feat: add compatible Trojan manager image

trojan-master/asset/compat-init

@@ -0,0 +1,11 @@
+#!/bin/bash
+set -euo pipefail
+
+# The legacy image's systemd replacement can supervise units without a real
+# PID-1 systemd. Start them explicitly and keep the container foreground alive.
+systemctl daemon-reload || true
+systemctl start trojan
+systemctl start trojan-web
+systemctl start trojan-acme-challenge
+systemctl enable trojan trojan-web trojan-acme-challenge trojan-acme-renew.timer || true
+exec tail -f /dev/null

trojan-master/asset/renew-trojan-certificate

@@ -0,0 +1,20 @@
+#!/bin/bash
+set -euo pipefail
+domain="${ACME_DOMAIN:?ACME_DOMAIN is required}"
+home=/root/.acme.sh
+cert_dir=/etc/trojan/certs
+source_cert="$home/${domain}_ecc/fullchain.cer"
+source_key="$home/${domain}_ecc/${domain}.key"
+before=""
+[[ -f "$cert_dir/fullchain.pem" ]] && before=$(openssl x509 -in "$cert_dir/fullchain.pem" -noout -fingerprint -sha256)
+"$home/acme.sh" --cron --home "$home"
+test -r "$source_cert" -a -r "$source_key"
+openssl x509 -in "$source_cert" -noout -checkend 0
+mkdir -p "$cert_dir"
+install -m 0644 "$source_cert" "$cert_dir/fullchain.pem"
+install -m 0600 "$source_key" "$cert_dir/private.key"
+openssl x509 -noout -modulus -in "$cert_dir/fullchain.pem" | openssl sha256 > /tmp/trojan-cert.modulus
+openssl rsa -noout -modulus -in "$cert_dir/private.key" | openssl sha256 >> /tmp/trojan-cert.modulus
+[[ $(cut -d' ' -f2 /tmp/trojan-cert.modulus | sort -u | wc -l) -eq 1 ]]
+after=$(openssl x509 -in "$cert_dir/fullchain.pem" -noout -fingerprint -sha256)
+if [[ "$before" != "$after" ]]; then systemctl restart trojan; fi

trojan-master/asset/trojan-acme-challenge.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Trojan ACME HTTP-01 challenge server
+After=network.target
+
+[Service]
+Type=simple
+Environment=ACME_WEBROOT=/var/lib/trojan-acme-webroot
+ExecStart=/bin/sh -c '/usr/local/bin/trojan acme-http --port "${ACME_HTTP_PORT:-8082}"'
+Restart=on-failure
+RestartSec=3s
+
+[Install]
+WantedBy=multi-user.target

trojan-master/asset/trojan-acme-renew.service

@@ -0,0 +1,6 @@
+[Unit]
+Description=Renew Trojan ACME certificate
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/renew-trojan-certificate

trojan-master/asset/trojan-acme-renew.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Daily Trojan ACME renewal check
+
+[Timer]
+OnCalendar=daily
+RandomizedDelaySec=6h
+Persistent=true
+
+[Install]
+WantedBy=timers.target

trojan-master/asset/trojan-web.service

@@ -6,10 +6,10 @@ After=network.target network-online.target nss-lookup.target mysql.service maria
 [Service]
 Type=simple
 StandardError=journal
-ExecStart=/usr/local/bin/trojan web
+ExecStart=/bin/sh -c '/usr/local/bin/trojan web --host "${WEB_HOST:-127.0.0.1}" --port "${WEB_PORT:-8081}"'
 ExecReload=/bin/kill -HUP $MAINPID
 Restart=on-failure
 RestartSec=3s
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=multi-user.target

trojan-master/asset/trojan.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=trojan
+After=network.target network-online.target nss-lookup.target mysql.service mariadb.service mysqld.service
+
+[Service]
+Type=simple
+StandardError=journal
+ExecStart=/usr/bin/trojan/trojan /usr/local/etc/trojan/config.json
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=3s
+
+[Install]
+WantedBy=multi-user.target

