#安装所需
yum -y install pcre-devel pcre
yum -y install openssl-devel openssl
yum -y install gcc-c++

#创建普通用户及组
groupadd www && useradd www -s /sbin/nologin -M -g www

#下载所需文件
echo-nginx-module-0.62.tar.gz
luajit2-2.1-20220915.tar.gz
lua-nginx-module-0.10.22.tar.gz
lua-resty-core-0.1.24.tar.gz
lua-resty-lrucache-0.13.tar.gz
nginx-1.22.0.tar.gz
ngx_devel_kit-0.3.1.tar.gz

wget https://nginx.org/download/nginx-1.22.0.tar.gz
wget https://github.com/openresty/luajit2/archive/refs/tags/v2.1-20220915.tar.gz
wget https://github.com/openresty/lua-nginx-module/archive/refs/tags/v0.10.22.tar.gz

#批量解压
ls *.tar.gzxargs -n 1 tar -xzvf

#编译所需库
cd luajit2-2.1-20220915
make install PREFIX=/usr/local/luajit2-2.1-20220915
设置环境变量到/etc/profile
export LUAJIT_LIB=/usr/local/luajit2-2.1-20220915/lib/
export LUAJIT_INC=/usr/local/luajit2-2.1-20220915/include/luajit-2.1
source /etc/profile
ln -sf /usr/local/luajit2-2.1-20220915/lib/libluajit-5.1.so.2 /lib64/libluajit-5.1.so.2

cd ../lua-resty-core-0.1.24
make install PREFIX=/usr/local/lua_core
cd ../lua-resty-lrucache-0.13
make install PREFIX=/usr/local/lua_core

#安装nginx
cd ../nginx-1.22.0
./configure --prefix=/usr/local/nginx --user=www --group=www --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_ssl_module --with-stream --with-stream_ssl_preread_module --with-stream_ssl_module --with-http_gzip_static_module --with-http_realip_module --with-http_flv_module --with-http_mp4_module --add-module=../ngx_devel_kit-0.3.1 --add-module=../lua-nginx-module-0.10.22 --add-module=../echo-nginx-module-0.62
make -j 4
make install

nginx.conf http节加
lua_package_path "/usr/local/lua_core/lib/lua/?.lua;;";
nginx -t

#下载所需库
https://github.com/chobits/ngx_http_proxy_connect_module

#打补丁 看介绍不同版本补丁不一样
#这里是nginx-1.22.0
patch -p1 < ../ngx_http_proxy_connect_module-0.0.3/patch/proxy_connect_rewrite_102101.patch
#如果之前已安装nginx，查看之前编译参数nginx -V
--add-module=../ngx_http_proxy_connect_module-0.0.3
make && make install

#新建proxy.conf配置文件
server {
    listen 1443;
    charset utf-8;
    #DNS解析(核心配置)
    resolver 10.2.1.10;
    client_max_body_size     50m;
    access_log logs/access_proxy.log;

    #need ngx_proxy module
    proxy_connect;
    proxy_connect_allow            443 80;
    proxy_connect_connect_timeout  10s;
    proxy_connect_read_timeout     10s;
    proxy_connect_send_timeout     10s;

    location / {
        proxy_pass $scheme://$http_host$request_uri;
        proxy_connect_timeout 10;
         proxy_send_timeout 10;
         proxy_read_timeout 10;
         proxy_redirect     off;
         proxy_set_header Host $http_host;
         proxy_buffers 256 4k;
         proxy_next_upstream error timeout invalid_header http_502;
         proxy_max_temp_file_size 0k;
        proxy_ssl_server_name on;
    }
}

yum -y install gcc-c++ pcre-devel pcre openssl-devel openssl
yum -y install libxslt-devel libxml2 libxml2-dev gd-devel perl-devel perl-ExtUtils-Embed gperftools

./configure --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-compat --with-debug --with-file-aio --with-google_perftools_module --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_degradation_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_mp4_module --with-http_perl_module=dynamic --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_xslt_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-stream_ssl_preread_module --with-threads --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4' --add-module=/usr/local/ngx_devel_kit-0.3.1 --add-module=/usr/local/lua-nginx-module-0.10.22 --add-module=/usr/local/echo-nginx-module-0.62
make
make install

@echo off&setlocal enabledelayedexpansion
color 2f
set ver=1.9
set port=443
set suser=nginx
set sname=Nginxd
set sslpath=d:\ssl
set nginxpath=d:\nginx
title IIS+NGINX反向代理环境部署程序v%ver%
set vhostpath=d:\nginx\conf\vhost
set nginxconf=d:\nginx\conf\nginx.conf
set vhosttemppath=d:\nginx\conf\temp.conf
set winrarfile="C:\Program Files\WinRAR\winrar.exe"
set appcmdfile=c:\Windows\System32\inetsrv\appcmd.exe
set updateurl=http://downinfo.myhostadmin.net/vps
set baseurl=http://download.myhostadmin.net/win-ssl
set downdir=C:\Users\Administrator\Downloads
set wgetfile=C:\Users\Administrator\Downloads\wget.exe
set sedfile=C:\Users\Administrator\Downloads\sed.rar
set sedexe=C:\Users\Administrator\Downloads\sed\sed.exe

if not exist %wgetfile% (
    echo.
    echo 缺少wget.exe程序
    ::pause
    echo 正在下载wget.exe必要程序
    bitsadmin.exe /transfer wget /Download /Priority FOREGROUND %baseurl%/wget.exe %downdir%\wget.exe >nul 2>nul
)
if not exist %wgetfile% (
    echo.
    echo 自动下载失败请访问 %baseurl%/wget.exe 手动下载
    echo 并保存到默认下载目录[%downdir%]
    echo.
    pause
    exit
)

if not exist %winrarfile% (
    echo.
    echo 缺少WinRAR解压程序
    echo 请检查安装解压程序后重新运行脚本
    echo.
    pause
    exit
)

