${escapeHTML(text)}${escapeHTML(key.fingerprint)}
${codeBlock(`key-${i}`,key.text,`复制第 ${i + 1} 个公钥`)}此版本明确撤销全部受管理公钥，手工管理的公钥仍保留。
'; +} +export function renderCommands(commands) { + const card = command => `${escapeHTML(command.description)}
${codeBlock(`command-${command.id}`,command.command,`复制“${command.title}”命令`)}测试预览：这里使用公开测试密钥，不能部署到真实服务器。
' : '', + SOURCE_LABEL:escapeHTML(sourceLabel),SOURCE_STATUS:escapeHTML(sourceStatus),CONTENT_REVISION:escapeHTML(snapshot.sha256?.slice(0,12) || '—'),KEYS_NOTICE:escapeHTML(notice), + }; + return template.replace(/@@([A-Z_]+)@@/g, (_, token) => { + if (!Object.hasOwn(replacements, token)) throw Error(`Unresolved page template token: ${token}`); + return replacements[token]; + }); +} diff --git a/cf-worker/wrangler.toml b/cf-worker/wrangler.toml index 956a932..a4e8405 100644 --- a/cf-worker/wrangler.toml +++ b/cf-worker/wrangler.toml @@ -1,3 +1,8 @@ name = "quickly-conf-ssh-worker" main = "src/index.js" -compatibility_date = "2023-01-26" +compatibility_date = "2026-10-01" + +[assets] +directory = "./public" +binding = "ASSETS" +run_worker_first = true diff --git a/conf-sshd.sh b/conf-sshd.sh index d55c80f..7f43f4e 100755 --- a/conf-sshd.sh +++ b/conf-sshd.sh @@ -1,323 +1,487 @@ -#!/bin/bash -set -e -set -o pipefail +#!/bin/sh +# conf-sshd-script-v2 +# Generated configuration. Never source or eval downloaded data. +BASE_URL='@@BASE_URL@@' +DEFAULT_CRON='@@DEFAULT_CRON@@' -########## 一些配置 ########## +set -eu +umask 077 +LC_ALL=C +export LC_ALL +BEGIN_KEYS='# --- BEGIN MANAGED BY CONF-SSHD SCRIPT ---' +END_KEYS='# --- END MANAGED BY CONF-SSHD SCRIPT ---' +BEGIN_CRON='# --- BEGIN CRON MANAGED BY CONF-SSHD SCRIPT ---' +END_CRON='# --- END CRON MANAGED BY CONF-SSHD SCRIPT ---' +mode=sync +cron_requested=no +cron_value= +dry_run=no +no_install=no +root_password= +temps= +lock_owned=no +created_state=no +created_ssh=no -# 默认获取 SSH key 的地方，一般是 Github. -sshkey_url="{{ SSH_KEY_URL }}" -# 默认的 Cron 执行计划, 每天凌晨 0 点执行 -default_cron="{{ DEFAULT_CRON }}" -# 脚本 Url -script_url="{{ SCRIPT_URL }}" +say() { printf '%s\n' "$*"; } +fail() { printf 'conf-sshd: %s\n' "$*" >&2; exit 1; } +usage() { + cat <<'HELP' +Usage: sh conf-sshd.sh [options] + (no options), -o, --only-update-keys Validate and sync managed public keys only + -c, --cron ["five fields"|false] Sync and schedule; bare -c keeps an existing + schedule, otherwise every 15 minutes. + -c false only removes this script's schedule. + -u, --update-self Explicitly update the installed script only + --uninstall Remove own schedule/script; preserve keys/config + -p, --allow-root-passwd yes|no Explicit root-only sshd_config edit; never reload + -n, --no-install-sshd Compatibility flag; packages are never installed + --dry-run Validate and show changes without applying them + --status Show local installation and schedule status + -h, --help Show this help -############ 脚本区 ########## - -script_params=("$@") -has_param() { - for param in "${script_params[@]}"; do - for tParam in "$@"; do - if [ "$tParam" == "$param" ]; then - echo "true" - return - fi - done - done - echo "false" +-u, --uninstall, -p and --status are exclusive operations. -o cannot use -c or -p. +Requires curl, ssh-keygen, awk, standard POSIX tools, mktemp, stat, and one of +sha256sum, shasum or openssl. Scheduling also requires crontab. Downloads require +HTTPS; existing keys survive any validation/download failure. +No SSH service is installed, restarted, or reloaded. Keep recovery access ready. +The payload SHA-256 detects inconsistency; trust comes from HTTPS and its source. +HELP } - -get_param_value() { - local find=false - for param in "${script_params[@]}"; do - if [ "$find" == "true" ]; then - if [[ $param == -* ]]; then - return - fi - - echo "$param" - return - fi - for tParam in "$@"; do - if [ "$tParam" == "$param" ]; then - find=true - break - fi - done - done +select_mode() { + [ "$mode" = sync ] || fail 'Conflicting or duplicate operation options.' + mode=$1 } +while [ "$#" -gt 0 ]; do + case $1 in + -h|--help) [ "$#" -eq 1 ] && [ "$mode" = sync ] && [ "$cron_requested" = no ] || fail '--help must be used alone.'; usage; exit 0 ;; + -o|--only-update-keys) select_mode keys ;; + -u|--update-self) select_mode update ;; + --uninstall) select_mode uninstall ;; + --status) select_mode status ;; + -p|--allow-root-passwd) + select_mode config + [ "$#" -ge 2 ] || fail '-p requires yes or no.' + shift; case $1 in yes|no) root_password=$1 ;; *) fail '-p requires yes or no.' ;; esac ;; + -c|--cron) + [ "$cron_requested" = no ] || fail 'Duplicate -c option.' + cron_requested=yes + if [ "$#" -gt 1 ]; then + case $2 in -*) : ;; *) shift; cron_value=$1; [ -n "$cron_value" ] || fail 'Empty cron expression.' ;; esac + fi ;; + --dry-run) [ "$dry_run" = no ] || fail 'Duplicate --dry-run.'; dry_run=yes ;; + -n|--no-install-sshd) [ "$no_install" = no ] || fail 'Duplicate -n.'; no_install=yes ;; + *) fail "Unknown option or unexpected argument: $1" ;; + esac + shift +done +[ "$cron_requested" = no ] || [ "$mode" = sync ] || fail '-c cannot be combined with this operation.' -# 帮助信息. -if [ "$(has_param "-h" "--help")" == "true" ]; then - echo "Usage: $0 [options]" - echo "Options:" - echo " -h, --help Print this help message." - echo "" - echo "Available to any user: " - echo " -c, --cron \"01 / PUBLIC KEYS
部署前，请核对指纹及密钥归属。
@@KEYS_NOTICE@@
+这里展示的是公开密钥。私钥应始终由你保管，本页面不会要求上传或输入私钥。
02 / QUICK START
以下命令会在你执行后修改服务器配置。请先检查脚本，并保留当前 SSH 会话以验证新连接。
每条命令独立使用。高级选项涉及 SSH 登录策略或卸载，请阅读说明后操作。
+