Codex
784 lines
31 KiB
TypeScript
784 lines
31 KiB
TypeScript
// SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. pk01-public-exposure module for scripts/src/platform-infra.ts.
|
|
|
|
// Moved mechanically from scripts/src/platform-infra.ts:2226-2702 for #903.
|
|
|
|
import { createHash, randomBytes } from "node:crypto";
|
|
import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
|
|
import { dirname, isAbsolute, join } from "node:path";
|
|
import type { UniDeskConfig } from "../config";
|
|
import { rootPath } from "../config";
|
|
import { startJob } from "../jobs";
|
|
import type { RenderedCliResult } from "../output";
|
|
import { pk01CaddyMergeManagedBlocksPython, renderCaddyManagedBlock, renderSimpleReverseProxyCaddySiteBlock } from "../pk01-caddy";
|
|
import { capture, compactCapture, parseJsonOutput, prepareFrpcSecret, shQuote } from "../platform-infra-public-service";
|
|
import { yamlBooleanField, yamlFieldLabel, yamlIntegerField } from "../platform-infra-ops-library";
|
|
import { fingerprintSecretValues, parseEnvFile, readEnvSourceFile, readTextFile, redactRepoPath, requiredEnvValue } from "../secrets";
|
|
|
|
import { sub2apiCaddyManagedMarker } from "./entry";
|
|
import type { EgressProxySubscriptionCandidateSummary, EgressProxySubscriptionDiagnostics, Sub2ApiEgressProxyConfig, Sub2ApiPublicExposureConfig, Sub2ApiTargetConfig } from "./entry";
|
|
import { status } from "./actions";
|
|
import { publicExposureUpstream, renderPk01CaddyService, renderPk01Caddyfile } from "./apply-script";
|
|
import { asRecordOrNull, boolField } from "./utils";
|
|
|
|
export type SubscriptionNode =
|
|
| { kind: "vless-reality"; uri: string; uuid: string; host: string; port: number; sni: string; flow: string | null; fingerprint: string | null; publicKey: string; shortId: string | null }
|
|
| { kind: "hysteria2"; uri: string; password: string; host: string; port: number; sni: string | null; obfsPassword: string | null; insecure: boolean };
|
|
|
|
export function selectSubscriptionNode(nodes: string[], preferred: Exclude<Sub2ApiEgressProxyConfig["preferredOutbound"], null>): SubscriptionNode {
|
|
const analyzed = analyzeEgressProxySubscription(nodes, preferred);
|
|
if (analyzed.selected === null) throw new Error(analyzed.diagnostics.error ?? `egressProxy preferredOutbound=${preferred} is absent from subscription; no fallback outbound was selected`);
|
|
return analyzed.selected;
|
|
}
|
|
|
|
export function analyzeEgressProxySubscription(nodes: string[], preferred: Exclude<Sub2ApiEgressProxyConfig["preferredOutbound"], null>): { diagnostics: EgressProxySubscriptionDiagnostics; selected: SubscriptionNode | null } {
|
|
const parsed = nodes
|
|
.map((uri, index) => ({ uri, sourceLine: index, node: parseSubscriptionNode(uri) }))
|
|
.filter((entry): entry is { uri: string; sourceLine: number; node: SubscriptionNode } => entry.node !== null);
|
|
const selectedEntry = parsed.find((entry) => entry.node.kind === preferred) ?? null;
|
|
const byKind: Record<string, number> = {};
|
|
for (const entry of parsed) byKind[entry.node.kind] = (byKind[entry.node.kind] ?? 0) + 1;
|
|
const candidates = parsed.map((entry): EgressProxySubscriptionCandidateSummary => {
|
|
const fingerprint = fingerprintSecretValues({ candidate: entry.uri }, ["candidate"]);
|
|
return {
|
|
sourceLine: entry.sourceLine,
|
|
kind: entry.node.kind,
|
|
fingerprint,
|
|
paramKeys: subscriptionUriParamKeys(entry.uri),
|
|
selected: selectedEntry !== null && entry.sourceLine === selectedEntry.sourceLine,
|
|
};
|
|
});
|
|
const selectedFingerprint = selectedEntry === null ? null : fingerprintSecretValues({ candidate: selectedEntry.uri }, ["candidate"]);
|
|
const diagnostics: EgressProxySubscriptionDiagnostics = {
|
|
ok: selectedEntry !== null,
|
|
sourceType: "subscription-url",
|
|
preferredOutbound: preferred,
|
|
candidateCount: nodes.length,
|
|
supportedCount: parsed.length,
|
|
unsupportedCount: nodes.length - parsed.length,
|
|
byKind,
|
|
selectedOutbound: selectedEntry?.node.kind ?? null,
|
|
selectedFingerprint,
|
|
candidates,
|
|
valuesPrinted: false,
|
|
};
|
|
if (selectedEntry === null) {
|
|
diagnostics.error = `egressProxy preferredOutbound=${preferred} is absent from subscription; no fallback outbound was selected`;
|
|
}
|
|