:update
cls
%wgetfile% %baseurl%/version.txt -O version.txt >nul 2>nul
title IIS+NGINX反向代理环境部署程序v%ver%
set /p newver=<version.txt
if %newver% gtr %ver% (
    %wgetfile% %baseurl%/updatelog.txt -O updatelog.txt >nul 2>nul
    title IIS+NGINX反向代理环境部署程序v%ver%
    echo.
    echo 当前版本v%ver%，最新版本v%newver%
    echo.
    echo -- 更新日志 --
    for /f "delims=" %%i in (updatelog.txt) do set "updatelog=%%i"&call :logecho !updatelog!
    echo.
    echo 请按任意键更新...
    pause >nul
    %wgetfile% %updateurl%/win-ssl.bat -O win-ssl_v%newver%.bat
    title IIS+NGINX反向代理环境部署程序v%ver%
    cls
    del /f /q "version.txt"
    attrib -h -s -r -a "v%newver%log.txt"
    del /f /q "updatelog.txt"
    attrib -h -s -r -a "%0"
    start win-ssl_v%newver%.bat
    del /f /q "%0"
) 
if %newver% equ %ver% (
    cls
    del /f /q "version.txt"
    echo 已是最新版本v%newver%
)

set tmp=0123456789abcdefghijklmnopqrstuvwxyz
for /l %%a in (1,1,8) do (
    set /a "n=!random!%%36"
    for %%z in (!n!) do set webpasswd=!passwd!!tmp:~%%z,1!
)

echo.
echo -- 温馨提示 --
echo.
echo 1、部署前请退出服务器内安装的杀毒软件
echo    安全狗、云锁、360、金山、等安全软件有可能导致SSL证书部署出错
echo 2、主要针对我司申请的SSL证书，如还没有SSL证书，请先申请
echo    其它公司申请的证书可能有所出入，
echo    若部署失败需要自行排查，或提交正确工单我司收费排查。
echo 3、部署之前请做好相关备份，若自行部署失败不承担相关风险和责任。
echo 4、部署前请检查IIS上是否有泛域名绑定，若有请临时取消。
echo 5、推荐将证书文件解压后上传到对应站点目录下，运行脚本自动搜索部署。
echo.
echo 请阅读以上温馨提示，5秒后按任意键继续。
choice /t 5 /d y /n >nul
pause

call :menu

:menu
findstr "listen \[::\]:443 ssl http2;" %vhosttemppath% >nul 2>nul && set ipv6title=关闭IPV6  set ipv6title=开启IPV6
echo   __________________________________________________________
echo  ^                                                          ^
echo  ^        IIS+NGINX反向代理环境部署程序 v%ver%                ^
echo  ^                                                          ^
echo  ^     1 - 安装                   2 - 卸载                  ^
echo  ^     3 - 部署ssl                4 - 更新ssl               ^
echo  ^     5 - %ipv6title%              6 - 退出                  ^
echo  ^                                                          ^
echo  ^__________________________________________________________^
set /p choice=-^> 请选择:
if %choice% ==1 call :install
if %choice% ==2 call :uninstall
if %choice% ==3 call :newsetssl
if %choice% ==4 call :updatessl
if %choice% ==5 call :enableipv6
if %choice% ==6 call :exit
echo.
echo 不能输入除了1、2、3、4、5、6之外的其他字符！& choice /t 1 /d y /n >nul & cls & goto menu

:install
cls
if exist %nginxpath%\%sname%.exe (
    echo.
    echo 核实已安装Nginx环境，请检查服务是否启动，2s后返回主菜单。
    choice /t 2 /d y /n >nul & cls & goto menu
)
if not exist %nginxpath% (
    mkdir %nginxpath%
    echo 创建目录:%nginxpath%成功
)
if not exist %sslpath% (
    mkdir %sslpath%
    echo 创建目录:%sslpath%成功
)
if not exist %vhostpath% (
    mkdir %vhostpath%
    echo 创建目录:%vhostpath%成功
)
if not exist %nginxpath%\%suser%.rar (
    %wgetfile% %baseurl%/%suser%.rar -O %nginxpath%\%suser%.rar >nul 2>nul
    title IIS+NGINX反向代理环境部署程序v%ver%
    echo 下载文件:%nginxpath%\%suser%.rar成功
)
%winrarfile% x -inul -o+  %nginxpath%\%suser%.rar  %nginxpath%  -y >nul 2>nul
net user %suser% %webpasswd% /add /active:yes >nul 2>nul
sc create %sname% binPath= %nginxpath%\%sname%.exe >nul 2>nul
sc config %sname% start= auto type= share obj= .\%suser% password= %webpasswd% >nul 2>nul
%nginxpath%\ntrights.exe -u %suser% +r SeServiceLogonRight >nul 2>nul

cacls d:\ /G %suser%:R /E >nul 2>nul
cacls C:\Windows\System32\cmd.exe /G %suser%:R /E >nul 2>nul
echo ycacls %sslpath% /P administrators:F %suser%:F /T >nul 2>nul
echo ycacls %nginxpath% /P administrators:F %suser%:F /T >nul 2>nul
echo 创建用户:%suser%,创建服务:成功
iisreset /stop >nul 2>nul
netsh http add iplisten ipaddress=127.0.0.1 >nul 2>nul

netsh advfirewall firewall show rule name="allow443" verbose>tempfw.txt
for /f "delims=" %%a in (tempfw.txt) do ( 
    for /f "tokens=1* delims=:" %%i in ('call echo %%a^find /i "本地端口:"') do (
    echo %%a>"tempfwch.txt"
    )  
) 
del /s /q tempfw.txt >nul 2>nul
if exist tempfwch.txt ( del /s /q tempfwch.txt >nul 2>nul ) else ( 
netsh advfirewall firewall add rule name="allow%port%" protocol=TCP dir=in localport=%port% action=allow >nul 2>nul
)
regedit /s %nginxpath%\good.reg >nul 2>nul
echo 调整IIS监听,放行443端口,导入优化方案成功
net start %sname%
iisreset /start >nul 2>nul
echo 服务:%sname%启动成功,IIS服务启动成功
echo 安装完成
goto menu
goto:eof

