mirror of
https://github.com/wnlen/clash-for-linux.git
synced 2026-10-10 12:13:04 +08:00
Arvin
346 lines
8.5 KiB
Bash
346 lines
8.5 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
RUNTIME_DIR="$PROJECT_DIR/runtime"
|
|
CONFIG_DIR="$PROJECT_DIR/config"
|
|
LOG_DIR="$PROJECT_DIR/logs"
|
|
|
|
RUNTIME_CONFIG="$RUNTIME_DIR/config.yaml"
|
|
STATE_FILE="$RUNTIME_DIR/state.env"
|
|
|
|
TMP_DOWNLOAD="$RUNTIME_DIR/subscription.raw.yaml"
|
|
TMP_NORMALIZED="$RUNTIME_DIR/subscription.normalized.yaml"
|
|
TMP_PROXY_FRAGMENT="$RUNTIME_DIR/proxy.fragment.yaml"
|
|
TMP_CONFIG="$RUNTIME_DIR/config.yaml.tmp"
|
|
|
|
mkdir -p "$RUNTIME_DIR" "$CONFIG_DIR" "$LOG_DIR"
|
|
|
|
if [ -f "$PROJECT_DIR/.env" ]; then
|
|
# shellcheck disable=SC1091
|
|
source "$PROJECT_DIR/.env"
|
|
fi
|
|
|
|
# shellcheck disable=SC1091
|
|
source "$PROJECT_DIR/scripts/get_cpu_arch.sh"
|
|
# shellcheck disable=SC1091
|
|
source "$PROJECT_DIR/scripts/resolve_clash.sh"
|
|
# shellcheck disable=SC1091
|
|
source "$PROJECT_DIR/scripts/config_utils.sh"
|
|
# shellcheck disable=SC1091
|
|
source "$PROJECT_DIR/scripts/port_utils.sh"
|
|
|
|
CLASH_HTTP_PORT="${CLASH_HTTP_PORT:-7890}"
|
|
CLASH_SOCKS_PORT="${CLASH_SOCKS_PORT:-7891}"
|
|
CLASH_REDIR_PORT="${CLASH_REDIR_PORT:-7892}"
|
|
CLASH_LISTEN_IP="${CLASH_LISTEN_IP:-0.0.0.0}"
|
|
CLASH_ALLOW_LAN="${CLASH_ALLOW_LAN:-false}"
|
|
EXTERNAL_CONTROLLER_ENABLED="${EXTERNAL_CONTROLLER_ENABLED:-true}"
|
|
EXTERNAL_CONTROLLER="${EXTERNAL_CONTROLLER:-127.0.0.1:9090}"
|
|
ALLOW_INSECURE_TLS="${ALLOW_INSECURE_TLS:-false}"
|
|
CLASH_AUTO_UPDATE="${CLASH_AUTO_UPDATE:-true}"
|
|
CLASH_URL="${CLASH_URL:-}"
|
|
|
|
CLASH_HTTP_PORT="$(resolve_port_value "HTTP" "$CLASH_HTTP_PORT")"
|
|
CLASH_SOCKS_PORT="$(resolve_port_value "SOCKS" "$CLASH_SOCKS_PORT")"
|
|
CLASH_REDIR_PORT="$(resolve_port_value "REDIR" "$CLASH_REDIR_PORT")"
|
|
EXTERNAL_CONTROLLER="$(resolve_host_port "External Controller" "$EXTERNAL_CONTROLLER" "127.0.0.1")"
|
|
|
|
trim_value() {
|
|
local s="$1"
|
|
s="${s#"${s%%[![:space:]]*}"}"
|
|
s="${s%"${s##*[![:space:]]}"}"
|
|
printf '%s' "$s"
|
|
}
|
|
|
|
write_state() {
|
|
local status="$1"
|
|
local reason="$2"
|
|
local source="${3:-unknown}"
|
|
|
|
cat > "$STATE_FILE" <<EOF
|
|
LAST_GENERATE_STATUS=$status
|
|
LAST_GENERATE_REASON=$reason
|
|
LAST_CONFIG_SOURCE=$source
|
|
