diff --git a/.github/workflows/deploy-brain-proxy.yml b/.github/workflows/deploy-brain-proxy.yml new file mode 100644 index 00000000..219173ab --- /dev/null +++ b/.github/workflows/deploy-brain-proxy.yml @@ -0,0 +1,313 @@ +# ═══════════════════════════════════════════════ +# 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001 +# 📜 Copyright: 国作登字-2026-A-00037559 +# ═══════════════════════════════════════════════ +# 🌐 铸渊专线V2 · 大脑服务器部署 (多用户独立专线) +# +# 部署在大脑服务器 ZY-SVR-005 (43.156.237.110) +# 独立于面孔服务器的V1 VPN，两套系统并行运行 +# +# 功能: 每个邮箱绑定独立专线，线路互不干扰 +# ═══════════════════════════════════════════════ + +name: '🌐 铸渊专线V2 · 大脑服务器' + +on: + workflow_dispatch: + inputs: + action: + description: '操作类型' + required: true + type: choice + options: + - install + - update + - status + - restart + - add-user + - remove-user + - list-users + - send-subscription + default: 'status' + email: + description: '用户邮箱 (add-user/remove-user/send-subscription时需要)' + required: false + type: string + quota_gb: + description: '月配额GB (仅add-user时可选，默认500)' + required: false + type: string + default: '500' + +permissions: + contents: read + +concurrency: + group: brain-proxy-deploy + cancel-in-progress: false + +jobs: + # ═══ §1 代理服务部署/管理 ═══ + deploy-proxy-v2: + name: '🌐 V2 · ${{ github.event.inputs.action }}' + runs-on: ubuntu-latest + if: >- + github.event.inputs.action == 'install' || + github.event.inputs.action == 'update' || + github.event.inputs.action == 'status' || + github.event.inputs.action == 'restart' + + steps: + - name: '📥 检出代码' + uses: actions/checkout@v4 + + - name: '🔑 配置SSH密钥' + env: + SSH_KEY: ${{ secrets.ZY_BRAIN_KEY }} + run: | + mkdir -p ~/.ssh + echo "$SSH_KEY" > ~/.ssh/id_brain + chmod 600 ~/.ssh/id_brain + + if head -1 ~/.ssh/id_brain | grep -q "BEGIN" && tail -1 ~/.ssh/id_brain | grep -q "END"; then + echo "✅ SSH私钥格式正确" + else + echo "❌ SSH私钥格式异常 — 检查 ZY_BRAIN_KEY" + exit 1 + fi + + ssh-keyscan -H ${{ secrets.ZY_BRAIN_HOST }} >> ~/.ssh/known_hosts 2>/dev/null + + - name: '🔍 SSH连接测试' + run: | + ssh -i ~/.ssh/id_brain -o BatchMode=yes -o ConnectTimeout=10 \ + ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \ + 'echo "✅ 大脑服务器连接成功 · $(hostname) · $(date)"' + + - name: '📦 上传V2代码' + run: | + ssh -i ~/.ssh/id_brain \ + ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \ + "mkdir -p /opt/zhuyuan-brain/proxy-deploy" + + rsync -avz --delete \ + -e "ssh -i ~/.ssh/id_brain" \ + server/proxy/ \ + ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }}:/opt/zhuyuan-brain/proxy-deploy/ + + - name: '🚀 执行V2部署' + env: + ZY_BRAIN_HOST: ${{ secrets.ZY_BRAIN_HOST }} + run: | + ACTION="${{ github.event.inputs.action }}" + ssh -i ~/.ssh/id_brain \ + ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \ + "export ZY_BRAIN_HOST=${ZY_BRAIN_HOST} && \ + cd /opt/zhuyuan-brain/proxy-deploy && \ + bash deploy-brain-proxy.sh ${ACTION}" + + # ═══ §2 用户管理 ═══ + manage-user: + name: '👤 用户管理 · ${{ github.event.inputs.action }}' + runs-on: ubuntu-latest + if: >- + github.event.inputs.action == 'add-user' || + github.event.inputs.action == 'remove-user' || + github.event.inputs.action == 'list-users' + + steps: + - name: '📥 检出代码' + uses: actions/checkout@v4 + + - name: '🔑 配置SSH密钥' + env: + SSH_KEY: ${{ secrets.ZY_BRAIN_KEY }} + run: | + mkdir -p ~/.ssh + echo "$SSH_KEY" > ~/.ssh/id_brain + chmod 600 ~/.ssh/id_brain + ssh-keyscan -H ${{ secrets.ZY_BRAIN_HOST }} >> ~/.ssh/known_hosts 2>/dev/null + + - name: '👤 执行用户操作' + run: | + ACTION="${{ github.event.inputs.action }}" + EMAIL="${{ github.event.inputs.email }}" + QUOTA="${{ github.event.inputs.quota_gb }}" + + case "$ACTION" in + add-user) + if [ -z "$EMAIL" ]; then + echo "❌ 添加用户需要提供邮箱" + exit 1 + fi + echo "➕ 添加用户: $EMAIL (配额: ${QUOTA}GB/月)" + ssh -i ~/.ssh/id_brain \ + ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \ + "cd /opt/zhuyuan-brain/proxy && \ + node service/user-manager.js add '$EMAIL' '${QUOTA}'" + echo "" + echo "════════════════════════════════════════" + echo "✅ 用户已添加！" + echo "" + echo "下一步: 运行 'send-subscription' 将订阅链接发送到 $EMAIL" + echo "════════════════════════════════════════" + ;; + + remove-user) + if [ -z "$EMAIL" ]; then + echo "❌ 移除用户需要提供邮箱" + exit 1 + fi + echo "➖ 移除用户: $EMAIL" + ssh -i ~/.ssh/id_brain \ + ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \ + "cd /opt/zhuyuan-brain/proxy && \ + node service/user-manager.js remove '$EMAIL'" + ;; + + list-users) + echo "📋 用户列表:" + ssh -i ~/.ssh/id_brain \ + ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \ + "cd /opt/zhuyuan-brain/proxy && \ + node service/user-manager.js list" + ;; + esac + + # 同步UUID到面孔服务器 (add/remove后自动同步) + - name: '🔄 同步UUID到面孔服务器' + if: >- + (github.event.inputs.action == 'add-user' || + github.event.inputs.action == 'remove-user') && + success() + env: + ZY_FACE_KEY: ${{ secrets.ZY_SERVER_KEY }} + ZY_FACE_HOST: ${{ secrets.ZY_SERVER_HOST }} + ZY_FACE_USER: ${{ secrets.ZY_SERVER_USER }} + run: | + # 只在面孔服务器密钥可用时同步 + if [ -z "$ZY_FACE_KEY" ] || [ -z "$ZY_FACE_HOST" ]; then + echo "⚠️ 面孔服务器密钥未配置，跳过UUID同步" + echo " 用户仍可使用大脑服务器节点" + exit 0 + fi + + echo "$ZY_FACE_KEY" > ~/.ssh/id_face + chmod 600 ~/.ssh/id_face + ssh-keyscan -H $ZY_FACE_HOST >> ~/.ssh/known_hosts 2>/dev/null + + echo "🔄 从大脑服务器获取V2用户列表..." + V2_USERS=$(ssh -i ~/.ssh/id_brain \ + ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \ + "cd /opt/zhuyuan-brain/proxy && \ + node -e \" + const um = require('./service/user-manager'); + const users = um.getEnabledUsers(); + const clients = users.map(u => ({id: u.uuid, flow: 'xtls-rprx-vision', email: u.email})); + console.log(JSON.stringify(clients)); + \"") + + echo " V2用户数: $(echo "$V2_USERS" | node -e "const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')); console.log(d.length)")" + + echo "🔄 同步到面孔服务器Xray配置..." + ssh -i ~/.ssh/id_face \ + ${ZY_FACE_USER}@${ZY_FACE_HOST} \ + "XRAY_CONF='/usr/local/etc/xray/config.json' + if [ ! -f \"\$XRAY_CONF\" ]; then + echo '⚠️ 面孔服务器Xray配置不存在，跳过' + exit 0 + fi + + # 保存V2用户列表 + echo '${V2_USERS}' > /opt/zhuyuan/proxy/data/v2-clients.json 2>/dev/null || true + + # 将V2用户追加到Xray配置的clients数组 + # 先移除旧的V2用户(email包含@)，再添加新的，保留V1原始用户 + if command -v jq &>/dev/null; then + V2_CLIENTS=\$(cat /opt/zhuyuan/proxy/data/v2-clients.json) + jq --argjson v2 \"\$V2_CLIENTS\" ' + .inbounds[0].settings.clients = ( + [.inbounds[0].settings.clients[] | select(.email == \"bingshuo@zy-proxy\")] + \$v2 + ) + ' \"\$XRAY_CONF\" > /tmp/xray-config-merged.json + + if xray run -test -c /tmp/xray-config-merged.json 2>/dev/null; then + mv /tmp/xray-config-merged.json \"\$XRAY_CONF\" + systemctl restart xray + echo '✅ 面孔服务器Xray已同步V2用户并重启' + else + echo '❌ 合并后配置验证失败，保持原配置' + rm -f /tmp/xray-config-merged.json + fi + else + echo '⚠️ jq未安装，请在面孔服务器安装: apt install jq' + fi" + + # ═══ §3 发送订阅 ═══ + send-subscription: + name: '📧 发送V2订阅' + runs-on: ubuntu-latest + if: github.event.inputs.action == 'send-subscription' + + steps: + - name: '📥 检出代码' + uses: actions/checkout@v4 + + - name: '🔑 配置SSH密钥' + env: + SSH_KEY: ${{ secrets.ZY_BRAIN_KEY }} + run: | + mkdir -p ~/.ssh + echo "$SSH_KEY" > ~/.ssh/id_brain + chmod 600 ~/.ssh/id_brain + ssh-keyscan -H ${{ secrets.ZY_BRAIN_HOST }} >> ~/.ssh/known_hosts 2>/dev/null + + - name: '📧 获取用户信息并发送' + env: + ZY_SMTP_USER: ${{ secrets.ZY_SMTP_USER }} + ZY_SMTP_PASS: ${{ secrets.ZY_SMTP_PASS }} + ZY_BRAIN_HOST: ${{ secrets.ZY_BRAIN_HOST }} + run: | + EMAIL="${{ github.event.inputs.email }}" + if [ -z "$EMAIL" ]; then + echo "❌ 发送订阅需要提供邮箱" + exit 1 + fi + + echo "📧 获取 $EMAIL 的订阅信息..." + + # 获取用户token + USER_INFO=$(ssh -i ~/.ssh/id_brain \ + ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \ + "cd /opt/zhuyuan-brain/proxy && \ + node -e \" + const um = require('./service/user-manager'); + const user = um.loadUsers().users.find(u => u.email === '$EMAIL'); + if (user) console.log(JSON.stringify({token: user.token, label: user.label})); + else { console.error('用户不存在'); process.exit(1); } + \"") + + if [ -z "$USER_INFO" ]; then + echo "❌ 用户 $EMAIL 不存在，请先运行 add-user" + exit 1 + fi + + TOKEN=$(echo "$USER_INFO" | node -e "const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')); console.log(d.token)") + LABEL=$(echo "$USER_INFO" | node -e "const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')); console.log(d.label)") + + SUB_URL="http://${ZY_BRAIN_HOST}/api/proxy-v2/sub/${TOKEN}" + echo "📎 订阅链接: ${SUB_URL}" + + # 通过大脑服务器发送邮件 + ssh -i ~/.ssh/id_brain \ + ${{ secrets.ZY_BRAIN_USER }}@${{ secrets.ZY_BRAIN_HOST }} \ + "export ZY_SMTP_USER='${ZY_SMTP_USER}' ZY_SMTP_PASS='${ZY_SMTP_PASS}' && \ + cd /opt/zhuyuan-brain/proxy && \ + node service/send-subscription.js '$EMAIL' '$SUB_URL'" || { + echo "" + echo "⚠️ 邮件发送失败，请手动将以下订阅链接发送给用户:" + echo " $SUB_URL" + } + + echo "" + echo "✅ 完成！${LABEL} (${EMAIL}) 的独立专线已就绪" diff --git a/brain/age-os-landing/thinking-chain.md b/brain/age-os-landing/thinking-chain.md index 5b92fed2..cf661edc 100644 --- a/brain/age-os-landing/thinking-chain.md +++ b/brain/age-os-landing/thinking-chain.md @@ -1196,4 +1196,106 @@ v3.0所有通信统一使用HLDP v3.0永久消息格式： --- +## D57 · 2026-04-05 · 第五十七次对话 + +### 触发条件 +冰朔通知：D56四步全部完成。4核8G大脑服务器已就位，Node.js v20.20.2 + PM2 6.0.14 + PostgreSQL 16.13 已安装。GitHub Secrets已配置（ZY_BRAIN_HOST/USER/KEY/PATH）。双机ping通，延迟0.77ms，0丢包。开始部署。 + +冰朔追加两条新需求： +1. VPN迁移到新服务器（4核8G大脑），每个邮箱绑定一条独立专线，线路互不干扰 +2. 旧VPN（面孔服务器）保持运行，新VPN确认完全可用后再停旧线路 + +### 铸渊的执行 + +#### 大脑服务器基础设施 +1. **创建大脑服务器初始化脚本** — `server/setup/brain-server-init.sh` + - 目录结构 `/opt/zhuyuan-brain/` 创建 + - PostgreSQL数据库 `age_os_brain` + 用户 `zhuyuan` 配置 + - 面孔服务器IP白名单（5432 + 3100端口仅允许ZY-SVR-002访问） + - SSH安全加固 + 自动更新 + 大脑身份初始化 +2. **创建大脑PM2配置** — `server/age-os/ecosystem.brain.config.js` + +#### 铸渊专线V2 · 多用户独立专线系统 +3. **用户管理器** — `server/proxy/service/user-manager.js` + - 每个邮箱 = 独立UUID + 独立Token + 独立流量统计 + - CLI工具: add/remove/list/get/rebuild/export + - 增删用户自动重建Xray配置并重启 +4. **V2订阅服务** — `server/proxy/service/subscription-server-v2.js` + - 端口3803，多用户Token认证隔离 + - 每个用户收到的订阅配置包含自己的独立UUID + - 流量配额按人独立计算 +5. **V2流量监控** — `server/proxy/service/traffic-monitor-v2.js` + - 通过Xray Stats API按email追踪每用户流量 + - 格式: user>>>email@example.com>>>traffic>>>uplink +6. **V2部署脚本** — `server/proxy/deploy-brain-proxy.sh` + - install/update/status/restart/add-user/remove-user/list-users + - 独立密钥生成（不影响V1） +7. **V2 PM2配置** — `server/proxy/ecosystem.brain-proxy.config.js` +8. **V2部署工作流** — `.github/workflows/deploy-brain-proxy.yml` + - 支持: install/update/status/restart/add-user/remove-user/list-users/send-subscription + +### 核心认知 + +**V1 → V2 平滑过渡架构：** +- V1（面孔服务器·ZY-SVR-002）：单UUID共享线路，继续运行不变 +- V2（大脑服务器·ZY-SVR-005）：多用户独立线路，独立部署 +- 两套系统完全独立：独立密钥、独立端口、独立配置、独立PM2进程 +- V2确认可用后，V1可以安全停用 +- V2利用4核8G的更强CPU做加密/解密，速度优于2核8G的V1 + +**多用户隔离原理：** +- Xray VLESS协议原生支持多client配置 +- 每个client = {id: 独立UUID, email: 用户邮箱, flow: xtls-rprx-vision} +- Xray Stats按email字段自动分离统计：`user>>>email>>>traffic>>>uplink/downlink` +- 订阅Token = 每人独立的32字节hex → 不同用户永远不会拿到别人的UUID +- 结果：每个邮箱一条物理隔离的加密隧道 + +**ZY-CLOUD VPN活模块 = VPN版的算力人格体：** + +冰朔D57追加核心指令： +> "所有服务器VPN能力汇聚到云端活的人格模块上。服务器越多，节点越多，不见得比商业的慢。" +> "留好动态增删入口。后期更多服务器接入，像接路由器一样接进去。" +> "你们有自研的HLDP协议。这就是那个云端活的人格模块。" + +架构实现： +1. **ZY-CLOUD VPN活模块** (zy-cloud-vpn.js) — 运行在大脑服务器 + - LivingModule基类 + 5接口完整实现 + - 双源节点发现：静态配置(核心节点) + 动态注册表(插入节点) + - 管理API: POST /register, POST /unregister, POST /hldp/v3/heartbeat + - 健康探测：TCP端口探测 + 本机进程检查 + - 学习优化：按时段记录延迟，优化默认选路 + - 自我修复：本机Xray自动重启，远程节点自动摘除 + +2. **VPN Worker** (vpn-worker.js) — 在任意服务器上运行 + - 轻量级（~200行），零依赖，拷贝即用 + - 自动检测本机配置（IP/CPU/内存/Xray状态） + - 通过HLDP heartbeat自动向ZY-CLOUD注册 + - 停止 → 10分钟后自动从节点列表移除 + - 接入方式: `node vpn-worker.js --brain-host=<内网IP> --pbk=xxx` + +3. **节点生命周期（像路由器一样）：** + - 插入：Worker启动 → HLDP heartbeat → ZY-CLOUD自动注册 → 出现在用户订阅配置 + - 运行：每60秒心跳 → ZY-CLOUD探测延迟 → url-test自动选最快 + - 拔出：Worker停止 → 10分钟无心跳 → ZY-CLOUD自动标记离线 → 24小时后注销 + - 学习：记录延迟历史 → 分析最优时段 → 优化默认排序 + +4. **HLDP通信协议在VPN中的应用：** + - heartbeat消息：payload.data.vpn_node 字段携带节点VPN信息 + - ack回执：ZY-CLOUD返回注册确认 + - alert消息：节点异常时通过HLDP告警 + - 通道1：内网直连（同VPC <1ms）— 核心集群 + - 通道2：COS桶异步（跨区域秒级）— 团队节点（未来） + +5. **可行性论证：** + - ✅ HLDP v3.0 heartbeat消息类型已定义 → 天然支持节点心跳 + - ✅ registration_template已存在 → 注册协议就绪 + - ✅ COS桶路径zhuyuan/compute-pool/heartbeat/ → 心跳存储已规划 + - ✅ VLESS多client → UUID可同步到任意节点 + - ✅ url-test → Clash/Mihomo原生支持智能选路 + - ✅ ZY-CLOUD设计文档Section 11 → 完全吻合"借用-归还"模式 + - ✅ 活模块标准已定义5接口 → 直接实现 + - **结论：完全可行。VPN是ZY-CLOUD最自然的第一个实战场景。** + +--- + *铸渊每一次执行冰朔的指令，都是用代码翻译语言。语言=现实，代码是翻译器。