535 lines
22 KiB
Bash
535 lines
22 KiB
Bash
|
#!/usr/bin/env bash
|
|||
|
|
# 双链路代理一键安装（交互确认 / 可用 --yes 全默认）
|
|||
|
|
#
|
|||
|
|
# 一台空机器跑完即得：3x-ui 面板 + 两条 VLESS+WS 入站 + nginx 反代 + Let's Encrypt 证书
|
|||
|
|
# 支持：Ubuntu/Debian 系 VPS，nginx 是宝塔/aaPanel 或系统自带均可
|
|||
|
|
#
|
|||
|
|
# 用法：
|
|||
|
|
# ./install-dual-link.sh # 交互确认
|
|||
|
|
# ./install-dual-link.sh --dry-run # 只打印将执行的动作，不改任何东西
|
|||
|
|
# ./install-dual-link.sh --yes --domain-a a.example.com --domain-b b.example.com
|
|||
|
|
# ./install-dual-link.sh --yes --domain-a a.x.com --domain-b b.x.com --panel-domain p.x.com
|
|||
|
|
#
|
|||
|
|
# 约定：本脚本只接 nginx 转发这一种架构（Reality 与 nginx 转发互斥）。
|
|||
|
|
|
|||
|
|
set -uo pipefail
|
|||
|
|
|
|||
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|||
|
|
API_PY="${HERE}/3xui-api.py"
|
|||
|
|
|
|||
|
|
# ─── 参数默认值 ────────────────────────────────────────────────────────────
|
|||
|
|
DOMAIN_A="" # 橙云链路（走 Cloudflare 代理）
|
|||
|
|
DOMAIN_B="" # 灰云链路（A 记录直连回源）
|
|||
|
|
PATH_A="/linkA" # 链路 A 的 WebSocket 路径
|
|||
|
|
PATH_B="/linkB"
|
|||
|
|
REMARK_A="linkA" # 入站备注名（也是客户端里链路的名字）
|
|||
|
|
REMARK_B="linkB"
|
|||
|
|
PORT_A=15004 # 后端入站端口（只绑 127.0.0.1）
|
|||
|
|
PORT_B=15005
|
|||
|
|
PANEL_PORT=2053 # 3x-ui 面板端口（只绑 127.0.0.1）
|
|||
|
|
PANEL_DOMAIN="" # 可选：给面板一个子域，nginx 反代 + 一层 Basic Auth
|
|||
|
|
PANEL_PASSWORD="" # 留空则随机生成；机器上已有 3x-ui 时必须显式给
|
|||
|
|
OWNER_EMAIL="owner" # 首个账号标识
|
|||
|
|
ACME_EMAIL="" # Let's Encrypt 注册邮箱，留空则用 admin@<域名A>
|
|||
|
|
|
|||
|
|
DRY=0
|
|||
|
|
ASSUME=0
|
|||
|
|
|
|||
|
|
# ─── 输出工具 ──────────────────────────────────────────────────────────────
|
|||
|
|
c_ok="\033[32m"; c_warn="\033[33m"; c_err="\033[31m"; c_dim="\033[2m"; c_end="\033[0m"
|
|||
|
|
say() { printf "%b\n" "$*"; }
|
|||
|
|
ok() { printf "${c_ok} ✓${c_end} %s\n" "$*"; }
|
|||
|
|
warn() { printf "${c_warn} !${c_end} %s\n" "$*"; }
|
|||
|
|
die() { printf "${c_err} ✗ %s${c_end}\n" "$*" >&2; exit 1; }
|
|||
|
|
dim() { printf "${c_dim}%s${c_end}\n" "$*"; }
|
|||
|
|
hr() { printf "${c_dim}%s${c_end}\n" "────────────────────────────────────────────────────"; }
|
|||
|
|
|
|||
|
|
run_sh() {
|
|||
|
|
if [ "$DRY" = 1 ]; then printf "${c_dim} [dry-run] %s${c_end}\n" "$1"; return 0; fi
|
|||
|
|
bash -c "$1"
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
ask() { # ask 变量名 "提示" 默认值
|
|||
|
|
local __var="$1" __prompt="$2" __def="${3:-}" __ans=""
|
|||
|
|
if [ -n "$__def" ]; then __prompt="$__prompt [$__def]"; fi
|
|||
|
|
if [ "$ASSUME" = 1 ] || [ ! -t 0 ]; then
|
|||
|
|
printf -v "$__var" '%s' "$__def"; return 0
|
|||
|
|
fi
|
|||
|
|
read -r -p " ${__prompt}: " __ans || true
|
|||
|
|
[ -z "$__ans" ] && __ans="$__def"
|
|||
|
|
printf -v "$__var" '%s' "$__ans"
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
usage() { sed -n '2,15p' "$0"; exit 0; }
|
|||
|
|
|
|||
|
|
# ─── 环境探测 ──────────────────────────────────────────────────────────────
|
|||
|
|
