feat(poJun-proxy): 添加 PoJun Worker 支持，生成代理节点 bundle 和相关配置

Author: No-Github

aliyun/proxy/README.md

@@ -2,9 +2,9 @@
 
 ## 场景说明
 
-该场景会在阿里云批量部署多台基于 shadowsocks-libev 的代理节点，默认创建 10 台抢占式 ECS，并通过 redc 插件链生成 Clash 配置。适合快速拿到一组可批量接入的代理出口。
+该场景会在阿里云批量部署多台基于 shadowsocks-libev 的代理节点，默认创建 10 台抢占式 ECS，并通过 redc 插件链生成 Clash 配置和供 PoJun Worker 消费的代理节点 bundle。适合快速拿到一组可批量接入的代理出口。
 
-部署完成后，你会得到节点公网 IP 列表、批量 SSH 连接命令，以及本地生成的 Clash 配置文件；如果已经配置 R2 上传能力，还可以把配置文件自动上传到 Cloudflare R2 后再分发使用。
+部署完成后，你会得到节点公网 IP 列表、批量 SSH 连接命令、本地生成的 Clash 配置文件，以及场景目录下自包含的 `pojun-proxy/bundle.json`；如果已经配置 R2 上传能力，还可以把 Clash 配置文件自动上传到 Cloudflare R2 后再分发使用。
 
 ## 前置条件
 
@@ -21,6 +21,7 @@ redc pull aliyun/proxy
 redc run aliyun/proxy
 redc run aliyun/proxy -e node=20
 redc status [uuid]
+redc status [uuid] -o json | jq '.plugin_outputs'
 redc stop [uuid]
 ```
 
@@ -54,6 +55,8 @@ redc run aliyun/proxy \
 - `ssh_user`：默认 SSH 用户名，当前为 `root`。
 - `ecs_password` / `ssh_password`：所有节点共用的 SSH 登录密码。
 - Clash 配置文件：由 `redc-plugin-clash-config` 根据 `port`、`password`、`filename` 生成；如果配置了 R2 上传，还会由上传插件进一步分发。
+- `pojun-proxy/bundle.json`：由 `redc-plugin-pojun-proxy` 生成的单个自包含文件，包含稳定代理池 ID、节点数、来源 Case、revision 和 Shadowsocks 节点数组，供后续 PoJun Worker 代理池适配使用。
+- `plugin_outputs`：`redc status [uuid] -o json` 中的独立对象，包含 `pojun_proxy_bundle_file`、`pojun_proxy_pool_id`、`pojun_proxy_node_count` 和 `pojun_proxy_revision`。
 
 ## 常见问题
 
@@ -70,6 +73,7 @@ redc run aliyun/proxy \
 - 模板在不同区域使用硬编码的实例规格与可用区：北京默认 `ecs.n1.tiny` / `cn-beijing-f`，东京默认 `ecs.t5-lc1m1.small` / `ap-northeast-1b`。
 - `main.tf` 中已启用 `spot_strategy = "SpotWithPriceLimit"`，因此节点稳定性和最终节点数量可能受市场价格与库存影响。
 - 默认安全组会放开全部 TCP 和 UDP 入站流量，部署后请按你的场景自行收紧。
+- macOS/Linux 上 `pojun-proxy` 目录权限为 `0700`，`bundle.json` 权限为 `0600`；Windows 使用当前用户 Case 目录继承的 ACL。该文件包含代理密码，不要上传到公开存储、提交到 Git 或粘贴到日志中。
 
 ## 附录
 

aliyun/proxy/README_EN.md

@@ -2,9 +2,9 @@
 
 ## Scene Description
 
-This scenario deploys multiple Shadowsocks-based proxy nodes on Aliyun, creates 10 spot ECS instances by default, and uses the redc plugin chain to generate a Clash configuration. It is suitable for quickly obtaining a batch of proxy exits that can be consumed together.
+This scenario deploys multiple Shadowsocks-based proxy nodes on Aliyun, creates 10 spot ECS instances by default, and uses the redc plugin chain to generate a Clash configuration and a proxy-node bundle for PoJun Workers. It is suitable for quickly obtaining a batch of proxy exits that can be consumed together.
 
-After deployment, you get the node public IP list, batch SSH commands, and a locally generated Clash configuration file. If R2 upload is configured, the config can also be uploaded automatically to Cloudflare R2 for distribution.
+After deployment, you get the node public IP list, batch SSH commands, a locally generated Clash configuration file, and a self-contained `pojun-proxy/bundle.json` under the case directory. If R2 upload is configured, the Clash config can also be uploaded automatically to Cloudflare R2 for distribution.
 
 ## Prerequisites
 
@@ -21,6 +21,7 @@ redc pull aliyun/proxy
 redc run aliyun/proxy
 redc run aliyun/proxy -e node=20
 redc status [uuid]
+redc status [uuid] -o json | jq '.plugin_outputs'
 redc stop [uuid]
 ```
 
