eli/vpsetup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Commit Graph

  • 1d5af2248b fix(firewall): forward 链改回"作用域白名单 + 默认丢弃" main eli 2026-11-11 12:24:44 +08:00
  • 38c2f1fd14 fix(firewall): 加 wt0 进模板、删掉无用的 NTP 规则 eli 2026-11-11 00:11:25 +08:00
  • a8b22b594c fix(firewall): 按旧 iptables 实现精确复刻容器放行，并补回遗漏的 NTP eli 2026-11-10 18:53:05 +08:00
  • 4889ac36f2 docs: 删除「rules.v6 由另一个 agent 管」这条过期约束 eli 2026-11-10 15:46:47 +08:00
  • 57b21d5b99 refactor(firewall): forward 链彻底不做过滤（回到 netavark 本来就能工作的状态） eli 2026-11-10 13:06:25 +08:00
  • bff47139d7 fix(firewall): 补容器 DNS/出站放行、修 --local --apply 的静默失败 eli 2026-11-10 11:48:48 +08:00
  • 328a41fda3 fix(firewall): forward 链放行 DNAT，否则容器发布端口全被挡成 refused eli 2026-11-10 11:24:37 +08:00
  • 3b19271b6a feat(rotate): hy2 的 CF 令牌轮换脚本（含一次真实事故的教训） eli 2026-11-10 10:42:45 +08:00
  • 6982948324 docs(readme): 补 init-firewall.sh 章节（之前脚本在、README 里完全没提） eli 2026-11-08 20:40:25 +08:00
  • dea51c546a chore(cdn-v6): 文件头补上 Akamai 来源仓库地址（测试断言要求写明来源） eli 2026-11-08 13:13:39 +08:00
  • ca5d8ee84a refactor: CDN 清单生成器移交 gc-toolkit/cdn-list eli 2026-11-08 13:12:01 +08:00
  • 8fd7d9db1b feat(tools): 新增 refresh-cdn-lists.sh，把清单刷新变成一条命令 eli 2026-11-08 11:31:52 +08:00
  • 37db75413d fix(cdn-list): 换用上游仓库自带的合并版，并补上一直缺失的 Akamai IPv6 eli 2026-11-08 11:17:55 +08:00
  • bb27fb24dc feat(cdn-list): v4 清单 188 → 402 条，覆盖面上补到 GCP 那份的规模 eli 2026-11-08 10:38:45 +08:00
  • 5420ea95e3 feat(firewall): 主机防火墙收进本仓库，全机队共用 eli 2026-11-08 00:48:17 +08:00
  • b1ab48afd3 docs(cdn-v6): 把 Akamai 段的空缺从 TODO 改成有依据的结论 eli 2026-11-07 21:05:58 +08:00
  • b4a3640536 docs(guard): 记录 2026-11-07 用 GCP Monitoring 做的实测校准 eli 2026-11-07 21:04:16 +08:00
  • 15690fd9a6 fix(cdn-bypass): 改为独立实例，修掉 confdir 合并污染主配置 eli 2026-11-07 20:53:47 +08:00
  • 3d35d0381c feat(guard): 新增月度出站流量看门狗 eli 2026-11-07 20:53:39 +08:00
  • 0cc1d093b9 docs: 替换 AGENTS/README 真实域名/IP，改用代号与占位符；更新测试断言与夹具 eli 2026-11-04 19:07:29 +08:00
  • c3d06b2273 docs: cdn-bypass networkd drop-in 三处文档同步；HANDOFF §13 记录 10-16 事故与 10-30 修复实测；README 287→188 段订正；顺带落库 §12（10-24 ZeroTier 恢复，此前漏提交） eli 2026-10-30 20:38:45 +08:00
  • a7f63052a2 fix(cdn-bypass): networkd drop-in 防 fwmark 策略路由被清——2026-10-16 gcoregon 静默失效根治 eli 2026-10-30 20:38:45 +08:00
  • f0b4c1a984 style: vlessenc 解析处 A&&B||C 改 if（SC2015）——本地 shellcheck 0.8.0 默认 severity 闸门恢复全绿 eli 2026-10-30 20:38:45 +08:00
  • 4a88b3a4ac AGENTS: point workspace to /home/eli/cloud/vpsetup eli 2026-10-25 10:20:36 +08:00
  • 817238206e Never start nftables at runtime: enable --now flushes the host firewall eli 2026-10-25 10:20:36 +08:00
