joywaygamess/server-deploy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vps部署优化

Browse Source
This commit is contained in:
joywayer
2026-08-05 17:12:18 +08:00
parent 2afc2cade6
commit 5195986fc4
11 changed files with 989 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vps-xray/deploy.sh
+345 -40
View File
@@ -28,26 +28,30 @@ usage() {
echo "选项:"
echo " --mode reality VLESS-Reality 模式（默认，推荐，抗封锁）"
echo " --mode fast VLESS TCP 模式（无 TLS，极速但易被检测）"
echo " --show 只读取 .env 打印连接信息和分享链接，不改动任何服务"
echo " --redetect 强制重新挑选 Reality 伪装目标（会改变 SNI，"
echo " 所有客户端链接都必须同步更新）"
echo " -h, --help 显示帮助"
exit 0
}
# ===== 解析参数 =====
MODE="reality"
MODE=""
MODE_EXPLICIT=0
SHOW_ONLY=0
REDETECT=0
while [[ $# -gt 0 ]]; do
case $1 in
--mode) MODE="$2"; shift 2 ;;
--mode) MODE="${2:-}"; MODE_EXPLICIT=1; shift 2 ;;
--show) SHOW_ONLY=1; shift ;;
--redetect) REDETECT=1; shift ;;
-h|--help) usage ;;
*) error "未知参数: $1"; usage ;;
esac
done
if [[ "$MODE" != "reality" && "$MODE" != "fast" ]]; then
error "无效模式: $MODE（支持 reality / fast）"
exit 1
fi
# ===== 检查 root =====
# .env 权限为 600，读取它同样需要 root
if [ "$(id -u)" -ne 0 ]; then
error "请使用 root 用户运行: sudo bash deploy.sh"
exit 1
@@ -59,12 +63,30 @@ if [ -f .env ]; then
set -a; source .env; set +a
fi
# 未显式指定 --mode 时沿用 .env 里记录的模式，
# 避免在 fast 模式的机器上重跑脚本被静默切换成 reality
if [ "$MODE_EXPLICIT" -eq 0 ]; then
MODE="${XRAY_MODE:-reality}"
fi
if [[ "$MODE" != "reality" && "$MODE" != "fast" ]]; then
error "无效模式: $MODE（支持 reality / fast）"
exit 1
fi
# 布尔开关归一化：容忍 true/TRUE/True/yes/on/1 等写法，
# 避免用户按直觉写了 TRUE 却被静默当成关闭
case "$(printf '%s' "${XRAY_DAILY_RESTART:-false}" | tr '[:upper:]' '[:lower:]')" in
true|yes|on|1) DAILY_RESTART=1 ;;
*) DAILY_RESTART=0 ;;
esac
XRAY_PORT="${XRAY_PORT:-443}"
# ===== 0. 检查并安装依赖 =====
# 精简版系统镜像（如部分 VPS 商的 Debian/Ubuntu minimal）常缺 curl / unzip
ensure_deps() {
step "0/5 检查依赖"
step "1/8 检查依赖"
local missing=()
local cmd
@@ -107,7 +129,7 @@ ensure_deps() {
# ===== 1. 安装 Xray =====
install_xray() {
step "1/5 安装 Xray"
step "2/8 安装 Xray"
if [ -x /usr/local/bin/xray ]; then
log "Xray 已安装: $(/usr/local/bin/xray version | head -1)"
@@ -147,8 +169,48 @@ install_xray() {
}
# ===== 2. 生成密钥 =====
# ===== 凭据回收 =====
# 部署目录被删除、或 .env 丢失后重跑脚本，若直接生成新密钥，
# 所有客户端的旧链接会立刻失效——而失效表现与「握手被中间人干扰」
# 完全相同（REALITY: received real certificate），极难排查。
# 因此只要 config.json 还在，就以它为准恢复凭据。
recover_credentials() {
[ -f "$XRAY_CONFIG" ] || return 0
[ -n "${XRAY_UUID:-}" ] && return 0 # .env 已提供，无需回收
local flat uuid priv sid sni dest port
flat=$(tr -d '\n\r\t ' < "$XRAY_CONFIG")
uuid=$(echo "$flat" | grep -oP '"id":"\K[^"]+' | head -1 || true)
