chore(platform-infra): commit parallel proxy updates
This commit is contained in:
Codex
@@ -43,7 +43,7 @@ interface HostProxyServer {
|
||||
|
||||
interface HostProxySource {
|
||||
id: string;
|
||||
sourceType: "benchmark-validated-master-shadowsocks" | "vpn-server-shadowsocks";
|
||||
sourceType: "benchmark-validated-master-shadowsocks" | "vpn-server-shadowsocks" | "vpn-server-hysteria-existing";
|
||||
serverRef: string;
|
||||
benchmarkRef: string;
|
||||
implementationRef: string;
|
||||
@@ -51,14 +51,17 @@ interface HostProxySource {
|
||||
sourceRef: string;
|
||||
sourceKey: string;
|
||||
sourceFingerprint: string;
|
||||
masterShadowsocks: MasterShadowsocksSourceSpec;
|
||||
masterShadowsocks: MasterShadowsocksSourceSpec | null;
|
||||
client: HostProxyClient;
|
||||
proxyUrl: string;
|
||||
externalProbeUrl: string;
|
||||
expectedServer: string | null;
|
||||
fingerprint: string;
|
||||
}
|
||||
|
||||
interface HostProxyClient {
|
||||
type HostProxyClient = HostProxyManagedClient | HostProxyExistingHysteriaClient;
|
||||
|
||||
interface HostProxyManagedClient {
|
||||
mode: "trans-static-binary";
|
||||
upstreamUrl: string;
|
||||
version: string;
|
||||
@@ -79,6 +82,16 @@ interface HostProxyClient {
|
||||
healthUrl: string;
|
||||
}
|
||||
|
||||
interface HostProxyExistingHysteriaClient {
|
||||
mode: "external-existing-hysteria";
|
||||
configPath: string;
|
||||
serviceName: string;
|
||||
httpListenHost: string;
|
||||
httpListenPort: number;
|
||||
socks5ListenHost: string;
|
||||
socks5ListenPort: number;
|
||||
}
|
||||
|
||||
interface HostProxyPodAccess {
|
||||
enabled: boolean;
|
||||
listenHost: string;
|
||||
@@ -136,14 +149,11 @@ export async function runPlatformInfraHostProxyCommand(_config: UniDeskConfig, a
|
||||
if (options.action === "plan") return renderPlan(plan(config.server, target));
|
||||
if (options.action === "status") return renderStatus(status(config.server, target));
|
||||
if (!options.confirm || options.dryRun) {
|
||||
const dryRunPlan = plan(config.server, target);
|
||||
return renderPlan({
|
||||
...plan(config.server, target),
|
||||
...dryRunPlan,
|
||||
mode: "dry-run",
|
||||
mutation: false,
|
||||
next: {
|
||||
apply: `bun scripts/cli.ts platform-infra egress-proxy host apply --target ${target.id} --confirm`,
|
||||
status: `bun scripts/cli.ts platform-infra egress-proxy host status --target ${target.id}`,
|
||||
},
|
||||
});
|
||||
}
|
||||
return renderApply(apply(config.server, target));
|
||||
@@ -233,13 +243,14 @@ function parseServer(raw: Record<string, unknown>, label: string): HostProxyServ
|
||||
}
|
||||
|
||||
function parseSource(id: string, raw: Record<string, unknown>): HostProxySource {
|
||||
const sourceType = enumField(raw, "sourceType", `${configPath}.sources.${id}`, ["benchmark-validated-master-shadowsocks", "vpn-server-shadowsocks"] as const);
|
||||
const sourceType = enumField(raw, "sourceType", `${configPath}.sources.${id}`, ["benchmark-validated-master-shadowsocks", "vpn-server-shadowsocks", "vpn-server-hysteria-existing"] as const);
|
||||
if (sourceType === "vpn-server-hysteria-existing") return parseExistingHysteriaSource(id, raw, sourceType);
|
||||
const sourceConfigRef = stringField(raw, "sourceConfigRef", `${configPath}.sources.${id}`);
|
||||
