135 lines
3.9 KiB
Markdown
135 lines
3.9 KiB
Markdown
# operator-migration
|
|
|
|
[🇺🇸 English](#english) · [🇪🇸 Español](#español)
|
|
|
|
---
|
|
|
|
# English
|
|
|
|
Zero-downtime migration from the legacy WireGuard + Go API stack to operator-docker. Existing VPN clients reconnect automatically — no new configuration required on their end.
|
|
|
|
## How it works
|
|
|
|
The server's WireGuard identity (private key → public key) is preserved. All peers are migrated to the new API. Clients reconnect without any config change.
|
|
|
|
```text
|
|
Before After
|
|
wireguard (linuxserver) wireguard (same identity)
|
|
wireguard-api (Go) operator-api (FastAPI)
|
|
nginx-certbot marzban + hysteria2 + mysql
|
|
```
|
|
|
|
## Prerequisites
|
|
|
|
- Legacy stack running (`docker ps` shows `wireguard`)
|
|
- Domain with DNS pointing to this server
|
|
- SSH key authorized by Simplified Privacy
|
|
- Port 80/TCP open externally (required by Let's Encrypt)
|
|
|
|
## Migration
|
|
|
|
Run as your Linux user (not root):
|
|
|
|
```bash
|
|
bash migration.sh
|
|
```
|
|
|
|
What it does:
|
|
|
|
1. Requests sudo once — no further prompts
|
|
2. Verifies SSH access and clones operator-docker
|
|
3. Creates a full backup — WireGuard keys, peers, Nginx, SSL certs
|
|
4. Shuts down the legacy stack
|
|
5. Runs the operator-docker installer
|
|
6. Injects the legacy WireGuard identity into the new stack
|
|
7. Migrates all peers via the new API
|
|
8. Destroys the private key from disk
|
|
|
|
## Rollback
|
|
|
|
If something goes wrong — or you want to revert — run:
|
|
|
|
```bash
|
|
bash rollback.sh
|
|
```
|
|
|
|
What it does:
|
|
|
|
1. Stops operator-docker completely
|
|
2. Removes SSL certificates issued for the new subdomains
|
|
3. Restores the Nginx configuration from backup
|
|
4. Restores SSL certificates from backup
|
|
5. Starts the legacy Go stack
|
|
6. Deletes the migration backup
|
|
|
|
## Notes
|
|
|
|
- The private key is destroyed from disk after successful migration.
|
|
- If port 80 is blocked, SSL issuance will fail. Contact your VPS provider or use DNS challenge manually.
|
|
- IPv6 is detected and enabled automatically.
|
|
|
|
---
|
|
|
|
# Español
|
|
|
|
Migración sin tiempo de inactividad desde el stack legacy WireGuard + Go API hacia operator-docker. Los clientes VPN existentes se reconectan automáticamente — no requieren ningún cambio de configuración.
|
|
|
|
## Cómo funciona
|
|
|
|
La identidad WireGuard del servidor (clave privada → clave pública) se preserva. Todos los peers se migran a la nueva API. Los clientes se reconectan sin cambios.
|
|
|
|
```text
|
|
Antes Después
|
|
wireguard (linuxserver) wireguard (misma identidad)
|
|
wireguard-api (Go) operator-api (FastAPI)
|
|
nginx-certbot marzban + hysteria2 + mysql
|
|
```
|
|
|
|
## Requisitos
|
|
|
|
- Stack legacy corriendo (`docker ps` muestra `wireguard`)
|
|
- Dominio con DNS apuntando a este servidor
|
|
- SSH key autorizada por Simplified Privacy
|
|
- Puerto 80/TCP abierto externamente (requerido por Let's Encrypt)
|
|
|
|
## Migración
|
|
|
|
Ejecutar como usuario Linux (no root):
|
|
|
|
```bash
|
|
bash migration.sh
|
|
```
|
|
|
|
Pasos:
|
|
|
|
1. Solicita sudo una vez — sin interrupciones posteriores
|
|
2. Verifica acceso SSH y clona operator-docker
|
|
3. Crea un backup completo — claves WireGuard, peers, Nginx, certificados SSL
|
|
4. Apaga el stack legacy
|
|
5. Ejecuta el instalador de operator-docker
|
|
6. Inyecta la identidad WireGuard legacy en el nuevo stack
|
|
7. Migra todos los peers vía la nueva API
|
|
8. Destruye la clave privada del disco
|
|
|
|
## Rollback
|
|
|
|
Si algo falla — o si se quiere revertir — ejecutar:
|
|
|
|
```bash
|
|
bash rollback.sh
|
|
```
|
|
|
|
Pasos:
|
|
|
|
1. Detiene operator-docker completamente
|
|
2. Elimina los certificados SSL emitidos para los nuevos subdominios
|
|
3. Restaura la configuración de Nginx desde el backup
|
|
4. Restaura los certificados SSL desde el backup
|
|
5. Inicia el stack Go legacy
|
|
6. Elimina el backup de migración
|
|
|
|
## Notas
|
|
|
|
- La clave privada se destruye del disco tras la migración exitosa.
|
|
- Si el puerto 80 está bloqueado, la emisión de certificados fallará. Contacta a tu proveedor VPS o usa DNS challenge manualmente.
|
|
- IPv6 se detecta y habilita automáticamente.
|