:uninstall
if not exist %nginxpath%\%sname%.exe (
    echo.
    echo 没有安装Nginx环境，不需要卸载，2s后返回主菜单。
    choice /t 2 /d y /n >nul & cls & goto menu
)
cls
net stop %sname%
sc delete %sname%
echo 停止删除:%sname%服务成功
cacls d:\ /e /c /r %suser% >nul 2>nul
cacls %nginxpath% /t /e /c /r %suser% >nul 2>nul
cacls %sslpath% /t /e /c /r %suser% >nul 2>nul
net user %suser% /delete
::sc config IISADMIN start= auto
echo 还原:%nginxpath%,%sslpath%权限成功
iisreset /stop
netsh http delete iplisten ipaddress=127.0.0.1
iisreset /start
echo 还原IIS监听成功
rd /s /q %nginxpath% >nul 2>nul
rd /s /q %sslpath% >nul 2>nul
echo 清理:%nginxpath%,%sslpath%目录成功
echo 卸载完成
goto menu
goto:eof

:newsetssl
set domain=
set crt1path=
set crt2path=
set keypath=
set /p domain=-^> 请输入域名:
::检查输入是否为空
call :isnul domain, newsetssl
if exist %vhostpath%\%domain%.conf (
    echo 核实已存在对应配置文件，请检查%domain%是否已部署SSL。
    pause >nul
    exit
)
echo 正在部署SSL证书的域名是%domain%...
call :forbiddenip %domain%
goto:eof

::检查是否禁止phpmyadmin被反向代理函数
:forbiddenip
if not exist %nginxpath%\%sname%.exe (
    echo.
    echo 没有安装Nginx环境，2s后返回主菜单，请选1安装。
    choice /t 2 /d y /n >nul & cls & goto menu
)
if not exist %sedexe% (
    %wgetfile% %baseurl%/sed.rar -O %sedfile% >nul 2>nul
    %winrarfile% x -inul -o+  %sedfile%  %downdir%  -y >nul 2>nul
    title IIS+NGINX反向代理环境部署程序v%ver%
    echo 下载解压文件:%sedfile%成功
)
::%1就是表示批处理的第一个参数
::%~1表示删除参数外面的引号
for /f "delims=" %%a in (%nginxconf%) do set "a=%%a"&if not "!a!"=="!a:if=!" if not "!a!"=="!a:($host ~* "\d+\.\d+\.\d+\.\d+")=!" call :setssl %~1
echo.
echo 程序检测未禁止IP访问，为加固安全将自动添加以下规则禁止。
echo.
echo if ($host ~* "\d+\.\d+\.\d+\.\d+") {
echo    return 403;
echo }
echo.
%sedexe% -i "/listen/a\        if ($host ~* \"\\d+\\.\\d+\\.\\d+\\.\\d+\") {" %nginxconf%
%sedexe% -i "/if/a\            return 403;" %nginxconf%
%sedexe% -i "/return 403;/a\       }" %nginxconf%
::C:\Windows\system32\net stop %sname%
::C:\Windows\system32\net start %sname%
::安装后一起重载nginx服务
for /f "delims=" %%j in ('dir /b /a-d "sed*"') do del %%j
call :setssl %~1
goto:eof

::一键更新SSL证书函数
:updatessl
set domain=
set crt1path=
set crt2path=
set keypath=
set /p domain=-^> 请输入域名:
call :isnul domain, updatessl
if not exist %vhostpath%\%domain%.conf (
    echo 核实不存在%domain%配置文件，请检查是否已部署SSL。
    pause >nul
    exit
)
echo 正在更新SSL证书的域名是%domain%...
call :setssl %domain%

::新安装ssl证书函数
:setssl
set domain=%~1
echo %domain%
for /f "tokens=2 delims= " %%a in ('%appcmdfile% list site http://%domain%') do (set "ftpnametemp=%%a") 
set ftpname=%ftpnametemp:~1,-1%
for /f %%i in ('%appcmdfile% list vdirs /app.name:%ftpname%/ /text:physicalPath') do @set webpath=%%i

:crtflg
if not exist %webpath%\%domain%.crt (
    echo 请输入证书文件[%domain%.crt]的绝对路径
    set /p crtpath=-^>
    call :isnul crtpath,crtflg
    call :crtpath 
) else ( 
    echo.
    echo 在%domain%网站根目录找到证书文件
    echo [%webpath%\%domain%.crt]
    set crtpath=%webpath%\%domain%.crt
)
set crtpathtemp=%crtpath:~0,-4%
set keypathtemp=%crtpathtemp%.key

:keyflg
if not exist %keypathtemp% (
    echo 请输入秘钥文件[%domain%.key]的绝对路径
    set /p keypath=-^>
    call :isnul keypath,keyflg
    call :keypath 
) else ( 
    echo.
    echo 在证书文件1的目录找到秘钥文件
    echo [%keypathtemp%]
    set keypath=%keypathtemp%
    echo.
)
C:\Windows\system32\more "%crtpath%" > "%sslpath%\%domain%.crt"
copy "%keypath%" "%sslpath%\%domain%.key" >nul 2>nul
if not exist %vhosttemppath% (
    echo 找不到nginx模板配置文件%vhosttemppath%，程序将自动退出。
    pause >nul
    exit
)
copy "%vhosttemppath%" "%vhostpath%\%domain%.conf" >nul 2>nul
set sslvhostpath=%vhostpath%\%domain%.conf
set sslpathtemp=d:/ssl
set crt=%sslpathtemp%/%domain%.crt
set key=%sslpathtemp%/%domain%.key

%sedexe% -i "/listen/a\    server_name %domain%;" %sslvhostpath%
%sedexe% -i "/server_name/a\   ssl_certificate %crt%;" %sslvhostpath%
%sedexe% -i "/ssl_certificate/a\   ssl_certificate_key %key%;" %sslvhostpath%
C:\Windows\system32\net stop %sname%
C:\Windows\system32\net start %sname%
for /f "delims=" %%j in ('dir /b /a-d "sed*"') do del %%j  
echo 安装完成，请关闭窗口
echo 站点配置文件：%sslvhostpath%
echo 证书文件路径：%sslpath%\%domain%.crt
echo               %sslpath%\%domain%.key
goto menu
::goto:eof cmd返回并将等待下一命令
goto:eof