const resolved = resolveEgressProxySourceRef(sourceConfigRef, `${configPath}.sources.${id}.sourceConfigRef`);
|
||||
if (resolved.sourceType !== "master-shadowsocks" || resolved.masterShadowsocks === null) {
|
||||
throw new Error(`${configPath}.sources.${id}.sourceConfigRef must reference a master-shadowsocks source`);
|
||||
}
|
||||
const client = clientSpec(record(raw.client, `${configPath}.sources.${id}.client`), `${configPath}.sources.${id}.client`);
|
||||
const client = managedClientSpec(record(raw.client, `${configPath}.sources.${id}.client`), `${configPath}.sources.${id}.client`);
|
||||
const proxyUrl = urlField(raw, "proxyUrl", `${configPath}.sources.${id}`);
|
||||
const expectedProxyUrl = `http://${client.listenHost}:${client.listenPort}`;
|
||||
if (proxyUrl !== expectedProxyUrl) throw new Error(`${configPath}.sources.${id}.proxyUrl must be ${expectedProxyUrl}`);
|
||||
@@ -257,6 +268,7 @@ function parseSource(id: string, raw: Record<string, unknown>): HostProxySource
|
||||
client,
|
||||
proxyUrl,
|
||||
externalProbeUrl: urlField(raw, "externalProbeUrl", `${configPath}.sources.${id}`),
|
||||
expectedServer: null,
|
||||
fingerprint: "",
|
||||
};
|
||||
return {
|
||||
@@ -274,7 +286,46 @@ function parseSource(id: string, raw: Record<string, unknown>): HostProxySource
|
||||
};
|
||||
}
|
||||
|
||||
function clientSpec(raw: Record<string, unknown>, label: string): HostProxyClient {
|
||||
function parseExistingHysteriaSource(id: string, raw: Record<string, unknown>, sourceType: HostProxySource["sourceType"]): HostProxySource {
|
||||
const client = existingHysteriaClientSpec(record(raw.client, `${configPath}.sources.${id}.client`), `${configPath}.sources.${id}.client`);
|
||||
const proxyUrl = urlField(raw, "proxyUrl", `${configPath}.sources.${id}`);
|
||||
const expectedProxyUrl = `http://${client.httpListenHost}:${client.httpListenPort}`;
|
||||
if (proxyUrl !== expectedProxyUrl) throw new Error(`${configPath}.sources.${id}.proxyUrl must be ${expectedProxyUrl}`);
|
||||
const sourceConfigRef = stringField(raw, "sourceConfigRef", `${configPath}.sources.${id}`);
|
||||
const expectedServer = listenAddressField(raw, "expectedServer", `${configPath}.sources.${id}`);
|
||||
const source = {
|
||||
id,
|
||||
sourceType,
|
||||
serverRef: stringField(raw, "serverRef", `${configPath}.sources.${id}`),
|
||||
benchmarkRef: stringField(raw, "benchmarkRef", `${configPath}.sources.${id}`),
|
||||
implementationRef: stringField(raw, "implementationRef", `${configPath}.sources.${id}`),
|
||||
sourceConfigRef,
|
||||
sourceRef: sourceConfigRef,
|
||||
sourceKey: "",
|
||||
sourceFingerprint: fingerprint({ sourceConfigRef, expectedServer }),
|
||||
masterShadowsocks: null,
|
||||
client,
|
||||
proxyUrl,
|
||||
externalProbeUrl: urlField(raw, "externalProbeUrl", `${configPath}.sources.${id}`),
|
||||
expectedServer,
|
||||
fingerprint: "",
|
||||
};
|
||||
return {
|
||||
...source,
|
||||
fingerprint: fingerprint({
|
||||
sourceType,
|
||||
benchmarkRef: source.benchmarkRef,
|
||||
implementationRef: source.implementationRef,
|
||||
sourceConfigRef,
|
||||
expectedServer,
|
||||
client,
|
||||
proxyUrl,
|
||||
externalProbeUrl: source.externalProbeUrl,
|
||||
}),
|
||||
};
|
||||
}
|
||||
|
||||
function managedClientSpec(raw: Record<string, unknown>, label: string): HostProxyManagedClient {
|
||||
