diff options
Diffstat (limited to 'scripts/system.sh')
| -rw-r--r-- | scripts/system.sh | 122 |
1 files changed, 122 insertions, 0 deletions
diff --git a/scripts/system.sh b/scripts/system.sh new file mode 100644 index 0000000..31864b9 --- /dev/null +++ b/scripts/system.sh @@ -0,0 +1,122 @@ +#/bin/bash + +# 脏标记：0=不需要重建 UKI，1=需要 +MKINITCPIO=0 + +setup_vconsole_font() { + sudo sed -i 's/^\(FONT=.*\)$/# \1\nFONT=ter-132n/' /etc/vconsole.conf + + sudo cp /etc/kernel/cmdline /etc/kernel/cmdline.bak + sudo sed -i 's/$/ fbcon=font:TER16x32/' /etc/kernel/cmdline + + sudo cp /boot/loader/loader.conf /boot/loader/loader.conf.bak + sudo sed -i -e '/^[[:space:]]*#\?[[:space:]]*console-mode/d' /boot/loader/loader.conf + echo 'console-mode 1' | sudo tee -a /boot/loader/loader.conf >/dev/null + + # 标记需要重建 + MKINITCPIO=1 +} + +setup_shadowsocks() { + sudo cat > /etc/shadowsocks-rust/s.json <<EOF +{ + "server": "x.xxx", + "server_port": 1111, + "password": "xxxxxxxxxxxxxxxx", + "timeout": 300, + "method": "aes-256-gcm", + "locals": [ + { + "local_address": "127.0.0.1", + "local_port": 1080 + }, + { + "local_address": "127.0.0.1", + "local_port": 3128, + "protocol": "http" + } + ] +} +EOF + + sudo systemctl enable --now shadowsocks-rust@s +} + +setup_dae() { + sudo cat > /etc/dae/config.dae <<EOF +global { + wan_interface: auto + auto_config_kernel_parameter: true + log_level: info + + # Keep the original domain when dialing through the proxy. This also makes + # domain-based routing independent from the IP returned by the local DNS. + dial_mode: domain + allow_insecure: false +} + +# Reuse the local Shadowsocks SOCKS5 listener instead of duplicating the +# remote server address and password in this configuration. +node { + # local_ss: 'socks5://127.0.0.1:8888' + + # Direct Shadowsocks node example using the SIP002 URI format. Replace the + # cipher, password, host, and port, then uncomment it. Base64 is encoding, + # not encryption, so keep the real link under secret/. + # example_ss: 'ss://YWVzLTEyOC1nY206dGVzdA@example.com:8388#example-ss' + ss: 'ss://aes-256-gcm:xxxxxxxxxx@xxxx:1234' +} + +group { + proxy { + filter: name(ss) + policy: fixed(0) + } +} + +# Let dae observe DNS queries so that routing rules can match domain names. +dns { + upstream { + router: 'udp://192.168.8.1:53' + direct_dns: 'tcp+udp://223.5.5.5:53' + } + + routing { + request { + qname(suffix: l) -> router + qname(suffix: lan) -> router + fallback: direct_dns + } + + response { + fallback: accept + } + } +} + +routing { + # Shadowsocks must reach its remote server directly to avoid a proxy loop. + pname(sslocal) -> direct + + # Keep local, multicast, and other private destinations direct. + dip(224.0.0.0/3, 'ff00::/8') -> direct + dip(geoip:private) -> direct + + # Route mainland China IPs directly. Everything else uses the proxy, so + # overseas destinations do not need to be maintained in a domain list. + dip(geoip:cn) -> direct + + fallback: proxy +} +EOF +} + +setup_vconsole_font +setup_shadowsocks +setup_dae + +# 统一重建一次 +if [ "$MKINITCPIO" -eq 1 ]; then + echo ">>> mkinitcpio -P" + sudo mkinitcpio -P +fi
\ No newline at end of file |