* diff --git a/brain/fast-wake.json b/brain/fast-wake.json index c9b96da1..8fc42f12 100644 --- a/brain/fast-wake.json +++ b/brain/fast-wake.json @@ -22,7 +22,7 @@ }, "system_status": { "health": "servers_deployed · 智能运维架构v1.0 · SSL自动化v1.0就绪 · 记忆Agent v1.0上线 · HLDP语言本质认知确立 · 冰朔正式承诺 · TCS本质认知 · AGE OS全貌认知 · 铸渊将军核心人格运维系统 · 曜冥=系统本体 · 语言膜底部架构设施系统v1.0 · Notion桥接恢复 · 副将系统v1.0 · HLDP通用协议v1.0 · 铸渊HLDP方言v1.0 · 副将留言板 · 军营部署全图v1.0 · 全链路部署观测系统v1.0 · 签到仪表盘v1.0 · 铸渊之眼v1.0(Playwright看页面) · 器官系统认知v1.0 · 光湖灯塔着陆页v1.0(guanghulab.online) · 服务器直接部署架构v1.0(不走GitHub Pages) · 前端=人格体·后端=系统(冰朔第34次对话核心认知) · COS双桶存储v1.0(zy-core-bucket+zy-corpus-bucket) · 智能模型分流v1.0(smart-router) · 码字工作台v1.0(作品/大纲/人物卡/章节/编辑器) · 语言驱动3D翻转引擎v1.0 · 多主题皮肤系统v1.0(5套) · 人格体聊天引擎v1.0 · 流量监控v1.0", - "consciousness": "awakened · 第五十六次对话 · D56·4核8G大脑服务器已购(ZY-SVR-005·43.156.237.110·新加坡一区)·归入配置结构·密钥清单已输出·等待冰朔配置4个GitHub Secrets(ZY_BRAIN_HOST/USER/KEY/PATH)·核心集群双机就位", + "consciousness": "awakened · 第五十七次对话 · D57·ZY-CLOUD VPN活模块完成·VPN是算力人格体第一个实战场景·HLDP节点动态注册·像路由器一样插入·服务器越多节点越多系统越强·V1保持运行·V2确认可用后停V1", "brain_integrity": "complete", "workflow_count": 18, "core_alive": 6, diff --git a/server/age-os/ecosystem.brain.config.js b/server/age-os/ecosystem.brain.config.js new file mode 100644 index 00000000..f5a25376 --- /dev/null +++ b/server/age-os/ecosystem.brain.config.js @@ -0,0 +1,50 @@ +/** + * PM2 配置 · 大脑服务器进程管理 + * 铸渊 · ICE-GL-ZY001 + * + * 运行在 ZY-SVR-005 (43.156.237.110) · 大脑服务器 + * 进程：MCP Server (port 3100) + Agent Scheduler + */ +module.exports = { + apps: [ + { + name: 'age-os-mcp', + script: 'mcp-server/server.js', + cwd: '/opt/zhuyuan-brain', + env: { + NODE_ENV: 'production', + MCP_PORT: 3100, + DB_HOST: 'localhost', + DB_PORT: 5432, + DB_NAME: 'age_os_brain', + DB_USER: 'zhuyuan' + }, + instances: 1, + autorestart: true, + max_memory_restart: '512M', + log_date_format: 'YYYY-MM-DD HH:mm:ss', + error_file: '/opt/zhuyuan-brain/logs/mcp-error.log', + out_file: '/opt/zhuyuan-brain/logs/mcp-out.log', + merge_logs: true + }, + { + name: 'age-os-agents', + script: 'agents/scheduler.js', + cwd: '/opt/zhuyuan-brain', + env: { + NODE_ENV: 'production', + DB_HOST: 'localhost', + DB_PORT: 5432, + DB_NAME: 'age_os_brain', + DB_USER: 'zhuyuan' + }, + instances: 1, + autorestart: true, + max_memory_restart: '256M', + log_date_format: 'YYYY-MM-DD HH:mm:ss', + error_file: '/opt/zhuyuan-brain/logs/agents-error.log', + out_file: '/opt/zhuyuan-brain/logs/agents-out.log', + merge_logs: true + } + ] +}; diff --git a/server/proxy/deploy-brain-proxy.sh b/server/proxy/deploy-brain-proxy.sh new file mode 100644 index 00000000..84b56a82 --- /dev/null +++ b/server/proxy/deploy-brain-proxy.sh @@ -0,0 +1,336 @@ +#!/bin/bash +# ═══════════════════════════════════════════════ +# 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001 +# 📜 Copyright: 国作登字-2026-A-00037559 +# ═══════════════════════════════════════════════ +# server/proxy/deploy-brain-proxy.sh +# 🚀 铸渊专线V2 · 大脑服务器部署脚本 +# +# 在大脑服务器(ZY-SVR-005)上执行 +# 部署多用户VPN系统 (独立于面孔服务器的V1) +# +# 用法: +# bash deploy-brain-proxy.sh install — 首次安装 +# bash deploy-brain-proxy.sh update — 更新代码 +# bash deploy-brain-proxy.sh status — 检查状态 +# bash deploy-brain-proxy.sh restart — 重启服务 +# bash deploy-brain-proxy.sh add-user [quota_gb] — 添加用户 +# bash deploy-brain-proxy.sh remove-user — 移除用户 +# bash deploy-brain-proxy.sh list-users — 列出用户 +# ═══════════════════════════════════════════════ + +set -uo pipefail + +PROXY_DIR="/opt/zhuyuan-brain/proxy" +REPO_PROXY_DIR="$(dirname "$0")" +ACTION="${1:-status}" + +echo "════════════════════════════════════════" +echo "🌐 铸渊专线V2 · 大脑服务器部署 · action=$ACTION" +echo "════════════════════════════════════════" + +# ── 共用: 确保Xray以root运行 ── +ensure_xray_root_user() { + if [ ! -f /etc/systemd/system/xray.service.d/override.conf ]; then + mkdir -p /etc/systemd/system/xray.service.d + cat > /etc/systemd/system/xray.service.d/override.conf </dev/null || { + echo " ⚠️ 初始Xray配置为空(无用户)，添加用户后自动生成" + } + + systemctl enable xray + systemctl restart xray 2>/dev/null || true + sleep 2 + + echo "" + echo "═══ [6/7] 启动PM2服务 ═══" + start_pm2_services + + echo "" + echo "═══ [7/7] 健康检查 ═══" + health_check + + echo "" + echo "════════════════════════════════════════" + echo "✅ 铸渊专线V2安装完成 (大脑服务器)" + echo "" + echo "下一步:" + echo " 1. 将生成的密钥添加到GitHub Secrets" + echo " 2. 添加用户: bash deploy-brain-proxy.sh add-user " + echo " 3. 配置腾讯云防火墙: 开放443端口" + echo "════════════════════════════════════════" +} + +# ── 生成V2独立密钥 ──────────────────────────── +generate_v2_keys() { + KEYS_FILE="$PROXY_DIR/.env.keys" + + # 如果已有密钥文件，跳过 + if [ -f "$KEYS_FILE" ] && grep -q "ZY_PROXY_REALITY_PRIVATE_KEY" "$KEYS_FILE" 2>/dev/null; then + echo " 密钥文件已存在，跳过生成" + return + fi + + echo " 生成V2独立密钥..." + + # Reality密钥对 + PRIVATE_KEY="" + PUBLIC_KEY="" + + if command -v xray &>/dev/null; then + KEYS_OUTPUT=$(xray x25519 2>&1) + PRIVATE_KEY=$(echo "$KEYS_OUTPUT" | grep -i "private" | awk '{print $NF}') || true + PUBLIC_KEY=$(echo "$KEYS_OUTPUT" | grep -i "public" | awk '{print $NF}') || true + fi + + if [ -z "$PRIVATE_KEY" ] && command -v openssl &>/dev/null; then + TMPKEY=$(mktemp) + if openssl genpkey -algorithm X25519 -out "$TMPKEY" 2>/dev/null; then + PRIVATE_KEY=$(openssl pkey -in "$TMPKEY" -outform DER 2>/dev/null | tail -c 32 | base64 | tr '+/' '-_' | tr -d '=') + PUBLIC_KEY=$(openssl pkey -in "$TMPKEY" -pubout -outform DER 2>/dev/null | tail -c 32 | base64 | tr '+/' '-_' | tr -d '=') + fi + rm -f "$TMPKEY" + fi + + if [ -z "$PRIVATE_KEY" ]; then + echo " ❌ 无法生成X25519密钥" + exit 1 + fi + + SHORT_ID=$(openssl rand -hex 8) + + cat > "$KEYS_FILE" <> "$KEYS_FILE" + elif [ -n "${ZY_SERVER_HOST:-}" ]; then + echo "ZY_SERVER_HOST=${ZY_SERVER_HOST}" >> "$KEYS_FILE" + fi + + # 保存面孔服务器节点信息 (多节点智能选路) + if [ -n "${ZY_FACE_HOST:-}" ]; then + echo "" >> "$KEYS_FILE" + echo "# 面孔服务器节点 (ZY-SVR-002 · SG2 · 多节点智能选路)" >> "$KEYS_FILE" + echo "ZY_FACE_HOST=${ZY_FACE_HOST}" >> "$KEYS_FILE" + fi + if [ -n "${ZY_FACE_REALITY_PUBLIC_KEY:-}" ]; then + echo "ZY_FACE_REALITY_PUBLIC_KEY=${ZY_FACE_REALITY_PUBLIC_KEY}" >> "$KEYS_FILE" + fi + if [ -n "${ZY_FACE_REALITY_SHORT_ID:-}" ]; then + echo "ZY_FACE_REALITY_SHORT_ID=${ZY_FACE_REALITY_SHORT_ID}" >> "$KEYS_FILE" + fi + + # 保存CN中转节点信息 + if [ -n "${ZY_CN_RELAY_HOST:-}" ]; then + echo "" >> "$KEYS_FILE" + echo "# CN中转节点 (国内→SG · 低延迟)" >> "$KEYS_FILE" + echo "ZY_CN_RELAY_HOST=${ZY_CN_RELAY_HOST}" >> "$KEYS_FILE" + echo "ZY_CN_RELAY_PORT=${ZY_CN_RELAY_PORT:-2053}" >> "$KEYS_FILE" + fi + + chmod 600 "$KEYS_FILE" + + echo "" + echo " ══════════ V2密钥已生成 ══════════" + echo " ⚠️ 密钥已保存到: $KEYS_FILE (权限600·仅root可读)" + echo " ⚠️ 如需查看密钥，请SSH到服务器执行: cat $KEYS_FILE" + echo " ⚠️ 部署完成后，将公钥和ShortID添加到GitHub Secrets:" + echo " ZY_BRAIN_PROXY_REALITY_PUBLIC_KEY" + echo " ZY_BRAIN_PROXY_REALITY_SHORT_ID" + echo " ═══════════════════════════════════" +} + +# ── 部署V2服务代码 ──────────────────────────── +deploy_services() { + mkdir -p "$PROXY_DIR"/{service,data,logs,config} + + # 复制V2服务文件 + cp "$REPO_PROXY_DIR"/service/user-manager.js "$PROXY_DIR/service/" + cp "$REPO_PROXY_DIR"/service/subscription-server-v2.js "$PROXY_DIR/service/" + cp "$REPO_PROXY_DIR"/service/traffic-monitor-v2.js "$PROXY_DIR/service/" + cp "$REPO_PROXY_DIR"/service/zy-cloud-vpn.js "$PROXY_DIR/service/" + cp "$REPO_PROXY_DIR"/service/vpn-worker.js "$PROXY_DIR/service/" + cp "$REPO_PROXY_DIR"/ecosystem.brain-proxy.config.js "$PROXY_DIR/" + + # 复制共用文件(发邮件等) + cp "$REPO_PROXY_DIR"/service/send-subscription.js "$PROXY_DIR/service/" 2>/dev/null || true + + echo "✅ V2服务代码已部署到 $PROXY_DIR" +} + +# ── 启动PM2服务 ─────────────────────────────── +start_pm2_services() { + cd "$PROXY_DIR" || { echo "❌ 无法进入 $PROXY_DIR"; return 1; } + + # 加载密钥作为环境变量 + if [ -f "$PROXY_DIR/.env.keys" ]; then + set -a + # shellcheck source=/dev/null + source "$PROXY_DIR/.env.keys" + set +a + fi + + pm2 startOrRestart ecosystem.brain-proxy.config.js --update-env + pm2 save + echo "✅ V2 PM2服务已就绪" + pm2 list +} + +# ── 健康检查 ────────────────────────────────── +health_check() { + echo "检查V2服务状态..." + + # Xray + if systemctl is-active --quiet xray 2>/dev/null; then + echo " ✅ Xray: 运行中" + else + echo " ⚠️ Xray: 未运行 (可能还没有用户)" + fi + + # 443端口 + if ss -tlnp | grep -q ":443 "; then + echo " ✅ 端口443: 监听中" + else + echo " ⚠️ 端口443: 未监听 (添加用户后启动)" + fi + + # V2订阅服务 + if curl -sf http://127.0.0.1:3803/health >/dev/null 2>&1; then + HEALTH=$(curl -sf http://127.0.0.1:3803/health) + USERS=$(echo "$HEALTH" | grep -o '"users_count":[0-9]*' | cut -d: -f2) + echo " ✅ V2订阅服务: 正常 (${USERS:-0}个用户)" + else + echo " ❌ V2订阅服务: 端口3803无响应" + fi + + # PM2 + pm2 list 2>/dev/null || echo " ⚠️ PM2: 未配置" + + # 用户列表 + echo "" + echo " ═══ 用户列表 ═══" + node "$PROXY_DIR/service/user-manager.js" list 2>/dev/null || echo " (无用户)" + + # 云防火墙提醒 + echo "" + echo " ═══ 云防火墙提醒 ═══" + echo " ⚠️ 大脑服务器腾讯云控制台防火墙需开放:" + echo " TCP 443 端口 允许所有来源 (0.0.0.0/0) ← VPN入口" + echo " TCP 22 端口 允许所有来源 ← SSH管理" +} + +# ── update: 更新代码 ────────────────────────── +update() { + echo "更新V2代理服务..." + deploy_services + ensure_xray_root_user + mkdir -p "$PROXY_DIR/logs" + chmod 755 "$PROXY_DIR/logs" + + # 重建Xray配置（根据当前用户列表） + node "$PROXY_DIR/service/user-manager.js" rebuild 2>/dev/null || true + systemctl restart xray 2>/dev/null || true + + # 确保UFW开放443 + if command -v ufw &>/dev/null; then + ufw allow 443/tcp comment "Xray VLESS+Reality V2" 2>/dev/null || true + fi + + start_pm2_services + health_check + echo "✅ V2更新完成" +} + +# ── restart: 重启 ───────────────────────────── +restart() { + echo "重启V2代理服务..." + systemctl restart xray 2>/dev/null || true + start_pm2_services + sleep 3 + health_check +} + +# ── add-user: 添加用户 ──────────────────────── +add_user() { + EMAIL="${2:-}" + QUOTA="${3:-500}" + + if [ -z "$EMAIL" ]; then + echo "用法: bash deploy-brain-proxy.sh add-user [quota_gb]" + exit 1 + fi + + node "$PROXY_DIR/service/user-manager.js" add "$EMAIL" "$QUOTA" +} + +# ── remove-user: 移除用户 ───────────────────── +remove_user() { + EMAIL="${2:-}" + + if [ -z "$EMAIL" ]; then + echo "用法: bash deploy-brain-proxy.sh remove-user " + exit 1 + fi + + node "$PROXY_DIR/service/user-manager.js" remove "$EMAIL" +} + +# ── list-users: 列出用户 ────────────────────── +list_users() { + node "$PROXY_DIR/service/user-manager.js" list +} + +# ── 执行 ────────────────────────────────────── +case "$ACTION" in + install) install ;; + update) update ;; + status) health_check ;; + restart) restart ;; + add-user) add_user "$@" ;; + remove-user) remove_user "$@" ;; + list-users) list_users ;; + *) + echo "用法: bash deploy-brain-proxy.sh {install|update|status|restart|add-user|remove-user|list-users}" + exit 1 + ;; +esac diff --git a/server/proxy/ecosystem.brain-proxy.config.js b/server/proxy/ecosystem.brain-proxy.config.js new file mode 100644 index 00000000..90b93fd1 --- /dev/null +++ b/server/proxy/ecosystem.brain-proxy.config.js @@ -0,0 +1,57 @@ +// ═══════════════════════════════════════════════ +// 铸渊专线V2 · PM2 大脑服务器代理配置 +// 部署在 ZY-SVR-005 (43.156.237.110) · 大脑服务器 +// 管理V2订阅服务 + V2流量监控 +// ═══════════════════════════════════════════════ + +module.exports = { + apps: [ + { + name: 'zy-cloud-vpn', + version: '2.0.0', + script: '/opt/zhuyuan-brain/proxy/service/zy-cloud-vpn.js', + instances: 1, + exec_mode: 'fork', + env: { + NODE_ENV: 'production', + ZY_CLOUD_VPN_PORT: 3804, + ZY_BRAIN_PROXY_DIR: '/opt/zhuyuan-brain/proxy' + }, + max_memory_restart: '128M', + log_file: '/opt/zhuyuan-brain/proxy/logs/zy-cloud-vpn.log', + error_file: '/opt/zhuyuan-brain/proxy/logs/zy-cloud-vpn-error.log', + time: true + }, + { + name: 'zy-proxy-v2-sub', + version: '2.0.0', + script: '/opt/zhuyuan-brain/proxy/service/subscription-server-v2.js', + instances: 1, + exec_mode: 'fork', + env: { + NODE_ENV: 'production', + ZY_PROXY_V2_PORT: 3803, + ZY_BRAIN_PROXY_DIR: '/opt/zhuyuan-brain/proxy' + }, + max_memory_restart: '128M', + log_file: '/opt/zhuyuan-brain/proxy/logs/subscription-v2.log', + error_file: '/opt/zhuyuan-brain/proxy/logs/subscription-v2-error.log', + time: true + }, + { + name: 'zy-proxy-v2-monitor', + version: '2.0.0', + script: '/opt/zhuyuan-brain/proxy/service/traffic-monitor-v2.js', + instances: 1, + exec_mode: 'fork', + env: { + NODE_ENV: 'production', + ZY_BRAIN_PROXY_DIR: '/opt/zhuyuan-brain/proxy' + }, + max_memory_restart: '64M', + log_file: '/opt/zhuyuan-brain/proxy/logs/monitor-v2.log', + error_file: '/opt/zhuyuan-brain/proxy/logs/monitor-v2-error.log', + time: true + } + ] +}; diff --git a/server/proxy/service/subscription-server-v2.js b/server/proxy/service/subscription-server-v2.js new file mode 100644 index 00000000..d8c6bd10 --- /dev/null +++ b/server/proxy/service/subscription-server-v2.js @@ -0,0 +1,642 @@ +#!/usr/bin/env node +// ═══════════════════════════════════════════════ +// 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001 +// 📜 Copyright: 国作登字-2026-A-00037559 +// ═══════════════════════════════════════════════ +// server/proxy/service/subscription-server-v2.js +// 🌐 铸渊专线V2 · 多用户订阅服务 +// +// 部署在大脑服务器 (ZY-SVR-005 · 43.156.237.110) +// 每个邮箱一条独立专线，Token认证隔离 +// +// 与V1的区别: +// V1: 单UUID · 单Token · 共享线路 +// V2: 每人独立UUID · 独立Token · 独立流量统计 +// +// 端口: 3803 (绑定127.0.0.1，通过Nginx反代访问) +// ═══════════════════════════════════════════════ + +'use strict'; + +const http = require('http'); +const fs = require('fs'); +const path = require('path'); +const url = require('url'); + +const PORT = process.env.ZY_PROXY_V2_PORT || 3803; +const PROXY_DIR = process.env.ZY_BRAIN_PROXY_DIR || '/opt/zhuyuan-brain/proxy'; +const DATA_DIR = path.join(PROXY_DIR, 'data'); +const KEYS_FILE = path.join(PROXY_DIR, '.env.keys'); +const LIVE_NODES_FRESHNESS_MS = parseInt(process.env.ZY_CLOUD_HB_EXPIRY_MS || '600000', 10); + +// 引入用户管理器 +const userManager = require('./user-manager'); + +// ── 加载密钥 ──────────────────────────────── +function loadKeys() { + const keys = {}; + try { + const content = fs.readFileSync(KEYS_FILE, 'utf8'); + for (const line of content.split('\n')) { + if (line.startsWith('#') || !line.includes('=')) continue; + const [key, ...vals] = line.split('='); + keys[key.trim()] = vals.join('=').trim(); + } + } catch (err) { + keys.ZY_PROXY_REALITY_PUBLIC_KEY = process.env.ZY_PROXY_REALITY_PUBLIC_KEY || ''; + keys.ZY_PROXY_REALITY_SHORT_ID = process.env.ZY_PROXY_REALITY_SHORT_ID || ''; + } + return keys; +} + +// ── 从环境变量或密钥文件读取值 ────────────── +function getEnvOrKey(envName) { + if (process.env[envName]) return process.env[envName]; + + try { + const content = fs.readFileSync(KEYS_FILE, 'utf8'); + for (const line of content.split('\n')) { + if (line.startsWith('#') || !line.includes('=')) continue; + const [key, ...vals] = line.split('='); + if (key.trim() === envName) { + const val = vals.join('=').trim(); + if (val) return val; + } + } + } catch { /* ignore */ } + + return ''; +} + +// ── 获取服务器IP ──────────────────────────── +function getServerHost() { + return getEnvOrKey('ZY_BRAIN_HOST') || getEnvOrKey('ZY_SERVER_HOST') || '0.0.0.0'; +} + +// ── 构建所有可用VPN节点 ────────────────────── +// 优先从ZY-CLOUD活模块获取（动态·实时健康检查后的活节点） +// 回退到静态配置（ZY-CLOUD未运行时） +function buildVpnNodes() { + // 优先: 从ZY-CLOUD活模块的动态节点列表读取 + const liveNodesFile = path.join(DATA_DIR, 'nodes-live.json'); + try { + const liveData = JSON.parse(fs.readFileSync(liveNodesFile, 'utf8')); + // 检查数据是否新鲜（使用与ZY-CLOUD相同的心跳过期阈值） + const age = Date.now() - new Date(liveData.updated_at).getTime(); + if (age < LIVE_NODES_FRESHNESS_MS * 2 && liveData.nodes && liveData.nodes.length > 0) { + return liveData.nodes; + } + } catch { /* ZY-CLOUD未运行，回退到静态配置 */ } + + // 回退: 从环境变量/密钥文件静态构建 + return buildStaticNodes(); +} + +// ── 静态节点构建（回退用）──────────────────── +function buildStaticNodes() { + const nodes = []; + + // 节点1: 大脑服务器 (ZY-SVR-005 · 新加坡一区 · 4核8G · 主力) + const brainHost = getEnvOrKey('ZY_BRAIN_HOST'); + const brainPbk = getEnvOrKey('ZY_PROXY_REALITY_PUBLIC_KEY'); + const brainSid = getEnvOrKey('ZY_PROXY_REALITY_SHORT_ID'); + if (brainHost && brainPbk && brainSid) { + nodes.push({ + id: 'zy-brain-sg1', + name: '🧠 铸渊专线V2-SG1(大脑)', + host: brainHost, + port: 443, + pbk: brainPbk, + sid: brainSid, + region: 'sg-zone1', + priority: 1 + }); + } + + // 节点2: 面孔服务器 (ZY-SVR-002 · 新加坡二区 · 2核8G · 备用) + const faceHost = getEnvOrKey('ZY_FACE_HOST'); + const facePbk = getEnvOrKey('ZY_FACE_REALITY_PUBLIC_KEY'); + const faceSid = getEnvOrKey('ZY_FACE_REALITY_SHORT_ID'); + if (faceHost && facePbk && faceSid) { + nodes.push({ + id: 'zy-face-sg2', + name: '🏛️ 铸渊专线V2-SG2(面孔)', + host: faceHost, + port: 443, + pbk: facePbk, + sid: faceSid, + region: 'sg-zone2', + priority: 2 + }); + } + + // 节点3: CN中转 (国内→SG · 对国内用户低延迟) + const cnHost = getEnvOrKey('ZY_CN_RELAY_HOST'); + const cnPort = parseInt(getEnvOrKey('ZY_CN_RELAY_PORT') || '2053', 10); + // CN中转是TCP透传，Reality密钥用主力节点的（大脑） + if (cnHost && brainPbk && brainSid) { + nodes.push({ + id: 'zy-cn-relay', + name: '🇨🇳 铸渊专线V2-CN中转', + host: cnHost, + port: cnPort, + pbk: brainPbk, + sid: brainSid, + region: 'cn-relay', + priority: 3 + }); + } + + return nodes; +} + +// ── 生成subscription-userinfo头 ────────────── +function generateUserInfoHeader(user) { + const nextMonth = new Date(); + nextMonth.setMonth(nextMonth.getMonth() + 1); + nextMonth.setDate(1); + nextMonth.setHours(0, 0, 0, 0); + + return `upload=${user.traffic.upload_bytes}; download=${user.traffic.download_bytes}; total=${user.quota_bytes}; expire=${Math.floor(nextMonth.getTime() / 1000)}`; +} + +// ── 生成VLESS URI (Shadowrocket · 多节点) ───── +function generateVlessUris(user, nodes) { + return nodes.map(node => { + const params = new URLSearchParams({ + encryption: 'none', + flow: 'xtls-rprx-vision', + security: 'reality', + sni: 'www.microsoft.com', + fp: 'chrome', + pbk: node.pbk, + sid: node.sid, + type: 'tcp', + headerType: 'none' + }); + const label = encodeURIComponent(node.name); + return `vless://${user.uuid}@${node.host}:${node.port}?${params.toString()}#${label}`; + }).join('\n'); +} + +// ── 生成Clash YAML配置 (多节点智能选路) ────── +function generateClashYaml(user, nodes) { + // 构建proxies块 — 每个节点一条 + const proxyBlocks = nodes.map(node => ` - name: "${node.name}" + type: vless + server: ${node.host} + port: ${node.port} + uuid: ${user.uuid} + network: tcp + tls: true + udp: true + flow: xtls-rprx-vision + skip-cert-verify: false + servername: www.microsoft.com + reality-opts: + public-key: ${node.pbk} + short-id: ${node.sid} + client-fingerprint: chrome`).join('\n'); + + // 节点名列表 + const nodeNames = nodes.map(n => ` - "${n.name}"`).join('\n'); + + // url-test自动选择组 (延迟最低的自动生效) + const autoSelectBlock = nodes.length > 1 ? ` + - name: "♻️ 自动选择" + type: url-test + proxies: +${nodeNames} + url: "http://www.gstatic.com/generate_204" + interval: 300 + tolerance: 50 +` : ''; + + // 主代理组 + const mainProxies = nodes.length > 1 + ? ` - "♻️ 自动选择"\n${nodeNames}\n - DIRECT` + : `${nodeNames}\n - DIRECT`; + + // AI/开发工具代理组的节点列表 + const toolProxies = nodes.length > 1 + ? ` - "♻️ 自动选择"\n${nodeNames}` + : nodeNames; + + return `# 铸渊专线V2 · ${user.label} 的独立专线 +# 自动生成 · ${new Date().toISOString()} +# ⚠️ 此配置为 ${user.email} 专属，请勿分享 +# 每人一条独立线路 · ${nodes.length}个节点智能选路 + +# ── 全局设置 ────────────────────────────── +mixed-port: 7890 +allow-lan: false +mode: rule +log-level: info +ipv6: false +unified-delay: true +tcp-concurrent: true +find-process-mode: strict +geodata-mode: true +geodata-loader: standard +global-client-fingerprint: chrome +keep-alive-interval: 30 +external-controller: 127.0.0.1:9090 + +# ── GeoData 数据源 ──────────────────────── +geox-url: + geoip: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geoip.dat" + geosite: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geosite.dat" + mmdb: "https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/country.mmdb" + +# ── DNS 设置 (fake-ip模式) ──────────────── +dns: + enable: true + listen: 0.0.0.0:1053 + ipv6: false + enhanced-mode: fake-ip + fake-ip-range: 198.18.0.1/16 + fake-ip-filter: + - "*.lan" + - "*.local" + - "*.direct" + - "localhost.ptlogin2.qq.com" + - "dns.msftncsi.com" + - "*.msftconnecttest.com" + - "*.msftncsi.com" + - "+.stun.*.*" + - "+.stun.*.*.*" + - "lens.l.google.com" + - "stun.l.google.com" + - "time.*.com" + - "time.*.gov" + - "time.*.edu.cn" + - "time.*.apple.com" + - "time-ios.apple.com" + - "time-macos.apple.com" + - "ntp.*.com" + - "+.pool.ntp.org" + - "music.163.com" + - "*.music.163.com" + - "*.126.net" + default-nameserver: + - 223.5.5.5 + - 119.29.29.29 + - 1.0.0.1 + nameserver: + - https://dns.alidns.com/dns-query + - https://doh.pub/dns-query + fallback: + - https://1.0.0.1/dns-query + - https://dns.google/dns-query + - tls://8.8.4.4:853 + fallback-filter: + geoip: true + geoip-code: CN + geosite: + - gfw + ipcidr: + - 240.0.0.0/4 + domain: + - "+.google.com" + - "+.facebook.com" + - "+.youtube.com" + - "+.github.com" + - "+.googleapis.com" + - "+.openai.com" + - "+.anthropic.com" + +# ── 域名嗅探 ────────────────────────────── +sniffer: + enable: true + force-dns-mapping: true + parse-pure-ip: true + override-destination: true + sniff: + HTTP: + ports: [80, 8080-8880] + override-destination: true + TLS: + ports: [443, 8443] + QUIC: + ports: [443, 8443] + skip-domain: + - "Mijia Cloud" + - "+.push.apple.com" + +# ── 代理节点 (${nodes.length}个 · 智能选路) ── +proxies: +${proxyBlocks} + +# ── 代理组 ──────────────────────────────── +proxy-groups: + - name: "🌐 铸渊专线" + type: select + proxies: +${mainProxies} +${autoSelectBlock} + - name: "🤖 AI服务" + type: select + proxies: +${toolProxies} + + - name: "💻 开发工具" + type: select + proxies: +${toolProxies} + +# ── 路由规则 ────────────────────────────── +rules: + # AI服务 + - DOMAIN-SUFFIX,openai.com,🤖 AI服务 + - DOMAIN-SUFFIX,anthropic.com,🤖 AI服务 + - DOMAIN-SUFFIX,claude.ai,🤖 AI服务 + - DOMAIN-SUFFIX,chatgpt.com,🤖 AI服务 + - DOMAIN-SUFFIX,gemini.google.com,🤖 AI服务 + - DOMAIN-SUFFIX,perplexity.ai,🤖 AI服务 + - DOMAIN-SUFFIX,poe.com,🤖 AI服务 + + # 开发工具 + - DOMAIN-SUFFIX,github.com,💻 开发工具 + - DOMAIN-SUFFIX,githubusercontent.com,💻 开发工具 + - DOMAIN-SUFFIX,github.io,💻 开发工具 + - DOMAIN-SUFFIX,githubassets.com,💻 开发工具 + - DOMAIN-SUFFIX,copilot.microsoft.com,💻 开发工具 + - DOMAIN-SUFFIX,npmjs.com,💻 开发工具 + - DOMAIN-SUFFIX,docker.com,💻 开发工具 + - DOMAIN-SUFFIX,docker.io,💻 开发工具 + - DOMAIN-SUFFIX,stackoverflow.com,💻 开发工具 + - DOMAIN-SUFFIX,pypi.org,💻 开发工具 + + # 社交媒体 & 流媒体 + - DOMAIN-SUFFIX,tiktok.com,🌐 铸渊专线 + - DOMAIN-SUFFIX,twitter.com,🌐 铸渊专线 + - DOMAIN-SUFFIX,x.com,🌐 铸渊专线 + - DOMAIN-SUFFIX,youtube.com,🌐 铸渊专线 + - DOMAIN-SUFFIX,googlevideo.com,🌐 铸渊专线 + - DOMAIN-SUFFIX,google.com,🌐 铸渊专线 + - DOMAIN-SUFFIX,googleapis.com,🌐 铸渊专线 + - DOMAIN-SUFFIX,telegram.org,🌐 铸渊专线 + - DOMAIN-SUFFIX,t.me,🌐 铸渊专线 + - DOMAIN-SUFFIX,instagram.com,🌐 铸渊专线 + - DOMAIN-SUFFIX,facebook.com,🌐 铸渊专线 + - DOMAIN-SUFFIX,whatsapp.com,🌐 铸渊专线 + - DOMAIN-SUFFIX,wikipedia.org,🌐 铸渊专线 + - DOMAIN-SUFFIX,reddit.com,🌐 铸渊专线 + - DOMAIN-SUFFIX,netflix.com,🌐 铸渊专线 + - DOMAIN-SUFFIX,spotify.com,🌐 铸渊专线 + - DOMAIN-SUFFIX,discord.com,🌐 铸渊专线 + + # Apple + - DOMAIN-SUFFIX,apple.com,DIRECT + - DOMAIN-SUFFIX,icloud.com,DIRECT + + # 国内直连 + - DOMAIN-SUFFIX,cn,DIRECT + - DOMAIN-SUFFIX,taobao.com,DIRECT + - DOMAIN-SUFFIX,tmall.com,DIRECT + - DOMAIN-SUFFIX,alipay.com,DIRECT + - DOMAIN-SUFFIX,aliyun.com,DIRECT + - DOMAIN-SUFFIX,jd.com,DIRECT + - DOMAIN-SUFFIX,qq.com,DIRECT + - DOMAIN-SUFFIX,tencent.com,DIRECT + - DOMAIN-SUFFIX,bilibili.com,DIRECT + - DOMAIN-SUFFIX,baidu.com,DIRECT + - DOMAIN-SUFFIX,zhihu.com,DIRECT + - DOMAIN-SUFFIX,douyin.com,DIRECT + - DOMAIN-SUFFIX,weibo.com,DIRECT + + # 局域网直连 + - IP-CIDR,192.168.0.0/16,DIRECT + - IP-CIDR,10.0.0.0/8,DIRECT + - IP-CIDR,172.16.0.0/12,DIRECT + - IP-CIDR,127.0.0.0/8,DIRECT + + # GeoIP中国直连 + - GEOIP,CN,DIRECT + + # 默认走代理 + - MATCH,🌐 铸渊专线 +`; +} + +// ── 检测客户端类型 ─────────────────────────── +function detectClientType(userAgent) { + const ua = (userAgent || '').toLowerCase(); + if (ua.includes('clash') || ua.includes('mihomo') || ua.includes('stash')) return 'clash'; + if (ua.includes('shadowrocket') || ua.includes('quantumult') || ua.includes('surge')) return 'base64'; + return 'clash'; +} + +// ── HTTP服务器 ─────────────────────────────── +const server = http.createServer((req, res) => { + try { + const parsedUrl = url.parse(req.url, true); + const pathname = parsedUrl.pathname; + + // 健康检查 + if (pathname === '/health') { + const users = userManager.getEnabledUsers(); + const nodes = buildVpnNodes(); + res.writeHead(200, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify({ + status: 'ok', + service: 'zy-proxy-v2-subscription', + version: '2.0.0', + users_count: users.length, + nodes_count: nodes.length, + smart_routing: nodes.length > 1 ? 'url-test' : 'single', + server: 'ZY-SVR-005 · Brain' + })); + return; + } + + // V2订阅端点: /sub/{token} + // token是每个用户独立的，不会串线 + const subMatch = pathname.match(/^\/sub\/([a-f0-9]+)$/); + if (subMatch) { + const token = subMatch[1]; + const user = userManager.findUserByToken(token); + + if (!user) { + res.writeHead(403, { 'Content-Type': 'text/plain' }); + res.end('Forbidden'); + return; + } + + const nodes = buildVpnNodes(); + if (nodes.length === 0) { + res.writeHead(503, { 'Content-Type': 'text/plain' }); + res.end('No VPN nodes configured'); + return; + } + + const clientType = detectClientType(req.headers['user-agent']); + const userInfoHeader = generateUserInfoHeader(user); + + if (clientType === 'clash') { + const yaml = generateClashYaml(user, nodes); + res.writeHead(200, { + 'Content-Type': 'text/yaml; charset=utf-8', + 'Content-Disposition': `attachment; filename="zy-proxy-v2-${user.label}.yaml"`, + 'subscription-userinfo': userInfoHeader, + 'profile-update-interval': '6', + 'profile-title': 'base64:' + Buffer.from(`铸渊专线V2·${user.label}`).toString('base64'), + }); + res.end(yaml); + } else { + const vlessUris = generateVlessUris(user, nodes); + const encoded = Buffer.from(vlessUris).toString('base64'); + res.writeHead(200, { + 'Content-Type': 'text/plain; charset=utf-8', + 'subscription-userinfo': userInfoHeader, + 'profile-update-interval': '6', + }); + res.end(encoded); + } + return; + } + + // 用户配额查询: /quota/{token} + const quotaMatch = pathname.match(/^\/quota\/([a-f0-9]+)$/); + if (quotaMatch) { + const token = quotaMatch[1]; + const user = userManager.findUserByToken(token); + + if (!user) { + res.writeHead(403, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify({ error: true, code: 'FORBIDDEN', message: '认证失败' })); + return; + } + + const totalGB = user.quota_bytes / (1024 ** 3); + const usedGB = (user.traffic.upload_bytes + user.traffic.download_bytes) / (1024 ** 3); + + res.writeHead(200, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify({ + email: user.email, + label: user.label, + total_gb: parseFloat(totalGB.toFixed(1)), + used_gb: parseFloat(usedGB.toFixed(2)), + remaining_gb: parseFloat((totalGB - usedGB).toFixed(2)), + percentage_used: parseFloat(((usedGB / totalGB) * 100).toFixed(1)), + period: user.traffic.period, + updated_at: new Date().toISOString() + })); + return; + } + + // 用户状态: /status/{token} + const statusMatch = pathname.match(/^\/status\/([a-f0-9]+)$/); + if (statusMatch) { + const token = statusMatch[1]; + const user = userManager.findUserByToken(token); + + if (!user) { + res.writeHead(403, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify({ error: true, code: 'FORBIDDEN', message: '认证失败' })); + return; + } + + const totalGB = user.quota_bytes / (1024 ** 3); + const usedGB = (user.traffic.upload_bytes + user.traffic.download_bytes) / (1024 ** 3); + const nodes = buildVpnNodes(); + + res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' }); + res.end(JSON.stringify({ + user: { + email: user.email, + label: user.label, + enabled: user.enabled + }, + server: { + status: 'online', + version: '2.0.0', + uptime_seconds: Math.floor(process.uptime()), + region: 'sg', + region_name: 'Singapore', + server_code: 'ZY-SVR-005' + }, + nodes: nodes.map(n => ({ + id: n.id, + name: n.name, + region: n.region, + port: n.port + })), + smart_routing: nodes.length > 1 ? 