const mode = enumField(raw, "mode", label, ["trans-static-binary"] as const);
|
||||
const podAccess = raw.podAccess === undefined ? null : podAccessSpec(record(raw.podAccess, `${label}.podAccess`), `${label}.podAccess`);
|
||||
const client = {
|
||||
@@ -302,6 +353,22 @@ function clientSpec(raw: Record<string, unknown>, label: string): HostProxyClien
|
||||
return client;
|
||||
}
|
||||
|
||||
function existingHysteriaClientSpec(raw: Record<string, unknown>, label: string): HostProxyExistingHysteriaClient {
|
||||
const mode = enumField(raw, "mode", label, ["external-existing-hysteria"] as const);
|
||||
const client = {
|
||||
mode,
|
||||
configPath: absolutePathField(raw, "configPath", label),
|
||||
serviceName: stringField(raw, "serviceName", label),
|
||||
httpListenHost: hostField(raw, "httpListenHost", label),
|
||||
httpListenPort: portField(raw, "httpListenPort", label),
|
||||
socks5ListenHost: hostField(raw, "socks5ListenHost", label),
|
||||
socks5ListenPort: portField(raw, "socks5ListenPort", label),
|
||||
};
|
||||
if (client.httpListenHost !== "127.0.0.1") throw new Error(`${label}.httpListenHost must stay 127.0.0.1 for host-local HTTP proxy`);
|
||||
if (client.socks5ListenHost !== "127.0.0.1") throw new Error(`${label}.socks5ListenHost must stay 127.0.0.1 for host-local SOCKS5 proxy`);
|
||||
return client;
|
||||
}
|
||||
|
||||
function podAccessSpec(raw: Record<string, unknown>, label: string): HostProxyPodAccess {
|
||||
const enabled = booleanField(raw, "enabled", label);
|
||||
const listenHost = hostField(raw, "listenHost", label);
|
||||
@@ -394,6 +461,7 @@ function resolveTarget(config: HostProxyConfig, targetId: string): HostProxyTarg
|
||||
|
||||
function plan(server: HostProxyServer, target: HostProxyTarget): Record<string, unknown> {
|
||||
const client = target.source.client;
|
||||
const applyEnabled = client.mode === "trans-static-binary";
|
||||
return {
|
||||
ok: true,
|
||||
command: "platform-infra egress-proxy host plan",
|
||||
@@ -407,14 +475,17 @@ function plan(server: HostProxyServer, target: HostProxyTarget): Record<string,
|
||||
env: { proxyUrl: target.env.httpProxy, noProxyCount: target.env.noProxy.length, noProxyIncludesHyueapi: true },
|
||||
valuesPrinted: false,
|
||||
next: {
|
||||
dryRun: `bun scripts/cli.ts platform-infra egress-proxy host apply --target ${target.id} --dry-run`,
|
||||
apply: `bun scripts/cli.ts platform-infra egress-proxy host apply --target ${target.id} --confirm`,
|
||||
dryRun: applyEnabled ? `bun scripts/cli.ts platform-infra egress-proxy host apply --target ${target.id} --dry-run` : "disabled: existing external host proxy client",
|
||||
apply: applyEnabled ? `bun scripts/cli.ts platform-infra egress-proxy host apply --target ${target.id} --confirm` : "disabled: existing external host proxy client",
|
||||
status: `bun scripts/cli.ts platform-infra egress-proxy host status --target ${target.id}`,
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function apply(server: HostProxyServer, target: HostProxyTarget): Record<string, unknown> {
|
||||
if (target.source.client.mode !== "trans-static-binary") {
|
||||
throw new Error(`${configPath}.targets.${target.id} uses ${target.source.client.mode}; host apply is disabled for existing external clients. Use status to verify the declared runtime.`);
|
||||
}
|
||||
