$(hostname)
🕐 $(date '+%Y-%m-%d %H:%M:%S')
🛡 Автообновления безопасности: включены"
}
# ══════════════════════════════════════════════════════════════
# БЛОК 2: SSH HARDENING
# ══════════════════════════════════════════════════════════════
cmd_ssh_hardening() {
hr
echo -e "${BOLD} SSH Hardening${RESET}"
hr
local sshd_config="/etc/ssh/sshd_config"
local current_port ssh_dropin_backup_dir=""
current_port=$(current_ssh_port)
echo -e " Текущий SSH порт: ${CYAN}${current_port}${RESET}"
echo
# ── Шаг 1: Создание нового пользователя ──────────────────
hr
echo -e "${BOLD} Шаг 1: Новый sudo-пользователь${RESET}"
hr
local new_user=""
while true; do
echo -ne "${CYAN}Имя нового пользователя (Enter = пропустить): ${RESET}"
read -r new_user
if [[ -z "$new_user" ]]; then
warn "Пропускаю создание пользователя"
break
fi
if [[ ! "$new_user" =~ ^[a-z][a-z0-9_-]{2,31}$ ]]; then
err "Только строчные буквы, цифры, _, - (3-32 символа, начинается с буквы)"
continue
fi
if id "$new_user" &>/dev/null; then
warn "Пользователь $new_user уже существует"
break
fi
# Создаём пользователя
useradd -m -s /bin/bash "$new_user"
usermod -aG sudo "$new_user"
# Пароль
echo -ne "${CYAN}Пароль для $new_user (Enter = сгенерировать): ${RESET}"
read -r user_pass
if [[ -z "$user_pass" ]]; then
user_pass=$(random_safe_token 20 'a-zA-Z0-9')
info "Сгенерирован пароль: ${BOLD}${user_pass}${RESET}"
info "СОХРАНИ ЕГО СЕЙЧАС!"
fi
printf "%s:%s" "${new_user}" "${user_pass}" | chpasswd
ok "Пользователь ${new_user} создан с правами sudo"
break
done
# ── Шаг 2: SSH-ключ ──────────────────────────────────────
hr
echo -e "${BOLD} Шаг 2: SSH-ключ (ED25519)${RESET}"
hr
local target_user="${new_user:-root}"
local target_home
target_home=$(getent passwd "$target_user" | cut -d: -f6)
local ssh_dir="${target_home}/.ssh"
local auth_keys="${ssh_dir}/authorized_keys"
if [[ -f "$auth_keys" ]] && grep -q "ssh-" "$auth_keys" 2>/dev/null; then
ok "SSH-ключ уже настроен для ${target_user}"
else
info "Генерирую ED25519 ключ для ${target_user}..."
mkdir -p "$ssh_dir"
chmod 700 "$ssh_dir"
# Генерируем ключ
ssh-keygen -t ed25519 -f "${ssh_dir}/id_ed25519_server" -N "" -C "naiveproxy-server-$(date +%Y%m%d)" -q
cat "${ssh_dir}/id_ed25519_server.pub" >> "$auth_keys"
chmod 600 "$auth_keys"
[[ "$target_user" != "root" ]] && chown -R "${target_user}:${target_user}" "$ssh_dir"
# Авто-сохранение ключа в /etc/naiveproxy/
mkdir -p "$CONFIG_DIR"
cp "${ssh_dir}/id_ed25519_server" "${CONFIG_DIR}/ssh_private_key"
cp "${ssh_dir}/id_ed25519_server.pub" "${CONFIG_DIR}/ssh_public_key"
chmod 600 "${CONFIG_DIR}/ssh_private_key"
ok "SSH ключ авто-сохранён: ${CONFIG_DIR}/ssh_private_key"
echo
echo -e "${RED}╔══════════════════════════════════════════════════════╗${RESET}"
echo -e "${RED}║ ПРИВАТНЫЙ КЛЮЧ — СКОПИРУЙ И СОХРАНИ ПРЯМО СЕЙЧАС ║${RESET}"
echo -e "${RED}╚══════════════════════════════════════════════════════╝${RESET}"
cat "${ssh_dir}/id_ed25519_server"
echo -e "${RED}══════════════════════════════════════════════════════${RESET}"
echo
# Команда для скачивания ключа с сервера
local server_ip_tmp
server_ip_tmp=$(curl -s4 --max-time 5 https://ifconfig.me 2>/dev/null || echo YOUR_IP)
echo -e " ${BOLD}Скачать ключ на свой компьютер:${RESET}"
echo -e " ${CYAN}# Linux/macOS:${RESET}"
echo -e " scp root@${server_ip_tmp}:${CONFIG_DIR}/ssh_private_key ~/.ssh/id_naiveproxy"
echo -e " chmod 600 ~/.ssh/id_naiveproxy"
echo
echo -e " ${CYAN}# Windows PowerShell:${RESET}"
echo -e " scp root@${server_ip_tmp}:${CONFIG_DIR}/ssh_private_key \$HOME\.ssh\id_naiveproxy"
echo
warn "Подключение после hardening:"
echo -e " ${CYAN}ssh -i ~/.ssh/id_naiveproxy -p [НОВЫЙ_ПОРТ] ${target_user}@${server_ip_tmp}${RESET}"
echo
echo -ne "${YELLOW}Ты сохранил/скачал ключ? [yes]: ${RESET}"
read -r confirm
if [[ "${confirm,,}" != "yes" && "${confirm,,}" != "y" ]]; then
warn "Ключ сохранён на сервере: ${CONFIG_DIR}/ssh_private_key"
warn "Скачай его позже через scp!"
echo -ne "${YELLOW}Продолжить? [y/N]: ${RESET}"
read -r force
[[ "${force,,}" == "y" ]] || return 1
fi
ok "SSH-ключ сгенерирован и добавлен в authorized_keys"
fi
# ── Шаг 3: Смена SSH порта ────────────────────────────────
hr
echo -e "${BOLD} Шаг 3: Смена SSH порта${RESET}"
hr
local new_ssh_port=""
echo -e " Текущий порт: ${CYAN}${current_port}${RESET}"
echo -e " ${BOLD}1)${RESET} Ввести вручную"
echo -e " ${BOLD}2)${RESET} Случайный (49000-65000)"
echo -e " ${BOLD}0)${RESET} Оставить ${current_port}"
echo -ne "${CYAN}Выбор: ${RESET}"
read -r port_choice
case "$port_choice" in
1)
while true; do
echo -ne "${CYAN}Новый SSH порт (1024-65535): ${RESET}"
read -r new_ssh_port
if is_valid_local_proxy_port "$new_ssh_port"; then
break
fi
err "Неверный порт. Введи число от 1024 до 65535"
done
;;
2)
# Генерируем случайный порт и проверяем что он свободен
while true; do
new_ssh_port=$(( RANDOM % 16000 + 49000 ))
if ! ss -tlnp | grep -E ":${new_ssh_port}([[:space:]]|$)" >/dev/null; then
break
fi
done
info "Случайный порт: ${BOLD}${new_ssh_port}${RESET}"
;;
*)
new_ssh_port="$current_port"
info "Порт оставляем: $current_port"
;;
esac
# ── Шаг 4: Применяем sshd_config ─────────────────────────
hr
echo -e "${BOLD} Шаг 4: Настройка sshd_config${RESET}"
hr
# Бэкап — сохраняем метку времени для возможного отката
local sshd_backup
sshd_backup="${sshd_config}.bak.$(date +%Y%m%d_%H%M%S)"
cp "$sshd_config" "$sshd_backup"
ssh_dropin_backup_dir=$(mktemp -d /tmp/yurich-ssh-dropins.XXXXXX)
chmod 700 "$ssh_dropin_backup_dir"
for cfg in /etc/ssh/sshd_config.d/*.conf; do
[[ -f "$cfg" ]] || continue
cp -a "$cfg" "$ssh_dropin_backup_dir/$(basename "$cfg")"
done
ok "Бэкап sshd_config создан: $sshd_backup"
# Безопасные значения по умолчанию: не отключаем текущие способы входа без явного согласия.
local permit_root="yes"
local password_auth="yes"
if [[ "$target_user" != "root" ]]; then
echo -ne "${YELLOW}Запретить SSH вход root? [y/N]: ${RESET}"
read -r ans_disable_root
[[ "${ans_disable_root,,}" == "y" ]] && permit_root="no"
else
warn "Hardening выполняется для root — root вход оставляю включённым, чтобы не потерять доступ."
fi
if [[ ! -f "$auth_keys" ]] || ! grep -q "ssh-" "$auth_keys" 2>/dev/null; then
warn "Нет SSH-ключа — пароль оставляем включённым"
else
echo -ne "${YELLOW}Отключить SSH вход по паролю? [y/N]: ${RESET}"
read -r ans_disable_pass
[[ "${ans_disable_pass,,}" == "y" ]] && password_auth="no"
fi
# Меняем настройки
# Проверяем что строка Port вообще есть
if grep -qE "^#?Port " "$sshd_config"; then
sed -i "s/^#*Port .*/Port ${new_ssh_port}/" "$sshd_config"
else
echo "Port ${new_ssh_port}" >> "$sshd_config"
fi
# На Ubuntu 22.04+ конфиг может быть в /etc/ssh/sshd_config.d/*.conf
for cfg in /etc/ssh/sshd_config.d/*.conf; do
[[ ! -f "$cfg" ]] && continue
if grep -qE "^#?Port " "$cfg"; then
sed -i "s/^#*Port .*/Port ${new_ssh_port}/" "$cfg"
fi
done
# PermitRootLogin
if grep -qE "^#?PermitRootLogin " "$sshd_config"; then
sed -i "s/^#*PermitRootLogin .*/PermitRootLogin ${permit_root}/" "$sshd_config"
else
echo "PermitRootLogin ${permit_root}" >> "$sshd_config"
fi
# PasswordAuthentication
if grep -qE "^#?PasswordAuthentication " "$sshd_config"; then
sed -i "s/^#*PasswordAuthentication .*/PasswordAuthentication ${password_auth}/" "$sshd_config"
else
echo "PasswordAuthentication ${password_auth}" >> "$sshd_config"
fi
# Также в conf.d файлах (Ubuntu 22.04+)
for cfg in /etc/ssh/sshd_config.d/*.conf; do
[[ ! -f "$cfg" ]] && continue
sed -i "s/^#*PermitRootLogin .*/PermitRootLogin ${permit_root}/" "$cfg" 2>/dev/null || true
sed -i "s/^#*PasswordAuthentication .*/PasswordAuthentication ${password_auth}/" "$cfg" 2>/dev/null || true
done
sed -i "s/^#*PubkeyAuthentication .*/PubkeyAuthentication yes/" "$sshd_config"
sed -i "s/^#*AuthorizedKeysFile .*/AuthorizedKeysFile .ssh\/authorized_keys/" "$sshd_config"
sed -i "s/^#*X11Forwarding .*/X11Forwarding no/" "$sshd_config"
sed -i "s/^#*MaxAuthTries .*/MaxAuthTries 3/" "$sshd_config"
sed -i "s/^#*LoginGraceTime .*/LoginGraceTime 30/" "$sshd_config"
sed -i "s/^#*PermitEmptyPasswords .*/PermitEmptyPasswords no/" "$sshd_config"
# Добавляем если нет
grep -q "^ClientAliveInterval" "$sshd_config" || echo "ClientAliveInterval 300" >> "$sshd_config"
grep -q "^ClientAliveCountMax" "$sshd_config" || echo "ClientAliveCountMax 2" >> "$sshd_config"
# Проверяем конфиг
if ! sshd -t 2>/dev/null; then
err "Ошибка в sshd_config! Откатываю из $sshd_backup..."
cp "$sshd_backup" "$sshd_config" 2>/dev/null || true
for cfg in "$ssh_dropin_backup_dir"/*.conf; do
[[ -f "$cfg" ]] && cp -a "$cfg" "/etc/ssh/sshd_config.d/$(basename "$cfg")" 2>/dev/null || true
done
rm -rf -- "$ssh_dropin_backup_dir"
return 1
fi
# ── Шаг 5: UFW + Fail2Ban ─────────────────────────────────
hr
echo -e "${BOLD} Шаг 5: Firewall + Fail2Ban${RESET}"
hr
# Убеждаемся что UFW активен
if ! ufw status | grep -q "Status: active"; then
warn "UFW неактивен — включаю..."
ufw --force enable >/dev/null 2>&1 || true
fi
# Открываем новый порт ПЕРЕД закрытием старого
ufw allow "${new_ssh_port}/tcp" comment "SSH hardened" >/dev/null 2>&1 || true
# Старый порт не закрываем автоматически: это частая причина lockout.
if [[ "$new_ssh_port" != "$current_port" ]]; then
warn "Старый SSH порт ${current_port} оставлен открытым в UFW как аварийный запас."
warn "Закрой его вручную только после проверки входа на порт ${new_ssh_port}."
fi
ok "Новый SSH порт ${new_ssh_port} открыт в UFW"
# Ubuntu 22.04+ может использовать ssh.socket. Переключаемся на ssh.service
# и сразу перезапускаем SSH, до установки дополнительных пакетов.
local ssh_socket_was_enabled="no"
if systemctl is-enabled ssh.socket &>/dev/null; then
ssh_socket_was_enabled="yes"
info "Отключаю ssh.socket (Ubuntu 22.04+ override) и включаю ssh.service..."
systemctl enable ssh --quiet 2>/dev/null || systemctl enable sshd --quiet 2>/dev/null || true
systemctl disable --now ssh.socket --quiet 2>/dev/null || true
fi
if restart_ssh_service; then
ok "SSH сервис перезапущен с новыми настройками"
else
err "Не удалось перезапустить ssh/sshd. Откатываю sshd_config..."
cp "$sshd_backup" "$sshd_config" 2>/dev/null || true
for cfg in "$ssh_dropin_backup_dir"/*.conf; do
[[ -f "$cfg" ]] && cp -a "$cfg" "/etc/ssh/sshd_config.d/$(basename "$cfg")" 2>/dev/null || true
done
if [[ "$ssh_socket_was_enabled" == "yes" ]]; then
systemctl enable --now ssh.socket --quiet 2>/dev/null || true
fi
restart_ssh_service || true
rm -rf -- "$ssh_dropin_backup_dir"
return 1
fi
if ! setup_fail2ban "$new_ssh_port"; then
rm -rf -- "$ssh_dropin_backup_dir"
return 1
fi
rm -rf -- "$ssh_dropin_backup_dir"
# Маркер
mkdir -p "$CONFIG_DIR"
cat > "$SSH_HARDENING_DONE" << EOF
SSH_PORT=${new_ssh_port}
SSH_USER=${target_user}
HARDENED_AT=$(date '+%Y-%m-%d %H:%M:%S')
EOF
# ── Итог ─────────────────────────────────────────────────
local server_ip
server_ip=$(curl -s4 --max-time 5 https://ifconfig.me 2>/dev/null || curl -s4 --max-time 5 https://api.ipify.org 2>/dev/null || echo "YOUR_IP")
hr
echo -e "${BOLD}${GREEN} SSH Hardening завершён!${RESET}"
hr
echo -e " ${BOLD}Новый SSH порт:${RESET} ${CYAN}${new_ssh_port}${RESET}"
echo -e " ${BOLD}Пользователь:${RESET} ${CYAN}${target_user}${RESET}"
echo -e " ${BOLD}Root вход:${RESET} $([ "$permit_root" = "no" ] && echo -e "${RED}запрещён${RESET}" || echo -e "${YELLOW}разрешён${RESET}")"
echo -e " ${BOLD}Пароль вход:${RESET} $([ "$password_auth" = "no" ] && echo -e "${RED}запрещён${RESET}" || echo -e "${YELLOW}разрешён${RESET}")"
echo -e " ${BOLD}Fail2Ban:${RESET} ${GREEN}активен${RESET}"
echo
echo -e " ${BOLD}Подключение:${RESET}"
echo -e " ${CYAN}ssh -i ~/.ssh/id_naiveproxy -p ${new_ssh_port} ${target_user}@${server_ip}${RESET}"
hr
tg_send "🔒 SSH Hardening выполнен
🖥 Сервер: $(hostname)
🔑 Пользователь: ${target_user}
🚪 SSH порт: ${new_ssh_port}
🛡 Fail2Ban: включён
🕐 $(date '+%Y-%m-%d %H:%M:%S')"
}
cmd_ssh_rescue() {
local rescue_conf="/etc/ssh/sshd_config.d/99-naiveproxy-rescue.conf"
local rescue_script="/usr/local/sbin/yurich-disable-ssh-rescue.sh"
local rescue_state="/run/yurich-ssh-rescue.state"
local rescue_ttl="${NAIVEPROXY_SSH_RESCUE_TTL_SECONDS:-1800}"
local rescue_unit socket_enabled=0 socket_active=0 fail2ban_active=0 ufw_22_preexisting=0 candidate
hr
echo -e "${BOLD}${YELLOW} SSH Rescue Mode${RESET}"
hr
warn "Включаю временный аварийный SSH-доступ на 22 порту."
warn "После восстановления зайди по SSH и заново настрой hardening."
