mirror of
https://github.com/hotyue/IP-Sentinel.git
synced 2026-07-09 22:51:28 +08:00
refactor(docs): 启动架构文档全量重构，统一 V4.1.1 工业级防渗透注释标准，彻底抹除历史版本碎片
This commit is contained in:
hotyue
@@ -1,26 +1,25 @@
|
||||
#!/bin/bash
|
||||
|
||||
# ==========================================================
|
||||
# 脚本名称: install_master.sh (IP-Sentinel 控制中枢部署脚本 - 动态锚点版)
|
||||
# 核心功能: 部署/卸载调度中枢、SQLite 资产管理、平滑热更新引擎
|
||||
# 脚本名称: install_master.sh
|
||||
# 核心功能: Master 环境探底预装、无感 OTA 置换、持久化 SQLite 建库
|
||||
# ==========================================================
|
||||
|
||||
# ==========================================================
|
||||
# 🛑 核心权限防线: 检查是否以 root 权限运行
|
||||
# ==========================================================
|
||||
# ----------------------------------------------------------
|
||||
# [权限鉴权] 阻断非预期非最高权限的部署操作
|
||||
# ----------------------------------------------------------
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo -e "\033[31m❌ 权限被拒绝: 部署 IP-Sentinel 需要最高系统权限。\033[0m"
|
||||
echo -e "💡 请切换到 root 用户 (执行 su root 或 sudo -i) 后重新运行指令。"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 🟢 [防劫持沙盒] 引入司令部专属随机安全工作区
|
||||
SECURE_TMP=$(mktemp -d /tmp/ips_master_install.XXXXXX)
|
||||
trap 'rm -rf "$SECURE_TMP"' EXIT HUP INT QUIT TERM
|
||||
|
||||
# ==========================================================
|
||||
# 🔍 核心探针: 系统环境与虚拟化检测 (v4.0.13 架构升级)
|
||||
# ==========================================================
|
||||
# ----------------------------------------------------------
|
||||
# [环境预检] 中枢架构探测与系统级诊断
|
||||
# ----------------------------------------------------------
|
||||
is_systemd() {
|
||||
command -v systemctl >/dev/null 2>&1 || return 1
|
||||
[ -d /run/systemd/system ] || return 1
|
||||
@@ -61,27 +60,21 @@ fi
|
||||
echo -e "======================================\n"
|
||||
sleep 1
|
||||
|
||||
# 你的 GitHub 仓库 Raw 数据直链前缀
|
||||
REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/main"
|
||||
|
||||
# [核心: 动态提取 Master 专属版本锚点 (KV 解析法)]
|
||||
# 通过 grep 定位 MASTER_VERSION 行，再通过 cut 提取等号右侧的值
|
||||
# [红警修复] 增加 -f 与 --retry 护甲，防御 404 吞雷 Bug
|
||||
# [链路容灾] 双栈冗余防抖抓取，确立本地态势版本号
|
||||
TARGET_VERSION=$( (curl -fsSL --connect-timeout 5 --retry 2 "${REPO_RAW_URL}/version.txt" || curl -4 -fsSL --connect-timeout 5 --retry 2 "${REPO_RAW_URL}/version.txt") 2>/dev/null | grep "^MASTER_VERSION=" | cut -d'=' -f2 | tr -d '[:space:]')
|
||||
|
||||
# 🛡️ 兜底防线：如果网络波动拉取失败，启用内置的最新兜底版本
|
||||
TARGET_VERSION=${TARGET_VERSION:-"4.0.7"}
|
||||
|
||||
MASTER_DIR="/opt/ip_sentinel_master"
|
||||
DB_FILE="${MASTER_DIR}/sentinel.db"
|
||||
|
||||
echo "========================================================"
|
||||
# [修改] 将欢迎语改为更通用的文案，因为现在不仅能部署，还能卸载
|
||||
echo " 🧠 欢迎使用 IP-Sentinel Master (控制中枢) v${TARGET_VERSION}"
|
||||
echo "========================================================"
|
||||
|
||||
# ==========================================================
|
||||
# [v3.6.1 核心] 拦截司令部静默 OTA 升级模式 (强行接管执行流)
|
||||
# [指令接管] 云端 OTA 重构流引擎拦截
|
||||
# ==========================================================
|
||||
if [ "$SILENT_MASTER_OTA" == "true" ]; then
|
||||
echo -e "\n⏳ [OTA] 中枢重构指令已确认，正在剥离控制台交互..."
