Add tunnel installer security envs

apps/aether-tunnel/.env.example

@@ -7,6 +7,10 @@ AETHER_TUNNEL_MANAGEMENT_TOKEN=ae_xxxxx
 # Node identification
 AETHER_TUNNEL_NODE_NAME=jp-proxy-01
 
+# Secure non-TLS tunnel MVP. Use non_tls_required only with a per-node base64 32-byte PSK.
+AETHER_TUNNEL_SECURITY=off
+# AETHER_TUNNEL_ENCRYPTION_KEY=base64-32-bytes
+
 # Maximum request body buffered for 307/308 replay (supports K/M/G, 0 disables body replay buffering)
 AETHER_TUNNEL_REDIRECT_REPLAY_BUDGET_BYTES=5M
 

apps/aether-tunnel/install.ps1

@@ -105,7 +105,7 @@ function Test-ServerExists([string]$Path, [string]$QuotedUrl, [string]$QuotedNam
   return ($FoundUrl -and $FoundName)
 }
 
-function Add-ServerConfig([string]$AetherUrl, [string]$ManagementToken, [string]$NodeName) {
+function Add-ServerConfig([string]$AetherUrl, [string]$ManagementToken, [string]$NodeName, [string]$TunnelSecurity, [string]$TunnelEncryptionKey) {
   $ConfigDir = Split-Path -Parent $script:ConfigPath
   New-Item -ItemType Directory -Force -Path $ConfigDir | Out-Null
 
@@ -116,6 +116,8 @@ function Add-ServerConfig([string]$AetherUrl, [string]$ManagementToken, [string]
   $QuotedUrl = ConvertTo-TomlQuotedString $AetherUrl
   $QuotedToken = ConvertTo-TomlQuotedString $ManagementToken
   $QuotedName = ConvertTo-TomlQuotedString $NodeName
+  $QuotedTunnelSecurity = ConvertTo-TomlQuotedString $TunnelSecurity
+  $QuotedTunnelEncryptionKey = ConvertTo-TomlQuotedString $TunnelEncryptionKey
 
   if (Test-ServerExists $script:ConfigPath $QuotedUrl $QuotedName) {
     Say "Same aether_url + node_name already exists, skipping config append: $script:ConfigPath"
@@ -132,8 +134,12 @@ function Add-ServerConfig([string]$AetherUrl, [string]$ManagementToken, [string]
     '[[servers]]',
     "aether_url = $QuotedUrl",
     "management_token = $QuotedToken",
-    "node_name = $QuotedName"
+    "node_name = $QuotedName",
+    "tunnel_security = $QuotedTunnelSecurity"
   ) -join "`n"
+  if ($TunnelEncryptionKey) {
+    $Block += "`ntunnel_encryption_key = $QuotedTunnelEncryptionKey"
+  }
   Add-Content -Path $script:ConfigPath -Value ($Block + "`n") -Encoding UTF8
   Say "Appended [[servers]] to: $script:ConfigPath"
 }
@@ -143,13 +149,21 @@ function Main {
   $AetherUrl = Prompt-IfEmpty 'AETHER_TUNNEL_AETHER_URL' $env:AETHER_TUNNEL_AETHER_URL 'Aether URL'
   $ManagementToken = Prompt-IfEmpty 'AETHER_TUNNEL_MANAGEMENT_TOKEN' $env:AETHER_TUNNEL_MANAGEMENT_TOKEN 'Management token (ae_xxx)'
   $NodeName = Prompt-IfEmpty 'AETHER_TUNNEL_NODE_NAME' $env:AETHER_TUNNEL_NODE_NAME 'Node name'
+  $TunnelSecurity = if ($env:AETHER_TUNNEL_SECURITY) { $env:AETHER_TUNNEL_SECURITY } else { 'off' }
+  $TunnelEncryptionKey = if ($env:AETHER_TUNNEL_ENCRYPTION_KEY) { $env:AETHER_TUNNEL_ENCRYPTION_KEY } else { '' }
+  if ($TunnelSecurity -notin @('off', 'non_tls_required')) {
+    Fail 'AETHER_TUNNEL_SECURITY must be off or non_tls_required'
+  }
+  if (($TunnelSecurity -eq 'non_tls_required') -and -not $TunnelEncryptionKey) {
+    Fail 'AETHER_TUNNEL_ENCRYPTION_KEY is required when AETHER_TUNNEL_SECURITY=non_tls_required'
+  }
 
