YANG JIANKUAN
5326c572a2
迁入通用节点部署工具、离线交付页生成器和共用技能，隔离真实配置与交付产物。统一 Codex 与 Claude Code 开发约定，补充节点迁移与运维文档。 完善 FINAL、策略组引用、输入校验、Surge 字段编码与 AI DNS 例外保护，增加隔离测试和订阅验证工具。 验证：全量类型检查、44 项单测、前端构建、脚本语法、技能入口与凭据隔离检查均通过。
116 lines
3.8 KiB
Bash
Executable File
116 lines
3.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Hand-written nginx vhosts (no aaPanel):
|
|
# - landing : <DOMAIN_ROOT> -> static page
|
|
# - cover : <SUB_COVER>.<root> -> 6 WS reverse proxies (one per inbound) + benign root
|
|
# - xui panel : <SUB_XUI>.<root> -> 127.0.0.1:<XUI_PORT>
|
|
# - default : unmatched SNI -> return 444
|
|
# All TLS via the standalone wildcard cert; HTTP :80 -> 301 HTTPS.
|
|
. "$(dirname "$0")/_lib.sh"
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
|
|
|
COVER="$SUB_COVER.$DOMAIN_ROOT"
|
|
XUI_HOST="$SUB_XUI.$DOMAIN_ROOT"
|
|
CERTDIR="/etc/nginx/ssl/$DOMAIN_ROOT"
|
|
|
|
# landing page html (shared by landing + cover root so neither looks dead)
|
|
LANDING_HTML="$(sed "s/__NODE_NAME__/$NODE_NAME/g" "$HERE/../templates/landing.html")"
|
|
|
|
# build the 6 WS location blocks
|
|
WS_BLOCKS=""
|
|
add_ws() { # $1=path $2=port $3=name
|
|
WS_BLOCKS+="
|
|
# $3
|
|
location = $1 {
|
|
proxy_pass http://127.0.0.1:$2;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade \\\$http_upgrade;
|
|
proxy_set_header Connection \\\$connection_upgrade;
|
|
proxy_set_header Host \\\$host;
|
|
proxy_set_header X-Real-IP \\\$remote_addr;
|
|
proxy_set_header X-Forwarded-For \\\$proxy_add_x_forwarded_for;
|
|
proxy_read_timeout 300s;
|
|
proxy_send_timeout 300s;
|
|
}"
|
|
}
|
|
add_ws "$WS_PATH_VMESS_DIRECT" "$PORT_VMESS_DIRECT" "vmess-direct"
|
|
add_ws "$WS_PATH_VMESS_WARP" "$PORT_VMESS_WARP" "vmess-warp"
|
|
add_ws "$WS_PATH_TROJAN_DIRECT" "$PORT_TROJAN_DIRECT" "trojan-direct"
|
|
add_ws "$WS_PATH_TROJAN_WARP" "$PORT_TROJAN_WARP" "trojan-warp"
|
|
add_ws "$WS_PATH_SS_DIRECT" "$PORT_SS_DIRECT" "ss-direct"
|
|
add_ws "$WS_PATH_SS_WARP" "$PORT_SS_WARP" "ss-warp"
|
|
|
|
# push landing content to the box
|
|
printf '%s' "$LANDING_HTML" | run "mkdir -p /var/www/$DOMAIN_ROOT /var/www/$COVER && cat > /var/www/$DOMAIN_ROOT/index.html && cp /var/www/$DOMAIN_ROOT/index.html /var/www/$COVER/index.html"
|
|
|
|
# write the vhost config
|
|
run "cat > /etc/nginx/conf.d/edge.conf <<CONF
|
|
map \\\$http_upgrade \\\$connection_upgrade { default upgrade; '' close; }
|
|
|
|
# HTTP -> HTTPS
|
|
server {
|
|
listen 80 default_server;
|
|
listen [::]:80 default_server;
|
|
server_name _;
|
|
return 301 https://\\\$host\\\$request_uri;
|
|
}
|
|
|
|
# default TLS server: unmatched SNI -> drop
|
|
server {
|
|
listen 443 ssl default_server;
|
|
listen [::]:443 ssl default_server;
|
|
server_name _;
|
|
ssl_certificate $CERTDIR/fullchain.pem;
|
|
ssl_certificate_key $CERTDIR/privkey.pem;
|
|
return 444;
|
|
}
|
|
|
|
# landing
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
server_name $DOMAIN_ROOT;
|
|
ssl_certificate $CERTDIR/fullchain.pem;
|
|
ssl_certificate_key $CERTDIR/privkey.pem;
|
|
root /var/www/$DOMAIN_ROOT;
|
|
index index.html;
|
|
location / { try_files \\\$uri \\\$uri/ =404; }
|
|
}
|
|
|
|
# node cover: 6 WS reverse proxies + benign root
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
server_name $COVER;
|
|
ssl_certificate $CERTDIR/fullchain.pem;
|
|
ssl_certificate_key $CERTDIR/privkey.pem;
|
|
root /var/www/$COVER;
|
|
index index.html;
|
|
$WS_BLOCKS
|
|
|
|
location / { try_files \\\$uri \\\$uri/ =404; }
|
|
}
|
|
|
|
# 3x-ui panel
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
server_name $XUI_HOST;
|
|
ssl_certificate $CERTDIR/fullchain.pem;
|
|
ssl_certificate_key $CERTDIR/privkey.pem;
|
|
location / {
|
|
proxy_pass http://127.0.0.1:$XUI_PORT;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade \\\$http_upgrade;
|
|
proxy_set_header Connection \\\$connection_upgrade;
|
|
proxy_set_header Host \\\$host;
|
|
proxy_set_header X-Real-IP \\\$remote_addr;
|
|
proxy_set_header X-Forwarded-For \\\$proxy_add_x_forwarded_for;
|
|
proxy_read_timeout 300s;
|
|
}
|
|
}
|
|
CONF
|
|
|
|
# apt nginx ships a default_server on :80 -> remove so ours wins
|
|
rm -f /etc/nginx/sites-enabled/default
|
|
nginx -t && systemctl reload nginx && echo nginx-reloaded"
|