[ -z "$uuid" ] && return 0 # 多半是官方安装脚本留下的空壳配置
priv=$(echo "$flat" | grep -oP '"privateKey":"\K[^"]+' | head -1 || true)
sid=$(echo "$flat" | grep -oP '"shortIds":\["\K[^"]+' | head -1 || true)
sni=$(echo "$flat" | grep -oP '"serverNames":\["\K[^"]+' | head -1 || true)
dest=$(echo "$flat" | grep -oP '"dest":"\K[^"]+' | head -1 || true)
port=$(echo "$flat" | grep -oP '"port":\K[0-9]+' | head -1 || true)
warn ".env 缺失，正在从现有的 ${XRAY_CONFIG} 恢复凭据"
warn "（这样客户端已有的分享链接依然可用，不会因重装而失效）"
XRAY_UUID="$uuid"
[ -n "$port" ] && XRAY_PORT="$port"
if [ -n "$priv" ]; then
XRAY_PRIVATE_KEY="$priv"
XRAY_PUBLIC_KEY=$(/usr/local/bin/xray x25519 -i "$priv" 2>/dev/null \
| grep -iE 'public|password' | awk -F': ' '{print $2}' | tr -d '[:space:]' || true)
[ -n "$sid" ] && XRAY_SHORT_ID="$sid"
[ -n "$sni" ] && REALITY_SNI="$sni"
[ -n "$dest" ] && REALITY_DEST="${dest%%:*}"
fi
log "已恢复 UUID: ${XRAY_UUID}"
}
generate_keys() {
step "2/5 生成密钥"
step "3/8 生成密钥"
recover_credentials
XRAY_UUID="${XRAY_UUID:-$(cat /proc/sys/kernel/random/uuid)}"
log "UUID: ${XRAY_UUID}"
@@ -178,48 +240,158 @@ select_reality_dest() {
return
fi
step "3/5 选择 Reality 伪装目标"
step "4/8 选择 Reality 伪装目标"
local candidates=("www.microsoft.com" "dl.google.com" "www.apple.com" "www.amazon.com")
REALITY_DEST="${REALITY_DEST:-}"
REALITY_SNI="${REALITY_SNI:-}"
if [ -n "$REALITY_DEST" ] && [ -n "$REALITY_SNI" ]; then
log "使用 .env 中指定的伪装目标: ${REALITY_DEST}"
if [ -n "$REALITY_DEST" ] && [ -n "$REALITY_SNI" ] && [ "$REDETECT" -eq 0 ]; then
log "使用 .env 中已固定的伪装目标: ${REALITY_DEST}"
# 固定下来的伪装站可能哪天失效。这里只做可用性检查并告警，
# 绝不自动更换——更换会改变 SNI，导致所有客户端链接静默失效。
local ms
ms=$(curl -so /dev/null -w '%{time_connect}' --max-time 5 "https://${REALITY_DEST}" 2>/dev/null \
| awk '{printf "%d", $1*1000}') || true
if [ -z "$ms" ] || ! [[ "$ms" =~ ^[0-9]+$ ]] || [ "$ms" -le 0 ]; then
warn "伪装目标 ${REALITY_DEST} 当前不可达！Reality 回落会失败，客户端可能连不上"
warn "如需更换，执行: bash deploy.sh --redetect"
warn "注意：更换会改变 SNI，届时所有客户端链接都必须同步更新"
else
log "伪装目标连通性正常 (${ms}ms)"
fi
return
fi
local best_dest="www.microsoft.com"
if [ "$REDETECT" -eq 1 ] && [ -n "$REALITY_DEST" ]; then
warn "--redetect：将重新挑选伪装目标，原目标为 ${REALITY_DEST}"
fi
local best_dest=""
local best_ms=9999
for site in "${candidates[@]}"; do
local ms
# curl 失败时 %{time_connect} 会输出 0.000000，必须要求 ms > 0，
# 否则连不通的站点会被当成「延迟最低」选中
ms=$(curl -so /dev/null -w '%{time_connect}' --max-time 3 "https://${site}" 2>/dev/null \
| awk '{printf "%d", $1*1000}') || true
if [ -n "$ms" ] && [ "$ms" -lt "$best_ms" ] 2>/dev/null; then
if [ -z "$ms" ] || ! [[ "$ms" =~ ^[0-9]+$ ]] || [ "$ms" -le 0 ]; then
