init xboard node
This commit is contained in:
xboard
@@ -0,0 +1,874 @@
|
||||
package service
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/sha256"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"math"
|
||||
"sort"
|
||||
"time"
|
||||
|
||||
"github.com/cedar2025/xboard-node/internal/cert"
|
||||
"github.com/cedar2025/xboard-node/internal/config"
|
||||
"github.com/cedar2025/xboard-node/internal/kernel"
|
||||
"github.com/cedar2025/xboard-node/internal/kernel/singbox"
|
||||
"github.com/cedar2025/xboard-node/internal/kernel/xray"
|
||||
"github.com/cedar2025/xboard-node/internal/limiter"
|
||||
"github.com/cedar2025/xboard-node/internal/monitor"
|
||||
"github.com/cedar2025/xboard-node/internal/panel"
|
||||
"github.com/cedar2025/xboard-node/internal/tracker"
|
||||
)
|
||||
|
||||
type Service struct {
|
||||
cfg *config.Config
|
||||
panel *panel.Client
|
||||
kernel kernel.Kernel
|
||||
tracker *tracker.Tracker
|
||||
limiter *limiter.Limiter
|
||||
speedTracker *limiter.SpeedTracker
|
||||
cert *cert.Manager
|
||||
|
||||
lastConfig *panel.NodeConfig
|
||||
lastUsers []panel.User
|
||||
|
||||
lastAppliedPort int // the port currently bound by the kernel
|
||||
lastAppliedIP string // the listen IP currently bound by the kernel
|
||||
|
||||
pushInterval int // seconds
|
||||
pullInterval int // seconds
|
||||
|
||||
lastUserHash string // hash of user list for change detection
|
||||
lastConfigHash string // hash of full config for change detection
|
||||
pullBackoff apiBackoff // backoff for panel pull failures
|
||||
pushBackoff apiBackoff // backoff for panel push failures
|
||||
|
||||
wsClient *panel.WSClient // WebSocket client (nil if WS not enabled)
|
||||
wsEvents chan panel.WSEvent // receives data events from WS client
|
||||
wsStatusCh chan panel.WSStatusChange // receives WS connect/disconnect notifications
|
||||
wsCancel context.CancelFunc // cancels the WS client goroutine
|
||||
wsDisconnectAt time.Time // when WS last disconnected (zero if connected)
|
||||
}
|
||||
|
||||
// apiBackoff implements simple exponential backoff for API failures.
|
||||
type apiBackoff struct {
|
||||
skipRemaining int
|
||||
}
|
||||
|
||||
func (b *apiBackoff) shouldSkip() bool {
|
||||
if b.skipRemaining > 0 {
|
||||
b.skipRemaining--
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func (b *apiBackoff) onSuccess() { b.skipRemaining = 0 }
|
||||
func (b *apiBackoff) onFailure() {
|
||||
if b.skipRemaining <= 0 {
|
||||
b.skipRemaining = 1
|
||||
} else if b.skipRemaining < 8 {
|
||||
b.skipRemaining *= 2
|
||||
}
|
||||
}
|
||||
|
||||
func New(cfg *config.Config) *Service {
|
||||
panelClient := panel.NewClient(cfg.Panel)
|
||||
certMgr := cert.NewManager(cfg.Cert)
|
||||
|
||||
var k kernel.Kernel
|
||||
switch cfg.Kernel.Type {
|
||||
case "singbox":
|
||||
k = singbox.New(cfg.Kernel)
|
||||
case "xray":
|
||||
k = xray.New(cfg.Kernel)
|
||||
default:
|
||||
slog.Error("unsupported kernel type, defaulting to sing-box", "type", cfg.Kernel.Type)
|
||||
k = singbox.New(cfg.Kernel)
|
||||
}
|
||||
|
||||
l := limiter.New()
|
||||
st := limiter.NewSpeedTracker(l)
|
||||
|
||||
return &Service{
|
||||
cfg: cfg,
|
||||
panel: panelClient,
|
||||
kernel: k,
|
||||
tracker: tracker.New(),
|
||||
limiter: l,
|
||||
speedTracker: st,
|
||||
cert: certMgr,
|
||||
wsEvents: make(chan panel.WSEvent, 16),
|
||||
wsStatusCh: make(chan panel.WSStatusChange, 4),
|
||||
}
|
||||
}
|
||||
|
||||
func (s *Service) Run(ctx context.Context) error {
|
||||
// Start cert manager (handles auto-TLS or manual cert verification)
|
||||
if err := s.cert.Start(ctx); err != nil {
|
||||
return fmt.Errorf("cert manager: %w", err)
|
||||
}
|
||||
defer s.cert.Stop()
|
||||
|
||||
// Handshake: get WS config + initial data in one call
|
||||
if err := s.initialSetup(ctx); err != nil {
|
||||
return fmt.Errorf("initial setup: %w", err)
|
||||
}
|
||||
defer s.kernel.Stop()
|
||||
|
||||
// Set up tickers
|
||||
trackTicker := time.NewTicker(10 * time.Second)
|
||||
pushInterval := time.Duration(math.Max(float64(s.pushInterval), 5)) * time.Second
|
||||
pullInterval := time.Duration(s.pullInterval) * time.Second
|
||||
reportTicker := time.NewTicker(pushInterval)
|
||||
pullTicker := time.NewTicker(pullInterval)
|
||||
|
||||
// WS discovery: when in REST-only mode, periodically re-handshake to check
|
||||
// if WS has been enabled. When WS is disconnected for too long, re-check
|
||||
// if it's still available.
