Files
eli f9d829934d feat: 迁移脚本 migrate_existing_stack.sh + WS_PATH 参数化 + ACTION=links
- migrate_existing_stack.sh:手工部署的 caddy/xray/hysteria2 栈一键迁入脚本管理
  - 只读解析三份旧配置(python3 注释感知花括号扫描/注释剥离+json/awk YAML)
  - 交互确认 DOMAIN/EMAIL/WS_PATH,凭据脱敏清单确认后落盘
  - 写 setup.env(%q 格式 mode 600,保留旧 uuid/私钥/shortId/密码,同协议旧客户端不断线)
  - 备份旧配置到 migration-backup-<ts>/;非主域站点块 verbatim 抽取提示人工合并
  - nft 只体检不修改:脏表生成参考配置,绝不插入 include
  - REALITY 公钥用 xray x25519 -i 现推;HY2_CERT_MODE 按旧 acme 配置推断
- setup_caddy_xray_hysteria.sh:
  - WS_PATH 参数化(默认 /scilad,迁移可保留 /vlessws 等旧路径,进 RENDER_VARS)
  - 新增 ACTION=links:只读 setup.env 重打全部分享链接,不碰系统
  - 环境变量优先于 setup.env:sudo CDN_DOMAIN=x ACTION=upgrade 带参升级真正生效
- 测试 167 条断言全绿(fixtures 已脱敏);README/CLAUDE.md 同步
- 已在 oraclejp/oraclejp-2 两机实测:迁移+升级+CDN 端到端验证通过

Co-Authored-By: Claude Code <noreply@anthropic.com>
2026-09-26 15:31:41 +08:00

86 lines
2.9 KiB
Caddyfile

{
# General Options
#debug
email ops@example.com
servers 127.0.0.1:8003 { #[::1]:8003
listener_wrappers {
proxy_protocol {
#timeout 2s
allow 127.0.0.1/32 ::1/128
#deny 10.0.0.0/8
#fallback_policy reject
}
tls
}
protocols h1 h2 h3
}
https_port 8003
}
http:// {
redir https://{host}:443{uri} permanent
}
oraclejp-2.henhaoji.site {
bind 127.0.0.1 [::1]
encode gzip zstd
php_fastcgi unix//run/php/php7.4-fpm.sock
@proxypaths {
path /portainer /portainer/*
}
@notpaths {
not path /portainer /portainer/* /vlessws /vlessws/*
}
tls {
ciphers TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
curves x25519 secp521r1 secp384r1 secp256r1
alpn h3 h2 http/1.1
}
reverse_proxy @notpaths https://engineersblog.net {
header_up Host {upstream_hostport}
}
handle_path /vlessws {
@websockets {
header Connection *Upgrade*
header Upgrade websocket
}
reverse_proxy @websockets 127.0.0.1:54442 {
# health_timeout 12h
}
}
reverse_proxy @proxypaths localhost:9000
root * /usr/share/caddy
file_server
}
oraclejp.duckdns.org {
bind 127.0.0.1 [::1]
encode gzip zstd
php_fastcgi unix//run/php/php7.4-fpm.sock
@proxypaths {
path /portainer /portainer/*
}
@notpaths {
not path /portainer /portainer/* /vlessws /vlessws/*
}
tls {
dns duckdns 00000000-0000-0000-0000-000000000000
ciphers TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
curves x25519 secp521r1 secp384r1 secp256r1
alpn h3 h2 http/1.1
}
reverse_proxy @notpaths https://engineersblog.net {
header_up Host {upstream_hostport}
}
handle_path /vlessws {
@websockets {
header Connection *Upgrade*
header Upgrade websocket
}
reverse_proxy @websockets 127.0.0.1:54442 {
# health_timeout 12h
}
}
reverse_proxy @proxypaths localhost:9000
root * /usr/share/caddy
file_server
}