对脚本整体性能进行了优化，美化了菜单界面

.github/workflows/build_caddy.yml

@@ -29,6 +29,7 @@ jobs:
           --with github.com/caddyserver/forwardproxy
         mkdir -p dist
         tar -czvf dist/caddy-${VERSION}.tar.gz caddy
+        (cd dist && sha256sum caddy-${VERSION}.tar.gz > caddy-${VERSION}.tar.gz.sha256)
         echo "RELEASE_TAG=${VERSION}" >> $GITHUB_ENV
         echo "RELEASE_NAME=Monthly Build (${DATE})" >> $GITHUB_ENV
 
@@ -37,7 +38,9 @@ jobs:
       with:
         tag_name: ${{ env.RELEASE_TAG }}
         name: ${{ env.RELEASE_NAME }}
-        files: dist/*.tar.gz
+        files: |
+          dist/*.tar.gz
+          dist/*.sha256
         draft: false
         prerelease: false
         update_release: true  # 自动更新已有 Release（覆盖上传）

.github/workflows/shell_quality.yml

@@ -0,0 +1,40 @@
+name: Shell Quality
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install shellcheck
+        run: |
+          sudo apt-get update -y
+          sudo apt-get install -y shellcheck
+
+      - name: Set up Go for shfmt
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.21'
+
+      - name: Install shfmt
+        run: |
+          go install mvdan.cc/sh/v3/cmd/shfmt@latest
+          echo "${HOME}/go/bin" >> $GITHUB_PATH
+
+      - name: Run shellcheck
+        run: |
+          set -e
+          echo "Running shellcheck..."
+          find . -type f -name "*.sh" -print0 | xargs -0 -I{} bash -lc 'shellcheck -x "{}"'
+
+      - name: Run shfmt diff
+        run: |
+          set -e
+          echo "Running shfmt..."
+          shfmt -d .
+

README.md

@@ -20,8 +20,9 @@ Ubuntu 16.04, 18.04, 20.04, 22.04
 
 CentOS 7
 
-* WSS客户端配置信息保存在：
-`cat /usr/local/etc/v2ray/client.json`
+* WSS客户端配置信息：
+  - 机器可读 JSON: `/usr/local/etc/v2ray/client.json`
+  - 可读文本: `/usr/local/etc/v2ray/client.txt`
 
 * Shadowsocks客户端配置信息：
 `cat /etc/shadowsocks/config.json`
@@ -32,10 +33,33 @@ CentOS 7
 * Hysteria2客户端配置信息保存在：
 `cat /etc/hysteria/hyclient.json`
 
-* Https正向代理客户端配置信息保存在：
-`cat /etc/caddy/https.json`
+* Https正向代理客户端配置信息：
+  - 机器可读 JSON: `/etc/caddy/https.json`
+  - 可读文本: `/etc/caddy/https.txt`
 
 卸载方法如下：
 https://1024.day/d/1296
 
 **提醒：连不上的朋友，建议先检查一下服务器自带防火墙有没有关闭？**
+
+环境变量与参数（可选）：
+
+- `TZ_AUTO=1` 与可选 `TZ_VALUE=Asia/Shanghai`：启用脚本内时区设置（默认不修改时区）。
+- `ACME_EMAIL=you@example.com`：`v2ray+ws+tls` 与 HTTPS（Caddy）申请证书使用的邮箱（默认 `admin@example.com`）。
+- `HY2_CERT=/path/server.crt`、`HY2_KEY=/path/server.key`、`HY2_SNI=example.com`：Hysteria2 使用真实证书（存在时客户端将不再跳过证书验证）。
+- `SS_VERSION=vX.Y.Z`、`SS_SHA256=<sha256>`：固定安装 Shadowsocks-rust 的版本并可选校验下载的完整性。
+- `FIREWALL_AUTO=1`：安装后自动尝试放通所需端口（UFW/Firewalld）。
+  - WS/WSS: 80、443（WSS 可自定义端口）
+  - Reality: 指定 TCP 端口
+  - Hysteria2: 指定 UDP 端口
+  - HTTPS 正向代理: 80、443
+
+TCP/系统调优脚本（可选）：
+
+- 使用方式：`bash tcp-window.sh --apply` 应用调优；`--revert` 回滚；`--status` 查看状态。
+- 实现：通过 `/etc/sysctl.d/99-tuning.conf` 和 `/etc/security/limits.d/99-nofile.conf` 等 drop-in 文件实现，避免覆盖系统默认配置；不再强制重启。
+
+辅助脚本：
+
+- 诊断：`bash doctor.sh` 输出服务状态、监听端口、证书情况、防火墙信息。
+- 卸载：`bash uninstall.sh` 选择性移除 V2Ray/Xray/Hysteria2/Shadowsocks/Caddy/Nginx 站点配置。

