From 084577c91022409c097a4338a627ee6cec304523 Mon Sep 17 00:00:00 2001
From: chermack <505360893@qq.com>
Date: Sun, 26 Jul 2026 06:37:49 +0800
Subject: [PATCH] feat: add managed ACME listener and log rotation

---
 Dockerfile                                       |  3 ++-
 trojan-master/asset/compat-init                  |  5 +++++
 trojan-master/asset/rotate-trojan-log            | 16 ++++++++++++++++
 .../asset/trojan-acme-challenge.service          |  2 +-
 trojan-master/cmd/acme_http.go                   |  9 +++++++--
 5 files changed, 31 insertions(+), 4 deletions(-)
 create mode 100644 trojan-master/asset/rotate-trojan-log

diff --git a/Dockerfile b/Dockerfile
index d0d01ed..d572fa9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -28,7 +28,8 @@ COPY trojan-master/asset/trojan-acme-challenge.service /etc/systemd/system/troja
 COPY trojan-master/asset/trojan-acme-renew.service /etc/systemd/system/trojan-acme-renew.service
 COPY trojan-master/asset/trojan-acme-renew.timer /etc/systemd/system/trojan-acme-renew.timer
 COPY trojan-master/asset/renew-trojan-certificate /usr/local/sbin/renew-trojan-certificate
+COPY trojan-master/asset/rotate-trojan-log /usr/local/sbin/rotate-trojan-log
 COPY trojan-master/asset/compat-init /usr/local/sbin/compat-init
-RUN chmod 0755 /usr/local/sbin/renew-trojan-certificate /usr/local/sbin/compat-init
+RUN chmod 0755 /usr/local/sbin/renew-trojan-certificate /usr/local/sbin/rotate-trojan-log /usr/local/sbin/compat-init
 HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 CMD curl -fsS "http://127.0.0.1:${WEB_PORT:-8081}/healthz" || exit 1
 CMD ["/usr/local/sbin/compat-init"]
diff --git a/trojan-master/asset/compat-init b/trojan-master/asset/compat-init
index 90c4cb2..b1571d8 100644
--- a/trojan-master/asset/compat-init
+++ b/trojan-master/asset/compat-init
@@ -8,4 +8,9 @@ systemctl start trojan
 systemctl start trojan-web
 systemctl start trojan-acme-challenge
 systemctl enable trojan trojan-web trojan-acme-challenge trojan-acme-renew.timer || true
+(
+  while sleep 300; do
+    /usr/local/sbin/rotate-trojan-log || true
+  done
+) &
 exec tail -f /dev/null
diff --git a/trojan-master/asset/rotate-trojan-log b/trojan-master/asset/rotate-trojan-log
new file mode 100644
index 0000000..ca36b76
--- /dev/null
+++ b/trojan-master/asset/rotate-trojan-log
@@ -0,0 +1,16 @@
+#!/bin/bash
+set -euo pipefail
+
+log=/var/log/trojan.log
+limit=$((20 * 1024 * 1024))
+[[ -f "$log" ]] || exit 0
+size=$(stat -c %s "$log")
+(( size < limit )) && exit 0
+
+rm -f "${log}.5.gz"
+for n in 4 3 2 1; do
+  [[ -f "${log}.${n}.gz" ]] && mv "${log}.${n}.gz" "${log}.$((n + 1)).gz"
+done
+cp "$log" "${log}.1"
+: > "$log"
+gzip -f "${log}.1"
diff --git a/trojan-master/asset/trojan-acme-challenge.service b/trojan-master/asset/trojan-acme-challenge.service
index 26f689f..3759433 100644
--- a/trojan-master/asset/trojan-acme-challenge.service
+++ b/trojan-master/asset/trojan-acme-challenge.service
@@ -5,7 +5,7 @@ After=network.target
 [Service]
 Type=simple
 Environment=ACME_WEBROOT=/var/lib/trojan-acme-webroot
-ExecStart=/bin/sh -c '/usr/local/bin/trojan acme-http --port "${ACME_HTTP_PORT:-8082}"'
+ExecStart=/bin/sh -c '/usr/local/bin/trojan acme-http --host "${ACME_HTTP_HOST:-127.0.0.1}" --port "${ACME_HTTP_PORT:-8082}"'
 Restart=on-failure
 RestartSec=3s
 
diff --git a/trojan-master/cmd/acme_http.go b/trojan-master/cmd/acme_http.go
index 1ca4988..81efbc5 100644
--- a/trojan-master/cmd/acme_http.go
+++ b/trojan-master/cmd/acme_http.go
@@ -10,6 +10,7 @@ import (
 )
 
 var acmeHTTPPort int
+var acmeHTTPHost string
 
 var acmeHTTPCmd = &cobra.Command{
 	Use: "acme-http",
@@ -18,9 +19,13 @@ var acmeHTTPCmd = &cobra.Command{
 		root := os.Getenv("ACME_WEBROOT")
 		if root == "" { root = "/var/lib/trojan-acme-webroot" }
 		if err := os.MkdirAll(filepath.Join(root, ".well-known", "acme-challenge"), 0750); err != nil { return err }
-		addr := fmt.Sprintf("127.0.0.1:%d", acmeHTTPPort)
+		addr := fmt.Sprintf("%s:%d", acmeHTTPHost, acmeHTTPPort)
 		return http.ListenAndServe(addr, http.FileServer(http.Dir(root)))
 	},
 }
 
-func init() { acmeHTTPCmd.Flags().IntVar(&acmeHTTPPort, "port", 8082, "ACME HTTP listener port"); rootCmd.AddCommand(acmeHTTPCmd) }
+func init() {
+	acmeHTTPCmd.Flags().StringVar(&acmeHTTPHost, "host", "127.0.0.1", "ACME HTTP listener host")
+	acmeHTTPCmd.Flags().IntVar(&acmeHTTPPort, "port", 8082, "ACME HTTP listener port")
+	rootCmd.AddCommand(acmeHTTPCmd)
+}