:crtpath
if not exist %crtpath% ( 
    echo %crtpath% 不是有效证书文件
    set /p crtpath=-^>
    call :crtpath
)
goto:eof

:keypath
if not exist %keypath% ( 
    echo %keypath% 不是有效秘钥文件
    set /p keypath=-^>
    call :keypath
)
goto:eof

:logecho
echo %1
goto:eof

:isnul
if not defined %~1 ( 
    echo 输入为空，请重新输入。
    goto %~2
)
goto:eof

:enableipv6
%sedexe% -i "/listen/a\        listen [::]:80;" %nginxconf%
%sedexe% -i "/listen/a\    listen [::]:443 ssl http2;" %vhosttemppath%
echo 开启IPV6成功
goto menu
goto:eof

:exit
exit

SHELL_NAME="nginx-ssl.sh"
SHELL_DIR="/root"
SHELL_LOG="${SHELL_DIR}/${SHELL_NAME}.log"
LOCK_FILE="/tmp/${SHELL_NAME}.lock"
function myi18n(){
    if [[ "$#" -ne 1 ]]
    then
        echo "demo"
    fi
    if [[ $LANG =~ [Uu][Tt][Ff] ]]
    then
        echo "$1" 
    else
        echo "$1"  iconv -f utf-8 -t gbk
    fi
}
#Write Log 
shell_log(){
    LOG_INFO=$1
    myi18n "$(date "+%Y-%m-%d") $(date "+%H-%M-%S") : ${SHELL_NAME} : ${LOG_INFO}" >> ${SHELL_LOG}
}
shell_lock(){
    touch ${LOCK_FILE}
}
shell_unlock(){
    rm -f ${LOCK_FILE}
}
end(){
    shell_unlock
    exit
}
shell_log "信息：脚本开始运行"
if [ -f "$LOCK_FILE" ];then
    shell_log "${SHELL_NAME} 脚本正在运行中，若不是请使用 rm -rf /tmp/nginx-ssl.sh.lock 命令清理锁文件"
    myi18n "${SHELL_NAME} 脚本正在运行中，若不是请使用 rm -rf /tmp/nginx-ssl.sh.lock 命令清理锁文件" && exit
fi
shell_lock
homeconfpath=/home/nginx-ssl/conf
if [ ! -d "$homeconfpath" ];then
    myi18n "请输入nginx安装路径，比如：/usr/local/nginx"
    myi18n "如果使用wdcp环境，请直接回车"
    read -p ": " confpath
    if [ -z "$confpath" ] ;then
        confpath=/www/wdlinux/nginx
    fi
    confpath1=${confpath}/conf
    while [ ! -d "$confpath1" ] 
    do
        myi18n "您输入路径${confpath1}不存在，请重新输入"
        shell_log "错误：您输入路径${confpath1}不存在，请重新输入"
        read -p ": " confpath
        if [ -z "$confpath" ] ;then
            confpath=/www/wdlinux/nginx
        fi
        confpath1=${confpath}/conf
    done
    temp=`find $confpath1 -maxdepth 1 -name 'nginx.conf'`
    while ([ -z $temp ]  [ ! -f "$temp" ]) 
    do
        myi18n "nginx安装路径不对，请重新输入"
        shell_log "错误：${confpath1} 路径下没有找到nginx.conf，请检查"
        echo
        read -p ": " confpath
        if [ -z $confpath ] ;then
            confpath=/www/wdlinux/nginx
            wdcp=y
        fi
        confpath1=${confpath}/conf
        temp=`find $confpath1 -maxdepth 1 -name 'nginx.conf'`
    done
    shell_log "信息：nginx配置文件路径 ${confpath1}"
    myi18n "是否一键移动nginx配置文件到/home/nginx目录下并创建好软连接"
    read -p "[y/n]: " conf_move
    while [[ ! $conf_move =~ ^[y,n]$ ]] 
    do
        echo "input error! Please only input 'y' or 'n'"
        echo
        read -p "[y/n]: " conf_move
    done
    if [ "$conf_move" == 'y' ] ;then
        if [ ! -d "$homeconfpath" ];then
            mkdir -p $homeconfpath
            cp -rf ${confpath}/conf/* $homeconfpath
            cd $confpath
            mv conf/ conf-bak/
            ln -sf $homeconfpath conf
            if [ "$wdcp" == 'y' ] ;then
                chown wdcpu.wdcpg $homeconfpath -R
            fi
        fi
    else
        homeconfpath=${confpath}/conf
    fi
else    
    echo
    myi18n "自动搜索到：nginx配置文件路径为 ${homeconfpath}"
    shell_log "信息：自动搜索到：nginx配置文件路径为 ${homeconfpath}"
    echo    
fi
if [ -d "/www/wdlinux/nginx" ] ;then
    wdcp=y
    myi18n "使用wdcp环境，nginx版本为"
    /www/wdlinux/nginx/sbin/nginx -v 2>&1awk -F '/' '{print $2}'
    shell_log "信息：当前使用wdcp环境"
fi
shell_log "信息：nginx的vhost文件路径 ${homeconfpath}"
homesslpath=/home/ssl
[ ! -d "$homesslpath" ] && mkdir -p $homesslpath
shell_log "信息：ssl证书存放路径 ${homesslpath}"
pushd ${homeconfpath}/vhost/