  • 21afa5bfae fix(xray): REALITY dest 写全 127.0.0.1:8003（裸端口在 v25.7.26+ 会变 localhost） eli 2026-10-10 22:11:43 +08:00
  • 3f6e1cff21 feat(migrate): 额外站点块直接装进站点目录——迁移后不再需要人工合并 eli 2026-10-10 11:05:37 +08:00
  • 4d7415e803 fix(apt): Caddy 官方源 402 的窄容错——upgrade 不再在第一步就中止 eli 2026-10-10 10:48:10 +08:00
  • cd26ae505f docs: 额外站点扩展点（README 章节 + 环境变量表 + AGENTS/HANDOFF） eli 2026-10-10 09:59:26 +08:00
  • 00e05c0c71 feat(caddy): 额外站点目录扩展点——升级安全的 import，手加站点不再被 upgrade 覆盖 eli 2026-10-10 09:59:19 +08:00
  • 8c8cb05e0a docs: 项目指引迁移 CLAUDE.md → AGENTS.md（DSH 原生），补访问地图与 standing constraints eli 2026-10-09 23:47:54 +08:00
  • 9722fa1825 docs: cdn-bypass 注释/CLAUDE.md 对齐新架构（客户端流量同样经 nft 筛选；direct 出站带 255 的典型症状；188 官方 CIDR；drop-in 20- 前缀） eli 2026-09-28 13:10:11 +08:00
  • 06d26b252b fix: cdn-bypass drop-in 改名 20- 前缀——官方 xray 安装脚本自带 10-donot_touch_single_conf.conf 会在同前缀 ASCII 序后加载盖掉我们的 -confdir；卸载同时清 10-/20- 两种残留 eli 2026-09-28 13:04:50 +08:00
  • 582f12efaa fix: systemd drop-in ExecStart 从新版 {path=...;argv[]=...} 形式正确抽出 argv[] eli 2026-09-28 12:51:23 +08:00
  • e23f5a7c1a fix: migrate 脚本 xray 解析器补上 # 剥注释（gcoregon 配置含 # 注释无法解析） eli 2026-09-28 11:55:21 +08:00
  • 960ca8c3f2 refactor: 端口过滤下沉到 nft 层（xray 不再做端口筛选），架构对齐 nft 全筛原则 eli 2026-09-28 11:50:01 +08:00
  • 2c13ffc03d fix: cdn-bypass 清单只保留三家公司官方段（401→188，剔除 213 条来源不明的 LE 回源 IP） eli 2026-09-28 11:34:52 +08:00
  • 2c7c3d5566 test: cdn-bypass 脚本 DRY_RUN 断言（routing 端口过滤 / mark255 / 双 nft 表 / CIDR≥400） eli 2026-09-28 08:01:56 +08:00
  • 09a5f6566a fix: cdn-bypass 与 gcoregon 实战清单合并(287→401) + routing 端口过滤 eli 2026-09-28 08:00:56 +08:00
  • 5916d1e1e1 fix: northflank 模板容器端口 443->8443（对齐实测：public 端口是 8443，443 是 private 上已移除的死 REALITY） eli 2026-09-26 16:47:47 +08:00
  • 0bd50a3157 docs: northflank/ 部署模板（XHTTP 最优配置 + hy2 + healthcheck 指南） eli 2026-09-26 15:48:28 +08:00
  • 1c7880609a feat: 迁移脚本 migrate_existing_stack.sh + WS_PATH 参数化 + ACTION=links eli 2026-09-26 15:31:41 +08:00
  • 4740f67ddc chore: gitignore 加入 .env（Northflank API token 等本地机密，不入库） eli 2026-09-26 15:31:15 +08:00
  • 4fe71e323d docs: README 重构——索引、选型总览、mermaid 架构图、新增 cdn-bypass 章节 eli 2026-09-26 12:25:30 +08:00
  • 826014e3b8 feat: 新增 setup_cdn_bypass_tproxy.sh —— CDN 绕行透明代理 eli 2026-09-26 12:25:30 +08:00
  • 49b389c9cb fix: nftables 运行时只加载自己的表，不再执行整份 nftables.conf eli 2026-09-26 12:25:30 +08:00
  • e786b38624 fix: ECH 默认 DNS 8.8.8.8 -> 9.9.9.9（Quad9，实测不被屏蔽；8.8.8.8 偶发断） eli 2026-08-25 15:25:23 +08:00
  • b43d56edb2 fix: ECH 默认查询改用 udp://8.8.8.8（明文 UDP53，墙内实测最稳） eli 2026-08-25 13:13:23 +08:00
