mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-08-12 06:10:58 +00:00
feat: release-driven golden-image & unattended-install deployment pipeline (#5323)
* feat(install): add non-interactive install path for cloud/golden-image use Trigger non-interactive mode when XUI_NONINTERACTIVE=1 or stdin is not a TTY (curl | bash, cloud-init). Every prompt is then replaced by an env var or a sane default; interactive prompts stay byte-for-byte identical. Honored env vars: XUI_USERNAME, XUI_PASSWORD, XUI_PANEL_PORT, XUI_WEB_BASE_PATH (unset => random, as before), XUI_SSL_MODE=none|ip|domain (default none), XUI_DOMAIN, XUI_ACME_EMAIL, XUI_DB_TYPE/XUI_DB_DSN, plus additive XUI_ACME_HTTP_PORT, XUI_SSL_IPV6, XUI_SERVER_IP. On success, write /etc/x-ui/install-result.env (mode 600) with the panel creds + access URL + api token, in both interactive and non-interactive modes, so cloud-init/MOTD can surface them. Postgres in non-interactive mode requires XUI_DB_DSN or installs locally; never silently downgrades. * feat(deploy): add first-boot per-instance credential generation Golden images ship with no x-ui.db. x-ui-firstboot.sh runs once (guarded by /etc/x-ui/.firstboot-done), before x-ui.service, and replaces the seeded admin/admin with fresh random username/password on a random high port, regenerates the session secret/panel GUID via 'x-ui setting -reset', mints an API token, and writes the creds to /etc/x-ui/credentials.txt (600) + /etc/motd. Idempotent: skips regeneration if a non-default admin already exists. The oneshot unit is ordered After=network-online/cloud-init and Before=x-ui.service so the panel never serves default credentials. * chore(deploy): force LF for cloud-image deploy assets (.service/.hcl/.yaml) * feat(deploy): add Packer config + provisioning scripts for golden image One build, two sources: amazon-ebs (AWS AMI, Canonical Ubuntu 24.04 base via source_ami_filter) and qemu (qcow2 + raw, NoCloud-seeded for build-time SSH). Provisioner order is fixed: provision.sh -> harden.sh -> cleanup.sh. - provision.sh: downloads the released x-ui tarball (no Go build), installs the panel + firstboot unit, enables but does NOT start services, creates NO DB. - harden.sh: key-only SSH, no root password login, locks default account passwords, enables unattended-upgrades (scanner-compliant). - cleanup.sh: wipes any DB/creds, SSH host keys, authorized_keys, machine-id, cloud-init state, logs and history; fails the build if any secret survives. packer fmt -check clean; packer validate passes for both sources. * feat(deploy): add generic cloud-init user-data for unattended install cloud-init.yaml installs the latest 3x-ui non-interactively (XUI_NONINTERACTIVE=1) on any cloud-init platform, generating unique per-instance credentials and surfacing them via /etc/x-ui/install-result.env, serial console and MOTD. README documents per-provider usage (Hetzner/AWS/DO/Vultr/GCP/Azure/Oracle) and all XUI_* knobs. * ci: add image.yml to build cloud images on release On release: published (or workflow_dispatch with a tag), waits for the x-ui-linux-amd64.tar.gz asset (handles the release-matrix upload race), then: - qemu-image (always): builds the qcow2 with Packer and attaches a compressed .qcow2.xz + sha256 to the GitHub release. Uses KVM when /dev/kvm exists, else TCG. - ami-image (gated): builds the AWS AMI only when AWS creds exist (OIDC role preferred, else access keys), so forks skip cleanly. Prints the AMI ID to the job summary. No secrets or AMI IDs are committed. * test(deploy): add container smoke tests for install + firstboot smoke-noninteractive.sh: runs install.sh piped (no TTY) with XUI_NONINTERACTIVE=1 in an Ubuntu container; asserts install-result.env (600) holds random non-default creds, hasDefaultCredential is false, and the panel serves HTTP. smoke-firstboot.sh: installs the released binary with no DB, runs x-ui-firstboot.sh; asserts per-instance creds + credentials.txt (600) + MOTD, no admin/admin, and that a second run is a no-op (sentinel honored). smoke.yml runs both as gated jobs on PRs/pushes touching install.sh or deploy/**. Both pass locally against the v3.3.1 release binary. * docs(deploy): add Packer/marketplace docs and link from README - deploy/README.md: index of the cloud-deploy tooling and the two models - deploy/packer/README.md: how to build locally, variables, first-boot behavior - deploy/marketplace/aws/README.md: seller registration -> AMI scan -> limited-visibility preview -> go-public checklist - deploy/marketplace/hetzner/README.md: cloud-init-first guidance + snapshot caveat (delete x-ui.db first) + hetznercloud/apps reference - README.md: link the unattended-install / cloud-image docs from Quick Start * feat(deploy): build golden images for arm64 as well as amd64 The install path was