|
||||
wsDiscoveryTicker := time.NewTicker(5 * time.Minute)
|
||||
|
||||
defer trackTicker.Stop()
|
||||
defer reportTicker.Stop()
|
||||
defer pullTicker.Stop()
|
||||
defer wsDiscoveryTicker.Stop()
|
||||
|
||||
s.startWSClient(ctx)
|
||||
|
||||
sMode := "disabled"
|
||||
if s.wsClient != nil {
|
||||
sMode = "connecting"
|
||||
}
|
||||
slog.Info("service started",
|
||||
"kernel", s.kernel.Name(),
|
||||
"push_interval", s.pushInterval,
|
||||
"pull_interval", s.pullInterval,
|
||||
"websocket", sMode,
|
||||
)
|
||||
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
slog.Info("service shutting down")
|
||||
s.pushReport()
|
||||
return nil
|
||||
|
||||
case <-trackTicker.C:
|
||||
s.trackAndEnforce(ctx)
|
||||
|
||||
case <-reportTicker.C:
|
||||
s.pushReport()
|
||||
|
||||
case <-pullTicker.C:
|
||||
// When WebSocket is connected, skip REST polling entirely.
|
||||
// Config/user updates arrive via WS push.
|
||||
if s.wsClient != nil && s.wsClient.IsConnected() {
|
||||
slog.Debug("ws connected, skipping REST pull")
|
||||
continue
|
||||
}
|
||||
slog.Info("ws not connected or disabled, polling from API")
|
||||
s.pullViaAPI(ctx)
|
||||
|
||||
case <-wsDiscoveryTicker.C:
|
||||
s.wsDiscovery(ctx)
|
||||
|
||||
case status := <-s.wsStatusCh:
|
||||
s.handleWSStatus(ctx, status)
|
||||
|
||||
case event := <-s.wsEvents:
|
||||
s.handleWSEvent(ctx, event)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (s *Service) initialSetup(ctx context.Context) error {
|
||||
// Register speed limit lookup with kernel unconditionally (before WS/V1 branch).
|
||||
// This ensures speedLimitFunc is set regardless of which code path applies config.
|
||||
s.kernel.SetSpeedLimitFunc(s.speedTracker.GetLimiter)
|
||||
|
||||
slog.Info("performing handshake with panel")
|
||||
|
||||
var hs *panel.HandshakeResponse
|
||||
var err error
|
||||
|
||||
// Retry loop for initial handshake
|
||||
for attempt := 1; ; attempt++ {
|
||||
hs, err = s.panel.Handshake()
|
||||
if err != nil {
|
||||
slog.Error("handshake failed", "attempt", attempt, "error", err)
|
||||
if attempt >= 5 {
|
||||
return fmt.Errorf("handshake failed after %d attempts: %w", attempt, err)
|
||||
}
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return ctx.Err()
|
||||
case <-time.After(time.Duration(attempt*5) * time.Second):
|
||||
continue
|
||||
}
|
||||
}
|
||||
break
|
||||
}
|
||||
|
||||
// Apply settings from panel handshake (Handshake provides default intervals)
|
||||
if s.cfg.Node.PushInterval == 0 && hs.Settings.PushInterval > 0 {
|
||||
s.pushInterval = hs.Settings.PushInterval
|
||||
} else {
|
||||
s.pushInterval = s.cfg.Node.PushInterval
|
||||
}
|
||||
if s.pushInterval == 0 {
|
||||
s.pushInterval = 60
|
||||
}
|
||||
|
||||
if s.cfg.Node.PullInterval == 0 && hs.Settings.PullInterval > 0 {
|
||||
s.pullInterval = hs.Settings.PullInterval
|
||||
} else {
|
||||
s.pullInterval = s.cfg.Node.PullInterval
|
||||
}
|
||||
if s.pullInterval == 0 {
|
||||
s.pullInterval = 60
|
||||
}
|
||||
|
||||
// If WebSocket is enabled, skip initial V1 APIs fetch and wait for推送
|
||||
if hs.WebSocket.Enabled && hs.WebSocket.WSURL != "" {
|
||||
s.wsClient = s.newWSClient(hs.WebSocket.WSURL)
|
||||
slog.Info("handshake complete (websocket enabled), waiting for data push...",
|
||||
"ws_url", hs.WebSocket.WSURL,
|
||||
)
|
||||
return nil
|
||||
}
|
||||
|
||||
// Falls back to V1 APIs only if WebSocket is disabled in panel