command -v systemd-run >/dev/null 2>&1 || { err "systemd-run недоступен: безопасный автооткат SSH rescue невозможен"; return 1; }
is_canonical_uint_in_range "$rescue_ttl" 300 86400 || { err "SSH rescue TTL должен быть 300-86400 секунд"; return 1; }
[[ ! -e "$rescue_conf" && ! -L "$rescue_conf" ]] || { err "SSH rescue уже активен: $rescue_conf"; return 1; }
mkdir -p /etc/ssh/sshd_config.d
candidate=$(mktemp /etc/ssh/sshd_config.d/.99-naiveproxy-rescue.XXXXXX)
cat > "$candidate" <<'EOF'
Port 22
PermitRootLogin yes
PasswordAuthentication yes
PubkeyAuthentication yes
EOF
install -m 600 "$candidate" "$rescue_conf"
rm -f "$candidate"
if ! sshd -t; then
rm -f "$rescue_conf"
err "sshd_config не прошёл проверку; rescue отменён"
return 1
fi
systemctl is-enabled --quiet ssh.socket 2>/dev/null && socket_enabled=1
systemctl is-active --quiet ssh.socket 2>/dev/null && socket_active=1
systemctl is-active --quiet fail2ban 2>/dev/null && fail2ban_active=1
ufw show added 2>/dev/null | grep -Eq '^ufw allow 22/tcp([[:space:]]|$)' && ufw_22_preexisting=1
{
printf 'SSH_SOCKET_ENABLED=%s\n' "$socket_enabled"
printf 'SSH_SOCKET_ACTIVE=%s\n' "$socket_active"
printf 'FAIL2BAN_ACTIVE=%s\n' "$fail2ban_active"
printf 'UFW_22_PREEXISTED=%s\n' "$ufw_22_preexisting"
} > "$rescue_state"
chmod 600 "$rescue_state"
cat > "$rescue_script" <<'EOF'
#!/bin/bash
set -euo pipefail
state=/run/yurich-ssh-rescue.state
state_value() { awk -F= -v key="$1" '$1 == key {print $2; exit}' "$state" 2>/dev/null || true; }
socket_enabled=$(state_value SSH_SOCKET_ENABLED)
socket_active=$(state_value SSH_SOCKET_ACTIVE)
fail2ban_active=$(state_value FAIL2BAN_ACTIVE)
ufw_22_preexisting=$(state_value UFW_22_PREEXISTED)
rm -f /etc/ssh/sshd_config.d/99-naiveproxy-rescue.conf
if [[ "$ufw_22_preexisting" != "1" ]]; then
ufw --force delete allow 22/tcp >/dev/null 2>&1 || true
fi
if [[ "$fail2ban_active" == "1" ]]; then
systemctl start fail2ban >/dev/null 2>&1 || true
fi
if [[ "$socket_enabled" == "1" ]]; then
systemctl enable ssh.socket >/dev/null 2>&1 || true
else
systemctl disable ssh.socket >/dev/null 2>&1 || true
fi
if [[ "$socket_active" == "1" ]]; then
systemctl stop ssh >/dev/null 2>&1 || systemctl stop sshd >/dev/null 2>&1 || true
systemctl start ssh.socket >/dev/null 2>&1 || true
elif sshd -t; then
systemctl reload ssh >/dev/null 2>&1 || systemctl reload sshd >/dev/null 2>&1 || systemctl restart ssh >/dev/null 2>&1 || systemctl restart sshd >/dev/null 2>&1 || true
fi
rm -f "$state" /usr/local/sbin/yurich-disable-ssh-rescue.sh
EOF
chmod 700 "$rescue_script"
rescue_unit="yurich-ssh-rescue-autodisable-$(date +%s)"
if ! systemd-run --unit="$rescue_unit" --on-active="${rescue_ttl}s" "$rescue_script" >/dev/null 2>&1; then
rm -f "$rescue_conf" "$rescue_state" "$rescue_script"
err "Не удалось поставить обязательный автооткат; SSH rescue не включён"
return 1
fi
warn "SSH rescue автоматически отключится через ${rescue_ttl} сек."
systemctl disable --now ssh.socket >/dev/null 2>&1 || true
if command -v ufw >/dev/null 2>&1 && ! ufw allow 22/tcp comment "SSH rescue" >/dev/null 2>&1; then
"$rescue_script" >/dev/null 2>&1 || true
err "Не удалось открыть 22/tcp в UFW; rescue отменён"
return 1
fi
systemctl stop fail2ban >/dev/null 2>&1 || true
if ! restart_ssh_service; then
"$rescue_script" >/dev/null 2>&1 || true
err "Не удалось перезапустить SSH; rescue отменён и прежнее состояние восстановлено"
return 1
fi
if ! ss -tln 2>/dev/null | grep -Eq ':(22)([[:space:]]|$)'; then
"$rescue_script" >/dev/null 2>&1 || true
err "SSH не начал слушать 22/tcp; rescue отменён и прежнее состояние восстановлено"
return 1
fi
ok "SSH rescue включён: порт 22, root/password временно разрешены"
warn "Если пароль root неизвестен, задай его командой: passwd root"
ss -tlnp | grep -E ':(22)([[:space:]]|$)' || true
}
# ─── МУЛЬТИЯЗЫЧНОСТЬ ──────────────────────────────────────────
# Использование: t "Текст на русском" "English text"
t() {
if [[ "${LANG_UI}" == "en" ]]; then
echo "$2"
else
echo "$1"
fi
}
normalize_lang_ui() {
if [[ -n "${NAIVEPROXY_LANG:-}" ]]; then
LANG_UI="$NAIVEPROXY_LANG"
fi
case "${LANG_UI:-ru}" in
ru|en) ;;
*) LANG_UI="ru" ;;
esac
}
# Установить язык: export NAIVEPROXY_LANG=en
# Set language: export NAIVEPROXY_LANG=en
# ─── Проверки ────────────────────────────────────────────────
check_root() {
if [[ $EUID -ne 0 ]]; then
err "Запускай от root: sudo bash $0"
exit 1
fi
}
check_os() {
if ! grep -qiE "ubuntu|debian" /etc/os-release 2>/dev/null; then
warn "Скрипт тестировался на Ubuntu/Debian. Продолжаем на свой страх и риск."
fi
}
check_installed() {
[[ -f "$CADDY_BIN" && -f "$CADDYFILE" ]]
}
is_valid_domain() {
[[ "${1:-}" =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$ ]]
}
domain_in_space_list_ci() {
local domains="${1:-}" needle="${2:-}" domain
is_valid_domain "$needle" || return 1
for domain in $domains; do
[[ "${domain,,}" == "${needle,,}" ]] && return 0
done
return 1
}
subscription_public_domain() {
local domain="${SUBSCRIPTION_DOMAIN:-${DOMAIN:-}}"
is_valid_domain "$domain" || return 1
printf '%s\n' "$domain"
}
is_valid_host_port() {
local value="${1:-}" host port
[[ "$value" == *:* ]] || return 1
host="${value%:*}"
port="${value##*:}"
is_valid_domain "$host" || return 1
is_valid_port "$port"
}
public_dns_ipv4() {
local domain="${1:-}"
[[ -n "$domain" ]] || return 0
command -v dig >/dev/null 2>&1 || return 0
dig @1.1.1.1 +short A "$domain" +time=3 +tries=1 2>/dev/null \
| grep -E '^([0-9]{1,3}\.){3}[0-9]{1,3}$' \
| head -1 || true
}
domains_for_hosts_audit() {
local dom node_domain
{
[[ -n "${DOMAIN:-}" ]] && printf '%s\n' "$DOMAIN"
[[ -n "${SUBSCRIPTION_DOMAIN:-}" ]] && printf '%s\n' "$SUBSCRIPTION_DOMAIN"
if [[ -n "${DOMAINS:-}" ]]; then
local IFS=','
for dom in $DOMAINS; do
printf '%s\n' "$dom"
done
fi
if [[ -f "${NODES_FILE:-}" ]]; then
while IFS='|' read -r _ _ _ _ node_domain _; do
if [[ -n "$node_domain" && "$node_domain" != "-" ]]; then
printf '%s\n' "$node_domain"
fi
done < <(grep -v '^#\|^[[:space:]]*$' "$NODES_FILE" 2>/dev/null || true)
fi
} | while IFS= read -r dom; do
dom="${dom//[[:space:]]/}"
dom="${dom%.}"
dom="${dom,,}"
if [[ -n "$dom" ]] && is_valid_domain "$dom"; then
printf '%s\n' "$dom"
fi
done | awk '!seen[$0]++'
}
hosts_public_domain_overrides() {
local hosts_file="${1:-/etc/hosts}" domain
[[ -r "$hosts_file" ]] || return 0
domains_for_hosts_audit | while IFS= read -r domain; do
awk -v domain="$domain" '
/^[[:space:]]*#/ || /^[[:space:]]*$/ { next }
{
for (i = 2; i <= NF; i++) {
entry = tolower($i)
sub(/\.$/, "", entry)
if (entry == domain) {
print domain "|" FNR ":" $0
break
}
}
}
' "$hosts_file"
done
}
format_hosts_override_domains() {
awk -F'|' 'NF && !seen[$1]++ { out = out sep $1; sep = ", " } END { print out }'
}
is_valid_proxy_user() {
[[ "${1:-}" =~ ^[a-zA-Z0-9_-]{2,32}$ ]]
}
is_valid_proxy_pass() {
[[ "${1:-}" =~ ^[a-zA-Z0-9_-]{8,64}$ ]]
}
current_ssh_port() {
local port
port=$(sshd -T 2>/dev/null | awk '$1 == "port" {print $2; exit}' || true)
is_valid_port "$port" || port="22"
printf '%s\n' "$port"
}
restart_ssh_service() {
if systemctl restart ssh 2>/dev/null; then
return 0
fi
if systemctl restart sshd 2>/dev/null; then
return 0
fi
return 1
}
detect_hysteria_arch() {
local arch
arch=$(uname -m)
case "$arch" in
x86_64|amd64) echo "amd64" ;;
aarch64|arm64) echo "arm64" ;;
armv7l|armv7*) echo "armv7" ;;
i386|i686) echo "386" ;;
*) err "Архитектура $arch не поддерживается Hysteria 2 автоустановкой"; return 1 ;;
esac
}
find_caddy_cert() {
local domain="${1:-${DOMAIN:-}}"
[[ -z "$domain" ]] && return 1
find /root/.local/share/caddy/certificates -type f -path "*/${domain}/${domain}.crt" 2>/dev/null | head -1
}
find_caddy_key() {
local domain="${1:-${DOMAIN:-}}"
[[ -z "$domain" ]] && return 1
find /root/.local/share/caddy/certificates -type f -path "*/${domain}/${domain}.key" 2>/dev/null | head -1
}
is_valid_port() {
local value="${1:-}"
[[ "$value" =~ ^[1-9][0-9]{0,4}$ ]] && (( 10#$value <= 65535 ))
}
is_valid_local_proxy_port() {
local value="${1:-}"
is_valid_port "$value" && (( 10#$value >= 1024 ))
}
local_tcp_endpoint_ready() {
local port="${1:-}"
is_valid_port "$port" || return 1
command -v timeout >/dev/null 2>&1 || return 1
timeout 2 bash -c "exec 3<>/dev/tcp/127.0.0.1/${port}" >/dev/null 2>&1
}
is_canonical_uint_in_range() {
local value="${1:-}" min="${2:-0}" max="${3:-2147483647}"
[[ "$value" =~ ^(0|[1-9][0-9]{0,9})$ ]] || return 1
(( 10#$value >= min && 10#$value <= max ))
}
warp_cli() {
warp-cli --accept-tos "$@" 2>/dev/null || warp-cli "$@"
}
random_safe_token() {
local len="${1:-20}"
local alphabet="${2:-a-zA-Z0-9_-}"
local token=""
local chunk
local attempts=0
if ! is_canonical_uint_in_range "$len" 8 128; then
err "Некорректная длина токена: $len"
return 1
fi
while [[ ${#token} -lt "$len" ]]; do
attempts=$((attempts + 1))
if [[ "$attempts" -gt 20 ]]; then
err "Не удалось сгенерировать случайный токен через openssl"
return 1
fi
chunk=$(openssl rand -base64 "$((len * 3))" 2>/dev/null \
| LC_ALL=C tr -dc "$alphabet" \
| head -c "$len" || true)
token="${token}${chunk}"
done
printf '%s\n' "${token:0:len}"
}
is_valid_hysteria_secret() {
[[ "${1:-}" =~ ^[A-Za-z0-9_-]{8,64}$ ]]
}
ensure_hysteria_secrets() {
if ! is_valid_hysteria_secret "${HYSTERIA_PASSWORD:-}"; then
HYSTERIA_PASSWORD=$(random_safe_token 24)
info "Сгенерирован новый пароль Hysteria 2"
fi
if ! is_valid_hysteria_secret "${HYSTERIA_OBFS_PASSWORD:-}"; then
HYSTERIA_OBFS_PASSWORD=$(random_safe_token 24)
info "Сгенерирован новый obfs-пароль Hysteria 2"
fi
if ! is_valid_hysteria_secret "${HYSTERIA_PASSWORD:-}" || ! is_valid_hysteria_secret "${HYSTERIA_OBFS_PASSWORD:-}"; then
err "Не удалось подготовить безопасные пароли Hysteria 2"
return 1
fi
}
# ─── Режим входящего 443 ─────────────────────────────────────
normalize_edge_routing_mode() {
case "${EDGE_ROUTING_MODE:-}" in
haproxy|sni|sni-mux|sni_mux)
EDGE_ROUTING_MODE="haproxy"
;;
caddy|caddy-only|caddy_only|"")
if [[ "${XRAY_REALITY_SNI_MUX_ENABLED:-0}" == "1" ]]; then
EDGE_ROUTING_MODE="haproxy"
else
EDGE_ROUTING_MODE="caddy"
fi
;;
*)
warn "Неизвестный EDGE_ROUTING_MODE=${EDGE_ROUTING_MODE}; использую caddy"
EDGE_ROUTING_MODE="caddy"
;;
esac
}
edge_routing_mode_is_haproxy() {
[[ "${EDGE_ROUTING_MODE:-}" == "haproxy" || "${XRAY_REALITY_SNI_MUX_ENABLED:-0}" == "1" ]]
}
edge_routing_mode_label() {
if edge_routing_mode_is_haproxy; then
printf 'HAProxy SNI mux'
else
printf 'Caddy-only'
fi
}
set_edge_routing_mode() {
local mode="${1:-caddy}"
case "$mode" in
haproxy|sni|sni-mux|sni_mux)
EDGE_ROUTING_MODE="haproxy"
XRAY_REALITY_SNI_MUX_ENABLED="1"
XRAY_FALLBACK_ENABLED="0"
XRAY_REALITY_PUBLIC_PORT="443"
XRAY_CADDY_FALLBACK_PORT="${XRAY_CADDY_FALLBACK_PORT:-$XRAY_CADDY_FALLBACK_PORT_DEFAULT}"
;;
caddy|caddy-only|caddy_only)
EDGE_ROUTING_MODE="caddy"
XRAY_REALITY_SNI_MUX_ENABLED="0"
XRAY_FALLBACK_ENABLED="0"
XRAY_REALITY_PUBLIC_PORT=""
;;
*)
err "Неверный режим 443: $mode"
return 1
;;
esac
}
prompt_edge_routing_mode() {
local ans current mode
normalize_edge_routing_mode
current="${EDGE_ROUTING_MODE:-caddy}"
echo
echo -e "${BOLD}Режим входящего 443:${RESET}"
echo -e " ${BOLD}1)${RESET} Caddy-only — Caddy держит 443, VLESS Reality на отдельном TCP-порту"
echo -e " ${BOLD}2)${RESET} HAProxy SNI mux — Naive/Caddy и VLESS Reality вместе на 443"
echo -ne "${YELLOW}Выбор [${current}]: ${RESET}"
read -r ans
case "${ans,,}" in
"" ) mode="$current" ;;
1|c|caddy|caddy-only|caddy_only) mode="caddy" ;;
2|h|haproxy|sni|sni-mux|sni_mux) mode="haproxy" ;;
*) err "Неверный выбор режима 443"; return 1 ;;
esac
set_edge_routing_mode "$mode"
ok "Режим 443 выбран: $(edge_routing_mode_label)"
}
# ─── Конфиг ──────────────────────────────────────────────────
load_config() {
if [[ -f "$CONFIG_FILE" ]]; then
# Безопасность: проверяем владельца и права перед source
local owner perms
owner=$(stat -c '%U' "$CONFIG_FILE" 2>/dev/null || echo "unknown")
perms=$(stat -c '%a' "$CONFIG_FILE" 2>/dev/null || echo "000")
if [[ "$owner" != "root" ]]; then
err "БЕЗОПАСНОСТЬ: $CONFIG_FILE принадлежит '$owner', ожидается root. Прерываю."
