feat: add compatible Trojan manager image

trojan-master/asset/compat-init

@@ -0,0 +1,11 @@
+#!/bin/bash
+set -euo pipefail
+
+# The legacy image's systemd replacement can supervise units without a real
+# PID-1 systemd. Start them explicitly and keep the container foreground alive.
+systemctl daemon-reload || true
+systemctl start trojan
+systemctl start trojan-web
+systemctl start trojan-acme-challenge
+systemctl enable trojan trojan-web trojan-acme-challenge trojan-acme-renew.timer || true
+exec tail -f /dev/null

trojan-master/asset/renew-trojan-certificate

@@ -0,0 +1,20 @@
+#!/bin/bash
+set -euo pipefail
+domain="${ACME_DOMAIN:?ACME_DOMAIN is required}"
+home=/root/.acme.sh
+cert_dir=/etc/trojan/certs
+source_cert="$home/${domain}_ecc/fullchain.cer"
+source_key="$home/${domain}_ecc/${domain}.key"
+before=""
+[[ -f "$cert_dir/fullchain.pem" ]] && before=$(openssl x509 -in "$cert_dir/fullchain.pem" -noout -fingerprint -sha256)
+"$home/acme.sh" --cron --home "$home"
+test -r "$source_cert" -a -r "$source_key"
+openssl x509 -in "$source_cert" -noout -checkend 0
+mkdir -p "$cert_dir"
+install -m 0644 "$source_cert" "$cert_dir/fullchain.pem"
+install -m 0600 "$source_key" "$cert_dir/private.key"
+openssl x509 -noout -modulus -in "$cert_dir/fullchain.pem" | openssl sha256 > /tmp/trojan-cert.modulus
+openssl rsa -noout -modulus -in "$cert_dir/private.key" | openssl sha256 >> /tmp/trojan-cert.modulus
+[[ $(cut -d' ' -f2 /tmp/trojan-cert.modulus | sort -u | wc -l) -eq 1 ]]
+after=$(openssl x509 -in "$cert_dir/fullchain.pem" -noout -fingerprint -sha256)
+if [[ "$before" != "$after" ]]; then systemctl restart trojan; fi

trojan-master/asset/trojan-acme-challenge.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Trojan ACME HTTP-01 challenge server
+After=network.target
+
+[Service]
+Type=simple
+Environment=ACME_WEBROOT=/var/lib/trojan-acme-webroot
+ExecStart=/bin/sh -c '/usr/local/bin/trojan acme-http --port "${ACME_HTTP_PORT:-8082}"'
+Restart=on-failure
+RestartSec=3s
+
+[Install]
+WantedBy=multi-user.target

trojan-master/asset/trojan-acme-renew.service

@@ -0,0 +1,6 @@
+[Unit]
+Description=Renew Trojan ACME certificate
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/renew-trojan-certificate

trojan-master/asset/trojan-acme-renew.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Daily Trojan ACME renewal check
+
+[Timer]
+OnCalendar=daily
+RandomizedDelaySec=6h
+Persistent=true
+
+[Install]
+WantedBy=timers.target

trojan-master/asset/trojan-web.service

@@ -6,10 +6,10 @@ After=network.target network-online.target nss-lookup.target mysql.service maria
 [Service]
 Type=simple
 StandardError=journal
-ExecStart=/usr/local/bin/trojan web
+ExecStart=/bin/sh -c '/usr/local/bin/trojan web --host "${WEB_HOST:-127.0.0.1}" --port "${WEB_PORT:-8081}"'
 ExecReload=/bin/kill -HUP $MAINPID
 Restart=on-failure
 RestartSec=3s
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=multi-user.target

trojan-master/asset/trojan.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=trojan
+After=network.target network-online.target nss-lookup.target mysql.service mariadb.service mysqld.service
+
+[Service]
+Type=simple
+StandardError=journal
+ExecStart=/usr/bin/trojan/trojan /usr/local/etc/trojan/config.json
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=3s
+
+[Install]
+WantedBy=multi-user.target