|
||||
slog.Info("websocket disabled or missing, falling back to V1 APIs")
|
||||
|
||||
// Fetch initial config and users via V1 APIs
|
||||
nodeConfig, err := s.panel.GetConfig()
|
||||
if err != nil {
|
||||
return fmt.Errorf("initial config fetch: %w", err)
|
||||
}
|
||||
if nodeConfig == nil {
|
||||
return fmt.Errorf("initial config is nil")
|
||||
}
|
||||
|
||||
users, err := s.panel.GetUsers()
|
||||
if err != nil {
|
||||
return fmt.Errorf("initial user fetch: %w", err)
|
||||
}
|
||||
|
||||
// Apply initial data
|
||||
s.lastConfig = nodeConfig
|
||||
s.lastUsers = users
|
||||
s.lastUserHash = computeUserHash(users)
|
||||
s.lastConfigHash = computeConfigHash(nodeConfig)
|
||||
s.limiter.UpdateUsers(users)
|
||||
s.speedTracker.UpdateBuckets()
|
||||
|
||||
slog.Info("handshake complete (V1 fallback)",
|
||||
"protocol", nodeConfig.Protocol,
|
||||
"port", nodeConfig.ServerPort,
|
||||
"users", len(users),
|
||||
)
|
||||
|
||||
if len(users) == 0 {
|
||||
slog.Warn("no users, kernel will not start until users are available")
|
||||
return nil
|
||||
}
|
||||
|
||||
// Update service-level config overrides from remote NodeConfig if present
|
||||
s.applyRemoteOverrides(ctx, nodeConfig)
|
||||
|
||||
s.lastAppliedPort = nodeConfig.ServerPort
|
||||
s.lastAppliedIP = nodeConfig.ListenIP
|
||||
|
||||
certFile, keyFile := s.cert.CertFile(), s.cert.KeyFile()
|
||||
if err := s.kernel.ApplyConfig(nodeConfig, users, certFile, keyFile); err != nil {
|
||||
return fmt.Errorf("apply config: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// applyRemoteOverrides updates service-level settings (log level, cert config)
|
||||
// from the panel's NodeConfig. Returns true if cert paths changed (kernel restart needed).
|
||||
func (s *Service) applyRemoteOverrides(ctx context.Context, nc *panel.NodeConfig) bool {
|
||||
if nc == nil {
|
||||
return false
|
||||
}
|
||||
|
||||
// Dynamic Log Level (Kernel)
|
||||
if nc.KernelLogLevel != "" && nc.KernelLogLevel != s.cfg.Kernel.LogLevel {
|
||||
slog.Info("cert: kernel log level override", "old", s.cfg.Kernel.LogLevel, "new", nc.KernelLogLevel)
|
||||
s.cfg.Kernel.LogLevel = nc.KernelLogLevel
|
||||
}
|
||||
|
||||
// Certificate configuration from panel (panel-first: takes precedence over local config)
|
||||
if nc.CertConfig != nil {
|
||||
return s.applyPanelCert(ctx, nc.CertConfig)
|
||||
}
|
||||
|
||||
// Legacy fields (deprecated: prefer cert_config)
|
||||
if nc.AutoTLS != s.cfg.Cert.AutoTLS {
|
||||
slog.Info("cert: auto_tls policy changed (deprecated field)", "new", nc.AutoTLS)
|
||||
s.cfg.Cert.AutoTLS = nc.AutoTLS
|
||||
}
|
||||
if nc.Domain != "" && nc.Domain != s.cfg.Cert.Domain {
|
||||
s.cfg.Cert.Domain = nc.Domain
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
// applyPanelCert converts a panel CertConfig into the local config format and
|
||||
// reconfigures the cert manager. Reports whether cert paths changed.
|
||||
func (s *Service) applyPanelCert(ctx context.Context, pc *panel.CertConfig) bool {
|
||||
newCfg := config.CertConfig{
|
||||
CertMode: pc.CertMode,
|
||||
Domain: pc.Domain,
|
||||
Email: pc.Email,
|
||||
DNSProvider: pc.DNSProvider,
|
||||
DNSEnv: pc.DNSEnv,
|
||||
HTTPPort: pc.HTTPPort,
|
||||
CertFile: pc.CertFile,
|
||||
KeyFile: pc.KeyFile,
|
||||
CertContent: pc.CertContent,
|
||||
KeyContent: pc.KeyContent,
|
||||
// Preserve local storage dir — only the operator controls where certs live.
