|
|| fail "acceptance: bandwidth.disableLossCompensation missing from hysteria template"
|
|
grep -q '{{CONGESTION_BLOCK}}' "$package_dir/templates/hysteria/config.yaml.tpl" \
|
|
|| fail "acceptance: congestion block missing from hysteria template"
|
|
grep -q '{{QUIC_BLOCK}}' "$package_dir/templates/hysteria/config.yaml.tpl" \
|
|
|| fail "acceptance: quic block missing from hysteria template"
|
|
|
|
log_step "Acceptance: post-install env derives obfs type from resolved context"
|
|
grep -q '^HY2_OBFS_TYPE={{OBFS_TYPE}}$' "$package_dir/templates/env/post-install.env.tpl" \
|
|
|| fail "acceptance: post-install env must render the resolved obfs type, not a second set of defaults"
|
|
! grep -Eq '^HY2_OBFS_TYPE=(gecko|salamander)$' "$package_dir/templates/env/post-install.env.tpl" \
|
|
|| fail "acceptance: post-install env must not hardcode an obfs type"
|
|
|
|
log_step "Acceptance: production defaults are declared in exactly one module"
|
|
grep -q 'DEFAULT_HYSTERIA_OBFS_TYPE' orchestrator/src/config/profile.ts \
|
|
|| fail "acceptance: the default obfs type must be declared in orchestrator/src/config/profile.ts"
|
|
local default_declarations
|
|
default_declarations="$(grep -rl 'DEFAULT_HYSTERIA_OBFS_TYPE\s*[:=]' orchestrator/src \
|
|
| grep -v 'orchestrator/src/config/profile.ts' || true)"
|
|
[ -z "$default_declarations" ] \
|
|
|| fail "acceptance: the default obfs type must not be re-declared in: $default_declarations"
|
|
|
|
log_step "Acceptance: runtime env is derived from config, not literals"
|
|
! grep -Eq 'HY2XS_HYSTERIA_OBFS_TYPE=(gecko|salamander)' orchestrator/src/config/env.ts \
|
|
|| fail "acceptance: renderRuntimeEnv must not print a hardcoded obfs type"
|
|
grep -q 'HY2XS_HYSTERIA_OBFS_TYPE=\${config.hysteriaObfsType}' orchestrator/src/config/env.ts \
|
|
|| fail "acceptance: renderRuntimeEnv must derive the obfs type from the parsed config"
|
|
! grep -Eq '\|\|\s*"(gecko|salamander)"' orchestrator/src/config/env.ts \
|
|
|| fail "acceptance: env.ts must not carry its own obfs fallback default"
|
|
|
|
log_step "Acceptance: package metadata records how the Hysteria version was chosen"
|
|
grep -q '^hysteria_resolution=' "$package_dir/metadata/package.env" \
|
|
|| fail "acceptance: metadata must record hysteria_resolution"
|
|
grep -q '^hysteria_resolved_at=' "$package_dir/metadata/package.env" \
|
|
|| fail "acceptance: metadata must record hysteria_resolved_at"
|
|
grep -q '^hysteria_compat_gate=true$' "$package_dir/metadata/package.env" \
|
|
|| fail "acceptance: release packages must be built with the Hysteria compatibility gate enabled"
|
|
grep -Eq '^hysteria_artifact_url=https://github\.com/HyNetworks/hysteria/' "$package_dir/metadata/package.env" \
|
|
|| fail "acceptance: Hysteria artifact must come from the canonical HyNetworks upstream"
|
|
|
|
log_step "Acceptance: install-time never resolves a moving latest"
|
|
! grep -rq 'api.github.com' orchestrator/src/commands orchestrator/src/steps \
|
|
|| fail "acceptance: install-time code must not query the upstream release API"
|
|
! grep -rq 'download.hysteria.network' orchestrator/src \
|
|
|| fail "acceptance: install-time code must not use the moving latest download URL"
|
|
|
|
log_step "Acceptance: smoke verifies config semantics, not substrings"
|
|
grep -q 'assertHysteriaConfigMatchesProfile' orchestrator/src/steps/smoke.ts \
|
|
|| fail "acceptance: smoke must verify the effective config semantically"
|
|
|
|
log_step "Acceptance: admin export preserves unknown upstream fields and strips secrets"
|
|
grep -q 'ExportHysteria2ConfigYaml' apps/controller/config.go \
|
|
|| fail "acceptance: hysteria config export must go through the sanitizing raw-YAML path"
|
|
grep -q 'GetRawHysteria2Config' apps/service/hysteria2_export.go \
|
|
|| fail "acceptance: export must read the raw YAML instead of the typed model"
|
|
|
|
log_step "Acceptance: frontend ACME registry matches current upstream"