return { diagnostics, selected: selectedEntry?.node ?? null };
|
|
}
|
|
|
|
export function subscriptionUriParamKeys(uri: string): string[] {
|
|
try {
|
|
return Array.from(new URL(uri).searchParams.keys()).sort();
|
|
} catch {
|
|
return [];
|
|
}
|
|
}
|
|
|
|
export function parseSubscriptionNode(uri: string): SubscriptionNode | null {
|
|
let url: URL;
|
|
try {
|
|
url = new URL(uri);
|
|
} catch {
|
|
return null;
|
|
}
|
|
if (url.protocol === "vless:") {
|
|
const params = url.searchParams;
|
|
if (params.get("security") !== "reality") return null;
|
|
const publicKey = params.get("pbk");
|
|
if (publicKey === null || publicKey.length === 0) return null;
|
|
return {
|
|
kind: "vless-reality",
|
|
uri,
|
|
uuid: decodeURIComponent(url.username),
|
|
host: requiredUrlHost(url, uri),
|
|
port: requiredUrlPort(url, uri),
|
|
sni: params.get("sni") ?? "",
|
|
flow: params.get("flow"),
|
|
fingerprint: params.get("fp"),
|
|
publicKey,
|
|
shortId: params.get("sid"),
|
|
};
|
|
}
|
|
if (url.protocol === "hysteria2:" || url.protocol === "hy2:") {
|
|
const params = url.searchParams;
|
|
return {
|
|
kind: "hysteria2",
|
|
uri,
|
|
password: decodeURIComponent(url.username),
|
|
host: requiredUrlHost(url, uri),
|
|
port: requiredUrlPort(url, uri),
|
|
sni: params.get("sni"),
|
|
obfsPassword: params.get("obfs-password"),
|
|
insecure: params.get("insecure") === "1" || params.get("insecure") === "true",
|
|
};
|
|
}
|
|
return null;
|
|
}
|
|
|
|
export function requiredUrlHost(url: URL, uri: string): string {
|
|
if (url.hostname.length === 0) throw new Error(`VPN subscription node is missing host: ${redactSubscriptionUri(uri)}`);
|
|
return url.hostname;
|
|
}
|
|
|
|
export function requiredUrlPort(url: URL, uri: string): number {
|
|
const port = Number(url.port);
|
|
if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error(`VPN subscription node is missing a valid port: ${redactSubscriptionUri(uri)}`);
|
|
return port;
|
|
}
|
|
|
|
export function renderSingBoxConfig(node: SubscriptionNode, proxy: Sub2ApiEgressProxyConfig): string {
|
|
const outbound = node.kind === "vless-reality"
|
|
? {
|
|
type: "vless",
|
|
tag: "master-vpn",
|
|
server: node.host,
|
|
server_port: node.port,
|
|
uuid: node.uuid,
|
|
flow: node.flow ?? undefined,
|
|
tls: {
|
|
enabled: true,
|
|
server_name: node.sni,
|
|
utls: { enabled: true, fingerprint: node.fingerprint ?? "chrome" },
|
|
reality: { enabled: true, public_key: node.publicKey, short_id: node.shortId ?? "" },
|
|
},
|
|
}
|
|
: {
|
|
type: "hysteria2",
|
|
tag: "master-vpn",
|
|
server: node.host,
|
|
server_port: node.port,
|
|
password: node.password,
|
|
obfs: node.obfsPassword === null ? undefined : { type: "salamander", password: node.obfsPassword },
|
|
tls: { enabled: true, server_name: node.sni ?? node.host, insecure: node.insecure },
|
|
};
|
|
return renderSingBoxProxyConfig(outbound, proxy);
|
|
}
|
|
|
|
export function renderSingBoxMasterShadowsocksConfig(proxy: Sub2ApiEgressProxyConfig, password: string): string {
|
|
const shadowsocks = proxy.masterShadowsocks;
|
|
if (shadowsocks === null) throw new Error("masterShadowsocks config is required");
|
|
return renderSingBoxProxyConfig({
|
|
type: "shadowsocks",
|
|
tag: "master-vpn",
|
|
server: shadowsocks.serverHost,
|
|
server_port: shadowsocks.serverPort,
|
|
method: shadowsocks.method,
|
|
password,
|
|
}, proxy);
|
|
}
|
|
|
|
export function renderSingBoxProxyConfig(outbound: Record<string, unknown>, proxy: Sub2ApiEgressProxyConfig): string {
|
|
const config = stripUndefined({
|
|
log: { level: "info", timestamp: true },
|
|
experimental: {
|
|
clash_api: {
|
|
external_controller: "127.0.0.1:9090",
|
|
},
|
|
},
|
|
inbounds: [
|
|
{
|
|
type: "mixed",
|
|
tag: "mixed-in",
|
|
listen: "0.0.0.0",
|
|
listen_port: proxy.listenPort,
|
|
},
|
|
],
|
|
outbounds: [
|
|
outbound,
|
|
{ type: "direct", tag: "direct" },
|
|
{ type: "block", tag: "block" },
|
|
],
|
|
route: {
|
|
rules: [
|
|
{ ip_is_private: true, outbound: "direct" },
|
|
{ domain_suffix: ["cluster.local", "svc"], outbound: "direct" },
|
|
],
|
|
final: "master-vpn",
|
|
},
|
|
});
|
|
return `${JSON.stringify(config, null, 2)}\n`;
|
|
}
|
|
|
|
export function stripUndefined(value: unknown): unknown {
|
|
if (Array.isArray(value)) return value.map(stripUndefined);