warn " ${site} 不可达，跳过"
continue
fi
log " ${site} → ${ms}ms"
if [ "$ms" -lt "$best_ms" ]; then
best_ms=$ms
best_dest=$site
fi
done
if [ -z "$best_dest" ]; then
error "所有候选伪装目标都无法连接，请检查服务器网络 / DNS"
error "候选列表: ${candidates[*]}"
exit 1
fi
local old_dest="$REALITY_DEST"
REALITY_DEST="$best_dest"
REALITY_SNI="$best_dest"
log "伪装目标: ${REALITY_DEST} (延迟 ${best_ms}ms)"
}
# ===== 4. 写入 Xray 配置 =====
write_config() {
if [ "$MODE" = "reality" ]; then
write_config_reality
else
write_config_fast
if [ -n "$old_dest" ] && [ "$old_dest" != "$best_dest" ]; then
echo ""
warn "════════════════════════════════════════════════════════"
warn "伪装目标已从 ${old_dest} 更换为 ${best_dest}"
warn "SNI 随之改变，所有客户端的旧链接将立即失效！"
warn "部署完成后请用新的分享链接重新配置全部客户端。"
warn "════════════════════════════════════════════════════════"
echo ""
fi
}
write_config_reality() {
step "3/5 写入 Xray 配置 (Reality)"
# ===== 4. 写入 Xray 配置 =====
XRAY_CONFIG="/usr/local/etc/xray/config.json"
cat > /usr/local/etc/xray/config.json << EOF
# 对外 IP：.env 指定优先，否则探测出口 IP
SERVER_IP_EFFECTIVE=""
resolve_server_ip() {
if [ -n "${SERVER_IP:-}" ]; then
SERVER_IP_EFFECTIVE="$SERVER_IP"
return
fi
SERVER_IP_EFFECTIVE=$(curl -s --max-time 5 ipv4.ip.sb 2>/dev/null \
|| curl -s --max-time 5 ifconfig.me 2>/dev/null || true)
}
# 阻断规则：
# 1) 本机公网 IP 的「代理端口」—— 客户端若因路由回环把「连接本代理」这件事
# 也丢进隧道，服务器就成了自我中继与流量放大器。只掐这一个端口，
# 不影响经隧道 SSH 回本机等正常用法（那是很常见的运维操作）。
# 2) geoip:private —— 私网与回环。代理用户没有任何理由经本机访问服务器内网，
# 放开等于把内网暴露给所有客户端。
build_block_rules() {
SELF_LOOP_RULE=""
if [[ "$SERVER_IP_EFFECTIVE" =~ ^[0-9]{1,3}(\.[0-9]{1,3}){3}$ ]]; then
SELF_LOOP_RULE=$(cat <<EOF
{
"type": "field",
"outboundTag": "block",
"ip": ["${SERVER_IP_EFFECTIVE}/32"],
"port": "${XRAY_PORT}"
},
EOF
)
fi
}
write_config() {
resolve_server_ip
build_block_rules
mkdir -p "$(dirname "$XRAY_CONFIG")"
# 先写临时文件并校验，通过后再原子替换正式配置，
# 保证校验失败时磁盘上的配置和正在运行的服务都不受影响
# xray 靠文件扩展名判断配置格式，临时文件必须叫 *.json，
# 否则会报 "Failed to get format"。所以用临时目录而非 mktemp 裸文件。
local tmpdir tmp
tmpdir="$(mktemp -d)"
tmp="${tmpdir}/config.json"
if [ "$MODE" = "reality" ]; then
write_config_reality "$tmp"
else
write_config_fast "$tmp"
fi
if ! /usr/local/bin/xray run -test -config "$tmp" >/dev/null 2>&1; then
error "配置校验失败，磁盘配置与运行中的服务均未改动。详细输出:"
/usr/local/bin/xray run -test -config "$tmp" || true
rm -rf "$tmpdir"
exit 1
fi
log "配置语法校验通过"
# 覆盖前备份旧配置，重跑脚本不至于丢掉手工改动（例如新增的 clients）
if [ -f "$XRAY_CONFIG" ]; then
local backup="${XRAY_CONFIG}.bak.$(date '+%Y%m%d%H%M%S')"
cp "$XRAY_CONFIG" "$backup"
log "旧配置已备份: ${backup}"