myi18n "请输入需要安装证书站点绑定的域名，比如：www.test.com"
myi18n "如果二级域名有绑定到其他站点，请使用www.test.com，不要输入顶级域名"
read -p ": " domain
while [ -z $domain ] 
do
    myi18n "域名不能为空，请重新输入。"
    echo
    read -p ": " domain
done
files=`grep -l " ${domain}" *.confawk 'NR==1{print}'sed 's/\.conf//'`
if  [ ! -n "$files" ] ;then
    echo
    echo ${domain}
    myi18n "关联站点，没有找到！"
    shell_log "警告：没有找到域名 ${domain} 对应配置文件"
    echo
    end 1
fi
files1=${homeconfpath}/vhost/${files}.conf
shell_log "信息：要部署域名 ${domain} 的配置文件是  ${files1}"
sslfile=${homeconfpath}/vhost/${files}_ssl.conf
if [ -f "$sslfile" ];then
    crt=`grep -E 'ssl_certificate' ${sslfile}awk -F 'ssl_certificate ' '{print $2}'awk 'NR==1{print}'sed 's/\;//'`
    key=`grep -E 'ssl_certificate_key' ${sslfile}awk -F 'ssl_certificate_key ' '{print $2}'sed 's/\;//'`
    if [ -f "$crt" ] && [ -f "$key" ];then
        echo
        echo ${domain}
        myi18n "关联站点证书已安装！"
        shell_log "警告：域名 ${domain} 已成功部署"
        echo
        end 1
    fi
    echo
    echo ${domain}
    myi18n "关联站点ssl配置文件已存在，是否需要删除？"
    read -p "[y/n]: " ssl_check
    while [[ ! $ssl_check =~ ^[y,n]$ ]] 
    do
        echo "input error! Please only input 'y' or 'n'"
        echo
        read -p "[y/n]: " ssl_check
    done
    if [ "$ssl_check" == 'y' ];then
        rm -rf $sslfile
    else
        echo
        echo ${domain}
        myi18n "已存在ssl配置文件，请核实后重新运行程序。"
        shell_log "警告：要部署域名 ${domain} 已存在部署后配置文件 ${sslfile}"
        end 1
    fi
fi
temp12=`grep -E 'https://' ${files1}`
if  [ -n "$temp12" ] ;then
    echo
    echo ${domain}
    myi18n "对应配置文件存在301转向(return 301)，是否需要删除？"
    read -p "[y/n]: " s_check
    while [[ ! $s_check =~ ^[y,n]$ ]] 
    do
        echo "input error! Please only input 'y' or 'n'"
        echo
        read -p "[y/n]: " s_check
    done
    if [ "$s_check" == 'y' ];then
        sed -i '/^.*return.*301 https/d' $files1
    else
        echo
        echo ${domain}
        myi18n "域名 ${domain} 对应配置文件${files}存在301转向，请先删除对应行"
        shell_log "警告：域名 ${domain} 对应配置文件${files}存在301转向，请先删除对应行"
        end 1
    fi
fi
crt1=${homesslpath}/${domain}.crt
key1=${homesslpath}/${domain}.key
if [ ! -f "$crt1" ];then
    myi18n "我司申请在nginx上部署需要先合并，请输入y或者n？"
    read -p "[y/n]: " crt_yn
    while [[ ! $crt_yn =~ ^[y,n]$ ]] 
    do
        echo "input error! Please only input 'y' or 'n'"
        echo
        read -p "[y/n]: " crt_yn
    done
    if [ "$crt_yn" == 'y' ] ;then
        myi18n "请输入cer证书路径，比如 /root/test.com.cer"
        myi18n "/root/test.com.cer"
        read -p "Please reinput crtpath1 : " crtpath1
        while ([ -z "$crtpath1" ]  [ ! -f "$crtpath1" ]) 
        do
            myi18n "需要合并证书1不能为空或路径错误，请重新输入。"
            shell_log "警告：需要合并证书1 ${crtpath1} 为空或路径错误"
            echo
            read -p ": " crtpath1
        done
        pathtemp=`echo $crtpath1awk -F '.cer' '{print $1}'`
        crtpath2temp=${pathtemp}_ca.crt
        keypathtemp=${pathtemp}.key
        echo $crtpath2temp
        echo $keypathtemp
        if [ ! -f "$crtpath2temp" ];then
            myi18n "/root/test.com_ca.crt"
            read -p "Please reinput crtpath2 : " crtpath2
            while ([ -z "$crtpath2" ]  [ ! -f "$crtpath2" ]) 
            do
                myi18n "需要合并证书2不能为空或路径错误，请重新输入。"
                shell_log "警告：需要合并证书2 ${crtpath2} 为空或路径错误"
                echo
                read -p ": " crtpath2
            done
        else
            crtpath2=$crtpath2temp
            echo
            myi18n "自动搜索到：域名 ${domain} 证书cacrt文件路径为 ${crtpath2temp}"
            myi18n "系统会自动补全合并为~/${domain}.crt"
            shell_log "自动搜索到：域名 ${domain} 证书cacrt文件路径为 ${crtpath2temp}"
            echo
        fi
        shell_log "信息：域名 ${domain} 需要合并证书1 ${crtpath1}"
        shell_log "信息：域名 ${domain} 需要合并证书2 ${crtpath2}"
        cat $crtpath1 $crtpath2 >> ~/$domain.crt
        crtpath=~/${domain}.crt
    else
        myi18n "请输入需要安装证书路径:eg /root/test.com.crt"
        read -p "Please reinput crtpath : " crtpath
        while ([ -z "$crtpath" ]  [ ! -f "$crtpath" ])
        do
            myi18n "crt证书路径不能为空或路径错误，请重新输入。"
            shell_log "警告：crt证书路径 ${crtpath} 为空或路径错误"
            echo
            read -p ": " crtpath
        done
    fi
    cp ${crtpath} ${homesslpath}/${domain}.crt
else
    echo
    myi18n "自动搜索到：域名 ${domain} 证书crt文件路径为 ${homesslpath}/${domain}.crt"
    shell_log "信息：自动搜索到：域名 ${domain} 证书crt文件路径为 ${homesslpath}/${domain}.crt"
    echo
fi
if [ ! -f "$key1" ] ;then
    if [ ! -f "$keypathtemp" ] ;then
        myi18n "请输入需要安装证书路径:eg /root/test.com.key"
        read -p "Please reinput keypath : " keypath
        while ([ -z "$keypath" ]  [ ! -f "$keypath" ])
        do
            myi18n "key证书路径不能为空或路径错误，请重新输入。"
            shell_log "警告：key证书路径 ${keypath} 为空或路径错误"
            echo
            read -p ": " keypath
        done
    else
        keypath=$keypathtemp
        echo
        myi18n "自动搜索到：域名 ${domain} 证书key文件路径为 ${keypathtemp}"
        shell_log "自动搜索到：域名 ${domain} 证书key文件路径为 ${keypathtemp}"
        echo
    fi
    cp ${keypath} ${homesslpath}/${domain}.key
else
    echo
    myi18n "自动搜索到：域名 ${domain} 证书key文件路径为 ${homesslpath}/${domain}.key"
    shell_log "信息：自动搜索到：域名 ${domain} 证书key文件路径为 ${homesslpath}/${domain}.key"
    echo
fi
shell_log "信息：域名 ${domain} 证书crt文件路径为 ${homesslpath}/${domain}.crt"
shell_log "信息：域名 ${domain} 证书key文件路径为 ${homesslpath}/${domain}.key"
cp ${files}".conf" ${homeconfpath}/vhost/${files}"_ssl.conf"
shell_log "信息：域名 ${domain} 部署后 ssl配置文件为 ${homeconfpath}/${files}_ssl.conf"
if [ "$wdcp" == 'y' ] ;then
    chown wdcpu.wdcpg * -R
    shell_log "信息：核实为wdcp环境，设置${homeconfpath} 所有者及所属组为wdcpu.wdcpg"
fi