|
|
if (value !== null && typeof value === "object") {
|
|
const output: Record<string, unknown> = {};
|
|
for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
|
|
if (child !== undefined) output[key] = stripUndefined(child);
|
|
}
|
|
return output;
|
|
}
|
|
return value;
|
|
}
|
|
|
|
export function redactSubscriptionUri(uri: string): string {
|
|
return uri.replace(/\/\/[^@]+@/u, "//<redacted>@").replace(/password=[^&#]+/giu, "password=<redacted>").replace(/pbk=[^&#]+/giu, "pbk=<redacted>");
|
|
}
|
|
|
|
export async function applyPk01PublicExposure(config: UniDeskConfig, target: Sub2ApiTargetConfig): Promise<Record<string, unknown>> {
|
|
const exposure = target.publicExposure;
|
|
if (exposure === null) return { ok: true, action: "not-configured" };
|
|
if (!exposure.enabled) return await removePk01PublicExposure(config, target, exposure);
|
|
const start = await startPk01PublicExposureJob(config, target, exposure);
|
|
if (!start.ok || typeof start.remoteJobId !== "string") {
|
|
return {
|
|
ok: false,
|
|
action: "platform-infra-sub2api-pk01-public-exposure",
|
|
route: exposure.pk01.route,
|
|
mode: "remote-job-start-failed",
|
|
remoteJob: start,
|
|
};
|
|
}
|
|
const waited = await waitPk01PublicExposureJob(config, exposure, start.remoteJobId);
|
|
const terminal = asRecordOrNull(waited.terminal);
|
|
const summary = asRecordOrNull(terminal?.summary);
|
|
return {
|
|
ok: waited.ok === true && boolField(summary, "ok", false),
|
|
action: "platform-infra-sub2api-pk01-public-exposure",
|
|
route: exposure.pk01.route,
|
|
mode: "remote-job",
|
|
summary,
|
|
remoteJob: {
|
|
start,
|
|
waited,
|
|
},
|
|
};
|
|
}
|
|
|
|
export async function removePk01PublicExposure(config: UniDeskConfig, target: Sub2ApiTargetConfig, exposure: Sub2ApiPublicExposureConfig): Promise<Record<string, unknown>> {
|
|
const marker = sub2apiCaddyManagedMarker(target);
|
|
const script = `
|
|
set -u
|
|
tmp="$(mktemp -d)"
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
config_path=${shQuote(exposure.pk01.caddyConfigPath)}
|
|
service_name=${shQuote(exposure.pk01.caddyServiceName)}
|
|
marker=${shQuote(marker)}
|
|
hostname=${shQuote(exposure.dns.hostname)}
|
|
next="$tmp/Caddyfile.next"
|
|
update_out="$tmp/update.out"
|
|
update_err="$tmp/update.err"
|
|
fmt_out="$tmp/fmt.out"
|
|
fmt_err="$tmp/fmt.err"
|
|
validate_out="$tmp/validate.out"
|
|
validate_err="$tmp/validate.err"
|
|
install_out="$tmp/install.out"
|
|
install_err="$tmp/install.err"
|
|
reload_out="$tmp/reload.out"
|
|
reload_err="$tmp/reload.err"
|
|
if ! [ -f "$config_path" ]; then
|
|
python3 - "$config_path" "$marker" "$hostname" <<'PY'
|
|
import json
|
|
import sys
|
|
print(json.dumps({
|
|
"ok": True,
|
|
"action": "caddy-config-missing-noop",
|
|
"configPath": sys.argv[1],
|
|
"marker": sys.argv[2],
|
|
"hostname": sys.argv[3],
|
|
"valuesPrinted": False,
|
|
}, ensure_ascii=False, indent=2))
|
|
PY
|
|
exit 0
|
|
fi
|
|
sudo python3 - "$config_path" "$next" "$marker" >"$update_out" 2>"$update_err" <<'PY'
|
|
import pathlib
|
|
import re
|
|
import sys
|
|
|
|
config_path = pathlib.Path(sys.argv[1])
|
|
next_path = pathlib.Path(sys.argv[2])
|
|
marker = sys.argv[3]
|
|
text = config_path.read_text(encoding="utf-8")
|
|
pattern = re.compile(r"(?ms)^# BEGIN unidesk managed (?P<name>[^\\n]+)\\n(?P<body>.*?)\\n# END unidesk managed (?P=name)\\n*")
|
|
removed = False
|
|
|
|
def replace(match):
|
|
global removed
|
|
if match.group("name") != marker:
|
|
return match.group(0)
|
|
removed = True
|
|
return ""
|
|
|
|
next_text = pattern.sub(replace, text)
|
|
next_text = re.sub(r"\\n{3,}", "\\n\\n", next_text).rstrip() + "\\n"
|
|
next_path.write_text(next_text, encoding="utf-8")
|
|
print("removed" if removed else "absent")
|
|
PY
|
|
update_rc=$?
|
|
if [ "$update_rc" -eq 0 ]; then
|
|
sudo caddy fmt --overwrite "$next" >"$fmt_out" 2>"$fmt_err"
|
|
fmt_rc=$?
|
|
else
|
|
: >"$fmt_out"; : >"$fmt_err"; fmt_rc=1
|
|
fi
|
|
if [ "$fmt_rc" -eq 0 ]; then
|
|
sudo caddy validate --config "$next" >"$validate_out" 2>"$validate_err"
|
|
validate_rc=$?
|
|
else
|
|
: >"$validate_out"; : >"$validate_err"; validate_rc=1
|
|
fi
|
|
if [ "$validate_rc" -eq 0 ]; then
|
|
sudo install -m 0644 "$next" "$config_path" >"$install_out" 2>"$install_err"
|
|
install_rc=$?