|
||||
@@ -89,11 +82,9 @@ if [ "$SILENT_MASTER_OTA" == "true" ]; then
|
||||
UPGRADE_MODE="true"
|
||||
KEEP_DB="true"
|
||||
|
||||
# 汲取原配置进入内存
|
||||
if [ -f "${MASTER_DIR}/master.conf" ]; then
|
||||
source "${MASTER_DIR}/master.conf"
|
||||
|
||||
# 同步新版本号至配置文件
|
||||
if grep -q "^MASTER_VERSION=" "${MASTER_DIR}/master.conf"; then
|
||||
sed -i "s/^MASTER_VERSION=.*/MASTER_VERSION=\"$TARGET_VERSION\"/" "${MASTER_DIR}/master.conf"
|
||||
else
|
||||
@@ -102,13 +93,11 @@ if [ "$SILENT_MASTER_OTA" == "true" ]; then
|
||||
fi
|
||||
echo -e "\033[32m✅ 已激活 [中枢静默重构模式]，即将无损覆写内核...\033[0m"
|
||||
else
|
||||
# [新增] 交互式操作菜单：支持选择部署或调用卸载程序
|
||||
echo -e "\n请选择操作:"
|
||||
echo " 1) 🚀 部署 Master 控制中枢"
|
||||
echo " 2) 🗑️ 一键卸载 Master 中枢"
|
||||
read -p "请输入选择 [1-2] (默认1): " ACTION_CHOICE
|
||||
|
||||
# [v3.5.2 修复] 防止用户直接回车导致变量为空，从而漏过下方的平滑升级判定被误删档
|
||||
ACTION_CHOICE=${ACTION_CHOICE:-1}
|
||||
|
||||
if [ "$ACTION_CHOICE" == "2" ]; then
|
||||
@@ -120,7 +109,7 @@ else
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# ================== [v3.2.2 新增: 平滑升级模式嗅探] ==================
|
||||
# [态势传承] 平滑接管探查并保护库文件
|
||||
UPGRADE_MODE="false"
|
||||
KEEP_DB="true"
|
||||
|
||||
@@ -149,7 +138,9 @@ else
|
||||
fi
|
||||
fi
|
||||
|
||||
# ================== [v3.2.2 优化: 数据纯净度清理与保护] ==================
|
||||
# ----------------------------------------------------------
|
||||
# [环境清洗] 执行装配前系统清理动作
|
||||
# ----------------------------------------------------------
|
||||
echo -e "\n⏳ 正在验证本地环境与数据..."
|
||||
|
||||
if [ "$UPGRADE_MODE" == "true" ]; then
|
||||
@@ -159,42 +150,36 @@ if [ "$UPGRADE_MODE" == "true" ]; then
|
||||
else
|
||||
echo -e "📦 历史节点数据库 (SQLite) 已绝密保留。"
|
||||
fi
|
||||
# [防砖修复] 移除过早的旧进程抹杀与脚本物理删除，防止拉取失败导致司令部变砖失联
|
||||
else
|
||||
# 焦土政策：如果不是升级模式，直接扬了整个司令部目录
|
||||
rm -rf "$MASTER_DIR" 2>/dev/null
|
||||
fi
|
||||
# =======================================================================
|
||||
|
||||
# 1. 依赖检查与智能安装 (v3.6.0 兼容性与优雅性升级)
|
||||
# ==========================================================
|
||||
# [依赖装甲] 多分支环境极简包管理器适配策略
|
||||
# ==========================================================
|
||||
echo -e "\n[1/4] 正在探测核心依赖 (curl, jq, sqlite3, crontab, pgrep, openssl)..."
|
||||
|
||||
REQUIRED_CMDS=("curl" "jq" "sqlite3" "crontab" "pgrep" "openssl")
|
||||
MISSING_CMDS=()
|
||||
|
||||
# 基础探测：预检查缺失的命令
|
||||
for cmd in "${REQUIRED_CMDS[@]}"; do
|
||||
if ! command -v "$cmd" >/dev/null 2>&1; then
|
||||
MISSING_CMDS+=("$cmd")
|
||||
fi
|
||||
done
|
||||
|
||||
# 如果有缺失，才执行包管理器拉取逻辑
|
||||
if [ ${#MISSING_CMDS[@]} -gt 0 ]; then
|
||||
echo "⏳ 发现缺失依赖: ${MISSING_CMDS[*]}，正在尝试自动补齐..."