  • f97bb8e133 fix: ECH default DoH -> 8.8.8.8 IP 字面量（实测连通；免 dns.google 域名二次解析） eli 2026-08-25 12:30:54 +08:00
  • 3b45fda3c1 fix: ECH default DoH endpoint cloudflare-dns.com -> dns.google eli 2026-08-25 12:24:43 +08:00
  • eb7370eabb feat: CDN links carry ech= — dynamic DoH query form by default eli 2026-08-25 12:12:30 +08:00
  • 50195daa10 feat: XHTTP extra padding on by default (XHTTP_PADDING=0 to disable) eli 2026-08-25 12:12:16 +08:00
  • f0ea7bc279 feat: optional XHTTP extra padding via XHTTP_PADDING=1 (link carries extra=) eli 2026-08-25 00:09:31 +08:00
  • 48e6bd4313 fix: drop XHTTP extra/xPadding block — breaks every link-imported client (400) eli 2026-08-24 23:55:38 +08:00
  • 4138484128 fix: WS route stripped /scilad prefix (handle_path) — xray 404'd every handshake eli 2026-08-24 23:27:59 +08:00
  • 51088dc7f0 feat: fp=chrome on all TLS client links; ws-cdn link test eli 2026-08-24 22:47:37 +08:00
  • fe59616fa5 fix: drop h3 from Caddy TLS ALPN; add ws-cdn client link eli 2026-08-24 21:21:44 +08:00
  • f4616814b8 fix: disable Caddy auto_https redirects shadowing hy2 ACME challenge route eli 2026-08-24 20:27:05 +08:00
  • 9bdd928b9b feat: self-check probes ACME challenge route; live caddy route test eli 2026-08-24 19:54:30 +08:00
  • 384d46ee7a fix: default hy2 masquerade to engineersblog.net (match xray camouflage) eli 2026-08-24 19:37:53 +08:00
  • 1645e1a003 fix: port-80 ACME challenge route was shadowed by bare redir eli 2026-08-24 19:31:44 +08:00
  • 60717dc48d docs: fix HTTP/3 toggle location (Speed > Settings) and dig HTTPS syntax eli 2026-08-24 19:04:50 +08:00
  • 7e5e7ec570 docs: ECH is default-on for Free zones; clarify HTTPS redirect, TLS 1.2, ACM eli 2026-08-24 18:56:22 +08:00
  • 62d852c97b docs: drop Enterprise-only Origin Rule from CDN guide — Preserve works eli 2026-08-24 18:46:32 +08:00
  • 07ae7e7caf docs: Cloudflare origin setup guide for current 2026 dashboard eli 2026-08-24 18:36:13 +08:00
  • 0f8e3eed37 fix: preflight silently killed the script under set -e when DRY_RUN unset eli 2026-08-24 15:51:00 +08:00
  • e11206a868 docs: clarify tty detection comment eli 2026-08-24 15:32:45 +08:00
  • 418112b646 feat: ACTION=upgrade — non-interactive upgrade of all components eli 2026-08-24 15:27:32 +08:00
  • 588d292ecb feat: optional VLESS post-quantum encryption (XRAY_VLESS_ENC), README index + ECH/PQ docs eli 2026-08-24 15:20:15 +08:00
  • fbda86236a docs: add 2026-08 protocol landscape review to design doc eli 2026-08-24 13:36:19 +08:00
  • ab908117a0 feat: hysteria2 HTTP-01 standalone mode binds port 80 when Caddy skipped eli 2026-08-24 13:28:27 +08:00