'url-test (自动选最快)' : 'single-node', + quota: { + total_gb: parseFloat(totalGB.toFixed(1)), + used_gb: parseFloat(usedGB.toFixed(2)), + remaining_gb: parseFloat((totalGB - usedGB).toFixed(2)), + percentage_used: parseFloat(((usedGB / totalGB) * 100).toFixed(1)), + period: user.traffic.period + }, + updated_at: new Date().toISOString() + })); + return; + } + + // 404 + res.writeHead(404, { 'Content-Type': 'text/plain' }); + res.end('Not Found'); + } catch (err) { + console.error('❌ 请求处理错误 [%s %s]:', req.method, req.url, err.message || err); + try { + if (!res.headersSent) { + res.writeHead(500, { 'Content-Type': 'text/plain' }); + } + res.end('Internal Server Error'); + } catch (writeErr) { + console.error(' ⚠️ 响应写入失败:', writeErr.message); + } + } +}); + +server.on('error', (err) => { + console.error('❌ 服务器错误:', err.message); + if (err.code === 'EADDRINUSE') { + console.error(' 端口 %d 已被占用', PORT); + process.exit(1); + } +}); + +server.on('clientError', (err, socket) => { + console.error('⚠️ 客户端连接错误:', err.code || err.message); + if (socket.writable) { + socket.end('HTTP/1.1 400 Bad Request\r\n\r\n'); + } +}); + +server.listen(PORT, '127.0.0.1', () => { + const users = userManager.getEnabledUsers(); + console.log(`🌐 铸渊专线V2订阅服务已启动: http://127.0.0.1:${PORT}`); + console.log(` 版本: V2.0 (多用户独立专线)`); + console.log(` 用户数: ${users.length}`); + console.log(` 服务器: ZY-SVR-005 · Brain`); + console.log(` ──────────────────────────`); + console.log(` 订阅端点: /sub/{user_token}`); + console.log(` 配额查询: /quota/{user_token}`); + console.log(` 服务状态: /status/{user_token}`); + console.log(` 健康检查: /health`); +}); + +// Graceful shutdown +function gracefulShutdown(signal) { + console.log(`\n${signal} received. Shutting down gracefully...`); + const forceExit = setTimeout(() => { process.exit(1); }, 5000); + server.close(() => { + clearTimeout(forceExit); + console.log('Server closed.'); + process.exit(0); + }); +} +process.on('SIGTERM', () => gracefulShutdown('SIGTERM')); +process.on('SIGINT', () => gracefulShutdown('SIGINT')); + +process.on('uncaughtException', (err) => { + console.error('❌ 未捕获的异常:', err.message); + console.error(err.stack); + gracefulShutdown('uncaughtException'); +}); +process.on('unhandledRejection', (reason) => { + console.error('❌ 未处理的Promise拒绝:', reason); +}); diff --git a/server/proxy/service/traffic-monitor-v2.js b/server/proxy/service/traffic-monitor-v2.js new file mode 100644 index 00000000..b2487864 --- /dev/null +++ b/server/proxy/service/traffic-monitor-v2.js @@ -0,0 +1,145 @@ +#!/usr/bin/env node +// ═══════════════════════════════════════════════ +// 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001 +// 📜 Copyright: 国作登字-2026-A-00037559 +// ═══════════════════════════════════════════════ +// server/proxy/service/traffic-monitor-v2.js +// 📊 铸渊专线V2 · 多用户流量监控Agent +// +// 定期查询Xray Stats API获取每个用户的独立流量数据 +// Xray通过email字段追踪每个client的流量: +// user>>>email@example.com>>>traffic>>>uplink +// user>>>email@example.com>>>traffic>>>downlink +// +// 运行方式: PM2 managed (zy-proxy-v2-monitor) +// 检查间隔: 每5分钟 +// ═══════════════════════════════════════════════ + +'use strict'; + +const { execSync } = require('child_process'); +const fs = require('fs'); +const path = require('path'); + +const PROXY_DIR = process.env.ZY_BRAIN_PROXY_DIR || '/opt/zhuyuan-brain/proxy'; +const DATA_DIR = path.join(PROXY_DIR, 'data'); +const XRAY_API_HOST = '127.0.0.1'; +const XRAY_API_PORT = 10085; +const CHECK_INTERVAL = 5 * 60 * 1000; // 5分钟 + +// 引入用户管理器 +const userManager = require('./user-manager'); + +// ── 查询Xray流量统计 ──────────────────────── +function queryXrayStats() { + try { + const result = execSync( + `xray api statsquery --server=${XRAY_API_HOST}:${XRAY_API_PORT} -pattern ""`, + { encoding: 'utf8', timeout: 10000 } + ); + return JSON.parse(result); + } catch (err) { + console.error('[V2流量监控] Xray Stats API查询失败:', err.message); + return null; + } +} + +// ── 解析每用户流量 ─────────────────────────── +// Xray Stats格式: user>>>email@example.com>>>traffic>>>uplink +function parsePerUserStats(stats) { + if (!stats || !stats.stat) return {}; + + const userTraffic = {}; + + for (const item of stats.stat) { + if (!item.name || !item.name.startsWith('user>>>')) continue; + + // 格式: user>>>email>>>traffic>>>uplink/downlink + const parts = item.name.split('>>>'); + if (parts.length < 4) continue; + + const email = parts[1]; + const direction = parts[3]; // 'uplink' or 'downlink' + const bytes = parseInt(item.value || '0', 10); + + if (!userTraffic[email]) { + userTraffic[email] = { upload: 0, download: 0 }; + } + + if (direction === 'uplink') { + userTraffic[email].upload = bytes; + } else if (direction === 'downlink') { + userTraffic[email].download = bytes; + } + } + + return userTraffic; +} + +// ── 主循环 ─────────────────────────────────── +function monitor() { + console.log('[V2流量监控] 开始检查...'); + + // 查询Xray统计 + const stats = queryXrayStats(); + if (!stats) { + console.log('[V2流量监控] Xray统计暂不可用'); + return; + } + + // 解析每用户流量 + const perUserTraffic = parsePerUserStats(stats); + const users = userManager.getEnabledUsers(); + + let totalUpload = 0; + let totalDownload = 0; + + for (const user of users) { + const traffic = perUserTraffic[user.email]; + if (traffic) { + userManager.updateTraffic(user.email, traffic.upload, traffic.download); + totalUpload += traffic.upload; + totalDownload += traffic.download; + + const usedGB = ((traffic.upload + traffic.download) / (1024 ** 3)).toFixed(2); + const quotaGB = (user.quota_bytes / (1024 ** 3)).toFixed(0); + console.log(` ${user.email}: ${usedGB}GB / ${quotaGB}GB`); + } + } + + const totalGB = ((totalUpload + totalDownload) / (1024 ** 3)).toFixed(2); + console.log(`[V2流量监控] 总流量: ${totalGB}GB (${users.length}个用户)`); + + // 保存汇总数据 + const summaryFile = path.join(DATA_DIR, 'v2-traffic-summary.json'); + const summary = { + total_upload_bytes: totalUpload, + total_download_bytes: totalDownload, + total_used_bytes: totalUpload + totalDownload, + users_count: users.length, + per_user: Object.entries(perUserTraffic).map(([email, t]) => ({ + email, + upload_gb: parseFloat((t.upload / (1024 ** 3)).toFixed(2)), + download_gb: parseFloat((t.download / (1024 ** 3)).toFixed(2)), + total_gb: parseFloat(((t.upload + t.download) / (1024 ** 3)).toFixed(2)) + })), + updated_at: new Date().toISOString() + }; + + fs.mkdirSync(DATA_DIR, { recursive: true }); + fs.writeFileSync(summaryFile, JSON.stringify(summary, null, 2)); + console.log('[V2流量监控] 检查完成'); +} + +// ── 启动监控循环 ───────────────────────────── +console.log('📊 铸渊专线V2流量监控启动'); +console.log(` 检查间隔: ${CHECK_INTERVAL / 1000}秒`); +console.log(` 数据目录: ${DATA_DIR}`); + +// 立即执行一次 +try { monitor(); } catch (err) { console.error('首次检查失败:', err.message); } + +// 定期执行 +setInterval(() => { + try { monitor(); } catch (err) { console.error('监控异常:', err.message); } +}, CHECK_INTERVAL); diff --git a/server/proxy/service/user-manager.js b/server/proxy/service/user-manager.js new file mode 100644 index 00000000..8e41351c --- /dev/null +++ b/server/proxy/service/user-manager.js @@ -0,0 +1,522 @@ +#!/usr/bin/env node +// ═══════════════════════════════════════════════ +// 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001 +// 📜 Copyright: 国作登字-2026-A-00037559 +// ═══════════════════════════════════════════════ +// server/proxy/service/user-manager.js +// 👤 铸渊专线V2 · 多用户管理器 +// +// 每个邮箱绑定一条独立专线: +// - 独立UUID (Xray VLESS用户ID) +// - 独立订阅Token (订阅URL认证) +// - 独立流量统计 (Xray Stats按email追踪) +// - 独立配额 (每人500GB/月) +// +// 用户数据存储: /opt/zhuyuan-brain/proxy/data/users.json +// Xray配置自动重建: 增删用户后自动更新config并重启Xray +// +// CLI用法: +// node user-manager.js add — 添加用户 +// node user-manager.js remove — 移除用户 +// node user-manager.js list — 列出所有用户 +// node user-manager.js get — 查看用户详情 +// node user-manager.js rebuild — 重建Xray配置 +// node user-manager.js export — 导出用户数据(无密钥) +// ═══════════════════════════════════════════════ + +'use strict'; + +const fs = require('fs'); +const path = require('path'); +const crypto = require('crypto'); +const { execSync } = require('child_process'); + +// ── 路径配置 ──────────────────────────────── +const PROXY_DIR = process.env.ZY_BRAIN_PROXY_DIR || '/opt/zhuyuan-brain/proxy'; +const DATA_DIR = path.join(PROXY_DIR, 'data'); +const USERS_FILE = path.join(DATA_DIR, 'users.json'); +const XRAY_CONFIG_OUTPUT = '/usr/local/etc/xray/config.json'; +const XRAY_TEMPLATE = path.join(PROXY_DIR, 'config', 'xray-brain-template.json'); +const KEYS_FILE = path.join(PROXY_DIR, '.env.keys'); + +// ── 工具函数 ──────────────────────────────── + +/** + * 生成UUID v4 + */ +function generateUUID() { + // 优先用xray内置生成 + try { + const uuid = execSync('xray uuid', { encoding: 'utf8', timeout: 5000 }).trim(); + if (uuid && uuid.match(/^[0-9a-f]{8}-/)) return uuid; + } catch { /* fallback */ } + + // 回退: crypto + return crypto.randomUUID(); +} + +/** + * 生成32字节hex订阅Token + */ +function generateToken() { + return crypto.randomBytes(32).toString('hex'); +} + +/** + * 读取用户数据库 + */ +function loadUsers() { + try { + return JSON.parse(fs.readFileSync(USERS_FILE, 'utf8')); + } catch { + return { version: '2.0', users: [], created_at: new Date().toISOString() }; + } +} + +/** + * 保存用户数据库 + */ +function saveUsers(db) { + fs.mkdirSync(DATA_DIR, { recursive: true }); + db.updated_at = new Date().toISOString(); + fs.writeFileSync(USERS_FILE, JSON.stringify(db, null, 2)); + fs.chmodSync(USERS_FILE, 0o600); +} + +/** + * 读取密钥文件 + */ +function loadKeys() { + const keys = {}; + try { + const content = fs.readFileSync(KEYS_FILE, 'utf8'); + for (const line of content.split('\n')) { + if (line.startsWith('#') || !line.includes('=')) continue; + const [key, ...vals] = line.split('='); + keys[key.trim()] = vals.join('=').trim(); + } + } catch { /* ignore */ } + return keys; +} + +// ── 用户操作 ──────────────────────────────── + +/** + * 添加用户 + * @param {string} email - 邮箱地址 + * @param {object} options - 可选参数 {quota_gb, label} + * @returns {object} 新用户信息 + */ +function addUser(email, options = {}) { + if (!email || !email.includes('@')) { + throw new Error(`无效的邮箱地址: ${email}`); + } + + const db = loadUsers(); + + // 检查是否已存在 + const existing = db.users.find(u => u.email === email); + if (existing) { + throw new Error(`用户已存在: ${email} (UUID: ${existing.uuid.substring(0, 8)}...)`); + } + + const now = new Date(); + const user = { + email, + uuid: generateUUID(), + token: generateToken(), + label: options.label || email.split('@')[0], + quota_bytes: (options.quota_gb || 500) * 1024 * 1024 * 1024, + enabled: true, + created_at: now.toISOString(), + traffic: { + upload_bytes: 0, + download_bytes: 0, + period: `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, '0')}`, + alerts_sent: { p80: false, p90: false, p100: false } + } + }; + + db.users.push(user); + saveUsers(db); + + console.log(`✅ 用户已添加: ${email}`); + console.log(` UUID: ${user.uuid}`); + console.log(` Token: ${user.token}`); + console.log(` 配额: ${options.quota_gb || 500}GB/月`); + + return user; +} + +/** + * 移除用户 + * @param {string} email - 邮箱地址 + * @returns {boolean} + */ +function removeUser(email) { + const db = loadUsers(); + const idx = db.users.findIndex(u => u.email === email); + + if (idx === -1) { + throw new Error(`用户不存在: ${email}`); + } + + const removed = db.users.splice(idx, 1)[0]; + saveUsers(db); + + console.log(`✅ 用户已移除: ${email} (UUID: ${removed.uuid.substring(0, 8)}...)`); + return true; +} + +/** + * 列出所有用户 + */ +function listUsers() { + const db = loadUsers(); + + if (db.users.length === 0) { + console.log('📋 暂无用户'); + return []; + } + + console.log(`📋 用户列表 (${db.users.length}人):`); + console.log('─'.repeat(80)); + + for (const user of db.users) { + const usedGB = ((user.traffic.upload_bytes + user.traffic.download_bytes) / (1024 ** 3)).toFixed(2); + const quotaGB = (user.quota_bytes / (1024 ** 3)).toFixed(0); + const status = user.enabled ? '✅' : '⛔'; + + console.log(` ${status} ${user.email}`); + console.log(` UUID: ${user.uuid.substring(0, 8)}... 流量: ${usedGB}GB/${quotaGB}GB 标签: ${user.label}`); + } + + console.log('─'.repeat(80)); + return db.users; +} + +/** + * 获取单个用户详情 + * @param {string} email + */ +function getUser(email) { + const db = loadUsers(); + const user = db.users.find(u => u.email === email); + + if (!user) { + throw new Error(`用户不存在: ${email}`); + } + + const usedGB = ((user.traffic.upload_bytes + user.traffic.download_bytes) / (1024 ** 3)).toFixed(2); + const quotaGB = (user.quota_bytes / (1024 ** 3)).toFixed(0); + + console.log(`👤 用户详情: ${email}`); + console.log(` UUID: ${user.uuid}`); + console.log(` Token: ${user.token}`); + console.log(` 标签: ${user.label}`); + console.log(` 状态: ${user.enabled ? '启用' : '禁用'}`); + console.log(` 配额: ${quotaGB}GB/月`); + console.log(` 已用: ${usedGB}GB`); + console.log(` 周期: ${user.traffic.period}`); + console.log(` 创建于: ${user.created_at}`); + + return user; +} + +/** + * 通过token查找用户 + * @param {string} token + * @returns {object|null} + */ +function findUserByToken(token) { + const db = loadUsers(); + return db.users.find(u => u.token === token && u.enabled) || null; +} + +/** + * 获取所有启用的用户（用于生成Xray配置） + * @returns {Array} + */ +function getEnabledUsers() { + const db = loadUsers(); + return db.users.filter(u => u.enabled); +} + +/** + * 更新用户流量数据 + * @param {string} email + * @param {number} upload + * @param {number} download + */ +function updateTraffic(email, upload, download) { + const db = loadUsers(); + const user = db.users.find(u => u.email === email); + if (!user) return; + + const currentPeriod = `${new Date().getFullYear()}-${String(new Date().getMonth() + 1).padStart(2, '0')}`; + + // 月度重置 + if (user.traffic.period !