|
|
# Ищем именно предлагаемое значение, а не упоминание в комментарии.
|
|
! grep -q '"namedotcom"' apps/frontend/src/views/hysteria/list/index.vue \
|
|
|| fail "acceptance: namedotcom was removed upstream in Hysteria 2.11.0 and must not be offered"
|
|
local provider
|
|
for provider in cloudflare duckdns gandi godaddy namecheap njalla porkbun vultr; do
|
|
grep -q "\"${provider}\"" apps/frontend/src/views/hysteria/list/index.vue \
|
|
|| fail "acceptance: ACME DNS provider ${provider} is missing from the UI registry"
|
|
done
|
|
|
|
log_step "Acceptance: systemd unit production env"
|
|
grep -q '^Environment=GIN_MODE=release$' "$package_dir/systemd/hy2xs-admin.service" || fail "acceptance: GIN_MODE=release missing"
|
|
|
|
log_step "Acceptance: docs matrix markers"
|
|
grep -q 'Fix20 production matrix' docs/11-testing-and-acceptance.md || fail "acceptance: fix20 matrix section missing"
|
|
|
|
log_step "Acceptance: machine auth URL in templates"
|
|
grep -q '/hui/hysteria2/auth?access_token={{HYSTERIA_API_SECRET}}' "$package_dir/templates/hysteria/config.yaml.tpl" || fail "acceptance: machine token missing in hysteria auth URL template"
|
|
grep -q '^HY2_AUTH_URL=http://127.0.0.1:{{UI_PORT}}/hui/hysteria2/auth?access_token={{HYSTERIA_API_SECRET}}$' "$package_dir/templates/env/post-install.env.tpl" || fail "acceptance: machine token missing in post-install HY2_AUTH_URL"
|
|
|
|
log_step "Acceptance: smoke auth checks are tokenized"
|
|
grep -q 'unexpected auth status without machine token' orchestrator/src/steps/smoke.ts || fail "acceptance: missing 403 negative smoke for auth without machine token"
|
|
grep -q 'hysteria2/auth?access_token=\${context.config.hysteriaTrafficStatsSecret}' orchestrator/src/steps/smoke.ts || fail "acceptance: smoke auth URL is not tokenized"
|
|
|
|
log_step "Acceptance: bootstrap peer can pass auth smoke"
|
|
grep -q 'quota := int64(-1)' apps/dao/sqlite.go || fail "acceptance: bootstrap peer quota must be unlimited (-1), otherwise install auth smoke fails"
|
|
|
|
log_step "Acceptance: frontend i18n does not touch Pinia at module import"
|
|
! grep -q 'useAppStore' apps/frontend/src/lang/index.ts || fail "acceptance: lang/index.ts must not import/use Pinia store"
|
|
|
|
log_step "Acceptance: env rendering maps machine token and fails on unresolved placeholders"
|
|
grep -q 'HYSTERIA_API_SECRET: context.config.hysteriaTrafficStatsSecret' orchestrator/src/steps/env.ts || fail "acceptance: writePostInstallEnv must pass HYSTERIA_API_SECRET"
|
|
grep -q 'template render failed: unresolved placeholders' orchestrator/src/lib/fs.ts || fail "acceptance: renderTemplate must fail on unresolved placeholders"
|
|
}
|