exit 1
fi
[[ "$perms" != "600" ]] && chmod 600 "$CONFIG_FILE"
# shellcheck source=/dev/null
# Проверяем владельца перед source
local _cfg_owner
_cfg_owner=$(stat -c '%U' "$CONFIG_FILE" 2>/dev/null || echo "unknown")
if [[ "$_cfg_owner" == "root" ]]; then
# shellcheck source=/dev/null
source "$CONFIG_FILE"
normalize_lang_ui
normalize_edge_routing_mode
else
warn "CONFIG_FILE принадлежит не root — пропускаю source"
fi
fi
normalize_lang_ui
normalize_edge_routing_mode
}
save_config() {
mkdir -p "$CONFIG_DIR"
chmod 700 "$CONFIG_DIR" 2>/dev/null || true
local tmp_config
tmp_config=$(mktemp "${CONFIG_DIR}/.naive.conf.XXXXXX") || {
err "Не удалось создать временный конфиг в $CONFIG_DIR"
return 1
}
chmod 600 "$tmp_config"
normalize_edge_routing_mode
if ! {
printf 'LANG_UI=%q\n' "${LANG_UI:-ru}"
printf 'DOMAIN=%q\n' "${DOMAIN:-}"
printf 'DOMAINS=%q\n' "${DOMAINS:-${DOMAIN:-}}"
printf '# Отдельный публичный домен страниц подписок; пусто = DOMAIN\n'
printf 'SUBSCRIPTION_DOMAIN=%q\n' "${SUBSCRIPTION_DOMAIN:-${DOMAIN:-}}"
printf 'EMAIL=%q\n' "${EMAIL:-}"
printf '# Красивое имя сервера в подписках, например: 🇫🇮 Finland\n'
printf 'PROFILE_LOCATION_LABEL=%q\n' "${PROFILE_LOCATION_LABEL:-Yurich}"
printf '# Подписки: 1 = включать локальный сервер в клиентские профили, 0 = только nodes\n'
printf 'SUBSCRIPTION_LOCAL_ENABLED=%q\n' "${SUBSCRIPTION_LOCAL_ENABLED:-1}"
printf '# Подписки: first или last, если локальный сервер включён\n'
printf 'SUBSCRIPTION_LOCAL_POSITION=%q\n' "${SUBSCRIPTION_LOCAL_POSITION:-first}"
printf '# Подписки: имена nodes, где публиковать VLESS XHTTP. Примеры: all, poland2, "poland2 test2"\n'
printf 'SUBSCRIPTION_XHTTP_NODE_NAMES=%q\n' "${SUBSCRIPTION_XHTTP_NODE_NAMES:-all}"
printf '# 1 = nodes из SUBSCRIPTION_XHTTP_NODE_NAMES публикуют только XHTTP, без HTTPS/Turbo/Reality\n'
printf 'SUBSCRIPTION_XHTTP_NODE_EXCLUSIVE=%q\n' "${SUBSCRIPTION_XHTTP_NODE_EXCLUSIVE:-0}"
printf '# Nodes, используемые только как backend для relay: синхронизируются, но прямые профили не публикуются\n'
printf 'SUBSCRIPTION_RELAY_ONLY_NODE_NAMES=%q\n' "${SUBSCRIPTION_RELAY_ONLY_NODE_NAMES:-}"
printf '# 1 = публиковать XHTTP в основных клиентских подписках, 0 = держать XHTTP отдельно/для тестов\n'
printf 'SUBSCRIPTION_XHTTP_MAIN_ENABLED=%q\n' "${SUBSCRIPTION_XHTTP_MAIN_ENABLED:-1}"
printf '# Canary XHTTP: дополнительные nodes публикуются только указанным пользователям\n'
printf 'SUBSCRIPTION_XHTTP_CANARY_NODE_NAMES=%q\n' "${SUBSCRIPTION_XHTTP_CANARY_NODE_NAMES:-}"
printf 'SUBSCRIPTION_XHTTP_CANARY_USERS=%q\n' "${SUBSCRIPTION_XHTTP_CANARY_USERS:-}"
printf '# Новый дизайн страниц подписок: all, * или список пользователей через пробел\n'
printf 'SUBSCRIPTION_REMWAVE_USERS=%q\n' "${SUBSCRIPTION_REMWAVE_USERS:-all}"
printf 'SUBSCRIPTION_REMWAVE_PREVIEW_USERS=%q\n' "${SUBSCRIPTION_REMWAVE_PREVIEW_USERS:-all}"
printf '# Режим входящего 443: caddy = Caddy держит 443; haproxy = HAProxy SNI mux держит 443\n'
printf 'EDGE_ROUTING_MODE=%q\n' "${EDGE_ROUTING_MODE:-caddy}"
printf '# 1 = стандартный HTTP 407 для Chrome/Edge browser proxy; 0 = stealth 404\n'
printf 'BROWSER_PROXY_COMPAT=%q\n' "${BROWSER_PROXY_COMPAT:-0}"
printf '# Optional isolated browser proxy route behind HAProxy SNI mux; empty domain = disabled\n'
printf 'BROWSER_PROXY_SNI_DOMAIN=%q\n' "${BROWSER_PROXY_SNI_DOMAIN:-}"
printf 'BROWSER_PROXY_BACKEND_PORT=%q\n' "${BROWSER_PROXY_BACKEND_PORT:-7444}"
printf '# Enable only when the local backend explicitly accepts PROXY protocol v2; default = 0\n'
printf 'BROWSER_PROXY_SEND_PROXY_V2=%q\n' "${BROWSER_PROXY_SEND_PROXY_V2:-0}"
printf '# Browser subscriptions: host|node-name entries separated by semicolons; empty = disabled\n'
printf 'BROWSER_SUBSCRIPTION_PROFILES=%q\n' "${BROWSER_SUBSCRIPTION_PROFILES:-}"
printf '# Extra Naive HTTPS profiles: host|node-name entries separated by semicolons; empty = disabled\n'
printf 'NAIVE_EXTRA_PROFILES=%q\n' "${NAIVE_EXTRA_PROFILES:-}"
printf '# Users allowed to receive extra Naive profiles: *, all or a space/comma-separated list\n'
printf 'NAIVE_EXTRA_USERS=%q\n' "${NAIVE_EXTRA_USERS:-}"
printf '# HTTPS node sources: node-name|domain|ipv4 entries separated by semicolons; empty = disabled\n'
printf 'SUBSCRIPTION_HTTP_NODE_SOURCES=%q\n' "${SUBSCRIPTION_HTTP_NODE_SOURCES:-}"
printf '# Subscription rebuild: prefetch remote node profiles once and publish each page atomically\n'
printf 'SUBSCRIPTION_NODE_PREFETCH_ENABLED=%q\n' "${SUBSCRIPTION_NODE_PREFETCH_ENABLED:-1}"
printf 'SUBSCRIPTION_ATOMIC_PUBLISH=%q\n' "${SUBSCRIPTION_ATOMIC_PUBLISH:-1}"
printf '# Subscription rebuild workers: 0 = auto (1-4), explicit safe range = 1-8\n'
printf 'SUBSCRIPTION_REBUILD_JOBS=%q\n' "${SUBSCRIPTION_REBUILD_JOBS:-0}"
printf '# VLESS relay profiles: source-node|relay-host|relay-port|reality,xhttp entries separated by semicolons\n'
printf 'VLESS_RELAY_PROFILES=%q\n' "${VLESS_RELAY_PROFILES:-}"
printf '# Users allowed to receive relay profiles: *, all or a space/comma-separated list\n'
printf 'VLESS_RELAY_USERS=%q\n' "${VLESS_RELAY_USERS:-}"
printf '# Автомониторинг протоколов: тестовый пользователь, повторы, порог средней задержки в мс\n'
printf 'PROTOCOL_BENCHMARK_USER=%q\n' "${PROTOCOL_BENCHMARK_USER:-}"
printf 'PROTOCOL_BENCHMARK_ROUNDS=%q\n' "${PROTOCOL_BENCHMARK_ROUNDS:-3}"
printf 'PROTOCOL_BENCHMARK_MAX_AVG_MS=%q\n' "${PROTOCOL_BENCHMARK_MAX_AVG_MS:-2500}"
printf 'PROTOCOL_BENCHMARK_LOG=%q\n' "${PROTOCOL_BENCHMARK_LOG:-$PROTOCOL_BENCHMARK_LOG_DEFAULT}"
printf 'PROTOCOL_BENCHMARK_MONITOR_MIN_ROUNDS=%q\n' "${PROTOCOL_BENCHMARK_MONITOR_MIN_ROUNDS:-3}"
printf 'PROTOCOL_BENCHMARK_SLOW_MIN_HITS=%q\n' "${PROTOCOL_BENCHMARK_SLOW_MIN_HITS:-2}"
printf 'PROTOCOL_BENCHMARK_WARN_MIN_OK_HITS=%q\n' "${PROTOCOL_BENCHMARK_WARN_MIN_OK_HITS:-2}"
printf 'PROTOCOL_BENCHMARK_ALERT_REPEAT=%q\n' "${PROTOCOL_BENCHMARK_ALERT_REPEAT:-3}"
printf 'PROTOCOL_BENCHMARK_HARD_ALERT_REPEAT=%q\n' "${PROTOCOL_BENCHMARK_HARD_ALERT_REPEAT:-3}"
printf 'PROTOCOL_BENCHMARK_ALERT_COOLDOWN_MINUTES=%q\n' "${PROTOCOL_BENCHMARK_ALERT_COOLDOWN_MINUTES:-60}"
printf 'PROTOCOL_BENCHMARK_ALERT_STATE=%q\n' "${PROTOCOL_BENCHMARK_ALERT_STATE:-$CONFIG_DIR/protocol-benchmark-alert.state}"
printf 'PROTOCOL_BENCHMARK_RECOVERY_ALERT=%q\n' "${PROTOCOL_BENCHMARK_RECOVERY_ALERT:-1}"
printf 'PROTOCOL_MONITOR_ALERT_COOLDOWN_MINUTES=%q\n' "${PROTOCOL_MONITOR_ALERT_COOLDOWN_MINUTES:-60}"
printf 'PROTOCOL_MONITOR_ALERT_REPEAT=%q\n' "${PROTOCOL_MONITOR_ALERT_REPEAT:-3}"
printf 'PROTOCOL_MONITOR_ALERT_STATE=%q\n' "${PROTOCOL_MONITOR_ALERT_STATE:-$CONFIG_DIR/protocol-health-alert.state}"
printf 'PROTOCOL_MONITOR_RECOVERY_ALERT=%q\n' "${PROTOCOL_MONITOR_RECOVERY_ALERT:-1}"
printf 'TG_TOKEN=%q\n' "${TG_TOKEN:-}"
printf 'TG_CHAT_ID=%q\n' "${TG_CHAT_ID:-}"
printf '# Доп. администраторы через запятую: id1,id2,id3\n'
printf 'TG_ADMINS=%q\n' "${TG_ADMINS:-}"
printf '# Отдельный Telegram бот для продаж и автовыдачи подписок\n'
printf 'SALES_BOT_TOKEN=%q\n' "${SALES_BOT_TOKEN:-}"
printf 'SALES_BOT_ADMIN_ID=%q\n' "${SALES_BOT_ADMIN_ID:-${TG_CHAT_ID:-}}"
printf 'SALES_BOT_ADMINS=%q\n' "${SALES_BOT_ADMINS:-}"
printf 'SALES_BOT_PLANS=%q\n' "${SALES_BOT_PLANS:-$SALES_BOT_PLANS_DEFAULT}"
printf 'SALES_BOT_CURRENCY=%q\n' "${SALES_BOT_CURRENCY:-$SALES_BOT_CURRENCY_DEFAULT}"
printf 'SALES_BOT_CHANNEL_URL=%q\n' "${SALES_BOT_CHANNEL_URL:-$SALES_BOT_CHANNEL_URL_DEFAULT}"
printf 'SALES_BOT_PAYMENT_TEXT=%q\n' "${SALES_BOT_PAYMENT_TEXT:-$SALES_BOT_PAYMENT_TEXT_DEFAULT}"
printf 'SALES_BOT_PAYMENT_QR_PATH=%q\n' "${SALES_BOT_PAYMENT_QR_PATH:-$SALES_BOT_PAYMENT_QR_PATH_DEFAULT}"
printf 'SALES_BOT_WELCOME_ANIMATION_PATH=%q\n' "${SALES_BOT_WELCOME_ANIMATION_PATH:-$SALES_BOT_WELCOME_ANIMATION_PATH_DEFAULT}"
printf 'SALES_BOT_WELCOME_IMAGE_PATH=%q\n' "${SALES_BOT_WELCOME_IMAGE_PATH:-$SALES_BOT_WELCOME_IMAGE_PATH_DEFAULT}"
printf 'SALES_BOT_CAPTCHA_TTL_SECONDS=%q\n' "${SALES_BOT_CAPTCHA_TTL_SECONDS:-$SALES_BOT_CAPTCHA_TTL_SECONDS_DEFAULT}"
printf 'SALES_BOT_ORDER_MIN_INTERVAL_SECONDS=%q\n' "${SALES_BOT_ORDER_MIN_INTERVAL_SECONDS:-$SALES_BOT_ORDER_MIN_INTERVAL_SECONDS_DEFAULT}"
printf 'SALES_BOT_MAX_PENDING_PER_CHAT=%q\n' "${SALES_BOT_MAX_PENDING_PER_CHAT:-$SALES_BOT_MAX_PENDING_PER_CHAT_DEFAULT}"
printf 'SALES_BOT_MAX_ORDER_FILES=%q\n' "${SALES_BOT_MAX_ORDER_FILES:-$SALES_BOT_MAX_ORDER_FILES_DEFAULT}"
printf '# 1 = Hysteria 2 включена для роли сервера, 0 = не запускать её при синхронизации пользователей\n'
printf 'HYSTERIA_ENABLED=%q\n' "${HYSTERIA_ENABLED:-1}"
printf 'HYSTERIA_PORT=%q\n' "${HYSTERIA_PORT:-8443}"
printf 'HYSTERIA_PASSWORD=%q\n' "${HYSTERIA_PASSWORD:-}"
printf 'HYSTERIA_OBFS_PASSWORD=%q\n' "${HYSTERIA_OBFS_PASSWORD:-}"
printf '# 1 = направлять только Hysteria 2 через локальный WARP SOCKS5, не трогая Caddy/Xray\n'
printf 'HYSTERIA_WARP_ENABLED=%q\n' "${HYSTERIA_WARP_ENABLED:-0}"
printf '# 1 = добавлять Hysteria 2 Port Hopping профиль и UDP redirect диапазона на Hysteria порт\n'
printf 'HYSTERIA_PORT_HOP_ENABLED=%q\n' "${HYSTERIA_PORT_HOP_ENABLED:-0}"
printf 'HYSTERIA_PORT_HOP_PORTS=%q\n' "${HYSTERIA_PORT_HOP_PORTS:-$HYSTERIA_PORT_HOP_PORTS_DEFAULT}"
printf 'UNBOUND_ENABLED=%q\n' "${UNBOUND_ENABLED:-0}"
printf 'UNBOUND_MODE=%q\n' "${UNBOUND_MODE:-recursive}"
printf 'UNBOUND_ADBLOCK=%q\n' "${UNBOUND_ADBLOCK:-0}"
printf 'UNBOUND_GATEWAY_IP=%q\n' "${UNBOUND_GATEWAY_IP:-}"
printf 'UNBOUND_MANAGED_GATEWAY=%q\n' "${UNBOUND_MANAGED_GATEWAY:-0}"
printf 'UNBOUND_VPN_ENABLED=%q\n' "${UNBOUND_VPN_ENABLED:-0}"
printf 'UNBOUND_VPN_CIDRS=%q\n' "${UNBOUND_VPN_CIDRS:-10.0.0.0/24}"
printf 'UNBOUND_FILTER_ENABLED=%q\n' "${UNBOUND_FILTER_ENABLED:-1}"
printf 'UNBOUND_FILTER_URLS=%q\n' "${UNBOUND_FILTER_URLS:-$DNS_FILTER_URLS_DEFAULT}"
printf 'UNBOUND_FILTER_MAX_DOMAINS=%q\n' "${UNBOUND_FILTER_MAX_DOMAINS:-$DNS_FILTER_MAX_DOMAINS_DEFAULT}"
printf 'DNS_MONITOR_ALERT_REPEAT=%q\n' "${DNS_MONITOR_ALERT_REPEAT:-3}"
printf 'DNS_MONITOR_ALERT_COOLDOWN_MINUTES=%q\n' "${DNS_MONITOR_ALERT_COOLDOWN_MINUTES:-180}"
printf 'DNS_MONITOR_ALERT_STATE=%q\n' "${DNS_MONITOR_ALERT_STATE:-$CONFIG_DIR/dns-monitor-alert.state}"
printf 'DNS_MONITOR_RECOVERY_ALERT=%q\n' "${DNS_MONITOR_RECOVERY_ALERT:-1}"
printf 'WARP_PROXY_PORT=%q\n' "${WARP_PROXY_PORT:-$WARP_PROXY_PORT_DEFAULT}"
printf 'WARP_PROXY_ENABLED=%q\n' "${WARP_PROXY_ENABLED:-0}"
printf 'WARP_MODE=%q\n' "${WARP_MODE:-off}"
printf 'WARP_PROTOCOL=%q\n' "${WARP_PROTOCOL:-auto}"
printf 'WARP_SSH_ALLOW_CIDRS=%q\n' "${WARP_SSH_ALLOW_CIDRS:-}"
printf 'XRAY_WARP_ENABLED=%q\n' "${XRAY_WARP_ENABLED:-${WARP_PROXY_ENABLED:-0}}"