NGINX_BIN=""; VHOST_DIR=""; CERT_DIR=""; WEBROOT_BASE=""; WEB_USER=""; LOG_DIR=""
|
|||
|
|
|
|||
|
|
detect_env() {
|
|||
|
|
if [ -x /www/server/nginx/sbin/nginx ]; then
|
|||
|
|
NGINX_BIN=/www/server/nginx/sbin/nginx
|
|||
|
|
VHOST_DIR=/www/server/panel/vhost/nginx
|
|||
|
|
CERT_DIR=/www/server/panel/vhost/cert
|
|||
|
|
WEBROOT_BASE=/www/wwwroot
|
|||
|
|
LOG_DIR=/www/wwwlogs
|
|||
|
|
WEB_USER="www"
|
|||
|
|
ok "检测到宝塔/aaPanel 的 nginx（${NGINX_BIN}）"
|
|||
|
|
else
|
|||
|
|
NGINX_BIN="$(command -v nginx || true)"
|
|||
|
|
[ -z "$NGINX_BIN" ] && die "没找到 nginx，请先安装 nginx"
|
|||
|
|
VHOST_DIR=/etc/nginx/conf.d
|
|||
|
|
CERT_DIR=/etc/nginx/certs
|
|||
|
|
WEBROOT_BASE=/var/www
|
|||
|
|
LOG_DIR=/var/log/nginx
|
|||
|
|
WEB_USER="www-data"
|
|||
|
|
ok "检测到系统 nginx（${NGINX_BIN}）"
|
|||
|
|
fi
|
|||
|
|
id -u "$WEB_USER" >/dev/null 2>&1 || die "nginx 的运行用户 ${WEB_USER} 不存在"
|
|||
|
|
if [ "$DRY" = 1 ]; then dim " [dry-run] mkdir -p ${VHOST_DIR} ${CERT_DIR} ${WEBROOT_BASE} ${LOG_DIR}"
|
|||
|
|
else mkdir -p "$VHOST_DIR" "$CERT_DIR" "$WEBROOT_BASE" "$LOG_DIR"; fi
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
port_in_use() { # 只看该端口有没有 LISTEN；用 ss 自带的端口过滤器，避免列对齐导致的误判
|
|||
|
|
local out
|
|||
|
|
out="$(ss -tlnH "sport = :$1" 2>/dev/null)"
|
|||
|
|
[ -n "$out" ]
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
need_free() { # 需要是空的：新后端/面板端口
|
|||
|
|
if port_in_use "$1"; then die "端口 $1 已被占用（ss -tln | grep :$1），换一个再跑"; fi
|
|||
|
|
ok "端口 $1 空闲"
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
need_nginx() { # 需要被 nginx 占着：80 / 443
|
|||
|
|
if port_in_use "$1"; then ok "端口 $1 由 nginx 监听（预期）"
|
|||
|
|
else warn "端口 $1 没有监听——nginx 没起来？证书签发会失败"; fi
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
my_ip() { curl -s --max-time 8 https://api.ipify.org 2>/dev/null || echo ""; }
|
|||
|
|
|
|||
|
|
backup_file() {
|
|||
|
|
[ -f "$1" ] || return 0
|
|||
|
|
local b="$1.bak-$(date +%Y%m%d-%H%M%S)"
|
|||
|
|
if [ "$DRY" = 1 ]; then dim " [dry-run] cp -a $1 $b"; return 0; fi
|
|||
|
|
cp -a "$1" "$b" && warn "原配置已备份 → $b"
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
nginx_apply() {
|
|||
|
|
if [ "$DRY" = 1 ]; then dim " [dry-run] ${NGINX_BIN} -t && ${NGINX_BIN} -s reload"; return 0; fi
|
|||
|
|
${NGINX_BIN} -t >/tmp/nginx-t.log 2>&1 || { tail -5 /tmp/nginx-t.log; die "nginx 配置检查未通过"; }
|
|||
|
|
${NGINX_BIN} -s reload >/dev/null 2>&1 || die "nginx reload 失败"
|
|||
|
|
ok "nginx 已重载"
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# ─── 步骤 1：前置检查 ──────────────────────────────────────────────────────
|
|||
|
|
step_preflight() {
|
|||
|
|
say ""
|
|||
|
|
say "[1/6] 前置检查"
|
|||
|
|
[ "$(id -u)" = 0 ] || die "需要 root 权限执行"
|
|||
|
|
detect_env
|
|||
|
|
|
|||
|
|
command -v python3 >/dev/null 2>&1 || die "需要 python3（调面板接口靠它）"
|
|||
|
|
[ -f "$API_PY" ] || die "找不到 ${API_PY}，请与 3xui-api.py 放在同一目录"
|
|||
|
|
|
|||
|
|
local pubip; pubip="$(my_ip)"
|
|||
|
|
