jacek4yang · jacek4yang · Aug 13, 2026 · Aug 13, 2026
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -25,19 +25,15 @@ jobs:
           TAG: ${{ github.ref_name }}
         run: |
           set -euo pipefail
-          archive="rust-xhttp-${TAG}-x86_64-unknown-linux-gnu"
-          mkdir "$archive"
-          cp target/release/rust-xhttp README.md README.zh-CN.md LICENSE \
-            config.example.json config.acme.example.json "$archive/"
-          cp -r docs "$archive/"
-          tar -czf "$archive.tar.gz" "$archive"
-          sha256sum "$archive.tar.gz" > "$archive.tar.gz.sha256"
+          mkdir release-dist
+          scripts/package_release.sh "$TAG" release-dist
       - name: Publish GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
         run: |
           set -euo pipefail
           archive="rust-xhttp-${TAG}-x86_64-unknown-linux-gnu.tar.gz"
-          gh release create "$TAG" "$archive" "$archive.sha256" \
+          gh release create "$TAG" "release-dist/$archive" \
+            "release-dist/$archive.sha256" "release-dist/install.sh" \
             --title "rust-xhttp $TAG" --generate-notes --verify-tag
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,34 @@ follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-08-14
+
+### Added
+
+- Added the separate Rust `rust-xhttpctl` interactive installer and lifecycle
+  manager for systemd installation, status/log access, diagnosis, transactional
+  config editing, repair, update, rollback, and preserve-or-purge uninstall.
+- Added a version-pinned one-command bootstrap that verifies the GitHub Release
+  SHA-256 before starting the Rust wizard.
+- Added bilingual installation and long-term management documentation plus an
+  alternate-root installer smoke test in the required quality gate.
+
+### Changed
+
+- Run managed deployments as a dedicated non-login user with stable `/etc`,
+  `/usr/local/bin`, and `/var/lib` paths instead of a root-owned working tree.
+- Package both the daemon and manager, the pinned bootstrap, configuration
+  examples, and bilingual documentation in every Linux release archive.
+
+### Security
+
+- Hardened the canonical systemd unit with config preflight, a read-only system,
+  home/device isolation, restricted address families, and only
+  `CAP_NET_BIND_SERVICE`.
+- Online updates enforce HTTPS-only redirects, validated tags/archive paths,
+  matching binary versions, published SHA-256 verification, config preflight,
+  atomic replacement, and automatic failed-activation rollback.
+
 ## [0.1.1] - 2026-08-14
 
 ### Changed
@@ -40,4 +68,5 @@ follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 [0.1.0]: https://github.com/jacek4yang/rust-xhttp/releases/tag/v0.1.0
 [0.1.1]: https://github.com/jacek4yang/rust-xhttp/compare/v0.1.0...v0.1.1
-[Unreleased]: https://github.com/jacek4yang/rust-xhttp/compare/v0.1.1...HEAD
+[0.2.0]: https://github.com/jacek4yang/rust-xhttp/compare/v0.1.1...v0.2.0
+[Unreleased]: https://github.com/jacek4yang/rust-xhttp/compare/v0.2.0...HEAD
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rust-xhttp"
-version = "0.1.1"
+version = "0.2.0"
 edition = "2024"
 rust-version = "1.88"
 description = "Pure-Rust XHTTP/VLESS server wire-compatible with the official Xray-core client (XHTTP packet-up + VLESS + VLESS-Encryption + Vision + XUDP)"
@@ -23,6 +23,10 @@ path = "src/lib.rs"
 name = "rust-xhttp"
 path = "src/main.rs"
 
+[[bin]]
+name = "rust-xhttpctl"
+path = "src/bin/rust-xhttpctl.rs"
+
 [dependencies]
 # async runtime / io
 tokio = { version = "1.40", features = ["rt-multi-thread", "net", "io-util", "time", "sync", "macros", "signal"] }

diff --git a/README.md b/README.md
@@ -58,6 +58,7 @@ Single crate, one module per protocol layer (mirrors the sibling `rust-reality`
 | Path | Responsibility |
 |------|----------------|
 | `src/main.rs`, `src/runtime.rs` | entry point + stack wiring |
+| `src/bin/rust-xhttpctl.rs`, `src/management.rs` | interactive installer and lifecycle manager |
 | `src/config.rs` | strict Xray-shaped JSON schema, validation, safe defaults |
 | `src/acme.rs` | HTTP-01 issuance, renewal backoff, atomic certificate activation |
 | `src/origin.rs` | hyper 1.x origin over in-tree TLS 1.3/H2, HTTP/1.1, and h2c; health routes |
@@ -73,47 +74,120 @@ Per-protocol ground-truth maps and deployment notes live in [`docs/`](docs/).
 The non-XHTTP static fallback is documented in
 [`docs/static-fallback.md`](docs/static-fallback.md).
 