|
||||
CertDir: s.cfg.Cert.CertDir,
|
||||
}
|
||||
|
||||
changed, err := s.cert.Reconfigure(ctx, newCfg)
|
||||
if err != nil {
|
||||
slog.Error("failed to apply panel cert config", "mode", pc.CertMode, "error", err)
|
||||
return false
|
||||
}
|
||||
s.cfg.Cert = newCfg
|
||||
if changed {
|
||||
slog.Info("cert: paths updated from panel", "cert", s.cert.CertFile(), "key", s.cert.KeyFile())
|
||||
}
|
||||
return changed
|
||||
}
|
||||
|
||||
// startWSClient starts the WS client goroutine if a client is configured.
|
||||
func (s *Service) startWSClient(ctx context.Context) {
|
||||
if s.wsClient == nil {
|
||||
return
|
||||
}
|
||||
wsCtx, wsCancel := context.WithCancel(ctx)
|
||||
s.wsCancel = wsCancel
|
||||
go s.wsClient.Run(wsCtx)
|
||||
}
|
||||
|
||||
// newWSClient creates a WSClient with standard event/status callbacks.
|
||||
func (s *Service) newWSClient(wsURL string) *panel.WSClient {
|
||||
return panel.NewWSClient(
|
||||
wsURL,
|
||||
s.cfg.Panel.Token,
|
||||
s.cfg.Panel.NodeID,
|
||||
func(event panel.WSEvent) {
|
||||
select {
|
||||
case s.wsEvents <- event:
|
||||
default:
|
||||
slog.Warn("ws event channel full, dropping event", "type", event.Type)
|
||||
}
|
||||
},
|
||||
func(status panel.WSStatusChange) {
|
||||
select {
|
||||
case s.wsStatusCh <- status:
|
||||
default:
|
||||
}
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
// handleWSStatus reacts to WS connectivity changes.
|
||||
//
|
||||
// - On disconnect: record timestamp, immediately REST poll.
|
||||
// - On reconnect: clear disconnect timestamp, REST poll to catch missed events.
|
||||
func (s *Service) handleWSStatus(ctx context.Context, status panel.WSStatusChange) {
|
||||
if status.Connected {
|
||||
s.wsDisconnectAt = time.Time{}
|
||||
slog.Info("ws connected, waiting for server-side full sync push")
|
||||
// No REST pull needed — server detects new connection and pushes
|
||||
// full config + users automatically on auth success.
|
||||
} else {
|
||||
if s.wsDisconnectAt.IsZero() {
|
||||
s.wsDisconnectAt = time.Now()
|
||||
}
|
||||
slog.Info("ws disconnected, falling back to REST polling")
|
||||
s.pullViaAPI(ctx)
|
||||
}
|
||||
}
|
||||
|
||||
// wsDiscovery periodically checks WS availability:
|
||||
//
|
||||
// 1. REST-only mode (wsClient == nil): Re-handshake to check if panel now has
|
||||
// WS enabled. If so, create and start a WS client. This handles the case
|
||||
// where WS was not enabled at startup but enabled later.
|
||||
//
|
||||
// 2. WS disconnected for >10 min: Re-handshake to check if WS config changed.
|
||||
// If WS is now disabled, stop the WS client and switch to REST-only.
|
||||
// If WS config changed (different URL/channel), restart with new config.
|
||||
func (s *Service) wsDiscovery(ctx context.Context) {
|
||||
needsCheck := false
|
||||
|
||||
if s.wsClient == nil {
|
||||
needsCheck = true
|
||||
slog.Debug("ws discovery: no WS client, checking if panel enabled WS")
|
||||
} else if !s.wsDisconnectAt.IsZero() && time.Since(s.wsDisconnectAt) > 10*time.Minute {
|
||||
needsCheck = true
|
||||
slog.Debug("ws discovery: WS disconnected for >10min, re-checking WS config")
|
||||
}
|
||||
|
||||
if !needsCheck {
|
||||
return
|
||||
}
|
||||
|
||||
hs, err := s.panel.Handshake()
|
||||
if err != nil {
|
||||
slog.Debug("ws discovery: handshake failed", "error", err)
|
||||
return
|
||||
}
|
||||
|
||||
// Apply any latest config/user changes via dedicated APIs
|
||||
s.pullViaAPI(ctx)
|
||||
|
||||
if hs.WebSocket.Enabled && hs.WebSocket.WSURL != "" {
|
||||
if s.wsClient == nil {
|
||||
slog.Info("ws discovery: panel has WS enabled, creating WS client")
|
||||
s.wsClient = s.newWSClient(hs.WebSocket.WSURL)
|
||||
s.wsDisconnectAt = time.Time{}
|
||||
s.startWSClient(ctx)
|
||||
}
|
||||
} else if s.wsClient != nil {
|
||||
slog.Info("ws discovery: panel disabled WS, switching to REST-only")
|
||||
if s.wsCancel != nil {
|
||||
s.wsCancel()
|
||||
}
|
||||
s.wsClient = nil
|
||||
s.wsCancel = nil
|
||||