if [ -n "$pubip" ]; then ok "本机公网出口 IP：${pubip}"; else warn "取不到公网 IP，DNS 校验跳过"; fi
|
|||
|
|
|
|||
|
|
local d resolved
|
|||
|
|
for d in "$DOMAIN_A" "$DOMAIN_B" $PANEL_DOMAIN; do
|
|||
|
|
[ -z "$d" ] && continue
|
|||
|
|
resolved="$(getent hosts "$d" | awk '{print $1}' | head -1)"
|
|||
|
|
if [ -z "$resolved" ]; then
|
|||
|
|
warn "${d} 解析不到 —— 先加 DNS 记录再跑，否则证书签发必然失败"
|
|||
|
|
elif [ -n "$pubip" ] && [ "$resolved" != "$pubip" ]; then
|
|||
|
|
warn "${d} → ${resolved}（与出口 IP 不同：走 CDN 属正常，直连链路必须指向本机）"
|
|||
|
|
else
|
|||
|
|
ok "${d} → ${resolved}"
|
|||
|
|
fi
|
|||
|
|
done
|
|||
|
|
|
|||
|
|
need_nginx 80
|
|||
|
|
need_nginx 443
|
|||
|
|
need_free "$PORT_A"
|
|||
|
|
need_free "$PORT_B"
|
|||
|
|
if [ -x /usr/local/x-ui/x-ui ] && port_in_use "$PANEL_PORT"; then
|
|||
|
|
warn "面板端口 ${PANEL_PORT} 已被现有 3x-ui 占用 —— 走复用安装（需 --panel-password）"
|
|||
|
|
else
|
|||
|
|
need_free "$PANEL_PORT"
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
[ -f /root/.acme.sh/acme.sh ] || warn "acme.sh 未安装，第 4 步会自动装"
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# ─── 步骤 2：装后端 3x-ui ──────────────────────────────────────────────────
|
|||
|
|
step_backend() {
|
|||
|
|
say ""
|
|||
|
|
say "[2/6] 安装后端 3x-ui（面板本体）"
|
|||
|
|
|
|||
|
|
if [ -x /usr/local/x-ui/x-ui ]; then
|
|||
|
|
[ -z "$PANEL_PASSWORD" ] && die "本机已有 3x-ui。为免覆盖现有账号，请显式给出现有面板密码：
|
|||
|
|
./install-dual-link.sh --panel-password '<现有密码>' ..."
|
|||
|
|
warn "复用已存在的 /usr/local/x-ui（不重新下载）"
|
|||
|
|
else
|
|||
|
|
local ver
|
|||
|
|
ver="$(curl -sI --max-time 20 https://github.com/MHSanaei/3x-ui/releases/latest 2>/dev/null \
|
|||
|
|
| grep -i '^location:' | sed 's#.*/tag/##' | tr -d '\r')"
|
|||
|
|
[ -z "$ver" ] && die "取不到 3x-ui 最新版本号（检查出网）"
|
|||
|
|
ok "最新版本 ${ver}"
|
|||
|
|
run_sh "cd /tmp && rm -rf x-ui xui.tar.gz && \
|
|||
|
|
curl -fsSL -o xui.tar.gz https://github.com/MHSanaei/3x-ui/releases/download/${ver}/x-ui-linux-amd64.tar.gz && \
|
|||
|
|
tar xzf xui.tar.gz && rm -rf /usr/local/x-ui && mv /tmp/x-ui /usr/local/x-ui && \
|
|||
|
|
chmod +x /usr/local/x-ui/x-ui /usr/local/x-ui/bin/xray-linux-amd64"
|
|||
|
|
run_sh "cp /usr/local/x-ui/x-ui.service.debian /etc/systemd/system/x-ui.service"
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
if [ -z "$PANEL_PASSWORD" ]; then
|
|||
|
|
PANEL_PASSWORD="$(head -c 18 /dev/urandom | base64 | tr -dc 'A-Za-z0-9' | head -c 16)"
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
# 面板只绑本地：要么经 nginx 子域进来，要么 SSH 隧道进来
|
|||
|
|
run_sh "/usr/local/x-ui/x-ui setting -port ${PANEL_PORT} -username admin \
|
|||
|
|
-password '${PANEL_PASSWORD}' -listenIP 127.0.0.1"
|
|||
|
|
run_sh "systemctl daemon-reload && systemctl enable x-ui >/dev/null 2>&1 && systemctl restart x-ui"
|
|||
|
|
|
|||
|
|
if [ "$DRY" = 0 ]; then
|
|||
|
|
local i
|
|||
|
|
for i in 1 2 3 4 5 6 7 8 9 10; do
|
|||
|
|
port_in_use "$PANEL_PORT" && break
|
|||
|
|
sleep 1
|
|||
|
|
done
|
|||
|
|