trojan-master/cmd/acme_http.go

@@ -0,0 +1,26 @@
+package cmd
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+
+	"github.com/spf13/cobra"
+)
+
+var acmeHTTPPort int
+
+var acmeHTTPCmd = &cobra.Command{
+	Use: "acme-http",
+	Short: "serve only ACME HTTP-01 challenge files",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		root := os.Getenv("ACME_WEBROOT")
+		if root == "" { root = "/var/lib/trojan-acme-webroot" }
+		if err := os.MkdirAll(filepath.Join(root, ".well-known", "acme-challenge"), 0750); err != nil { return err }
+		addr := fmt.Sprintf("127.0.0.1:%d", acmeHTTPPort)
+		return http.ListenAndServe(addr, http.FileServer(http.Dir(root)))
+	},
+}
+
+func init() { acmeHTTPCmd.Flags().IntVar(&acmeHTTPPort, "port", 8082, "ACME HTTP listener port"); rootCmd.AddCommand(acmeHTTPCmd) }

trojan-master/core/server.go

@@ -6,6 +6,7 @@ import (
 	"github.com/tidwall/pretty"
 	"github.com/tidwall/sjson"
 	"os"
+	"path/filepath"
 )
 
 var configPath = "/usr/local/etc/trojan/config.json"
@@ -53,10 +54,13 @@ func Save(data []byte, path string) bool {
 	if path == "" {
 		path = configPath
 	}
-	if err := os.WriteFile(path, pretty.Pretty(data), 0644); err != nil {
+	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil { fmt.Println(err); return false }
+	tmp := path + ".tmp"
+	if err := os.WriteFile(tmp, pretty.Pretty(data), 0644); err != nil {
 		fmt.Println(err)
 		return false
 	}
+	if err := os.Rename(tmp, path); err != nil { fmt.Println(err); return false }
 	return true
 }
 

trojan-master/managerconfig/manager.go

@@ -0,0 +1,47 @@
+// Package managerconfig owns settings which are not part of Trojan's native JSON.
+package managerconfig
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"gopkg.in/yaml.v3"
+)
+
+const DefaultPath = "/etc/trojan-manager/manager.yaml"
+
+type Config struct {
+	SchemaVersion int `yaml:"schema_version" json:"schemaVersion"`
+	Public struct {
+		Domain string `yaml:"domain" json:"domain"`
+		Port int `yaml:"port" json:"port"`
+	} `yaml:"public" json:"public"`
+	Runtime struct {
+		ListenAddress string `yaml:"listen_address" json:"listenAddress"`
+		ListenPort int `yaml:"listen_port" json:"listenPort"`
+		FallbackAddress string `yaml:"fallback_address" json:"fallbackAddress"`
+		FallbackPort int `yaml:"fallback_port" json:"fallbackPort"`
+	} `yaml:"runtime" json:"runtime"`
+	Web struct { ListenAddress string `yaml:"listen_address" json:"listenAddress"`; ListenPort int `yaml:"listen_port" json:"listenPort"` } `yaml:"web" json:"web"`
+	ACME struct { Enabled bool `yaml:"enabled" json:"enabled"`; Domain string `yaml:"domain" json:"domain"`; HTTPPort int `yaml:"http_port" json:"httpPort"` } `yaml:"acme" json:"acme"`
+	Firewall struct { Manage bool `yaml:"manage" json:"manage"` } `yaml:"firewall" json:"firewall"`
+}
+
+func Defaults() Config {
+	var c Config
+	c.SchemaVersion = 1; c.Public.Port = 443; c.Runtime.ListenAddress = "0.0.0.0"; c.Runtime.ListenPort = 8443
+	c.Runtime.FallbackAddress = "127.0.0.1"; c.Runtime.FallbackPort = 8081; c.Web.ListenAddress = "127.0.0.1"; c.Web.ListenPort = 8081; c.ACME.HTTPPort = 8082
+	return c
+}
+func Path() string { if p := os.Getenv("TROJAN_MANAGER_CONFIG"); p != "" { return p }; return DefaultPath }
+func Load() (Config, error) { c := Defaults(); b, err := os.ReadFile(Path()); if os.IsNotExist(err) { return c, nil }; if err != nil { return c, err }; err = yaml.Unmarshal(b, &c); return c, err }
+func Validate(c Config) error {
+	if c.SchemaVersion != 1 { return errors.New("unsupported manager config schema") }
+	ports := []int{c.Public.Port, c.Runtime.ListenPort, c.Runtime.FallbackPort, c.Web.ListenPort, c.ACME.HTTPPort}
+	for _, p := range ports { if p < 1 || p > 65535 { return fmt.Errorf("invalid port %d", p) } }
+	if c.Runtime.ListenPort == c.Web.ListenPort || c.Runtime.ListenPort == c.ACME.HTTPPort || c.Web.ListenPort == c.ACME.HTTPPort { return errors.New("listen, web and ACME ports must be distinct") }
+	return nil
+}
+func Save(c Config) error { if err := Validate(c); err != nil { return err }; b, err := yaml.Marshal(c); if err != nil { return err }; p := Path(); if err := os.MkdirAll(filepath.Dir(p), 0750); err != nil { return err }; tmp := p + ".tmp"; if err := os.WriteFile(tmp, b, 0640); err != nil { return err }; return os.Rename(tmp, p) }

