windy/vps - vps - windy git

107 Commits 5 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
windyboy	7ec29627fb	docs(us4): sing-box :6443 代理 + 根盘回收 91%→43% (Plane VPS-99/100) 新增独立 HTTPS forward proxy：Traefik 新 entrypoint proxyin(:6443) 终止 TLS，后端 sing-box（HTTP inbound + users 认证 + direct 出站），与既有 :443 nghttpx/squid 链路并存。宿主机只新增 6443/tcp；容器不发布 host 端口。新增 compose/sing-box/（镜像 digest 钉版）与两份 runbook： - proxy-health.md：:443/:6443 只读健康检查，含开放代理负向测试 - proxy-client-setup.md：curl / env / 浏览器扩展配置与三类失败排查（407 无认证头、页面加载不全=CDN 域名漏配、urllib/wget 不支持 TLS-to-proxy）同批根盘回收 91%→43%（约 14G）：rust/node/.go/podman 孤儿存储/apt/journal/ 未用镜像/容器日志；journald 加 SystemMaxUse=200M；nghttpx+squid+traefik 加 json-file 轮转 10m×3；删除 ~/.cargo 后修好 zshenv/bashrc/profile 的失效 source。验证：:6443 LE 证书、匿名 407、CONNECT 与绝对 URI 均返回 185.201.226.122； us4-gate 401 / update 200 / trlm 302；8 容器全部 Up；validate-repo.sh PASS。	2026-09-26 10:34:09 +08:00
windyboy	1f6d028ab5	feat(us4): firewall audit + safe reconciliation playbook, host doc Add playbooks/us4-firewalld.yml, a narrow reconciliation of the audited us4 public zone: fails closed on drift or unknown allowances, never reloads or restarts firewalld, and does not manage Docker rules. Requires explicit apply + provider-console confirmations, backs up the firewalld config and ruleset, schedules an automatic 15-minute rollback via at, and verifies SSH, HTTPS routes, containers, Fail2ban jails, and the WireGuard health check before cancelling rollback. Pins ansible.posix 2.2.2 in requirements.yml. Also expand hosts/us4.wsvc.info.md with deployment config and a live audit snapshot (2026-08-12).	2026-08-12 21:16:31 +08:00
windyboy	29bdf06383	Document network operations and WireGuard maintenance	2026-08-06 10:20:43 +08:00

Author

SHA1

Message

Date

windyboy

7ec29627fb

docs(us4): sing-box :6443 代理 + 根盘回收 91%→43% (Plane VPS-99/100)

新增独立 HTTPS forward proxy：Traefik 新 entrypoint proxyin(:6443) 终止 TLS，
后端 sing-box（HTTP inbound + users 认证 + direct 出站），与既有 :443
nghttpx/squid 链路并存。宿主机只新增 6443/tcp；容器不发布 host 端口。

新增 compose/sing-box/（镜像 digest 钉版）与两份 runbook：
- proxy-health.md：:443/:6443 只读健康检查，含开放代理负向测试
- proxy-client-setup.md：curl / env / 浏览器扩展配置与三类失败排查
  （407 无认证头、页面加载不全=CDN 域名漏配、urllib/wget 不支持 TLS-to-proxy）

同批根盘回收 91%→43%（约 14G）：rust/node/.go/podman 孤儿存储/apt/journal/
未用镜像/容器日志；journald 加 SystemMaxUse=200M；nghttpx+squid+traefik 加
json-file 轮转 10m×3；删除 ~/.cargo 后修好 zshenv/bashrc/profile 的失效 source。

验证：:6443 LE 证书、匿名 407、CONNECT 与绝对 URI 均返回 185.201.226.122；
us4-gate 401 / update 200 / trlm 302；8 容器全部 Up；validate-repo.sh PASS。

2026-09-26 10:34:09 +08:00

windyboy

1f6d028ab5

feat(us4): firewall audit + safe reconciliation playbook, host doc

Add playbooks/us4-firewalld.yml, a narrow reconciliation of the audited us4
public zone: fails closed on drift or unknown allowances, never reloads or
restarts firewalld, and does not manage Docker rules. Requires explicit
apply + provider-console confirmations, backs up the firewalld config and
ruleset, schedules an automatic 15-minute rollback via at, and verifies SSH,
HTTPS routes, containers, Fail2ban jails, and the WireGuard health check before
cancelling rollback. Pins ansible.posix 2.2.2 in requirements.yml.

Also expand hosts/us4.wsvc.info.md with deployment config and a live audit
snapshot (2026-08-12).

2026-08-12 21:16:31 +08:00

windyboy

29bdf06383

Document network operations and WireGuard maintenance

2026-08-06 10:20:43 +08:00