already multi-arch (install.sh auto-detects arch); this extends the golden image + CI to arm64: - packer: xui_arch (amd64|arm64, validated) now derives the base AMI filter and the Ubuntu cloud image; the qemu source switches to qemu-system-aarch64 + virt machine + AAVMF UEFI firmware for arm64. amd64 path unchanged. - image.yml: arch matrix. AMIs for amd64 (t3.small) + arm64 (t4g.small/Graviton) from one runner; qcow2 for amd64 on a standard runner and arm64 on a native ubuntu-24.04-arm runner. Waits for both release tarballs. - smoke.yml: run install + firstboot smoke tests on amd64 and arm64 runners; smoke-firstboot.sh now resolves the arch tarball via dpkg. - docs updated for both arches. packer fmt/validate pass for amd64 and arm64; actionlint + shellcheck clean. Verified locally: non-interactive install AND firstboot run on the real arm64 release binary under emulation (ELF aarch64, no admin/admin). * chore(deploy): default AWS region to eu-central-1 (Frankfurt) Replace the us-east-1 fallback in image.yml (4 sites) and the Packer 'region' default + doc examples. Still overridable via the AWS_REGION repo variable / the -var 'region=...' flag. * feat(deploy): add Amazon Lightsail support (launch script + snapshot builder) Lightsail can't launch from an EC2 AMI and its blueprint list isn't self-publishable, so add the two self-service paths instead: - launch-script.sh: paste into Lightsail 'Add launch script' (or --user-data) to install 3x-ui non-interactively with unique per-instance credentials. - snapshot-userdata.sh + build-snapshot.sh: AWS CLI pipeline that provisions a build instance (panel installed, NO DB, firstboot enabled), runs the shared cleanup.sh, then snapshots it. Instances launched from the snapshot mint their own credentials on first boot. Optional --panel-port pins a known port for the Lightsail firewall. - README documents both paths, the firewall caveat, and the blueprint reality. EC2 AMI / Marketplace path kept untouched alongside. All scripts shellcheck-clean. * fix(deploy): address Copilot PR review findings - install.sh + firstboot: write install-result.env / credentials.txt values with printf %q so the files stay safe to source even if creds are pinned with shell metacharacters (no-op for the alphanumeric random defaults). - firstboot: fail closed if 'x-ui setting -show' can't be parsed to true/false — exit without writing the sentinel so the next boot retries, instead of silently skipping regeneration and risking admin/admin. - firstboot + cloud-init + lightsail launch-script: keep secrets out of the world-readable /etc/motd (show URL + username only; full creds via the mode-600 file / serial console). - lightsail build-snapshot: handle download-default-key-pair returning either a PEM or base64, and assert a valid PEM before using it for SSH. - image.yml: pin hashicorp/setup-packer@v3 (was @main). - deploy/README: document XUI_ACME_HTTP_PORT / XUI_SSL_IPV6 / XUI_SERVER_IP. Both container smoke tests still pass; shellcheck + actionlint clean.
This commit is contained in:
Sanaei
@@ -0,0 +1,7 @@
|
||||
# Packer build artifacts (never commit images or manifests)
|
||||
output-qemu/
|
||||
*.qcow2
|
||||
*.raw
|
||||
packer-manifest.json
|
||||
packer_cache/
|
||||
crash.log
|
||||
@@ -0,0 +1,116 @@
|
||||
# 3x-ui golden image (Packer)
|
||||
|
||||
Builds a cloud image with the 3x-ui panel pre-installed but **not configured**:
|
||||
the image ships with **no database and no credentials**, and generates a unique
|
||||
admin account on first boot. This is the **primary** path for AWS Marketplace
|
||||
and any reusable image.
|
||||
|
||||
Two sources, one build:
|
||||
|
||||
| Source | Output | For |
|
||||
| --- | --- | --- |
|
||||
| `amazon-ebs` | AWS AMI | AWS / Marketplace |
|
||||
| `qemu` | `qcow2` (+ `raw`) | Hetzner, DigitalOcean, Vultr, GCP, Azure, Oracle, bare metal |
|
||||
|
||||
Both sources build for **`amd64` and `arm64`** (select with `-var xui_arch=...`).
|
||||
|
||||
## Why no baked DB
|
||||
|
||||
3x-ui seeds a hardcoded `admin/admin` user and generates its session secret +
|
||||
panel GUID the first time it starts. If an image shipped an initialized
|
||||
`x-ui.db`, **every clone would share the same credentials and secret**. So the
|
||||
build deliberately:
|
||||
|
||||
- installs the panel binary + systemd unit but **never starts it** and **never
|
||||
creates a DB** (`scripts/provision.sh`);
|
||||
- wipes any stray DB/credentials/host-keys at the end (`scripts/cleanup.sh`);
|
||||
- enables `x-ui-firstboot.service`, which on first boot resets settings, sets a
|
||||
random username/password on a random high port, regenerates the secret/GUID,
|
||||
and writes the credentials to `/etc/x-ui/credentials.txt` + `/etc/motd`
|
||||
(`deploy/firstboot/`).