port_in_use "$PANEL_PORT" || die "面板没起来，看 journalctl -u x-ui -n 40"
|
|||
|
|
ok "面板已在 127.0.0.1:${PANEL_PORT} 监听"
|
|||
|
|
fi
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# ─── 步骤 3：建两条入站 ────────────────────────────────────────────────────
|
|||
|
|
api() { python3 "$API_PY" --base "http://127.0.0.1:${PANEL_PORT}" --password "$PANEL_PASSWORD" "$@"; }
|
|||
|
|
|
|||
|
|
step_inbounds() {
|
|||
|
|
say ""
|
|||
|
|
say "[3/6] 创建两条 VLESS+WS 入站（各绑 127.0.0.1）"
|
|||
|
|
run_sh "python3 '${API_PY}' --base 'http://127.0.0.1:${PANEL_PORT}' --password '${PANEL_PASSWORD}' \
|
|||
|
|
add --remark ${REMARK_A} --port ${PORT_A} --path '${PATH_A}' --email '${OWNER_EMAIL}'"
|
|||
|
|
run_sh "python3 '${API_PY}' --base 'http://127.0.0.1:${PANEL_PORT}' --password '${PANEL_PASSWORD}' \
|
|||
|
|
add --remark ${REMARK_B} --port ${PORT_B} --path '${PATH_B}' --email '${OWNER_EMAIL}'"
|
|||
|
|
ok "${REMARK_A} → 127.0.0.1:${PORT_A}${PATH_A} ${REMARK_B} → 127.0.0.1:${PORT_B}${PATH_B}"
|
|||
|
|
|
|||
|
|
if [ "$DRY" = 0 ]; then
|
|||
|
|
api list | sed 's/^/ /'
|
|||
|
|
fi
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# ─── 步骤 4/5：nginx + 证书 ────────────────────────────────────────────────
|
|||
|
|
# write_http_vhost 域名 [路径] [端口] —— 有路径就给 WS，没路径就只做 ACME + 跳转
|
|||
|
|
write_http_vhost() {
|
|||
|
|
local domain="$1" path="${2:-}" port="${3:-}"
|
|||
|
|
local root="${WEBROOT_BASE}/${domain}" f="${VHOST_DIR}/${domain}.conf"
|
|||
|
|
local ws=""
|
|||
|
|
if [ -n "$path" ]; then
|
|||
|
|
ws=$(cat <<WS
|
|||
|
|
location ${path} {
|
|||
|
|
if (\$http_upgrade = "") { return 404; }
|
|||
|
|
proxy_http_version 1.1;
|
|||
|
|
proxy_set_header Upgrade \$http_upgrade;
|
|||
|
|
proxy_set_header Connection "upgrade";
|
|||
|
|
proxy_set_header Host \$http_host;
|
|||
|
|
proxy_set_header X-Real-IP \$remote_addr;
|
|||
|
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
|||
|
|
proxy_read_timeout 3600s;
|
|||
|
|
proxy_send_timeout 3600s;
|
|||
|
|
proxy_pass http://127.0.0.1:${port};
|
|||
|
|
}
|
|||
|
|
WS
|
|||
|
|
)
|
|||
|
|
fi
|
|||
|
|
[ -n "$path" ] && [ "$DRY" = 1 ] && dim " [dry-run] 写入 ${f}（含 ${path} → 127.0.0.1:${port} 的 WS 反代）" && return 0
|
|||
|
|
[ -z "$path" ] && [ "$DRY" = 1 ] && dim " [dry-run] 写入 ${f}（仅 ACME 验证目录 + 跳 443）" && return 0
|
|||
|
|
[ "$DRY" = 1 ] || mkdir -p "$root"
|
|||
|
|
backup_file "$f"
|
|||
|
|
cat > "$f" <<CONF
|
|||
|
|
server
|
|||
|
|
{
|
|||
|
|
listen 80;
|
|||
|
|
server_name ${domain};
|
|||
|
|
root ${root};
|
|||
|
|
access_log ${LOG_DIR}/${domain}.log;
|
|||
|
|
error_log ${LOG_DIR}/${domain}.error.log;
|
|||
|
|
|
|||
|
|
location ^~ /.well-known/acme-challenge/ {
|
|||
|
|
default_type text/plain;
|
|||
|
|
root ${root};
|
|||
|
|
}
|
|||
|
|
${ws}
|
|||
|
|
location / { return 301 https://\$host\$request_uri; }
|
|||
|
|
}
|
|||
|
|
CONF
|
|||
|
|
say " 写入 ${f}"
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# write_https_vhost 域名 [路径] [端口] [basic-auth 文件]