const material = proxySecretMaterial(server, target.source);
|
||||
const serverApply = sourceUsesManagedServer(target.source) ? applyMasterProxyServer(server, material) : skippedMasterProxyServer(target.source, "apply");
|
||||
const artifact = prepareClientArtifact(target.source.client);
|
||||
@@ -495,13 +566,14 @@ function skippedMasterProxyServer(source: HostProxySource, mode: "apply" | "stat
|
||||
existingHealthy: null,
|
||||
inspect: null,
|
||||
container: "external",
|
||||
listen: `${source.masterShadowsocks.serverHost}:${source.masterShadowsocks.serverPort}`,
|
||||
listen: source.masterShadowsocks === null ? source.expectedServer ?? source.proxyUrl : `${source.masterShadowsocks.serverHost}:${source.masterShadowsocks.serverPort}`,
|
||||
health: { ok: true, mode: "external", host: "", port: 0 },
|
||||
valuesPrinted: false,
|
||||
};
|
||||
}
|
||||
|
||||
function proxySecretMaterial(server: HostProxyServer, source: HostProxySource): HostProxySecretMaterial {
|
||||
if (source.masterShadowsocks === null) throw new Error(`${configPath}.sources.${source.id} does not render managed shadowsocks secret material`);
|
||||
const envSource = readEnvSourceFile({
|
||||
root: rootPath(".state", "secrets"),
|
||||
sourceRef: source.sourceRef,
|
||||
@@ -531,6 +603,9 @@ function renderMasterShadowsocksServerConfig(server: HostProxyServer, password:
|
||||
}
|
||||
|
||||
function renderSingBoxClientConfig(source: HostProxySource, password: string): string {
|
||||
if (source.masterShadowsocks === null || source.client.mode !== "trans-static-binary") {
|
||||
throw new Error(`${configPath}.sources.${source.id} cannot render sing-box client config`);
|
||||
}
|
||||
const client = source.client;
|
||||
const inbounds = [
|
||||
{ type: "mixed", tag: "mixed-host-local", listen: client.listenHost, listen_port: client.listenPort },
|
||||
@@ -741,6 +816,7 @@ ${remoteStatusProbeShell(target)}
|
||||
|
||||
function remoteStatusProbeShell(target: HostProxyTarget): string {
|
||||
const client = target.source.client;
|
||||
if (client.mode === "external-existing-hysteria") return remoteExistingHysteriaStatusProbeShell(target, client);
|
||||
const podAccess = client.podAccess;
|
||||
const podAccessShell = podAccess?.enabled
|
||||
? `
|
||||
@@ -811,6 +887,101 @@ PY
|
||||
`;
|
||||
}
|
||||
|
||||
function remoteExistingHysteriaStatusProbeShell(target: HostProxyTarget, client: HostProxyExistingHysteriaClient): string {
|
||||
return `
|
||||
set -eu
|
||||
config_present=missing
|
||||
[ -f ${shQuote(client.configPath)} ] && config_present=present
|
||||
service_active="$(systemctl is-active ${shQuote(client.serviceName)} 2>/dev/null || true)"
|
||||
http_rc=0
|
||||
http_metrics="$(curl -sS -o /dev/null -w '%{http_code} %{time_connect} %{time_pretransfer} %{time_starttransfer} %{time_total}' --max-time 20 -x ${shQuote(target.env.httpProxy)} ${shQuote(target.source.externalProbeUrl)} 2>/tmp/unidesk-host-proxy-hysteria-http.err)" || http_rc=$?
|
||||
socks_rc=0
|
||||
socks_metrics="$(curl -sS -o /dev/null -w '%{http_code} %{time_connect} %{time_pretransfer} %{time_starttransfer} %{time_total}' --max-time 20 --socks5-hostname ${shQuote(`${client.socks5ListenHost}:${client.socks5ListenPort}`)} ${shQuote(target.source.externalProbeUrl)} 2>/tmp/unidesk-host-proxy-hysteria-socks.err)" || socks_rc=$?