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- [Packer](https://developer.hashicorp.com/packer) ≥ 1.9
|
||||
- For `qemu` amd64: `qemu-system-x86`, `qemu-utils` (and `/dev/kvm` for acceptable speed)
|
||||
- For `qemu` arm64: `qemu-system-arm`, `qemu-efi-aarch64`, `qemu-utils` — best built on an
|
||||
arm64 host (native KVM); cross-building from x86 works but uses slow TCG emulation
|
||||
- For `amazon-ebs`: AWS credentials with EC2 build permissions (arm64 builds on a Graviton
|
||||
instance such as `t4g.small`)
|
||||
|
||||
```bash
|
||||
cd deploy/packer
|
||||
packer init .
|
||||
packer fmt -check . # formatting
|
||||
packer validate . # both sources
|
||||
```
|
||||
|
||||
## Build
|
||||
|
||||
Build a specific release (recommended) or `latest`:
|
||||
|
||||
```bash
|
||||
# amd64 qcow2 (no cloud account needed)
|
||||
packer build -only='qemu.x-ui' -var 'xui_version=v3.3.1' -var 'xui_arch=amd64' .
|
||||
|
||||
# arm64 qcow2 (run on an arm64 host for native KVM)
|
||||
packer build -only='qemu.x-ui' -var 'xui_version=v3.3.1' -var 'xui_arch=arm64' .
|
||||
|
||||
# amd64 AWS AMI
|
||||
packer build -only='amazon-ebs.x-ui' \
|
||||
-var 'xui_version=v3.3.1' -var 'xui_arch=amd64' -var 'instance_type=t3.small' -var 'region=eu-central-1' .
|
||||
|
||||
# arm64 AWS AMI (Graviton)
|
||||
packer build -only='amazon-ebs.x-ui' \
|
||||
-var 'xui_version=v3.3.1' -var 'xui_arch=arm64' -var 'instance_type=t4g.small' -var 'region=eu-central-1' .
|
||||
```
|
||||
|
||||
Outputs (per arch):
|
||||
- `output-qemu/3x-ui-ubuntu-24.04-<arch>.qcow2` and `.raw`
|
||||
- the AMI id (also recorded in `packer-manifest.json`)
|
||||
|
||||
If `/dev/kvm` is unavailable, add `-var 'qemu_accelerator=tcg'` (much slower).
|
||||
|
||||
## Key variables
|
||||
|
||||
See [`variables.pkr.hcl`](variables.pkr.hcl) for the full list.
|
||||
|
||||
| Variable | Default | Notes |
|
||||
| --- | --- | --- |
|
||||
| `xui_version` | `latest` | Release tag to install, e.g. `v3.3.1` |
|
||||
| `xui_arch` | `amd64` | `amd64` or `arm64` (derives the base AMI / cloud image) |
|
||||
| `region` | `eu-central-1` | AWS region (amazon-ebs) |
|
||||
| `instance_type` | `t3.small` | EC2 build instance — must match the arch (`t4g.small` for arm64) |
|
||||
| `qemu_accelerator` | `kvm` | `kvm` or `tcg` |
|
||||
| `qemu_cpu` | `host` | arm64 `-cpu` model (`host` with KVM, `max` for TCG) |
|
||||
| `ubuntu_version` | `24.04` | Base Ubuntu LTS (naming/tags) |
|
||||
|
||||
The CI workflow builds both arches automatically: amd64 qcow2 on a standard runner,
|
||||
arm64 qcow2 on a native `ubuntu-24.04-arm` runner, and both AMIs from a single runner
|
||||
(the build instance runs in AWS).
|
||||
|
||||
## First boot
|
||||
|
||||
On the first boot of any instance launched from the image:
|
||||
|
||||
1. `x-ui-firstboot.service` runs **before** `x-ui.service`.
|
||||
2. It generates a unique admin username/password, a random panel port, a random
|
||||
base path, and an API token.
|
||||
3. Credentials are written to `/etc/x-ui/credentials.txt` (root-only) and shown
|
||||
in `/etc/motd`. Retrieve them with `sudo cat /etc/x-ui/credentials.txt`.
