i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-02 09:20:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

Document tunnel security MVP config

Browse Source
This commit is contained in:
RWDai
2026-05-21 16:09:38 +08:00
parent 888414c41b
commit 4f49dd5943
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
apps/aether-tunnel/README.md
View File

@@ -53,6 +53,7 @@ curl -fsSL https://raw.githubusercontent.com/fawney19/Aether/main/apps/aether-tu
AETHER_TUNNEL_AETHER_URL="https://aether.example.com" \ AETHER_TUNNEL_AETHER_URL="https://aether.example.com" \
AETHER_TUNNEL_MANAGEMENT_TOKEN="ae_xxx" \ AETHER_TUNNEL_MANAGEMENT_TOKEN="ae_xxx" \
AETHER_TUNNEL_NODE_NAME="jp-proxy-01" \ AETHER_TUNNEL_NODE_NAME="jp-proxy-01" \
AETHER_TUNNEL_SECURITY="off" \
sh sh
``` ```
@@ -60,6 +61,7 @@ curl -fsSL https://raw.githubusercontent.com/fawney19/Aether/main/apps/aether-tu
$env:AETHER_TUNNEL_AETHER_URL = "https://aether.example.com" $env:AETHER_TUNNEL_AETHER_URL = "https://aether.example.com"
$env:AETHER_TUNNEL_MANAGEMENT_TOKEN = "ae_xxx" $env:AETHER_TUNNEL_MANAGEMENT_TOKEN = "ae_xxx"
$env:AETHER_TUNNEL_NODE_NAME = "jp-proxy-01" $env:AETHER_TUNNEL_NODE_NAME = "jp-proxy-01"
$env:AETHER_TUNNEL_SECURITY = "off"
irm https://raw.githubusercontent.com/fawney19/Aether/main/apps/aether-tunnel/install.ps1 | iex irm https://raw.githubusercontent.com/fawney19/Aether/main/apps/aether-tunnel/install.ps1 | iex
``` ```
@@ -111,6 +113,8 @@ sudo aether-tunnel uninstall
| `--aether-url` | `AETHER_TUNNEL_AETHER_URL` | **必填** | Aether 服务器地址 | | `--aether-url` | `AETHER_TUNNEL_AETHER_URL` | **必填** | Aether 服务器地址 |
| `--management-token` | `AETHER_TUNNEL_MANAGEMENT_TOKEN` | **必填** | 管理员 Token（`ae_xxx` 格式） | | `--management-token` | `AETHER_TUNNEL_MANAGEMENT_TOKEN` | **必填** | 管理员 Token（`ae_xxx` 格式） |
| `--node-name` | `AETHER_TUNNEL_NODE_NAME` | **必填** | 节点名称标识 | | `--node-name` | `AETHER_TUNNEL_NODE_NAME` | **必填** | 节点名称标识 |
| `--tunnel-security` | `AETHER_TUNNEL_SECURITY` | `off` | Aether ↔ tunnel 通道安全模式；MVP 仅支持 `off` / `non_tls_required` |
| `--tunnel-encryption-key` | `AETHER_TUNNEL_ENCRYPTION_KEY` | 空 | `non_tls_required` 使用的长期 PSK（base64 32-byte），每个 `[[servers]]` 节点独立配置 |
| `--public-ip` | `AETHER_TUNNEL_PUBLIC_IP` | 自动检测 | 公网 IP | | `--public-ip` | `AETHER_TUNNEL_PUBLIC_IP` | 自动检测 | 公网 IP |
| `--node-region` | `AETHER_TUNNEL_NODE_REGION` | 自动检测 | 地区标识 | | `--node-region` | `AETHER_TUNNEL_NODE_REGION` | 自动检测 | 地区标识 |
| `--heartbeat-interval` | `AETHER_TUNNEL_HEARTBEAT_INTERVAL` | `5` | 心跳间隔（秒） | | `--heartbeat-interval` | `AETHER_TUNNEL_HEARTBEAT_INTERVAL` | `5` | 心跳间隔（秒） |
@@ -216,13 +220,18 @@ tunnel 会在心跳兼容字段 `proxy_metadata` 中主动上报隧道稳定性
aether_url = "https://aether-1.example.com" aether_url = "https://aether-1.example.com"
management_token = "ae_xxx" management_token = "ae_xxx"
node_name = "jp-proxy-01" node_name = "jp-proxy-01"
tunnel_security = "off"
[[servers]] [[servers]]
aether_url = "https://aether-2.example.com" aether_url = "http://aether-2.example.com"
management_token = "ae_yyy" management_token = "ae_yyy"
node_name = "jp-proxy-02" node_name = "jp-proxy-02"
tunnel_security = "non_tls_required"
tunnel_encryption_key = "base64-32-bytes"
``` ```
`tunnel_security = "non_tls_required"` 是非 TLS secure tunnel 的 MVP 配置面：它要求同时提供当前 `[[servers]]` 条目的 `tunnel_encryption_key`，后续握手使用 `node_name` / `X-Node-Id` 查找对应 PSK，不引入 `tunnel_encryption_key_id`。`wss://` 仍是推荐方案；`ws:// + secure tunnel` 只保护 Aether ↔ tunnel 之间的 token 和 payload，不等价于 HTTPS 伪装，也不覆盖 tunnel ↔ origin/provider 这段链路。
## 发布新版本 ## 发布新版本
推送 `tunnel-v*` 格式的 tag，GitHub Actions 会自动： 推送 `tunnel-v*` 格式的 tag，GitHub Actions 会自动：