feat: bundle and sync official Hysteria2 install script locally

Store install_server.sh in role files, compare SHA256 with get.hy2.sh on the control node before install/update, refresh the bundled copy when upstream changes, then copy and run it on VPS.

Co-authored-by: Cursor <cursoragent@cursor.com>

roles/hysteria2/defaults/main.yml

@@ -26,6 +26,12 @@ hysteria2_configure_firewall: true
 hysteria2_config_path: /etc/hysteria/config.yaml
 hysteria2_service_name: hysteria-server
 
+# Официальный install_server.sh: хранится в roles/hysteria2/files/, синхронизируется с get.hy2.sh
+hysteria2_install_script_url: "https://get.hy2.sh/"
+hysteria2_install_script_name: install_server.sh
+hysteria2_install_script_staging_dir: "{{ playbook_dir }}/.cache/hysteria2"
+hysteria2_install_script_remote_path: /tmp/hysteria2-install_server.sh
+
 hysteria2_output_dir: "{{ playbook_dir }}/output"
 hysteria2_output_name: "{{ inventory_hostname }}"
 

roles/hysteria2/tasks/install.yml

@@ -23,11 +23,18 @@
         + (['qrencode'] if hysteria2_generate_qr_png | bool else [])
       }}
 
+- name: Sync official Hysteria2 install script on control node
+  ansible.builtin.import_tasks: sync_install_script.yml
+
+- name: Copy Hysteria2 install script to server
+  ansible.builtin.copy:
+    src: "{{ hysteria2_install_script_name }}"
+    dest: "{{ hysteria2_install_script_remote_path }}"
+    mode: "0755"
+
 - name: Install Hysteria2 via official script
-  ansible.builtin.shell:
+  ansible.builtin.command:
-    cmd: bash <(curl -fsSL https://get.hy2.sh/)
+    cmd: "{{ hysteria2_install_script_remote_path }}"
-    executable: /bin/bash
-  args:
     creates: /usr/local/bin/hysteria
   register: _hysteria2_install
 

roles/hysteria2/tasks/sync_install_script.yml

@@ -0,0 +1,64 @@
+---
+- name: Ensure staging directory for install script sync
+  ansible.builtin.file:
+    path: "{{ hysteria2_install_script_staging_dir }}"
+    state: directory
+    mode: "0700"
+  delegate_to: localhost
+  become: false
+  run_once: true
+
+- name: Fetch official install script for version check
+  ansible.builtin.get_url:
+    url: "{{ hysteria2_install_script_url }}"
+    dest: "{{ hysteria2_install_script_staging_dir }}/{{ hysteria2_install_script_name }}.remote"
+    mode: "0644"
+    force: true
+  delegate_to: localhost
+  become: false
+  run_once: true
+  register: _hysteria2_remote_script
+
+- name: Stat local install script in role files
+  ansible.builtin.stat:
+    path: "{{ role_path }}/files/{{ hysteria2_install_script_name }}"
+    checksum_algorithm: sha256
+  delegate_to: localhost
+  become: false
+  run_once: true
+  register: _hysteria2_local_script
+
+- name: Stat remote install script from official server
+  ansible.builtin.stat:
+    path: "{{ hysteria2_install_script_staging_dir }}/{{ hysteria2_install_script_name }}.remote"
+    checksum_algorithm: sha256
+  delegate_to: localhost
+  become: false
+  run_once: true
+  register: _hysteria2_remote_script_stat
+
+- name: Update bundled install script when official version is newer
+  ansible.builtin.copy:
+    src: "{{ hysteria2_install_script_staging_dir }}/{{ hysteria2_install_script_name }}.remote"
+    dest: "{{ role_path }}/files/{{ hysteria2_install_script_name }}"
+    mode: "0755"
+  delegate_to: localhost
+  become: false
+  run_once: true
+  when: >-
+    not _hysteria2_local_script.stat.exists
+    or _hysteria2_local_script.stat.checksum
+       != _hysteria2_remote_script_stat.stat.checksum
+  register: _hysteria2_script_updated
+
+- name: Report install script sync result
+  ansible.builtin.debug:
+    msg: >-
+      {{
+        'Официальный install_server.sh обновлён в roles/hysteria2/files/'
+        if (_hysteria2_script_updated.changed | default(false))
+        else 'Локальный install_server.sh актуален (совпадает с ' ~ hysteria2_install_script_url ~ ')'
+      }}
+  delegate_to: localhost
+  become: false
+  run_once: true

roles/hysteria2/tasks/update.yml

@@ -1,8 +1,16 @@
 ---
+- name: Sync official Hysteria2 install script on control node
+  ansible.builtin.import_tasks: sync_install_script.yml
+
+- name: Copy Hysteria2 install script to server
+  ansible.builtin.copy:
+    src: "{{ hysteria2_install_script_name }}"
+    dest: "{{ hysteria2_install_script_remote_path }}"
+    mode: "0755"
+
 - name: Update Hysteria2 binary via official script
-  ansible.builtin.shell:
+  ansible.builtin.command:
-    cmd: bash <(curl -fsSL https://get.hy2.sh/)
+    cmd: "{{ hysteria2_install_script_remote_path }} --force"
-    executable: /bin/bash
   register: _hysteria2_update
   notify: Restart hysteria-server