HH-635: migrate legacy managed configs

Co-authored-by: multica-agent <github@multica.ai>

tests/container-smoke.sh

@@ -5,20 +5,22 @@ image=${1:-mohomo-docker:smoke}
 suffix="$$"
 container="mohomo-docker-smoke-${suffix}"
 unconfigured="mohomo-docker-unconfigured-${suffix}"
+legacy_container="mohomo-docker-legacy-${suffix}"
 provider="mohomo-provider-smoke-${suffix}"
 network="mohomo-network-smoke-${suffix}"
 volume="mohomo-volume-smoke-${suffix}"
+legacy_volume="mohomo-legacy-volume-smoke-${suffix}"
 secret="container-smoke-secret"
 admin_password="container-smoke-admin-password"
 
-case "$container:$unconfigured:$provider:$network:$volume" in
-mohomo-docker-smoke-*':mohomo-docker-unconfigured-'*':mohomo-provider-smoke-'*':mohomo-network-smoke-'*':mohomo-volume-smoke-'*) ;;
+case "$container:$unconfigured:$legacy_container:$provider:$network:$volume:$legacy_volume" in
+mohomo-docker-smoke-*':mohomo-docker-unconfigured-'*':mohomo-docker-legacy-'*':mohomo-provider-smoke-'*':mohomo-network-smoke-'*':mohomo-volume-smoke-'*':mohomo-legacy-volume-smoke-'*) ;;
 *) echo "refusing unsafe cleanup targets" >&2; exit 1 ;;
 esac
 
 cleanup() {
-	docker container rm --force "$container" "$unconfigured" "$provider" >/dev/null 2>&1 || true
-	docker volume rm "$volume" >/dev/null 2>&1 || true
+	docker container rm --force "$container" "$unconfigured" "$legacy_container" "$provider" >/dev/null 2>&1 || true
+	docker volume rm "$volume" "$legacy_volume" >/dev/null 2>&1 || true
 	docker network rm "$network" >/dev/null 2>&1 || true
 }
 trap cleanup EXIT INT TERM
@@ -114,6 +116,46 @@ docker run --rm --network none --entrypoint /bin/sh "$image" -c '
 	/usr/local/lib/ssclash/clash -t -d "$runtime" -f "$runtime/config.yaml"
 ' >/dev/null
 
+docker volume create "$legacy_volume" >/dev/null
+docker run --rm \
+	--volume "$legacy_volume:/opt/clash" \
+	--entrypoint /bin/sh \
+	"$image" -c '
+		set -eu
+		grep -v -F "  ChinaIp: {type: file, behavior: ipcidr, format: yaml, path: /usr/local/share/ssclash/rules/ChinaIp.yaml}" \
+			/usr/local/share/ssclash/config.yaml \
+			| sed "s/^  - RULE-SET,ChinaIp,/  - GEOIP,CN,/" \
+			> /opt/clash/config.yaml
+		grep -F "  - GEOIP,CN,🎯 全球直连" /opt/clash/config.yaml >/dev/null
+	'
+if docker run \
+	--name "$legacy_container" \
+	--network none \
+	--env "SUBSCRIPTION_URL=http://127.0.0.1:9/provider.yaml" \
+	--env "SSCLASH_PASSWORD=${admin_password}" \
+	--volume "$legacy_volume:/opt/clash" \
+	"$image" >/dev/null 2>&1; then
+	echo "legacy volume unexpectedly started without a subscription network" >&2
+	exit 1
+fi
+docker logs "$legacy_container" 2>&1 | grep -F 'initial subscription update failed: subscription request failed' >/dev/null
+if docker logs "$legacy_container" 2>&1 | grep -F 'geoip.metadb' >/dev/null; then
+	echo "legacy managed config attempted a GeoIP download" >&2
+	exit 1
+fi
+docker run --rm --network none \
+	--volume "$legacy_volume:/opt/clash" \
+	--entrypoint /bin/sh \
+	"$image" -c '
+		set -eu
+		cmp /opt/clash/config.yaml /usr/local/share/ssclash/config.yaml
+		test "$(cat /opt/clash/.mohomo-docker-config-version)" = 1
+		runtime=$(mktemp -d)
+		cp /opt/clash/config.yaml "$runtime/config.yaml"
+		printf "proxies:\n  - name: smoke-node\n    type: socks5\n    server: 127.0.0.1\n    port: 9\n" > "$runtime/subscription.yaml"
+		/usr/local/lib/ssclash/clash -t -d "$runtime" -f "$runtime/config.yaml"
+	' >/dev/null
+
 docker network create "$network" >/dev/null
 docker volume create "$volume" >/dev/null
 docker run --detach --rm \
@@ -247,4 +289,4 @@ assert_published_ports
 web_port=$(docker port "$container" 9091/tcp | awk -F: 'NR == 1 { print $NF }')
 assert_web_login_and_start "$web_port"
 
-echo "container smoke test passed: fresh volume fails closed; authenticated 9091 survives same-volume rebuild; only 7890/9091 are published"
+echo "container smoke test passed: legacy config migrates offline; fresh volume fails closed; authenticated 9091 survives same-volume rebuild; only 7890/9091 are published"