s.wsDisconnectAt = time.Time{}
|
||||
}
|
||||
}
|
||||
|
||||
// handleWSEvent processes data events received via WebSocket
|
||||
func (s *Service) handleWSEvent(ctx context.Context, event panel.WSEvent) {
|
||||
switch event.Type {
|
||||
case panel.WSEventSyncConfig:
|
||||
if event.Config == nil {
|
||||
slog.Warn("ws: sync.config event with nil config, ignoring")
|
||||
return
|
||||
}
|
||||
newConfigHash := computeConfigHash(event.Config)
|
||||
if newConfigHash == s.lastConfigHash {
|
||||
slog.Debug("ws: config unchanged (same hash), skipping")
|
||||
return
|
||||
}
|
||||
slog.Info("ws: applying config update", "protocol", event.Config.Protocol)
|
||||
s.lastConfig = event.Config
|
||||
s.lastConfigHash = newConfigHash
|
||||
s.applyRemoteOverrides(ctx, event.Config)
|
||||
s.applyChanges(ctx, true, false)
|
||||
|
||||
case panel.WSEventSyncUsers:
|
||||
if event.Users == nil {
|
||||
slog.Warn("ws: sync.users event with nil users, ignoring")
|
||||
return
|
||||
}
|
||||
newHash := computeUserHash(event.Users)
|
||||
if newHash == s.lastUserHash {
|
||||
slog.Debug("ws: users unchanged (same hash), skipping")
|
||||
return
|
||||
}
|
||||
slog.Info("ws: applying user update", "count", len(event.Users))
|
||||
s.applyUserUpdate(ctx, event.Users, newHash)
|
||||
|
||||
case panel.WSEventSyncUserDelta:
|
||||
if len(event.DeltaUsers) == 0 {
|
||||
slog.Warn("ws: sync.user.delta event with empty users, ignoring")
|
||||
return
|
||||
}
|
||||
slog.Info("ws: applying user delta", "action", event.DeltaAction, "count", len(event.DeltaUsers))
|
||||
s.applyUserDelta(ctx, event.DeltaAction, event.DeltaUsers)
|
||||
|
||||
default:
|
||||
slog.Debug("ws: unknown event type", "type", event.Type)
|
||||
}
|
||||
}
|
||||
|
||||
// pullViaAPI re-calls the config and user APIs for polling fallback.
|
||||
// Also opportunistically detects WS enablement when in REST-only mode.
|
||||
func (s *Service) pullViaAPI(ctx context.Context) {
|
||||
if s.pullBackoff.shouldSkip() {
|
||||
slog.Debug("skipping pull due to backoff")
|
||||
return
|
||||
}
|
||||
|
||||
config, err := s.panel.GetConfig()
|
||||
if err != nil {
|
||||
slog.Error("poll config failed", "error", err)
|
||||
s.pullBackoff.onFailure()
|
||||
return
|
||||
}
|
||||
|
||||
users, err := s.panel.GetUsers()
|
||||
if err != nil {
|
||||
slog.Error("poll users failed", "error", err)
|
||||
s.pullBackoff.onFailure()
|
||||
return
|
||||
}
|
||||
|
||||
s.pullBackoff.onSuccess()
|
||||
|
||||
configChanged := false
|
||||
|
||||
if s.cert.CertRenewed() {
|
||||
slog.Info("certificate renewed, kernel restart needed")
|
||||
configChanged = true
|
||||
}
|
||||
|
||||
if config != nil {
|
||||
newConfigHash := computeConfigHash(config)
|
||||
if s.lastConfigHash != newConfigHash {
|
||||
configChanged = true
|
||||
slog.Info("config updated from panel",
|
||||
"protocol", config.Protocol, "port", config.ServerPort)
|
||||
s.lastConfig = config
|
||||
s.lastConfigHash = newConfigHash
|
||||
// Apply kernel overrides and cert updates from REST pull
|
||||
if s.applyRemoteOverrides(ctx, config) {
|
||||
configChanged = true // Restart kernel if cert paths changed
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if users != nil {
|
||||
newHash := computeUserHash(users)
|
||||
usersChanged := newHash != s.lastUserHash
|
||||
|
||||
if usersChanged && !configChanged {
|
||||
s.applyUserUpdate(ctx, users, newHash)
|
||||
} else if usersChanged {
|
||||
// Config is also changing — ApplyConfig will restart the kernel with the
|
||||
// updated user list, so skip the intermediate ReloadUsers.
|
||||
s.syncUserState(ctx, users, newHash, false)
|
||||
}
|
||||
}
|
||||
|
||||
if configChanged {
|
||||
s.applyChanges(ctx, true, false)
|
||||
}
|
||||
}
|
||||
|
||||
// syncUserState updates user tracking state (limiter, speedTracker, lastUsers)
|
||||
// without touching the kernel. Set kickRemoved=false when a full kernel restart
|
||||
// is about to happen anyway — removed users' connections will be killed then.
