feat(cert,scripts,docs): Linux 原生安装包与证书申请三处修复（DNS 解析器 / Buypass 下线 / ZeroSSL 报错与密钥脱敏）（v1.2.13）
- Linux 安装包：scripts/build-linux.ps1 交叉编译出 fonu-<版本>-linux-{amd64,arm64}.tar.gz（二进制 + migrations + systemd 安装脚本 + 运行时资源 + sha256），scripts/fonu-install.sh 负责装机（/opt/fonu、/var/lib/fonu、/etc/fonu/fonu.env 首次生成随机会话密钥）并新增 --reset-admin；装完直接打印初始管理员口令
- 证书 DNS-01：lego 默认读系统 resolv.conf（容器里是 Docker 的 127.0.0.11，不返回权威 NS）导致 could not determine authoritative nameservers；现显式传 AddRecursiveNameservers，默认 223.5.5.5/1.1.1.1/8.8.8.8，设置项 acme_dns_resolvers 可覆盖（system = 回到系统解析器）
- Buypass 已停止签发（2025-10-15）并终止服务（2026-04-15）：从可选 CA 移除，历史记录仍可展示，直接提交会被拦下并给出中文原因
- ZeroSSL：422 时带出 error.type/error.code（非 JSON 退回截断正文）；同时修掉网络错误把含 access_key 的完整 URL 写进任务日志与 app.log 的密钥泄露
- 测试：解析器列表解析 3 例 + ZeroSSL EAB 4 例（含不泄露密钥断言）；gofmt / go build / go vet / go test 全绿
This commit is contained in:
@@ -216,8 +216,8 @@
|
||||
<p v-if="applyCA === 'zerossl' && !zerosslApiKey" class="ca-hint ca-hint--warn">
|
||||
使用 ZeroSSL 需在「设置」中配置 API Key
|
||||
</p>
|
||||
<p v-if="applyCA === 'buypass'" class="ca-hint">
|
||||
Buypass 不支持通配符，单张证书最多 5 个域名
|
||||
<p v-if="applyCA === 'buypass'" class="ca-hint ca-hint--warn">
|
||||
Buypass 已于 2025-10-15 停止签发证书，请改选 Let's Encrypt 或 ZeroSSL
|
||||
</p>
|
||||
</div>
|
||||
</n-form-item>
|
||||
|
||||
@@ -69,7 +69,7 @@
|
||||
<div class="settings-field">
|
||||
<div class="settings-field__label">ACME 邮箱</div>
|
||||
<n-input v-model:value="acmeEmail" placeholder="admin@example.com" />
|
||||
<p class="field-hint">用于 Let's Encrypt / ZeroSSL / Buypass 账户注册</p>
|
||||
<p class="field-hint">用于 Let's Encrypt / ZeroSSL 账户注册</p>
|
||||
</div>
|
||||
<ConfiguredSecretField
|
||||
v-model="zerosslApiKey"
|
||||
@@ -78,6 +78,16 @@
|
||||
placeholder="申请 ZeroSSL 证书时填写"
|
||||
/>
|
||||
<p class="field-hint zerossl-key-hint">申请 ZeroSSL 证书时必填，可在 ZeroSSL 控制台获取</p>
|
||||
<div class="settings-field">
|
||||
<div class="settings-field__label">DNS 解析器（高级）</div>
|
||||
<n-input v-model:value="acmeResolvers" placeholder="223.5.5.5:53, 1.1.1.1:53" />
|
||||
<p class="field-hint">
|
||||
DNS-01 验证时用它查域名的权威 NS 记录。容器里的系统解析器通常指向 Docker 的
|
||||
127.0.0.11，不返回 NS，于是报「could not determine authoritative nameservers」；
|
||||
所以默认用公共解析器。留空 = 用默认值；填 system = 回到系统解析器；
|
||||
多个用逗号分隔，不写端口默认 53。
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</FonuCard>
|
||||
|
||||
@@ -1015,6 +1025,7 @@ const ddnsInterval = ref(5)
|
||||
const certThreshold = ref(30)
|
||||
const logRetention = ref(30)
|
||||
const acmeEmail = ref('')
|
||||
const acmeResolvers = ref('')
|
||||
const zerosslApiKey = ref('')
|
||||
const zerosslHasKey = ref(false)
|
||||
const trustedProxyEnabled = ref(false)
|
||||
@@ -1108,6 +1119,7 @@ function applySettingsToForm(settings: Record<string, string>) {
|
||||
statusPageCode.value = settings.status_page_code ?? ''
|
||||
statusPageConfigured.value = statusPageCode.value === MASKED_SECRET
|
||||
acmeEmail.value = settings.acme_email ?? ''
|
||||
acmeResolvers.value = settings.acme_dns_resolvers ?? ''
|
||||
zerosslHasKey.value = Boolean(settings.zerossl_api_key?.trim())
|
||||
zerosslApiKey.value = ''
|
||||
chinaCIDRHours.value = Number(settings.china_cidr_update_interval_hours ?? 24)
|
||||
@@ -1579,6 +1591,7 @@ function buildSavePayload() {
|
||||
cert_renew_threshold_days: String(certThreshold.value),
|
||||
log_retention_days: String(logRetention.value),
|
||||
acme_email: acmeEmail.value.trim(),
|
||||
acme_dns_resolvers: acmeResolvers.value.trim(),
|
||||
trusted_proxy_json: buildTrustedProxyJSON(),
|
||||
global_ip_blacklist: buildGlobalIPListJSON(globalIPBlacklistText.value),
|
||||
global_ip_whitelist: buildGlobalWhitelistJSON(),
|
||||
|
||||
Reference in New Issue
Block a user