  • 1b500d5a69 feat: default hysteria2 cert to ACME HTTP-01 via Caddy port-80 proxy eli 2026-08-24 12:57:49 +08:00
  • 79cfe0e12a fix: DNS takeover mode by resolv.conf disposition, in-place restore eli 2026-08-24 11:04:17 +08:00
  • b8ffb98277 docs: usage docs for caddy+xray+hysteria script, archive original templates eli 2026-08-24 00:37:04 +08:00
  • ad249126ba chore: untrack hand-written templates and codegraph index eli 2026-08-24 00:34:35 +08:00
  • 1c82fa7cef feat: self-check, client summary, uninstall eli 2026-08-24 00:34:24 +08:00
  • 321bc96d5e feat: nftables port hopping, validation, service enablement eli 2026-08-24 00:32:45 +08:00
  • 372b25126d feat: hysteria2 install + config render eli 2026-08-24 00:31:13 +08:00
  • bfebe573c7 feat: xray install, keypair generation, config render eli 2026-08-24 00:30:05 +08:00
  • d756d2aa3f feat: caddy install + Caddyfile render eli 2026-08-24 00:27:49 +08:00
  • c7dcf88bb6 feat: parameter collection, env persistence, test scaffold eli 2026-08-24 00:24:46 +08:00
  • cf5c966a07 feat: add setup_caddy_xray_hysteria.sh skeleton eli 2026-08-24 00:21:54 +08:00
  • 0f14089e6d docs: condense implementation plan (keep tasks + key info) eli 2026-08-24 00:15:49 +08:00
  • 4dbf477e8b Add optional CDN_DOMAIN second site block to design eli 2026-08-23 23:47:29 +08:00
  • 5721c6f85b Add design doc for caddy+xray+hysteria2 setup script eli 2026-08-23 23:44:25 +08:00
  • 99064c849b Diagnose team-name typos: explain HTTP 404 on enrollment JWT fetch eli 2026-08-23 22:39:32 +08:00
  • 5f800bf654 Add README with 2026 Zero Trust enrollment paths, improve JWT error diagnostics eli 2026-08-23 22:18:44 +08:00
  • e6f8b5be20 Add interactive mode, wireguard-go fallback, supply-chain hardening eli 2026-08-23 22:01:08 +08:00
  • 0b59471c52 Rewrite WARP setup: fix registration, add Zero Trust team mode eli 2026-08-23 21:47:38 +08:00
  • 32d465d4fa Update setup_warp_zerotrust.sh eli 2026-08-23 18:42:59 +08:00
  • 630397e7c4 Update setup_warp_zerotrust.sh eli 2026-08-23 17:19:21 +08:00
  • 7ec70cd66b Update setup_warp_zerotrust.sh eli 2026-08-23 12:00:02 +08:00
  • 3177d0b890 Update setup_warp_zerotrust.sh eli 2026-08-23 11:57:11 +08:00
  • 54a8df0764 Update setup_warp_zerotrust.sh eli 2026-08-23 11:55:48 +08:00
  • 5bd5e7043e Update setup_warp_zerotrust.sh eli 2026-08-23 11:53:53 +08:00
  • fe44a6c350 Update setup_warp_zerotrust.sh eli 2026-08-23 11:46:40 +08:00
  • 304e5b548c Add setup_warp_zerotrust.sh eli 2026-08-23 11:44:59 +08:00