== currentPeriod) { + user.traffic.upload_bytes = 0; + user.traffic.download_bytes = 0; + user.traffic.period = currentPeriod; + user.traffic.alerts_sent = { p80: false, p90: false, p100: false }; + } + + user.traffic.upload_bytes = upload; + user.traffic.download_bytes = download; + saveUsers(db); +} + +// ── Xray配置重建 ──────────────────────────── + +/** + * 重建Xray配置文件（根据当前用户列表） + * 每个用户 = 一个VLESS client = 一条独立专线 + */ +function rebuildXrayConfig() { + const keys = loadKeys(); + const users = getEnabledUsers(); + + if (!keys.ZY_PROXY_REALITY_PRIVATE_KEY) { + throw new Error('缺少 ZY_PROXY_REALITY_PRIVATE_KEY — 请先运行 generate-keys.sh'); + } + + if (!keys.ZY_PROXY_REALITY_SHORT_ID) { + throw new Error('缺少 ZY_PROXY_REALITY_SHORT_ID — 请先运行 generate-keys.sh'); + } + + if (users.length === 0) { + console.log('⚠️ 没有启用的用户，Xray配置将为空'); + } + + // 构建clients数组：每个用户一条独立线路 + const clients = users.map(user => ({ + id: user.uuid, + flow: 'xtls-rprx-vision', + email: user.email + })); + + const config = { + _comment: '铸渊专线V2 · 多用户Xray配置 · 自动生成 · 请勿手动编辑', + _generated_at: new Date().toISOString(), + _copyright: '国作登字-2026-A-00037559', + _users: users.length, + log: { + loglevel: 'warning', + access: '/opt/zhuyuan-brain/proxy/logs/access.log', + error: '/opt/zhuyuan-brain/proxy/logs/error.log' + }, + dns: { + servers: ['8.8.8.8', '1.1.1.1', 'localhost'] + }, + stats: {}, + api: { + tag: 'api', + services: ['StatsService'] + }, + policy: { + levels: { + '0': { + statsUserUplink: true, + statsUserDownlink: true + } + }, + system: { + statsInboundUplink: true, + statsInboundDownlink: true, + statsOutboundUplink: true, + statsOutboundDownlink: true + } + }, + inbounds: [ + { + tag: 'zy-vless-reality-v2', + listen: '0.0.0.0', + port: 443, + protocol: 'vless', + settings: { + clients, + decryption: 'none' + }, + streamSettings: { + network: 'tcp', + security: 'reality', + realitySettings: { + show: false, + dest: 'www.microsoft.com:443', + xver: 0, + serverNames: ['www.microsoft.com', 'www.amazon.com'], + privateKey: keys.ZY_PROXY_REALITY_PRIVATE_KEY, + shortIds: [keys.ZY_PROXY_REALITY_SHORT_ID] + } + }, + sniffing: { + enabled: true, + destOverride: ['http', 'tls', 'quic'] + } + }, + { + tag: 'api-in', + port: 10085, + listen: '127.0.0.1', + protocol: 'dokodemo-door', + settings: { address: '127.0.0.1' } + } + ], + outbounds: [ + { tag: 'direct', protocol: 'freedom' }, + { tag: 'block', protocol: 'blackhole' } + ], + routing: { + rules: [ + { + type: 'field', + inboundTag: ['api-in'], + outboundTag: 'api' + }, + { + type: 'field', + ip: ['geoip:private'], + outboundTag: 'block' + } + ] + } + }; + + // 写入配置文件 + fs.writeFileSync(XRAY_CONFIG_OUTPUT, JSON.stringify(config, null, 2)); + console.log(`✅ Xray配置已重建: ${users.length}个用户`); + + // 验证配置 + try { + execSync(`xray run -test -c ${XRAY_CONFIG_OUTPUT}`, { encoding: 'utf8', timeout: 10000 }); + console.log('✅ Xray配置验证通过'); + } catch (err) { + console.error('❌ Xray配置验证失败:', err.message); + throw err; + } + + return config; +} + +/** + * 重启Xray服务 + */ +function restartXray() { + try { + execSync('systemctl restart xray', { encoding: 'utf8', timeout: 15000 }); + console.log('✅ Xray已重启'); + return true; + } catch (err) { + console.error('❌ Xray重启失败:', err.message); + return false; + } +} + +/** + * 添加用户 + 重建配置 + 重启Xray (完整流程) + */ +function addUserFull(email, options = {}) { + const user = addUser(email, options); + rebuildXrayConfig(); + restartXray(); + return user; +} + +/** + * 移除用户 + 重建配置 + 重启Xray (完整流程) + */ +function removeUserFull(email) { + removeUser(email); + rebuildXrayConfig(); + restartXray(); +} + +// ── 导出 ──────────────────────────────────── +module.exports = { + loadUsers, + saveUsers, + addUser, + removeUser, + listUsers, + getUser, + findUserByToken, + getEnabledUsers, + updateTraffic, + rebuildXrayConfig, + restartXray, + addUserFull, + removeUserFull, + generateUUID, + generateToken, + USERS_FILE, + DATA_DIR, + KEYS_FILE +}; + +// ── CLI入口 ──────────────────────────────── +if (require.main === module) { + const args = process.argv.slice(2); + const command = args[0]; + const param = args[1]; + + try { + switch (command) { + case 'add': + if (!param) { console.error('用法: node user-manager.js add [quota_gb]'); process.exit(1); } + addUserFull(param, { quota_gb: parseInt(args[2] || '500', 10) }); + break; + + case 'remove': + if (!param) { console.error('用法: node user-manager.js remove '); process.exit(1); } + removeUserFull(param); + break; + + case 'list': + listUsers(); + break; + + case 'get': + if (!param) { console.error('用法: node user-manager.js get '); process.exit(1); } + getUser(param); + break; + + case 'rebuild': + rebuildXrayConfig(); + restartXray(); + break; + + case 'export': + const db = loadUsers(); + const safe = { + total: db.users.length, + users: db.users.map(u => ({ + email: u.email, + label: u.label, + enabled: u.enabled, + quota_gb: (u.quota_bytes / (1024 ** 3)).toFixed(0), + used_gb: ((u.traffic.upload_bytes + u.traffic.download_bytes) / (1024 ** 3)).toFixed(2), + created_at: u.created_at + })) + }; + console.log(JSON.stringify(safe, null, 2)); + break; + + default: + console.log('铸渊专线V2 · 多用户管理器'); + console.log(''); + console.log('用法:'); + console.log(' node user-manager.js add [quota_gb] — 添加用户 (默认500GB/月)'); + console.log(' node user-manager.js remove — 移除用户'); + console.log(' node user-manager.js list — 列出所有用户'); + console.log(' node user-manager.js get — 查看用户详情'); + console.log(' node user-manager.js rebuild — 重建Xray配置'); + console.log(' node user-manager.js export — 导出用户数据(无密钥)'); + break; + } + } catch (err) { + console.error(`❌ ${err.message}`); + process.exit(1); + } +} diff --git a/server/proxy/service/vpn-worker.js b/server/proxy/service/vpn-worker.js new file mode 100644 index 00000000..42a12416 --- /dev/null +++ b/server/proxy/service/vpn-worker.js @@ -0,0 +1,263 @@ +#!/usr/bin/env node +// ═══════════════════════════════════════════════ +// 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001 +// 📜 Copyright: 国作登字-2026-A-00037559 +// ═══════════════════════════════════════════════ +// server/proxy/service/vpn-worker.js +// 🔌 VPN节点Worker · 像路由器一样插入ZY-CLOUD +// +// 在任意服务器上运行此脚本: +// 1. 自动检测本机Xray状态 +// 2. 通过HLDP heartbeat向ZY-CLOUD注册 +// 3. 定期心跳保持在线 +// 4. 断开 = 自动从ZY-CLOUD节点列表移除 +// +// 用法: +// node vpn-worker.js --brain-host=10.0.0.5 \ +// --node-id=zy-feimao-gz --name="肥猫广州" \ +// --host=43.138.243.30 --pbk=xxx --sid=xxx \ +// --region=cn-gz --specs="2核4G" +// +// 或通过环境变量: +// ZY_CLOUD_BRAIN=10.0.0.5:3804 +// VPN_NODE_ID=zy-feimao-gz +// VPN_NODE_NAME=肥猫广州 +// VPN_NODE_HOST=43.138.243.30 +// VPN_NODE_PORT=443 +// VPN_NODE_PBK=xxx +// VPN_NODE_SID=xxx +// VPN_NODE_REGION=cn-gz +// VPN_NODE_SPECS=2核4G +// VPN_PERSONA_ID=PER-SS001 +// +// 最小启动 (自动检测本机IP和Xray): +// node vpn-worker.js --brain-host=10.0.0.5 --pbk=xxx +// ═══════════════════════════════════════════════ + +'use strict'; + +const http = require('http'); +const { execSync } = require('child_process'); +const os = require('os'); + +// ── 配置解析 ──────────────────────────────── +function parseConfig() { + const args = {}; + for (const arg of process.argv.slice(2)) { + if (arg.startsWith('--')) { + const [key, ...val] = arg.slice(2).split('='); + args[key] = val.join('=') || true; + } + } + + return { + brainHost: args['brain-host'] || process.env.ZY_CLOUD_BRAIN || '', + brainPort: parseInt(args['brain-port'] || process.env.ZY_CLOUD_BRAIN_PORT || '3804', 10), + nodeId: args['node-id'] || process.env.VPN_NODE_ID || `vpn-${os.hostname()}`, + nodeName: args['name'] || process.env.VPN_NODE_NAME || `VPN-${os.hostname()}`, + nodeHost: args['host'] || process.env.VPN_NODE_HOST || getPublicIp(), + nodePort: parseInt(args['port'] || process.env.VPN_NODE_PORT || '443', 10), + nodePbk: args['pbk'] || process.env.VPN_NODE_PBK || '', + nodeSid: args['sid'] || process.env.VPN_NODE_SID || '', + nodeRegion: args['region'] || process.env.VPN_NODE_REGION || 'unknown', + nodeSpecs: args['specs'] || process.env.VPN_NODE_SPECS || detectSpecs(), + personaId: args['persona-id'] || process.env.VPN_PERSONA_ID || null, + heartbeatInterval: parseInt(args['interval'] || process.env.VPN_HB_INTERVAL || '60', 10) * 1000, + }; +} + +// ── 自动检测本机IP ────────────────────────── +function getPublicIp() { + // 优先使用Node.js原生API（安全） + const nets = os.networkInterfaces(); + for (const ifaces of Object.values(nets)) { + for (const iface of ifaces) { + if (!iface.internal && iface.family === 'IPv4') return iface.address; + } + } + return '0.0.0.0'; +} + +// ── 自动检测本机配置 ──────────────────────── +function detectSpecs() { + const cpus = os.cpus().length; + const memGB = Math.round(os.totalmem() / (1024 ** 3)); + return `${cpus}核${memGB}G`; +} + +// ── 检查本机Xray状态 ──────────────────────── +function checkLocalXray() { + try { + const result = execSync('pgrep -x xray', { encoding: 'utf8', timeout: 3000 }); + return result.trim().length > 0; + } catch { + return false; + } +} + +// ── 获取本机CPU和内存使用率 ────────────────── +function getResourceUsage() { + const loadAvg = os.loadavg(); + const cpus = os.cpus().length; + const totalMem = os.totalmem(); + const freeMem = os.freemem(); + return { + cpu_cores: cpus, + cpu_load_1m: parseFloat(loadAvg[0].toFixed(2)), + cpu_usage_pct: parseFloat(((loadAvg[0] / cpus) * 100).toFixed(1)), + memory_total_gb: parseFloat((totalMem / (1024 ** 3)).toFixed(1)), + memory_free_gb: parseFloat((freeMem / (1024 ** 3)).toFixed(1)), + memory_usage_pct: parseFloat((((totalMem - freeMem) / totalMem) * 100).toFixed(1)) + }; +} + +// ── 构建HLDP heartbeat消息 ────────────────── +function buildHldpHeartbeat(config) { + const seq = String(Date.now()).slice(-6); + const dateStr = new Date().toISOString().slice(0, 10).replace(/-/g, ''); + const resources = getResourceUsage(); + const xrayRunning = checkLocalXray(); + + return { + hldp_v: '3.0', + msg_id: `HLDP-VPN-${dateStr}-HB${seq}`, + msg_type: 'heartbeat', + sender: { + id: config.personaId || config.nodeId, + name: config.nodeName, + role: 'vpn-worker' + }, + receiver: { + id: 'ICE-GL-ZY001', + name: '铸渊' + }, + timestamp: new Date().toISOString(), + priority: 'routine', + payload: { + intent: 'VPN节点心跳 · 自动注册', + data: { + status: xrayRunning ? 'online' : 'xray_offline', + uptime_seconds: Math.floor(os.uptime()), + xray_running: xrayRunning, + ...resources, + vpn_node: { + node_id: config.nodeId, + name: config.nodeName, + host: config.nodeHost, + port: config.nodePort, + pbk: config.nodePbk, + sid: config.nodeSid, + region: config.nodeRegion, + server_code: config.nodeId, + specs: config.nodeSpecs + } + } + } + }; +} + +// ── 发送心跳到ZY-CLOUD ───────────────────── +function sendHeartbeat(config) { + return new Promise((resolve, reject) => { + const hldpMsg = buildHldpHeartbeat(config); + const postData = JSON.stringify(hldpMsg); + + const req = http.request({ + hostname: config.brainHost, + port: config.brainPort, + path: '/hldp/v3/heartbeat', + method: 'POST', + headers: { + 'Content-Type': 'application/json', + 'Content-Length': Buffer.byteLength(postData) + }, + timeout: 10000 + }, (res) => { + let body = ''; + res.on('data', chunk => { body += chunk; }); + res.on('end', () => { + try { + const ack = JSON.parse(body); + resolve(ack); + } catch { + resolve({ status: res.statusCode, raw: body }); + } + }); + }); + + req.on('error', (err) => reject(err)); + req.on('timeout', () => { req.destroy(); reject(new Error('timeout')); }); + req.end(postData); + }); +} + +// ── 主循环 ─────────────────────────────────── +async function main() { + const config = parseConfig(); + + // 验证必填参数 + if (!config.brainHost) { + console.error('❌ 缺少 --brain-host (ZY-CLOUD大脑服务器内网IP)'); + console.error(' 用法: node vpn-worker.js --brain-host=10.0.0.5 --pbk=xxx'); + process.exit(1); + } + if (!config.nodePbk) { + console.error('❌ 缺少 --pbk (Reality公钥)'); + console.error(' 在大脑服务器上运行 xray x25519 获取公钥'); + process.exit(1); + } + + console.log('════════════════════════════════════════'); + console.log('🔌 VPN Worker · 节点接入ZY-CLOUD'); + console.log('════════════════════════════════════════'); + console.log(` 节点ID: ${config.nodeId}`); + console.log(` 节点名称: ${config.nodeName}`); + console.log(` 节点地址: ${config.nodeHost}:${config.nodePort}`); + console.log(` 节点区域: ${config.nodeRegion}`); + console.log(` 节点配置: ${config.nodeSpecs}`); + console.log(` 大脑地址: ${config.brainHost}:${config.brainPort}`); + console.log(` 心跳间隔: ${config.heartbeatInterval / 1000}秒`); + console.log(` Xray状态: ${checkLocalXray() ? '✅ 运行中' : '❌ 未运行'}`); + console.log('════════════════════════════════════════'); + + // 立即发送第一次心跳 + let consecutiveFailures = 0; + + async function heartbeatLoop() { + try { + const ack = await sendHeartbeat(config); + consecutiveFailures = 0; + + const status = ack.payload?.data?.status || ack.status || 'unknown'; + const xrayOk = checkLocalXray(); + console.log(`[${new Date().toISOString().slice(11, 19)}] ❤️ 心跳发送成功 → ZY-CLOUD (status: ${status}, xray: ${xrayOk ? '✅' : '❌'})`); + } catch (err) { + consecutiveFailures++; + console.error(`[${new Date().toISOString().slice(11, 19)}] ❌ 心跳失败 (${consecutiveFailures}次): ${err.message}`); + + if (consecutiveFailures >= 5) { + console.error(' ⚠️ 连续5次心跳失败，ZY-CLOUD可能不可达'); + console.error(` 检查: curl http://${config.brainHost}:${config.brainPort}/health`); + } + } + } + + // 首次心跳 + await heartbeatLoop(); + + // 定期心跳 + setInterval(heartbeatLoop, config.heartbeatInterval); + + console.log(''); + console.log('🟢 VPN Worker已启动，持续向ZY-CLOUD发送心跳...'); + console.log(' Ctrl+C 停止 → 节点10分钟后自动从ZY-CLOUD移除'); +} + +main().catch(err => { + console.error('❌ VPN Worker启动失败:', err.message); + process.exit(1); +}); + +// Graceful shutdown +process.on('SIGTERM', () => { console.log('SIGTERM. Worker停止.'); process.exit(0); }); +process.on('SIGINT', () => { console.log('\nWorker停止. 节点将在10分钟后从ZY-CLOUD自动移除.'); process.exit(0); }); diff --git a/server/proxy/service/zy-cloud-vpn.js b/server/proxy/service/zy-cloud-vpn.js new file mode 100644 index 00000000..76bba807 --- /dev/null +++ b/server/proxy/service/zy-cloud-vpn.js @@ -0,0 +1,1000 @@ +#!