|
|
else
|
|
: >"$install_out"; : >"$install_err"; install_rc=1
|
|
fi
|
|
if [ "$install_rc" -eq 0 ]; then
|
|
sudo systemctl reload "$service_name" >"$reload_out" 2>"$reload_err" || sudo systemctl restart "$service_name" >>"$reload_out" 2>>"$reload_err"
|
|
reload_rc=$?
|
|
else
|
|
: >"$reload_out"; : >"$reload_err"; reload_rc=1
|
|
fi
|
|
python3 - "$update_rc" "$fmt_rc" "$validate_rc" "$install_rc" "$reload_rc" "$config_path" "$marker" "$hostname" "$update_out" "$update_err" "$fmt_out" "$fmt_err" "$validate_out" "$validate_err" "$install_out" "$install_err" "$reload_out" "$reload_err" <<'PY'
|
|
import json
|
|
import sys
|
|
|
|
update_rc, fmt_rc, validate_rc, install_rc, reload_rc = [int(value) for value in sys.argv[1:6]]
|
|
config_path, marker, hostname = sys.argv[6:9]
|
|
paths = sys.argv[9:]
|
|
|
|
def text(path, limit=3000):
|
|
try:
|
|
return open(path, encoding="utf-8", errors="replace").read()[-limit:]
|
|
except FileNotFoundError:
|
|
return ""
|
|
|
|
update_stdout = text(paths[0], 1000).strip()
|
|
payload = {
|
|
"ok": update_rc == 0 and fmt_rc == 0 and validate_rc == 0 and install_rc == 0 and reload_rc == 0,
|
|
"action": "removed-managed-block" if update_stdout == "removed" else "managed-block-absent",
|
|
"target": "${target.id}",
|
|
"publicBaseUrl": "${exposure.publicBaseUrl}",
|
|
"hostname": hostname,
|
|
"configPath": config_path,
|
|
"managedBlock": {"marker": marker},
|
|
"steps": {
|
|
"update": {"exitCode": update_rc, "stdout": update_stdout, "stderr": text(paths[1])},
|
|
"fmt": {"exitCode": fmt_rc, "stdout": text(paths[2]), "stderr": text(paths[3])},
|
|
"validate": {"exitCode": validate_rc, "stdout": text(paths[4]), "stderr": text(paths[5])},
|
|
"install": {"exitCode": install_rc, "stdout": text(paths[6]), "stderr": text(paths[7])},
|
|
"reload": {"exitCode": reload_rc, "stdout": text(paths[8]), "stderr": text(paths[9])},
|
|
},
|
|
"valuesPrinted": False,
|
|
}
|
|
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
|
sys.exit(0 if payload["ok"] else 1)
|
|
PY
|
|
`;
|
|
const result = await capture(config, exposure.pk01.route, ["sh"], script);
|
|
const parsed = parseJsonOutput(result.stdout);
|
|
return {
|
|
ok: result.exitCode === 0 && boolField(parsed, "ok", false),
|
|
action: "platform-infra-sub2api-pk01-public-exposure",
|
|
route: exposure.pk01.route,
|
|
mode: "remove-disabled-managed-block",
|
|
summary: parsed ?? null,
|
|
capture: compactCapture(result, { full: result.exitCode !== 0 }),
|
|
};
|
|
}
|
|
|
|
export async function startPk01PublicExposureJob(config: UniDeskConfig, target: Sub2ApiTargetConfig, exposure: Sub2ApiPublicExposureConfig): Promise<Record<string, unknown>> {
|
|
const jobId = `sub2api-pk01-exposure-${new Date().toISOString().replace(/[^0-9A-Za-z]/gu, "")}-${randomBytes(3).toString("hex")}`;
|
|
const payload = pk01PublicExposureScript(target, exposure);
|
|
const payloadB64 = Buffer.from(payload, "utf8").toString("base64");
|
|
const script = `
|
|
set -eu
|
|
job_id=${shQuote(jobId)}
|
|
base="$HOME/.unidesk/platform-infra/sub2api-pk01-exposure/jobs"
|
|
job_dir="$base/$job_id"
|
|
mkdir -p "$job_dir"
|
|
payload="$job_dir/payload.sh"
|
|
runner="$job_dir/runner.sh"
|
|
stdout="$job_dir/stdout.log"
|
|
stderr="$job_dir/stderr.log"
|
|
state="$job_dir/state.json"
|
|
printf '%s' '${payloadB64}' | base64 -d >"$payload"
|
|
chmod 0700 "$payload"
|
|
cat >"$runner" <<'RUNNER'
|
|
#!/bin/sh
|
|
set +e
|
|
job_dir="$1"
|
|
payload="$job_dir/payload.sh"
|
|
stdout="$job_dir/stdout.log"
|
|
stderr="$job_dir/stderr.log"
|
|
state="$job_dir/state.json"
|
|
write_state() {
|
|
status="$1"
|
|
stage="$2"
|
|
exit_code="$3"
|
|
python3 - "$state" "$status" "$stage" "$exit_code" <<'PY'
|
|
import datetime
|
|
import json
|
|
import sys
|
|
|
|
path, status, stage, exit_code = sys.argv[1:5]
|
|
payload = {
|
|
"ok": status == "succeeded",
|
|
"status": status,
|
|
"stage": stage,
|
|
"updatedAt": datetime.datetime.now(datetime.timezone.utc).isoformat(),
|
|
"exitCode": None if exit_code == "" else int(exit_code),
|
|
}
|
|
if status in ("succeeded", "failed"):
|
|
payload["finishedAt"] = payload["updatedAt"]
|
|
with open(path, "w", encoding="utf-8") as handle:
|
|
json.dump(payload, handle, ensure_ascii=False)
|
|
PY
|
|
}
|
|
write_state running start ""
|
|
sh "$payload" >"$stdout" 2>"$stderr"
|
|
rc=$?