LAST_GENERATE_AT=$(date -Iseconds)
|
|
EOF
|
|
}
|
|
|
|
fail_with_state() {
|
|
local reason="$1"
|
|
local message="$2"
|
|
local source="${3:-none}"
|
|
|
|
write_state "failed" "$reason" "$source"
|
|
echo "[ERROR] $message" >&2
|
|
exit 1
|
|
}
|
|
|
|
write_env_value() {
|
|
local key="$1"
|
|
local value="$2"
|
|
local env_file="$PROJECT_DIR/.env"
|
|
local tmp_file
|
|
|
|
[ -f "$env_file" ] || return 1
|
|
|
|
tmp_file="$(mktemp)"
|
|
|
|
awk -v k="$key" -v v="$value" '
|
|
BEGIN { updated = 0 }
|
|
$0 ~ "^[[:space:]]*(export[[:space:]]+)?" k "=" {
|
|
print "export " k "='\''" v "'\''"
|
|
updated = 1
|
|
next
|
|
}
|
|
{ print }
|
|
END {
|
|
if (!updated) {
|
|
print "export " k "='\''" v "'\''"
|
|
}
|
|
}
|
|
' "$env_file" > "$tmp_file" && mv "$tmp_file" "$env_file"
|
|
}
|
|
|
|
generate_secret() {
|
|
if [ -n "${CLASH_SECRET:-}" ]; then
|
|
echo "$CLASH_SECRET"
|
|
return 0
|
|
fi
|
|
|
|
if [ -s "$RUNTIME_CONFIG" ]; then
|
|
local old_secret
|
|
old_secret="$(sed -nE 's/^[[:space:]]*secret:[[:space:]]*"?([^"#]+)"?.*$/\1/p' "$RUNTIME_CONFIG" | head -n 1)"
|
|
if [ -n "${old_secret:-}" ]; then
|
|
echo "$old_secret"
|
|
return 0
|
|
fi
|
|
fi
|
|
|
|
if command -v openssl >/dev/null 2>&1; then
|
|
openssl rand -base64 24 | tr -dc 'A-Za-z0-9' | head -c 16
|
|
else
|
|
tr -dc 'A-Za-z0-9' </dev/urandom | head -c 16
|
|
fi
|
|
}
|
|
|
|
SECRET="$(generate_secret)"
|
|
write_env_value "CLASH_SECRET" "$SECRET" || true
|
|
|
|
upsert_yaml_kv_local() {
|
|
local file="$1"
|
|
local key="$2"
|
|
local value="$3"
|
|
|
|
[ -f "$file" ] || touch "$file"
|
|
|
|
if grep -qE "^[[:space:]]*${key}:" "$file"; then
|
|
sed -i -E "s|^[[:space:]]*${key}:.*$|${key}: ${value}|g" "$file"
|
|
else
|
|
printf "%s: %s\n" "$key" "$value" >> "$file"
|
|
fi
|
|
}
|
|
|
|
remove_yaml_key_local() {
|
|
local file="$1"
|
|
local key="$2"
|
|
|
|
[ -f "$file" ] || return 0
|
|
sed -i -E "/^[[:space:]]*${key}:/d" "$file"
|
|
}
|
|
|
|
apply_secret_to_config() {
|
|
local file="$1"
|
|
upsert_yaml_kv_local "$file" "secret" "$SECRET"
|
|
}
|
|
|
|
apply_controller_to_config() {
|
|
local file="$1"
|
|
local ui_src="$PROJECT_DIR/ui/dist"
|
|
local ui_dir="$RUNTIME_DIR/ui"
|
|
|
|
if [ "$EXTERNAL_CONTROLLER_ENABLED" = "true" ]; then
|
|
upsert_yaml_kv_local "$file" "external-controller" "$EXTERNAL_CONTROLLER"