|
||||
func (s *Service) syncUserState(ctx context.Context, users []panel.User, newHash string, kickRemoved bool) {
|
||||
removedIDs := s.limiter.UpdateUsers(users)
|
||||
s.speedTracker.UpdateBuckets()
|
||||
|
||||
if kickRemoved && len(removedIDs) > 0 && s.kernel.IsRunning() {
|
||||
conns, err := s.kernel.GetConnections(ctx)
|
||||
if err == nil {
|
||||
kicks := s.limiter.KickUsers(conns, removedIDs)
|
||||
s.executeKicks(ctx, kicks)
|
||||
slog.Info("kicked removed users", "removed_ids", removedIDs, "kicked_conns", len(kicks))
|
||||
}
|
||||
}
|
||||
|
||||
s.lastUsers = users
|
||||
s.lastUserHash = newHash
|
||||
slog.Info("users updated", "count", len(users))
|
||||
}
|
||||
|
||||
// applyUserUpdate updates user state and hot-reloads the kernel inbounds.
|
||||
func (s *Service) applyUserUpdate(ctx context.Context, users []panel.User, newHash string) {
|
||||
s.syncUserState(ctx, users, newHash, true)
|
||||
s.applyChanges(ctx, false, true)
|
||||
}
|
||||
|
||||
// applyUserDelta applies an incremental user change (add or remove).
|
||||
func (s *Service) applyUserDelta(ctx context.Context, action string, deltaUsers []panel.User) {
|
||||
switch action {
|
||||
case "add":
|
||||
// Build a map of current users for fast lookup
|
||||
userMap := make(map[int]panel.User, len(s.lastUsers))
|
||||
for _, u := range s.lastUsers {
|
||||
userMap[u.ID] = u
|
||||
}
|
||||
for _, u := range deltaUsers {
|
||||
userMap[u.ID] = u // add or update
|
||||
}
|
||||
merged := make([]panel.User, 0, len(userMap))
|
||||
for _, u := range userMap {
|
||||
merged = append(merged, u)
|
||||
}
|
||||
newHash := computeUserHash(merged)
|
||||
s.applyUserUpdate(ctx, merged, newHash)
|
||||
|
||||
case "remove":
|
||||
removeSet := make(map[int]struct{}, len(deltaUsers))
|
||||
for _, u := range deltaUsers {
|
||||
removeSet[u.ID] = struct{}{}
|
||||
}
|
||||
filtered := make([]panel.User, 0, len(s.lastUsers))
|
||||
for _, u := range s.lastUsers {
|
||||
if _, ok := removeSet[u.ID]; !ok {
|
||||
filtered = append(filtered, u)
|
||||
}
|
||||
}
|
||||
newHash := computeUserHash(filtered)
|
||||
s.applyUserUpdate(ctx, filtered, newHash)
|
||||
default:
|
||||
slog.Warn("ws: unknown user delta action", "action", action)
|
||||
}
|
||||
}
|
||||
|
||||
// applyChanges applies config and/or user changes to the kernel
|
||||
func (s *Service) applyChanges(ctx context.Context, configChanged, usersChanged bool) {
|
||||
certFile, keyFile := s.cert.CertFile(), s.cert.KeyFile()
|
||||
|
||||
if configChanged {
|
||||
if s.lastConfig != nil && len(s.lastUsers) > 0 {
|
||||
// If the port or listen IP has changed, we MUST perform a full restart
|
||||
// because hot-reload (s.kernel.Reload) typically only updates users/rules
|
||||
// and doesn't re-bind existing listeners in most kernels.
|
||||
needsRestart := s.kernel.IsRunning() && (s.lastConfig.ServerPort != s.lastAppliedPort || s.lastConfig.ListenIP != s.lastAppliedIP)
|
||||
|
||||
if !needsRestart {
|
||||
// Try hot-reload for other config changes (could be route/user changes).
