feat: add managed ACME listener and log rotation

Dockerfile

@@ -28,7 +28,8 @@ COPY trojan-master/asset/trojan-acme-challenge.service /etc/systemd/system/troja
 COPY trojan-master/asset/trojan-acme-renew.service /etc/systemd/system/trojan-acme-renew.service
 COPY trojan-master/asset/trojan-acme-renew.timer /etc/systemd/system/trojan-acme-renew.timer
 COPY trojan-master/asset/renew-trojan-certificate /usr/local/sbin/renew-trojan-certificate
+COPY trojan-master/asset/rotate-trojan-log /usr/local/sbin/rotate-trojan-log
 COPY trojan-master/asset/compat-init /usr/local/sbin/compat-init
-RUN chmod 0755 /usr/local/sbin/renew-trojan-certificate /usr/local/sbin/compat-init
+RUN chmod 0755 /usr/local/sbin/renew-trojan-certificate /usr/local/sbin/rotate-trojan-log /usr/local/sbin/compat-init
 HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 CMD curl -fsS "http://127.0.0.1:${WEB_PORT:-8081}/healthz" || exit 1
 CMD ["/usr/local/sbin/compat-init"]

trojan-master/asset/compat-init

@@ -8,4 +8,9 @@ systemctl start trojan
 systemctl start trojan-web
 systemctl start trojan-acme-challenge
 systemctl enable trojan trojan-web trojan-acme-challenge trojan-acme-renew.timer || true
+(
+  while sleep 300; do
+    /usr/local/sbin/rotate-trojan-log || true
+  done
+) &
 exec tail -f /dev/null

trojan-master/asset/rotate-trojan-log

@@ -0,0 +1,16 @@
+#!/bin/bash
+set -euo pipefail
+
+log=/var/log/trojan.log
+limit=$((20 * 1024 * 1024))
+[[ -f "$log" ]] || exit 0
+size=$(stat -c %s "$log")
+(( size < limit )) && exit 0
+
+rm -f "${log}.5.gz"
+for n in 4 3 2 1; do
+  [[ -f "${log}.${n}.gz" ]] && mv "${log}.${n}.gz" "${log}.$((n + 1)).gz"
+done
+cp "$log" "${log}.1"
+: > "$log"
+gzip -f "${log}.1"

trojan-master/asset/trojan-acme-challenge.service

@@ -5,7 +5,7 @@ After=network.target
 [Service]
 Type=simple
 Environment=ACME_WEBROOT=/var/lib/trojan-acme-webroot
-ExecStart=/bin/sh -c '/usr/local/bin/trojan acme-http --port "${ACME_HTTP_PORT:-8082}"'
+ExecStart=/bin/sh -c '/usr/local/bin/trojan acme-http --host "${ACME_HTTP_HOST:-127.0.0.1}" --port "${ACME_HTTP_PORT:-8082}"'
 Restart=on-failure
 RestartSec=3s
 

trojan-master/cmd/acme_http.go

@@ -10,6 +10,7 @@ import (
 )
 
 var acmeHTTPPort int
+var acmeHTTPHost string
 
 var acmeHTTPCmd = &cobra.Command{
 	Use: "acme-http",
@@ -18,9 +19,13 @@ var acmeHTTPCmd = &cobra.Command{
 		root := os.Getenv("ACME_WEBROOT")
 		if root == "" { root = "/var/lib/trojan-acme-webroot" }
 		if err := os.MkdirAll(filepath.Join(root, ".well-known", "acme-challenge"), 0750); err != nil { return err }
-		addr := fmt.Sprintf("127.0.0.1:%d", acmeHTTPPort)
+		addr := fmt.Sprintf("%s:%d", acmeHTTPHost, acmeHTTPPort)
 		return http.ListenAndServe(addr, http.FileServer(http.Dir(root)))
 	},
 }
 
-func init() { acmeHTTPCmd.Flags().IntVar(&acmeHTTPPort, "port", 8082, "ACME HTTP listener port"); rootCmd.AddCommand(acmeHTTPCmd) }
+func init() {
+	acmeHTTPCmd.Flags().StringVar(&acmeHTTPHost, "host", "127.0.0.1", "ACME HTTP listener host")
+	acmeHTTPCmd.Flags().IntVar(&acmeHTTPPort, "port", 8082, "ACME HTTP listener port")
+	rootCmd.AddCommand(acmeHTTPCmd)
+}