|
||||
4. The panel then starts on the random port. `admin/admin` never exists.
|
||||
|
||||
## CI
|
||||
|
||||
`.github/workflows/image.yml` runs this build on `release: published` (and via
|
||||
`workflow_dispatch`), attaching the compressed `qcow2` to the release and
|
||||
building the AMI when AWS credentials are configured.
|
||||
|
||||
## A note on host firewalls
|
||||
|
||||
`scripts/harden.sh` intentionally does **not** enable a restrictive host
|
||||
firewall. 3x-ui opens Xray inbound ports on admin-chosen ports at runtime, which
|
||||
a host firewall would block. Use your cloud provider's security groups/firewall
|
||||
instead, and open the panel port + your inbound ports there. If you still want a
|
||||
host firewall, add `ufw` rules in `harden.sh` allowing SSH, the panel port and
|
||||
your inbound ports.
|
||||
@@ -0,0 +1,59 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# cleanup.sh — strip all instance-specific state and secrets from the image.
|
||||
#
|
||||
# Runs LAST. The output image must contain no panel database, no credentials,
|
||||
# no SSH host keys, and no baked authorized_keys. Fails the build if any of
|
||||
# those survive.
|
||||
set -euo pipefail
|
||||
|
||||
echo "[cleanup] removing panel database, credentials and first-boot sentinel..."
|
||||
rm -f /etc/x-ui/x-ui.db /etc/x-ui/x-ui.db-* 2> /dev/null || true
|
||||
rm -f /etc/x-ui/install-result.env /etc/x-ui/credentials.txt 2> /dev/null || true
|
||||
rm -f /etc/x-ui/.firstboot-done 2> /dev/null || true
|
||||
|
||||
echo "[cleanup] removing SSH host keys (regenerated on first boot)..."
|
||||
rm -f /etc/ssh/ssh_host_* 2> /dev/null || true
|
||||
|
||||
echo "[cleanup] removing any baked authorized_keys..."
|
||||
rm -f /root/.ssh/authorized_keys 2> /dev/null || true
|
||||
find /home -maxdepth 3 -name authorized_keys -type f -delete 2> /dev/null || true
|
||||
|
||||
echo "[cleanup] resetting machine-id..."
|
||||
truncate -s 0 /etc/machine-id 2> /dev/null || true
|
||||
rm -f /var/lib/dbus/machine-id 2> /dev/null || true
|
||||
ln -sf /etc/machine-id /var/lib/dbus/machine-id 2> /dev/null || true
|
||||
|
||||
echo "[cleanup] resetting cloud-init so it re-runs on the real first boot..."
|
||||
cloud-init clean --logs --seed > /dev/null 2>&1 || rm -rf /var/lib/cloud/* 2> /dev/null || true
|
||||
|
||||
echo "[cleanup] truncating logs, history and package caches..."
|
||||
find /var/log -type f -exec truncate -s 0 {} + 2> /dev/null || true
|
||||
rm -rf /var/lib/x-ui /var/log/x-ui/* 2> /dev/null || true
|
||||
apt-get clean || true
|
||||
rm -rf /var/lib/apt/lists/* 2> /dev/null || true
|
||||
rm -f /root/.bash_history 2> /dev/null || true
|
||||
find /home -maxdepth 3 -name .bash_history -type f -delete 2> /dev/null || true
|
||||
rm -rf /tmp/firstboot 2> /dev/null || true
|
||||
|
||||
echo "[cleanup] verifying the image is clean..."
|
||||
fail=0
|
||||
for f in /etc/x-ui/x-ui.db /etc/x-ui/credentials.txt /etc/x-ui/install-result.env /etc/x-ui/.firstboot-done; do
|
||||
if [ -e "$f" ]; then
|
||||
echo "[cleanup] FATAL: $f is present in the image" >&2
|
||||
fail=1
|
||||
fi
|
||||
done
|
||||
if ls /etc/ssh/ssh_host_* > /dev/null 2>&1; then
|
||||
echo "[cleanup] FATAL: SSH host keys present in the image" >&2
|
||||
fail=1
|
||||
fi
|
||||
if [ -e /root/.ssh/authorized_keys ]; then
|
||||
echo "[cleanup] FATAL: /root/.ssh/authorized_keys present in the image" >&2
|
||||
fail=1
|
||||
fi
|
||||
if [ "$fail" -ne 0 ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "[cleanup] OK — no DB, no credentials, no host keys, no authorized_keys."
|
||||
@@ -0,0 +1,39 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# harden.sh — baseline OS hardening for AWS Marketplace AMI scanner compliance.