|
||||
if err := s.kernel.Reload(s.lastConfig, s.lastUsers, certFile, keyFile); err != nil {
|
||||
slog.Warn("reload failed, falling back to full restart", "error", err)
|
||||
needsRestart = true
|
||||
}
|
||||
}
|
||||
|
||||
if needsRestart || !s.kernel.IsRunning() {
|
||||
if err := s.kernel.ApplyConfig(s.lastConfig, s.lastUsers, certFile, keyFile); err != nil {
|
||||
slog.Error("failed to apply config", "error", err)
|
||||
} else {
|
||||
// Update tracking state for next change
|
||||
s.lastAppliedPort = s.lastConfig.ServerPort
|
||||
s.lastAppliedIP = s.lastConfig.ListenIP
|
||||
}
|
||||
}
|
||||
} else if len(s.lastUsers) == 0 {
|
||||
slog.Warn("no users, stopping kernel")
|
||||
s.kernel.Stop()
|
||||
}
|
||||
} else if usersChanged && s.kernel.IsRunning() {
|
||||
// Hot-reload for user-only changes
|
||||
if err := s.kernel.Reload(s.lastConfig, s.lastUsers, certFile, keyFile); err != nil {
|
||||
slog.Warn("inbound reload failed, falling back to full restart", "error", err)
|
||||
if err := s.kernel.ApplyConfig(s.lastConfig, s.lastUsers, certFile, keyFile); err != nil {
|
||||
slog.Error("failed to apply config (fallback)", "error", err)
|
||||
} else {
|
||||
s.lastAppliedPort = s.lastConfig.ServerPort
|
||||
s.lastAppliedIP = s.lastConfig.ListenIP
|
||||
}
|
||||
}
|
||||
} else if usersChanged && !s.kernel.IsRunning() && len(s.lastUsers) > 0 {
|
||||
// Kernel was stopped (no users), now we have users — start it
|
||||
if err := s.kernel.ApplyConfig(s.lastConfig, s.lastUsers, certFile, keyFile); err != nil {
|
||||
slog.Error("failed to start kernel with new users", "error", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (s *Service) trackAndEnforce(ctx context.Context) {
|
||||
if !s.kernel.IsRunning() {
|
||||
return
|
||||
}
|
||||
|
||||
conns, err := s.kernel.GetConnections(ctx)
|
||||
if err != nil {
|
||||
slog.Debug("get connections failed", "error", err)
|
||||
return
|
||||
}
|
||||
|
||||
s.tracker.Process(conns)
|
||||
s.tracker.LogStats()
|
||||
|
||||
kicks := s.limiter.Check(conns)
|
||||
s.executeKicks(ctx, kicks)
|
||||
}
|
||||
|
||||
func (s *Service) executeKicks(ctx context.Context, kicks []limiter.KickAction) {
|
||||
for _, kick := range kicks {
|
||||
slog.Info("kicking connection",
|
||||
"user_id", kick.UserID,
|
||||
"conn_id", kick.ConnID,
|
||||
"reason", kick.Reason,
|
||||
)
|
||||
if err := s.kernel.CloseConnection(ctx, kick.ConnID); err != nil {
|
||||
slog.Error("failed to close connection", "conn_id", kick.ConnID, "error", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// pushReport sends consolidated traffic + alive + status to the panel
|
||||
func (s *Service) pushReport() {
|
||||
if s.pushBackoff.shouldSkip() {
|
||||
slog.Debug("skipping report due to backoff")
|
||||
return
|
||||
}
|
||||
|
||||
traffic := s.tracker.FlushTraffic()
|
||||
aliveIPs := s.tracker.FlushAliveIPs()
|
||||
online := s.tracker.CurrentOnline()
|
||||
status := monitor.Collect()
|
||||
|
||||
metrics := s.buildMetrics(status)
|
||||
|
||||
if len(traffic) == 0 && len(aliveIPs) == 0 && len(online) == 0 {
|
||||
// Still send status periodically
|
||||
if err := s.panel.Report(
|
||||
nil, nil, nil,
|
||||
status.CPU,
|
||||
[2]uint64{status.MemTotal, status.MemUsed},
|
||||
[2]uint64{status.SwapTotal, status.SwapUsed},
|
||||
[2]uint64{status.DiskTotal, status.DiskUsed},
|
||||
metrics,
|
||||
); err != nil {
|
||||
slog.Error("failed to push status report", "error", err)
|
||||
s.pushBackoff.onFailure()
|
||||
return
|
||||
}
|
||||
s.pushBackoff.onSuccess()
|
||||
return
|
||||
}
|
||||
|
||||
if err := s.panel.Report(
|
||||
traffic, aliveIPs, online,
|
||||
status.CPU,
|
||||
[2]uint64{status.MemTotal, status.MemUsed},
|
||||
[2]uint64{status.SwapTotal, status.SwapUsed},
|
||||
[2]uint64{status.DiskTotal, status.DiskUsed},
|
||||
metrics,
|
||||
); err != nil {
|
||||
slog.Error("failed to push report", "error", err)
|
||||
s.tracker.RestoreTraffic(traffic)
|
||||
s.tracker.RestoreAliveIPs(aliveIPs)
|
||||
s.pushBackoff.onFailure()
|
||||
return
|
||||
}
|
||||
|
||||
s.pushBackoff.onSuccess()
|
||||
slog.Info("report pushed", "users", len(traffic))
|
||||
}
|
||||
|
||||
// buildMetrics aggregates node-level metrics to be reported to the panel.
|
||||
// This includes active connections, per-core CPU, GC stats, API call stats,
|
||||
// WebSocket status, and limiter hit counts.
|
||||
func (s *Service) buildMetrics(status monitor.Status) map[string]interface{} {
|
||||
m := make(map[string]interface{})
|
||||
|
||||
m["uptime"] = status.Uptime
|
||||
|
||||
// Active connections (last measured during tracker.Process()).
|
||||
m["active_connections"] = s.tracker.ActiveConnections()
|
||||
m["total_connections"] = s.tracker.TotalConnections()
|
||||
|
||||
// Speed
|
||||
m["inbound_speed"] = s.tracker.InboundSpeed()
|
||||
m["outbound_speed"] = s.tracker.OutboundSpeed()
|
||||
|
||||
// Per-core CPU usage (if available).
