6814fa2a62
Add deployment traces for the JPpro proxy node, RackNerd origin hosts, catproxy boundary changes, local speed checks, and Sub2API rate-limit behavior. Keep remote secrets excluded while tracking sanitized nginx, compose, plan, and operational memory documents.
73 lines
2.0 KiB
Bash
Executable File
73 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
set -euo pipefail
|
||
|
||
# 在 proxy-ng 节点上执行的安装骨架。
|
||
# 该脚本只处理 nginx 基础安装和配置落位；DNS、证书签发、真实密钥分发仍由人工或运维系统完成。
|
||
|
||
if [[ "${EUID}" -ne 0 ]]; then
|
||
echo "must run as root" >&2
|
||
exit 1
|
||
fi
|
||
|
||
ENV_FILE="${1:-/etc/proxy-ng/proxy-ng.env}"
|
||
if [[ ! -f "${ENV_FILE}" ]]; then
|
||
echo "env file not found: ${ENV_FILE}" >&2
|
||
exit 1
|
||
fi
|
||
|
||
# shellcheck disable=SC1090
|
||
source "${ENV_FILE}"
|
||
|
||
required_vars=(
|
||
PROXY_NG_DOMAIN
|
||
PROXY_NG_NODE_NAME
|
||
SUB2API_BACKEND_ORIGIN
|
||
SUB2API_BACKEND_ORIGIN_HOST
|
||
PROXY_NG_TOKEN_FILE
|
||
TLS_CERT_PATH
|
||
TLS_KEY_PATH
|
||
)
|
||
|
||
for name in "${required_vars[@]}"; do
|
||
if [[ -z "${!name:-}" ]]; then
|
||
echo "missing required env: ${name}" >&2
|
||
exit 1
|
||
fi
|
||
done
|
||
|
||
apt-get update
|
||
apt-get install -y nginx openssl ca-certificates curl
|
||
|
||
install -d -m 0755 /etc/proxy-ng
|
||
install -d -m 0700 /etc/nginx/proxy-ng
|
||
|
||
if [[ ! -f "${PROXY_NG_TOKEN_FILE}" ]]; then
|
||
echo "token file not found: ${PROXY_NG_TOKEN_FILE}" >&2
|
||
echo "create it as root-only, for example: set \\$proxy_ng_expected_token \"<token>\";" >&2
|
||
exit 1
|
||
fi
|
||
chmod 600 "${PROXY_NG_TOKEN_FILE}"
|
||
chown root:root "${PROXY_NG_TOKEN_FILE}"
|
||
|
||
TEMPLATE_PATH="${PROXY_NG_TEMPLATE_PATH:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/nginx/proxy-node.conf.template}"
|
||
if [[ ! -f "${TEMPLATE_PATH}" ]]; then
|
||
echo "template not found: ${TEMPLATE_PATH}" >&2
|
||
exit 1
|
||
fi
|
||
|
||
sed \
|
||
-e "s|{{DOMAIN}}|${PROXY_NG_DOMAIN}|g" \
|
||
-e "s|{{NODE_NAME}}|${PROXY_NG_NODE_NAME}|g" \
|
||
-e "s|{{BACKEND_ORIGIN}}|${SUB2API_BACKEND_ORIGIN}|g" \
|
||
-e "s|{{BACKEND_ORIGIN_HOST}}|${SUB2API_BACKEND_ORIGIN_HOST}|g" \
|
||
-e "s|{{PROXY_NG_TOKEN_FILE}}|${PROXY_NG_TOKEN_FILE}|g" \
|
||
-e "s|{{TLS_CERT_PATH}}|${TLS_CERT_PATH}|g" \
|
||
-e "s|{{TLS_KEY_PATH}}|${TLS_KEY_PATH}|g" \
|
||
"${TEMPLATE_PATH}" > /etc/nginx/nginx.conf
|
||
|
||
nginx -t
|
||
systemctl enable --now nginx
|
||
systemctl reload nginx
|
||
|
||
echo "proxy-ng node installed: ${PROXY_NG_NODE_NAME} (${PROXY_NG_DOMAIN})"
|