docs/CHANGELOG.md

@@ -0,0 +1,69 @@
+# Changelog
+
+## Phase 1 — Baseline Hardening
+
+Date: YYYY-MM-DD
+
+Changes:
+- Shebangs unified to `#!/usr/bin/env bash` across all scripts
+- Enabled strict mode: `set -Eeuo pipefail` and safe IFS
+- Timezone changes gated by `TZ_AUTO=1` (default off)
+- ACME email in `tcp-wss.sh` parameterized via `ACME_EMAIL` (default `admin@example.com`)
+- Removed self-deleting lines from all scripts (retain scripts for troubleshooting)
+- No behavioral protocol changes yet (kept for Phase 2)
+
+Notes:
+- Subsequent phases will refine protocol configs, TLS settings, and idempotency.
+
+## Phase 2 — Protocol & Web Server Correctness
+
+Date: YYYY-MM-DD
+
+Changes:
+- tcp-wss.sh: Switched ACME issuance to webroot mode; added two-stage Nginx setup (80-only for ACME, then TLS site) with modern TLS (1.2/1.3) and enabled logs
+- tcp-wss.sh: Stopped overwriting `nginx.conf`; now uses `conf.d` site files
+- tcp-wss.sh: Client output encryption label aligned to `none` for VMess
+- ws.sh: Inbound `streamSettings.security` set to `none`; share link `method` set to `none`; client output aligned
+ - Normalized client outputs: now write machine-readable JSON and human-readable TXT for VMess (ws/wss)
+ - https.sh: Switched to domain-hosted Caddyfile (auto HTTP->HTTPS), added global ACME email, checksum verification for Caddy tarball
+
+Pending:
+- HTTPS forward proxy Caddy: clarify auto-cert behavior; add checksum validation
+- Further VMess link field normalization if needed across clients
+
+## Phase 3 — Reality/Hy2/SS-rust Enhancements
+
+Date: YYYY-MM-DD
+
+Changes:
+- reality.sh: Parse X25519 public key only from Public/PublicKey fields; generate random hex shortId; propagate into config and share-link
+- reality.sh: Client output and saved JSON now include dynamic shortId
+- hy2.sh: Support using real certificate/key via `HY2_CERT`/`HY2_KEY`; SNI via `HY2_SNI`; client `insecure` auto-set based on certificate type
+- ss-rust.sh: Allow version pin using `SS_VERSION`; optional tarball integrity check via `SS_SHA256`
+
+Pending:
+- reality.sh: Optional multi-user/multi-port support
+- ss-rust.sh: 2022 ciphers option
+
+## Phase 4 — System Tuning & Idempotency
+
+Date: YYYY-MM-DD
+
+Changes:
+- Rewrote `tcp-window.sh` to an idempotent, CLI-driven script using `/etc/sysctl.d` and `/etc/security/limits.d` drop-ins
+- Added `--apply`, `--revert`, and `--status` commands; removed forced reboot
+
+Notes:
+- Some settings may require service restart or reboot to take effect
+
+## Phase 5 — Automation & Docs
+
+Date: YYYY-MM-DD
+
+Changes:
+- Added CI workflow for ShellCheck and shfmt to enforce script quality
+- Updated README with environment variables and tuning script usage
+ - Added uninstall.sh and doctor.sh helper scripts
+
+Pending:
+- Add uninstall and doctor scripts; expand docs for firewall/SELinux

