rogue/NexusGate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity
Files
backup-20261021
NexusGate/LINK-MIGRATION.md
T
aaaamoooo d316d0f8bb feat: customer-level credentials shared across all nodes (item 2) 
One credential set per customer (UUID + 32-byte root relay key + shortId)
lives on the customer record; node bindings no longer store credentials.
SS2022 user keys derive deterministically from the root key by method
length (16/24/32-byte prefix), so a single password serves every protocol,
matching 3x-ui's per-client credential model. Reality public keys stay a
node property and are shown per binding in the credentials pane.

- store: load-time convergence — first binding's set wins; a converged
  password that is not a 32-byte root key is regenerated (uuid/shortId
  preserved); bindings are stripped; idempotent, covered by tests
- deploy: the orchestrator stamps the customer's set onto a build copy;
  subscriptions resolve the same set; the derivation applies in both the
  inbound builder and the URI builder (verified live: Alice's N1 link is
  byte-identical to the pre-change seed expectation, her N2 user key is
  exactly the root key's 16-byte prefix)
- API: GET /api/customers/:id/credentials returns {credentials, bindings};
  regenerate is now POST /api/customers/:id/credentials/regenerate and
  rotates the whole set, rebuilding every deployed node of the customer
- UI: credentials pane shows the single shared set plus per-binding
  node/protocol/Reality-public-key rows
- golden subscriptions fixture regenerated under one shared set (RF and
  SS entries byte-identical to before; five entries audited by hand)
- golden baseline re-captured for the new shapes; difftest normalizer now
  treats a base64 root key's prefix-truncation encodings and the Surge
  '='-mangled variants as the same secret
2026-10-21 11:18:00 +08:00

73 lines
5.7 KiB
Markdown
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# NexusGate 分发链接迁移报告（GitHub → 自建 Gitea）
- 日期：2026-10-20
- 提交：`f4ef3d9` chore: migrate self-distribution links from GitHub to self-hosted Gitea（8 文件，本地已 commit，**未 push**，等云电脑侧续推）
- 新基址：`https://git.881218.xyz/rogue/NexusGate`
## 映射规则（已按此执行）
| 类型 | 旧（GitHub） | 新（Gitea） |
|---|---|---|
| raw | `raw.githubusercontent.com/aaaamoooo/NexusGate/<branch>/<path>` | `git.881218.xyz/rogue/NexusGate/raw/branch/<branch>/<path>` |
| release | `github.com/aaaamoooo/NexusGate/releases/download/<tag>/<file>` | `git.881218.xyz/rogue/NexusGate/releases/download/<tag>/<file>` |
| archive | `github.com/<REPO>/archive/refs/heads/<branch>.tar.gz` | `git.881218.xyz/rogue/NexusGate/archive/<branch>.tar.gz` |
| clone | `github.com/aaaamoooo/NexusGate.git` | `git.881218.xyz/rogue/NexusGate.git` |
## 逐文件改动
- `public/app.js`（2 处）：面板生成的节点注册命令、旧版卸载兼容命令的 raw 链接 → Gitea raw。
- `panel-go/embed_public/app.js`：同上同步改毕，两份 app.js 全文件逐字一致。注意该目录是 panel-go 的构建产物（`.gitignore` 排除，`build.sh` 每次从 `../public` 重新拷贝），不入仓；panel-go 已编译的三个二进制（同为 gitignore 产物）内嵌的仍是旧链接，**需重跑 panel-go/build.sh 重建后才生效**。