printf 'DEVICE_LIMIT_ENABLED=%q\n' "${DEVICE_LIMIT_ENABLED:-0}"
printf 'DEVICE_LIMIT=%q\n' "${DEVICE_LIMIT:-$DEVICE_LIMIT_DEFAULT}"
printf 'DEVICE_WINDOW_HOURS=%q\n' "${DEVICE_WINDOW_HOURS:-$DEVICE_WINDOW_HOURS_DEFAULT}"
printf 'DEVICE_LIMIT_MODE=%q\n' "${DEVICE_LIMIT_MODE:-alert}"
printf 'EXPIRED_DELETE_GRACE_DAYS=%q\n' "${EXPIRED_DELETE_GRACE_DAYS:-$EXPIRED_DELETE_GRACE_DAYS_DEFAULT}"
printf 'XRAY_ENABLED=%q\n' "${XRAY_ENABLED:-0}"
printf 'XRAY_FALLBACK_ENABLED=%q\n' "${XRAY_FALLBACK_ENABLED:-0}"
printf '# 1 = включить VLESS Reality inbound, 0 = оставить Xray только для других явно включённых transport\n'
printf 'XRAY_REALITY_ENABLED=%q\n' "${XRAY_REALITY_ENABLED:-1}"
printf 'XRAY_REALITY_PORT=%q\n' "${XRAY_REALITY_PORT:-$XRAY_REALITY_PORT_DEFAULT}"
printf 'XRAY_REALITY_PUBLIC_PORT=%q\n' "${XRAY_REALITY_PUBLIC_PORT:-${XRAY_REALITY_PUBLIC_PORT_DEFAULT}}"
printf 'XRAY_REALITY_SNI_MUX_ENABLED=%q\n' "${XRAY_REALITY_SNI_MUX_ENABLED:-0}"
printf 'XRAY_MKCP_PORT=%q\n' "${XRAY_MKCP_PORT:-$XRAY_MKCP_PORT_DEFAULT}"
printf 'XRAY_VISION_PORT=%q\n' "${XRAY_VISION_PORT:-$XRAY_VISION_PORT_DEFAULT}"
printf '# 1 = включить VLESS XHTTP inbound на сервере, 0 = убрать inbound из Xray\n'
printf 'XRAY_XHTTP_ENABLED=%q\n' "${XRAY_XHTTP_ENABLED:-0}"
printf 'XRAY_XHTTP_PORT=%q\n' "${XRAY_XHTTP_PORT:-$XRAY_XHTTP_PORT_DEFAULT}"
printf '# all/* или список пользователей, разрешённых на XHTTP inbound\n'
printf 'XRAY_XHTTP_ALLOWED_USERS=%q\n' "${XRAY_XHTTP_ALLOWED_USERS:-all}"
printf 'XRAY_MOBILE_ALT_ENABLED=%q\n' "${XRAY_MOBILE_ALT_ENABLED:-0}"
printf 'XRAY_WS_PORT=%q\n' "${XRAY_WS_PORT:-$XRAY_WS_PORT_DEFAULT}"
printf 'XRAY_HTTPUPGRADE_PORT=%q\n' "${XRAY_HTTPUPGRADE_PORT:-$XRAY_HTTPUPGRADE_PORT_DEFAULT}"
printf 'XRAY_CADDY_FALLBACK_PORT=%q\n' "${XRAY_CADDY_FALLBACK_PORT:-$XRAY_CADDY_FALLBACK_PORT_DEFAULT}"
printf 'XRAY_REALITY_TARGET=%q\n' "${XRAY_REALITY_TARGET:-www.microsoft.com:443}"
printf 'XRAY_REALITY_SERVER_NAME=%q\n' "${XRAY_REALITY_SERVER_NAME:-www.microsoft.com}"
printf '# Optional temporary Reality test profile with a separate SNI/target\n'
printf 'XRAY_GITHUB_TEST_ENABLED=%q\n' "${XRAY_GITHUB_TEST_ENABLED:-0}"
printf 'XRAY_GITHUB_TEST_USERS=%q\n' "${XRAY_GITHUB_TEST_USERS:-}"
printf 'XRAY_GITHUB_TEST_PORT=%q\n' "${XRAY_GITHUB_TEST_PORT:-$XRAY_GITHUB_TEST_PORT_DEFAULT}"
printf 'XRAY_GITHUB_TEST_TARGET=%q\n' "${XRAY_GITHUB_TEST_TARGET:-$XRAY_GITHUB_TEST_TARGET_DEFAULT}"
printf 'XRAY_GITHUB_TEST_SERVER_NAME=%q\n' "${XRAY_GITHUB_TEST_SERVER_NAME:-$XRAY_GITHUB_TEST_SERVER_NAME_DEFAULT}"
printf 'XRAY_REALITY_PRIVATE_KEY=%q\n' "${XRAY_REALITY_PRIVATE_KEY:-}"
printf 'XRAY_REALITY_PUBLIC_KEY=%q\n' "${XRAY_REALITY_PUBLIC_KEY:-}"
printf 'XRAY_REALITY_SHORT_ID=%q\n' "${XRAY_REALITY_SHORT_ID:-}"
printf 'XRAY_TROJAN_PASSWORD=%q\n' "${XRAY_TROJAN_PASSWORD:-}"
printf '# Legacy: zapret.dat blackhole routing disabled; kept only for safe migration/status\n'
printf 'XRAY_ZAPRET_ENABLED=%q\n' "${XRAY_ZAPRET_ENABLED:-0}"
printf 'XRAY_ZAPRET_DAT=%q\n' "${XRAY_ZAPRET_DAT:-$XRAY_ZAPRET_DAT_DEFAULT}"
printf 'XRAY_ZAPRET_URL=%q\n' "${XRAY_ZAPRET_URL:-$XRAY_ZAPRET_URL_DEFAULT}"
printf 'CADDY_VERSION_PIN=%q\n' "${CADDY_VERSION_PIN:-v2.11.4}"
printf 'XCADDY_VERSION_PIN=%q\n' "${XCADDY_VERSION_PIN:-v0.4.6}"
printf 'FORWARDPROXY_REF_PIN=%q\n' "${FORWARDPROXY_REF_PIN:-d62c80d3dd2c706b6b87579844d2397bddd18317}"
printf 'XRAY_VERSION_PIN=%q\n' "${XRAY_VERSION_PIN:-v26.3.27}"
printf 'HYSTERIA_VERSION_PIN=%q\n' "${HYSTERIA_VERSION_PIN:-app/v2.12.3}"
printf 'BRIDGE_ENABLED=%q\n' "${BRIDGE_ENABLED:-0}"
printf 'BRIDGE_NAME=%q\n' "${BRIDGE_NAME:-}"
printf 'BRIDGE_ENTRY_PROTOCOL=%q\n' "${BRIDGE_ENTRY_PROTOCOL:-naive}"
printf 'BRIDGE_EXIT_PROTOCOL=%q\n' "${BRIDGE_EXIT_PROTOCOL:-vless}"
printf 'BRIDGE_EXIT_URI=%q\n' "${BRIDGE_EXIT_URI:-}"
printf 'INSTALLED_AT=%q\n' "$(date '+%Y-%m-%d %H:%M:%S')"
} > "$tmp_config"; then
rm -f "$tmp_config"
err "Не удалось записать временный конфиг"
return 1
fi
chown root:root "$tmp_config" 2>/dev/null || true
chmod 600 "$tmp_config"
if ! mv -f "$tmp_config" "$CONFIG_FILE"; then
rm -f "$tmp_config"
err "Не удалось обновить $CONFIG_FILE"
return 1
fi
}
# ─── Пользователи ────────────────────────────────────────────
load_users() {
if [[ ! -f "$USERS_FILE" ]]; then
mkdir -p "$CONFIG_DIR"
: > "$USERS_FILE"
chmod 600 "$USERS_FILE"
fi
chown root:root "$USERS_FILE" 2>/dev/null || true
chmod 600 "$USERS_FILE" 2>/dev/null || true
}
get_users() {
grep -v '^#\|^[[:space:]]*$' "$USERS_FILE" 2>/dev/null || true
}
is_valid_proxy_hash() {
[[ "${1:-}" =~ ^\$2[aby]\$[0-9]{2}\$[./A-Za-z0-9]{53}$ ]]
}
is_valid_encrypted_proxy_secret() {
local value="${1:-}"
[[ "${#value}" -ge 128 && "${#value}" -le 2048 ]] || return 1
[[ "$value" =~ ^[A-Za-z0-9+/]+={0,2}$ ]]
}
credential_bcrypt_cost() {
local cost="${CREDENTIAL_BCRYPT_COST:-$CREDENTIAL_BCRYPT_COST_DEFAULT}"
[[ "$cost" =~ ^(10|11|12|13|14)$ ]] || cost="$CREDENTIAL_BCRYPT_COST_DEFAULT"
printf '%s\n' "$cost"
}
ensure_credential_tools() {
command -v openssl >/dev/null 2>&1 || { err "Для credential vault нужен openssl"; return 1; }
if ! command -v htpasswd >/dev/null 2>&1; then
info "Устанавливаю apache2-utils для bcrypt..."
DEBIAN_FRONTEND=noninteractive apt-get install -y -q apache2-utils >/dev/null 2>&1 \
|| { err "Для bcrypt нужен htpasswd (пакет apache2-utils)"; return 1; }
fi
}
ensure_credential_keypair() {
ensure_credential_tools || return 1
install -d -o root -g root -m 700 "$CREDENTIALS_DIR"
if [[ -s "$CREDENTIALS_PRIVATE_KEY" || -s "$CREDENTIALS_PUBLIC_KEY" ]]; then
if [[ ! -s "$CREDENTIALS_PRIVATE_KEY" || ! -s "$CREDENTIALS_PUBLIC_KEY" ]]; then
err "Credential keypair неполный; автоматическая замена запрещена"
return 1
fi
openssl pkey -in "$CREDENTIALS_PRIVATE_KEY" -check -noout >/dev/null 2>&1 || { err "Повреждён private key credential vault"; return 1; }
openssl pkey -pubin -in "$CREDENTIALS_PUBLIC_KEY" -noout >/dev/null 2>&1 || { err "Повреждён public key credential vault"; return 1; }
local derived_public_hash stored_public_hash
derived_public_hash=$(openssl pkey -in "$CREDENTIALS_PRIVATE_KEY" -pubout -outform DER 2>/dev/null | sha256sum | awk '{print $1}')
stored_public_hash=$(openssl pkey -pubin -in "$CREDENTIALS_PUBLIC_KEY" -outform DER 2>/dev/null | sha256sum | awk '{print $1}')
[[ -n "$derived_public_hash" && "$derived_public_hash" == "$stored_public_hash" ]] \
|| { err "Private/public key credential vault не совпадают"; return 1; }
touch "$USERS_SECRETS_FILE" "$CREDENTIALS_LOCK_FILE"
chmod 600 "$CREDENTIALS_PRIVATE_KEY" "$USERS_SECRETS_FILE" "$CREDENTIALS_LOCK_FILE" 2>/dev/null || true
chmod 644 "$CREDENTIALS_PUBLIC_KEY" 2>/dev/null || true
return 0
fi
if [[ -s "$USERS_SECRETS_FILE" ]] \
|| grep -Eq ':\$2[aby]\$' "$USERS_FILE" 2>/dev/null \
|| grep -Eq ':\$2[aby]\$' "$DISABLED_USERS_FILE" 2>/dev/null; then
err "Credential vault key отсутствует для существующего protected store; автоматическая замена запрещена"
return 1
fi
local private_tmp public_tmp
private_tmp=$(mktemp "${CREDENTIALS_DIR}/private.pem.XXXXXX") || return 1
public_tmp=$(mktemp "${CREDENTIALS_DIR}/public.pem.XXXXXX") || { rm -f "$private_tmp"; return 1; }
chmod 600 "$private_tmp" "$public_tmp"
if ! openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out "$private_tmp" >/dev/null 2>&1 \
|| ! openssl pkey -in "$private_tmp" -pubout -out "$public_tmp" >/dev/null 2>&1; then
rm -f "$private_tmp" "$public_tmp"
err "Не удалось создать RSA-OAEP keypair для credential vault"
return 1
fi
mv -f "$private_tmp" "$CREDENTIALS_PRIVATE_KEY"
mv -f "$public_tmp" "$CREDENTIALS_PUBLIC_KEY"
chown root:root "$CREDENTIALS_PRIVATE_KEY" "$CREDENTIALS_PUBLIC_KEY" 2>/dev/null || true
chmod 600 "$CREDENTIALS_PRIVATE_KEY"
chmod 644 "$CREDENTIALS_PUBLIC_KEY"
: > "$USERS_SECRETS_FILE"
chmod 600 "$USERS_SECRETS_FILE"
ok "Создан локальный RSA-OAEP credential vault"
}
hash_proxy_password() {
local user="$1" pass="$2" record hash
ensure_credential_tools || return 1
is_valid_proxy_user "$user" || return 1
is_valid_proxy_pass "$pass" || return 1
record=$(printf '%s\n' "$pass" | htpasswd -niBC "$(credential_bcrypt_cost)" "$user" 2>/dev/null) || return 1
hash="${record#*:}"
is_valid_proxy_hash "$hash" || return 1
printf '%s\n' "$hash"
}
verify_proxy_password_hash() {
local user="$1" pass="$2" hash="$3" verify_file
is_valid_proxy_user "$user" || return 1
is_valid_proxy_pass "$pass" || return 1
is_valid_proxy_hash "$hash" || return 1
ensure_credential_tools || return 1
verify_file=$(mktemp /tmp/yurich-credential-verify.XXXXXX) || return 1
chmod 600 "$verify_file"
printf '%s:%s\n' "$user" "$hash" > "$verify_file"
if printf '%s\n' "$pass" | htpasswd -vi "$verify_file" "$user" >/dev/null 2>&1; then
rm -f "$verify_file"
return 0
fi
rm -f "$verify_file"
return 1
}
encrypt_proxy_password() {
local pass="$1" encrypted
ensure_credential_keypair || return 1
is_valid_proxy_pass "$pass" || return 1
encrypted=$(printf '%s' "$pass" \
| openssl pkeyutl -encrypt -pubin -inkey "$CREDENTIALS_PUBLIC_KEY" \
-pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -pkeyopt rsa_mgf1_md:sha256 2>/dev/null \
| base64 -w0) || return 1
is_valid_encrypted_proxy_secret "$encrypted" || return 1
printf '%s\n' "$encrypted"
}
decrypt_proxy_password_with_key() {
local encrypted="$1" private_key="$2" pass
is_valid_encrypted_proxy_secret "$encrypted" || return 1
[[ -s "$private_key" ]] || return 1
pass=$(printf '%s' "$encrypted" \
| base64 -d 2>/dev/null \
| openssl pkeyutl -decrypt -inkey "$private_key" \
-pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -pkeyopt rsa_mgf1_md:sha256 2>/dev/null) || return 1
is_valid_proxy_pass "$pass" || return 1
printf '%s\n' "$pass"
}
decrypt_proxy_password() {
decrypt_proxy_password_with_key "$1" "$CREDENTIALS_PRIVATE_KEY"
}
credential_file_value() {
local file="$1" lookup_user="$2"
[[ -f "$file" ]] || return 1
awk -F: -v user="$lookup_user" '$1 == user {sub(/^[^:]*:/, ""); print; exit}' "$file"
}
get_user_hash() {
local lookup_user="$1" value
value=$(credential_file_value "$USERS_FILE" "$lookup_user" 2>/dev/null || true)
[[ -n "$value" ]] || return 1
if is_valid_proxy_hash "$value"; then
printf '%s\n' "$value"
return 0
fi
is_valid_proxy_pass "$value" || return 1
hash_proxy_password "$lookup_user" "$value"
}
get_user_pass() {
local lookup_user="$1" encrypted legacy_value
encrypted=$(credential_file_value "$USERS_SECRETS_FILE" "$lookup_user" 2>/dev/null || true)
if [[ -n "$encrypted" ]]; then
decrypt_proxy_password "$encrypted"
return $?