docs/IMPROVEMENT_PLAN.md

@@ -0,0 +1,52 @@
+# Improvement Plan and Progress
+
+This document tracks the ongoing optimization roadmap and stage-by-stage progress.
+
+## Overview
+
+Goal: Improve security, correctness, portability, and maintainability of the installation scripts and tooling for Shadowsocks-rust, V2Ray (WS/WSS), Reality (Xray), Hysteria2, and HTTPS forward proxy.
+
+## Phases
+
+1) Baseline Hardening (In Progress)
+- Unify shebangs to bash and enable strict mode
+- Add safe defaults and environment toggles (e.g., TZ gating)
+- Remove in-script self-deletions
+- Parameterize ACME email
+- Prepare for idempotent operations and safer downloads
+
+2) Protocol & Web Server Correctness (In Progress)
+- Nginx: separate site config, modern TLS (1.2/1.3), ciphers, enable logs [done]
+- ACME: switch to webroot; customizable email [done]
+- V2Ray (VMess+WS): align inbound and share-link fields; fix `security` [done for ws.sh; wss prints aligned]
+- HTTPS proxy (Caddy): clarified auto-cert via host matcher and global email; checksum validation for release tarball [done]
+- Client outputs normalized: machine-readable JSON + human-readable TXT [done]
+
+3) Reality/Hy2/SS-rust Enhancements (In Progress)
+- Reality: robust key parsing (PublicKey) [done], random shortIds [done], multi-user optional [todo]
+- Hysteria2: real-cert option via HY2_CERT/HY2_KEY and HY2_SNI [done]; QUIC windows defaults [kept]
+- Shadowsocks-rust: version pin via SS_VERSION and checksum via SS_SHA256 [done]; 2022 ciphers option [todo]
+
+4) System Tuning & Idempotency (In Progress)
+- Converted `tcp-window.sh` to idempotent tuning via sysctl.d/limits.d [done]
+- Removed forced reboot; added `--apply`/`--revert`/`--status` [done]
+
+5) Automation & Docs (In Progress)
+- ShellCheck/shfmt CI [done]
+- Expanded README with env flags and tuning usage [done]
+- Firewall/SELinux guidance [todo]
+- Add `uninstall.sh` and `doctor.sh` [done]
+
+## Stage Logs
+
+### Phase 1 — Baseline Hardening
+Applied:
+- Shebangs unified to `#!/usr/bin/env bash`
+- Added `set -Eeuo pipefail` and safe IFS
+- Timezone change gated behind `TZ_AUTO=1` (default off)
+- ACME email parameterized via `ACME_EMAIL` (default `admin@example.com`)
+- Removed in-script self-deletion lines
+
+Next:
+- Introduce common utility library without breaking standalone usage
+- Add optional checksum verification helpers

doctor.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# Diagnostic helper for this repository
+
+set -Eeuo pipefail
+IFS=$'\n\t'
+
+bold() { printf "\033[1m%s\033[0m\n" "$*"; }
+
+section() {
+  echo; bold "== $* =="; }
+
+cmd_ok() { command -v "$1" >/dev/null 2>&1; }
+
+service_status() {
+  local svc="$1"
+  if cmd_ok systemctl; then
+    systemctl is-active --quiet "$svc" && echo active || echo inactive
+  else
+    echo unknown
+  fi
+}
+
+show_port_listen() {
+  if cmd_ok ss; then
+    ss -lntup || true
+  elif cmd_ok netstat; then
+    netstat -lntup || true
+  else
+    echo "No ss/netstat available"
+  fi
+}
+
+extract_domain_nginx() {
+  awk '/server_name/{print $2}' /etc/nginx/conf.d/v2ray_wss_tls.conf 2>/dev/null | tr -d ';' | head -1 || true
+}
+
+extract_domain_caddy() {
+  awk 'NF && $1 !~ /^[{#]/ {print $1; exit}' /etc/caddy/https.caddyfile 2>/dev/null || true
+}
+
+check_cert() {
+  local crt="$1"
+  [[ -f "$crt" ]] || { echo "Not found"; return; }
+  openssl x509 -noout -dates -in "$crt" 2>/dev/null || echo "Unable to parse"
+}
+
+section "System"
+uname -a || true
+if [[ -f /etc/os-release ]]; then . /etc/os-release; echo "$NAME $VERSION"; fi
+
+section "Services"
+for s in nginx v2ray xray hysteria-server caddy shadowsocks; do
+  printf "%-18s %s\n" "$s" "$(service_status "$s")"
+done
+
+section "Listening Ports"
+show_port_listen
+
+section "Nginx"
+cmd_ok nginx && (nginx -t || true)
+domain_nginx="$(extract_domain_nginx)"
+if [[ -n "$domain_nginx" ]]; then
+  echo "Detected domain: $domain_nginx"
+  echo "Certificate: /etc/letsencrypt/live/$domain_nginx/fullchain.pem"
+  check_cert "/etc/letsencrypt/live/$domain_nginx/fullchain.pem"
+fi
+
+section "Caddy"
+if [[ -f /etc/caddy/https.caddyfile ]]; then
+  echo "Caddyfile present: /etc/caddy/https.caddyfile"
+  domain_caddy="$(extract_domain_caddy)"
+  [[ -n "$domain_caddy" ]] && echo "Detected site: $domain_caddy"
+fi
+
+section "V2Ray/Xray Versions"
+/usr/local/bin/v2ray version 2>/dev/null || true
+/usr/local/bin/xray version 2>/dev/null || true
+
+section "Firewall"
+if cmd_ok ufw; then
+  ufw status || true
+elif cmd_ok firewall-cmd; then
+  firewall-cmd --state || true
+  firewall-cmd --list-ports || true
+else
+  echo "No ufw/firewalld detected"
+fi
+
+echo
+bold "Diagnostics completed."
+