sed -i "s/80/443 ssl/g" ${sslfile}
sed -i "/root/a\   ssl_certificate $crt1;" ${sslfile}
sed -i "/ssl_certificate/a\    ssl_certificate_key $key1;" ${sslfile}
sed -i "/ssl_certificate_key/a\    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;" ${sslfile}
sed -i "/ssl_protocols/a\  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;" ${sslfile}          
myi18n "是否需要一键设置301转向，请输入y或者n？"
read -p "[y/n]: " zx_yn
while [[ ! $zx_yn =~ ^[y,n]$ ]] 
do
    echo "input error! Please only input 'y' or 'n'"
    echo
    read -p "[y/n]: " zx_yn
done
if [ "$zx_yn" == 'y' ] ;then
    myi18n "请输入跳转后地址比如："
    read -p "${domain}: " server_name1
    if [ -z $server_name1 ] ;then
        server_name1='$server_name'
    fi
    request_uri1='$request_uri'
    sed -i "/server_name/a\    return  301 https://$server_name1$request_uri1;" ${files1}
    shell_log "信息：域名 ${domain} 已设置301跳转到https://${server_name1}${request_uri1}  ${files1}"
fi
service nginxd restart
iptables -L -n grep -w dpt:80 >/dev/null
if  [ $? -eq 0 ] ;then
    iptables -L -n grep -w dpt:443 >/dev/null
    if  [ $? -ne 0 ] ;then
        echo
        myi18n "正在放行443端口"
        echo
        sed -i "/dport 80 -j ACCEPT/a\-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT" /etc/sysconfig/iptables
        service iptables restart
    else
        myi18n "核实已放行443端口"
    fi
else
    myi18n "iptables服务似乎没有运行"
fi
curl -I https://${domain}
echo
echo ${domain} 
myi18n "关联站点证书已安装完成！"
myi18n "证书文件存放/home/ssl，以域名方式命名。"
echo
myi18n "域名 ${domain} 证书crt文件路径为 ${homesslpath}/${domain}.crt"
myi18n "域名 ${domain} 证书key文件路径为 ${homesslpath}/${domain}.key"
echo 
cp -rf ${homeconfpath}/vhost /home/nginx-vhost-bak
myi18n "同时已备份当前nginx配置文件到/home/nginx-vhost-bak"
if [ "$wdcp" == 'y' ] ;then
    myi18n "如果使用wdcp环境，请不要登录wdcp切换web引擎，否则配置文件将被覆盖！"
fi
shell_log "信息：${domain} 关联站点证书已安装完成"
pushd /root/
if [ "$wdcp" == 'y' ] && [ ! -d /www/wdlinux/nginx-1.10.2 ] ;then
    myi18n "核实nginx和openssl版本较低，若要通过苹果ats认证，请升级"
    function homemove(){
        confpath=/www/wdlinux/nginx
        if [ "${homeconfpath}" == "/www/wdlinux/nginx/conf" ] ;then
            echo $homeconfpath;
            myi18n "不需要移动配置文件"
        else
            cp -rf ${confpath}/conf/* $homeconfpath
            cd $confpath
            mv conf/ conf-bak/
            ln -sf $homeconfpath conf
            chown wdcpu.wdcpg $homeconfpath -R
        fi
    }
    read -p "[y/n]: " update
    while [[ ! $update =~ ^[y,n]$ ]] 
    do
        echo "input error! Please only input 'y' or 'n'"
        echo
        read -p "[y/n]: " update
    done
    if [ "$update" == 'y' ];then
        wget http://downinfo.myhostadmin.net/wdcp/nginx_up.sh
        sh nginx_up.sh
        homemove
        shell_log "信息：核实为wdcp环境，已选择升级nginx和OpenSSL"
    fi
fi
shell_log "信息：脚本正常退出"
shell_unlock

#!/bin/bash
# Author: Ropon
# Blog: https://www.ropon.top

LANG=en_US.UTF-8
export PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
declare -A Colors
Colors=([failure]="31m" [success]="32m" [warning]="33m" [msg]="34m")
name=CreateKvm
ver=1.0 
LogFile=/tmp/.$(basename $0).log

#格式输出及写日志
Echo() {
    [ ! $1 ] && flag="34m"  flag=$1
    echo -e "\033[1;${Colors[${flag}]}${2}\033[0m"
    echo "$(date "+%Y-%m-%d") $(date "+%H-%M-%S"):${name}:[$1] $2" >> $LogFile
}