|
||||
|
||||
if command -v apt-get >/dev/null 2>&1; then
|
||||
apt-get update -y >/dev/null 2>&1
|
||||
# [v3.6.3 抽脂级优化] 注入 --no-install-recommends 拒绝捆绑销售
|
||||
apt-get install -y --no-install-recommends curl jq sqlite3 cron procps openssl >/dev/null 2>&1
|
||||
systemctl enable cron >/dev/null 2>&1 && systemctl start cron >/dev/null 2>&1
|
||||
elif command -v yum >/dev/null 2>&1 || command -v dnf >/dev/null 2>&1 || command -v microdnf >/dev/null 2>&1; then
|
||||
# RHEL / CentOS / AlmaLinux / Rocky 系列 (含极简 microdnf 镜像)
|
||||
PKG_MGR="yum"
|
||||
OPT_ARGS=""
|
||||
if command -v dnf >/dev/null 2>&1; then
|
||||
PKG_MGR="dnf"
|
||||
# [v3.6.3 抽脂级优化] 强行关闭 DNF 的弱依赖拉取
|
||||
OPT_ARGS="--setopt=install_weak_deps=False"
|
||||
elif command -v microdnf >/dev/null 2>&1; then
|
||||
PKG_MGR="microdnf"
|
||||
@@ -204,12 +189,10 @@ if [ ${#MISSING_CMDS[@]} -gt 0 ]; then
|
||||
$PKG_MGR install -y epel-release >/dev/null 2>&1 || true
|
||||
|
||||
echo -e "\033[90m (正在拉取核心组件...)\033[0m"
|
||||
# [核心修复] 移除屏蔽符，暴露真实执行过程
|
||||
$PKG_MGR install -y $OPT_ARGS curl jq sqlite cronie procps-ng openssl
|
||||
systemctl enable crond >/dev/null 2>&1 && systemctl start crond >/dev/null 2>&1
|
||||
elif command -v apk >/dev/null 2>&1; then
|
||||
echo "Alpine 探测到系统类型为 Alpine Linux，正在执行轻量级安装..."
|
||||
# [修复] 优先尝试 cronie，若失败则回退至系统内置 cron，彻底避免单点依赖拖垮全局
|
||||
apk add --no-cache curl jq sqlite cronie procps bash openssl || apk add --no-cache curl jq sqlite procps bash openssl
|
||||
mkdir -p /var/spool/cron/crontabs
|
||||
rc-update add crond default >/dev/null 2>&1
|
||||
@@ -228,7 +211,6 @@ if [ ${#MISSING_CMDS[@]} -gt 0 ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 安装后二次复检
|
||||
for cmd in "${REQUIRED_CMDS[@]}"; do
|
||||
if ! command -v "$cmd" >/dev/null 2>&1; then
|
||||
echo -e "\033[31m❌ 致命错误：核心命令 '$cmd' 仍未找到！\033[0m"
|
||||
@@ -242,14 +224,12 @@ echo -e "\033[32m✅ 基础环境检测通过。\033[0m"
|
||||
mkdir -p "$MASTER_DIR"
|
||||
|
||||
# ==========================================================
|
||||
# 🛑 如果是全新部署，才询问 Token 并写入配置
|
||||
# [配置总线] 构建交互与策略文件固化
|
||||
# ==========================================================
|
||||
if [ "$UPGRADE_MODE" == "false" ]; then
|
||||
# 2. 交互配置机器人
|
||||
echo -e "\n[2/4] 配置控制中枢机器人:"
|
||||
read -p "请输入 Telegram Bot Token: " TG_TOKEN
|
||||
|
||||
# [v3.6.0 新增] 官方网关模式选项 (用于屏蔽全局 OTA 按钮)
|
||||
echo -e "\n请选择您的部署环境身份:"
|
||||
echo " 1) 🛡️ 私有独立中枢 (默认推荐，保留完整 OTA 遥控权限)"
|
||||
echo " 2) ☁️ 官方公共网关 (面向大众服务，将强制物理隐藏全局 OTA 按钮防滥用)"
|
||||
@@ -262,7 +242,6 @@ if [ "$UPGRADE_MODE" == "false" ]; then
|
||||
IS_OFFICIAL_GATEWAY="true"
|
||||
echo -e "\033[33m⚠️ 已开启官方公共网关模式，全舰队与司令部的 OTA 将被强制屏蔽。\033[0m"
|
||||
else
|
||||
# [v3.6.1] 私有模式开放中枢 OTA 授权向导
|