-## Build & test
+## One-command interactive installation
+
+The managed installer currently targets **x86_64 Linux with systemd**. Before
+running it, point an A/AAAA record at the server and allow inbound TCP 443. The
+recommended automatic-certificate mode also needs inbound TCP 80 for ACME
+HTTP-01. Then run:
+
+```bash
+curl --proto '=https' --tlsv1.2 -fsSL \
+  https://github.com/jacek4yang/rust-xhttp/releases/latest/download/install.sh | sudo sh
+```
+
+The shell file is only a small bootstrap: it resolves one immutable GitHub
+release, downloads the archive and its published SHA-256 file, verifies them,
+then starts the **Rust `rust-xhttpctl` wizard** on the terminal. If you prefer to
+inspect every privileged instruction first:
 
 ```bash
-cargo build --release            # → target/release/rust-xhttp
-cargo test                       # unit + reorder + crypto + integration
-cargo clippy --all-targets --all-features -- -D warnings
-cargo fmt --all -- --check
+curl --proto '=https' --tlsv1.2 -fLo install.sh \
+  https://github.com/jacek4yang/rust-xhttp/releases/latest/download/install.sh
+less install.sh
+sudo sh install.sh
 ```
 
-Requires Rust 1.88+ (edition 2024; required for the security-fixed `time` dependency).
+The wizard can configure:
+
+- automatic Let's Encrypt issuance and renewal, existing PEM files, or
+  plaintext behind Cloudflare/nginx/another TLS terminator;
+- domain, listen address/port, generated or supplied UUID, randomized XHTTP
+  path, and optional `xtls-rprx-vision` flow;
+- a generated customizable blog, or a copied/preloaded user `dist` directory;
+- a dedicated unprivileged `rust-xhttp` account and a hardened, enabled systemd
+  service with only `CAP_NET_BIND_SERVICE`.
+
+It validates syntax and referenced resources before systemd starts the service.
+PEM keys are copied with restricted permissions; custom site content is copied
+under the service-owned state directory. Existing configuration is backed up.
+
+### Long-term management
+
+The installed `rust-xhttpctl` binary owns the complete lifecycle:
+
+| Task | Command |
+| --- | --- |
+| Interactive management menu | `sudo rust-xhttpctl manage` |
+| Service status | `rust-xhttpctl status` |
+| Follow the last 100 journal lines | `rust-xhttpctl logs` |
+| Check files, config, systemd enablement and health | `rust-xhttpctl doctor` |
+| Validate, edit, back up and atomically activate config | `sudo rust-xhttpctl edit` |
+| Start/stop/restart | `sudo rust-xhttpctl service restart` |
+| Verified update to the latest release | `sudo rust-xhttpctl update` |
+| Install a specific release | `sudo rust-xhttpctl update v0.2.0` |
+| Swap back to the previous binary set | `sudo rust-xhttpctl rollback` |
+| Recreate permissions and the hardened unit | `sudo rust-xhttpctl repair` |
+| Remove service/binaries but preserve config and data | `sudo rust-xhttpctl uninstall` |
+| Remove service, config, ACME keys, site and rollback data | `sudo rust-xhttpctl uninstall --purge` |
+
+Updates are transactional: the manager verifies the archive checksum, checks
+the new daemon against the installed config, retains the current daemon and
+manager as one rollback set, restarts systemd, and restores the previous set if
+activation fails. `edit` follows the same validate-before-restart rule and
+restores its timestamped backup after a failed restart.
+
+Managed files use this stable layout:
+
+```text
+/usr/local/bin/rust-xhttp       # network daemon
+/usr/local/bin/rust-xhttpctl    # installer and lifecycle manager
+/etc/rust-xhttp/config.json     # Xray-shaped configuration
+/etc/rust-xhttp/backups/        # configuration history
+/etc/rust-xhttp/tls/            # copied manual PEM files
+/var/lib/rust-xhttp/acme/       # ACME account, cert and renewal state
+/var/lib/rust-xhttp/site/       # optional preloaded dist site
+/var/lib/rust-xhttp-manager/    # update/rollback state (root-only)
+```
+
+Read the full [installation and management guide](docs/installation-management.md)
+for firewall, reverse-proxy, recovery and trust details. Configuration mirrors
+Xray's `inbounds/settings/streamSettings/xhttpSettings` layout; see the complete
+[configuration guide](docs/configuration.md).
+
+### Existing config, manual release, or source build
 