|
|
if [ "$rc" -eq 0 ]; then
|
|
write_state succeeded complete "$rc"
|
|
else
|
|
write_state failed complete "$rc"
|
|
fi
|
|
exit "$rc"
|
|
RUNNER
|
|
chmod 0700 "$runner"
|
|
python3 - "$state" <<'PY'
|
|
import datetime
|
|
import json
|
|
import sys
|
|
|
|
payload = {
|
|
"ok": False,
|
|
"status": "queued",
|
|
"stage": "queued",
|
|
"updatedAt": datetime.datetime.now(datetime.timezone.utc).isoformat(),
|
|
"exitCode": None,
|
|
}
|
|
with open(sys.argv[1], "w", encoding="utf-8") as handle:
|
|
json.dump(payload, handle, ensure_ascii=False)
|
|
PY
|
|
nohup "$runner" "$job_dir" >/dev/null 2>&1 &
|
|
printf '%s' "$!" >"$job_dir/pid"
|
|
python3 - "$job_id" "$job_dir" <<'PY'
|
|
import json
|
|
import os
|
|
import sys
|
|
|
|
job_id, job_dir = sys.argv[1:3]
|
|
payload = {
|
|
"ok": True,
|
|
"remoteJobId": job_id,
|
|
"statePath": os.path.join(job_dir, "state.json"),
|
|
"stdoutPath": os.path.join(job_dir, "stdout.log"),
|
|
"stderrPath": os.path.join(job_dir, "stderr.log"),
|
|
"valuesPrinted": False,
|
|
}
|
|
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
|
PY
|
|
`;
|
|
const result = await capture(config, exposure.pk01.route, ["sh"], script);
|
|
const parsed = parseJsonOutput(result.stdout);
|
|
return {
|
|
ok: result.exitCode === 0 && boolField(parsed, "ok", false),
|
|
remoteJobId: typeof parsed?.remoteJobId === "string" ? parsed.remoteJobId : null,
|
|
parsed,
|
|
capture: compactCapture(result, { full: result.exitCode !== 0 }),
|
|
};
|
|
}
|
|
|
|
export async function waitPk01PublicExposureJob(config: UniDeskConfig, exposure: Sub2ApiPublicExposureConfig, remoteJobId: string): Promise<Record<string, unknown>> {
|
|
const observations: Array<Record<string, unknown>> = [];
|
|
const maxPolls = 120;
|
|
let lastProgressKey: string | null = null;
|
|
for (let attempt = 0; attempt < maxPolls; attempt += 1) {
|
|
const observation = await readPk01PublicExposureJob(config, exposure, remoteJobId);
|
|
observations.push(observation.summary);
|
|
const statusValue = observation.status;
|
|
const stage = typeof observation.summary.stage === "string" ? observation.summary.stage : null;
|
|
const progressKey = `${statusValue ?? "unknown"}:${stage ?? "unknown"}`;
|
|
if (attempt === 0 || progressKey !== lastProgressKey || attempt % 6 === 0 || statusValue === "succeeded" || statusValue === "failed") {
|
|
lastProgressKey = progressKey;
|
|
console.error(JSON.stringify({
|
|
event: "platform-infra.sub2api.pk01-exposure.progress",
|
|
at: new Date().toISOString(),
|
|
remoteJobId,
|
|
attempt: attempt + 1,
|
|
status: statusValue,
|
|
stage,
|
|
exitCode: observation.summary.exitCode ?? null,
|
|
}));
|
|
}
|
|
if (statusValue === "succeeded" || statusValue === "failed") {
|
|
return {
|
|
ok: statusValue === "succeeded" && boolField(asRecordOrNull(observation.summary.summary), "ok", false),
|
|
attempts: attempt + 1,
|
|
terminal: observation.summary,
|
|
recent: observations.slice(-10),
|
|
};
|
|
}
|
|
await Bun.sleep(5000);
|
|
}
|
|
return {
|
|
ok: false,
|
|
attempts: maxPolls,
|
|
terminal: null,
|
|
recent: observations.slice(-10),
|
|
error: "PK01 public exposure job did not finish before local polling budget",
|
|
};
|
|
}
|
|
|
|
export async function readPk01PublicExposureJob(config: UniDeskConfig, exposure: Sub2ApiPublicExposureConfig, remoteJobId: string): Promise<{ status: string | null; summary: Record<string, unknown> }> {
|
|
const safeId = remoteJobId.replace(/[^A-Za-z0-9_.-]/gu, "");
|
|
const script = `
|
|
set +e
|
|
job_dir="$HOME/.unidesk/platform-infra/sub2api-pk01-exposure/jobs/${safeId}"
|
|
state="$job_dir/state.json"
|
|
stdout="$job_dir/stdout.log"
|
|
stderr="$job_dir/stderr.log"
|
|
if [ -f "$state" ]; then cat "$state"; else printf '{"status":"missing","stage":"missing","exitCode":null}'; fi
|
|
printf '\\n---STDOUT---\\n'
|
|
if [ -f "$stdout" ]; then tail -200 "$stdout"; fi
|
|
printf '\\n---STDERR---\\n'
|
|
if [ -f "$stderr" ]; then tail -120 "$stderr"; fi
|
|
printf '\\n---DOWNLOAD---\\n'
|
|
download_part="$HOME/.cache/unidesk/platform-infra/caddy-linux-amd64.part"
|
|
download_cache="$HOME/.cache/unidesk/platform-infra/caddy-linux-amd64"
|
|
