116 lines
5.0 KiB
Bash
116 lines
5.0 KiB
Bash
#!/bin/bash
|
||
# ═══════════════════════════════════════════════
|
||
# 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001
|
||
# 📜 Copyright: 国作登字-2026-A-00037559
|
||
# ═══════════════════════════════════════════════
|
||
# server/proxy/setup/install-xray.sh
|
||
# 🌐 Xray-core安装 + BBR加速 + 防火墙配置
|
||
#
|
||
# 在SG服务器(ZY-SVR-002)上执行
|
||
# 安装Xray-core并启用BBR TCP加速
|
||
#
|
||
# 用法: bash install-xray.sh
|
||
# ═══════════════════════════════════════════════
|
||
|
||
set -uo pipefail
|
||
# 注意: 不使用 set -e，手动处理关键步骤错误
|
||
|
||
echo "════════════════════════════════════════"
|
||
echo "🌐 铸渊专线 · Xray-core 安装"
|
||
echo "════════════════════════════════════════"
|
||
|
||
# ── 1. 系统更新 ──────────────────────────────
|
||
echo "[1/6] 系统更新..."
|
||
apt-get update -y || { echo "❌ apt-get update 失败"; exit 1; }
|
||
apt-get upgrade -y || echo "⚠️ apt-get upgrade 部分失败，继续安装"
|
||
|
||
# ── 2. 安装Xray-core ────────────────────────
|
||
echo "[2/6] 安装Xray-core..."
|
||
if command -v xray &>/dev/null; then
|
||
echo " Xray已安装: $(xray version | head -1)"
|
||
else
|
||
# 使用XTLS官方安装脚本 (https://github.com/XTLS/Xray-install)
|
||
# 安装脚本自带GPG签名验证，确保二进制完整性
|
||
bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
|
||
if command -v xray &>/dev/null; then
|
||
echo " Xray安装完成: $(xray version | head -1)"
|
||
else
|
||
echo "❌ Xray安装失败"
|
||
exit 1
|
||
fi
|
||
fi
|
||
|
||
# ── 3. 启用BBR TCP加速 ──────────────────────
|
||
echo "[3/6] 配置BBR TCP加速..."
|
||
if sysctl net.ipv4.tcp_congestion_control 2>/dev/null | grep -q bbr; then
|
||
echo " BBR已启用"
|
||
else
|
||
# 检查是否已添加过BBR配置，避免重复追加
|
||
if ! grep -q "铸渊专线 BBR加速" /etc/sysctl.conf 2>/dev/null; then
|
||
cat >> /etc/sysctl.conf <<EOF
|
||
|
||
# ── 铸渊专线 BBR加速 ──
|
||
net.core.default_qdisc=fq
|
||
net.ipv4.tcp_congestion_control=bbr
|
||
net.ipv4.tcp_fastopen=3
|
||
net.ipv4.tcp_slow_start_after_idle=0
|
||
net.core.rmem_max=16777216
|
||
net.core.wmem_max=16777216
|
||
net.ipv4.tcp_rmem=4096 87380 16777216
|
||
net.ipv4.tcp_wmem=4096 65536 16777216
|
||
EOF
|
||
fi
|
||
sysctl -p || echo "⚠️ sysctl -p 有警告，继续"
|
||
echo " BBR已启用"
|
||
fi
|
||
|
||
# ── 4. 防火墙配置 ────────────────────────────
|
||
echo "[4/6] 配置防火墙..."
|
||
ufw allow 443/tcp comment "Xray VLESS+Reality" || true
|
||
# 端口3802不再需要外部直连 — 订阅服务通过Nginx反代(/api/proxy-sub/)访问
|
||
if ufw delete allow 3802/tcp 2>/dev/null; then
|
||
echo " ✅ 已移除3802端口外部访问规则"
|
||
else
|
||
echo " ℹ️ 3802端口规则不存在 (无需移除)"
|
||
fi
|
||
ufw reload || echo "⚠️ 防火墙重载失败，请手动检查"
|
||
echo " 防火墙已配置: 443(Xray) · 订阅服务走Nginx反代(端口80)"
|
||
|
||
# ── 5. 生成密钥 ──────────────────────────────
|
||
echo "[5/6] 生成密钥..."
|
||
SCRIPT_DIR="$(dirname "$0")"
|
||
if bash "$SCRIPT_DIR/generate-keys.sh"; then
|
||
echo " ✅ 密钥生成完成"
|
||
else
|
||
echo " ⚠️ 密钥生成脚本返回非零退出码，检查上方输出"
|
||
echo " 密钥文件可能仍已创建，继续安装..."
|
||
fi
|
||
|
||
# ── 6. 创建数据目录 ──────────────────────────
|
||
echo "[6/6] 创建数据目录..."
|
||
mkdir -p /opt/zhuyuan/proxy/{config,data,logs}
|
||
chown -R root:root /opt/zhuyuan/proxy
|
||
chmod 755 /opt/zhuyuan/proxy/logs
|
||
|
||
# 修复: Xray官方安装脚本默认设置 User=nobody
|
||
# 导致无法写入日志目录 (permission denied) 且 systemd 警告
|
||
# "Special user nobody configured, this is not safe!"
|
||
# 创建 systemd drop-in 覆盖，以 root 身份运行 (443端口需要root)
|
||
mkdir -p /etc/systemd/system/xray.service.d
|
||
cat > /etc/systemd/system/xray.service.d/override.conf <<EOF
|
||
[Service]
|
||
User=root
|
||
EOF
|
||
systemctl daemon-reload
|
||
echo " ✅ Xray服务已配置为root用户运行"
|
||
|
||
echo ""
|
||
echo "════════════════════════════════════════"
|
||
echo "✅ 安装完成"
|
||
echo ""
|
||
echo "下一步:"
|
||
echo " 1. 将生成的密钥添加到GitHub Secrets"
|
||
echo " 2. 运行部署脚本配置Xray"
|
||
echo " 3. 运行send-subscription发送订阅链接"
|
||
echo "════════════════════════════════════════"
|