- `scripts/agent-install.sh` / `scripts/agent-update.sh`：新增 `GIT_BASE="https://git.881218.xyz/${REPO}"`，raw 与 release 链接改由 GIT_BASE 拼装；`REPO` 默认 `aaaamoooo/NexusGate` → `rogue/NexusGate`；`NG_REPO`/`NG_BRANCH`/`--repo`/`--branch`/`NG_AGENT_RELEASE` 语义与默认值不变；raw 的 `?t=` 缓存破坏参数保留。相关注释 "GitHub Release" → "Gitea Release"。
- `scripts/install.sh` / `scripts/nexusgate.sh`：同上加 GIT_BASE；归档链接改 Gitea archive 格式（两脚本的解包逻辑对顶层目录的处理与 Gitea 包结构兼容：install.sh 取唯一顶层目录、nexusgate.sh 用 --strip-components=1）。
- `scripts/agent-singbox.sh`：release 基址改为 `https://git.881218.xyz/${NG_REPO:-rogue/NexusGate}/releases/download/${release_tag}`（调用方 agent-install.sh 本就透传 NG_REPO）；stats-query.go 的 raw 拉取改 Gitea raw 格式；提示文案 GitHub → Gitea。
- `README.md`：clone 地址、一键注册命令 raw 链接、"GitHub Release" 文案。
- `agent-go/INSTALL-GO.md`：release 下载地址与文案。
## ⚠️ 判断性改动（请复核）
以下三处脚本的 `REPO` 默认值原本指向**上游原作者** `a2899882/NexusGate`，本次一并改为 `rogue/NexusGate`：
- `scripts/install.sh`、`scripts/nexusgate.sh` 的源码归档下载
- `scripts/agent-singbox.sh` 中 stats-query.go 的拉取源
理由：这三处下载的是**本 fork 的面板/Agent 代码本身**（上游原版没有本 fork 的二开改动，装错即装成原版），且 a2899882 在自建 Gitea 上不存在、保留只会 404。调用方均可继续用 `NG_REPO` 覆盖。如认为应保留上游默认，回滚这三行即可。
## 未改动（残留清单及理由）
- `agent/stats-query.go` 的 import、`scripts/agent-singbox.sh` 的 `go install`/`go get github.com/sagernet/sing-box@...`、`agent-go/PARITY.md` 中的提及：均为**上游 sing-box 依赖包名**，不是分发链接。
- `scripts/agent-singbox.sh` 中 Go 工具链下载 `go.dev/dl/...`：上游官方地址、非 GitHub。
- `.github/workflows/ci.yml`：GitHub Actions 配置（actions/checkout 等），与分发无关；Gitea 侧默认不执行，保持原样。
- 全仓已复查：无 ghproxy / jsdelivr 等镜像域名、无其他写死的旧分发域名。
## 自检结果
- grep 复查：文本文件中已无指向 `aaaamoooo` / `a2899882` / `imamoxilin` 或以 `${REPO}` 拼 GitHub 主机的自有分发链接（残留仅上表上游依赖）。
- `bash -n` 五个改过的脚本全部通过。
- `public/app.js` 与 `panel-go/embed_public/app.js` diff 为空（逐字一致）。
## ★ Gitea 上尚不存在、需手工建的 Release 清单
脚本已指向以下地址，但在把文件传上去之前它们是 404。raw 与源码归档由 Gitea 按仓自动提供，无需手工处理；**只有这两组 release 要建**：
### 1. 标签 `agent-v0.6.8`（agent-install.sh / agent-update.sh 的 `AGENT_RELEASE` 默认值）
| 附件名（必须逐字一致） | 本地现存文件 |
|---|---|
| `nexusgate-agent-linux-amd64` | `~/workspace/backups/2026-10-20/binaries/nexusgate-agent-linux-amd64` |
| `nexusgate-agent-linux-arm64` | `~/workspace/backups/2026-10-20/binaries/nexusgate-agent-linux-arm64` |
（同名同大小副本也在 `~/workspace/NexusGate/agent-go/` 下，任选一处上传，文件名不用改。）
### 2. 标签 `sing-box-v1.13.21`（agent-singbox.sh 的 `release_tag` 默认值，可由 `NG_SINGBOX_RELEASE` 覆盖）
| 附件名（必须逐字一致） | 本地现存文件（上传时需改名去掉 `-v1.13.21` 后缀） |
|---|---|
| `nexusgate-sing-box-linux-amd64` | `~/workspace/nexusgate-release/bin/nexusgate-sing-box-linux-amd64-v1.13.21` |
| `nexusgate-sing-box-linux-arm64` | `~/workspace/nexusgate-release/bin/nexusgate-sing-box-linux-arm64-v1.13.21` |
| `nexusgate-sing-box-stats-linux-amd64` | `~/workspace/nexusgate-release/bin/nexusgate-sing-box-stats-linux-amd64-v1.13.21` |
| `nexusgate-sing-box-stats-linux-arm64` | `~/workspace/nexusgate-release/bin/nexusgate-sing-box-stats-linux-arm64-v1.13.21` |
（`~/workspace/backups/2026-10-20/binaries/` 下有同名镜像副本。）
注：sing-box 预编译下载失败时脚本会自动回退现场源码编译，所以这组 release 缺失不会让装机彻底失败，只是慢；agent 那组缺失则 Go 版 agent 无法新装（Node 回退路径走 raw，不受影响）。
Reference in New Issue View Git Blame Copy Permalink