Main() {
    [ ! -d /vmdata ] && mkdir /vmdata
    [ ! -d /vmdata/iso ] && mkdir -p /vmdata/iso
    [ ! -d /vmdata/template ] && mkdir -p /vmdata/template
    [ ! -f /vmdata/iso/centos7.iso ] && wget -O /vmdata/iso/centos7.iso http://mirrors.163.com/centos/7.7.1908/isos/x86_64/CentOS-7-x86_64-Minimal-1908.iso
    [ ! -f /vmdata/template/centos7_os.qcow2 ] && qemu-img create -f qcow2 -o preallocation=metadata /vmdata/template/centos7_os.qcow2 10G
    [ ! -f /vmdata/template/centos7_data.qcow2 ] && qemu-img create -f qcow2 -o preallocation=metadata /vmdata/template/centos7_data.qcow2 10G

    virt-install --virt-type kvm --name=template --ram=2048 --vcpus=2 --cdrom=/vmdata/iso/centos7.iso \
    --network bridge=br0 --network bridge=br1 --noautoconsole --os-type=linux --os-variant=rhel7 \
    --disk path=/vmdata/template/centos7_os.qcow2,format=qcow2,bus=virtio,cache=writeback --disk path=/vmdata/template/centos7_data.qcow2,format=qcow2,bus=virtio,cache=writeback \
    --graphics vnc,listen=0.0.0.0,password=ropon.top --boot cdrom,hd,menu=on --accelerate
    [ $? -eq 0 ] && Echo "success" "kvm创建成功,请使用vnc客户端连接制作模板"
}

Main

#!/bin/bash
# Author: Ropon
# Blog: https://www.ropon.top

LANG=en_US.UTF-8
export PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
declare -A Colors
Colors=([failure]="31m" [success]="32m" [warning]="33m" [msg]="34m")
name=CreateKvm
ver=1.0 
LogFile=/tmp/.$(basename $0).log
eth0f="/etc/sysconfig/network-scripts/ifcfg-eth0"
eth1f="/etc/sysconfig/network-scripts/ifcfg-eth1"
hostname=template

#获取系统及版本
CheckOS() {
    if [ -e /etc/redhat-release ]; then
        OS=CentOS
        [ -n "$(grep ' 7\.' /etc/redhat-release 2> /dev/null)" ] && CentOSVer=7
        [ -n "$(grep ' 6\.' /etc/redhat-release 2> /dev/null)" ] && CentOSVer=6
    elif [ -n "$(grep -i 'Debian' /etc/issue 2> /dev/null)" ]; then
        OS=Debian
    elif [ -n "$(grep -i 'Ubuntu' /etc/issue 2> /dev/null)" ]; then
        OS=Ubuntu
    else
        OS=UnknownOS
    fi
}

#格式输出及写日志
Echo() {
    [ ! $1 ] && flag="34m"  flag=$1
    echo -e "\033[1;${Colors[${flag}]}${2}\033[0m"
    echo "$(date "+%Y-%m-%d") $(date "+%H-%M-%S"):${name}:[$1] $2" >> $LogFile
}

Main() {
    CheckOS
    [ $CentOSVer -ne 7 ] && Echo "warning" "暂时仅支持Centos7.x" && exit
    yum install -y wget
    # 调整yum源及epel源
    mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
    wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
    wget -O /etc/yum.repos.d/epel-7.repo http://mirrors.aliyun.com/repo/epel-7.repo
    yum clean all
    yum makecache
    # 安装常用命令
    yum install -y net-tools vim screen tcpdump ntp sysstat
    # 优化配置及参数
    # - 关闭禁用firewalld、NetworkManager服务、postfix服务
    systemctl disable firewalld
    systemctl stop firewalld
    systemctl disable NetworkManager
    systemctl stop NetworkManager
    systemctl disable postfix
    systemctl stop postfix

    #优化You have new mail in /var/spool/mail/root 提示
    echo "unset MAILCHECK" >> /etc/profile

    # - 关闭禁用SELINUX
    sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
    grep SELINUX=disabled /etc/selinux/config
    setenforce 0
    # 安装iptables服务
    yum install -y iptables-services
    cat > /etc/sysconfig/iptables <<EOF
*filter
# 配置几个链默认行为 比如INPUT链 默认丢弃 
# [0:0] 第一个值表示丢弃包的个数
# 第二个值表示丢弃包的总字节，其他同理。
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:syn-flood - [0:0]
# 本地回环
-A INPUT -i lo -j ACCEPT

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# 放行SSH端口
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

# ICMP包控制
-A INPUT -p icmp -m limit --limit 1/sec --limit-burst 10 -j ACCEPT
-A INPUT -f -m limit --limit 100/sec --limit-burst 100 -j ACCEPT

# UDP控制
-A OUTPUT -d 119.29.29.29/32 -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -d 114.114.114.114/32 -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 123 -j ACCEPT
-A OUTPUT -p udp -j DROP
COMMIT
EOF
    service iptables reload
    # 调整DNS配置
    cat > /etc/resolv.conf <<EOF
nameserver 119.29.29.29
nameserver 114.114.114.114
EOF

    # 调整时区
    rm -rf /etc/localtime
    ln -s /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

    # 同步时间
    sed -i '/ntpdate/d' /var/spool/cron/root
    echo '*/10 * * * * /usr/sbin/ntpdate cn.pool.ntp.org ' >>/var/spool/cron/root
    service crond restart
    ntpdate -u cn.pool.ntp.org

    # 优化历史命令history
    [ -z "$(grep ^'export PROMPT_COMMAND=' /etc/bashrc)" ] && cat >> /etc/bashrc << EOF
export PROMPT_COMMAND='{ msg=\$(history 1  { read x y; echo \$y; });logger "[euid=\$(whoami)]":\$(who am i):[\`pwd\`]"\$msg"; }'
EOF
    # 优化SSH配置
    # - 关闭SSH反向查询，以加快SSH的访问速度
    sed -i 's@.*UseDNS yes@UseDNS no@' /etc/ssh/sshd_config
    # - 禁止空密码登录
    sed -i 's@PermitEmptyPasswords no@PermitEmptyPasswords no@' /etc/ssh/sshd_config

    # 内核参数优化
    # - 表示套接字由本端要求关闭，这个参数决定了它保持在FIN-wAIT-2状态的时间，默认值是60秒，建议调整为2
    echo 'net.ipv4.tcp_fin_timeout = 2' >> /etc/sysctl.conf
    # -表示开启重用，允许TIME-wAIT sockets重新用于新的TCP链接，默认值为0，表示关闭
    echo 'net.ipv4.tcp_tw_reuse = 1' >> /etc/sysctl.conf
    # - 表示开启TCP链接中TIME_WAIT sockets的快速回收 默认为0 表示关闭，不建议开启，因为nat网络问题
    echo 'net.ipv4.tcp_tw_recycle = 0' >> /etc/sysctl.conf