trojan-master/trojan/trojan.go

@@ -48,20 +48,20 @@ func ControlMenu() {
 }
 
 // Restart 重启trojan
-func Restart() {
+func Restart() error {
 	util.OpenPort(core.GetConfig().LocalPort)
-	util.SystemctlRestart("trojan")
+	return util.SystemctlRestart("trojan")
 }
 
 // Start 启动trojan
-func Start() {
+func Start() error {
 	util.OpenPort(core.GetConfig().LocalPort)
-	util.SystemctlStart("trojan")
+	return util.SystemctlStart("trojan")
 }
 
 // Stop 停止trojan
-func Stop() {
-	util.SystemctlStop("trojan")
+func Stop() error {
+	return util.SystemctlStop("trojan")
 }
 
 // Status 获取trojan状态

trojan-master/trojan/web.go

@@ -4,6 +4,7 @@ import (
 	"crypto/sha256"
 	"fmt"
 	"trojan/core"
+	"trojan/managerconfig"
 	"trojan/util"
 )
 
@@ -52,5 +53,8 @@ func SetDomain(domain string) {
 // GetDomainAndPort 获取域名和端口
 func GetDomainAndPort() (string, int) {
 	config := core.GetConfig()
+	if managed, err := managerconfig.Load(); err == nil && managed.Public.Port != 0 {
+		return config.SSl.Sni, managed.Public.Port
+	}
 	return config.SSl.Sni, config.LocalPort
 }

trojan-master/util/command.go

@@ -34,30 +34,36 @@ func systemctlBase(name, operate string) (string, error) {
 }
 
 // SystemctlStart 服务启动
-func SystemctlStart(name string) {
+func SystemctlStart(name string) error {
 	if _, err := systemctlBase(name, "start"); err != nil {
 		fmt.Println(Red(fmt.Sprintf("启动%s失败!", name)))
+		return err
 	} else {
 		fmt.Println(Green(fmt.Sprintf("启动%s成功!", name)))
 	}
+	return nil
 }
 
 // SystemctlStop 服务停止
-func SystemctlStop(name string) {
+func SystemctlStop(name string) error {
 	if _, err := systemctlBase(name, "stop"); err != nil {
 		fmt.Println(Red(fmt.Sprintf("停止%s失败!", name)))
+		return err
 	} else {
 		fmt.Println(Green(fmt.Sprintf("停止%s成功!", name)))
 	}
+	return nil
 }
 
 // SystemctlRestart 服务重启
-func SystemctlRestart(name string) {
+func SystemctlRestart(name string) error {
 	if _, err := systemctlBase(name, "restart"); err != nil {
 		fmt.Println(Red(fmt.Sprintf("重启%s失败!", name)))
+		return err
 	} else {
 		fmt.Println(Green(fmt.Sprintf("重启%s成功!", name)))
 	}
+	return nil
 }
 