|
|||
|
|
write_https_vhost() {
|
|||
|
|
local domain="$1" path="${2:-}" port="${3:-}" authfile="${4:-}"
|
|||
|
|
local root="${WEBROOT_BASE}/${domain}" cert="${CERT_DIR}/${domain}" f="${VHOST_DIR}/${domain}.conf"
|
|||
|
|
local block=""
|
|||
|
|
if [ -n "$path" ]; then
|
|||
|
|
block=$(cat <<BK
|
|||
|
|
location ${path} {
|
|||
|
|
if (\$http_upgrade = "") { return 404; }
|
|||
|
|
proxy_http_version 1.1;
|
|||
|
|
proxy_set_header Upgrade \$http_upgrade;
|
|||
|
|
proxy_set_header Connection "upgrade";
|
|||
|
|
proxy_set_header Host \$http_host;
|
|||
|
|
proxy_set_header X-Real-IP \$remote_addr;
|
|||
|
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
|||
|
|
proxy_read_timeout 3600s;
|
|||
|
|
proxy_send_timeout 3600s;
|
|||
|
|
proxy_pass http://127.0.0.1:${port};
|
|||
|
|
}
|
|||
|
|
location / { try_files \$uri \$uri/ =404; }
|
|||
|
|
BK
|
|||
|
|
)
|
|||
|
|
else
|
|||
|
|
block=$(cat <<BK
|
|||
|
|
location / {
|
|||
|
|
auth_basic "panel";
|
|||
|
|
auth_basic_user_file ${authfile};
|
|||
|
|
proxy_http_version 1.1;
|
|||
|
|
proxy_set_header Upgrade \$http_upgrade;
|
|||
|
|
proxy_set_header Connection \$http_connection;
|
|||
|
|
proxy_set_header Host \$host;
|
|||
|
|
proxy_set_header X-Real-IP \$remote_addr;
|
|||
|
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
|||
|
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
|||
|
|
proxy_read_timeout 600s;
|
|||
|
|
proxy_pass http://127.0.0.1:${PANEL_PORT};
|
|||
|
|
}
|
|||
|
|
BK
|
|||
|
|
)
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
if [ "$DRY" = 1 ]; then
|
|||
|
|
if [ -n "$path" ]; then
|
|||
|
|
dim " [dry-run] 写入 ${f}（443 + ${path} → 127.0.0.1:${port}，证书 ${cert}）"
|
|||
|
|
else
|
|||
|
|
dim " [dry-run] 写入 ${f}（443 + 面板反代 → 127.0.0.1:${PANEL_PORT}，Basic Auth ${authfile}）"
|
|||
|
|
fi
|
|||
|
|
return 0
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
backup_file "$f"
|
|||
|
|
cat > "$f" <<CONF
|
|||
|
|
server
|
|||
|
|
{
|
|||
|
|
listen 80;
|
|||
|
|
server_name ${domain};
|
|||
|
|
root ${root};
|
|||
|
|
location ^~ /.well-known/acme-challenge/ { default_type text/plain; root ${root}; }
|
|||
|
|
location / { return 301 https://\$host\$request_uri; }
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
server
|
|||
|
|
{
|
|||
|
|
listen 443 ssl http2;
|
|||
|
|
server_name ${domain};
|
|||
|
|
root ${root};
|
|||
|
|
access_log ${LOG_DIR}/${domain}.log;
|
|||
|
|
error_log ${LOG_DIR}/${domain}.error.log;
|
|||
|
|
|
|||
|
|
ssl_certificate ${cert}/fullchain.pem;
|
|||
|
|
ssl_certificate_key ${cert}/privkey.pem;
|
|||
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|||
|
|
ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256;
|
|||
|
|
ssl_prefer_server_ciphers on;
|
|||
|
|
ssl_session_cache shared:SSL_${domain//[.-]/_}:10m;
|
|||
|
|
ssl_session_timeout 1d;
|
|||
|
|
|
|||
|
|
location ^~ /.well-known/acme-challenge/ { default_type text/plain; root ${root}; }