fi
# Read-only compatibility for pre-v5.7 installs. New writes never use plaintext.
legacy_value=$(credential_file_value "$USERS_FILE" "$lookup_user" 2>/dev/null || true)
if is_valid_proxy_pass "$legacy_value" && ! is_valid_proxy_hash "$legacy_value"; then
printf '%s\n' "$legacy_value"
return 0
fi
return 1
}
get_active_user_hashes() {
local user value hash
while IFS=: read -r user value; do
[[ -z "$user" || -z "$value" ]] && continue
if ! user_is_expired "$user"; then
hash=$(get_user_hash "$user" 2>/dev/null || true)
[[ -n "$hash" ]] && printf '%s:%s\n' "$user" "$hash"
fi
done < <(get_users)
}
get_active_users() {
local user value pass
while IFS=: read -r user value; do
[[ -z "$user" || -z "$value" ]] && continue
if ! user_is_expired "$user"; then
pass=$(get_user_pass "$user" 2>/dev/null || true)
[[ -n "$pass" ]] && printf '%s:%s\n' "$user" "$pass"
fi
done < <(get_users)
}
get_active_user_pass() {
local lookup_user="$1"
if user_is_expired "$lookup_user"; then
return 1
fi
get_user_pass "$lookup_user"
}
active_user_count() {
get_active_user_hashes | wc -l
}
write_active_users_hash_file() {
local tmp
ensure_credential_keypair || return 1
tmp=$(mktemp "${CREDENTIALS_DIR}/users.active.XXXXXX") || return 1
{
echo "# Yurich Panel active bcrypt credentials"
get_active_user_hashes
} > "$tmp"
install -o root -g root -m 600 "$tmp" "$ACTIVE_USERS_HASH_FILE"
rm -f "$tmp"
}
credential_state_backup() {
local destination="$1"
mkdir -p "$destination"
chmod 700 "$destination"
local file name
for file in "$USERS_FILE" "$DISABLED_USERS_FILE"; do
name=$(basename "$file")
if [[ -e "$file" ]]; then cp -a "$file" "$destination/$name"; else : > "$destination/$name.missing"; fi
done
if [[ -d "$CREDENTIALS_DIR" ]]; then
cp -a "$CREDENTIALS_DIR" "$destination/credentials"
else
: > "$destination/credentials.missing"
fi
}
credential_state_restore() {
local source="$1" file name
for file in "$USERS_FILE" "$DISABLED_USERS_FILE"; do
name=$(basename "$file")
if [[ -f "$source/$name.missing" ]]; then
rm -f "$file"
elif [[ -f "$source/$name" ]]; then
install -o root -g root -m 600 "$source/$name" "$file"
fi
done
rm -rf "$CREDENTIALS_DIR"
if [[ -d "$source/credentials" ]]; then
cp -a "$source/credentials" "$CREDENTIALS_DIR"
fi
}
credential_set_user() {
local user="$1" pass="$2" hash encrypted users_tmp secrets_tmp users_old secrets_old lock_fd
is_valid_proxy_user "$user" || return 1
is_valid_proxy_pass "$pass" || return 1
ensure_credential_keypair || return 1
hash=$(hash_proxy_password "$user" "$pass") || { err "Не удалось создать bcrypt для $user"; return 1; }
encrypted=$(encrypt_proxy_password "$pass") || { err "Не удалось зашифровать secret для $user"; return 1; }
touch "$CREDENTIALS_LOCK_FILE" "$USERS_SECRETS_FILE"
chmod 600 "$CREDENTIALS_LOCK_FILE" "$USERS_SECRETS_FILE"
exec {lock_fd}>"$CREDENTIALS_LOCK_FILE"
flock -x "$lock_fd" || { exec {lock_fd}>&-; return 1; }
users_tmp=$(mktemp "${CONFIG_DIR}/users.conf.XXXXXX") || { flock -u "$lock_fd"; exec {lock_fd}>&-; return 1; }
secrets_tmp=$(mktemp "${CREDENTIALS_DIR}/users.secrets.XXXXXX") || { rm -f "$users_tmp"; flock -u "$lock_fd"; exec {lock_fd}>&-; return 1; }
users_old=$(mktemp "${CREDENTIALS_DIR}/users.old.XXXXXX") \
|| { rm -f "$users_tmp" "$secrets_tmp"; flock -u "$lock_fd"; exec {lock_fd}>&-; return 1; }
secrets_old=$(mktemp "${CREDENTIALS_DIR}/secrets.old.XXXXXX") \
|| { rm -f "$users_tmp" "$secrets_tmp" "$users_old"; flock -u "$lock_fd"; exec {lock_fd}>&-; return 1; }
cp -a "$USERS_FILE" "$users_old"
cp -a "$USERS_SECRETS_FILE" "$secrets_old"
awk -F: -v user="$user" '$1 != user' "$USERS_FILE" > "$users_tmp"
printf '%s:%s\n' "$user" "$hash" >> "$users_tmp"
awk -F: -v user="$user" '$1 != user' "$USERS_SECRETS_FILE" > "$secrets_tmp"
printf '%s:%s\n' "$user" "$encrypted" >> "$secrets_tmp"
if ! install -o root -g root -m 600 "$users_tmp" "$USERS_FILE" \
|| ! install -o root -g root -m 600 "$secrets_tmp" "$USERS_SECRETS_FILE" \
|| [[ "$(get_user_pass "$user" 2>/dev/null || true)" != "$pass" ]] \
|| ! verify_proxy_password_hash "$user" "$pass" "$hash" \
|| ! write_active_users_hash_file >/dev/null 2>&1; then
install -o root -g root -m 600 "$users_old" "$USERS_FILE" 2>/dev/null || true
install -o root -g root -m 600 "$secrets_old" "$USERS_SECRETS_FILE" 2>/dev/null || true
rm -f "$users_tmp" "$secrets_tmp" "$users_old" "$secrets_old"
flock -u "$lock_fd"; exec {lock_fd}>&-
err "Credential transaction для $user отменена"
return 1
fi
rm -f "$users_tmp" "$secrets_tmp" "$users_old" "$secrets_old"
flock -u "$lock_fd"; exec {lock_fd}>&-
return 0
}
credential_remove_user_secret() {
local user="$1" tmp lock_fd
[[ -f "$USERS_SECRETS_FILE" ]] || return 0
touch "$CREDENTIALS_LOCK_FILE"
chmod 600 "$CREDENTIALS_LOCK_FILE"
exec {lock_fd}>"$CREDENTIALS_LOCK_FILE"
flock -x "$lock_fd" || { exec {lock_fd}>&-; return 1; }
tmp=$(mktemp "${CREDENTIALS_DIR}/users.secrets.XXXXXX") \
|| { flock -u "$lock_fd"; exec {lock_fd}>&-; return 1; }
awk -F: -v user="$user" '$1 != user' "$USERS_SECRETS_FILE" > "$tmp"
if ! install -o root -g root -m 600 "$tmp" "$USERS_SECRETS_FILE"; then
rm -f "$tmp"
flock -u "$lock_fd"; exec {lock_fd}>&-
return 1
fi
rm -f "$tmp"
flock -u "$lock_fd"; exec {lock_fd}>&-
}
credential_plaintext_count() {
local count=0 file user value
for file in "$USERS_FILE" "$DISABLED_USERS_FILE"; do
[[ -f "$file" ]] || continue
while IFS=: read -r user value; do
[[ -z "$user" || -z "$value" ]] && continue
is_valid_proxy_hash "$value" || count=$((count + 1))
done < <(grep -v '^#\|^[[:space:]]*$' "$file" 2>/dev/null || true)
done
printf '%s\n' "$count"
}
credential_store_integrity_check() {
local file user value encrypted pass
local -A seen=()
command -v htpasswd >/dev/null 2>&1 || { err "Credential integrity: htpasswd не найден"; return 1; }
[[ -s "$CREDENTIALS_PRIVATE_KEY" && -s "$CREDENTIALS_PUBLIC_KEY" && -f "$USERS_SECRETS_FILE" ]] \
|| { err "Credential integrity: vault неполный"; return 1; }
local derived_public_hash stored_public_hash
derived_public_hash=$(openssl pkey -in "$CREDENTIALS_PRIVATE_KEY" -pubout -outform DER 2>/dev/null | sha256sum | awk '{print $1}')
stored_public_hash=$(openssl pkey -pubin -in "$CREDENTIALS_PUBLIC_KEY" -outform DER 2>/dev/null | sha256sum | awk '{print $1}')
[[ -n "$derived_public_hash" && "$derived_public_hash" == "$stored_public_hash" ]] \
|| { err "Credential integrity: RSA keypair не совпадает"; return 1; }
for file in "$USERS_FILE" "$DISABLED_USERS_FILE"; do
[[ -f "$file" ]] || continue
while IFS=: read -r user value; do
[[ -z "$user" || -z "$value" || "$user" == \#* ]] && continue
[[ -z "${seen[$user]+x}" ]] || { err "Credential integrity: duplicate user $user"; return 1; }
seen[$user]=1
is_valid_proxy_hash "$value" || continue
encrypted=$(credential_file_value "$USERS_SECRETS_FILE" "$user" 2>/dev/null || true)
pass=$(decrypt_proxy_password "$encrypted" 2>/dev/null || true)
verify_proxy_password_hash "$user" "$pass" "$value" \
|| { err "Credential integrity: bcrypt/vault mismatch for $user"; return 1; }
done < <(grep -v '^#\|^[[:space:]]*$' "$file" 2>/dev/null || true)
done
}
credential_migrate_store() (
local active_tmp disabled_tmp secrets_tmp file output user value hash encrypted pass migration_lock_fd
local -A seen=()
ensure_credential_keypair || return 1
exec {migration_lock_fd}>"$CREDENTIALS_LOCK_FILE"
flock -x "$migration_lock_fd" || return 1
active_tmp=$(mktemp "${CONFIG_DIR}/users.conf.migrate.XXXXXX") || return 1
disabled_tmp=$(mktemp "${CONFIG_DIR}/users.disabled.migrate.XXXXXX") || { rm -f "$active_tmp"; return 1; }
secrets_tmp=$(mktemp "${CREDENTIALS_DIR}/users.secrets.migrate.XXXXXX") || { rm -f "$active_tmp" "$disabled_tmp"; return 1; }
: > "$active_tmp"; : > "$disabled_tmp"; : > "$secrets_tmp"
for file in "$USERS_FILE" "$DISABLED_USERS_FILE"; do
[[ "$file" == "$USERS_FILE" ]] && output="$active_tmp" || output="$disabled_tmp"
[[ -f "$file" ]] || continue
while IFS=: read -r user value; do
[[ -z "$user" || -z "$value" || "$user" == \#* ]] && continue
is_valid_proxy_user "$user" || { err "Миграция: некорректный пользователь $user"; rm -f "$active_tmp" "$disabled_tmp" "$secrets_tmp"; return 1; }
[[ -z "${seen[$user]+x}" ]] || { err "Миграция: пользователь $user встречается дважды"; rm -f "$active_tmp" "$disabled_tmp" "$secrets_tmp"; return 1; }
seen[$user]=1
encrypted=$(credential_file_value "$USERS_SECRETS_FILE" "$user" 2>/dev/null || true)
if is_valid_proxy_hash "$value"; then
hash="$value"
is_valid_encrypted_proxy_secret "$encrypted" || { err "Миграция: для $user нет encrypted secret; сначала ротируй пароль"; rm -f "$active_tmp" "$disabled_tmp" "$secrets_tmp"; return 1; }
pass=$(decrypt_proxy_password "$encrypted" 2>/dev/null || true)
verify_proxy_password_hash "$user" "$pass" "$hash" || { err "Миграция: encrypted secret $user не соответствует bcrypt"; rm -f "$active_tmp" "$disabled_tmp" "$secrets_tmp"; return 1; }
else
pass="$value"
is_valid_proxy_pass "$pass" || { err "Миграция: некорректный legacy-пароль $user"; rm -f "$active_tmp" "$disabled_tmp" "$secrets_tmp"; return 1; }
hash=$(hash_proxy_password "$user" "$pass") || { rm -f "$active_tmp" "$disabled_tmp" "$secrets_tmp"; return 1; }
encrypted=$(encrypt_proxy_password "$pass") || { rm -f "$active_tmp" "$disabled_tmp" "$secrets_tmp"; return 1; }
fi
printf '%s:%s\n' "$user" "$hash" >> "$output"
printf '%s:%s\n' "$user" "$encrypted" >> "$secrets_tmp"
done < <(grep -v '^#\|^[[:space:]]*$' "$file" 2>/dev/null || true)
done
if ! install -o root -g root -m 600 "$active_tmp" "$USERS_FILE" \
|| ! install -o root -g root -m 600 "$disabled_tmp" "$DISABLED_USERS_FILE" \
|| ! install -o root -g root -m 600 "$secrets_tmp" "$USERS_SECRETS_FILE"; then
rm -f "$active_tmp" "$disabled_tmp" "$secrets_tmp"
return 1
fi
rm -f "$active_tmp" "$disabled_tmp" "$secrets_tmp"
write_active_users_hash_file
)
cmd_credentials_status() {
load_users
local total legacy encrypted=0 missing=0 user value
total=$(get_users | wc -l)
legacy=$(credential_plaintext_count)
while IFS=: read -r user value; do
[[ -z "$user" ]] && continue
if is_valid_encrypted_proxy_secret "$(credential_file_value "$USERS_SECRETS_FILE" "$user" 2>/dev/null || true)"; then
encrypted=$((encrypted + 1))
else
missing=$((missing + 1))
fi
done < <(get_users)
hr
echo -e "${BOLD} Credential storage${RESET}"
hr
echo -e " Пользователей: ${CYAN}${total}${RESET}"
echo -e " Bcrypt + vault: ${GREEN}${encrypted}${RESET}"
echo -e " Legacy plaintext: $([[ "$legacy" -eq 0 ]] && echo -e "${GREEN}0${RESET}" || echo -e "${RED}${legacy}${RESET}")"
echo -e " Без encrypted secret: $([[ "$missing" -eq 0 ]] && echo -e "${GREEN}0${RESET}" || echo -e "${RED}${missing}${RESET}")"
[[ -s "$CREDENTIALS_PRIVATE_KEY" ]] && ok "RSA-OAEP keypair: готов" || warn "RSA-OAEP keypair: ещё не создан"
}
cmd_credentials_migrate() {
load_config
load_users
local legacy runtime_backup caddy_had=0 hysteria_had=0
legacy=$(credential_plaintext_count)
if [[ "$legacy" -eq 0 ]]; then
if [[ "$(get_users | wc -l)" -gt 0 || -s "$DISABLED_USERS_FILE" ]]; then
credential_store_integrity_check || {
err "Protected credential store повреждён; миграция без восстановления запрещена"
return 1
}
fi
write_active_users_hash_file >/dev/null 2>&1 || return 1
ok "Credential store уже использует bcrypt + encrypted vault"
return 0
fi
runtime_backup=$(mktemp -d /run/yurich-credential-migration.XXXXXX) || return 1
chmod 700 "$runtime_backup"
credential_state_backup "$runtime_backup/state" || { rm -rf "$runtime_backup"; return 1; }
if [[ -f "$CADDYFILE" ]]; then cp -a "$CADDYFILE" "$runtime_backup/Caddyfile"; caddy_had=1; fi
if [[ -f "$HYSTERIA_CONFIG" ]]; then cp -a "$HYSTERIA_CONFIG" "$runtime_backup/hysteria.yaml"; hysteria_had=1; fi
info "Мигрирую ${legacy} legacy credentials в bcrypt + RSA-OAEP vault..."