 // SystemctlEnable 服务设置开机自启

trojan-master/web/auth.go

@@ -123,6 +123,12 @@ func RequestUsername(c *gin.Context) string {
 	return claims[identityKey].(string)
 }
 
+func RequireAdmin(c *gin.Context) bool {
+	if RequestUsername(c) == "admin" { return true }
+	c.JSON(403, gin.H{"code": 403, "message": "administrator access required"})
+	return false
+}
+
 // Auth 权限router
 func Auth(r *gin.Engine, timeout int) *jwt.GinJWTMiddleware {
 	jwtInit(timeout)
@@ -152,7 +158,10 @@ func Auth(r *gin.Engine, timeout int) *jwt.GinJWTMiddleware {
 		}
 	})
 	r.POST("/auth/login", authMiddleware.LoginHandler)
-	r.POST("/auth/register", updateUser)
+	r.POST("/auth/register", func(c *gin.Context) {
+		if result, _ := core.GetValue("admin_pass"); result != "" { c.JSON(403, gin.H{"code":403,"message":"administrator already initialized"}); return }
+		updateUser(c)
+	})
 	authO := r.Group("/auth")
 	authO.Use(authMiddleware.MiddlewareFunc())
 	{

trojan-master/web/controller/system.go

@@ -0,0 +1,18 @@
+package controller
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"os"
+	"time"
+	"trojan/managerconfig"
+)
+
+func SystemConfig() *ResponseBody { c, err := managerconfig.Load(); r := &ResponseBody{Msg:"success", Data:c}; if err != nil { r.Msg=err.Error() }; return r }
+func ValidateSystemConfig(c managerconfig.Config) *ResponseBody { r:=&ResponseBody{Msg:"success"}; if err:=managerconfig.Validate(c); err != nil { r.Msg=err.Error() }; return r }
+func ApplySystemConfig(c managerconfig.Config) *ResponseBody { r:=ValidateSystemConfig(c); if r.Msg!="success" { return r }; if err:=managerconfig.Save(c); err!=nil { r.Msg=err.Error(); return r }; r.Data=map[string]bool{"restartRequired":true,"nginxReloadRequired":false,"containerRecreateRequired":false}; return r }
+func CertificateStatus() *ResponseBody {
+	r:=&ResponseBody{Msg:"success"}; b,err:=os.ReadFile("/etc/trojan/certs/fullchain.pem"); if err!=nil { r.Msg=err.Error(); return r }; block,_:=pem.Decode(b); if block==nil { r.Msg="invalid certificate PEM"; return r }; cert,err:=x509.ParseCertificate(block.Bytes); if err!=nil { r.Msg=err.Error(); return r }
+	r.Data=map[string]interface{}{"subject":cert.Subject.String(),"issuer":cert.Issuer.String(),"dnsNames":cert.DNSNames,"notBefore":cert.NotBefore,"notAfter":cert.NotAfter,"daysRemaining":int(time.Until(cert.NotAfter).Hours()/24),"serialNumber":fmt.Sprint(cert.SerialNumber)}; return r
+}

trojan-master/web/controller/trojan.go

@@ -20,7 +20,7 @@ import (
 func Start() *ResponseBody {
 	responseBody := ResponseBody{Msg: "success"}
 	defer TimeCost(time.Now(), &responseBody)
-	trojan.Start()
+	if err := trojan.Start(); err != nil { responseBody.Msg = err.Error() }
 	return &responseBody
 }
 
@@ -28,7 +28,7 @@ func Start() *ResponseBody {
 func Stop() *ResponseBody {
 	responseBody := ResponseBody{Msg: "success"}
 	defer TimeCost(time.Now(), &responseBody)
-	trojan.Stop()
+	if err := trojan.Stop(); err != nil { responseBody.Msg = err.Error() }
 	return &responseBody
 }
 