-Official Linux release binaries target `x86-64-v3` (Haswell/Zen or newer). Build
-from source with an overridden `RUSTFLAGS` value for older CPUs; see
-[`docs/production-hardening.md`](docs/production-hardening.md).
+To install a reviewed existing config from an extracted release:
 
-## Install
+```bash
+sudo ./rust-xhttpctl install \
+  --server-binary ./rust-xhttp \
+  --ctl-binary ./rust-xhttpctl \
+  --config /path/to/config.json
+```
 
-Download the current `x86_64-unknown-linux-gnu` archive from
-[GitHub Releases](https://github.com/jacek4yang/rust-xhttp/releases/latest), or build locally:
+To build both binaries yourself, install Rust 1.88+ and run:
 
 ```bash
 git clone https://github.com/jacek4yang/rust-xhttp.git
 cd rust-xhttp
-cargo build --locked --release
+cargo build --locked --release --bins
+sudo target/release/rust-xhttpctl install \
+  --server-binary target/release/rust-xhttp \
+  --ctl-binary target/release/rust-xhttpctl
 ```
 
-## Run
+Official Linux binaries target `x86-64-v3` (Haswell/Zen or newer). Older CPUs
+must build from source with a compatible `RUSTFLAGS` target. The daemon remains
+usable without systemd for containers or custom supervisors:
 
 ```bash
-cp config.acme.example.json config.json # edit UUID, domain, path, and email
-./target/release/rust-xhttp check config.json
-sudo ./target/release/rust-xhttp config.json
+rust-xhttp check /path/to/config.json
+rust-xhttp /path/to/config.json
 ```
 
-The config mirrors Xray's `inbounds/settings/streamSettings/xhttpSettings`
-layout. Direct TLS can use user-managed PEM files or built-in ACME HTTP-01 with
-background renewal and atomic activation. Ordinary traffic is a generated,
-customizable blog by default, or a preloaded user `dist` directory. Logging is
-controlled by `log.loglevel` or `RUST_LOG`. See the complete
-[configuration guide](docs/configuration.md) and
-[performance/availability analysis](docs/performance-and-availability.md).
+For development, run `cargo test`, `cargo clippy --all-targets -- -D warnings`,
+and `cargo fmt --all -- --check`.
 
 ## Scope & non-claims
 
@@ -137,6 +211,7 @@ welcome under [`CONTRIBUTING.md`](CONTRIBUTING.md).
 | --- | --- | --- |
 | Documentation index | [English](docs/index.md) | [简体中文](docs/index.zh-CN.md) |
 | Configuration and deployment | [English](docs/configuration.md) | [简体中文](docs/configuration.zh-CN.md) |
+| Installation and management | [English](docs/installation-management.md) | [简体中文](docs/installation-management.zh-CN.md) |
 | Benchmarks and evidence | [English](docs/benchmarks.md) | [简体中文](docs/benchmarks.zh-CN.md) |
 | Performance and availability | [English](docs/performance-and-availability.md) | [简体中文](docs/performance-and-availability.zh-CN.md) |
 | Hotspot optimization report | [English](docs/performance-hotspots.md) | [简体中文](docs/performance-hotspots.zh-CN.md) |