|
|
|
|
if [ ! -f "$ui_src/index.html" ]; then
|
|
fail_with_state "ui_missing" "UI 未找到: $ui_src/index.html" "none"
|
|
fi
|
|
|
|
rm -rf "$ui_dir"
|
|
mkdir -p "$ui_dir"
|
|
cp -a "$ui_src/." "$ui_dir/"
|
|
|
|
upsert_yaml_kv_local "$file" "external-ui" "$ui_dir"
|
|
else
|
|
remove_yaml_key_local "$file" "external-controller"
|
|
remove_yaml_key_local "$file" "external-ui"
|
|
fi
|
|
}
|
|
|
|
validate_clash_url() {
|
|
local url="$1"
|
|
|
|
url="$(trim_value "$url")"
|
|
|
|
if [ -z "$url" ]; then
|
|
write_state "failed" "url_empty" "none"
|
|
echo "[ERROR] CLASH_URL 为空" >&2
|
|
return 1
|
|
fi
|
|
|
|
case "$url" in
|
|
http://*|https://*)
|
|
;;
|
|
*)
|
|
write_state "failed" "url_invalid" "none"
|
|
echo "[ERROR] CLASH_URL 格式非法：必须以 http:// 或 https:// 开头" >&2
|
|
return 1
|
|
;;
|
|
esac
|
|
|
|
if [[ "$url" =~ [[:space:]] ]]; then
|
|
write_state "failed" "url_whitespace" "none"
|
|
echo "[ERROR] CLASH_URL 含有空白字符" >&2
|
|
return 1
|
|
fi
|
|
|
|
if [[ "$url" == "-"* ]]; then
|
|
write_state "failed" "url_like_option" "none"
|
|
echo "[ERROR] CLASH_URL 非法：看起来像 curl 参数而不是链接" >&2
|
|
return 1
|
|
fi
|
|
|
|
return 0
|
|
}
|
|
|
|
download_subscription() {
|
|
local url
|
|
url="$(trim_value "${CLASH_URL:-}")"
|
|
|
|
validate_clash_url "$url" || return 1
|
|
|
|
local curl_cmd=(
|
|
curl
|
|
-fL
|
|
-S
|
|
--retry 2
|
|
--connect-timeout 10
|
|
-m 30
|
|
-o "$TMP_DOWNLOAD"
|
|
--
|
|
"$url"
|
|
)
|
|
|
|
if [ "$ALLOW_INSECURE_TLS" = "true" ]; then
|
|
curl_cmd=(
|
|
curl
|
|
-fL
|
|
-S
|
|
--retry 2
|
|
--connect-timeout 10
|
|
-m 30
|
|
-k
|
|
-o "$TMP_DOWNLOAD"
|
|
--
|
|
"$url"
|
|
)
|
|
fi
|
|
|
|
if [ -n "${CLASH_HEADERS:-}" ]; then
|
|
local header
|
|
while IFS= read -r header; do
|
|
header="$(trim_value "$header")"
|
|
[ -n "$header" ] && curl_cmd=("${curl_cmd[@]:0:${#curl_cmd[@]}-2}" -H "$header" -- "$url")
|
|
done < <(printf '%s\n' "$CLASH_HEADERS" | tr ';' '\n')
|
|
fi
|
|
|
|
"${curl_cmd[@]}"
|
|
}
|
|
|
|
is_complete_clash_config() {
|
|
local file="$1"
|
|
grep -qE '^[[:space:]]*(proxies:|proxy-providers:|mixed-port:|port:)' "$file"
|
|
}
|
|
|
|
cleanup_tmp_files() {
|
|
rm -f "$TMP_DOWNLOAD" "$TMP_NORMALIZED" "$TMP_PROXY_FRAGMENT" "$TMP_CONFIG"
|
|
}
|
|
|
|
build_fragment_config() {
|
|
local template_file="$1"
|
|
local target_file="$2"
|
|
|
|
