From b3ad4d5294fbc92131d2a2e40967079960a52da5 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 31 Mar 2026 04:45:06 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=E9=93=B8=E6=B8=8A?=
 =?UTF-8?q?=E4=B8=93=E7=BA=BF=20Xray=20=E5=90=AF=E5=8A=A8=E5=A4=B1?=
 =?UTF-8?q?=E8=B4=A5=20(=E6=9D=83=E9=99=90=E6=8B=92=E7=BB=9D=20+=20User=3D?=
 =?UTF-8?q?nobody=20+=20GFW=E8=AD=A6=E5=91=8A)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. 创建 systemd drop-in override 将 Xray 运行用户从 nobody 改为 root
   - 修复 "permission denied" 写入日志目录
   - 消除 "Special user nobody configured" systemd 警告
2. 显式设置日志目录权限 chmod 755
3. 从 REALITY serverNames 移除 www.apple.com (消除 GFW 封锁风险警告)
4. deploy-proxy.sh 提取共用函数减少重复代码

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/f201a674-d23b-4eaf-a0e6-f46c380e9494

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
---
 server/proxy/config/xray-config-template.json |  1 -
 server/proxy/deploy-proxy.sh                  | 26 +++++++++++++++++++
 server/proxy/setup/install-xray.sh            | 13 ++++++++++
 3 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/server/proxy/config/xray-config-template.json b/server/proxy/config/xray-config-template.json
index 959c40f8..4e9bdfaa 100644
--- a/server/proxy/config/xray-config-template.json
+++ b/server/proxy/config/xray-config-template.json
@@ -52,7 +52,6 @@
           "xver": 0,
           "serverNames": [
             "www.microsoft.com",
-            "www.apple.com",
             "www.amazon.com"
           ],
           "privateKey": "{{ZY_PROXY_REALITY_PRIVATE_KEY}}",
diff --git a/server/proxy/deploy-proxy.sh b/server/proxy/deploy-proxy.sh
index 458b29d9..c121140e 100644
--- a/server/proxy/deploy-proxy.sh
+++ b/server/proxy/deploy-proxy.sh
@@ -32,6 +32,25 @@ echo "════════════════════════
 echo "🌐 铸渊专线 · 部署 · action=$ACTION"
 echo "════════════════════════════════════════"
 
+# ── 共用: 确保Xray以root运行 (修复User=nobody问题) ──
+ensure_xray_root_user() {
+    if [ ! -f /etc/systemd/system/xray.service.d/override.conf ]; then
+        mkdir -p /etc/systemd/system/xray.service.d
+        cat > /etc/systemd/system/xray.service.d/override.conf <<EOF
+[Service]
+User=root
+EOF
+        systemctl daemon-reload
+        echo "  ✅ Xray服务已配置为root用户运行"
+    fi
+}
+
+# ── 共用: 确保日志目录权限正确 ──
+ensure_log_permissions() {
+    mkdir -p "$PROXY_DIR/logs"
+    chmod 755 "$PROXY_DIR/logs"
+}
+
 # ── install: 首次完整安装 ─────────────────────
 install() {
     echo ""
@@ -47,6 +66,9 @@ install() {
 
     echo ""
     echo "═══ [3/7] 启动Xray服务 ═══"
+    ensure_xray_root_user
+    ensure_log_permissions
+
     systemctl enable xray
     systemctl restart xray
     sleep 2
@@ -214,6 +236,10 @@ update() {
     echo "更新代理服务..."
     deploy_services
     configure_xray
+
+    ensure_xray_root_user
+    ensure_log_permissions
+
     systemctl restart xray
     pm2 restart zy-proxy-sub zy-proxy-monitor zy-proxy-guardian 2>/dev/null || true
     health_check
diff --git a/server/proxy/setup/install-xray.sh b/server/proxy/setup/install-xray.sh
index 1f3a9d0a..5c8214c6 100644
--- a/server/proxy/setup/install-xray.sh
+++ b/server/proxy/setup/install-xray.sh
@@ -85,6 +85,19 @@ fi
 echo "[6/6] 创建数据目录..."
 mkdir -p /opt/zhuyuan/proxy/{config,data,logs}
 chown -R root:root /opt/zhuyuan/proxy
+chmod 755 /opt/zhuyuan/proxy/logs
+
+# 修复: Xray官方安装脚本默认设置 User=nobody
+# 导致无法写入日志目录 (permission denied) 且 systemd 警告
+# "Special user nobody configured, this is not safe!"
+# 创建 systemd drop-in 覆盖，以 root 身份运行 (443端口需要root)
+mkdir -p /etc/systemd/system/xray.service.d
+cat > /etc/systemd/system/xray.service.d/override.conf <<EOF
+[Service]
+User=root
+EOF
+systemctl daemon-reload
+echo "  ✅ Xray服务已配置为root用户运行"
 
 echo ""
 echo "════════════════════════════════════════"