|
||||
#
|
||||
# Focus: the controls the scanner actually checks — key-only SSH, no root
|
||||
# password login, and no default OS account passwords. A restrictive host
|
||||
# firewall is intentionally NOT enforced by default because 3x-ui opens Xray
|
||||
# inbound ports on admin-chosen ports at runtime (see README for the rationale
|
||||
# and how to add ufw rules if you want them).
|
||||
set -euo pipefail
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
echo "[harden] applying SSH hardening..."
|
||||
install -d -m 755 /etc/ssh/sshd_config.d
|
||||
cat > /etc/ssh/sshd_config.d/99-3xui-hardening.conf << 'EOF'
|
||||
# 3x-ui golden image hardening (AWS Marketplace scanner compliance)
|
||||
PasswordAuthentication no
|
||||
PermitRootLogin prohibit-password
|
||||
KbdInteractiveAuthentication no
|
||||
ChallengeResponseAuthentication no
|
||||
EOF
|
||||
chmod 644 /etc/ssh/sshd_config.d/99-3xui-hardening.conf
|
||||
|
||||
echo "[harden] locking passwords on default OS accounts..."
|
||||
# No account may ship with a usable password. Keys are provisioned per-instance
|
||||
# by the cloud platform (EC2 metadata / cloud-init) on first boot.
|
||||
# passwd -l locks the PASSWORD only; key-based login keeps working.
|
||||
for u in root ubuntu admin; do
|
||||
if id "$u" > /dev/null 2>&1; then
|
||||
passwd -l "$u" > /dev/null 2>&1 || true
|
||||
fi
|
||||
done
|
||||
|
||||
echo "[harden] enabling automatic security updates..."
|
||||
apt-get update
|
||||
apt-get install -y --no-install-recommends unattended-upgrades
|
||||
systemctl enable unattended-upgrades > /dev/null 2>&1 || true
|
||||
|
||||
echo "[harden] done."
|
||||
@@ -0,0 +1,76 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# provision.sh — install the 3x-ui panel into a golden image (Packer).
|
||||
#
|
||||
# Self-contained: mirrors install.sh's download/extract logic but DELIBERATELY
|
||||
# does NOT run config_after_install and does NOT create a database. The image
|
||||
# must ship without /etc/x-ui/x-ui.db so that deploy/firstboot generates unique
|
||||
# per-instance credentials on first boot. Both x-ui.service and
|
||||
# x-ui-firstboot.service are enabled but NOT started here.
|
||||
#
|
||||
# Inputs (from Packer environment_vars):
|
||||
# XUI_VERSION release tag (e.g. v3.3.1) or 'latest'
|
||||
# XUI_ARCH amd64 (default) or arm64
|
||||
set -euo pipefail
|
||||
|
||||
XUI_VERSION="${XUI_VERSION:-latest}"
|
||||
XUI_ARCH="${XUI_ARCH:-amd64}"
|
||||
XUI_DIR="/usr/local/x-ui"
|
||||
REPO="MHSanaei/3x-ui"
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
echo "[provision] installing base packages..."
|
||||
apt-get update
|
||||
apt-get install -y --no-install-recommends \
|
||||
ca-certificates curl tar tzdata socat openssl cron jq
|
||||
|
||||
echo "[provision] resolving 3x-ui version..."
|
||||
if [ "$XUI_VERSION" = "latest" ]; then
|
||||
XUI_VERSION=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases/latest" | jq -r '.tag_name')
|
||||
fi
|
||||
if [ -z "$XUI_VERSION" ] || [ "$XUI_VERSION" = "null" ]; then
|
||||
echo "[provision] ERROR: could not resolve 3x-ui release tag" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "[provision] installing 3x-ui ${XUI_VERSION} (${XUI_ARCH})"
|
||||
|
||||
tarball="x-ui-linux-${XUI_ARCH}.tar.gz"
|
||||
url="https://github.com/${REPO}/releases/download/${XUI_VERSION}/${tarball}"
|
||||
tmp="$(mktemp -d)"
|
||||
trap 'rm -rf "$tmp"' EXIT
|
||||
|
||||
# Download the RELEASED binary tarball (no Go build inside the image).
|
||||
curl -fL4 --retry 3 -o "${tmp}/${tarball}" "$url"
|
||||
|
||||
# Extract into /usr/local/ (the tarball contains an x-ui/ directory).
|
||||
systemctl stop x-ui > /dev/null 2>&1 || true
|
||||
rm -rf "$XUI_DIR"
|
||||
tar -xzf "${tmp}/${tarball}" -C /usr/local/
|
||||
chmod +x "${XUI_DIR}/x-ui" "${XUI_DIR}/x-ui.sh"