# 只保留最近 5 份，避免反复部署后无限堆积
ls -1t "${XRAY_CONFIG}".bak.* 2>/dev/null | tail -n +6 | xargs -r rm -f
fi
mv "$tmp" "$XRAY_CONFIG"
rm -rf "$tmpdir"
# xray 服务以 nobody 运行，配置必须对其可读
chmod 644 "$XRAY_CONFIG"
log "配置已写入: ${XRAY_CONFIG}"
}
write_config_reality() {
step "5/8 写入 Xray 配置 (Reality)"
local out="$1"
cat > "$out" << EOF
{
"log": {
"loglevel": "warning"
@@ -273,6 +445,12 @@ write_config_reality() {
],
"routing": {
"rules": [
${SELF_LOOP_RULE}
{
"type": "field",
"outboundTag": "block",
"ip": ["geoip:private"]
},
{
"type": "field",
"outboundTag": "block",
@@ -282,14 +460,13 @@ write_config_reality() {
}
}
EOF
log "配置已写入: /usr/local/etc/xray/config.json"
}
write_config_fast() {
step "3/5 写入 Xray 配置 (Fast TCP)"
step "5/8 写入 Xray 配置 (Fast TCP)"
local out="$1"
cat > /usr/local/etc/xray/config.json << EOF
cat > "$out" << EOF
{
"log": {
"loglevel": "warning"
@@ -330,6 +507,12 @@ write_config_fast() {
],
"routing": {
"rules": [
${SELF_LOOP_RULE}
{
"type": "field",
"outboundTag": "block",
"ip": ["geoip:private"]
},
{
"type": "field",
"outboundTag": "block",
@@ -339,23 +522,50 @@ write_config_fast() {
}
}
EOF
}
log "配置已写入: /usr/local/etc/xray/config.json"
# ===== 检测当前生效的 SSH 端口 =====
# 防火墙一旦 enable，若没放行真实的 SSH 端口就会把自己锁在门外
detect_ssh_ports() {
local ports=""
if command -v sshd &>/dev/null; then
ports=$(sshd -T 2>/dev/null | awk '/^port /{print $2}' || true)
fi
if [ -z "$ports" ]; then
ports=$(ss -tlnH 2>/dev/null | awk '{print $4}' | sed 's/.*://' | sort -u | grep -x 22 || true)
fi
if [ -z "$ports" ]; then
ports=$(awk '/^[[:space:]]*Port[[:space:]]+[0-9]+/{print $2}' /etc/ssh/sshd_config 2>/dev/null || true)
fi
# 兜底：至少放行 22，避免完全无法登录
[ -z "$ports" ] && ports="22"
echo "$ports"
}
# ===== 5. 防火墙 =====
configure_firewall() {
step "4/5 配置防火墙"
step "6/8 配置防火墙"
local ssh_ports
ssh_ports=$(detect_ssh_ports)
log "检测到 SSH 端口: $(echo "$ssh_ports" | tr '\n' ' ')"
if command -v ufw &>/dev/null; then
ufw allow "${XRAY_PORT}/tcp"
ufw allow 22/tcp
local p
for p in $ssh_ports; do
ufw allow "${p}/tcp"
done
ufw --force enable
log "ufw 已放行端口 ${XRAY_PORT}/tcp"
log "ufw 已放行端口 ${XRAY_PORT}/tcp 及 SSH 端口"
elif command -v firewall-cmd &>/dev/null; then
firewall-cmd --permanent --add-port="${XRAY_PORT}/tcp"
local p
for p in $ssh_ports; do
firewall-cmd --permanent --add-port="${p}/tcp"
done
firewall-cmd --reload
log "firewalld 已放行端口 ${XRAY_PORT}/tcp"
log "firewalld 已放行端口 ${XRAY_PORT}/tcp 及 SSH 端口"
else
warn "未检测到防火墙工具，请手动放行端口 ${XRAY_PORT}/tcp"
fi
@@ -363,7 +573,7 @@ configure_firewall() {
# ===== 6. BBR + 网络调优 =====
tune_network() {
step "5/5 BBR + 网络调优"
step "7/8 BBR + 网络调优"