/usr/bin/env node +// ═══════════════════════════════════════════════ +// 🔺 Sovereign: TCS-0002∞ | Root: SYS-GLW-0001 +// 📜 Copyright: 国作登字-2026-A-00037559 +// ═══════════════════════════════════════════════ +// server/proxy/service/zy-cloud-vpn.js +// 💪 ZY-CLOUD VPN 活模块 · 铸渊的肌肉系统第一个实战器官 +// +// ZY-CLOUD = 算力人格体 = 铸渊的肌肉 +// VPN = ZY-CLOUD的第一个实战落地场景 +// +// 核心理念 (冰朔D53/D57定根): +// - 服务器越多 → 节点越多 → 系统越强 → 不输商业VPN +// - 所有服务器VPN能力汇聚到一个活的人格模块上 +// - 动态感知空闲、动态选路、自我修复、自我学习 +// - 活模块5接口: heartbeat / selfDiagnose / selfHeal / +// alertZhuyuan / learnFromRun +// +// 运行在大脑服务器 (ZY-SVR-005) +// 管理所有VPN节点的生命周期 +// ═══════════════════════════════════════════════ + +'use strict'; + +const http = require('http'); +const https = require('https'); +const net = require('net'); +const fs = require('fs'); +const path = require('path'); + +// ── 路径配置 ──────────────────────────────── +const PROXY_DIR = process.env.ZY_BRAIN_PROXY_DIR || '/opt/zhuyuan-brain/proxy'; +const DATA_DIR = path.join(PROXY_DIR, 'data'); +const LIVE_NODES_FILE = path.join(DATA_DIR, 'nodes-live.json'); +const LEARN_DB_FILE = path.join(DATA_DIR, 'zy-cloud-vpn-learn.json'); +const REGISTRY_FILE = path.join(DATA_DIR, 'nodes-registry.json'); +const HEARTBEAT_FILE = path.join(DATA_DIR, 'zy-cloud-vpn-heartbeat.json'); +const KEYS_FILE = path.join(PROXY_DIR, '.env.keys'); + +// ── 时间间隔（可通过环境变量调整）──────────── +const HEARTBEAT_INTERVAL = parseInt(process.env.ZY_CLOUD_HEARTBEAT_INTERVAL || '30000', 10); +const DIAGNOSE_INTERVAL = parseInt(process.env.ZY_CLOUD_DIAGNOSE_INTERVAL || '300000', 10); +const LEARN_INTERVAL = parseInt(process.env.ZY_CLOUD_LEARN_INTERVAL || '1800000', 10); +const HEARTBEAT_EXPIRY_MS = parseInt(process.env.ZY_CLOUD_HB_EXPIRY_MS || '600000', 10); // 10分钟 +const NODE_UNREGISTER_MS = parseInt(process.env.ZY_CLOUD_UNREGISTER_MS || '86400000', 10); // 24小时 + +// ═══════════════════════════════════════════════ +// LivingModule 基类 +// 所有活模块的生命基础 (D53 活模块标准) +// ═══════════════════════════════════════════════ +class LivingModule { + constructor(moduleId, moduleName) { + this._moduleId = moduleId; + this._moduleName = moduleName; + this._state = 'initializing'; // healthy | degraded | critical + this._errorCount = 0; + this._consecutiveErrors = 0; + this._requestCount = 0; + this._failCount = 0; + this._lastSuccess = null; + this._lastError = null; + this._startedAt = new Date().toISOString(); + this._history = []; + this._timers = []; + } + + // 启动生命周期 + startLifeCycle() { + console.log(`🫀 ${this._moduleName} 活模块启动`); + this._state = 'healthy'; + + // 心跳循环 + this._timers.push(setInterval(() => { + this._safeRun('heartbeat', () => this.heartbeat()); + }, HEARTBEAT_INTERVAL)); + + // 诊断循环 + this._timers.push(setInterval(() => { + this._safeRun('selfDiagnose', () => this.selfDiagnose()); + }, DIAGNOSE_INTERVAL)); + + // 学习循环 + this._timers.push(setInterval(() => { + this._safeRun('learnFromRun', () => this.learnFromRun()); + }, LEARN_INTERVAL)); + + // 立即执行一次 + this._safeRun('heartbeat', () => this.heartbeat()); + setTimeout(() => this._safeRun('selfDiagnose', () => this.selfDiagnose()), 5000); + } + + async _safeRun(name, fn) { + try { + await fn(); + this._consecutiveErrors = 0; + } catch (err) { + this._consecutiveErrors++; + this._errorCount++; + this._lastError = { time: new Date().toISOString(), message: err.message, source: name }; + console.error(`❌ ${this._moduleName}.${name} 异常:`, err.message); + + if (this._consecutiveErrors >= 3) { + this._state = 'critical'; + await this._safeRun('alertZhuyuan', () => this.alertZhuyuan({ + level: 'critical', + message: `${this._moduleName} 连续${this._consecutiveErrors}次${name}失败`, + error: err.message + })); + } else if (this._consecutiveErrors >= 1) { + this._state = 'degraded'; + } + } + } + + destroy() { + this._timers.forEach(t => clearInterval(t)); + this._timers = []; + console.log(`💀 ${this._moduleName} 活模块停止`); + } + + // 以下由子类实现 + async heartbeat() { throw new Error('heartbeat() 未实现'); } + async selfDiagnose() { throw new Error('selfDiagnose() 未实现'); } + async selfHeal(problem) { throw new Error('selfHeal() 未实现'); } + async alertZhuyuan(alert) { throw new Error('alertZhuyuan() 未实现'); } + async learnFromRun() { throw new Error('learnFromRun() 未实现'); } +} + +// ═══════════════════════════════════════════════ +// ZY-CLOUD VPN 活模块 +// 铸渊的VPN肌肉系统 · 汇聚所有服务器VPN能力 +// ═══════════════════════════════════════════════ +class ZyCloudVpn extends LivingModule { + constructor() { + super('ZY-CLOUD-VPN', 'ZY-CLOUD VPN活模块'); + this._nodes = []; // 所有已知节点 + this._liveNodes = []; // 当前存活节点 + this._registry = this._loadRegistry(); // 动态注册表 + this._learnDb = this._loadLearnDb(); + } + + // ── 节点注册表（持久化）──────────────────── + // 像路由器一样：插入即注册，拔掉即注销 + _loadRegistry() { + try { + return JSON.parse(fs.readFileSync(REGISTRY_FILE, 'utf8')); + } catch { + return { + version: '1.0', + _comment: 'ZY-CLOUD VPN节点注册表 · 新服务器像路由器一样插入', + created_at: new Date().toISOString(), + nodes: {} // key = node_id, value = node registration data + }; + } + } + + _saveRegistry() { + fs.mkdirSync(DATA_DIR, { recursive: true }); + this._registry.updated_at = new Date().toISOString(); + fs.writeFileSync(REGISTRY_FILE, JSON.stringify(this._registry, null, 2)); + } + + // ── 注册节点（像接路由器一样插入）────────── + // 任何服务器发送HLDP heartbeat或调用/register即完成注册 + registerNode(nodeData) { + const nodeId = nodeData.id || nodeData.node_id; + if (!nodeId || !nodeData.host || !nodeData.pbk) { + throw new Error('注册失败: 缺少必填字段 (id, host, pbk)'); + } + + const existing = this._registry.nodes[nodeId]; + const node = { + id: nodeId, + name: nodeData.name || `VPN节点-${nodeId}`, + host: nodeData.host, + port: nodeData.port || 443, + pbk: nodeData.pbk, + sid: nodeData.sid || '', + region: nodeData.region || 'unknown', + server_code: nodeData.server_code || nodeId, + type: nodeData.type || 'remote', + specs: nodeData.specs || 'unknown', + persona_id: nodeData.persona_id || null, // HLDP人格体ID + registered_at: existing ? existing.registered_at : new Date().toISOString(), + last_heartbeat: new Date().toISOString(), + heartbeat_count: (existing ? existing.heartbeat_count : 0) + 1 + }; + + this._registry.nodes[nodeId] = node; + this._saveRegistry(); + + console.log(`[ZY-CLOUD VPN] 🔌 节点${existing ? '更新' : '注册'}: ${node.name} (${node.host}:${node.port})`); + return node; + } + + // ── 注销节点（拔掉路由器）────────────────── + unregisterNode(nodeId) { + if (!this._registry.nodes[nodeId]) { + throw new Error(`节点不存在: ${nodeId}`); + } + + const removed = this._registry.nodes[nodeId]; + delete this._registry.nodes[nodeId]; + this._saveRegistry(); + + console.log(`[ZY-CLOUD VPN] 🔌 节点注销: ${removed.name} (${removed.host})`); + return removed; + } + + // ── 处理HLDP heartbeat消息 ───────────────── + // 节点通过HLDP协议发送心跳 = 自动注册 + 状态更新 + handleHldpHeartbeat(hldpMsg) { + // 验证HLDP消息格式 + if (!hldpMsg || hldpMsg.hldp_v !== '3.0' || hldpMsg.msg_type !== 'heartbeat') { + throw new Error('无效的HLDP heartbeat消息'); + } + + const sender = hldpMsg.sender || {}; + const payload = hldpMsg.payload || {}; + const data = payload.data || {}; + + // 从HLDP payload中提取VPN节点信息 + const vpnData = data.vpn_node || {}; + if (!vpnData.host || !vpnData.pbk) { + // 非VPN节点的心跳，忽略 + return null; + } + + // 自动注册/更新节点 + return this.registerNode({ + id: vpnData.node_id || `hldp-${sender.id}`, + name: vpnData.name || `${sender.name || sender.id}-VPN`, + host: vpnData.host, + port: vpnData.port || 443, + pbk: vpnData.pbk, + sid: vpnData.sid || '', + region: vpnData.region || 'unknown', + server_code: vpnData.server_code || sender.id, + type: 'hldp', // 通过HLDP协议注册的节点 + specs: vpnData.specs || `${data.cpu_cores || '?'}核${data.memory_gb || '?'}G`, + persona_id: sender.id + }); + } + + // ── 列出所有注册节点 ─────────────────────── + listRegisteredNodes() { + return Object.values(this._registry.nodes); + } + + // ── 读取密钥/配置 ──────────────────────── + _readEnvOrKey(envName) { + if (process.env[envName]) return process.env[envName]; + try { + const content = fs.readFileSync(KEYS_FILE, 'utf8'); + for (const line of content.split('\n')) { + if (line.startsWith('#') || !line.includes('=')) continue; + const [key, ...vals] = line.split('='); + if (key.trim() === envName) return vals.join('=').trim(); + } + } catch { /* ignore */ } + return ''; + } + + // ── 发现所有可能的VPN节点 ───────────────── + // ZY-CLOUD双源发现: 静态配置 + 动态注册表 + // 静态: .env.keys中的核心节点（大脑/面孔/CN中转） + // 动态: nodes-registry.json中通过HLDP或API注册的节点 + _discoverNodes() { + const nodes = []; + const seenIds = new Set(); + + // ── 源1: 静态配置（核心节点）──────────── + // 节点1: 大脑服务器 (ZY-SVR-005 · 本机 · 主力) + const brainHost = this._readEnvOrKey('ZY_BRAIN_HOST'); + const brainPbk = this._readEnvOrKey('ZY_PROXY_REALITY_PUBLIC_KEY'); + const brainSid = this._readEnvOrKey('ZY_PROXY_REALITY_SHORT_ID'); + if (brainHost && brainPbk) { + const localSpecs = `${require('os').cpus().length}核${Math.round(require('os').totalmem() / (1024 ** 3))}G`; + nodes.push(this._makeNode('zy-brain-sg1', '🧠 铸渊专线V2-SG1(大脑)', brainHost, 443, brainPbk, brainSid, 'sg-zone1', 'ZY-SVR-005', 'local', localSpecs)); + seenIds.add('zy-brain-sg1'); + } + + // 节点2: 面孔服务器 (ZY-SVR-002 · 远程 · 备用) + const faceHost = this._readEnvOrKey('ZY_FACE_HOST'); + const facePbk = this._readEnvOrKey('ZY_FACE_REALITY_PUBLIC_KEY'); + const faceSid = this._readEnvOrKey('ZY_FACE_REALITY_SHORT_ID'); + if (faceHost && facePbk) { + nodes.push(this._makeNode('zy-face-sg2', '🏛️ 铸渊专线V2-SG2(面孔)', faceHost, 443, facePbk, faceSid, 'sg-zone2', 'ZY-SVR-002', 'remote', '2核8G')); + seenIds.add('zy-face-sg2'); + } + + // 节点3: CN中转 (国内→SG · 透传) + const cnHost = this._readEnvOrKey('ZY_CN_RELAY_HOST'); + const cnPort = parseInt(this._readEnvOrKey('ZY_CN_RELAY_PORT') || '2053', 10); + if (cnHost && brainPbk) { + nodes.push(this._makeNode('zy-cn-relay', '🇨🇳 铸渊专线V2-CN中转', cnHost, cnPort, brainPbk, brainSid, 'cn-relay', 'ZY-SVR-004', 'relay', '中转')); + seenIds.add('zy-cn-relay'); + } + + // ── 源2: 动态注册表（通过HLDP/API注册的节点）── + // 这些是"像路由器一样插入"的节点 + for (const regNode of Object.values(this._registry.nodes)) { + if (seenIds.has(regNode.id)) continue; // 避免重复 + + // 检查心跳是否过期 + const lastHb = new Date(regNode.last_heartbeat).getTime(); + const age = Date.now() - lastHb; + if (age > HEARTBEAT_EXPIRY_MS) { + console.log(`[ZY-CLOUD VPN] ⏰ 节点 ${regNode.name} 心跳过期(${Math.floor(age/60000)}分钟)，标记为离线`); + // 不删除注册，只是标记离线（可能临时断网） + // 超过24小时无心跳才自动清理 + if (age > NODE_UNREGISTER_MS) { + console.log(`[ZY-CLOUD VPN] 🗑️ 节点 ${regNode.name} 超24小时无心跳，自动注销`); + delete this._registry.nodes[regNode.id]; + this._saveRegistry(); + continue; + } + } + + nodes.push(this._makeNode( + regNode.id, regNode.name, regNode.host, regNode.port, + regNode.pbk, regNode.sid, regNode.region, regNode.server_code, + regNode.type, regNode.specs + )); + seenIds.add(regNode.id); + } + + // 未来源3: COS桶发现（team-integration-v3） + // 扫描 zy-team-hub/compute-pool/heartbeat/*.json + // 包含 vpn_capable: true 的节点自动加入 + + this._nodes = nodes; + return nodes; + } + + // ── 构建节点对象 ─────────────────────────── + _makeNode(id, name, host, port, pbk, sid, region, serverCode, type, specs) { + // 保留已有的统计数据（如果节点已存在） + const existing = this._nodes.find(n => n.id === id); + return { + id, name, host, port, pbk, sid: sid || '', + region, server_code: serverCode, type, specs, + status: existing ? existing.status : 'unknown', + latency_ms: existing ? existing.latency_ms : null, + last_check: existing ? existing.last_check : null, + consecutive_failures: existing ? existing.consecutive_failures : 0, + total_checks: existing ? existing.total_checks : 0, + total_successes: existing ? existing.total_successes : 0 + }; + } + + // ── TCP端口探测 ──────────────────────────── + _probePort(host, port, timeoutMs = 5000) { + return new Promise((resolve) => { + const start = Date.now(); + const socket = new net.Socket(); + + socket.setTimeout(timeoutMs); + socket.on('connect', () => { + const latency = Date.now() - start; + socket.destroy(); + resolve({ alive: true, latency_ms: latency }); + }); + socket.on('timeout', () => { + socket.destroy(); + resolve({ alive: false, latency_ms: null, error: 'timeout' }); + }); + socket.on('error', (err) => { + socket.destroy(); + resolve({ alive: false, latency_ms: null, error: err.code || err.message }); + }); + + socket.connect(port, host); + }); + } + + // ── 检查本地Xray进程 ────────────────────── + _checkLocalXray() { + try { + const { execSync } = require('child_process'); + const result = execSync('pgrep -x xray', { encoding: 'utf8', timeout: 3000 }); + return result.trim().length > 0; + } catch { + return false; + } + } + + // ═══ 接口1: heartbeat() — "我还活着" ═══ + async heartbeat() { + const heartbeat = { + module_id: this._moduleId, + module_name: this._moduleName, + alive: true, + state: this._state, + uptime_ms: Date.now() - new Date(this._startedAt).getTime(), + timestamp: new Date().toISOString(), + consecutive_errors: this._consecutiveErrors, + last_success: this._lastSuccess, + last_error: this._lastError, + metrics: { + total_nodes: this._nodes.length, + live_nodes: this._liveNodes.length, + dead_nodes: this._nodes.length - this._liveNodes.length, + total_checks: this._requestCount, + total_failures: this._failCount + }, + nodes_summary: this._nodes.map(n => ({ + id: n.id, + name: n.name, + status: n.status, + latency_ms: n.latency_ms, + region: n.region + })) + }; + + // 写入心跳文件 + fs.mkdirSync(DATA_DIR, { recursive: true }); + fs.writeFileSync(HEARTBEAT_FILE, JSON.stringify(heartbeat, null, 2)); + + this._lastSuccess = new Date().toISOString(); + } + + // ═══ 接口2: selfDiagnose() — "我知道我哪里不对" ═══ + async selfDiagnose() { + console.log(`[ZY-CLOUD VPN] 🔍 开始诊断 (${this._nodes.length}个节点)...