|
||||
python3 - "$config_present" "$service_active" "$http_rc" "$http_metrics" "$socks_rc" "$socks_metrics" <<'PY'
|
||||
import json
|
||||
import re
|
||||
import sys
|
||||
from pathlib import Path
|
||||
|
||||
config_path = "${client.configPath}"
|
||||
expected_server = "${target.source.expectedServer ?? ""}"
|
||||
expected_http = "${client.httpListenHost}:${client.httpListenPort}"
|
||||
expected_socks = "${client.socks5ListenHost}:${client.socks5ListenPort}"
|
||||
|
||||
def parse_metrics(raw):
|
||||
parts = str(raw or "").split()
|
||||
if len(parts) != 5:
|
||||
return {"status": "", "timeConnect": "", "timePretransfer": "", "timeStarttransfer": "", "timeTotal": ""}
|
||||
return {
|
||||
"status": parts[0],
|
||||
"timeConnect": parts[1],
|
||||
"timePretransfer": parts[2],
|
||||
"timeStarttransfer": parts[3],
|
||||
"timeTotal": parts[4],
|
||||
}
|
||||
|
||||
def section_listen(text, section):
|
||||
match = re.search(r"(?ms)^" + re.escape(section) + r":\\s*\\n(?:[ \\t]+.*\\n)*?[ \\t]+listen:\\s*([^\\s#]+)", text)
|
||||
return match.group(1).strip() if match else ""
|
||||
|
||||
text = Path(config_path).read_text(encoding="utf-8") if Path(config_path).exists() else ""
|
||||
server_match = re.search(r"(?m)^server:\\s*([^\\s#]+)", text)
|
||||
server = server_match.group(1).strip() if server_match else ""
|
||||
server_host_port = re.sub(r"^[^@]*@", "", server)
|
||||
http_listen = section_listen(text, "http")
|
||||
socks_listen = section_listen(text, "socks5")
|
||||
http = parse_metrics(sys.argv[4])
|
||||
socks = parse_metrics(sys.argv[6])
|
||||
payload = {
|
||||
"ok": (
|
||||
sys.argv[1] == "present"
|
||||
and sys.argv[2] == "active"
|
||||
and server_host_port == expected_server
|
||||
and http_listen == expected_http
|
||||
and socks_listen == expected_socks
|
||||
and int(sys.argv[3]) == 0
|
||||
and http["status"] == "204"
|
||||
and int(sys.argv[5]) == 0
|
||||
and socks["status"] == "204"
|
||||
),
|
||||
"target": "${target.id}",
|
||||
"route": "${target.route}",
|
||||
"sourceRef": "${target.sourceRef}",
|
||||
"sourceFingerprint": "${target.source.fingerprint}",
|
||||
"client": {
|
||||
"mode": "${client.mode}",
|
||||
"service": "${client.serviceName}",
|
||||
"serviceActive": sys.argv[2],
|
||||
"configPath": config_path,
|
||||
"configPresent": sys.argv[1],
|
||||
"configMatches": server_host_port == expected_server and http_listen == expected_http and socks_listen == expected_socks,
|
||||
"server": server_host_port,
|
||||
"expectedServer": expected_server,
|
||||
"httpListen": http_listen,
|
||||
"socks5Listen": socks_listen,
|
||||
"listen": expected_http,
|
||||
"podAccess": {"enabled": False, "listen": "", "proxyUrl": ""},
|
||||
},
|
||||
"files": {
|
||||
"envFile": "status-only",
|
||||
"profile": "status-only",
|
||||
"apt": "status-only",
|
||||
"dockerSystemdDropIn": "status-only",
|
||||
"k3sSystemdDropIn": "status-only",
|
||||
},
|
||||
"noProxy": {"hyueapi": True, "wildcardHyueapi": True},
|
||||
"health": {"exitCode": int(sys.argv[3]), "url": "${target.source.externalProbeUrl}", "mode": "http-proxy"},
|
||||
"externalProbe": {"exitCode": int(sys.argv[3]), **http, "url": "${target.source.externalProbeUrl}", "proxyUrl": "${target.env.httpProxy}"},
|
||||