@@ -54,6 +55,8 @@ redc run aliyun/proxy \
 - `ssh_user`: Default SSH username, currently `root`.
 - `ecs_password` / `ssh_password`: Shared SSH login password for all nodes.
 - Clash configuration file: Generated by `redc-plugin-clash-config` from `port`, `password`, and `filename`; if R2 upload is configured, the upload plugin can distribute it further.
+- `pojun-proxy/bundle.json`: A single self-contained file generated by `redc-plugin-pojun-proxy`; it records the stable pool ID, node count, source case, revision, and Shadowsocks nodes for the later PoJun Worker pool integration.
+- `plugin_outputs`: A separate object in `redc status [uuid] -o json`, containing `pojun_proxy_bundle_file`, `pojun_proxy_pool_id`, `pojun_proxy_node_count`, and `pojun_proxy_revision`.
 
 ## FAQ
 
@@ -70,6 +73,7 @@ redc run aliyun/proxy \
 - The template uses hard-coded instance mappings per region: Beijing uses `ecs.n1.tiny` in `cn-beijing-f`, and Tokyo uses `ecs.t5-lc1m1.small` in `ap-northeast-1b`.
 - `main.tf` enables `spot_strategy = "SpotWithPriceLimit"`, so stability and final node count can change with market price and capacity.
 - The default security group opens all inbound TCP and UDP traffic. Tighten the exposure after deployment if the nodes are not meant to remain fully exposed.
+- On macOS/Linux, the `pojun-proxy` directory is mode `0700` and `bundle.json` is mode `0600`; on Windows it inherits the current user's case-directory ACL. The bundle contains proxy passwords; do not upload it to public storage, commit it to Git, or paste it into logs.
 
 ## Appendix
 

aliyun/proxy/case.json

@@ -2,10 +2,10 @@
   "name": "proxy",
   "arch": "x86_64",
   "user": "r0fus0d",
-  "version": "1.2.9",
+  "version": "1.4.0",
   "description": "阿里云多节点代理场景，默认支持 10 台 spot ecs.n1.tiny 节点，shadowsocks-libev 搭建并可上传 clash/QuantumultX 配置到 Cloudflare R2",
   "description_en": "Aliyun multi-node proxy scenario with 10 spot ecs.n1.tiny nodes by default, shadowsocks-libev setup and supports uploading clash/QuantumultX configuration to Cloudflare R2",
-  "redc_plugins": "redc-plugin-clash-config,redc-plugin-quantumultx-config,redc-plugin-upload-r2",
+  "redc_plugins": "redc-plugin-clash-config,redc-plugin-quantumultx-config,redc-plugin-pojun-proxy,redc-plugin-upload-r2",
   "template": "preset",
   "tags": ["proxy"]
 }