if ! credential_migrate_store || ! apply_user_access_runtime; then
err "Миграция не применена; восстанавливаю прежнее состояние"
credential_state_restore "$runtime_backup/state" || true
[[ "$caddy_had" -eq 1 ]] && install -m 600 "$runtime_backup/Caddyfile" "$CADDYFILE"
[[ "$hysteria_had" -eq 1 ]] && install -m 600 "$runtime_backup/hysteria.yaml" "$HYSTERIA_CONFIG"
systemctl reload caddy >/dev/null 2>&1 || systemctl restart caddy >/dev/null 2>&1 || true
systemctl restart hysteria >/dev/null 2>&1 || true
rm -rf "$runtime_backup"
return 1
fi
if [[ "$(credential_plaintext_count)" -ne 0 ]] || grep -q 'type: userpass' "$HYSTERIA_CONFIG" 2>/dev/null; then
err "Post-migration audit не пройден; выполняю rollback"
credential_state_restore "$runtime_backup/state" || true
[[ "$caddy_had" -eq 1 ]] && install -m 600 "$runtime_backup/Caddyfile" "$CADDYFILE"
[[ "$hysteria_had" -eq 1 ]] && install -m 600 "$runtime_backup/hysteria.yaml" "$HYSTERIA_CONFIG"
systemctl reload caddy >/dev/null 2>&1 || systemctl restart caddy >/dev/null 2>&1 || true
systemctl restart hysteria >/dev/null 2>&1 || true
rm -rf "$runtime_backup"
return 1
fi
{
printf 'MIGRATED_AT=%q\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
printf 'USERS=%q\n' "$(get_users | wc -l)"
printf 'BCRYPT_COST=%q\n' "$(credential_bcrypt_cost)"
printf 'FORMAT=%q\n' "bcrypt+rsa-oaep-sha256"
} > "$CREDENTIALS_MIGRATION_RECEIPT"
chmod 600 "$CREDENTIALS_MIGRATION_RECEIPT"
rm -rf "$runtime_backup"
ok "Миграция завершена: plaintext credentials удалены из user store, Caddy и Hysteria config"
}
is_valid_user_months() {
[[ "${1:-}" =~ ^([1-9]|1[0-2])$ ]]
}
is_valid_user_term() {
[[ "${1:-}" =~ ^1d$ || "${1:-}" =~ ^([1-9]|1[0-2])m$ || "${1:-}" =~ ^([1-9]|1[0-2])$ ]]
}
normalize_user_term() {
local term="${1:-}"
case "$term" in
1d|day|день) printf '1d' ;;
1|2|3|4|5|6|7|8|9|10|11|12) printf '%sm\n' "$term" ;;
1m|2m|3m|4m|5m|6m|7m|8m|9m|10m|11m|12m) printf '%s\n' "$term" ;;
*) return 1 ;;
esac
}
user_term_label() {
local term
term=$(normalize_user_term "${1:-}" 2>/dev/null || true)
case "$term" in
1d) printf '1 день' ;;
1m) printf '1 месяц' ;;
2m|3m|4m) printf '%s месяца' "${term%m}" ;;
*m) printf '%s месяцев' "${term%m}" ;;
*) printf '%s' "${1:-?}" ;;
esac
}
user_meta_file() {
local user="$1"
printf '%s/%s.env\n' "$USER_META_DIR" "$user"
}
add_calendar_months_utc() {
local base="$1" months="$2" target_month last_day day
is_valid_user_months "$months" || return 1
[[ "$base" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]] || return 1
[[ "$(date -u -d "$base" '+%Y-%m-%d' 2>/dev/null)" == "$base" ]] || return 1
target_month=$(date -u -d "${base:0:7}-01 +${months} months" '+%Y-%m') || return 1
last_day=$(date -u -d "${target_month}-01 +1 month -1 day" '+%d') || return 1
day=$((10#${base:8:2}))
if (( day > 10#$last_day )); then
day=$((10#$last_day))
fi
printf '%s-%02d\n' "$target_month" "$day"
}
set_user_expiry_months() {
local user="$1" months="$2" expires_at created_at meta_file today
if ! is_valid_proxy_user "$user"; then
err "Некорректный пользователь для срока: $user"
return 1
fi
if ! is_valid_user_months "$months"; then
err "Срок пользователя: только 1-12 месяцев"
return 1
fi
mkdir -p "$USER_META_DIR"
chmod 700 "$USER_META_DIR"
created_at=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
today=$(date -u '+%Y-%m-%d')
expires_at=$(add_calendar_months_utc "$today" "$months" 2>/dev/null || true)
if [[ ! "$expires_at" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then
err "Не удалось рассчитать срок пользователя"
return 1
fi
meta_file=$(user_meta_file "$user")
{
printf 'USER=%q\n' "$user"
printf 'CREATED_AT=%q\n' "$created_at"
printf 'TERM_MONTHS=%q\n' "$months"
printf 'EXPIRES_AT=%q\n' "$expires_at"
} > "$meta_file"
chmod 600 "$meta_file"
}
set_user_expiry_extend_months() {
local user="$1" months="$2" current today base expires_at
if ! is_valid_proxy_user "$user"; then
err "Некорректный пользователь для продления: $user"
return 1
fi
if ! is_valid_user_months "$months"; then
err "Срок пользователя: только 1-12 месяцев"
return 1
fi
today=$(date -u '+%Y-%m-%d')
current=$(get_user_expiry "$user" 2>/dev/null || true)
if [[ "$current" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ && "$current" > "$today" ]]; then
base="$current"
else
base="$today"
fi
expires_at=$(add_calendar_months_utc "$base" "$months" 2>/dev/null || true)
if [[ ! "$expires_at" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then
err "Не удалось рассчитать срок продления"
return 1
fi
user_meta_set "$user" TERM_MONTHS "$months" >/dev/null
user_meta_set "$user" EXPIRES_AT "$expires_at" >/dev/null
user_meta_set "$user" UPDATED_AT "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" >/dev/null
}
set_user_expiry_extend_term() {
local user="$1" raw_term="$2" term current today base expires_at months
if ! is_valid_proxy_user "$user"; then
err "Некорректный пользователь для продления: $user"
return 1
fi
term=$(normalize_user_term "$raw_term" 2>/dev/null || true)
if ! is_valid_user_term "$term"; then
err "Срок пользователя: 1 день или 1-12 месяцев"
return 1
fi
today=$(date -u '+%Y-%m-%d')
current=$(get_user_expiry "$user" 2>/dev/null || true)
if [[ "$current" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ && "$current" > "$today" ]]; then
base="$current"
else
base="$today"
fi
case "$term" in
1d)
expires_at=$(date -u -d "${base} +1 day" '+%Y-%m-%d' 2>/dev/null || true)
;;
*m)
months="${term%m}"
expires_at=$(add_calendar_months_utc "$base" "$months" 2>/dev/null || true)
;;
esac
if [[ ! "$expires_at" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then
err "Не удалось рассчитать срок продления"
return 1
fi
if [[ "$term" == "1d" ]]; then
user_meta_set "$user" TERM_DAYS "1" >/dev/null
user_meta_set "$user" TERM_MONTHS "" >/dev/null
else
user_meta_set "$user" TERM_MONTHS "$months" >/dev/null
user_meta_set "$user" TERM_DAYS "" >/dev/null
fi
user_meta_set "$user" TERM "$term" >/dev/null
user_meta_set "$user" EXPIRES_AT "$expires_at" >/dev/null
user_meta_set "$user" UPDATED_AT "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" >/dev/null
}
get_user_expiry() {
local user="$1" meta_file expires
if ! is_valid_proxy_user "$user"; then
return 1
fi
meta_file=$(user_meta_file "$user")
[[ -f "$meta_file" ]] || return 1
expires=$(awk -F= '$1=="EXPIRES_AT"{gsub(/'\''|"|[[:space:]]/,"",$2); print $2; exit}' "$meta_file" 2>/dev/null || true)
[[ "$expires" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]] || return 1
printf '%s\n' "$expires"
}
user_is_blocked() {
local user="$1" blocked
blocked=$(user_meta_get "$user" ACCESS_BLOCKED 2>/dev/null || true)
[[ "$blocked" == "1" ]]
}
user_is_time_expired() {
local user="$1" expires today
expires=$(get_user_expiry "$user" 2>/dev/null || true)
[[ -n "$expires" ]] || return 1
today=$(date -u '+%Y-%m-%d')
[[ "$expires" < "$today" ]]
}
user_is_expired() {
local user="$1"
user_is_blocked "$user" && return 0
user_is_time_expired "$user"
}
user_expiry_label() {
local user="$1" expires today
if user_is_blocked "$user"; then
printf 'приостановлен администратором'
return
fi
expires=$(get_user_expiry "$user" 2>/dev/null || true)
if [[ -z "$expires" ]]; then
printf 'без срока'
return
fi
today=$(date -u '+%Y-%m-%d')
if [[ "$expires" < "$today" ]]; then
printf 'истёк %s' "$expires"
else
printf 'до %s' "$expires"
fi
}
user_expiry_tag() {
local user="$1" expires
expires=$(get_user_expiry "$user" 2>/dev/null || true)
if [[ -z "$expires" ]]; then
printf 'lifetime'
else
printf 'until-%s' "${expires//-/}"
fi
}
user_expiry_epoch() {
local user="$1" expires
expires=$(get_user_expiry "$user" 2>/dev/null || true)
[[ -n "$expires" ]] || return 1
date -u -d "${expires} 23:59:59" '+%s' 2>/dev/null || return 1
}
user_expired_days() {
local user="$1" expires today_ts expires_ts
expires=$(get_user_expiry "$user" 2>/dev/null || true)
[[ "$expires" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]] || return 1
today_ts=$(date -u -d "$(date -u '+%Y-%m-%d')" '+%s' 2>/dev/null || return 1)
expires_ts=$(date -u -d "$expires" '+%s' 2>/dev/null || return 1)
if [[ "$today_ts" -le "$expires_ts" ]]; then
printf '0\n'
else
printf '%s\n' $(( (today_ts - expires_ts) / 86400 ))
fi
}
prompt_user_term_months() {
local default_months="${1:-12}" ans
is_valid_user_months "$default_months" || default_months="12"
if [[ -t 0 ]]; then
# The function is often called inside command substitution, so keep the
# prompt on stderr but read from the active stdin. Reading /dev/tty can
# hang or hide the prompt in some provider serial consoles.
printf "%b" "${CYAN}Срок пользователя 1-12 месяцев [${default_months}]: ${RESET}" >&2
read -r ans || ans=""
else
ans="$default_months"
fi
ans="${ans:-$default_months}"
if ! is_valid_user_months "$ans"; then
err "Срок должен быть от 1 до 12 месяцев" >&2
return 1
fi
printf '%s\n' "$ans"
}
cleanup_user_metadata() {
local user="$1"
is_valid_proxy_user "$user" || return 0
rm -f -- "$(user_meta_file "$user")" 2>/dev/null || true
}
user_meta_get() {
local user="$1" key="$2" meta_file
is_valid_proxy_user "$user" || return 1
[[ "$key" =~ ^[A-Z0-9_]+$ ]] || return 1
meta_file=$(user_meta_file "$user")
[[ -f "$meta_file" ]] || return 1
awk -F= -v k="$key" '$1 == k {
sub(/^[^=]*=/, "")
gsub(/^'\''|'\''$/, "")
gsub(/^"|"$/, "")
print
exit
}' "$meta_file" 2>/dev/null || true
}
user_meta_set() {
local user="$1" key="$2" value="$3" meta_file tmp
if ! is_valid_proxy_user "$user"; then
err "Некорректный пользователь: $user"
return 1
fi
if [[ ! "$key" =~ ^[A-Z0-9_]+$ ]]; then
err "Некорректный ключ metadata: $key"
return 1
fi
mkdir -p "$USER_META_DIR"
chmod 700 "$USER_META_DIR"
meta_file=$(user_meta_file "$user")
tmp=$(mktemp)
if [[ -f "$meta_file" ]]; then
awk -F= -v k="$key" '$1 != k {print}' "$meta_file" > "$tmp"
else
: > "$tmp"
fi
if ! grep -q '^USER=' "$tmp" 2>/dev/null; then
printf 'USER=%q\n' "$user" >> "$tmp"
fi
if ! grep -q '^CREATED_AT=' "$tmp" 2>/dev/null; then
printf 'CREATED_AT=%q\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" >> "$tmp"
fi
printf '%s=%q\n' "$key" "$value" >> "$tmp"
install -m 600 "$tmp" "$meta_file"
rm -f "$tmp"
}
user_meta_unset() {
local user="$1" key="$2" meta_file tmp
is_valid_proxy_user "$user" || return 1
[[ "$key" =~ ^[A-Z0-9_]+$ ]] || return 1
meta_file=$(user_meta_file "$user")
[[ -f "$meta_file" ]] || return 0
tmp=$(mktemp)
awk -F= -v k="$key" '$1 != k {print}' "$meta_file" > "$tmp"
install -m 600 "$tmp" "$meta_file"
rm -f "$tmp"
}
is_valid_tg_chat_id() {
[[ "${1:-}" =~ ^-?[0-9]{5,20}$ ]]
}
tg_api_with_token() {
local token="$1" method="$2"
shift 2
[[ "$token" =~ ^[0-9]+:[A-Za-z0-9_-]{20,}$ ]] || return 1
[[ "$method" =~ ^[A-Za-z][A-Za-z0-9]*(\?[A-Za-z0-9_.%=&-]+)?$ ]] || return 1
local cfg rc
cfg=$(mktemp /tmp/yurich_tg_api_XXXXXX) || return 1
chmod 600 "$cfg" 2>/dev/null || true
printf 'url = "https://api.telegram.org/bot%s/%s"\n' "$token" "$method" > "$cfg"
curl --config "$cfg" "$@"
rc=$?
rm -f "$cfg" 2>/dev/null || true
return "$rc"
}
tg_api() {
local method="$1"
shift
[[ -z "${TG_TOKEN:-}" ]] && return 1
tg_api_with_token "$TG_TOKEN" "$method" "$@"
}
list_subscription_users() {
{
get_users | awk -F: '{print $1}'
[[ -s "$XRAY_USERS_FILE" ]] && awk -F: '{print $1}' "$XRAY_USERS_FILE"
} | awk 'NF && !seen[$0]++'
}
days_until_expiry() {
local expires="$1" exp_ts today_ts
[[ "$expires" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]] || return 1
exp_ts=$(date -u -d "$expires" '+%s' 2>/dev/null || true)
today_ts=$(date -u -d "$(date -u '+%Y-%m-%d')" '+%s' 2>/dev/null || true)
[[ -n "$exp_ts" && -n "$today_ts" ]] || return 1
printf '%s\n' $(( (exp_ts - today_ts) / 86400 ))
}
expiry_days_text() {
local days="${1:-0}"
if (( days < 0 )); then
printf 'срок уже истёк'
elif (( days == 0 )); then
printf 'сегодня последний день'
elif (( days == 1 )); then
printf 'остался 1 день'
elif (( days >= 2 && days <= 4 )); then
printf 'осталось %s дня' "$days"
else
printf 'осталось %s дней' "$days"
fi
}
tg_send_to_chat() {
local chat_id="$1" message="$2" resp
[[ -z "${TG_TOKEN:-}" ]] && return 1
is_valid_tg_chat_id "$chat_id" || return 1
resp=$(tg_api "sendMessage" -s --max-time 12 --retry 2 --retry-delay 2 \
-X POST \
--data-urlencode "chat_id=${chat_id}" \
--data-urlencode "parse_mode=HTML" \
--data-urlencode "disable_web_page_preview=true" \
--data-urlencode "text=${message}" \
2>/dev/null || true)
echo "$resp" | grep -q '"ok":true'
}
sales_bot_renew_url() {
local username resp
if [[ -n "${SALES_BOT_PUBLIC_URL:-}" ]]; then
printf '%s\n' "$SALES_BOT_PUBLIC_URL"
return 0
fi
if [[ -n "${SALES_BOT_USERNAME:-}" ]]; then
printf 'https://t.me/%s?start=renew\n' "${SALES_BOT_USERNAME#@}"
return 0
fi
[[ -n "${SALES_BOT_TOKEN:-}" ]] || return 1
resp=$(tg_api_with_token "$SALES_BOT_TOKEN" "getMe" -s --max-time 12 2>/dev/null || true)
username=$(printf '%s\n' "$resp" | grep -o '"username":"[^"]*"' | head -1 | cut -d'"' -f4)
[[ -n "$username" ]] || return 1
printf 'https://t.me/%s?start=renew\n' "$username"
}
tg_send_to_chat_with_renew_button() {
local chat_id="$1" message="$2" renew_url="$3" resp reply_markup
[[ -z "${TG_TOKEN:-}" ]] && return 1
is_valid_tg_chat_id "$chat_id" || return 1
[[ -n "$renew_url" ]] || return 1
reply_markup=$(printf '{"inline_keyboard":[[{"text":"Продлить подписку","url":"%s"}]]}' "$renew_url")
resp=$(tg_api "sendMessage" -s --max-time 12 --retry 2 --retry-delay 2 \
-X POST \
--data-urlencode "chat_id=${chat_id}" \
--data-urlencode "parse_mode=HTML" \
--data-urlencode "disable_web_page_preview=true" \
--data-urlencode "text=${message}" \
--data-urlencode "reply_markup=${reply_markup}" \
2>/dev/null || true)
echo "$resp" | grep -q '"ok":true'
}
telegram_expiry_message() {
local user="$1" expires="$2" days="$3" pretty safe_user safe_domain days_text
pretty=$(profile_expiry_date_dmy "$expires")
safe_user=$(html_escape_text "$user")
safe_domain=$(html_escape_text "${DOMAIN:-Yurich Connect}")
days_text=$(expiry_days_text "$days")
cat <${safe_user}
🌐 Сервер: ${safe_domain}
📅 Активна до: ${pretty}
⏳ ${days_text}
Чтобы подключение не прерывалось, продли подписку заранее.
EOF
}
telegram_bind_message() {
local user="$1" expires="$2" pretty safe_user safe_domain
pretty=$(profile_expiry_date_dmy "$expires")
safe_user=$(html_escape_text "$user")
safe_domain=$(html_escape_text "${DOMAIN:-Yurich Connect}")
cat <${safe_user}
🌐 Сервер: ${safe_domain}
📅 Активна до: ${pretty:-без срока}
Я напомню примерно за 5 дней до окончания подписки.
EOF
}
notify_user_expiry() {
local user="$1" force="${2:-0}" expires days chat_id last_key notify_key message now_at renew_url
if ! is_valid_proxy_user "$user"; then
printf 'invalid_user\n'
return 1
fi
expires=$(get_user_expiry "$user" 2>/dev/null || true)
if [[ -z "$expires" ]]; then
printf 'no_expiry\n'
return 0
fi
days=$(days_until_expiry "$expires" 2>/dev/null || true)
if [[ -z "$days" ]]; then
printf 'bad_expiry\n'
return 1
fi
chat_id=$(user_meta_get "$user" TELEGRAM_CHAT_ID 2>/dev/null || true)
if [[ -z "$chat_id" ]]; then
printf 'no_contact\n'
return 0
fi
if ! is_valid_tg_chat_id "$chat_id"; then
printf 'bad_contact\n'
return 1
fi
if [[ "$force" != "1" && "$days" -gt 5 ]]; then
printf 'not_due\n'
return 0
fi
notify_key="${expires}:window5"
last_key=$(user_meta_get "$user" LAST_EXPIRY_NOTIFY_KEY 2>/dev/null || true)
if [[ "$force" != "1" && "$last_key" == "$notify_key" ]]; then
printf 'already_sent\n'
return 0
fi
message=$(telegram_expiry_message "$user" "$expires" "$days")
renew_url=$(sales_bot_renew_url 2>/dev/null || true)
if { [[ -n "$renew_url" ]] && tg_send_to_chat_with_renew_button "$chat_id" "$message" "$renew_url"; } || tg_send_to_chat "$chat_id" "$message"; then
if [[ "$force" != "1" ]]; then
now_at=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
user_meta_set "$user" LAST_EXPIRY_NOTIFY_KEY "$notify_key" >/dev/null 2>&1 || true
user_meta_set "$user" LAST_EXPIRY_NOTIFY_AT "$now_at" >/dev/null 2>&1 || true
fi
printf 'sent\n'
return 0
fi
printf 'failed\n'
return 1
}
cmd_notify_bind_tg() {
local user="${1:-}" chat_id="${2:-}" expires message
load_config; load_users
if [[ -z "$user" || -z "$chat_id" ]]; then
err "Использование: notify-bind-tg USER TELEGRAM_ID"
return 1
fi
if ! is_valid_proxy_user "$user"; then
err "Некорректный пользователь: $user"
return 1
fi
if ! subscription_user_exists "$user"; then
err "Пользователь $user не найден"
return 1
fi
if ! is_valid_tg_chat_id "$chat_id"; then
err "Некорректный Telegram ID"
return 1
fi
user_meta_set "$user" TELEGRAM_CHAT_ID "$chat_id"
ok "Telegram уведомления привязаны к пользователю $user"
expires=$(get_user_expiry "$user" 2>/dev/null || true)
if [[ -n "${TG_TOKEN:-}" && -n "$expires" ]]; then
message=$(telegram_bind_message "$user" "$expires")
if tg_send_to_chat "$chat_id" "$message"; then
ok "Проверочное сообщение отправлено"
else
warn "Не удалось отправить проверочное сообщение. Пользователь должен открыть бота и нажать Start."
