YANG JIANKUAN
5326c572a2
迁入通用节点部署工具、离线交付页生成器和共用技能，隔离真实配置与交付产物。统一 Codex 与 Claude Code 开发约定，补充节点迁移与运维文档。 完善 FINAL、策略组引用、输入校验、Surge 字段编码与 AI DNS 例外保护，增加隔离测试和订阅验证工具。 验证：全量类型检查、44 项单测、前端构建、脚本语法、技能入口与凭据隔离检查均通过。
62 lines
3.1 KiB
Bash
Executable File
62 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# No-aaPanel preflight for the SG node: verify SSH, add swap (low-RAM box),
|
|
# set timezone, install nginx + acme deps directly from apt, authorize your key.
|
|
. "$(dirname "$0")/_lib.sh"
|
|
|
|
echo "== SSH + specs =="
|
|
run 'hostname; . /etc/os-release; echo "$PRETTY_NAME"; nproc; free -m | awk "/Mem/{print \$2\"MB\"}"; df -h / | tail -1'
|
|
|
|
echo "== swap (2G, low-RAM box needs it for installs) =="
|
|
run 'if ! swapon --show | grep -q /swapfile; then
|
|
fallocate -l 2G /swapfile || dd if=/dev/zero of=/swapfile bs=1M count=2048
|
|
chmod 600 /swapfile; mkswap /swapfile >/dev/null; swapon /swapfile
|
|
grep -q "/swapfile" /etc/fstab || echo "/swapfile none swap sw 0 0" >> /etc/fstab
|
|
sysctl -w vm.swappiness=10 >/dev/null
|
|
grep -q "vm.swappiness" /etc/sysctl.conf || echo "vm.swappiness=10" >> /etc/sysctl.conf
|
|
fi
|
|
free -h | awk "/Swap/{print \"swap: \"\$2}"'
|
|
|
|
echo "== timezone (${TZ:-UTC}) + base packages (nginx, acme deps) =="
|
|
run "timedatectl set-timezone '${TZ:-UTC}' 2>/dev/null || true
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
# Freshly-booted cloud images run unattended-upgrades, which holds the dpkg lock
|
|
# for minutes; without this wait apt fails while the script reports success.
|
|
for i in \$(seq 1 60); do
|
|
fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1 || break
|
|
[ \$i = 1 ] && echo 'waiting for dpkg lock (unattended-upgrades)...'
|
|
sleep 10
|
|
done
|
|
apt-get update -qq
|
|
apt-get install -y -qq curl wget gnupg ufw ca-certificates socat cron nginx >/dev/null || { echo 'ERROR: apt install failed'; exit 1; }
|
|
command -v nginx >/dev/null || { echo 'ERROR: nginx missing after install'; exit 1; }
|
|
systemctl enable --now nginx >/dev/null 2>&1 || true
|
|
nginx -v 2>&1
|
|
echo base-packages-ok"
|
|
|
|
# BBR + fq. Stock cloud images generally do NOT have it: this AWS Ubuntu 24.04 AMI
|
|
# came up on cubic + fq_codel with tcp_bbr not even loaded, while the DMIT box ships
|
|
# BBR pre-enabled in its VM template. Lifts every TCP inbound at once, no client change.
|
|
echo "== kernel tuning: BBR congestion control =="
|
|
run 'modprobe tcp_bbr 2>/dev/null || true
|
|
echo tcp_bbr > /etc/modules-load.d/tcp_bbr.conf
|
|
cat > /etc/sysctl.d/99-edge-node-bbr.conf <<CONF
|
|
net.core.default_qdisc = fq
|
|
net.ipv4.tcp_congestion_control = bbr
|
|
CONF
|
|
sysctl --system >/dev/null 2>&1
|
|
CC=$(sysctl -n net.ipv4.tcp_congestion_control)
|
|
QD=$(sysctl -n net.core.default_qdisc)
|
|
echo "congestion=$CC qdisc=$QD"
|
|
[ "$CC" = bbr ] || echo "WARN: BBR not active — kernel may lack tcp_bbr (available: $(sysctl -n net.ipv4.tcp_available_congestion_control))"'
|
|
|
|
# Authorize YOUR public key for passwordless login.
|
|
MYPUB="$(cat "$HOME/.ssh/id_ed25519.pub" 2>/dev/null || cat "$HOME/.ssh/id_rsa.pub" 2>/dev/null || true)"
|
|
if [ -n "$MYPUB" ]; then
|
|
run "mkdir -p ~/.ssh && chmod 700 ~/.ssh
|
|
grep -qF '$MYPUB' ~/.ssh/authorized_keys 2>/dev/null || echo '$MYPUB' >> ~/.ssh/authorized_keys
|
|
chmod 600 ~/.ssh/authorized_keys; echo authorized-key-added"
|
|
else
|
|
echo "WARN: no local public key found; add yours to the box manually"
|
|
fi
|
|
echo "preflight done"
|