sed -n '/^proxies:/,$p' "$TMP_NORMALIZED" > "$TMP_PROXY_FRAGMENT"
|
|
|
|
cat "$template_file" > "$target_file"
|
|
cat "$TMP_PROXY_FRAGMENT" >> "$target_file"
|
|
|
|
sed -i "s/CLASH_HTTP_PORT_PLACEHOLDER/${CLASH_HTTP_PORT}/g" "$target_file"
|
|
sed -i "s/CLASH_SOCKS_PORT_PLACEHOLDER/${CLASH_SOCKS_PORT}/g" "$target_file"
|
|
sed -i "s/CLASH_REDIR_PORT_PLACEHOLDER/${CLASH_REDIR_PORT}/g" "$target_file"
|
|
sed -i "s/CLASH_LISTEN_IP_PLACEHOLDER/${CLASH_LISTEN_IP}/g" "$target_file"
|
|
sed -i "s/CLASH_ALLOW_LAN_PLACEHOLDER/${CLASH_ALLOW_LAN}/g" "$target_file"
|
|
}
|
|
|
|
finalize_config() {
|
|
local file="$1"
|
|
mv -f "$file" "$RUNTIME_CONFIG"
|
|
}
|
|
|
|
main() {
|
|
local template_file="$CONFIG_DIR/template.yaml"
|
|
|
|
if [ "$CLASH_AUTO_UPDATE" != "true" ]; then
|
|
if [ -s "$RUNTIME_CONFIG" ]; then
|
|
write_state "success" "auto_update_disabled_keep_runtime" "runtime_existing"
|
|
exit 0
|
|
fi
|
|
|
|
fail_with_state "runtime_missing" "已关闭自动更新，且运行配置缺失: $RUNTIME_CONFIG" "none"
|
|
fi
|
|
|
|
CLASH_URL="$(trim_value "${CLASH_URL:-}")"
|
|
|
|
if ! validate_clash_url "$CLASH_URL"; then
|
|
exit 1
|
|
fi
|
|
|
|
if ! download_subscription; then
|
|
write_state "failed" "download_failed" "none"
|
|
echo "[ERROR] 下载订阅失败" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -s "$TMP_DOWNLOAD" ]; then
|
|
fail_with_state "subscription_empty" "订阅下载成功但内容为空" "none"
|
|
fi
|
|
|
|
cp -f "$TMP_DOWNLOAD" "$TMP_NORMALIZED"
|
|
|
|
if is_complete_clash_config "$TMP_NORMALIZED"; then
|
|
cp -f "$TMP_NORMALIZED" "$TMP_CONFIG"
|
|
apply_controller_to_config "$TMP_CONFIG"
|
|
apply_secret_to_config "$TMP_CONFIG"
|
|
finalize_config "$TMP_CONFIG"
|
|
write_state "success" "subscription_full" "subscription_full"
|
|
exit 0
|
|
fi
|
|
|
|
if ! grep -qE '^[[:space:]]*proxies:' "$TMP_NORMALIZED"; then
|
|
fail_with_state "subscription_invalid" "订阅不可用或转换失败" "none"
|
|
fi
|
|
|
|
if [ ! -s "$template_file" ]; then
|
|
fail_with_state "missing_template" "缺少模板配置文件: $template_file" "none"
|
|
fi
|
|
|
|
build_fragment_config "$template_file" "$TMP_CONFIG"
|
|
apply_controller_to_config "$TMP_CONFIG"
|
|
apply_secret_to_config "$TMP_CONFIG"
|
|
finalize_config "$TMP_CONFIG"
|
|
|
|
write_state "success" "subscription_fragment_merged" "subscription_fragment"
|
|
}
|
|
|
|
trap cleanup_tmp_files EXIT
|
|
main "$@" |