|
||||
chmod +x "${XUI_DIR}"/bin/* 2> /dev/null || true
|
||||
|
||||
# Install the x-ui management CLI.
|
||||
if [ -f "${XUI_DIR}/x-ui.sh" ]; then
|
||||
cp -f "${XUI_DIR}/x-ui.sh" /usr/bin/x-ui
|
||||
else
|
||||
curl -fL4 -o /usr/bin/x-ui "https://raw.githubusercontent.com/${REPO}/main/x-ui.sh"
|
||||
fi
|
||||
chmod +x /usr/bin/x-ui
|
||||
mkdir -p /var/log/x-ui
|
||||
|
||||
# Panel systemd unit (Ubuntu base => debian variant).
|
||||
install -m 644 "${XUI_DIR}/x-ui.service.debian" /etc/systemd/system/x-ui.service
|
||||
|
||||
# First-boot per-instance credential unit + script (uploaded to /tmp/firstboot).
|
||||
install -m 755 /tmp/firstboot/x-ui-firstboot.sh "${XUI_DIR}/x-ui-firstboot.sh"
|
||||
install -m 644 /tmp/firstboot/x-ui-firstboot.service /etc/systemd/system/x-ui-firstboot.service
|
||||
|
||||
systemctl daemon-reload
|
||||
# Enable (start on next boot) but do NOT start now — there is no DB yet.
|
||||
systemctl enable x-ui-firstboot.service
|
||||
systemctl enable x-ui.service
|
||||
|
||||
# Belt-and-braces: ensure no DB / sentinel was created during provisioning.
|
||||
rm -f /etc/x-ui/x-ui.db /etc/x-ui/x-ui.db-* /etc/x-ui/.firstboot-done 2> /dev/null || true
|
||||
|
||||
echo "[provision] done — panel installed, services enabled, NO database initialized."
|
||||
@@ -0,0 +1,109 @@
|
||||
// Input variables for the 3x-ui golden-image build.
|
||||
// See README.md for usage. Override with -var / -var-file or env (PKR_VAR_*).
|
||||
|
||||
variable "xui_version" {
|
||||
type = string
|
||||
description = "3x-ui release tag to install, e.g. v3.3.1. 'latest' resolves the newest GitHub release at build time."
|
||||
default = "latest"
|
||||
}
|
||||
|
||||
variable "xui_arch" {
|
||||
type = string
|
||||
description = "CPU architecture to build for: amd64 or arm64."
|
||||
default = "amd64"
|
||||
validation {
|
||||
condition = contains(["amd64", "arm64"], var.xui_arch)
|
||||
error_message = "The xui_arch value must be 'amd64' or 'arm64'."
|
||||
}
|
||||
}
|
||||
|
||||
variable "ubuntu_version" {
|
||||
type = string
|
||||
description = "Ubuntu LTS version label, used only for image naming/tags."
|
||||
default = "24.04"
|
||||
}
|
||||
|
||||
// --- amazon-ebs (AMI) ---------------------------------------------------------
|
||||
|
||||
variable "region" {
|
||||
type = string
|
||||
description = "AWS region the AMI is built in."
|
||||
default = "eu-central-1"
|
||||
}
|
||||
|
||||
variable "instance_type" {
|
||||
type = string
|
||||
description = "EC2 instance type used to build the AMI. Must match xui_arch (e.g. t3.small for amd64, t4g.small for arm64/Graviton)."
|
||||
default = "t3.small"
|
||||
}
|
||||
|
||||
variable "ami_name_prefix" {
|
||||
type = string
|
||||
description = "Prefix for the produced AMI name."
|
||||
default = "3x-ui"
|
||||
}
|
||||
|
||||
variable "source_ami_filter_name" {
|
||||
type = string
|
||||
description = "Override for the Canonical Ubuntu base AMI name filter. Empty ⇒ derived from xui_arch (latest patched 24.04 LTS for that arch)."
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "ssh_username" {
|
||||
type = string
|
||||
description = "Default SSH user on the base Ubuntu cloud image."
|
||||
default = "ubuntu"
|
||||
}
|
||||
|
||||
// --- qemu (qcow2 / raw) -------------------------------------------------------
|
||||
|
||||
variable "qemu_iso_url" {
|
||||
type = string
|
||||
description = "Override for the Ubuntu cloud image used as the qemu base disk. Empty ⇒ derived from xui_arch (amd64/arm64 cloud image)."
