feat(cloudflare): 新增 Cloudflare 隧道独立模块并发布 v1.6.0

internal/cloudflared/config.go

@@ -0,0 +1,145 @@
+package cloudflared
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+)
+
+type tokenPayload struct {
+	AccountTag   string `json:"a"`
+	TunnelID     string `json:"t"`
+	TunnelSecret string `json:"s"`
+}
+
+// DecodeToken 解析 Cloudflare Tunnel token；兼容 a/t/s 与 AccountTag/TunnelID/TunnelSecret 两种字段名。
+func DecodeToken(token string) (accountTag, tunnelID, tunnelSecret string, err error) {
+	clean := strings.NewReplacer("\n", "", "\r", "", " ", "", "\t", "").Replace(strings.TrimSpace(token))
+	if clean == "" {
+		return "", "", "", fmt.Errorf("token 为空")
+	}
+	if remainder := len(clean) % 4; remainder != 0 {
+		clean += strings.Repeat("=", 4-remainder)
+	}
+	raw, err := base64.StdEncoding.DecodeString(clean)
+	if err != nil {
+		return "", "", "", fmt.Errorf("token base64 解码失败: %w", err)
+	}
+	var payload tokenPayload
+	if err := json.Unmarshal(raw, &payload); err != nil || payload.TunnelID == "" {
+		var alt struct {
+			AccountTag   string `json:"AccountTag"`
+			TunnelID     string `json:"TunnelID"`
+			TunnelSecret string `json:"TunnelSecret"`
+		}
+		if err2 := json.Unmarshal(raw, &alt); err2 != nil {
+			return "", "", "", fmt.Errorf("token JSON 解析失败: %w", err)
+		}
+		payload.AccountTag, payload.TunnelID, payload.TunnelSecret = alt.AccountTag, alt.TunnelID, alt.TunnelSecret
+	}
+	if payload.AccountTag == "" || payload.TunnelID == "" || payload.TunnelSecret == "" {
+		return "", "", "", fmt.Errorf("token 缺少 AccountTag / TunnelID / TunnelSecret")
+	}
+	return payload.AccountTag, payload.TunnelID, payload.TunnelSecret, nil
+}
+
+// CredentialsJSON 生成 cloudflared 需要的 creds.json 内容。
+func CredentialsJSON(accountTag, tunnelID, tunnelSecret string) string {
+	data, _ := json.MarshalIndent(map[string]string{
+		"AccountTag":   accountTag,
+		"TunnelID":     tunnelID,
+		"TunnelSecret": tunnelSecret,
+	}, "", "  ")
+	return string(data)
+}
+
+// BuildConfig 生成 locally-managed 的 config.yml；ingress 末条由调用方保证是 catch-all。
+func BuildConfig(tunnelID, credsPath string, network NetworkSettings, ingress []IngressRule) string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "tunnel: %s\n", tunnelID)
+	fmt.Fprintf(&b, "credentials-file: %s\n\n", credsPath)
+	writeNetworkSection(&b, network)
+	b.WriteString("ingress:\n")
+	for _, rule := range ingress {
+		if rule.Hostname != "" {
+			fmt.Fprintf(&b, "  - hostname: %s\n", rule.Hostname)
+			fmt.Fprintf(&b, "    service: %s\n", rule.Service)
+			continue
+		}
+		fmt.Fprintf(&b, "  - service: %s\n", rule.Service)
+	}
+	return b.String()
+}
+
+func writeNetworkSection(b *strings.Builder, network NetworkSettings) {
+	protocol := strings.TrimSpace(network.TransportProtocol)
+	edge := strings.TrimSpace(network.EdgeIPVersion)
+	hasOrigin := strings.TrimSpace(network.OriginCAPool) != "" || network.NoTLSVerify || strings.TrimSpace(network.HTTPHostHeader) != ""
+	if protocol != "" && protocol != "auto" {
+		fmt.Fprintf(b, "protocol: %s\n", protocol)
+	}
+	if edge != "" && edge != "auto" {
+		fmt.Fprintf(b, "edge-ip-version: \"%s\"\n", edge)
+	}
+	if network.HAConnections > 0 {
+		fmt.Fprintf(b, "ha-connections: %d\n", network.HAConnections)
+	}
+	if hasOrigin {
+		b.WriteString("originRequest:\n")
+		if pool := strings.TrimSpace(network.OriginCAPool); pool != "" {
+			fmt.Fprintf(b, "  caPool: %s\n", pool)
+		}
+		if network.NoTLSVerify {
+			b.WriteString("  noTLSVerify: true\n")
+		}
+		if header := strings.TrimSpace(network.HTTPHostHeader); header != "" {
+			fmt.Fprintf(b, "  httpHostHeader: %s\n", header)
+		}
+	}
+	if protocol != "" || edge != "" || network.HAConnections > 0 || hasOrigin {
+		b.WriteString("\n")
+	}
+}
+
+// BuildIngress 从域名列表生成 ingress，锁定三条不变式：末条 catch-all、去重、稳定排序。
+func BuildIngress(hostnames []string, service string) []IngressRule {
+	seen := map[string]bool{}
+	cleaned := make([]string, 0, len(hostnames))
+	for _, host := range hostnames {
+		host = strings.ToLower(strings.TrimSpace(host))
+		if host == "" || seen[host] {
+			continue
+		}
+		seen[host] = true
+		cleaned = append(cleaned, host)
+	}
+	sort.Strings(cleaned)
+	out := make([]IngressRule, 0, len(cleaned)+1)
+	for _, host := range cleaned {
+		out = append(out, IngressRule{Hostname: host, Service: service})
+	}
+	return append(out, IngressRule{Service: "http_status:404"})
+}
+
+// NormalizeService 生成回源 service；localhost 归一化为 127.0.0.1。
+func NormalizeService(protocol, host string, port int) string {
+	host = strings.TrimSpace(host)
+	if host == "localhost" {
+		host = "127.0.0.1"
+	}
+	return fmt.Sprintf("%s://%s:%d", protocol, host, port)
+}
+
+// MaskSecret 只保留首尾少量字符，用于 API 回显与日志。
+func MaskSecret(value string) string {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return ""
+	}
+	if len(value) <= 8 {
+		return "********"
+	}
+	return value[:4] + "********" + value[len(value)-4:]
+}