Debian 初始化脚本与数据包

- init-debian.sh：用户创建、数据包下载与校验（防路径穿越）、/data 权限归一化（私钥、ACME 存储、.env 收紧为 600）、apt/docker/sshd 配置、sudoers、SSH 密钥、证书同步定时任务，新增任务 14 首次同步证书
- data.tar.gz：不含任何证书、私钥和密码，证书由 scripts/certs.sh 从证书机拉取；gateway 面板密码改从 .env 读取，并移除含 EAB 凭据的 zerossl 解析器
- 历史已压缩，旧历史中含敏感文件

etc/apt/sources-bookworm.list

@@ -0,0 +1,12 @@
+deb http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
+deb http://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware
+deb http://deb.debian.org/debian bookworm-backports main contrib non-free non-free-firmware
+deb http://deb.debian.org/debian bookworm-proposed-updates main contrib non-free non-free-firmware
+
+deb-src http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
+deb-src http://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware
+deb-src http://deb.debian.org/debian bookworm-backports main contrib non-free non-free-firmware
+deb-src http://deb.debian.org/debian bookworm-proposed-updates main contrib non-free non-free-firmware
+
+deb http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
+deb-src http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware

etc/apt/sources-bullseye.list

@@ -0,0 +1,12 @@
+deb http://deb.debian.org/debian bullseye main contrib non-free
+deb http://deb.debian.org/debian bullseye-updates main contrib non-free
+deb http://deb.debian.org/debian bullseye-backports main contrib non-free
+deb http://deb.debian.org/debian bullseye-proposed-updates main contrib non-free
+
+deb-src http://deb.debian.org/debian bullseye main contrib non-free
+deb-src http://deb.debian.org/debian bullseye-updates main contrib non-free
+deb-src http://deb.debian.org/debian bullseye-backports main contrib non-free
+deb-src http://deb.debian.org/debian bullseye-proposed-updates main contrib non-free
+
+deb http://security.debian.org/debian-security bullseye-security main contrib non-free non-free-firmware
+deb-src http://security.debian.org/debian-security bullseye-security main contrib non-free non-free-firmware

etc/profile

@@ -0,0 +1,36 @@
+# /etc/profile: system-wide .profile file for the Bourne shell (sh(1))
+# and Bourne compatible shells (bash(1), ksh(1), ash(1), ...).
+
+if [ "`id -u`" -eq 0 ]; then
+  PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+else
+  PATH="/usr/local/bin:/usr/bin:/bin"
+fi
+export PATH
+
+if [ "${PS1-}" ]; then
+  if [ "${BASH-}" ] && [ "$BASH" != "/bin/sh" ]; then
+    # The file bash.bashrc already sets the default PS1.
+    # PS1='\h:\w\$ '
+    if [ -f /etc/bash.bashrc ]; then
+      . /etc/bash.bashrc
+    fi
+  else
+    if [ "`id -u`" -eq 0 ]; then
+      PS1='# '
+    else
+      PS1='$ '
+    fi
+  fi
+fi
+
+if [ -d /etc/profile.d ]; then
+  for i in /etc/profile.d/*.sh; do
+    if [ -r $i ]; then
+      . $i
+    fi
+  done
+  unset i
+fi
+
+ulimit -SHn 51200

etc/security/limits.conf

@@ -0,0 +1,2 @@
+*	soft	nofile 51200
+*	hard	nofile 51200

etc/ssh/sshd_config

@@ -0,0 +1,23 @@
+Port 46571
+AddressFamily any
+Protocol 2
+HostKey /etc/ssh/ssh_host_ed25519_key
+PermitRootLogin prohibit-password
+AuthorizedKeysFile      .ssh/authorized_keys
+PasswordAuthentication no
+ChallengeResponseAuthentication no
+GSSAPIAuthentication no
+GSSAPICleanupCredentials no
+GSSAPIStrictAcceptorCheck no
+GSSAPIKeyExchange no
+UsePAM yes
+X11Forwarding yes
+TCPKeepAlive yes
+ClientAliveInterval 60
+UseDNS no
+PrintMotd no
+AcceptEnv LANG LC_*
+Subsystem	sftp	/usr/lib/openssh/sftp-server
+
+Match User kairee
+  PasswordAuthentication yes

etc/sysctl.conf

@@ -0,0 +1,36 @@
+kernel.sysrq = 1
+kernel.printk = 3 4 1 3
+vm.swappiness = 10
+vm.overcommit_memory=1
+
+fs.file-max = 1491124
+net.core.rmem_max = 67108864
+net.core.wmem_max = 67108864
+net.core.rmem_default = 65536
+net.core.wmem_default = 65536
+net.ipv4.tcp_max_syn_backlog = 1048576
+net.ipv4.tcp_tw_reuse = 1
+net.ipv4.tcp_max_tw_buckets = 55000
+net.core.netdev_max_backlog = 1048576
+net.core.somaxconn = 1048576
+net.ipv4.tcp_syncookies = 1
+
+net.ipv4.tcp_fin_timeout = 30
+net.ipv4.tcp_keepalive_time = 1200
+net.ipv4.ip_local_port_range = 1024 65000
+
+net.ipv4.tcp_fastopen = 3
+#net.ipv4.tcp_mem = 25600 51200 102400
+#net.ipv4.tcp_rmem = 4096 87380 67108864
+#net.ipv4.tcp_wmem = 4096 87380 67108864
+net.ipv4.tcp_mtu_probing = 1
+net.ipv4.tcp_ecn = 1
+net.ipv4.tcp_ecn_fallback = 1
+net.core.default_qdisc = fq
+net.ipv4.tcp_congestion_control = bbr
+net.ipv4.tcp_retries2 = 8
+
+net.ipv4.ip_forward = 1
+
+net.ipv6.conf.default.autoconf = 0
+net.ipv6.conf.all.autoconf = 0