if [ -f "$download_part" ]; then stat -c 'part_bytes=%s part_mtime=%y' "$download_part"; fi
|
|
if [ -f "$download_cache" ]; then stat -c 'cache_bytes=%s cache_mtime=%y' "$download_cache"; fi
|
|
`;
|
|
const result = await capture(config, exposure.pk01.route, ["sh"], script);
|
|
const [stateText, rest = ""] = result.stdout.split("\n---STDOUT---\n");
|
|
const [stdoutAndMaybeStderr = "", downloadProgress = ""] = rest.split("\n---DOWNLOAD---\n");
|
|
const [stdoutTail = "", stderrTail = ""] = stdoutAndMaybeStderr.split("\n---STDERR---\n");
|
|
const parsed = parseJsonOutput(stateText) ?? {};
|
|
const statusValue = typeof parsed.status === "string" ? parsed.status : null;
|
|
const summary = parseJsonOutput(stdoutTail);
|
|
return {
|
|
status: statusValue,
|
|
summary: {
|
|
ok: result.exitCode === 0,
|
|
remoteJobId,
|
|
status: statusValue,
|
|
stage: parsed.stage ?? null,
|
|
updatedAt: parsed.updatedAt ?? null,
|
|
finishedAt: parsed.finishedAt ?? null,
|
|
exitCode: parsed.exitCode ?? null,
|
|
summary,
|
|
stdoutTail: stdoutTail.slice(-8000),
|
|
stderrTail: stderrTail.slice(-4000),
|
|
downloadProgress: downloadProgress.slice(-1000),
|
|
capture: compactCapture(result, { full: result.exitCode !== 0 }),
|
|
},
|
|
};
|
|
}
|
|
|
|
export function pk01PublicExposureScript(target: Sub2ApiTargetConfig, exposure: Sub2ApiPublicExposureConfig): string {
|
|
const caddyfile = renderPk01Caddyfile(target, exposure);
|
|
const serviceUnit = renderPk01CaddyService(exposure);
|
|
const exposureMode = exposure.mode === "pk01-local" ? "pk01-caddy-local-docker" : "pk01-caddy-frp-direct";
|
|
const dataPath = exposure.mode === "pk01-local"
|
|
? `client -> PK01 Caddy -> ${publicExposureUpstream(target, exposure)} -> PK01 Docker Sub2API`
|
|
: `client -> PK01 Caddy -> PK01 frps remotePort -> ${target.id} frpc -> Sub2API`;
|
|
const frpSummary = exposure.mode === "frp" && exposure.frpc !== null
|
|
? {
|
|
server: `${exposure.frpc.serverAddr}:${exposure.frpc.serverPort}`,
|
|
remotePort: exposure.frpc.remotePort,
|
|
proxyName: exposure.frpc.proxyName,
|
|
}
|
|
: null;
|
|
const frpSummaryPython = frpSummary === null ? "None" : `json.loads(${JSON.stringify(JSON.stringify(frpSummary))})`;
|
|
const caddyfileB64 = Buffer.from(caddyfile, "utf8").toString("base64");
|
|
const serviceUnitB64 = Buffer.from(serviceUnit, "utf8").toString("base64");
|
|
const caddyDownloadProxyArgs = exposure.pk01.caddyDownloadProxyUrl === null ? "" : `--proxy ${shQuote(exposure.pk01.caddyDownloadProxyUrl)}`;
|
|
const caddyDownloadProxyUrl = exposure.pk01.caddyDownloadProxyUrl ?? "";
|
|
return `
|
|
set -u
|
|
tmp="$(mktemp -d)"
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
caddyfile="$tmp/Caddyfile"
|
|
service_unit="$tmp/${exposure.pk01.caddyServiceName}.service"
|
|
printf '%s' '${caddyfileB64}' | base64 -d >"$caddyfile"
|
|
printf '%s' '${serviceUnitB64}' | base64 -d >"$service_unit"
|
|
download_out="$tmp/download.out"
|
|
download_err="$tmp/download.err"
|
|
install_out="$tmp/install.out"
|
|
install_err="$tmp/install.err"
|
|
validate_out="$tmp/validate.out"
|
|
validate_err="$tmp/validate.err"
|
|
pikanode_out="$tmp/pikanode.out"
|
|
pikanode_err="$tmp/pikanode.err"
|
|
caddy_out="$tmp/caddy.out"
|
|
caddy_err="$tmp/caddy.err"
|
|
probe_out="$tmp/probe.out"
|
|
probe_err="$tmp/probe.err"
|
|
download_action="kept-existing"
|
|
download_proxy_url=${shQuote(caddyDownloadProxyUrl)}
|
|
download_proxy_mode="direct"
|
|
if [ -n "$download_proxy_url" ]; then download_proxy_mode="curl-proxy"; fi
|
|
download_rc=0
|
|
if ! [ -x ${shQuote(exposure.pk01.caddyBinaryPath)} ]; then
|
|
cache_dir="$HOME/.cache/unidesk/platform-infra"
|
|
cache_path="$cache_dir/caddy-linux-amd64"
|
|
cache_part="$cache_path.part"
|
|
mkdir -p "$cache_dir"
|
|
if [ -x "$cache_path" ]; then
|
|
download_action="used-cache"
|
|
"$cache_path" version >"$download_out" 2>"$download_err" || true
|
|
else
|
|
download_action="downloaded"
|
|
resume_args=
|
|
if [ -s "$cache_part" ]; then resume_args="-C -"; fi
|
|
curl -fL --connect-timeout 20 --retry 5 --retry-delay 3 --max-time 600 ${caddyDownloadProxyArgs} $resume_args ${shQuote(exposure.pk01.caddyDownloadUrl)} -o "$cache_part" >"$download_out" 2>"$download_err"
|
|
download_rc=$?