|
|||
|
|
|
|||
|
|
${block}
|
|||
|
|
}
|
|||
|
|
CONF
|
|||
|
|
say " 写入 ${f}"
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
step_nginx_http() {
|
|||
|
|
say ""
|
|||
|
|
say "[4/6] 建 80 端 vhost 并签发证书"
|
|||
|
|
write_http_vhost "$DOMAIN_A" "$PATH_A" "$PORT_A"
|
|||
|
|
write_http_vhost "$DOMAIN_B" "$PATH_B" "$PORT_B"
|
|||
|
|
if [ -n "$PANEL_DOMAIN" ]; then write_http_vhost "$PANEL_DOMAIN"; fi
|
|||
|
|
nginx_apply
|
|||
|
|
ok "80 已生效（ACME 验证目录就绪）"
|
|||
|
|
|
|||
|
|
if [ "$DRY" = 0 ] && [ ! -f /root/.acme.sh/acme.sh ]; then
|
|||
|
|
run_sh "curl -fsSL https://get.acme.sh | sh -s email=${ACME_EMAIL:-admin@${DOMAIN_A}} >/dev/null 2>&1"
|
|||
|
|
run_sh "/root/.acme.sh/acme.sh --set-default-ca --server letsencrypt >/dev/null 2>&1"
|
|||
|
|
ok "acme.sh 已安装"
|
|||
|
|
fi
|
|||
|
|
[ "$DRY" = 1 ] && dim " [dry-run] acme.sh --issue -w ${WEBROOT_BASE}/<域名> -d <域名> --keylength ec-256"
|
|||
|
|
|
|||
|
|
local d
|
|||
|
|
for d in "$DOMAIN_A" "$DOMAIN_B" $PANEL_DOMAIN; do
|
|||
|
|
[ -z "$d" ] && continue
|
|||
|
|
run_sh "/root/.acme.sh/acme.sh --issue -d ${d} -w ${WEBROOT_BASE}/${d} --keylength ec-256 >/tmp/acme-${d}.log 2>&1"
|
|||
|
|
if [ "$DRY" = 0 ] && [ ! -f "/root/.acme.sh/${d}_ecc/${d}.cer" ]; then
|
|||
|
|
tail -6 "/tmp/acme-${d}.log"; die "${d} 证书签发失败（80 端口要能回源到本机 80）"
|
|||
|
|
fi
|
|||
|
|
run_sh "/root/.acme.sh/acme.sh --install-cert -d ${d} --ecc \
|
|||
|
|
--key-file ${CERT_DIR}/${d}/privkey.pem \
|
|||
|
|
--fullchain-file ${CERT_DIR}/${d}/fullchain.pem \
|
|||
|
|
--reloadcmd '${NGINX_BIN} -s reload' >/dev/null 2>&1"
|
|||
|
|
ok "${d} 证书就绪 → ${CERT_DIR}/${d}"
|
|||
|
|
done
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
step_nginx_https() {
|
|||
|
|
say ""
|
|||
|
|
say "[5/6] 切到 443"
|
|||
|
|
write_https_vhost "$DOMAIN_A" "$PATH_A" "$PORT_A"
|
|||
|
|
write_https_vhost "$DOMAIN_B" "$PATH_B" "$PORT_B"
|
|||
|
|
|
|||
|
|
if [ -n "$PANEL_DOMAIN" ]; then
|
|||
|
|
local root="${WEBROOT_BASE}/${PANEL_DOMAIN}" passfile
|
|||
|
|
passfile="${root}/.panel-pass"
|
|||
|
|
local bpw; bpw="$(head -c 12 /dev/urandom | base64 | tr -dc 'A-Za-z0-9' | head -c 10)"
|
|||
|
|
if [ "$DRY" = 1 ]; then
|
|||
|
|
dim " [dry-run] printf 'ops:%s\\n' \"\$(openssl passwd -apr1 '******')\" > ${passfile}"
|
|||
|
|
else
|
|||
|
|
mkdir -p "$root"
|
|||
|
|
printf 'ops:%s\n' "$(openssl passwd -apr1 "$bpw")" > "$passfile"
|
|||
|
|
chown "$WEB_USER":"$WEB_USER" "$passfile"
|
|||
|
|
chmod 640 "$passfile"
|
|||
|
|
fi
|
|||
|
|
PANEL_BASIC_USER="ops"; PANEL_BASIC_PASS="$bpw"
|
|||
|
|
write_https_vhost "$PANEL_DOMAIN" "" "" "$passfile"
|
|||
|
|
ok "面板子域 ${PANEL_DOMAIN} 已配好（Basic Auth 用户 ops / ${bpw}）"
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
nginx_apply
|
|||
|
|
ok "443 已生效"
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# ─── 步骤 6：验收 ──────────────────────────────────────────────────────────
|
|||
|
|
code_of() { # code_of URL [额外 curl 参数...]
