feat: add compatible Trojan manager image

2026-07-26 05:01:15 +08:00
parent 059be96536
commit cb17d56cae
26 changed files with 320 additions and 41 deletions
@@ -0,0 +1,15 @@
+services:
+  trojan:
+    image: ${TROJAN_IMAGE:?set an immutable image digest}
+    container_name: trojan
+    network_mode: host
+    privileged: true
+    restart: always
+    command: init
+    env_file: /opt/trojan/runtime.env
+    volumes:
+      - /opt/trojan/config:/usr/local/etc/trojan
+      - /opt/trojan/manager:/var/lib/trojan-manager
+      - /opt/trojan/acme:/root/.acme.sh
+      - /opt/trojan/certs:/etc/trojan/certs
+      - /opt/trojan/manager-config:/etc/trojan-manager
@@ -0,0 +1,8 @@
+# 无损替换运行手册
+
+1. 以镜像 digest 设置 `TROJAN_IMAGE`；禁止使用 `latest`。
+2. 先备份 MariaDB，记录用户数，并保存 `docker inspect trojan` 与 Nginx 配置。
+3. 在旧容器仍运行时执行 `migrate-v1.sh`，然后用 18443/18081/18082 完成预演。
+4. 使用 `verify.sh` 验证管理端、证书、Trojan 监听与公开 443 分享链接。
+5. 正式切换时停止并重命名旧容器为 `trojan-legacy`，再以本 compose 启动新容器。
+6. 任一核心检查失败，立即运行 `rollback.sh`。保留旧容器至少一个证书续期周期。
@@ -0,0 +1,8 @@
+ACME_DOMAIN=www.hk.example.com
+PUBLIC_DOMAIN=www.hk.example.com
+PUBLIC_PORT=443
+TROJAN_LISTEN_PORT=8443
+WEB_HOST=127.0.0.1
+WEB_PORT=8081
+ACME_HTTP_PORT=8082
+MANAGE_FIREWALL=false
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+legacy_container=${1:-trojan}
+target=/opt/trojan
+install -d -m 0750 "$target"/{config,manager,acme,certs,manager-config}
+docker cp "$legacy_container":/usr/local/etc/trojan/config.json "$target/config/config.json"
+docker cp "$legacy_container":/var/lib/trojan-manager/. "$target/manager/"
+docker cp "$legacy_container":/root/.acme.sh/. "$target/acme/" || true
+cat > "$target/manager-config/manager.yaml" <<EOF
+schema_version: 1
+public: { domain: ${PUBLIC_DOMAIN:?set PUBLIC_DOMAIN}, port: ${PUBLIC_PORT:-443} }
+runtime: { listen_address: 0.0.0.0, listen_port: ${TROJAN_LISTEN_PORT:-8443}, fallback_address: 127.0.0.1, fallback_port: ${WEB_PORT:-8081} }
+web: { listen_address: ${WEB_HOST:-127.0.0.1}, listen_port: ${WEB_PORT:-8081} }
+acme: { enabled: true, domain: ${ACME_DOMAIN:-$PUBLIC_DOMAIN}, http_port: ${ACME_HTTP_PORT:-8082} }
+firewall: { manage: false }
+EOF
+chmod 700 "$target"/{acme,certs}; chmod 600 "$target/config/config.json"
+echo "Migration staged in $target; do not stop the legacy container before rehearsal succeeds."
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+docker stop trojan || true
+docker rename trojan trojan-failed-"$(date +%s)" || true
+docker rename trojan-legacy trojan
+docker start trojan
+echo "Legacy container restored. Verify ports 8443 and 8081."
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+: "${PUBLIC_DOMAIN:?PUBLIC_DOMAIN is required}"
+for port in "${TROJAN_LISTEN_PORT:-8443}" "${WEB_PORT:-8081}" "${ACME_HTTP_PORT:-8082}"; do
+  ss -ltn "sport = :${port}" | grep -q LISTEN || { echo "port ${port} is not listening" >&2; exit 1; }
+done
+curl --fail --silent --show-error "http://${WEB_HOST:-127.0.0.1}:${WEB_PORT:-8081}/healthz" >/dev/null
+openssl x509 -in /opt/trojan/certs/fullchain.pem -noout -checkend 0
+openssl x509 -in /opt/trojan/certs/fullchain.pem -noout -text | grep -F "${PUBLIC_DOMAIN}" >/dev/null
+echo "verification passed"