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "qemu_iso_checksum" {
|
||||
type = string
|
||||
description = "Checksum for the qemu base disk. 'file:<SHA256SUMS url>' auto-fetches; 'none' skips verification."
|
||||
default = "file:https://cloud-images.ubuntu.com/releases/24.04/release/SHA256SUMS"
|
||||
}
|
||||
|
||||
variable "qemu_accelerator" {
|
||||
type = string
|
||||
description = "QEMU accelerator: 'kvm' when /dev/kvm is available, else 'tcg' (slow software emulation)."
|
||||
default = "kvm"
|
||||
}
|
||||
|
||||
variable "qemu_headless" {
|
||||
type = bool
|
||||
description = "Run QEMU without a display (required on CI runners)."
|
||||
default = true
|
||||
}
|
||||
|
||||
variable "qemu_build_password" {
|
||||
type = string
|
||||
description = "Temporary password injected via cloud-init for Packer's build-time SSH. Locked/removed before the image is finalized."
|
||||
default = "packer-build-temp-pw"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
# --- qemu arm64-only knobs (ignored for amd64) -------------------------------
|
||||
|
||||
variable "qemu_cpu" {
|
||||
type = string
|
||||
description = "QEMU -cpu model for arm64 builds: 'host' with KVM on an arm64 host, 'max' for TCG emulation."
|
||||
default = "host"
|
||||
}
|
||||
|
||||
variable "qemu_efi_code" {
|
||||
type = string
|
||||
description = "Path to the arm64 UEFI code firmware (AAVMF). Only used when xui_arch=arm64."
|
||||
default = "/usr/share/AAVMF/AAVMF_CODE.fd"
|
||||
}
|
||||
|
||||
variable "qemu_efi_vars" {
|
||||
type = string
|
||||
description = "Path to the arm64 UEFI vars firmware template (AAVMF). Only used when xui_arch=arm64."
|
||||
default = "/usr/share/AAVMF/AAVMF_VARS.fd"
|
||||
}
|
||||
@@ -0,0 +1,160 @@
|
||||
// 3x-ui golden image — one build, two sources:
|
||||
// * amazon-ebs : produces an AWS AMI (Marketplace-scannable)
|
||||
// * qemu : produces a qcow2 (+ raw) for Hetzner/DO/Vultr/GCP/Azure/Oracle
|
||||
//
|
||||
// The image ships WITHOUT an initialized x-ui.db and WITHOUT any baked
|
||||
// credentials. deploy/firstboot/x-ui-firstboot.{sh,service} generates unique
|
||||
// per-instance credentials on first boot, before x-ui.service starts.
|
||||
//
|
||||
// Provisioner order is fixed: provision.sh -> harden.sh -> cleanup.sh.
|
||||
|
||||
packer {
|
||||
required_plugins {
|
||||
amazon = {
|
||||
version = ">= 1.3.0"
|
||||
source = "github.com/hashicorp/amazon"
|
||||
}
|
||||
qemu = {
|
||||
version = ">= 1.1.0"
|
||||
source = "github.com/hashicorp/qemu"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
locals {
|
||||
build_stamp = formatdate("YYYYMMDD-hhmmss", timestamp())
|
||||
image_name = "${var.ami_name_prefix}-ubuntu-${var.ubuntu_version}-${var.xui_arch}"
|
||||
is_arm = var.xui_arch == "arm64"
|
||||
|
||||
# Base images are derived from xui_arch unless explicitly overridden.
|
||||
source_ami_name = var.source_ami_filter_name != "" ? var.source_ami_filter_name : "ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-${var.xui_arch}-server-*"
|
||||
qemu_iso_url = var.qemu_iso_url != "" ? var.qemu_iso_url : "https://cloud-images.ubuntu.com/releases/24.04/release/ubuntu-24.04-server-cloudimg-${var.xui_arch}.img"
|
||||
}
|
||||
|
||||
source "amazon-ebs" "x-ui" {
|
||||
region = var.region
|
||||
instance_type = var.instance_type
|
||||
ssh_username = var.ssh_username
|
||||
|
||||
ami_name = "${local.image_name}-${var.xui_version}-${local.build_stamp}"
|
||||
ami_description = "3x-ui panel on Ubuntu ${var.ubuntu_version}. Per-instance credentials are generated on first boot."