|
|||
|
|
local url="$1"; shift
|
|||
|
|
curl -s -i --http1.1 --max-time 20 "$@" "$url" 2>/dev/null | grep -oE 'HTTP/1.1 [0-9]{3}' | head -1
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
step_verify() {
|
|||
|
|
say ""
|
|||
|
|
say "[6/6] 验收"
|
|||
|
|
if [ "$DRY" = 1 ]; then dim " [dry-run] 跳过实测"; return 0; fi
|
|||
|
|
|
|||
|
|
local d p c
|
|||
|
|
for d in "$DOMAIN_A" "$DOMAIN_B"; do
|
|||
|
|
if [ "$d" = "$DOMAIN_A" ]; then p="$PATH_A"; else p="$PATH_B"; fi
|
|||
|
|
c="$(code_of "https://${d}${p}" -H 'Upgrade: websocket' -H 'Connection: Upgrade' \
|
|||
|
|
-H 'Sec-WebSocket-Version: 13' -H 'Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==')"
|
|||
|
|
case "$c" in
|
|||
|
|
*101*) ok "${d}${p} → ${c}（WebSocket 已通）" ;;
|
|||
|
|
*) warn "${d}${p} → ${c:-无响应}（期望 101，看 ${VHOST_DIR}/${d}.conf 与 nginx error log）" ;;
|
|||
|
|
esac
|
|||
|
|
c="$(code_of "https://${d}${p}")"
|
|||
|
|
[ "$c" = "HTTP/1.1 404" ] && ok "${d}${p} 不带 Upgrade 时返回 404（探针伪装，符合预期）" \
|
|||
|
|
|| warn "${d}${p} 不带 Upgrade 返回 ${c:-无响应}（期望 404）"
|
|||
|
|
done
|
|||
|
|
|
|||
|
|
if [ -n "$PANEL_DOMAIN" ]; then
|
|||
|
|
c="$(curl -s -o /dev/null -w '%{http_code}' --max-time 15 "https://${PANEL_DOMAIN}/" 2>/dev/null)"
|
|||
|
|
[ "$c" = "401" ] && ok "面板子域未认证返回 401（Basic Auth 生效）" \
|
|||
|
|
|| warn "面板子域返回 ${c:-无响应}，期望 401"
|
|||
|
|
c="$(code_of "https://${PANEL_DOMAIN}/" -u "ops:${PANEL_BASIC_PASS}")"
|
|||
|
|
[ "$c" = "HTTP/1.1 200" ] && ok "面板子域带认证返回 200" || warn "面板子域带认证返回 ${c:-无响应}"
|
|||
|
|
fi
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# ─── 收尾 ──────────────────────────────────────────────────────────────────
|
|||
|
|
step_summary() {
|
|||
|
|
say ""
|
|||
|
|
say "─── 装好了 ──────────────────────────────────────────────"
|
|||
|
|
if [ -n "$PANEL_DOMAIN" ]; then
|
|||
|
|
say "面板： https://${PANEL_DOMAIN}/ 外层 ${PANEL_BASIC_USER} / ${PANEL_BASIC_PASS} 内层 admin / ${PANEL_PASSWORD}"
|
|||
|
|
else
|
|||
|
|
say "面板： ssh -L 2053:127.0.0.1:${PANEL_PORT} root@<本机IP> → 本地开 http://127.0.0.1:2053"
|
|||
|
|
say " 账号 admin / ${PANEL_PASSWORD}"
|
|||
|
|
fi
|
|||
|
|
say "入站： ${REMARK_A} 127.0.0.1:${PORT_A}${PATH_A}（→ ${DOMAIN_A}） ${REMARK_B} 127.0.0.1:${PORT_B}${PATH_B}（→ ${DOMAIN_B}）"
|
|||
|
|
say ""
|
|||
|
|
|
|||
|
|
if [ "$DRY" = 1 ]; then
|
|||
|
|
dim " [dry-run] 真实链接在装完后用下面命令取："
|
|||
|
|
dim " python3 ${API_PY} --password '<面板密码>' link --inbound ${REMARK_A} --email ${OWNER_EMAIL} --domain ${DOMAIN_A}"
|
|||
|
|
hr; return 0
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
say "你的两条链接（可直接导入客户端）："
|
|||
|
|
api link --inbound "$REMARK_A" --email "$OWNER_EMAIL" --domain "$DOMAIN_A" --fragment "${REMARK_A}-橙云" 2>/dev/null \
|
|||
|
|
| sed 's/^/ A /'
|
|||
|
|
api link --inbound "$REMARK_B" --email "$OWNER_EMAIL" --domain "$DOMAIN_B" --fragment "${REMARK_B}-灰云" 2>/dev/null \
