mirror of
https://gitee.com/xmz7891/ykxmz.git
synced 2026-10-18 10:10:43 +00:00
xmz7891
b62ac865ea
被控端 - 修复 MTU 问题：夹 MSS + 路径 MTU 探测（公网可用率 48% -> 100%） - 复用 HTTP 连接（免掉每次新建 TLS 的 30% 握手失败） - 每分钟回头找局域网，自动切回快 400 倍的路径 - 画面心跳帧：静止时省流量，客户端仍知道流是活的 - 锁屏时给出可操作的提示 手表端 - 内置 GTS Root R4 / GlobalSign Root CA，修 SSLHandshakeException - 连接错误翻译成人话（证书/时间/解析/超时分别提示） - 经中转连上后用服务器报的地址刷新已配对记录 - 新增局域网连接页面、服务器延迟检测 服务器端 - 支持 chunked 请求体（修每 16 秒一次的连接错乱与大面积 502） - 网络调优脚本 net-tune.sh（开机自动应用） - 管理页：批量删除、网络体检、下载区 - 隧道改 HTTP/2 + 双连接 文档 - 许可协议 / 安装前必读 / 安装后须知（作者：小麦子）
170 lines
5.2 KiB
Bash
170 lines
5.2 KiB
Bash
#!/bin/bash
|
||
# 建具名隧道（固定域名），替换掉会变地址的匿名隧道。
|
||
#
|
||
# 前提：已经 cloudflared tunnel login 授权过（/root/.cloudflared/cert.pem 存在）
|
||
#
|
||
# 做的事：
|
||
# 1. 建一个叫 lanremote 的隧道
|
||
# 2. 把 relay.<域名> 指到它
|
||
# 3. 写隧道配置（指向本机 8080）
|
||
# 4. 改 systemd 服务，改成跑具名隧道
|
||
# 5. 重启并验证
|
||
#
|
||
# 具名隧道的好处（对比匿名）：
|
||
# * 地址固定，不用每次重启都改客户端配置
|
||
# * 不受匿名隧道限流（实测匿名隧道经常 context deadline exceeded）
|
||
# * Cloudflare 官方支持的生产用法
|
||
set -u
|
||
|
||
DOMAIN="${1:-xxmxxs.top}"
|
||
HOSTNAME_FULL="${2:-relay.${DOMAIN}}"
|
||
TUNNEL_NAME=lanremote
|
||
CF_DIR=/root/.cloudflared
|
||
RELAY_DIR=/root/lanremote-relay
|
||
CONF="$CF_DIR/config.yml"
|
||
|
||
echo "============================================================"
|
||
echo " 建具名隧道：$TUNNEL_NAME 域名：$HOSTNAME_FULL"
|
||
echo "============================================================"
|
||
echo
|
||
|
||
# ---------- 0. 检查授权 ----------
|
||
echo "[0/6] 检查授权"
|
||
if [ ! -f "$CF_DIR/cert.pem" ]; then
|
||
echo " ✗ 还没有 cert.pem —— 请先在浏览器里完成授权"
|
||
echo " 链接： $(cat /root/cf_login_url.txt 2>/dev/null)"
|
||
exit 1
|
||
fi
|
||
echo " ✓ cert.pem 存在"
|
||
|
||
# ---------- 1. 建隧道 ----------
|
||
echo
|
||
echo "[1/6] 创建隧道"
|
||
EXISTING=$(cloudflared tunnel list 2>/dev/null | awk -v n="$TUNNEL_NAME" '$2 == n {print $1}')
|
||
if [ -n "$EXISTING" ]; then
|
||
TUNNEL_ID="$EXISTING"
|
||
echo " 已存在，ID: $TUNNEL_ID"
|
||
else
|
||
OUT=$(cloudflared tunnel create "$TUNNEL_NAME" 2>&1)
|
||
echo "$OUT" | sed 's/^/ /'
|
||
TUNNEL_ID=$(echo "$OUT" | grep -oE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | head -1)
|
||
if [ -z "$TUNNEL_ID" ]; then
|
||
TUNNEL_ID=$(cloudflared tunnel list 2>/dev/null | awk -v n="$TUNNEL_NAME" '$2 == n {print $1}')
|
||
fi
|
||
fi
|
||
if [ -z "$TUNNEL_ID" ]; then
|
||
echo " ✗ 拿不到隧道 ID"
|
||
exit 1
|
||
fi
|
||
echo " 隧道 ID: $TUNNEL_ID"
|
||
|
||
# ---------- 2. 凭据文件 ----------
|
||
echo
|
||
echo "[2/6] 检查凭据文件"
|
||
CRED="$CF_DIR/${TUNNEL_ID}.json"
|
||
if [ ! -f "$CRED" ]; then
|
||
echo " ✗ 找不到凭据 $CRED"
|
||
ls -la "$CF_DIR"
|
||
exit 1
|
||
fi
|
||
echo " ✓ $CRED"
|
||
|
||
# ---------- 3. 配 DNS ----------
|
||
echo
|
||
echo "[3/6] 把 $HOSTNAME_FULL 指向这个隧道"
|
||
DNS_OUT=$(cloudflared tunnel route dns "$TUNNEL_NAME" "$HOSTNAME_FULL" 2>&1)