@@ -36,7 +36,7 @@ func Stop() *ResponseBody {
 func Restart() *ResponseBody {
 	responseBody := ResponseBody{Msg: "success"}
 	defer TimeCost(time.Now(), &responseBody)
-	trojan.Restart()
+	if err := trojan.Restart(); err != nil { responseBody.Msg = err.Error() }
 	return &responseBody
 }
 
@@ -53,7 +53,7 @@ func SetLogLevel(level int) *ResponseBody {
 	responseBody := ResponseBody{Msg: "success"}
 	defer TimeCost(time.Now(), &responseBody)
 	core.WriteLogLevel(level)
-	trojan.Restart()
+	if err := trojan.Restart(); err != nil { responseBody.Msg = err.Error() }
 	return &responseBody
 }
 

trojan-master/web/controller/user.go

@@ -36,8 +36,8 @@ func UserList(requestUser string) *ResponseBody {
 	}
 	domain, port := trojan.GetDomainAndPort()
 	responseBody.Data = map[string]interface{}{
-		"domain":   domain,
-		"port":     port,
+		"domain": domain, "port": port, "publicPort": port,
+		"listenPort": core.GetConfig().LocalPort,
 		"userList": userList,
 	}
 	return &responseBody
@@ -55,8 +55,8 @@ func PageUserList(curPage int, pageSize int) *ResponseBody {
 	}
 	domain, port := trojan.GetDomainAndPort()
 	responseBody.Data = map[string]interface{}{
-		"domain":   domain,
-		"port":     port,
+		"domain": domain, "port": port, "publicPort": port,
+		"listenPort": core.GetConfig().LocalPort,
 		"pageData": pageData,
 	}
 	return &responseBody

trojan-master/web/web.go

@@ -8,6 +8,7 @@ import (
 	"io/fs"
 	"net/http"
 	"strconv"
+	"trojan/managerconfig"
 	"trojan/core"
 	"trojan/util"
 	"trojan/web/controller"
@@ -171,6 +172,14 @@ func noTokenRouter(router *gin.Engine) {
 	})
 }
 
+func systemRouter(router *gin.Engine) {
+	system := router.Group("/system")
+	system.GET("/config", func(c *gin.Context) { if !RequireAdmin(c) { return }; c.JSON(200, controller.SystemConfig()) })
+	system.POST("/config/validate", func(c *gin.Context) { if !RequireAdmin(c) { return }; var cfg managerconfig.Config; if err:=c.ShouldBindJSON(&cfg); err!=nil { c.JSON(400, gin.H{"message":err.Error()}); return }; c.JSON(200, controller.ValidateSystemConfig(cfg)) })
+	system.POST("/config/apply", func(c *gin.Context) { if !RequireAdmin(c) { return }; var cfg managerconfig.Config; if err:=c.ShouldBindJSON(&cfg); err!=nil { c.JSON(400, gin.H{"message":err.Error()}); return }; c.JSON(200, controller.ApplySystemConfig(cfg)) })
+	system.GET("/certificate", func(c *gin.Context) { if !RequireAdmin(c) { return }; c.JSON(200, controller.CertificateStatus()) })
+}
+
 // Start web启动入口
 func Start(host string, port, timeout int, isSSL bool) {
 	router := gin.Default()
@@ -178,7 +187,10 @@ func Start(host string, port, timeout int, isSSL bool) {
 	router.Use(gzip.Gzip(gzip.DefaultCompression))
 	staticRouter(router)
 	noTokenRouter(router)
+	router.GET("/healthz", func(c *gin.Context) { c.JSON(200, gin.H{"status":"ok"}) })
+	router.GET("/readyz", func(c *gin.Context) { if core.GetConfig()==nil { c.JSON(503, gin.H{"status":"not ready"}); return }; c.JSON(200, gin.H{"status":"ready"}) })
 	router.Use(Auth(router, timeout).MiddlewareFunc())
+	systemRouter(router)
 	trojanRouter(router)
 	userRouter(router)
 	dataRouter(router)