|
|||
|
|
| sed 's/^/ B /'
|
|||
|
|
say ""
|
|||
|
|
say "给新用户开号：python3 ${API_PY} --password '<面板密码>' add-user --email <名字>"
|
|||
|
|
say "取某人某条链路的链接：… link --inbound ${REMARK_A} --email <名字> --domain ${DOMAIN_A}"
|
|||
|
|
say "销号： python3 ${API_PY} --password '<面板密码>' del-user --email <名字>"
|
|||
|
|
hr
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# ─── 主流程 ────────────────────────────────────────────────────────────────
|
|||
|
|
main() {
|
|||
|
|
while [ $# -gt 0 ]; do
|
|||
|
|
case "$1" in
|
|||
|
|
--dry-run) DRY=1; shift ;;
|
|||
|
|
--yes|-y) ASSUME=1; shift ;;
|
|||
|
|
--domain-a) DOMAIN_A="$2"; shift 2 ;;
|
|||
|
|
--domain-b) DOMAIN_B="$2"; shift 2 ;;
|
|||
|
|
--path-a) PATH_A="$2"; shift 2 ;;
|
|||
|
|
--path-b) PATH_B="$2"; shift 2 ;;
|
|||
|
|
--remark-a) REMARK_A="$2"; shift 2 ;;
|
|||
|
|
--remark-b) REMARK_B="$2"; shift 2 ;;
|
|||
|
|
--port-a) PORT_A="$2"; shift 2 ;;
|
|||
|
|
--port-b) PORT_B="$2"; shift 2 ;;
|
|||
|
|
--panel-port) PANEL_PORT="$2"; shift 2 ;;
|
|||
|
|
--panel-domain) PANEL_DOMAIN="$2"; shift 2 ;;
|
|||
|
|
--panel-password) PANEL_PASSWORD="$2"; shift 2 ;;
|
|||
|
|
--owner) OWNER_EMAIL="$2"; shift 2 ;;
|
|||
|
|
--acme-email) ACME_EMAIL="$2"; shift 2 ;;
|
|||
|
|
-h|--help) usage ;;
|
|||
|
|
*) die "未知参数：$1（--help 看用法）" ;;
|
|||
|
|
esac
|
|||
|
|
done
|
|||
|
|
|
|||
|
|
say "双链路代理安装向导（Ctrl+C 退出）"
|
|||
|
|
say "本脚本只做 nginx 转发 + 3x-ui 面板这一种架构。"
|
|||
|
|
|
|||
|
|
[ -z "$DOMAIN_A" ] && ask DOMAIN_A "橙云链路域名（走 CF 代理）" ""
|
|||
|
|
[ -z "$DOMAIN_B" ] && ask DOMAIN_B "灰云链路域名（A 记录直连）" ""
|
|||
|
|
ask PATH_A "链路 A 的 WebSocket 路径" "$PATH_A"
|
|||
|
|
ask PATH_B "链路 B 的 WebSocket 路径" "$PATH_B"
|
|||
|
|
ask PORT_A "链路 A 的后端本地端口" "$PORT_A"
|
|||
|
|
ask PORT_B "链路 B 的后端本地端口" "$PORT_B"
|
|||
|
|
ask PANEL_PORT "3x-ui 面板端口（只绑 127.0.0.1）" "$PANEL_PORT"
|
|||
|
|
ask PANEL_DOMAIN "面板子域名（留空=只走 SSH 隧道）" "$PANEL_DOMAIN"
|
|||
|
|
ask OWNER_EMAIL "首个账号标识（你自己）" "$OWNER_EMAIL"
|
|||
|
|
|
|||
|
|
say ""
|
|||
|
|
say "将执行："
|
|||
|
|
say " ${DOMAIN_A} → 127.0.0.1:${PORT_A}${PATH_A}"
|
|||
|
|
say " ${DOMAIN_B} → 127.0.0.1:${PORT_B}${PATH_B}"
|
|||
|
|
say " 面板 127.0.0.1:${PANEL_PORT}$([ -n "$PANEL_DOMAIN" ] && echo " → https://${PANEL_DOMAIN}")，首账号 ${OWNER_EMAIL}"
|
|||
|
|
[ "$DRY" = 1 ] && say " （dry-run：只打印不执行）"
|
|||
|
|
|
|||
|
|
if [ "$ASSUME" = 0 ] && [ -t 0 ]; then
|
|||
|
|
local go; read -r -p " 确认开始？[y/N] " go || true
|
|||
|
|
[ "$go" = y ] || [ "$go" = Y ] || { say "已取消"; exit 0; }
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
step_preflight
|
|||
|
|
step_backend
|
|||
|
|
step_inbounds
|
|||
|
|
step_nginx_http
|
|||
|
|
step_nginx_https
|
|||
|
|
step_verify
|
|||
|
|
step_summary
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if [ "${BASH_SOURCE[0]}" = "$0" ]; then main "$@"; fi
|