|
||
echo "$DNS_OUT" | sed 's/^/ /'
|
||
if echo "$DNS_OUT" | grep -qi 'already exists'; then
|
||
echo " (DNS 记录已存在，跳过)"
|
||
fi
|
||
|
||
# ---------- 4. 写配置 ----------
|
||
echo
|
||
echo "[4/6] 写隧道配置"
|
||
cat > "$CONF" <<EOF
|
||
# 局域网遥控 · 具名隧道配置
|
||
tunnel: $TUNNEL_ID
|
||
credentials-file: $CRED
|
||
|
||
ingress:
|
||
- hostname: $HOSTNAME_FULL
|
||
service: http://127.0.0.1:8080
|
||
originRequest:
|
||
# 长轮询每个请求挂 25 秒，超时要给够
|
||
connectTimeout: 30s
|
||
# 中转是流式响应，关掉缓冲
|
||
noTLSVerify: false
|
||
disableChunkedEncoding: false
|
||
- service: http_status:404
|
||
EOF
|
||
echo " 已写 $CONF"
|
||
cat "$CONF" | sed 's/^/ /'
|
||
|
||
# ---------- 5. 改 systemd ----------
|
||
echo
|
||
echo "[5/6] 改 systemd 服务为具名隧道"
|
||
cat > /etc/systemd/system/lanremote-tunnel.service <<EOF
|
||
[Unit]
|
||
Description=LanRemote Cloudflare 具名隧道
|
||
After=network-online.target lanremote-relay.service
|
||
Wants=network-online.target
|
||
Requires=lanremote-relay.service
|
||
|
||
[Service]
|
||
Type=simple
|
||
# 具名隧道：地址固定为 $HOSTNAME_FULL
|
||
# 仍然强制 IPv4 —— 这条 4G 线路有 IPv6 地址但实际不通
|
||
ExecStart=/usr/local/bin/cloudflared tunnel --no-autoupdate --edge-ip-version 4 --config $CONF run $TUNNEL_NAME
|
||
Restart=always
|
||
RestartSec=5
|
||
MemoryMax=128M
|
||
StandardOutput=append:$RELAY_DIR/tunnel.log
|
||
StandardError=append:$RELAY_DIR/tunnel.log
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
EOF
|
||
systemctl daemon-reload
|
||
systemctl stop lanremote-tunnel 2>/dev/null || true
|
||
pkill -f 'cloudflared tunnel --no-autoupdate' 2>/dev/null || true
|
||
sleep 2
|
||
rm -f "$RELAY_DIR/tunnel.log"
|
||
systemctl start lanremote-tunnel
|
||
echo " 已启动"
|
||
|
||
# ---------- 6. 验证 ----------
|
||
echo
|
||
echo "[6/6] 等着并验证"
|
||
# 一定要带 https:// —— public_url() 只认以 http 开头的，
|
||
# 少了协议头 /url 接口会显示"还没有地址"。
|
||
echo "https://$HOSTNAME_FULL" > "$RELAY_DIR/public_url.txt"
|
||
sleep 12
|
||
|
||
for i in 1 2 3 4 5 6; do
|
||
CODE=$(curl -s -o /dev/null -w '%{http_code}' --max-time 15 \
|
||
"https://$HOSTNAME_FULL/v1/health")
|
||
if [ "$CODE" = "200" ]; then
|
||
echo " 第 $i 次: ✓ 通了"
|
||
break
|
||
fi
|
||
echo " 第 $i 次: HTTP $CODE（隧道可能还在建）"
|
||
sleep 8
|
||
done
|
||
|
||
echo
|
||
echo " 服务状态: $(systemctl is-active lanremote-tunnel)"
|
||
echo " 隧道日志尾部:"
|
||
tail -5 "$RELAY_DIR/tunnel.log" | sed 's/^/ /'
|
||
|
||
echo
|
||
echo "============================================================"
|
||
echo " 公网地址（固定，不会再变）："
|
||
echo " https://$HOSTNAME_FULL"
|
||
echo " 管理页："
|
||
echo " https://$HOSTNAME_FULL/?key=\$(cat $RELAY_DIR/data/admin_key.txt)"
|
||
echo "============================================================"
|
||
echo
|
||
echo " 接下来在被控端执行一次："
|
||
echo " LanRemote-Agent.exe --relay https://$HOSTNAME_FULL"
|
||
echo " 手表首页「中转设置」里填同一个地址。"
|