   $TempDir = Join-Path ([IO.Path]::GetTempPath()) ("aether-tunnel-" + [Guid]::NewGuid().ToString('N'))
   New-Item -ItemType Directory -Force -Path $TempDir | Out-Null
   try {
     $Tag = Resolve-LatestTunnelTag
     Install-AetherTunnelBinary $Tag $TempDir
-    Add-ServerConfig $AetherUrl $ManagementToken $NodeName
+    Add-ServerConfig $AetherUrl $ManagementToken $NodeName $TunnelSecurity $TunnelEncryptionKey
   } finally {
     Remove-Item -Recurse -Force $TempDir -ErrorAction SilentlyContinue
   }

apps/aether-tunnel/install.sh

@@ -186,11 +186,15 @@ append_server_config() {
   aether_url="$1"
   management_token="$2"
   node_name="$3"
+  tunnel_security="$4"
+  tunnel_encryption_key="$5"
 
   mkdir -p "$(dirname "$CONFIG_PATH")"
   quoted_url=$(toml_quote "$aether_url")
   quoted_token=$(toml_quote "$management_token")
   quoted_name=$(toml_quote "$node_name")
+  quoted_security=$(toml_quote "$tunnel_security")
+  quoted_encryption_key=$(toml_quote "$tunnel_encryption_key")
 
   if has_legacy_single_server_keys; then
     fail "现有配置仍使用旧的顶层 aether_url/management_token，请先运行 aether-tunnel setup 迁移为 [[servers]] 后重试：$CONFIG_PATH"
@@ -214,6 +218,10 @@ append_server_config() {
     printf 'aether_url = %s\n' "$quoted_url"
     printf 'management_token = %s\n' "$quoted_token"
     printf 'node_name = %s\n' "$quoted_name"
+    printf 'tunnel_security = %s\n' "$quoted_security"
+    if [ -n "$tunnel_encryption_key" ]; then
+      printf 'tunnel_encryption_key = %s\n' "$quoted_encryption_key"
+    fi
   } >> "$CONFIG_PATH"
   chmod 600 "$CONFIG_PATH" 2>/dev/null || true
   say "已追加 [[servers]] 到：$CONFIG_PATH"
@@ -227,12 +235,21 @@ main() {
   aether_url=$(prompt_if_empty AETHER_TUNNEL_AETHER_URL "${AETHER_TUNNEL_AETHER_URL:-}" "Aether URL: ")
   management_token=$(prompt_if_empty AETHER_TUNNEL_MANAGEMENT_TOKEN "${AETHER_TUNNEL_MANAGEMENT_TOKEN:-}" "Management token (ae_xxx): ")
   node_name=$(prompt_if_empty AETHER_TUNNEL_NODE_NAME "${AETHER_TUNNEL_NODE_NAME:-}" "Node name: ")
+  tunnel_security="${AETHER_TUNNEL_SECURITY:-off}"
+  tunnel_encryption_key="${AETHER_TUNNEL_ENCRYPTION_KEY:-}"
+  case "$tunnel_security" in
+    off|non_tls_required) ;;
+    *) fail "AETHER_TUNNEL_SECURITY 必须是 off 或 non_tls_required" ;;
+  esac
+  if [ "$tunnel_security" = "non_tls_required" ] && [ -z "$tunnel_encryption_key" ]; then
+    fail "AETHER_TUNNEL_SECURITY=non_tls_required 时必须设置 AETHER_TUNNEL_ENCRYPTION_KEY"
+  fi
 
   tag=$(resolve_latest_tunnel_tag)
   [ -n "$tag" ] || fail "没有找到可用的 tunnel-v* release"
   asset=$(detect_asset)
   install_binary "$tag" "$asset"
-  append_server_config "$aether_url" "$management_token" "$node_name"
+  append_server_config "$aether_url" "$management_token" "$node_name" "$tunnel_security" "$tunnel_encryption_key"
 
   say "完成。运行以下命令启动/配置服务："
   say "  $INSTALL_DIR/aether-tunnel setup $CONFIG_PATH"