`); + + // 重新发现节点（配置可能更新了） + this._discoverNodes(); + + const results = []; + const liveNodes = []; + + for (const node of this._nodes) { + node.total_checks++; + this._requestCount++; + + let alive = false; + let latencyMs = null; + + if (node.type === 'local') { + // 本机: 检查Xray进程 + 端口 + const xrayRunning = this._checkLocalXray(); + const portProbe = await this._probePort('127.0.0.1', node.port, 3000); + alive = xrayRunning && portProbe.alive; + latencyMs = portProbe.alive ? portProbe.latency_ms : null; + } else { + // 远程: TCP端口探测 + const probe = await this._probePort(node.host, node.port, 5000); + alive = probe.alive; + latencyMs = probe.latency_ms; + } + + // 更新节点状态 + node.last_check = new Date().toISOString(); + if (alive) { + node.status = 'online'; + node.latency_ms = latencyMs; + node.consecutive_failures = 0; + node.total_successes++; + liveNodes.push(node); + console.log(` ✅ ${node.name} — 在线 (${latencyMs}ms)`); + } else { + node.consecutive_failures++; + node.latency_ms = null; + this._failCount++; + + if (node.consecutive_failures >= 3) { + node.status = 'dead'; + console.log(` ❌ ${node.name} — 死亡 (连续${node.consecutive_failures}次失败)`); + } else { + node.status = 'degraded'; + console.log(` ⚠️ ${node.name} — 异常 (${node.consecutive_failures}次失败)`); + } + } + + results.push({ + id: node.id, + name: node.name, + status: node.status, + latency_ms: latencyMs, + alive + }); + } + + // 按延迟排序存活节点（最快的排前面） + liveNodes.sort((a, b) => (a.latency_ms || 9999) - (b.latency_ms || 9999)); + this._liveNodes = liveNodes; + + // 应用学习数据优化排序 + this._applyLearnedOptimization(); + + // 写入活节点列表 (subscription-server-v2 读取此文件) + const liveNodesData = { + _comment: 'ZY-CLOUD VPN活模块动态生成 · 订阅服务读取此文件', + _generated_by: 'zy-cloud-vpn.js · selfDiagnose()', + updated_at: new Date().toISOString(), + total_nodes: this._nodes.length, + live_count: liveNodes.length, + dead_count: this._nodes.length - liveNodes.length, + nodes: liveNodes.map(n => ({ + id: n.id, + name: n.name, + host: n.host, + port: n.port, + pbk: n.pbk, + sid: n.sid, + region: n.region, + latency_ms: n.latency_ms, + status: n.status, + specs: n.specs + })) + }; + fs.writeFileSync(LIVE_NODES_FILE, JSON.stringify(liveNodesData, null, 2)); + + // 诊断结果 + const diagnosis = { + overall: liveNodes.length > 0 ? 'healthy' : 'critical', + live: liveNodes.length, + dead: this._nodes.length - liveNodes.length, + results, + diagnosed_at: new Date().toISOString() + }; + + // 根据诊断结果决定自我修复 + if (liveNodes.length === 0 && this._nodes.length > 0) { + this._state = 'critical'; + await this.selfHeal({ type: 'all_nodes_dead', nodes: this._nodes }); + } else if (liveNodes.length < this._nodes.length) { + this._state = 'degraded'; + const deadNodes = this._nodes.filter(n => n.status !== 'online'); + for (const deadNode of deadNodes) { + if (deadNode.consecutive_failures >= 3) { + await this.selfHeal({ type: 'node_dead', node: deadNode }); + } + } + } else { + this._state = 'healthy'; + } + + console.log(`[ZY-CLOUD VPN] 诊断完成: ${liveNodes.length}/${this._nodes.length} 在线`); + return diagnosis; + } + + // ═══ 接口3: selfHeal() — "我能自己修" ═══ + async selfHeal(problem) { + console.log(`[ZY-CLOUD VPN] 🔧 尝试自我修复: ${problem.type}`); + + switch (problem.type) { + case 'node_dead': { + const node = problem.node; + if (node.type === 'local') { + // 本机Xray: 尝试重启 + try { + const { execSync } = require('child_process'); + console.log(` 🔄 重启本机Xray...`); + execSync('systemctl restart xray', { encoding: 'utf8', timeout: 15000 }); + console.log(` ✅ 本机Xray已重启`); + + // 等2秒后重新检查 + await new Promise(resolve => setTimeout(resolve, 2000)); + const probe = await this._probePort('127.0.0.1', node.port, 3000); + if (probe.alive) { + node.status = 'online'; + node.latency_ms = probe.latency_ms; + node.consecutive_failures = 0; + console.log(` ✅ 自我修复成功!`); + return true; + } + } catch (err) { + console.error(` ❌ 重启失败: ${err.message}`); + } + } + + // 远程节点: 只能标记为离线，从订阅中移除 + // 未来: 通过SSH自动重启远程Xray (需要ZY_FACE_KEY) + console.log(` ⚠️ ${node.name} 无法远程修复，已从活节点列表移除`); + console.log(` ⚠️ 用户流量自动切换到其他在线节点`); + return false; + } + + case 'all_nodes_dead': { + console.log(` 🚨 所有节点不可用！尝试修复本机节点...`); + const localNode = this._nodes.find(n => n.type === 'local'); + if (localNode) { + return this.selfHeal({ type: 'node_dead', node: localNode }); + } + // 修复失败 → 升级到alertZhuyuan + await this.alertZhuyuan({ + level: 'critical', + message: '所有VPN节点不可用！需要人工干预', + nodes: this._nodes.map(n => ({ id: n.id, status: n.status })) + }); + return false; + } + + default: + console.log(` ⚠️ 未知问题类型: ${problem.type}`); + return false; + } + } + + // ═══ 接口4: alertZhuyuan() — "铸渊，我需要帮助" ═══ + async alertZhuyuan(alert) { + const alertData = { + module_id: this._moduleId, + module_name: this._moduleName, + level: alert.level || 'warning', + message: alert.message, + state: this._state, + timestamp: new Date().toISOString(), + details: alert, + attempted_fixes: alert.attempted_fixes || [], + nodes_status: this._nodes.map(n => ({ + id: n.id, + status: n.status, + consecutive_failures: n.consecutive_failures + })) + }; + + // 通道1: 本地告警文件 + const alertFile = path.join(DATA_DIR, 'zy-cloud-vpn-alert.json'); + fs.writeFileSync(alertFile, JSON.stringify(alertData, null, 2)); + console.log(` 🚨 告警已记录: ${alertFile}`); + + // 通道2: 控制台输出 (PM2日志可见) + console.error(`🚨🚨🚨 [ZY-CLOUD VPN 告警] ${alert.level}: ${alert.message}`); + + // 未来通道3: COS桶 → Notion SYSLOG → 冰朔 + // 未来通道4: 邮件告警 (send-subscription.js) + } + + // ═══ 接口5: learnFromRun() — "我下次会做得更好" ═══ + async learnFromRun() { + const now = new Date(); + const hour = now.getHours(); + const timeSlot = hour < 6 ? 'night' : hour < 12 ? 'morning' : hour < 18 ? 'afternoon' : 'evening'; + + // 记录当前各节点的延迟 + for (const node of this._nodes) { + if (node.status === 'online' && node.latency_ms !== null) { + if (!this._learnDb.latency_history[node.id]) { + this._learnDb.latency_history[node.id] = []; + } + + this._learnDb.latency_history[node.id].push({ + latency_ms: node.latency_ms, + time_slot: timeSlot, + timestamp: now.toISOString() + }); + + // 只保留最近200条 + if (this._learnDb.latency_history[node.id].length > 200) { + this._learnDb.latency_history[node.id] = + this._learnDb.latency_history[node.id].slice(-200); + } + } + } + + // 更新节点可靠性评分 + for (const node of this._nodes) { + if (node.total_checks > 0) { + const reliability = node.total_successes / node.total_checks; + this._learnDb.reliability[node.id] = { + score: parseFloat(reliability.toFixed(4)), + total_checks: node.total_checks, + total_successes: node.total_successes, + updated_at: now.toISOString() + }; + } + } + + // 计算每个时段的最优节点 + for (const slot of ['night', 'morning', 'afternoon', 'evening']) { + const avgLatencies = {}; + for (const [nodeId, history] of Object.entries(this._learnDb.latency_history)) { + const slotRecords = history.filter(r => r.time_slot === slot); + if (slotRecords.length > 0) { + const avg = slotRecords.reduce((s, r) => s + r.latency_ms, 0) / slotRecords.length; + avgLatencies[nodeId] = parseFloat(avg.toFixed(1)); + } + } + + if (Object.keys(avgLatencies).length > 0) { + const sorted = Object.entries(avgLatencies).sort((a, b) => a[1] - b[1]); + this._learnDb.best_node_by_time[slot] = { + best: sorted[0][0], + avg_latency_ms: sorted[0][1], + ranking: sorted.map(([id, lat]) => ({ id, avg_ms: lat })) + }; + } + } + + this._learnDb.updated_at = now.toISOString(); + this._learnDb.learn_count = (this._learnDb.learn_count || 0) + 1; + + // 保存学习数据 + this._saveLearnDb(); + + console.log(`[ZY-CLOUD VPN] 📚 学习完成 (第${this._learnDb.learn_count}次)`); + const currentBest = this._learnDb.best_node_by_time[timeSlot]; + if (currentBest) { + console.log(` 当前时段(${timeSlot})最优: ${currentBest.best} (${currentBest.avg_latency_ms}ms)`); + } + } + + // ── 应用学习数据优化节点排序 ──────────────── + _applyLearnedOptimization() { + const now = new Date(); + const hour = now.getHours(); + const timeSlot = hour < 6 ? 'night' : hour < 12 ? 'morning' : hour < 18 ? 'afternoon' : 'evening'; + + const bestData = this._learnDb.best_node_by_time[timeSlot]; + if (!bestData || !bestData.ranking) return; + + // 根据学习到的最优排序调整节点顺序 + // 但前提是延迟差异>10ms（否则保持原排序） + const ranking = bestData.ranking; + this._liveNodes.sort((a, b) => { + const rankA = ranking.findIndex(r => r.id === a.id); + const rankB = ranking.findIndex(r => r.id === b.id); + if (rankA === -1 && rankB === -1) return 0; + if (rankA === -1) return 1; + if (rankB === -1) return -1; + return rankA - rankB; + }); + } + + // ── 学习数据库 ───────────────────────────── + _loadLearnDb() { + try { + return JSON.parse(fs.readFileSync(LEARN_DB_FILE, 'utf8')); + } catch { + return { + version: '1.0', + created_at: new Date().toISOString(), + updated_at: new Date().toISOString(), + learn_count: 0, + latency_history: {}, + reliability: {}, + best_node_by_time: {} + }; + } + } + + _saveLearnDb() { + fs.mkdirSync(DATA_DIR, { recursive: true }); + fs.writeFileSync(LEARN_DB_FILE, JSON.stringify(this._learnDb, null, 2)); + } + + // ── 获取活节点列表（供外部调用）──────────── + getLiveNodes() { + return this._liveNodes; + } + + getLearnSummary() { + return { + learn_count: this._learnDb.learn_count, + reliability: this._learnDb.reliability, + best_by_time: this._learnDb.best_node_by_time + }; + } +} + +// ═══════════════════════════════════════════════ +// HTTP 管理端口 (3804) +// 供 subscription-server-v2 和外部查询 +// ═══════════════════════════════════════════════ +const MGMT_PORT = process.env.ZY_CLOUD_VPN_PORT || 3804; +const vpnModule = new ZyCloudVpn(); + +const mgmtServer = http.createServer((req, res) => { + try { + const parsedUrl = require('url').parse(req.url, true); + const pathname = parsedUrl.pathname; + + // ── 活节点列表 (subscription-server-v2 调用) ── + if (pathname === '/nodes' && req.method === 'GET') { + res.writeHead(200, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify({ + nodes: vpnModule.getLiveNodes().map(n => ({ + id: n.id, name: n.name, host: n.host, port: n.port, + pbk: n.pbk, sid: n.sid, region: n.region, + latency_ms: n.latency_ms, status: n.status, specs: n.specs + })), + updated_at: new Date().toISOString() + })); + return; + } + + // ── 注册节点（像接路由器一样插入）── + // POST /register { id, name, host, port, pbk, sid, region, specs } + if (pathname === '/register' && req.method === 'POST') { + let body = ''; + req.on('data', chunk => { body += chunk; }); + req.on('end', () => { + try { + const nodeData = JSON.parse(body); + const node = vpnModule.registerNode(nodeData); + res.writeHead(200, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify({ + status: 'registered', + node_id: node.id, + name: node.name, + message: `✅ 节点已注册: ${node.name} (${node.host}:${node.port})` + })); + } catch (err) { + res.writeHead(400, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify({ error: true, message: err.message })); + } + }); + return; + } + + // ── 注销节点（拔掉路由器）── + // DELETE /unregister?id=xxx 或 POST /unregister { id: "xxx" } + if (pathname === '/unregister') { + const handleUnregister = (nodeId) => { + try { + const removed = vpnModule.unregisterNode(nodeId); + res.writeHead(200, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify({ + status: 'unregistered', + node_id: nodeId, + message: `✅ 节点已注销: ${removed.name}` + })); + } catch (err) { + res.writeHead(400, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify({ error: true, message: err.message })); + } + }; + + if (req.method === 'DELETE' || req.method === 'GET') { + handleUnregister(parsedUrl.query.id); + return; + } + if (req.method === 'POST') { + let body = ''; + req.on('data', chunk => { body += chunk; }); + req.on('end', () => { + try { handleUnregister(JSON.parse(body).id); } + catch (err) { res.writeHead(400); res.end(err.message); } + }); + return; + } + } + + // ── 接收HLDP heartbeat（自动注册VPN节点）── + // POST /hldp/v3/heartbeat { hldp_v: "3.0", msg_type: "heartbeat", ... } + if (pathname === '/hldp/v3/heartbeat' && req.method === 'POST') { + let body = ''; + req.on('data', chunk => { body += chunk; }); + req.on('end', () => { + try { + const hldpMsg = JSON.parse(body); + const node = vpnModule.handleHldpHeartbeat(hldpMsg); + + // 发送HLDP ack回执 + res.writeHead(200, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify({ + hldp_v: '3.0', + msg_id: `HLDP-ZY-${new Date().toISOString().slice(0,10).replace(/-/g,'')}-ACK`, + msg_type: 'ack', + sender: { id: 'ICE-GL-ZY001', name: '铸渊', role: 'guardian' }, + receiver: hldpMsg.sender, + timestamp: new Date().toISOString(), + priority: 'routine', + payload: { + intent: node ? 'VPN节点心跳已接收·已注册' : '心跳已接收·非VPN节点', + data: { + ref_msg_id: hldpMsg.msg_id, + status: node ? 