plugins/redc-plugin-pojun-proxy/README.md

@@ -0,0 +1,61 @@
+# redc-plugin-pojun-proxy
+
+在代理场景部署成功后，为 PoJun Worker 生成私有、可校验的 Shadowsocks 代理节点 bundle。
+
+## 生成内容
+
+插件在场景目录下固定生成：
+
+```text
+pojun-proxy/
+└── bundle.json
+```
+
+- `bundle.json`：单个自包含文件，包含 schema 版本、稳定代理池 ID、来源 Case、规范化节点 revision 和 Mihomo/Clash 兼容的 Shadowsocks 节点数组；不包含本地监听、DNS、规则、控制端口或代理组。
+
+在 macOS/Linux 上目录权限为 `0700`，`bundle.json` 权限为 `0600`；Windows 使用当前用户 Case 目录继承的 ACL。该文件含代理密码，不应上传到公开存储、提交到 Git 或粘贴到日志中。
+
+## 依赖
+
+- redc `3.3.8` 或更高版本
+- 无额外命令行依赖；插件使用 redc 的 Go Template 引擎，可在 Windows、macOS 和 Linux 运行
+
+## 安装
+
+从插件市场安装，或在 redc-template 源码目录中安装本地版本：
+
+```bash
+redc plugin install ./plugins/redc-plugin-pojun-proxy
+```
+
+`aliyun/proxy` 模板已在 `case.json` 中声明该插件。场景在 Terraform apply 成功后会通过跨平台 `.tmpl` hook 自动生成 bundle。
+
+## 配置
+
+| 参数 | 类型 | 必填 | 说明 |
+|------|------|------|------|
+| `pool_id` | string | 否 | 稳定代理池 ID；留空时使用 `redc-<case-id>-aliyun-proxy`。仅允许字母、数字、`.`、`_`、`:`、`-`，最长 128 字符。 |
+
+节点地址来自 Terraform output `ecs_ip`，兼容 `public_ip`；端口和密码按以下优先级读取：
+
+1. 当前 Case 运行参数 `REDC_CASE_VARS`。
+2. 场景目录的 `terraform.tfvars`。
+
+加密算法固定为 `chacha20-ietf-poly1305`，与 `aliyun/proxy` 服务端配置保持一致。
+
+## 输出
+
+插件通过 redc 的结构化输出协议提供以下字段：
+
+| 字段 | 说明 |
+|------|------|
+| `pojun_proxy_bundle_file` | `bundle.json` 的绝对路径。 |
+| `pojun_proxy_pool_id` | 稳定代理池 ID。 |
+| `pojun_proxy_node_count` | bundle 中的节点数量。 |
+| `pojun_proxy_revision` | 规范化 `nodes` 数组的 SHA-256，也是后续同步的修订标识。 |
+
+```bash
+redc status <case-id> -o json | jq '.plugin_outputs'
+```
+
+插件会拒绝空节点、重复节点、非法 IPv4、空密码、非法端口和非法 pool ID。校验失败时不会替换上一次成功生成的 bundle。