fi
fi
}
cmd_notify_unbind_tg() {
local user="${1:-}"
load_config; load_users
if [[ -z "$user" ]]; then
err "Использование: notify-unbind-tg USER"
return 1
fi
user_meta_unset "$user" TELEGRAM_CHAT_ID
ok "Telegram уведомления отключены для $user"
}
cmd_notify_expiry_list() {
local user expires days chat status pretty
load_config; load_users
printf '%-24s %-12s %-10s %s\n' "USER" "EXPIRES" "DAYS" "TELEGRAM"
printf '%-24s %-12s %-10s %s\n' "----" "-------" "----" "--------"
while IFS= read -r user; do
[[ -z "$user" ]] && continue
expires=$(get_user_expiry "$user" 2>/dev/null || true)
[[ -z "$expires" ]] && expires="без срока"
if [[ "$expires" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then
days=$(days_until_expiry "$expires" 2>/dev/null || echo "-")
pretty=$(profile_expiry_date_dmy "$expires")
else
days="-"
pretty="$expires"
fi
chat=$(user_meta_get "$user" TELEGRAM_CHAT_ID 2>/dev/null || true)
if [[ -n "$chat" ]]; then
status="ok"
else
status="нет id"
fi
printf '%-24s %-12s %-10s %s\n' "$user" "$pretty" "$days" "$status"
done < <(list_subscription_users)
}
cmd_notify_expiry_run() {
local user status total=0 sent=0 no_contact=0 skipped=0 failed=0
load_config; load_users
while IFS= read -r user; do
[[ -z "$user" ]] && continue
total=$((total+1))
if ! status=$(notify_user_expiry "$user" 0 2>/dev/null); then
status="${status:-failed}"
fi
status=$(printf '%s\n' "$status" | tail -n1)
case "$status" in
sent) sent=$((sent+1)) ;;
no_contact) no_contact=$((no_contact+1)) ;;
failed|bad_contact|bad_expiry|invalid_user) failed=$((failed+1)) ;;
*) skipped=$((skipped+1)) ;;
esac
done < <(list_subscription_users)
cmd_enforce_expired_users || failed=$((failed+1))
printf 'expiry notify: total=%s sent=%s no_contact=%s skipped=%s failed=%s\n' "$total" "$sent" "$no_contact" "$skipped" "$failed"
[[ "$failed" -eq 0 ]]
}
cmd_enforce_expired_users() {
local user expired=0 deleted=0 kept=0 failed=0 days grace apply_failed=0
load_config; load_users
grace="${EXPIRED_DELETE_GRACE_DAYS:-$EXPIRED_DELETE_GRACE_DAYS_DEFAULT}"
if ! is_canonical_uint_in_range "$grace" 0 3650; then grace="$EXPIRED_DELETE_GRACE_DAYS_DEFAULT"; fi
while IFS= read -r user; do
[[ -z "$user" ]] && continue
if user_is_time_expired "$user"; then
expired=$((expired + 1))
if ! suspend_subscription_page "$user" >/dev/null 2>&1; then
warn "Не удалось приостановить публичную страницу $user"
failed=$((failed + 1))
fi
days=$(user_expired_days "$user" 2>/dev/null || echo 0)
if [[ "$days" -ge "$grace" ]]; then
if delete_subscription_user_everywhere "$user" >/dev/null 2>&1; then
deleted=$((deleted + 1))
else
failed=$((failed + 1))
fi
else
kept=$((kept + 1))
fi
fi
done < <(list_subscription_users)
if [[ "$expired" -lt 1 && ! -f "$NODES_PENDING_SYNC_FILE" ]]; then
printf 'expiry enforce: expired=0\n'
return 0
fi
if [[ -x "$CADDY_BIN" && -f "$CADDYFILE" ]]; then
safe_apply_caddy_current >/dev/null 2>&1 || { warn "Не удалось применить Caddy после истечения подписок"; apply_failed=1; }
fi
sync_hysteria_users_if_active >/dev/null 2>&1 || { warn "Не удалось применить Hysteria после истечения подписок"; apply_failed=1; }
if [[ -x "$XRAY_BIN" && -s "$XRAY_USERS_FILE" ]]; then
cmd_xray_rebuild >/dev/null 2>&1 || { warn "Не удалось пересобрать Xray после истечения подписок"; apply_failed=1; }
fi
apply_subscription_aliases >/dev/null 2>&1 || { warn "Не удалось обновить alias URL после истечения подписок"; apply_failed=1; }
if [[ "$(nodes_count 2>/dev/null || echo 0)" -gt 0 || -f "$NODES_PENDING_SYNC_FILE" ]]; then
cmd_nodes_sync_users all >/dev/null 2>&1 || { warn "Не удалось синхронизировать истечение подписок на nodes"; apply_failed=1; }
fi
if [[ "$apply_failed" -ne 0 ]]; then
failed=$((failed + 1))
fi
printf 'expiry enforce: expired=%s kept=%s deleted=%s grace_days=%s failed=%s\n' "$expired" "$kept" "$deleted" "$grace" "$failed"
[[ "$failed" -eq 0 ]]
}
cmd_notify_expiry_test() {
local user="${1:-}" status
load_config; load_users
if [[ -z "$user" ]]; then
err "Использование: notify-expiry-test USER"
return 1
fi
if ! status=$(notify_user_expiry "$user" 1 2>/dev/null); then
status="${status:-failed}"
fi
status=$(printf '%s\n' "$status" | tail -n1)
if [[ "$status" == "sent" ]]; then
ok "Тестовое уведомление отправлено пользователю $user"
else
err "Тестовое уведомление не отправлено: $status"
return 1
fi
}
telegram_news_message() {
local body="$1" safe_body safe_domain
body="${body//$'\r'/}"
safe_body=$(html_escape_text "$body")
safe_domain=$(html_escape_text "${DOMAIN:-Yurich Connect}")
cat <${safe_domain}
💬 По вопросам напиши Ивану Юрьевичу.
EOF
}
cmd_notify_news_test() {
local body="${1:-}" target_chat_id="${2:-${TG_CHAT_ID:-}}" message
load_config
if [[ -z "$body" ]]; then
err "Использование: notify-news-test ТЕКСТ"
return 1
fi
if ! is_valid_tg_chat_id "$target_chat_id"; then
err "Некорректный Telegram ID для теста"
return 1
fi
message=$(telegram_news_message "$body")
if tg_send_to_chat "$target_chat_id" "$message"; then
ok "Тестовая новость отправлена"
return 0
fi
err "Тестовая новость не отправлена. Проверь, что админ открыл бота и нажал Start."
return 1
}
cmd_notify_news_broadcast() {
local body="${1:-}" user chat_id message seen_file total=0 contacts=0 sent=0 failed=0 skipped=0 duplicate=0 bad=0
load_config; load_users
if [[ -z "$body" ]]; then
err "Использование: notify-news ТЕКСТ"
return 1
fi
message=$(telegram_news_message "$body")
seen_file=$(mktemp)
chmod 600 "$seen_file" 2>/dev/null || true
while IFS= read -r user; do
[[ -z "$user" ]] && continue
total=$((total + 1))
chat_id=$(user_meta_get "$user" TELEGRAM_CHAT_ID 2>/dev/null || true)
if [[ -z "$chat_id" ]]; then
skipped=$((skipped + 1))
continue
fi
if ! is_valid_tg_chat_id "$chat_id"; then
bad=$((bad + 1))
continue
fi
if grep -Fxq -- "$chat_id" "$seen_file" 2>/dev/null; then
duplicate=$((duplicate + 1))
continue
fi
printf '%s\n' "$chat_id" >> "$seen_file"
contacts=$((contacts + 1))
if tg_send_to_chat "$chat_id" "$message"; then
sent=$((sent + 1))
else
failed=$((failed + 1))
fi
sleep 0.25
done < <(list_subscription_users)
rm -f "$seen_file"
printf 'news broadcast: users=%s contacts=%s sent=%s no_contact=%s duplicate=%s bad_contact=%s failed=%s\n' \
"$total" "$contacts" "$sent" "$skipped" "$duplicate" "$bad" "$failed"
[[ "$failed" -eq 0 && "$sent" -gt 0 ]]
}
cmd_notify_expiry_install() {
local script_path="${SCRIPT_PATH:-/usr/local/bin/yurich-panel.sh}"
load_config; load_users
mkdir -p "$(dirname "$EXPIRY_NOTIFY_CRON")" "$(dirname "$EXPIRY_NOTIFY_LOG")"
cat > "$EXPIRY_NOTIFY_CRON" <${DOMAIN:-unknown}
🕐 $(date '+%Y-%m-%d %H:%M:%S')
📡 Сервер: $(hostname)"
}
tg_alert_down() {
tg_send "🔴 Yurich Panel упал!
🌐 Домен: ${DOMAIN:-unknown}
🕐 $(date '+%Y-%m-%d %H:%M:%S')
📡 Сервер: $(hostname)
⚠️ Требуется вмешательство!"
}
tg_alert_updated() {
local old_ver="$1" new_ver="$2"
tg_send "🔄 Caddy обновлён
📦 Было: ${old_ver}
📦 Стало: ${new_ver}
🕐 $(date '+%Y-%m-%d %H:%M:%S')"
}
tg_send_stats() {
if ! check_installed; then
tg_send "❌ Yurich Panel не установлен"
return
fi
local status="🔴 Остановлен"
systemctl is-active --quiet caddy 2>/dev/null && status="🟢 Работает"
local uptime_str
uptime_str=$(systemctl show caddy --property=ActiveEnterTimestamp 2>/dev/null \
| cut -d= -f2 | xargs -I{} date -d "{}" '+%Y-%m-%d %H:%M' 2>/dev/null || echo "н/д")
local caddy_ver
caddy_ver=$("$CADDY_BIN" version 2>/dev/null | head -1 | awk '{print $1}' || echo "н/д")
local iface rx tx
iface=$(ip route | awk '/default/{print $5}' | head -1)
rx=$(cat /sys/class/net/"$iface"/statistics/rx_bytes 2>/dev/null || echo 0)
tx=$(cat /sys/class/net/"$iface"/statistics/tx_bytes 2>/dev/null || echo 0)
rx=$(numfmt --to=iec "$rx" 2>/dev/null || echo "н/д")
tx=$(numfmt --to=iec "$tx" 2>/dev/null || echo "н/д")
local users_count
users_count=$(get_users | wc -l)
tg_send "📊 Статистика Yurich Panel
🌐 Домен: ${DOMAIN:-н/д}
📡 Статус: ${status}
🕐 Запущен: ${uptime_str}
📦 Caddy: ${caddy_ver}
👥 Пользователей: ${users_count}
📈 Трафик (с ребута):
⬇️ Входящий: ${rx}
⬆️ Исходящий: ${tx}
🖥 Сервер: $(hostname)
💾 RAM: $(free -h | awk '/Mem:/{print $3"/"$2}')
💿 Диск: $(df -h / | awk 'NR==2{print $3"/"$2" ("$5")"}')
🔐 Сертификат:
$(
cert_days=""
cert_info=$(echo | timeout 5 openssl s_client -connect "${DOMAIN:-localhost}:443" -servername "${DOMAIN:-localhost}" 2>/dev/null | openssl x509 -noout -dates 2>/dev/null || echo "")
if [[ -n "$cert_info" ]]; then
not_after=$(echo "$cert_info" | grep "notAfter" | cut -d= -f2)
expire_ts=$(date -d "$not_after" +%s 2>/dev/null || echo 0)
now_ts=$(date +%s)
cert_days=$(( (expire_ts - now_ts) / 86400 ))
echo "📅 Истекает: ${not_after}"
echo "⏳ Осталось: ${cert_days} дней"
else
echo "N/A"
fi
)"
}
# ─── Настройка Telegram ───────────────────────────────────────
setup_telegram() {
hr
echo -e "${BOLD} Настройка Telegram-бота${RESET}"
hr
echo
info "Нужен токен бота и твой chat_id."
info "Создать бота: @BotFather → /newbot"
info "Узнать chat_id: напиши боту @userinfobot"
echo
echo -ne "${CYAN}Bot Token (Enter чтобы пропустить): ${RESET}"
read -rs input_token
echo
[[ -z "$input_token" ]] && { warn "Telegram пропущен"; return; }
echo -ne "${CYAN}Chat ID: ${RESET}"
read -r input_chat_id
[[ -z "$input_chat_id" ]] && { warn "Telegram пропущен"; return; }
if [[ ! "$input_token" =~ ^[0-9]+:[A-Za-z0-9_-]{20,}$ ]]; then
err "Bot Token имеет некорректный формат"
return 1
fi
if ! is_valid_tg_chat_id "$input_chat_id"; then
err "Chat ID имеет некорректный формат"
return 1
fi
info "Проверяю токен..."
local response
response=$(tg_api_with_token "$input_token" "getMe" -s 2>/dev/null || echo "{}")
if echo "$response" | grep -q '"ok":true'; then
local bot_name
bot_name=$(echo "$response" | grep -o '"username":"[^"]*"' | cut -d'"' -f4)
ok "Бот найден: @${bot_name}"
else
err "Токен неверный или бот недоступен"
return
fi
TG_TOKEN="$input_token"
TG_CHAT_ID="$input_chat_id"
save_config
tg_apply_bot_menu || warn "Команды Telegram Menu можно применить позже: sudo bash yurich-panel.sh bot-menu"
tg_send "🤖 Yurich Panel подключён!
✅ Telegram-уведомления настроены
📡 Сервер: $(hostname)
🕐 $(date '+%Y-%m-%d %H:%M:%S')
Доступные команды в скрипте:
• статус — bash yurich-panel.sh tg-stats
• мониторинг — каждые 5 минут автоматически"
ok "Тестовое сообщение отправлено"
echo
warn "Чтобы бот отвечал на /start, /menu и кнопки, нужен systemd сервис naiveproxy-bot."
echo -ne "${YELLOW}Установить и запустить Telegram bot service сейчас? [Y/n]: ${RESET}"
read -r bot_service_answer
if [[ ! "${bot_service_answer}" =~ ^[Nn]$ ]]; then
install_bot_service
else
warn "Бот-меню применено, но ответы на /menu заработают после: sudo bash ${SCRIPT_PATH} bot-install"
fi
}
# ─── Watchdog (cron) ─────────────────────────────────────────
install_monitor() {
cat > "$MONITOR_SCRIPT" <<'MONITOR'
#!/bin/bash
CONFIG_FILE="/etc/naiveproxy/naive.conf"
if [[ -f "$CONFIG_FILE" ]]; then
_owner=$(stat -c '%U' "$CONFIG_FILE" 2>/dev/null || echo "unknown")
_perms=$(stat -c '%a' "$CONFIG_FILE" 2>/dev/null || echo "000")
if [[ "$_owner" == "root" && "$_perms" == "600" ]]; then
_config_value() {
local key="$1"
awk -F= -v key="$key" '$1 == key {sub(/^[^=]*=/, ""); print; exit}' "$CONFIG_FILE" 2>/dev/null
}
TG_TOKEN=$(_config_value TG_TOKEN)
TG_CHAT_ID=$(_config_value TG_CHAT_ID)
DOMAIN=$(_config_value DOMAIN)
[[ "$TG_TOKEN" =~ ^[0-9]+:[A-Za-z0-9_-]{20,}$ ]] || TG_TOKEN=""
[[ "$TG_CHAT_ID" =~ ^-?[0-9]{5,20}$ ]] || TG_CHAT_ID=""
[[ "$DOMAIN" =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$ ]] || DOMAIN="unknown"
unset -f _config_value
fi
fi
tg_api() {
local method="$1"
shift
[[ "${TG_TOKEN:-}" =~ ^[0-9]+:[A-Za-z0-9_-]{20,}$ ]] || return 1
[[ "$method" =~ ^[A-Za-z][A-Za-z0-9]*(\?[A-Za-z0-9_.%=&-]+)?$ ]] || return 1
local cfg rc
cfg=$(mktemp /tmp/yurich_tg_api_XXXXXX) || return 1
chmod 600 "$cfg" 2>/dev/null || true
printf 'url = "https://api.telegram.org/bot%s/%s"\n' "$TG_TOKEN" "$method" > "$cfg"
curl --config "$cfg" "$@"
rc=$?
rm -f "$cfg" 2>/dev/null || true
return "$rc"
}
tg_send() {
local msg="$1"
[[ -z "${TG_TOKEN:-}" || -z "${TG_CHAT_ID:-}" ]] && return
tg_api "sendMessage" -s --max-time 10 --retry 2 \
-X POST \
--data-urlencode "chat_id=${TG_CHAT_ID}" \
--data-urlencode "parse_mode=HTML" \
--data-urlencode "text=${msg}" \
>/dev/null 2>&1 || true
}
FLAG="/run/naiveproxy_was_down"
if ! systemctl is-active --quiet caddy 2>/dev/null; then
if [[ ! -f "$FLAG" ]]; then
touch "$FLAG"
tg_send "🔴 Yurich Panel упал!