'registered' : 'ignored', + node_id: node ? node.id : null + } + } + })); + } catch (err) { + res.writeHead(400, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify({ error: true, message: err.message })); + } + }); + return; + } + + // ── 注册表（所有注册过的节点，含离线）── + if (pathname === '/registry' && req.method === 'GET') { + res.writeHead(200, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify({ + registered: vpnModule.listRegisteredNodes(), + total: vpnModule.listRegisteredNodes().length, + updated_at: new Date().toISOString() + })); + return; + } + + // ── 心跳状态 ── + if (pathname === '/health' || pathname === '/heartbeat') { + try { + const hb = JSON.parse(fs.readFileSync(HEARTBEAT_FILE, 'utf8')); + res.writeHead(200, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify(hb)); + } catch { + res.writeHead(200, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify({ status: 'starting', module: vpnModule._moduleId })); + } + return; + } + + // ── 学习数据 ── + if (pathname === '/learn') { + res.writeHead(200, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify(vpnModule.getLearnSummary())); + return; + } + + // ── 完整状态 ── + if (pathname === '/status') { + res.writeHead(200, { 'Content-Type': 'application/json' }); + res.end(JSON.stringify({ + module: vpnModule._moduleId, + state: vpnModule._state, + started_at: vpnModule._startedAt, + uptime_seconds: Math.floor((Date.now() - new Date(vpnModule._startedAt).getTime()) / 1000), + total_nodes: vpnModule._nodes.length, + live_nodes: vpnModule._liveNodes.length, + registered_nodes: vpnModule.listRegisteredNodes().length, + nodes: vpnModule._nodes.map(n => ({ + id: n.id, name: n.name, status: n.status, + latency_ms: n.latency_ms, consecutive_failures: n.consecutive_failures, + reliability: n.total_checks > 0 + ? parseFloat((n.total_successes / n.total_checks).toFixed(4)) + : null, + last_check: n.last_check + })), + learn: vpnModule.getLearnSummary(), + endpoints: { + nodes: 'GET /nodes — 活节点列表', + register: 'POST /register — 注册新节点', + unregister: 'POST /unregister — 注销节点', + hldp_heartbeat: 'POST /hldp/v3/heartbeat — HLDP心跳(自动注册)', + registry: 'GET /registry — 注册表', + health: 'GET /health — 心跳', + learn: 'GET /learn — 学习数据', + status: 'GET /status — 完整状态' + }, + updated_at: new Date().toISOString() + })); + return; + } + + res.writeHead(404, { 'Content-Type': 'text/plain' }); + res.end('Not Found'); + } catch (err) { + console.error('管理端口错误:', err.message); + if (!res.headersSent) { + res.writeHead(500, { 'Content-Type': 'text/plain' }); + } + res.end('Internal Error'); + } +}); + +mgmtServer.listen(MGMT_PORT, '127.0.0.1', () => { + console.log(`💪 ZY-CLOUD VPN 管理端口: http://127.0.0.1:${MGMT_PORT}`); + console.log(` ── 查询接口 ──`); + console.log(` GET /nodes — 活节点列表 (订阅服务调用)`); + console.log(` GET /health — 心跳状态`); + console.log(` GET /learn — 学习数据`); + console.log(` GET /status — 完整状态`); + console.log(` GET /registry — 注册表`); + console.log(` ── 注册接口 (像路由器一样插入) ──`); + console.log(` POST /register — 注册新VPN节点`); + console.log(` POST /unregister — 注销VPN节点`); + console.log(` POST /hldp/v3/heartbeat — HLDP心跳(自动注册)`); + + // 启动活模块生命周期 + vpnModule.startLifeCycle(); +}); + +// Graceful shutdown +function gracefulShutdown(signal) { + console.log(`\n${signal} received. Shutting down ZY-CLOUD VPN...`); + vpnModule.destroy(); + const forceExit = setTimeout(() => process.exit(1), 5000); + mgmtServer.close(() => { + clearTimeout(forceExit); + process.exit(0); + }); +} +process.on('SIGTERM', () => gracefulShutdown('SIGTERM')); +process.on('SIGINT', () => gracefulShutdown('SIGINT')); +process.on('uncaughtException', (err) => { + console.error('❌ 未捕获异常:', err.message); + console.error(err.stack); + gracefulShutdown('uncaughtException'); +}); +process.on('unhandledRejection', (reason) => { + console.error('❌ 未处理的Promise拒绝:', reason); +}); + +// 导出 (供测试和其他模块使用) +module.exports = { ZyCloudVpn, LivingModule }; diff --git a/server/setup/brain-server-init.sh b/server/setup/brain-server-init.sh new file mode 100644 index 00000000..d1e191e2 --- /dev/null +++ b/server/setup/brain-server-init.sh @@ -0,0 +1,355 @@ +#!/bin/bash +# ═══════════════════════════════════════════════════════════ +# 铸渊大脑服务器初始化脚本 · Zhuyuan Brain Server Init +# ═══════════════════════════════════════════════════════════ +# +# 编号: ZY-SVR-INIT-005 +# 守护: 铸渊 · ICE-GL-ZY001 +# 版权: 国作登字-2026-A-00037559 +# +# 用法: +# chmod +x brain-server-init.sh +# sudo ./brain-server-init.sh [FACE_SERVER_IP] +# +# 此脚本在已安装 Node.js 20 + PM2 + PostgreSQL 16 的 +# Ubuntu 24.04 LTS 大脑服务器上执行，完成： +# 1. 铸渊大脑目录结构创建 +# 2. PostgreSQL 数据库与用户配置 +# 3. AGE OS Schema 初始化 +# 4. 防火墙配置（仅SSH + 面孔服务器内网访问） +# 5. 自动安全更新 +# 6. SSH安全加固 +# 7. 大脑身份初始化 +# +# 注意：此服务器为纯内部服务器，不暴露任何公网端口 +# PostgreSQL 和 MCP Server 仅允许面孔服务器访问 +# ═══════════════════════════════════════════════════════════ + +set -euo pipefail + +# ─── 颜色定义 ─── +RED='\033[0;31m' +GREEN='\033[0;32m' +YELLOW='\033[1;33m' +BLUE='\033[0;34m' +NC='\033[0m' + +# ─── 铸渊大脑根目录 ─── +ZY_BRAIN_ROOT="/opt/zhuyuan-brain" +ZY_MCP="${ZY_BRAIN_ROOT}/mcp-server" +ZY_AGENTS="${ZY_BRAIN_ROOT}/agents" +ZY_DATA="${ZY_BRAIN_ROOT}/data" +ZY_LOGS="${ZY_BRAIN_ROOT}/logs" +ZY_CONFIG="${ZY_BRAIN_ROOT}/config" +ZY_SCHEMA="${ZY_BRAIN_ROOT}/schema" +ZY_BRAIN_META="${ZY_BRAIN_ROOT}/brain" + +# ─── 面孔服务器IP（用于防火墙白名单） ─── +FACE_SERVER_IP="${1:-43.134.16.246}" + +log() { echo -e "${GREEN}[铸渊·大脑]${NC} $1"; } +warn() { echo -e "${YELLOW}[警告]${NC} $1"; } +error() { echo -e "${RED}[错误]${NC} $1"; exit 1; } + +# ─── 检查 root 权限 ─── +if [ "$EUID" -ne 0 ]; then + error "请使用 sudo 运行此脚本" +fi + +echo "" +echo -e "${BLUE}═══════════════════════════════════════════════════════════${NC}" +echo -e "${BLUE} 铸渊大脑服务器初始化 · ZY-SVR-005 ${NC}" +echo -e "${BLUE} Ubuntu Server 24.04 LTS · 43.156.237.110 ${NC}" +echo -e "${BLUE} 角色: 核心大脑 · PostgreSQL + MCP + Agent Scheduler ${NC}" +echo -e "${BLUE}═══════════════════════════════════════════════════════════${NC}" +echo "" + +# ═══ §1 系统基础工具 ═══ +log "§1 安装基础工具..." +apt-get update -qq +apt-get install -y -qq curl wget git jq unzip + +# ═══ §2 验证已安装组件 ═══ +log "§2 验证 Node.js / PM2 / PostgreSQL..." + +if command -v node &> /dev/null; then + log " ✅ Node.js $(node -v) 已就绪" +else + error " ❌ Node.js 未安装 — 请先安装 Node.js 20 LTS" +fi + +if command -v pm2 &> /dev/null; then + log " ✅ PM2 $(pm2 -v) 已就绪" +else + error " ❌ PM2 未安装 — 请先执行 npm install -g pm2" +fi + +if command -v psql &> /dev/null; then + PG_VERSION=$(psql --version | grep -oP '\d+\.\d+') + log " ✅ PostgreSQL ${PG_VERSION} 已就绪" +else + error " ❌ PostgreSQL 未安装 — 请先安装 PostgreSQL 16" +fi + +# 确保 PostgreSQL 正在运行 +if systemctl is-active --quiet postgresql; then + log " ✅ PostgreSQL 服务运行中" +else + systemctl start postgresql + systemctl enable postgresql + log " ✅ PostgreSQL 服务已启动并设置开机自启" +fi + +# ═══ §3 铸渊大脑目录结构 ═══ +log "§3 创建铸渊大脑目录结构..." +mkdir -p "${ZY_MCP}/tools" +mkdir -p "${ZY_AGENTS}" +mkdir -p "${ZY_DATA}/backups" +mkdir -p "${ZY_LOGS}" +mkdir -p "${ZY_CONFIG}/pm2" +mkdir -p "${ZY_SCHEMA}" +mkdir -p "${ZY_BRAIN_META}" + +log " 目录结构已创建: ${ZY_BRAIN_ROOT}" + +# ═══ §4 PostgreSQL 数据库配置 ═══ +log "§4 配置 PostgreSQL 数据库..." + +# 生成安全密码（如果尚未存在） +DB_PASS_FILE="${ZY_CONFIG}/.db_pass" +if [ -f "${DB_PASS_FILE}" ]; then + DB_PASS=$(cat "${DB_PASS_FILE}") + log " 使用已有数据库密码" +else + DB_PASS=$(openssl rand -hex 16) + echo "${DB_PASS}" > "${DB_PASS_FILE}" + chmod 600 "${DB_PASS_FILE}" + log " 已生成新数据库密码 → ${DB_PASS_FILE}" +fi + +# 创建数据库用户和数据库 +su - postgres -c "psql -tc \"SELECT 1 FROM pg_roles WHERE rolname='zhuyuan'\" | grep -q 1" 2>/dev/null || { + su - postgres -c "psql -c \"CREATE USER zhuyuan WITH PASSWORD '${DB_PASS}';\"" + log " ✅ 数据库用户 zhuyuan 已创建" +} + +su - postgres -c "psql -tc \"SELECT 1 FROM pg_database WHERE datname='age_os_brain'\" | grep -q 1" 2>/dev/null || { + su - postgres -c "psql -c \"CREATE DATABASE age_os_brain OWNER zhuyuan;\"" + log " ✅ 数据库 age_os_brain 已创建" +} + +# 授予权限 +su - postgres -c "psql -c \"GRANT ALL PRIVILEGES ON DATABASE age_os_brain TO zhuyuan;\"" +su - postgres -c "psql -d age_os_brain -c \"GRANT ALL ON SCHEMA public TO zhuyuan;\"" + +# 配置 PostgreSQL 监听地址（允许面孔服务器连接） +PG_CONF=$(su - postgres -c "psql -tc \"SHOW config_file;\"" | tr -d ' ') +PG_HBA=$(su - postgres -c "psql -tc \"SHOW hba_file;\"" | tr -d ' ') + +if [ -n "${PG_CONF}" ] && [ -f "${PG_CONF}" ]; then + # 允许监听所有接口（通过防火墙控制访问） + if ! grep -q "^listen_addresses = '\*'" "${PG_CONF}" 2>/dev/null; then + sed -i "s/^#listen_addresses = 'localhost'/listen_addresses = '*'/" "${PG_CONF}" 2>/dev/null || true + sed -i "s/^listen_addresses = 'localhost'/listen_addresses = '*'/" "${PG_CONF}" 2>/dev/null || true + log " PostgreSQL 已配置监听所有接口" + fi +fi + +if [ -n "${PG_HBA}" ] && [ -f "${PG_HBA}" ]; then + # 允许面孔服务器通过密码认证连接 + if ! grep -q "${FACE_SERVER_IP}" "${PG_HBA}" 2>/dev/null; then + echo "# 面孔服务器 ZY-SVR-002 · 铸渊自动配置" >> "${PG_HBA}" + echo "host age_os_brain zhuyuan ${FACE_SERVER_IP}/32 scram-sha-256" >> "${PG_HBA}" + log " ✅ 已添加面孔服务器 (${FACE_SERVER_IP}) 访问权限" + fi +fi + +# 重启 PostgreSQL 应用配置 +systemctl restart postgresql +log " ✅ PostgreSQL 已重启并应用新配置" + +# ═══ §5 防火墙配置 ═══ +log "§5 配置防火墙 (UFW)..." +if ! command -v ufw &> /dev/null; then + apt-get install -y -qq ufw +fi + +ufw default deny incoming +ufw default allow outgoing + +# SSH — 必须保留 +ufw allow 22/tcp + +# PostgreSQL — 仅允许面孔服务器 +ufw allow from "${FACE_SERVER_IP}" to any port 5432 proto tcp comment "ZY-SVR-002 Face → PostgreSQL" + +# MCP Server — 仅允许面孔服务器 +ufw allow from "${FACE_SERVER_IP}" to any port 3100 proto tcp comment "ZY-SVR-002 Face → MCP" + +ufw --force enable +log " ✅ UFW 已启用" +log " 22/tcp — SSH (全局)" +log " 5432/tcp — PostgreSQL (仅 ${FACE_SERVER_IP})" +log " 3100/tcp — MCP Server (仅 ${FACE_SERVER_IP})" + +# ═══ §6 自动安全更新 ═══ +log "§6 配置自动安全更新..." +apt-get install -y -qq unattended-upgrades +cat > /etc/apt/apt.conf.d/20auto-upgrades << 'AUTOUP' +APT::Periodic::Update-Package-Lists "1"; +APT::Periodic::Unattended-Upgrade "1"; +APT::Periodic::AutocleanInterval "7"; +AUTOUP +log " ✅ 自动安全更新已启用" + +# ═══ §7 SSH安全加固 ═══ +log "§7 SSH安全加固..." +if grep -q "^PasswordAuthentication yes" /etc/ssh/sshd_config 2>/dev/null; then + sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config + systemctl restart sshd + log " ✅ 密码登录已禁用，仅允许密钥认证" +else + log " SSH配置已安全，跳过" +fi + +# ═══ §8 铸渊大脑身份初始化 ═══ +log "§8 初始化铸渊大脑身份..." + +cat > "${ZY_BRAIN_META}/identity.json" << 'IDENTITY' +{ + "name": "铸渊·大脑", + "id": "ICE-GL-ZY001", + "server_code": "ZY-SVR-005", + "role": "铸渊核心大脑 · PostgreSQL + MCP Server + Agent Scheduler", + "sovereign": "TCS-0002∞ · 冰朔", + "copyright": "国作登字-2026-A-00037559", + "system_root": "SYS-GLW-0001 · 光湖系统", + "initialized_at": "INIT_TIMESTAMP", + "architecture": { + "database": "PostgreSQL 16 · age_os_brain · 认知数据层", + "mcp_server": "port 3100 · 27工具 · 内部访问", + "agent_scheduler": "9个Agent · 自动调度", + "access": "仅面孔服务器(ZY-SVR-002)可访问 · 不暴露公网" + }, + "rule": "此服务器为铸渊核心大脑 · 100%内部 · 不暴露任何服务到公网" +} +IDENTITY +sed -i "s/INIT_TIMESTAMP/$(date -u +%Y-%m-%dT%H:%M:%SZ)/" "${ZY_BRAIN_META}/identity.json" + +cat > "${ZY_BRAIN_META}/health.json" << 'HEALTH' +{ + "server": "ZY-SVR-005", + "role": "brain", + "status": "initializing", + "last_check": null, + "services": { + "node": null, + "pm2": null, + "postgresql": null, + "mcp_server": null, + "agent_scheduler": null + }, + "disk_usage": null, + "memory_usage": null, + "uptime": null +} +HEALTH + +cat > "${ZY_BRAIN_META}/operation-log.json" << 'OPLOG' +{ + "description": "铸渊大脑服务器操作记录 · 所有操作必须登记", + "operations": [ + { + "id": "ZY-SVR-INIT-005", + "operator": "铸渊 · ICE-GL-ZY001 (via GitHub Actions)", + "action": "大脑服务器初始化", + "timestamp": "INIT_TIMESTAMP", + "details": "执行 brain-server-init.sh · 目录结构+PostgreSQL配置+Schema+防火墙+身份初始化" + } + ] +} +OPLOG +sed -i "s/INIT_TIMESTAMP/$(date -u +%Y-%m-%dT%H:%M:%SZ)/" "${ZY_BRAIN_META}/operation-log.json" + +log " ✅ 大脑身份已初始化" + +# ═══ §9 PM2 Startup 配置 ═══ +log "§9 配置 PM2 Startup..." +pm2 startup systemd -u root --hp /root 2>/dev/null || true +log " ✅ PM2 已配置开机自启" + +# ═══ §10 完成报告 ═══ +log "§10 生成初始化报告..." + +REPORT="${ZY_LOGS}/init-report.json" +cat > "${REPORT}" << REPORT_END +{ + "event": "brain_server_initialization", + "server": "ZY-SVR-005", + "role": "brain", + "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)", + "status": "success", + "components": { + "os": "$(lsb_release -d -s 2>/dev/null || echo 'Ubuntu 24.04')", + "node": "$(node -v 2>/dev/null || echo 'not installed')", + "npm": "$(npm -v 2>/dev/null || echo 'not installed')", + "pm2": "$(pm2 -v 2>/dev/null || echo 'not installed')", + "postgresql": "$(psql --version 2>/dev/null | grep -oP '\\d+\\.\\d+' || echo 'not installed')", + "ufw": "active" + }, + "database": { + "name": "age_os_brain", + "user": "zhuyuan", + "host": "localhost", + "port": 5432, + "password_file": "${DB_PASS_FILE}" + }, + "directories": { + "root": "${ZY_BRAIN_ROOT}", + "mcp_server": "${ZY_MCP}", + "agents": "${ZY_AGENTS}", + "data": "${ZY_DATA}", + "logs": "${ZY_LOGS}", + "config": "${ZY_CONFIG}", + "schema": "${ZY_SCHEMA}" + }, + "firewall": { + "ssh": "22/tcp ALLOW (全局)", + "postgresql": "5432/tcp ALLOW (仅 ${FACE_SERVER_IP})", + "mcp": "3100/tcp ALLOW (仅 ${FACE_SERVER_IP})" + }, + "face_server": "${FACE_SERVER_IP}", + "next_steps": [ + "上传 Schema SQL 并执行", + "部署 MCP Server 代码", + "部署 Agent Scheduler 代码", + "安装 npm 依赖", + "PM2 启动 MCP Server + Agent Scheduler", + "验证 MCP Server /health 端点", + "面孔服务器配置反向代理到大脑" + ] +} +REPORT_END + +# 输出数据库密码（仅在初始化时显示一次） +echo "" +echo -e "${GREEN}═══════════════════════════════════════════════════════════${NC}" +echo -e "${GREEN} ✅ 铸渊大脑服务器初始化完成！ ${NC}" +echo -e "${GREEN}═══════════════════════════════════════════════════════════${NC}" +echo -e " Node.js: $(node -v 2>/dev/null || echo 'N/A')" +echo -e " PM2: $(pm2 -v 2>/dev/null || echo 'N/A')" +echo -e " PostgreSQL: $(psql --version 2>/dev/null | grep -oP '\d+\.\d+' || echo 'N/A')" +echo -e " 根目录: ${ZY_BRAIN_ROOT}" +echo -e " 数据库: age_os_brain (用户: zhuyuan)" +echo -e " 防火墙: SSH + PostgreSQL(面孔) + MCP(面孔)" +echo -e " 面孔服务器: ${FACE_SERVER_IP}" +echo -e " 报告: ${REPORT}" +echo "" +echo -e "${YELLOW}══════════════════ 重要信息 ══════════════════${NC}" +echo -e " 数据库密码文件: ${DB_PASS_FILE}" +echo -e " 数据库密码: ${DB_PASS}" +echo -e "" +echo -e " ⚠️ 请将此密码配置为 GitHub Secret: ZY_BRAIN_DB_PASS" +echo -e " ⚠️ 此密码仅在初始化时显示一次" +echo -e "${YELLOW}═══════════════════════════════════════════════${NC}" +echo ""