plugins/redc-plugin-pojun-proxy/hooks/post-apply.sh

@@ -0,0 +1,170 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+fail() {
+    echo "[pojun-proxy] ERROR: $*" >&2
+    exit 1
+}
+
+read_tfvar() {
+    local key="$1"
+    local tfvars="$REDC_CASE_PATH/terraform.tfvars"
+    if [[ -f "$tfvars" ]]; then
+        sed -n -E "s/^[[:space:]]*${key}[[:space:]]*=[[:space:]]*\"([^\"]*)\"[[:space:]]*$/\\1/p" "$tfvars" | head -n 1
+    fi
+}
+
+has_case_var() {
+    local key="$1"
+    [[ -n "$REDC_CASE_VARS" ]] && jq -e --arg key "$key" 'has($key)' <<<"$REDC_CASE_VARS" >/dev/null 2>&1
+}
+
+read_case_var() {
+    local key="$1"
+    jq -er --arg key "$key" '.[$key] | if type == "string" or type == "number" then tostring else empty end' <<<"$REDC_CASE_VARS"
+}
+
+sha256_file() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        sha256sum "$1" | awk '{print $1}'
+    elif command -v shasum >/dev/null 2>&1; then
+        shasum -a 256 "$1" | awk '{print $1}'
+    else
+        fail "sha256sum or shasum is required"
+    fi
+}
+
+sync_path() {
+    local path="$1"
+    if sync -f "$path" 2>/dev/null; then
+        return
+    fi
+    sync
+}
+
+is_valid_ipv4() {
+    local address="$1"
+    local octets octet
+    [[ "$address" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] || return 1
+    IFS='.' read -r -a octets <<<"$address"
+    [[ ${#octets[@]} -eq 4 ]] || return 1
+    for octet in "${octets[@]}"; do
+        ((10#$octet >= 0 && 10#$octet <= 255)) || return 1
+    done
+}
+
+command -v jq >/dev/null 2>&1 || fail "jq is required"
+
+REDC_CASE_ID=${REDC_CASE_ID:-}
+REDC_CASE_NAME=${REDC_CASE_NAME:-}
+REDC_CASE_PATH=${REDC_CASE_PATH:-}
+REDC_CASE_TEMPLATE=${REDC_CASE_TEMPLATE:-}
+REDC_CASE_VARS=${REDC_CASE_VARS:-}
+REDC_OUTPUT_JSON=${REDC_OUTPUT_JSON:-}
+
+[[ -n "$REDC_CASE_PATH" ]] || fail "REDC_CASE_PATH is required"
+[[ -d "$REDC_CASE_PATH" ]] || fail "REDC_CASE_PATH is not a directory"
+[[ -n "$REDC_CASE_ID" ]] || fail "REDC_CASE_ID is required"
+[[ -n "$REDC_OUTPUT_JSON" ]] || fail "REDC_OUTPUT_JSON is required"
+
+if has_case_var port; then
+    PORT=$(read_case_var port)
+else
+    PORT=$(read_tfvar port)
+fi
+if has_case_var password; then
+    PASSWORD=$(read_case_var password)
+else
+    PASSWORD=$(read_tfvar password)
+fi
+CIPHER=chacha20-ietf-poly1305
+POOL_ID=${REDC_PLUGIN_CONFIG_POOL_ID:-redc-${REDC_CASE_ID}-aliyun-proxy}
+
+[[ -n "$PORT" ]] || fail "Shadowsocks port is required"
+[[ -n "$PASSWORD" ]] || fail "Shadowsocks password is required"
+[[ "$POOL_ID" =~ ^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$ ]] || fail "pool ID contains unsupported characters or is too long"
+[[ "$PORT" =~ ^[0-9]+$ ]] || fail "Shadowsocks port must be numeric"
+((10#$PORT >= 1 && 10#$PORT <= 65535)) || fail "Shadowsocks port must be between 1 and 65535"
+
+IPS_JSON=$(jq -ce '
+    (.ecs_ip.value // .public_ip.value // empty) as $value
+    | if ($value | type) == "array" then $value
+      elif ($value | type) == "string" then [$value]
+      else empty
+      end
+' <<<"$REDC_OUTPUT_JSON") || fail "ecs_ip or public_ip output is required"
+NODE_COUNT=$(jq -r 'length' <<<"$IPS_JSON")
+[[ "$NODE_COUNT" -gt 0 ]] || fail "at least one proxy node is required"
+UNIQUE_NODE_COUNT=$(jq -r 'unique | length' <<<"$IPS_JSON")
+[[ "$UNIQUE_NODE_COUNT" -eq "$NODE_COUNT" ]] || fail "duplicate proxy nodes are not allowed"
+while IFS= read -r IP; do
+    is_valid_ipv4 "$IP" || fail "proxy node address is not a valid IPv4 literal"
+done < <(jq -r '.[]' <<<"$IPS_JSON")
+
+umask 077
+BUNDLE_DIR="$REDC_CASE_PATH/pojun-proxy"
+[[ ! -L "$BUNDLE_DIR" ]] || fail "bundle directory must not be a symlink"
+mkdir -p "$BUNDLE_DIR"
+chmod 0700 "$BUNDLE_DIR"
+
+BUNDLE_FILE="$BUNDLE_DIR/bundle.json"
+NODES_TMP=$(mktemp "$BUNDLE_DIR/.nodes.json.tmp.XXXXXX")
+BUNDLE_TMP=$(mktemp "$BUNDLE_DIR/.bundle.json.tmp.XXXXXX")
+cleanup() {
+    rm -f "$NODES_TMP" "$BUNDLE_TMP"
+}
+trap cleanup EXIT HUP INT TERM
+
+NODES_JSON=$(jq -cn \
+    --argjson ips "$IPS_JSON" \
+    --argjson port "$PORT" \
+    --arg cipher "$CIPHER" \
+    --arg password "$PASSWORD" \
+    '$ips | to_entries | map({
+        cipher: $cipher,
+        name: ("redc-node-" + (("000" + ((.key + 1) | tostring))[-3:])),
+        password: $password,
+        port: $port,
+        server: .value,
+        type: "ss"
+    })')
+printf '%s' "$NODES_JSON" >"$NODES_TMP"
+chmod 0600 "$NODES_TMP"
+
+REVISION=$(sha256_file "$NODES_TMP")
+GENERATED_AT=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
+jq -n \
+    --arg pool_id "$POOL_ID" \
+    --arg generated_at "$GENERATED_AT" \
+    --arg revision "$REVISION" \
+    --arg case_id "$REDC_CASE_ID" \
+    --arg case_name "$REDC_CASE_NAME" \
+    --arg template "$REDC_CASE_TEMPLATE" \
+    --argjson node_count "$NODE_COUNT" \
+    --slurpfile nodes "$NODES_TMP" \
+    '{
+        schema_version: 1,
+        pool_id: $pool_id,
+        revision: $revision,
+        generated_at: $generated_at,
+        node_count: $node_count,
+        nodes: $nodes[0],
+        source: {
+            kind: "redc_case",
+            case_id: $case_id,
+            case_name: $case_name,
+            template: $template
+        }
+    }' >"$BUNDLE_TMP"
+chmod 0600 "$BUNDLE_TMP"
+
+sync_path "$BUNDLE_TMP"
+mv -f "$BUNDLE_TMP" "$BUNDLE_FILE"
+sync_path "$BUNDLE_DIR"
+trap - EXIT HUP INT TERM
+rm -f "$NODES_TMP"
+
+echo "REDC_OUTPUT:pojun_proxy_bundle_file=$BUNDLE_FILE"
+echo "REDC_OUTPUT:pojun_proxy_pool_id=$POOL_ID"
+echo "REDC_OUTPUT:pojun_proxy_node_count=$NODE_COUNT"
+echo "REDC_OUTPUT:pojun_proxy_revision=$REVISION"