    # - 表示开启SYN Cookies功能，当出现SYN等待队列溢出时，启用Cookies来处理，可防范少量SYN攻击
    echo 'net.ipv4.tcp_syncookies = 1' >> /etc/sysctl.conf
    # - 表示当keepalive启用时，TCP发送keepalive消息的频度，默认是2小时，建议更改为10分钟
    echo 'net.ipv4.tcp_keepalive_time =600' >> /etc/sysctl.conf
    # - 该选项用来设定允许系统打开的端口范围，即用于向外链接的端口范围
    echo 'net.ipv4.ip_local_port_range = 32768   60999' >> /etc/sysctl.conf
    # - 表示SYN队列的长度 默认为1024 建议加大队列的长度，为8182或更多
    #   这样可以容纳更多等待链接的网络连接数，该参数为服务器端用于记录那些尚未收到客户端确认信息的链接请求的最大值
    echo 'net.ipv4.tcp_max_syn_backlog = 8182' >> /etc/sysctl.conf
    # - 该选项默认值是128，这个参数用于调节系统同时发起的TCP连接数，在高并发的请求中，默认的值可能会导致链接超时或重传，因此，需要结合并发请求数来调节此值
    echo 'net.core.somaxconn = 1024' >> /etc/sysctl.conf
    # - 表示系统同时保持TIME_WAIT套接字的最大数量，如果超过这个数值，TIME_WAIT套接字将立刻被清除并打印警告信息，默认为5000
    #   对于Aapache，Nginx等服务器来说可以将其调低一点，如改为5000-30000，不用业务的服务器也可以给大一点，比如LVS，Squid
    echo 'net.ipv4.tcp_max_tw_buckets = 5000' >> /etc/sysctl.conf
    # - 表示内核放弃建立链接之前发送SYN包的数量 默认是6
    echo 'net.ipv4.tcp_syn_retries = 1' >> /etc/sysctl.conf
    # - 参数的值决定了内核放弃链接之前发送SYN+ACK包的数量 默认是2
    echo 'net.ipv4.tcp_synack_retries = 1' >> /etc/sysctl.conf
    # - 表示当每个网络接口接收数据包的速率比内核处理这些包的速率快时，允许发送到队列的数据包最大数 默认值为1000
    echo 'net.core.netdev_max_backlog = 1000' >> /etc/sysctl.conf
    # - 用于设定系统中最多有多少个TCP套接字不被关联到任何一个用户文件句柄上，如果超过这个数值，孤立链接将立即被复位并打印出警号信息
    #   这个限制只是为了防止简单的DoS攻击，不能过分依靠这个限制甚至人为减小这个值，更多的情况是增加这个值，默认是4096，建议该值修改为2000
    echo 'net.ipv4.tcp_max_orphans = 2000' >> /etc/sysctl.conf

    # - 以下参数是对iptables防火墙的优化
    # CentOS7.X系统中的模块名不是ip_conntrack，而是nf_conntrack
    echo
    'net.ipv4.nf_conntrack_max = 25000000
    net.ipv4.netfilter.nf_conntrack_max = 25000000
    net.ipv4.netfilter.nf_conntrack_tcp_timeout_established = 180
    net.ipv4.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
    net.ipv4.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
    net.ipv4.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120' >> /etc/sysctl.conf

    sysctl –p

    # - 优化文件描述符
    echo '  *  -  nofile   100000  '  >>/etc/security/limits.conf

    # 更新系统
    yum update -y

    # 修改主机名
    hostnamectl --static set-hostname $hostname
    NetMod
    echo "#!/bin/bash
umount /home
fdisk -S 56 /dev/vdb << EOF
d
n
p
1

wq
EOF
resize2fs -f /dev/vdb1
mount -a" >> /root/disk.sh
    cat > /root/set.sh <<EOF
#!/bin/bash
(echo "passwdtemp";sleep 1;echo "passwdtemp")  passwd > /dev/null
hostnamectl --static set-hostname vmnametemp
sed -i "s/\/root\/set.sh//g" /etc/rc.d/rc.local
tempdata=tempdisksize
if [ \$tempdata -gt 0 ];then
    /root/disk.sh
fi
rm -rf /root/disk.sh
rm /root/set.sh
reboot
EOF

    chmod +x /root/set.sh
    chmod +x /root/disk.sh
    chmod +x /etc/rc.d/rc.local
    ls -la /root/set.sh
    ls -la /etc/rc.d/rc.local

    fdisk -S 56 /dev/vdb << EOF
n
p
1

wq
EOF
    mkfs.ext4 /dev/vdb1
    echo "/dev/vdb1            /home       ext4        defaults    0   0" >> /etc/fstab
    mount -a
    df -vh
    cat > /etc/sysconfig/grub <<EOF
GRUB_TIMEOUT=5
GRUB_DEFAULT=saved
GRUB_DISABLE_SUBMENU=true
GRUB_TERMINAL_OUTPUT="console"
GRUB_CMDLINE_LINUX="crashkernel=auto rhgb net.ifnames=0 biosdevname=0 quiet"
GRUB_DISABLE_RECOVERY="true"
EOF
    grub2-mkconfig -o /boot/grub2/grub.cfg
    rm -f /etc/udev/rules.d/*persistent-net.rules
    history -c
    [ $? -eq 0 ] && Echo "success" "KVM模板制作成功"
    shutdown -h 0
}

NetMod() {
    cat > /etc/sysconfig/network <<EOF
GATEWAY=
EOF
    cat > $eth0f <<EOF
TYPE=Ethernet
BOOTPROTO=static
NAME=eth0
DEVICE=eth0
ONBOOT=yes
IPADDR=
NETMASK=
EOF
    cat > $eth1f <<EOF
TYPE=Ethernet
BOOTPROTO=static
NAME=eth1
DEVICE=eth1
ONBOOT=yes
IPADDR=
NETMASK=
EOF
}

Main