feat: 合并边缘节点运维并完善 Surge 配置安全

迁入通用节点部署工具、离线交付页生成器和共用技能，隔离真实配置与交付产物。统一 Codex 与 Claude Code 开发约定，补充节点迁移与运维文档。完善 FINAL、策略组引用、输入校验、Surge 字段编码与 AI DNS 例外保护，增加隔离测试和订阅验证工具。验证：全量类型检查、44 项单测、前端构建、脚本语法、技能入口与凭据隔离检查均通过。
2026-10-03 23:19:59 +08:00
parent 7358008936
commit 5326c572a2
93 changed files with 6780 additions and 320 deletions
--- a/.claude/skills/edge-node-multi-protocol/scripts/09-nginx-sites-sg.sh
+++ b/.claude/skills/edge-node-multi-protocol/scripts/09-nginx-sites-sg.sh
@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+# Hand-written nginx vhosts (no aaPanel):
+#   - landing   : <DOMAIN_ROOT>            -> static page
+#   - cover     : <SUB_COVER>.<root>       -> 6 WS reverse proxies (one per inbound) + benign root
+#   - xui panel : <SUB_XUI>.<root>         -> 127.0.0.1:<XUI_PORT>
+#   - default   : unmatched SNI            -> return 444
+# All TLS via the standalone wildcard cert; HTTP :80 -> 301 HTTPS.
+. "$(dirname "$0")/_lib.sh"
+HERE="$(cd "$(dirname "$0")" && pwd)"
+
+COVER="$SUB_COVER.$DOMAIN_ROOT"
+XUI_HOST="$SUB_XUI.$DOMAIN_ROOT"
+CERTDIR="/etc/nginx/ssl/$DOMAIN_ROOT"
+
+# landing page html (shared by landing + cover root so neither looks dead)
+LANDING_HTML="$(sed "s/__NODE_NAME__/$NODE_NAME/g" "$HERE/../templates/landing.html")"
+
+# build the 6 WS location blocks
+WS_BLOCKS=""
+add_ws() { # $1=path $2=port $3=name
+  WS_BLOCKS+="
+    # $3
+    location = $1 {
+        proxy_pass http://127.0.0.1:$2;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \\\$http_upgrade;
+        proxy_set_header Connection \\\$connection_upgrade;
+        proxy_set_header Host \\\$host;
+        proxy_set_header X-Real-IP \\\$remote_addr;
+        proxy_set_header X-Forwarded-For \\\$proxy_add_x_forwarded_for;
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }"
+}
+add_ws "$WS_PATH_VMESS_DIRECT"  "$PORT_VMESS_DIRECT"  "vmess-direct"
+add_ws "$WS_PATH_VMESS_WARP"    "$PORT_VMESS_WARP"    "vmess-warp"
+add_ws "$WS_PATH_TROJAN_DIRECT" "$PORT_TROJAN_DIRECT" "trojan-direct"
+add_ws "$WS_PATH_TROJAN_WARP"   "$PORT_TROJAN_WARP"   "trojan-warp"
+add_ws "$WS_PATH_SS_DIRECT"     "$PORT_SS_DIRECT"     "ss-direct"
+add_ws "$WS_PATH_SS_WARP"       "$PORT_SS_WARP"       "ss-warp"
+
+# push landing content to the box
+printf '%s' "$LANDING_HTML" | run "mkdir -p /var/www/$DOMAIN_ROOT /var/www/$COVER && cat > /var/www/$DOMAIN_ROOT/index.html && cp /var/www/$DOMAIN_ROOT/index.html /var/www/$COVER/index.html"
+
+# write the vhost config
+run "cat > /etc/nginx/conf.d/edge.conf <<CONF
+map \\\$http_upgrade \\\$connection_upgrade { default upgrade; '' close; }
+
+# HTTP -> HTTPS
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+    return 301 https://\\\$host\\\$request_uri;
+}
+
+# default TLS server: unmatched SNI -> drop
+server {
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    server_name _;
+    ssl_certificate $CERTDIR/fullchain.pem;
+    ssl_certificate_key $CERTDIR/privkey.pem;
+    return 444;
+}
+
+# landing
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name $DOMAIN_ROOT;
+    ssl_certificate $CERTDIR/fullchain.pem;
+    ssl_certificate_key $CERTDIR/privkey.pem;
+    root /var/www/$DOMAIN_ROOT;
+    index index.html;
+    location / { try_files \\\$uri \\\$uri/ =404; }
+}
+
+# node cover: 6 WS reverse proxies + benign root
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name $COVER;
+    ssl_certificate $CERTDIR/fullchain.pem;
+    ssl_certificate_key $CERTDIR/privkey.pem;
+    root /var/www/$COVER;
+    index index.html;
+$WS_BLOCKS
+
+    location / { try_files \\\$uri \\\$uri/ =404; }
+}
+
+# 3x-ui panel
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name $XUI_HOST;
+    ssl_certificate $CERTDIR/fullchain.pem;
+    ssl_certificate_key $CERTDIR/privkey.pem;
+    location / {
+        proxy_pass http://127.0.0.1:$XUI_PORT;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \\\$http_upgrade;
+        proxy_set_header Connection \\\$connection_upgrade;
+        proxy_set_header Host \\\$host;
+        proxy_set_header X-Real-IP \\\$remote_addr;
+        proxy_set_header X-Forwarded-For \\\$proxy_add_x_forwarded_for;
+        proxy_read_timeout 300s;
+    }
+}
+CONF
+
+# apt nginx ships a default_server on :80 -> remove so ours wins
+rm -f /etc/nginx/sites-enabled/default
+nginx -t && systemctl reload nginx && echo nginx-reloaded"