||||
echo -e "\n[2.1/4] 司令部自我进化授权"
|
||||
echo -e "💡 开启后，您可以在 TG 菜单一键将中枢核心系统热更新至最新版本。"
|
||||
read -p "是否允许司令部接收 OTA 重构指令？(y/n, 默认y): " M_OTA_CHOICE
|
||||
@@ -281,14 +260,11 @@ MASTER_VERSION="$TARGET_VERSION"
|
||||
TG_TOKEN="$TG_TOKEN"
|
||||
DB_FILE="$DB_FILE"
|
||||
MASTER_DIR="$MASTER_DIR"
|
||||
# [v3.6.0 核心] 官方网关 UI 熔断标识
|
||||
IS_OFFICIAL_GATEWAY="$IS_OFFICIAL_GATEWAY"
|
||||
# [v3.6.1 新增] 司令部自身 OTA 授权标识
|
||||
ENABLE_MASTER_OTA="$ENABLE_MASTER_OTA"
|
||||
EOF
|
||||
fi
|
||||
|
||||
# [v3.6.1 热修复] 老司令部平滑升级时，自动补齐缺失字段
|
||||
if [ "$UPGRADE_MODE" == "true" ]; then
|
||||
if ! grep -q "^IS_OFFICIAL_GATEWAY=" "${MASTER_DIR}/master.conf"; then
|
||||
echo "IS_OFFICIAL_GATEWAY=\"false\"" >> "${MASTER_DIR}/master.conf"
|
||||
@@ -297,9 +273,10 @@ if [ "$UPGRADE_MODE" == "true" ]; then
|
||||
echo "ENABLE_MASTER_OTA=\"false\"" >> "${MASTER_DIR}/master.conf"
|
||||
fi
|
||||
fi
|
||||
# 🛑 拦截块结束
|
||||
|
||||
# 3. 初始化 SQLite 数据库 (幂等操作，升级模式下由 tg_master.sh 负责热修补)
|
||||
# ----------------------------------------------------------
|
||||
# [数据存储] 初始化 SQLite 表结构基线
|
||||
# ----------------------------------------------------------
|
||||
echo -e "\n[3/4] 正在初始化 SQLite 数据库表结构..."
|
||||
sqlite3 "$DB_FILE" <<EOF
|
||||
CREATE TABLE IF NOT EXISTS nodes (
|
||||
@@ -316,7 +293,6 @@ CREATE TABLE IF NOT EXISTS nodes (
|
||||
PRIMARY KEY(chat_id, node_name)
|
||||
);
|
||||
|
||||
-- [v4.0.0 新增, v4.0.2 扩容] 核心情报表：记录历史 IP 质量数据，用于绘制趋势图
|
||||
CREATE TABLE IF NOT EXISTS ip_trend_log (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
node_name TEXT,
|
||||
@@ -329,18 +305,17 @@ CREATE TABLE IF NOT EXISTS ip_trend_log (
|
||||
EOF
|
||||
echo "✅ 数据库创建成功: $DB_FILE"
|
||||
|
||||
# ================== [v3.0.3 变更: 敏感文件权限收敛] ==================
|
||||
chmod 600 "${MASTER_DIR}/master.conf"
|
||||
chmod 600 "$DB_FILE"
|
||||
# ====================================================================
|
||||
|
||||
# 4. 拉取核心调度代码并执行原子化交接
|
||||
# ==========================================================
|
||||
# [原子交接] 防变砖双缓冲下载，确保执行层无断层覆写
|
||||
# ==========================================================
|
||||
echo -e "\n[4/4] 正在拉取新版司令部核心引擎..."
|
||||
|
||||
TMP_MASTER="${SECURE_TMP}/tg_master.sh"
|
||||
curl -fsSL --connect-timeout 10 --retry 3 "${REPO_RAW_URL}/master/tg_master.sh" -o "$TMP_MASTER"
|
||||
|
||||
# 🛡️ 防砖终极校验
|
||||
if [ ! -s "$TMP_MASTER" ]; then
|
||||
echo -e "\033[31m❌ 致命错误：中枢核心代码拉取失败！网络阻断或 GitHub Raw 异常。\033[0m"
|
||||
echo "🛡️ 防砖机制触发：已中止覆盖，旧版司令部仍在安全运行中。"
|
||||
@@ -348,8 +323,6 @@ if [ ! -s "$TMP_MASTER" ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 🟢 [原子化交接核心]: 校验完美通过，新代码已备妥！
|
||||
# 以雷霆手段抹杀旧版调度进程，杜绝文件覆写时的并发错乱
|
||||
echo "⏳ 新引擎校验通过，正在抹杀旧版守护进程..."