|
||||
if len(status.CPUPerCore) > 0 {
|
||||
m["cpu_per_core"] = status.CPUPerCore
|
||||
}
|
||||
|
||||
// Speed Limiter metrics
|
||||
m["speed_limiter"] = map[string]interface{}{
|
||||
"has_limits": s.speedTracker.HasLimits(),
|
||||
"limited_users": s.speedTracker.LimitedUserCount(),
|
||||
}
|
||||
|
||||
// GC metrics.
|
||||
m["gc"] = map[string]interface{}{
|
||||
"num_gc": status.NumGC,
|
||||
"last_pause_ms": status.LastPauseMS,
|
||||
}
|
||||
|
||||
// API metrics.
|
||||
api := s.panel.SnapshotMetrics()
|
||||
m["api"] = map[string]interface{}{
|
||||
"success": api.Success,
|
||||
"failure": api.Failure,
|
||||
}
|
||||
|
||||
// WebSocket status.
|
||||
wsEnabled := s.wsClient != nil
|
||||
wsConnected := wsEnabled && s.wsClient.IsConnected()
|
||||
m["ws"] = map[string]interface{}{
|
||||
"enabled": wsEnabled,
|
||||
"connected": wsConnected,
|
||||
}
|
||||
|
||||
// Limiter metrics.
|
||||
lm := s.limiter.SnapshotMetrics()
|
||||
m["limits"] = map[string]interface{}{
|
||||
"device_limit_events": lm.DeviceLimitEvents,
|
||||
"speed_limited_users": s.speedTracker.LimitedUserCount(),
|
||||
}
|
||||
|
||||
return m
|
||||
}
|
||||
|
||||
// computeConfigHash returns a SHA-256 hash of the kernel-relevant node config
|
||||
// fields. BaseConfig (PushInterval/PullInterval) is excluded because it only
|
||||
// affects service-layer polling intervals and must not trigger a kernel restart.
|
||||
func computeConfigHash(cfg *panel.NodeConfig) string {
|
||||
if cfg == nil {
|
||||
return ""
|
||||
}
|
||||
tmp := *cfg
|
||||
tmp.BaseConfig = panel.BaseConfig{}
|
||||
data, err := json.Marshal(&tmp)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
h := sha256.Sum256(data)
|
||||
return fmt.Sprintf("%x", h)
|
||||
}
|
||||
|
||||
// computeUserHash returns a deterministic hash of the user list for change detection.
|
||||
// Uses direct byte encoding instead of binary.Write to avoid reflection overhead.
|
||||
func computeUserHash(users []panel.User) string {
|
||||
sorted := make([]panel.User, len(users))
|
||||
copy(sorted, users)
|
||||
sort.Slice(sorted, func(i, j int) bool { return sorted[i].ID < sorted[j].ID })
|
||||
|
||||
h := sha256.New()
|
||||
var buf [8]byte
|
||||
for _, u := range sorted {
|
||||
buf[0] = byte(u.ID)
|
||||
buf[1] = byte(u.ID >> 8)
|
||||
buf[2] = byte(u.ID >> 16)
|
||||
buf[3] = byte(u.ID >> 24)
|
||||
buf[4] = byte(u.ID >> 32)
|
||||
buf[5] = byte(u.ID >> 40)
|
||||
buf[6] = byte(u.ID >> 48)
|
||||
buf[7] = byte(u.ID >> 56)
|
||||
h.Write(buf[:])
|
||||
h.Write([]byte(u.UUID))
|
||||
buf[0] = byte(u.SpeedLimit)
|
||||
buf[1] = byte(u.SpeedLimit >> 8)
|
||||
buf[2] = byte(u.SpeedLimit >> 16)
|
||||
buf[3] = byte(u.SpeedLimit >> 24)
|
||||
buf[4] = byte(u.SpeedLimit >> 32)
|
||||
buf[5] = byte(u.SpeedLimit >> 40)
|
||||
buf[6] = byte(u.SpeedLimit >> 48)
|
||||
buf[7] = byte(u.SpeedLimit >> 56)
|
||||
h.Write(buf[:])
|
||||
buf[0] = byte(u.DeviceLimit)
|
||||
buf[1] = byte(u.DeviceLimit >> 8)
|
||||
buf[2] = byte(u.DeviceLimit >> 16)
|
||||
buf[3] = byte(u.DeviceLimit >> 24)
|
||||
buf[4] = byte(u.DeviceLimit >> 32)
|
||||
buf[5] = byte(u.DeviceLimit >> 40)
|
||||
buf[6] = byte(u.DeviceLimit >> 48)
|
||||
buf[7] = byte(u.DeviceLimit >> 56)
|
||||
h.Write(buf[:])
|
||||
}
|
||||
return fmt.Sprintf("%x", h.Sum(nil))
|
||||
}
|
||||
Reference in New Issue
Block a user