fix: 修复铸渊专线 Xray 启动失败 (权限拒绝 + User=nobody + GFW警告)

1. 创建 systemd drop-in override 将 Xray 运行用户从 nobody 改为 root
   - 修复 "permission denied" 写入日志目录
   - 消除 "Special user nobody configured" systemd 警告
2. 显式设置日志目录权限 chmod 755
3. 从 REALITY serverNames 移除 www.apple.com (消除 GFW 封锁风险警告)
4. deploy-proxy.sh 提取共用函数减少重复代码

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/f201a674-d23b-4eaf-a0e6-f46c380e9494

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>

server/proxy/config/xray-config-template.json

@@ -52,7 +52,6 @@
           "xver": 0,
           "serverNames": [
             "www.microsoft.com",
-            "www.apple.com",
             "www.amazon.com"
           ],
           "privateKey": "{{ZY_PROXY_REALITY_PRIVATE_KEY}}",

server/proxy/deploy-proxy.sh

@@ -32,6 +32,25 @@ echo "════════════════════════
 echo "🌐 铸渊专线 · 部署 · action=$ACTION"
 echo "════════════════════════════════════════"
 
+# ── 共用: 确保Xray以root运行 (修复User=nobody问题) ──
+ensure_xray_root_user() {
+    if [ ! -f /etc/systemd/system/xray.service.d/override.conf ]; then
+        mkdir -p /etc/systemd/system/xray.service.d
+        cat > /etc/systemd/system/xray.service.d/override.conf <<EOF
+[Service]
+User=root
+EOF
+        systemctl daemon-reload
+        echo "  ✅ Xray服务已配置为root用户运行"
+    fi
+}
+
+# ── 共用: 确保日志目录权限正确 ──
+ensure_log_permissions() {
+    mkdir -p "$PROXY_DIR/logs"
+    chmod 755 "$PROXY_DIR/logs"
+}
+
 # ── install: 首次完整安装 ─────────────────────
 install() {
     echo ""
@@ -47,6 +66,9 @@ install() {
 
     echo ""
     echo "═══ [3/7] 启动Xray服务 ═══"
+    ensure_xray_root_user
+    ensure_log_permissions
+
     systemctl enable xray
     systemctl restart xray
     sleep 2
@@ -214,6 +236,10 @@ update() {
     echo "更新代理服务..."
     deploy_services
     configure_xray
+
+    ensure_xray_root_user
+    ensure_log_permissions
+
     systemctl restart xray
     pm2 restart zy-proxy-sub zy-proxy-monitor zy-proxy-guardian 2>/dev/null || true
     health_check

server/proxy/setup/install-xray.sh

@@ -85,6 +85,19 @@ fi
 echo "[6/6] 创建数据目录..."
 mkdir -p /opt/zhuyuan/proxy/{config,data,logs}
 chown -R root:root /opt/zhuyuan/proxy
+chmod 755 /opt/zhuyuan/proxy/logs
+
+# 修复: Xray官方安装脚本默认设置 User=nobody
+# 导致无法写入日志目录 (permission denied) 且 systemd 警告
+# "Special user nobody configured, this is not safe!"
+# 创建 systemd drop-in 覆盖，以 root 身份运行 (443端口需要root)
+mkdir -p /etc/systemd/system/xray.service.d
+cat > /etc/systemd/system/xray.service.d/override.conf <<EOF
+[Service]
+User=root
+EOF
+systemctl daemon-reload
+echo "  ✅ Xray服务已配置为root用户运行"
 
 echo ""
 echo "════════════════════════════════════════"