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -52,6 +52,7 @@ XHTTP (packet-up) + VLESS + VLESS-Encryption + xtls-rprx-vision + XUDP
 | 路径 | 职责 |
 | --- | --- |
 | `src/main.rs`, `src/runtime.rs` | 入口与协议栈装配 |
+| `src/bin/rust-xhttpctl.rs`, `src/management.rs` | 交互式安装与生命周期管理 |
 | `src/config.rs` | 严格 Xray 风格 JSON、校验与安全默认值 |
 | `src/acme.rs` | HTTP-01 签发、续期退避与证书原子激活 |
 | `src/origin.rs` | 内置 TLS 1.3/H2、HTTP/1.1 与 h2c 的 hyper 源站 |
@@ -63,30 +64,112 @@ XHTTP (packet-up) + VLESS + VLESS-Encryption + xtls-rprx-vision + XUDP
 | `src/xudp.rs` | XUDP 与普通 VLESS-UDP 编解码 |
 | `src/site.rs` | 自动生成博客或预加载用户 `dist` 网站 |
 
-## 构建、安装与运行
+## 一条命令交互式安装
 
-需要 Rust 1.88+（edition 2024，确保使用已修复安全问题的 `time` 依赖）。官方 Linux 发布包使用 `x86-64-v3`，要求
-Haswell/Zen 或更新 CPU；旧 CPU 请参考
-[`docs/production-hardening.md`](docs/production-hardening.md) 从源码构建。
+托管安装器目前支持使用 systemd 的 **x86_64 Linux**。安装前请把域名 A/AAAA
+记录指向服务器并放行 TCP 443；推荐的自动证书模式还需要放行 TCP 80，以完成
+ACME HTTP-01 验证。然后执行：
+
+```bash
+curl --proto '=https' --tlsv1.2 -fsSL \
+  https://github.com/jacek4yang/rust-xhttp/releases/latest/download/install.sh | sudo sh
+```
+
+这段 shell 只是很薄的引导程序：它锁定同一个不可变 GitHub Release，下载压缩包和
+Release 中公布的 SHA-256 文件并在本机校验，随后在当前终端启动 **Rust 编写的
+`rust-xhttpctl` 安装向导**。如果希望先审查全部提权指令：
+
+```bash
+curl --proto '=https' --tlsv1.2 -fLo install.sh \
+  https://github.com/jacek4yang/rust-xhttp/releases/latest/download/install.sh
+less install.sh
+sudo sh install.sh
+```
+
+交互向导支持：
+
+- Let's Encrypt 自动申请/续期、已有 PEM 证书，或位于 Cloudflare/nginx/其他 TLS
+  终止器后的明文回源；
+- 域名、监听地址与端口、自动生成或用户提供的 UUID、随机 XHTTP 路径，以及可选
+  `xtls-rprx-vision` flow；
+- 默认生成的可定制博客，或者复制并预加载用户指定的 `dist` 目录；
+- 创建独立低权限 `rust-xhttp` 用户，以及仅保留 `CAP_NET_BIND_SERVICE` 的加固
+  systemd service，并立即设置开机启动。
+
+安装器会在 systemd 启动前校验 JSON 和引用资源。手动证书私钥会以受限权限复制；
+自定义网站复制到服务自己的状态目录；现有配置会先备份。
+
+### 长期管理
+
+安装后的 `rust-xhttpctl` 覆盖完整生命周期：
+
+| 操作 | 命令 |
+| --- | --- |
+| 交互式管理菜单 | `sudo rust-xhttpctl manage` |
+| 查看服务状态 | `rust-xhttpctl status` |
+| 跟踪最近 100 行 journal 日志 | `rust-xhttpctl logs` |
+| 检查文件、配置、systemd 启用与运行状态 | `rust-xhttpctl doctor` |
+| 校验、编辑、备份并原子启用配置 | `sudo rust-xhttpctl edit` |
+| 启动/停止/重启 | `sudo rust-xhttpctl service restart` |
+| 校验并升级到最新 Release | `sudo rust-xhttpctl update` |
+| 安装指定 Release | `sudo rust-xhttpctl update v0.2.0` |
+| 切换回上一套二进制 | `sudo rust-xhttpctl rollback` |
+| 修复权限和加固 systemd unit | `sudo rust-xhttpctl repair` |
+| 删除服务和二进制，保留配置与数据 | `sudo rust-xhttpctl uninstall` |
+| 连同配置、ACME 密钥、网站和回滚数据彻底删除 | `sudo rust-xhttpctl uninstall --purge` |
+
+升级是事务式的：管理器会校验压缩包 SHA-256，用新服务端预检当前配置，把现有服务端
+和管理器作为一套回滚版本保存，重启 systemd；如果启用失败，会自动恢复旧版本。
+`edit` 同样坚持“先校验、再重启”，重启失败时恢复带时间戳的配置备份。
+
+托管安装使用固定目录：
+
+```text
+/usr/local/bin/rust-xhttp       # 网络服务端
+/usr/local/bin/rust-xhttpctl    # 安装与生命周期管理器
+/etc/rust-xhttp/config.json     # Xray 风格配置
+/etc/rust-xhttp/backups/        # 配置历史
+/etc/rust-xhttp/tls/            # 安装器复制的手动 PEM
+/var/lib/rust-xhttp/acme/       # ACME 账户、证书与续期状态
+/var/lib/rust-xhttp/site/       # 可选的预加载 dist 网站
+/var/lib/rust-xhttp-manager/    # root-only 升级与回滚状态
+```
+
+防火墙、反代、恢复和信任边界详见[安装与长期管理指南](docs/installation-management.zh-CN.md)；
+JSON 字段见[完整配置指南](docs/configuration.zh-CN.md)。
+
+### 使用现有配置、手动 Release 或源码安装
+
+从 Release 解压后，可以安装一份已经审查的配置：
+
+```bash
+sudo ./rust-xhttpctl install \
+  --server-binary ./rust-xhttp \
+  --ctl-binary ./rust-xhttpctl \
+  --config /path/to/config.json
+```
+
+也可以安装 Rust 1.88+ 后自己构建两个二进制：
 
 ```bash
 git clone https://github.com/jacek4yang/rust-xhttp.git
 cd rust-xhttp
-cargo build --locked --release
+cargo build --locked --release --bins
+sudo target/release/rust-xhttpctl install \
+  --server-binary target/release/rust-xhttp \
+  --ctl-binary target/release/rust-xhttpctl
+```
+
+官方 Linux 包使用 `x86-64-v3`（Haswell/Zen 或更新 CPU）；旧 CPU 要用适配的
+`RUSTFLAGS` 从源码构建。容器或自定义 supervisor 不必使用 systemd，可直接运行：
 
-cp config.acme.example.json config.json
-# 修改 UUID、域名、路径和邮箱
-./target/release/rust-xhttp check config.json
-sudo ./target/release/rust-xhttp config.json
+```bash
+rust-xhttp check /path/to/config.json
+rust-xhttp /path/to/config.json
 ```
 