cat > /etc/sysctl.d/99-xray-turbo.conf << 'SYSEOF'
# BBR 拥塞控制
@@ -396,7 +606,7 @@ SYSEOF
# ===== 新增：系统与服务加固 =====
harden_system() {
step "加固系统与服务"
step "8/8 加固系统与服务"
# 文件描述符上限
if ! grep -q '99-xray-nofile' /etc/security/limits.conf 2>/dev/null; then
@@ -418,6 +628,22 @@ Restart=always
RestartSec=3
EOF
# ===== 每日重启 timer：默认关闭 =====
# 崩溃恢复已由上面的 Restart=always + RestartSec=3 覆盖（秒级响应），
# 而每日硬重启会切断全部活动连接（跨夜下载、备份、CI 都会中断），
# 属于为假想问题付出真实代价。仅在确实观察到长期运行后性能退化时才开启。
if [ "$DAILY_RESTART" -ne 1 ]; then
if [ -f /etc/systemd/system/xray-restart.timer ]; then
systemctl disable --now xray-restart.timer 2>/dev/null || true
rm -f /etc/systemd/system/xray-restart.timer \
/etc/systemd/system/xray-restart.service
warn "已移除旧部署遗留的每日重启 timer"
warn "如需保留，请在 .env 中设置 XRAY_DAILY_RESTART=true 后重新部署"
fi
log "每日自动重启: 关闭（崩溃由 Restart=always 秒级恢复）"
return
fi
# 定时重启 timer（每日凌晨 4 点）
cat > /etc/systemd/system/xray-restart.service << 'EOF'
[Unit]
@@ -441,6 +667,8 @@ Persistent=true
[Install]
WantedBy=timers.target
EOF
warn "每日自动重启: 已启用（04:00 Asia/Shanghai）"
warn "该操作会切断所有活动连接，如无必要建议设 XRAY_DAILY_RESTART=false"
}
# ===== 7. 启动服务 =====
@@ -448,7 +676,9 @@ start_service() {
systemctl daemon-reload
systemctl restart xray
systemctl enable xray
systemctl enable --now xray-restart.timer
if [ "$DAILY_RESTART" -eq 1 ]; then
systemctl enable --now xray-restart.timer
fi
sleep 2
if systemctl is-active --quiet xray; then
@@ -468,6 +698,15 @@ save_env() {
XRAY_MODE=${MODE}
XRAY_PORT=${XRAY_PORT}
XRAY_UUID=${XRAY_UUID}
# 分享链接中使用的 IP。留空则自动探测出口 IP；
# NAT / 端口转发的机器请填写服务商给你的实际入站 IP
SERVER_IP=${SERVER_IP:-}
# 每日 04:00 自动重启 Xray。默认 false。
# 崩溃恢复已由 systemd 的 Restart=always 覆盖（秒级），而每日硬重启会
# 切断全部活动连接。仅在确实观察到长期运行后性能退化时才改为 true。
XRAY_DAILY_RESTART=$([ "$DAILY_RESTART" -eq 1 ] && echo true || echo false)
EOF
if [ "$MODE" = "reality" ]; then
@@ -487,13 +726,35 @@ EOF
# ===== 9. 输出连接信息 =====
print_result() {
local server_ip
server_ip=$(curl -s --max-time 5 ipv4.ip.sb || curl -s --max-time 5 ifconfig.me || echo "获取失败")
[ -z "$SERVER_IP_EFFECTIVE" ] && resolve_server_ip
if [ -n "${SERVER_IP:-}" ]; then
server_ip="$SERVER_IP"
log "使用 .env 中指定的 SERVER_IP: ${server_ip}"
else
server_ip="${SERVER_IP_EFFECTIVE:-获取失败}"
# 注意：这里拿到的是「出口」IP。NAT / 端口转发的机器上，
# 它与外部实际可连接的「入站」IP 可能不是同一个
local nic_ip
nic_ip=$(ip -4 -o addr show scope global 2>/dev/null | awk '{print $4}' | cut -d/ -f1 | head -1)
if [ -n "$nic_ip" ] && [ "$nic_ip" != "$server_ip" ]; then
warn "网卡地址 ${nic_ip} 与出口 IP ${server_ip} 不一致，本机可能位于 NAT / 端口转发之后"
warn "若客户端连不上，请向服务商确认实际映射的入站 IP 与端口，"
warn "然后在 .env 中设置 SERVER_IP= 和 XRAY_PORT= 后重新运行本脚本"
fi
fi