|
||||
|
||||
source_ami_filter {
|
||||
filters = {
|
||||
name = local.source_ami_name
|
||||
root-device-type = "ebs"
|
||||
virtualization-type = "hvm"
|
||||
}
|
||||
owners = ["099720109477"] // Canonical
|
||||
most_recent = true
|
||||
}
|
||||
|
||||
launch_block_device_mappings {
|
||||
device_name = "/dev/sda1"
|
||||
volume_size = 8
|
||||
volume_type = "gp3"
|
||||
delete_on_termination = true
|
||||
}
|
||||
|
||||
tags = {
|
||||
Name = local.image_name
|
||||
Project = "3x-ui"
|
||||
XuiVersion = var.xui_version
|
||||
BuildTool = "packer"
|
||||
BaseOS = "ubuntu-${var.ubuntu_version}"
|
||||
}
|
||||
}
|
||||
|
||||
source "qemu" "x-ui" {
|
||||
iso_url = local.qemu_iso_url
|
||||
iso_checksum = var.qemu_iso_checksum
|
||||
disk_image = true
|
||||
disk_size = "10G"
|
||||
format = "qcow2"
|
||||
|
||||
accelerator = var.qemu_accelerator
|
||||
headless = var.qemu_headless
|
||||
cpus = 2
|
||||
memory = 2048
|
||||
net_device = "virtio-net"
|
||||
disk_interface = "virtio"
|
||||
|
||||
// Arch-specific QEMU machine. amd64 uses Packer defaults (BIOS boot, x86_64);
|
||||
// arm64 needs the aarch64 binary, the 'virt' machine and UEFI (AAVMF) firmware.
|
||||
qemu_binary = local.is_arm ? "qemu-system-aarch64" : null
|
||||
machine_type = local.is_arm ? "virt" : null
|
||||
efi_boot = local.is_arm
|
||||
efi_firmware_code = local.is_arm ? var.qemu_efi_code : null
|
||||
efi_firmware_vars = local.is_arm ? var.qemu_efi_vars : null
|
||||
qemuargs = local.is_arm ? [["-cpu", var.qemu_cpu]] : []
|
||||
|
||||
output_directory = "output-qemu"
|
||||
vm_name = "${local.image_name}.qcow2"
|
||||
|
||||
// Build-time access: a NoCloud seed sets a temporary password for the default
|
||||
// user so Packer can SSH in. The seed is a separate CD-ROM (not part of the
|
||||
// output disk); the password is locked by harden.sh and state wiped by cleanup.sh.
|
||||
cd_label = "cidata"
|
||||
cd_content = {
|
||||
"meta-data" = ""
|
||||
"user-data" = <<-EOT
|
||||
#cloud-config
|
||||
password: ${var.qemu_build_password}
|
||||
chpasswd: { expire: false }
|
||||
ssh_pwauth: true
|
||||
EOT
|
||||
}
|
||||
|
||||
ssh_username = var.ssh_username
|
||||
ssh_password = var.qemu_build_password
|
||||
ssh_timeout = "20m"
|
||||
boot_wait = "45s"
|
||||
|
||||
shutdown_command = "sudo shutdown -P now"
|
||||
}
|
||||
|
||||
build {
|
||||
name = "3x-ui"
|
||||
sources = ["source.amazon-ebs.x-ui", "source.qemu.x-ui"]
|
||||
|
||||
// Upload the first-boot unit + script so provision.sh can install them.
|
||||
provisioner "shell" {
|
||||
inline = ["mkdir -p /tmp/firstboot"]
|
||||
}
|
||||
provisioner "file" {
|
||||
source = "${path.root}/../firstboot/x-ui-firstboot.sh"
|
||||
destination = "/tmp/firstboot/x-ui-firstboot.sh"
|
||||
}
|
||||
provisioner "file" {
|
||||
source = "${path.root}/../firstboot/x-ui-firstboot.service"
|
||||
destination = "/tmp/firstboot/x-ui-firstboot.service"
|
||||
}
|
||||
|
||||
provisioner "shell" {
|
||||
environment_vars = [
|
||||
"XUI_VERSION=${var.xui_version}",
|
||||
"XUI_ARCH=${var.xui_arch}",
|
||||
"DEBIAN_FRONTEND=noninteractive",
|
||||
]
|
||||
execute_command = "chmod +x {{ .Path }}; sudo -E bash {{ .Path }}"
|
||||
scripts = [
|
||||
"${path.root}/scripts/provision.sh",
|
||||
"${path.root}/scripts/harden.sh",
|
||||
"${path.root}/scripts/cleanup.sh",
|
||||
]
|
||||
// give cloud-init time to release apt locks on the very first boot
|
||||
pause_before = "10s"
|
||||
}
|
||||
|
||||
// Convert the qcow2 to raw for clouds that need it (qemu source only).
|
||||
post-processor "shell-local" {
|
||||
only = ["qemu.x-ui"]
|
||||
inline = ["qemu-img convert -p -O raw output-qemu/${local.image_name}.qcow2 output-qemu/${local.image_name}.raw"]
|
||||
}
|
||||
|
||||
// Record the AMI id / artifacts for CI to surface.
|
||||
post-processor "manifest" {
|
||||
output = "packer-manifest.json"
|
||||
strip_path = true
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user