-也可以从 [GitHub Releases](https://github.com/jacek4yang/rust-xhttp/releases/latest)
-下载 `x86_64-unknown-linux-gnu` 压缩包。配置沿用 Xray 的
-`inbounds/settings/streamSettings/xhttpSettings` 结构。直连 TLS 可选用户 PEM 或
-内置 ACME HTTP-01 自动签发/续期；普通访问默认显示可定制的美观博客，也能预加载
-用户 `dist` 目录。日志由 `log.loglevel` 或 `RUST_LOG` 控制。完整教学见
-[配置指南](docs/configuration.zh-CN.md)与
-[性能/可用性分析](docs/performance-and-availability.zh-CN.md)。
+开发检查使用 `cargo test`、`cargo clippy --all-targets -- -D warnings` 和
+`cargo fmt --all -- --check`。
 
 ## 支持范围与非声明
 
@@ -100,6 +183,7 @@ VLESS 协议。不支持 stream-up/stream-one，也不声称“不可检测”
 | --- | --- | --- |
 | 文档索引 | [English](docs/index.md) | [简体中文](docs/index.zh-CN.md) |
 | 配置与部署 | [English](docs/configuration.md) | [简体中文](docs/configuration.zh-CN.md) |
+| 安装与长期管理 | [English](docs/installation-management.md) | [简体中文](docs/installation-management.zh-CN.md) |
 | Benchmark 与证据 | [English](docs/benchmarks.md) | [简体中文](docs/benchmarks.zh-CN.md) |
 | 性能与可用性 | [English](docs/performance-and-availability.md) | [简体中文](docs/performance-and-availability.zh-CN.md) |
 | 热点优化报告 | [English](docs/performance-hotspots.md) | [简体中文](docs/performance-hotspots.zh-CN.md) |