|
|
if [ "$download_rc" -eq 33 ]; then
|
|
rm -f "$cache_part"
|
|
curl -fL --connect-timeout 20 --retry 5 --retry-delay 3 --max-time 600 ${caddyDownloadProxyArgs} ${shQuote(exposure.pk01.caddyDownloadUrl)} -o "$cache_part" >>"$download_out" 2>>"$download_err"
|
|
download_rc=$?
|
|
fi
|
|
if [ "$download_rc" -eq 0 ]; then
|
|
mv "$cache_part" "$cache_path"
|
|
chmod 0755 "$cache_path"
|
|
fi
|
|
fi
|
|
if [ "$download_rc" -eq 0 ]; then
|
|
sudo install -m 0755 "$cache_path" ${shQuote(exposure.pk01.caddyBinaryPath)} >>"$download_out" 2>>"$download_err"
|
|
download_rc=$?
|
|
fi
|
|
else
|
|
rm -f "$HOME/.cache/unidesk/platform-infra/caddy-linux-amd64.part"
|
|
${shQuote(exposure.pk01.caddyBinaryPath)} version >"$download_out" 2>"$download_err" || true
|
|
fi
|
|
install_rc=1
|
|
if [ "$download_rc" -eq 0 ]; then
|
|
sudo mkdir -p "$(dirname ${shQuote(exposure.pk01.caddyConfigPath)})" ${shQuote(exposure.pk01.caddyStorageDir)} /etc/systemd/system
|
|
merged_caddyfile="$tmp/Caddyfile.merged"
|
|
sudo python3 - "$caddyfile" ${shQuote(exposure.pk01.caddyConfigPath)} "$merged_caddyfile" ${shQuote(exposure.dns.hostname)} >"$install_out" 2>"$install_err" <<'PY'
|
|
${pk01CaddyMergeManagedBlocksPython()}
|
|
PY
|
|
install_rc=$?
|
|
if [ "$install_rc" -eq 0 ]; then
|
|
sudo install -m 0644 "$merged_caddyfile" ${shQuote(exposure.pk01.caddyConfigPath)} >>"$install_out" 2>>"$install_err"
|
|
install_rc=$?
|
|
fi
|
|
if [ "$install_rc" -eq 0 ]; then
|
|
sudo install -m 0644 "$service_unit" /etc/systemd/system/${exposure.pk01.caddyServiceName}.service >>"$install_out" 2>>"$install_err"
|
|
install_rc=$?
|
|
fi
|
|
fi
|
|
validate_rc=1
|
|
if [ "$install_rc" -eq 0 ]; then
|
|
sudo ${shQuote(exposure.pk01.caddyBinaryPath)} validate --config ${shQuote(exposure.pk01.caddyConfigPath)} >"$validate_out" 2>"$validate_err"
|
|
validate_rc=$?
|
|
else
|
|
: >"$validate_out"
|
|
: >"$validate_err"
|
|
fi
|
|
pikanode_rc=1
|
|
if [ "$validate_rc" -eq 0 ]; then
|
|
if docker inspect ${shQuote(exposure.pk01.pikanodeContainerName)} >/dev/null 2>&1; then
|
|
docker rm -f ${shQuote(exposure.pk01.pikanodeContainerName)} >"$pikanode_out" 2>"$pikanode_err"
|
|
pikanode_rc=$?
|
|
else
|
|
: >"$pikanode_out"
|
|
: >"$pikanode_err"
|
|
pikanode_rc=0
|
|
fi
|
|
if [ "$pikanode_rc" -eq 0 ]; then
|
|
docker run -d --name ${shQuote(exposure.pk01.pikanodeContainerName)} \\
|
|
--restart=always \\
|
|
-p 127.0.0.1:${exposure.pk01.pikanodeHttpHostPort}:8888 \\
|
|
-p 22000-22099:22000-22099 \\
|
|
-p 7500:7500 \\
|
|
-v ${shQuote(exposure.pk01.pikanodeRoot)}:/usr/src/app \\
|
|
-v /etc/letsencrypt:/etc/letsencrypt:ro \\
|
|
-w /usr/src/app \\
|
|
${shQuote(exposure.pk01.pikanodeImage)} \\
|
|
sh init.sh >>"$pikanode_out" 2>>"$pikanode_err"
|
|
pikanode_rc=$?