local title
if [ "${SHOW_ONLY:-0}" -eq 1 ]; then
title="连接信息"
else
title="部署完成 ✅"
fi
echo ""
echo "=========================================================="
if [ "$MODE" = "reality" ]; then
echo " Xray VLESS-Reality 部署完成 ✅"
echo " Xray VLESS-Reality ${title}"
echo "=========================================================="
echo ""
echo " IP : ${server_ip}"
@@ -514,7 +775,7 @@ print_result() {
echo ""
echo "vless://${XRAY_UUID}@${server_ip}:${XRAY_PORT}?encryption=none&flow=xtls-rprx-vision&security=reality&sni=${REALITY_SNI}&fp=chrome&pbk=${XRAY_PUBLIC_KEY}&sid=${XRAY_SHORT_ID}&type=tcp#vps-reality"
else
echo " Xray VLESS TCP 部署完成 ✅"
echo " Xray VLESS TCP ${title}"
echo "=========================================================="
echo ""
echo " IP : ${server_ip}"
@@ -523,6 +784,12 @@ print_result() {
echo " UUID : ${XRAY_UUID}"
echo " 传输 : tcp"
echo " 安全 : none"
echo ""
echo "=========================================================="
echo ""
echo ">>> VLESS 分享链接（可直接导入客户端）:"
echo ""
echo "vless://${XRAY_UUID}@${server_ip}:${XRAY_PORT}?encryption=none&security=none&type=tcp&headerType=none#vps-fast"
fi
echo ""
@@ -531,13 +798,51 @@ print_result() {
echo "⚠️ 请妥善保存以上信息！"
echo " 配置文件: /usr/local/etc/xray/config.json"
echo " 凭据备份: ${SCRIPT_DIR}/.env"
echo " 再次查看: bash deploy.sh --show"
echo " 查看日志: journalctl -u xray -f"
echo " 重启服务: systemctl restart xray"
echo "=========================================================="
}
# ===== --show：只读打印连接信息，不改动任何服务 =====
show_info() {
if [ ! -f "$SCRIPT_DIR/.env" ]; then
error "未找到 ${SCRIPT_DIR}/.env，无法读取部署信息"
echo ""
echo "若 Xray 配置仍在，可从 /usr/local/etc/xray/config.json 手工恢复："
echo " priv=\$(grep -oP '\"privateKey\"\\s*:\\s*\"\\K[^\"]+' /usr/local/etc/xray/config.json)"
echo " /usr/local/bin/xray x25519 -i \"\$priv\" # 输出的 Password (PublicKey) 即客户端 pbk"
exit 1
fi
local missing=()
[ -z "${XRAY_UUID:-}" ] && missing+=("XRAY_UUID")
if [ "$MODE" = "reality" ]; then
[ -z "${XRAY_PUBLIC_KEY:-}" ] && missing+=("XRAY_PUBLIC_KEY")
[ -z "${XRAY_SHORT_ID:-}" ] && missing+=("XRAY_SHORT_ID")
[ -z "${REALITY_SNI:-}" ] && missing+=("REALITY_SNI")
fi
if [ "${#missing[@]}" -gt 0 ]; then
error ".env 缺少必要字段: ${missing[*]}"
error "请重新运行 bash deploy.sh 完成部署"
exit 1
fi
if ! systemctl is-active --quiet xray 2>/dev/null; then
warn "Xray 服务当前未运行，以下信息来自 .env，不代表服务可用"
warn "检查: systemctl status xray"
fi
print_result
}
# ===== 主流程 =====
main() {
if [ "$SHOW_ONLY" -eq 1 ]; then
show_info
exit 0
fi
echo ""
log "部署模式: ${MODE}"
[ "$MODE" = "reality" ] && log "VLESS-Reality（推荐，抗封锁）" || log "VLESS TCP（极速，无 TLS）"