"socks5Probe": {"exitCode": int(sys.argv[5]), **socks, "url": "${target.source.externalProbeUrl}", "proxyUrl": "socks5h://${client.socks5ListenHost}:${client.socks5ListenPort}"},
|
||||
"podAccessProbe": {"enabled": False, "exitCode": 0, "status": "skipped", "url": "${target.source.externalProbeUrl}"},
|
||||
"valuesPrinted": False,
|
||||
}
|
||||
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
||||
sys.exit(0 if payload["ok"] else 1)
|
||||
PY
|
||||
`;
|
||||
}
|
||||
|
||||
function renderClientUnit(client: HostProxyClient): string {
|
||||
return [
|
||||
"[Unit]",
|
||||
@@ -900,15 +1071,7 @@ function targetSummary(target: HostProxyTarget): Record<string, unknown> {
|
||||
proxyUrl: target.source.proxyUrl,
|
||||
benchmarkRef: target.source.benchmarkRef,
|
||||
implementationRef: target.source.implementationRef,
|
||||
client: {
|
||||
mode: client.mode,
|
||||
version: client.version,
|
||||
installPath: client.installPath,
|
||||
configPath: client.configPath,
|
||||
unitPath: client.unitPath,
|
||||
serviceName: client.serviceName,
|
||||
listen: `${client.listenHost}:${client.listenPort}`,
|
||||
},
|
||||
client: clientSummary(client),
|
||||
trans: {
|
||||
hostProxyEnv: transHostProxyEnvSummary(target.id),
|
||||
},
|
||||
@@ -916,6 +1079,19 @@ function targetSummary(target: HostProxyTarget): Record<string, unknown> {
|
||||
}
|
||||
|
||||
function artifactSummary(client: HostProxyClient): Record<string, unknown> {
|
||||
if (client.mode === "external-existing-hysteria") {
|
||||
return {
|
||||
mode: client.mode,
|
||||
version: "existing",
|
||||
upstreamUrl: "external",
|
||||
archiveCachePath: "external",
|
||||
binaryCachePath: "external",
|
||||
archiveSha256: "external",
|
||||
archiveInstallPath: "external",
|
||||
binarySha256: "external",
|
||||
installPath: client.configPath,
|
||||
};
|
||||
}
|
||||
return {
|
||||
mode: client.mode,
|
||||
version: client.version,
|
||||
@@ -929,6 +1105,30 @@ function artifactSummary(client: HostProxyClient): Record<string, unknown> {
|
||||
};
|
||||
}
|
||||
|
||||
function clientSummary(client: HostProxyClient): Record<string, unknown> {
|
||||
if (client.mode === "external-existing-hysteria") {
|
||||
return {
|
||||
mode: client.mode,
|
||||
version: "existing",
|
||||
installPath: "external",
|
||||
configPath: client.configPath,
|
||||
unitPath: "external",
|
||||
serviceName: client.serviceName,
|
||||
listen: `${client.httpListenHost}:${client.httpListenPort}`,
|
||||
socks5Listen: `${client.socks5ListenHost}:${client.socks5ListenPort}`,
|
||||
};
|
||||
}
|
||||
return {
|
||||
mode: client.mode,
|
||||
version: client.version,
|
||||
installPath: client.installPath,
|
||||
configPath: client.configPath,
|
||||
unitPath: client.unitPath,
|
||||
serviceName: client.serviceName,
|
||||
listen: `${client.listenHost}:${client.listenPort}`,
|
||||
};
|
||||
}
|
||||
|
||||
function masterProxyTcpHealth(server: HostProxyServer): Record<string, unknown> {
|
||||
const result = runCommand(["bash", "-lc", `timeout 5 bash -lc ${shQuote(`</dev/tcp/${server.health.host}/${server.health.port}`)}`], rootPath(), { timeoutMs: 8_000 });
|
||||
return { ok: result.exitCode === 0, mode: server.health.mode, host: server.health.host, port: server.health.port, result: compactLocalResult(result) };
|
||||
|
||||
Reference in New Issue
Block a user