|
|
if [ "$pikanode_rc" -ne 0 ]; then
|
|
printf '%s\\n' '[rollback] restarting pikanode with previous public 80/443 mapping' >>"$pikanode_err"
|
|
docker rm -f ${shQuote(exposure.pk01.pikanodeContainerName)} >>"$pikanode_out" 2>>"$pikanode_err" || true
|
|
docker run -d --name ${shQuote(exposure.pk01.pikanodeContainerName)} \\
|
|
--restart=always \\
|
|
-p 80:8888 \\
|
|
-p 22000-22099:22000-22099 \\
|
|
-p 443:443 \\
|
|
-p 7500:7500 \\
|
|
-v ${shQuote(exposure.pk01.pikanodeRoot)}:/usr/src/app \\
|
|
-v /etc/letsencrypt:/etc/letsencrypt:ro \\
|
|
-w /usr/src/app \\
|
|
${shQuote(exposure.pk01.pikanodeImage)} \\
|
|
sh init.sh >>"$pikanode_out" 2>>"$pikanode_err" || true
|
|
fi
|
|
fi
|
|
else
|
|
: >"$pikanode_out"
|
|
: >"$pikanode_err"
|
|
fi
|
|
caddy_rc=1
|
|
if [ "$pikanode_rc" -eq 0 ]; then
|
|
sudo systemctl daemon-reload >"$caddy_out" 2>"$caddy_err"
|
|
sudo systemctl enable --now ${shQuote(exposure.pk01.caddyServiceName)} >>"$caddy_out" 2>>"$caddy_err"
|
|
caddy_rc=$?
|
|
if [ "$caddy_rc" -eq 0 ]; then
|
|
sudo systemctl reload ${shQuote(exposure.pk01.caddyServiceName)} >>"$caddy_out" 2>>"$caddy_err" || sudo systemctl restart ${shQuote(exposure.pk01.caddyServiceName)} >>"$caddy_out" 2>>"$caddy_err"
|
|
caddy_rc=$?
|
|
fi
|
|
fi
|
|
probe_rc=1
|
|
if [ "$caddy_rc" -eq 0 ]; then
|
|
{
|
|
printf '[pikanode]\\n'
|
|
curl -kfsS --max-time 10 --resolve pikapython.com:443:127.0.0.1 https://pikapython.com/ -o /dev/null -w 'status=%{http_code}\\n'
|
|
printf '[api-health]\\n'
|
|
curl -kfsS --max-time 10 --resolve ${exposure.dns.hostname}:443:127.0.0.1 ${exposure.publicBaseUrl}/health -o /dev/null -w 'status=%{http_code}\\n' || true
|
|
} >"$probe_out" 2>"$probe_err"
|
|
probe_rc=0
|
|
else
|
|
: >"$probe_out"
|
|
: >"$probe_err"
|
|
fi
|
|
python3 - "$download_rc" "$install_rc" "$validate_rc" "$pikanode_rc" "$caddy_rc" "$probe_rc" "$download_action" "$download_proxy_mode" "$download_proxy_url" "$download_out" "$download_err" "$install_out" "$install_err" "$validate_out" "$validate_err" "$pikanode_out" "$pikanode_err" "$caddy_out" "$caddy_err" "$probe_out" "$probe_err" <<'PY'
|
|
import json
|
|
import sys
|
|
|
|
download_rc, install_rc, validate_rc, pikanode_rc, caddy_rc, probe_rc = [int(value) for value in sys.argv[1:7]]
|
|
download_action = sys.argv[7]
|
|
download_proxy_mode = sys.argv[8]
|
|
download_proxy_url = sys.argv[9] or None
|
|
paths = sys.argv[10:]
|
|
|
|
def text(path, limit=4000):
|
|
try:
|
|
return open(path, encoding="utf-8", errors="replace").read()[-limit:]
|
|
except FileNotFoundError:
|
|
return ""
|
|
|
|
payload = {
|
|
"ok": download_rc == 0 and install_rc == 0 and validate_rc == 0 and pikanode_rc == 0 and caddy_rc == 0,
|
|
"target": "${target.id}",
|
|
"mode": ${JSON.stringify(exposureMode)},
|
|
"publicBaseUrl": "${exposure.publicBaseUrl}",
|
|
"hostname": "${exposure.dns.hostname}",
|
|
"expectedA": "${exposure.dns.expectedA}",
|
|
"dataPath": ${JSON.stringify(dataPath)},
|
|
"pikanodeRole": "pikapython.com upstream only; ${exposure.dns.hostname} does not pass through pikanode Express",
|
|
"caddy": {
|
|
"binaryPath": "${exposure.pk01.caddyBinaryPath}",
|
|
"configPath": "${exposure.pk01.caddyConfigPath}",
|
|
"serviceName": "${exposure.pk01.caddyServiceName}",
|
|
"downloadProxy": {"mode": download_proxy_mode, "url": download_proxy_url or None},
|
|
},
|
|
"frp": ${frpSummaryPython},
|
|
"steps": {
|
|
"downloadCaddy": {"exitCode": download_rc, "action": download_action, "stdout": text(paths[0]), "stderr": text(paths[1])},
|
|
"installConfig": {"exitCode": install_rc, "stdout": text(paths[2]), "stderr": text(paths[3])},
|
|
"validateCaddyConfig": {"exitCode": validate_rc, "stdout": text(paths[4]), "stderr": text(paths[5])},
|
|
"restartPikanodeLoopback": {"exitCode": pikanode_rc, "stdout": text(paths[6]), "stderr": text(paths[7])},
|
|
"startCaddy": {"exitCode": caddy_rc, "stdout": text(paths[8]), "stderr": text(paths[9])},
|
|
"localProbe": {"exitCode": probe_rc, "stdout": text(paths[10]), "stderr": text(paths[11])},
|
|
},
|
|
"valuesPrinted": False,
|
|
}
|
|
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
|
sys.exit(0 if payload["ok"] else 1)
|
|
PY
|
|
`;
|
|
}
|