|
||||
if is_systemd; then
|
||||
systemctl kill --signal=SIGKILL ip-sentinel-master.service >/dev/null 2>&1 || true
|
||||
@@ -357,7 +330,6 @@ if is_systemd; then
|
||||
fi
|
||||
pkill -9 -f "tg_master.sh" >/dev/null 2>&1 || true
|
||||
|
||||
# 执行物理替换
|
||||
mv "$TMP_MASTER" "${MASTER_DIR}/tg_master.sh"
|
||||
chmod +x "${MASTER_DIR}/tg_master.sh"
|
||||
|
||||
@@ -389,7 +361,6 @@ EOF
|
||||
systemctl enable --now ip-sentinel-master.service
|
||||
systemctl restart ip-sentinel-master.service
|
||||
|
||||
# 清理可能残留的历史 Cron (无落地内存流防劫持)
|
||||
crontab -l 2>/dev/null | grep -v "tg_master.sh" | crontab - >/dev/null 2>&1 || true
|
||||
else
|
||||
echo "💡 未检测到 Systemd，回退到 Cron 看门狗调度模式..."
|
||||
@@ -400,13 +371,15 @@ else
|
||||
pgrep -f tg_master.sh >/dev/null || { nohup bash "${MASTER_DIR}/tg_master.sh" >/dev/null 2>&1 & disown 2>/dev/null; }
|
||||
fi
|
||||
|
||||
# ================== [v3.2.2 优化 & v3.6.1 OTA捷报: 战报文案分流] ==================
|
||||
# ==========================================================
|
||||
# [状态汇报] 根据操作场景分发回执
|
||||
# ==========================================================
|
||||
echo "========================================================"
|
||||
if [ "$UPGRADE_MODE" == "true" ]; then
|
||||
echo "🎉 Master 控制中枢平滑热更新完成！"
|
||||
echo "🤖 新版中枢引擎已接管数据库，继续等待边缘节点汇报。"
|
||||
|
||||
# [v3.6.1 核心] 静默 OTA 完成后，由幽灵进程主动向指挥官发送捷报
|
||||
# 幽灵态静默 OTA 完毕后执行回叫汇报
|
||||
if [ "$SILENT_MASTER_OTA" == "true" ] && [ -n "$OTA_CHAT_ID" ] && [ -n "$TG_TOKEN" ]; then
|
||||
echo -e "\n📡 正在向指挥官发送司令部重构捷报..."
|
||||
curl -s -X POST "https://api.telegram.org/bot${TG_TOKEN}/sendMessage" \
|
||||
@@ -421,10 +394,7 @@ else
|
||||
echo "🤖 机器人现已开始全局接客，等待边缘节点注册。"
|
||||
fi
|
||||
echo "========================================================"
|
||||
# =================================================================
|
||||
|
||||
# ================== [v3.1.2 新增: 玻璃房透明装机统计] ==================
|
||||
# [修复] 仅在全新部署时触发统计，司令部热重载时绝对不触发
|
||||
if [ "$UPGRADE_MODE" == "false" ]; then
|
||||
echo -e "\n📡 正在向开源社区汇报装机量 (完全匿名，不收集IP)..."
|
||||
MASTER_COUNT=$(curl -s -m 3 "https://ip-sentinel-count.samanthaestime296.workers.dev/ping/master" || echo "")
|
||||
@@ -436,9 +406,8 @@ if [ "$UPGRADE_MODE" == "false" ]; then
|
||||
fi
|
||||
fi
|
||||
|
||||
# ================== [新增: 安装成功高光时刻 Star 引导] ==================
|
||||
echo -e "\n========================================================"
|
||||
echo -e "⭐ \033[33m开源不易，如果 IP-Sentinel 极大简化了您的多节点管理，请赐予我们一枚星标！\033[0m"
|
||||
echo -e "💡 \033[32m您的每一颗 Star 都是我们持续迭代架构、开发 Web 视窗化控制台的动力源泉。\033[0m"
|
||||
echo -e "👉 \033[36m\033[4m\033]8;;https://github.com/hotyue/IP-Sentinel\033\\点击此处直达 GitHub 仓库点亮 Star 🌟\033[0m\033]8;;\033\\"
|
||||
echo -e "========================================================\n"
|
||||
echo -e "========================================================\n"
|
||||
Reference in New Issue
Block a user