plugins/redc-plugin-pojun-proxy/hooks/post-apply.tmpl

@@ -0,0 +1,6 @@
+{{- $poolID := .Config.pool_id | default (printf "redc-%s-aliyun-proxy" .CaseID) -}}
+{{- $bundle := writePojunProxyBundle $poolID .Vars.port .Vars.password -}}
+{{- setOutput "pojun_proxy_bundle_file" (index $bundle "bundle_file") -}}
+{{- setOutput "pojun_proxy_pool_id" (index $bundle "pool_id") -}}
+{{- setOutput "pojun_proxy_node_count" (index $bundle "node_count") -}}
+{{- setOutput "pojun_proxy_revision" (index $bundle "revision") -}}

plugins/redc-plugin-pojun-proxy/plugin.json

@@ -0,0 +1,28 @@
+{
+  "name": "redc-plugin-pojun-proxy",
+  "version": "1.2.0",
+  "description": "为 PoJun Worker 生成安全、可校验的 Shadowsocks 代理节点 Bundle",
+  "description_en": "Generate a private, verifiable Shadowsocks proxy bundle for PoJun Workers",
+  "author": "wgpsec",
+  "homepage": "https://github.com/wgpsec/redc-template",
+  "category": "proxy",
+  "tags": ["pojun", "proxy", "shadowsocks", "mihomo"],
+  "min_redc_version": "3.3.8",
+  "capabilities": {
+    "hooks": {
+      "post-apply": {
+        "type": "template",
+        "template": "hooks/post-apply.tmpl",
+        "output": ""
+      }
+    }
+  },
+  "config_schema": {
+    "pool_id": {
+      "type": "string",
+      "required": false,
+      "description": "稳定代理池 ID；留空时根据 RedC Case ID 自动生成",
+      "default": ""
+    }
+  }
+}