🌐 Домен: ${DOMAIN:-unknown}
🕐 $(date '+%Y-%m-%d %H:%M:%S')
🔄 Пытаюсь перезапустить..."
systemctl restart caddy 2>/dev/null || true
sleep 5
if systemctl is-active --quiet caddy; then
tg_send "✅ Перезапущен успешно
🕐 $(date '+%Y-%m-%d %H:%M:%S')"
rm -f "$FLAG"
else
tg_send "❌ Перезапуск не помог! Нужно ручное вмешательство."
fi
fi
else
rm -f "$FLAG"
fi
MONITOR
chmod +x "$MONITOR_SCRIPT"
local script_path
# Если запущен через bash <(curl), $0 будет /dev/fd/xx — используем фиксированный путь
script_path=$(realpath "$0" 2>/dev/null || echo "")
if [[ -z "$script_path" || "$script_path" == /dev/fd/* || "$script_path" == /proc/* ]]; then
script_path="${SCRIPT_PATH}"
# Копируем себя в постоянное место если ещё не там
[[ -f "$script_path" ]] || cp "$0" "$script_path" 2>/dev/null || true
[[ -f "$script_path" ]] && chmod +x "$script_path"
fi
# Очищаем старые naive-cron записи, добавляем новые
( crontab -l 2>/dev/null | grep -v "naiveproxy\|monitor\.sh" || true
echo "*/5 * * * * /bin/bash $MONITOR_SCRIPT"
echo "0 3 * * 0 /bin/bash ${script_path} update >> ${LOG_DIR}/autoupdate.log 2>&1"
) | crontab -
ok "Watchdog: каждые 5 минут"
ok "Автообновление Caddy: воскресенье 3:00"
}
# ─── Проверка домена ─────────────────────────────────────────
check_domain() {
local domain="$1"
info "Проверяю DNS для $domain..."
local server_ip domain_ip public_domain_ip hosts_overrides hosts_domains ans
server_ip=$(curl -s4 --max-time 5 https://ifconfig.me 2>/dev/null || curl -s4 --max-time 5 https://api.ipify.org 2>/dev/null || curl -s4 --max-time 5 https://checkip.amazonaws.com 2>/dev/null || echo "")
public_domain_ip=$(public_dns_ipv4 "$domain")
domain_ip=$(getent ahostsv4 "$domain" 2>/dev/null | awk '{print $1; exit}' || echo "")
[[ -n "$domain_ip" ]] || domain_ip=$(getent hosts "$domain" 2>/dev/null | awk '$1 ~ /^([0-9]{1,3}\.){3}[0-9]{1,3}$/ {print $1; exit}' || echo "")
[[ -n "$domain_ip" ]] || domain_ip="$public_domain_ip"
hosts_overrides=$(hosts_public_domain_overrides | awk -F'|' -v d="${domain,,}" '$1 == d {print}' | head -5 || true)
if [[ -n "$hosts_overrides" ]]; then
hosts_domains=$(printf '%s\n' "$hosts_overrides" | format_hosts_override_domains)
warn "/etc/hosts содержит публичный домен (${hosts_domains}). Это может ломать TLS/SNI и проверки между серверами."
fi
if [[ -z "$domain_ip" ]]; then
err "Домен $domain не резолвится. Проверь DNS."
exit 1
fi
if [[ -n "$public_domain_ip" ]]; then
domain_ip="$public_domain_ip"
fi
if [[ -n "$server_ip" && "$server_ip" != "$domain_ip" ]]; then
warn "IP сервера: $server_ip | IP домена: $domain_ip"
warn "Не совпадают! Let's Encrypt может отказать в сертификате."
echo -ne "${YELLOW}Продолжить всё равно? [y/N]: ${RESET}"
read -r ans
[[ "${ans,,}" == "y" ]] || exit 1
elif [[ -z "$server_ip" ]]; then
warn "Не смог определить публичный IPv4 сервера, DNS домена: $domain_ip"
else
ok "DNS OK: $domain → $domain_ip"
fi
}
# ─── Зависимости ─────────────────────────────────────────────
install_deps() {
info "Обновляю пакеты и ставлю зависимости..."
apt-get update -qq
if ! apt-get install -y -qq curl wget unzip tar ufw openssl dnsutils ca-certificates python3 jq apache2-utils 2>/dev/null; then
err "Не удалось установить обязательные системные зависимости"
return 1
fi
export PATH="/usr/local/go/bin:$PATH"
local go_ver go_min="1.25.1"
go_ver=$(go version 2>/dev/null | grep -oP 'go\K[\d.]+' || echo "0.0")
if version_gt "$go_min" "$go_ver"; then
warn "Go $go_ver не подходит для Caddy ${CADDY_VERSION_PIN:-v2.11.4}, ставлю закреплённую версию..."
local arch
arch=$(dpkg --print-architecture)
[[ "$arch" == "arm64" ]] || arch="amd64"
local go_ver_pin="1.26.5"
local go_url="https://go.dev/dl/go${go_ver_pin}.linux-${arch}.tar.gz"
local go_sha256_amd64="5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"
local go_sha256_arm64="fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49"
local expected_sha go_tmp
[[ "$arch" == "arm64" ]] && expected_sha="$go_sha256_arm64" || expected_sha="$go_sha256_amd64"
go_tmp=$(mktemp /tmp/go_XXXXXX.tar.gz)
if ! wget -q --tries=3 --timeout=30 "$go_url" -O "$go_tmp"; then
rm -f "$go_tmp"
err "Не удалось скачать Go: $go_url"
exit 1
fi
local actual_sha
actual_sha=$(sha256sum "$go_tmp" | awk '{print $1}')
if [[ "$actual_sha" != "$expected_sha" ]]; then
err "SHA256 Go не совпадает! Возможная атака на цепочку поставок. Прерываю."
rm -f "$go_tmp"
exit 1
fi
ok "SHA256 Go подтверждён"
rm -rf /usr/local/go
tar -C /usr/local -xzf "$go_tmp"
rm -f "$go_tmp"
printf 'export PATH="/usr/local/go/bin:$PATH"\n' > /etc/profile.d/go.sh
fi
export PATH="/usr/local/go/bin:$PATH"
ok "Зависимости готовы"
}
# ─── Сборка Caddy ────────────────────────────────────────────
build_caddy() (
info "Собираю Caddy с forwardproxy (naive)..."
info "Занимает 5-15 минут, не прерывай..."
local output_bin="${1:-$CADDY_BIN}"
local caddy_ver="${CADDY_VERSION_PIN:-v2.11.4}"
local fp_ref="${FORWARDPROXY_REF_PIN:-d62c80d3dd2c706b6b87579844d2397bddd18317}"
[[ "$caddy_ver" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || {
err "Некорректный Caddy pin: $caddy_ver"
return 1
}
[[ "$fp_ref" =~ ^[a-fA-F0-9]{40}$ ]] || {
err "Forwardproxy должен быть закреплён полным commit SHA"
return 1
}
export PATH="/usr/local/go/bin:$PATH"
export GOPATH="/root/go"
export GOCACHE="/root/.cache/go-build"
# Ставим git если нет
command -v git &>/dev/null || apt-get install -y -q git
info "Ставлю xcaddy ${XCADDY_VERSION_PIN:-v0.4.6}..."
go install "github.com/caddyserver/xcaddy/cmd/xcaddy@${XCADDY_VERSION_PIN:-v0.4.6}"
# Клонируем naive ветку напрямую — единственный надёжный способ
local fp_dir
fp_dir=$(mktemp -d /tmp/naiveproxy_forwardproxy_XXXXXX)
trap 'rm -rf "${fp_dir:-}" 2>/dev/null' EXIT
info "Клонирую klzgrad/forwardproxy@${fp_ref}..."
if ! git clone -b naive --depth 1 https://github.com/klzgrad/forwardproxy.git "$fp_dir" 2>/dev/null; then
err "Не удалось клонировать forwardproxy. Проверь интернет."
return 1
fi
local current_fp_commit
current_fp_commit=$(git -C "$fp_dir" rev-parse HEAD 2>/dev/null || true)
if [[ "$current_fp_commit" == "$fp_ref" ]]; then
git -C "$fp_dir" checkout --detach HEAD >/dev/null 2>&1 || true
elif ! git -C "$fp_dir" fetch --depth 1 origin "$fp_ref" >/dev/null 2>&1 \
|| ! git -C "$fp_dir" checkout --detach FETCH_HEAD >/dev/null 2>&1; then
err "Не удалось закрепить forwardproxy на ${fp_ref}"
return 1
fi
current_fp_commit=$(git -C "$fp_dir" rev-parse HEAD 2>/dev/null || true)
[[ "$current_fp_commit" == "$fp_ref" ]] || {
err "Forwardproxy commit mismatch: ожидался $fp_ref, получен ${current_fp_commit:-unknown}"
return 1
}
info "Forwardproxy ref: ${current_fp_commit:0:12}"
info "Caddy release pin: $caddy_ver"
# Сборка из неизменяемого commit SHA сохраняет происхождение модуля в build metadata.
"$GOPATH/bin/xcaddy" build "$caddy_ver" \
--with "github.com/caddyserver/forwardproxy=github.com/klzgrad/forwardproxy@${fp_ref}" \
--output "$output_bin"
chmod +x "$output_bin"
local built_ver
built_ver=$("$output_bin" version 2>/dev/null | head -1 || true)
if [[ "$built_ver" != *"${caddy_ver#v}"* ]]; then
err "Собран неожиданный Caddy: ${built_ver:-unknown}, ожидался $caddy_ver"
rm -f "$output_bin"
return 1
fi
if ! "$output_bin" list-modules 2>/dev/null | grep -Fxq 'http.handlers.forward_proxy'; then
err "В собранном Caddy отсутствует http.handlers.forward_proxy"
rm -f "$output_bin"
return 1
fi
# Проверяем наличие naive padding в бинарнике
if command -v strings &>/dev/null; then
local _pc
_pc=$(strings "$output_bin" 2>/dev/null | grep -cE "^(Padding|SetPadding|WithPadding)$" || true)
_pc="${_pc//[^0-9]/}"; _pc="${_pc:-0}"
if [[ "${_pc}" -ge 2 ]]; then
ok "Naive padding модуль подтверждён ✓"
else
warn "Padding не найден — возможна проблема совместимости"
fi
fi
ok "Caddy собран: $built_ver"
)
# Browser extensions require a standards-compliant proxy auth challenge.
# Keep stealth 404 as the default for existing public installations.
caddy_proxy_auth_error_block() {
if [[ "${BROWSER_PROXY_COMPAT:-0}" == "1" ]]; then
cat <<'EOF'
handle_errors {
@proxy_auth_error expression {http.error.status_code} == 401
handle @proxy_auth_error {
log_append yurich_auth_failure "1"
header -WWW-Authenticate
header Proxy-Authenticate "Basic realm=\"Yurich Connect Browser\""
respond "" 407
}
}
EOF
else
cat <<'EOF'
handle_errors {
@proxy_auth_error expression {http.error.status_code} == 401
handle @proxy_auth_error {
log_append yurich_auth_failure "1"
header -WWW-Authenticate
respond "Not Found" 404
}
}
EOF
fi
}
# ── Мультидомен: генерация Caddyfile ─────────────────────────
write_caddyfile_multi() {
mkdir -p "$CADDY_DIR" "$WEBROOT" "$LOG_DIR"
if [[ "${XRAY_FALLBACK_ENABLED:-0}" == "1" ]]; then
warn "Xray fallback hub включён: мультидомен Caddy отключён, Caddy будет локальным fallback."
write_caddyfile
return $?
fi
install_camouflage_page
# Caddy core basic_auth принимает bcrypt; plaintext в Caddyfile не попадает.
local auth_blocks=""
local auth_count=0
while IFS=: read -r u p; do
[[ -z "$u" ]] && continue
if ! is_valid_proxy_user "$u" || ! is_valid_proxy_hash "$p"; then
err "Некорректная bcrypt-запись пользователя в $USERS_FILE: $u"
return 1
fi
auth_blocks+=" ${u} ${p}"$'\n'
auth_count=$((auth_count+1))
done < <(get_active_user_hashes)
if [[ "$auth_count" -lt 1 ]]; then
local disabled_pass disabled_hash
disabled_pass=$(random_safe_token 32)
disabled_hash=$(hash_proxy_password "__disabled__" "$disabled_pass") || return 1
auth_blocks+=" __disabled__ ${disabled_hash}"$'\n'
auth_count=1
warn "Нет активных пользователей. Caddy proxy закрыт placeholder-auth."
fi
local caddy_upstream=""
if [[ "${WARP_PROXY_ENABLED:-0}" == "1" ]]; then
caddy_upstream=" upstream socks5://127.0.0.1:${WARP_PROXY_PORT:-$WARP_PROXY_PORT_DEFAULT}"$'\n'
fi
local caddy_protocols="h1 h2" xhttp_block="" caddy_runtime_sampling=""
local proxy_auth_error_block
proxy_auth_error_block=$(caddy_proxy_auth_error_block)
if [[ "${HYSTERIA_PORT:-8443}" == "443" ]]; then
caddy_protocols="h1 h2"
fi
if [[ "${XRAY_XHTTP_ENABLED:-0}" == "1" ]]; then
xhttp_block=$(cat <Practical notes on server administration, open source tooling, and building reliable systems. No fluff — just working code and real-world configs.
Every time I spin up a new VPS it gets thousands of SSH brute-force attempts within hours. Here's the exact sequence I run — from changing the SSH port and setting up Fail2Ban to configuring unattended security updates and locking down UFW.
Read article →Forget manually managing Let's Encrypt certificates. Caddy does it all — including HTTP/3 via QUIC — with a ten-line config.
RSA-4096 is not broken, but ED25519 is smaller, faster, and safer against side-channel attacks. Here's how to migrate without locking yourself out.
Cron is simple and it works. Systemd timers are more powerful. I compared both for a production automation task — here's what I found.
UFW is friendly but hides complexity. I cover rule ordering, default policies, logging levels, and the three mistakes that get people locked out of their own servers.
Not every project needs containers. A plain Ubuntu server with Caddy, systemd and a deploy script can run production workloads reliably with far less overhead.
$(hostname)
🕐 $(date '+%Y-%m-%d %H:%M:%S')
${safe_text}"
cat "$tmp"
rm -f "$tmp"
ok "HAProxy stats отправлены в Telegram"
}
cmd_haproxy_logs() {
hr
echo -e "${BOLD} HAProxy SNI logs${RESET}"
hr
if [[ -f "$HAPROXY_LOG_FILE" ]]; then
tail -n 80 "$HAPROXY_LOG_FILE" 2>/dev/null | sed -E 's/client=[^ ]+/client=hidden/g'
else
warn "Лог не найден: $HAPROXY_LOG_FILE"
journalctl -u haproxy -n 80 --no-pager 2>/dev/null || true
fi
hr
}
edge_routing_snapshot_file() {
local snapshot="$1" label="$2" path="$3"
if [[ -e "$path" || -L "$path" ]]; then
cp -a -- "$path" "$snapshot/$label"
else
: > "$snapshot/$label.absent"
fi
}
edge_routing_snapshot() {
local snapshot unit enabled active
snapshot=$(mktemp -d /tmp/yurich-edge-routing.XXXXXX) || return 1
chmod 700 "$snapshot"
edge_routing_snapshot_file "$snapshot" naive.conf "$CONFIG_FILE" || { rm -rf -- "$snapshot"; return 1; }
edge_routing_snapshot_file "$snapshot" Caddyfile "$CADDYFILE" || { rm -rf -- "$snapshot"; return 1; }
edge_routing_snapshot_file "$snapshot" xray.json "$XRAY_CONFIG" || { rm -rf -- "$snapshot"; return 1; }
edge_routing_snapshot_file "$snapshot" haproxy.cfg "$HAPROXY_CFG" || { rm -rf -- "$snapshot"; return 1; }
edge_routing_snapshot_file "$snapshot" haproxy.rsyslog "$HAPROXY_RSYSLOG_CONF" || { rm -rf -- "$snapshot"; return 1; }
edge_routing_snapshot_file "$snapshot" haproxy.logrotate "$HAPROXY_LOGROTATE_CONF" || { rm -rf -- "$snapshot"; return 1; }
edge_routing_snapshot_file "$snapshot" haproxy.sysctl "$HAPROXY_SYSCTL_CONF" || { rm -rf -- "$snapshot"; return 1; }
: > "$snapshot/services.state"
for unit in caddy.service haproxy.service xray.service; do
enabled="no"; active="no"
systemctl is-enabled --quiet "$unit" 2>/dev/null && enabled="yes"
systemctl is-active --quiet "$unit" 2>/dev/null && active="yes"
printf '%s|%s|%s\n' "$unit" "$enabled" "$active" >> "$snapshot/services.state"
done
printf '%s\n' "$snapshot"
}
edge_routing_restore_file() {
local snapshot="$1" label="$2" path="$3"
if [[ -f "$snapshot/$label.absent" ]]; then
rm -f -- "$path"
elif [[ -e "$snapshot/$label" || -L "$snapshot/$label" ]]; then
mkdir -p "$(dirname "$path")"
cp -a -- "$snapshot/$label" "$path"
fi
}
edge_routing_restore() {
local snapshot="$1" unit enabled active failed=0
[[ -n "$snapshot" && "$snapshot" == /tmp/yurich-edge-routing.* && -d "$snapshot" ]] || return 1
edge_routing_restore_file "$snapshot" naive.conf "$CONFIG_FILE" || failed=1
edge_routing_restore_file "$snapshot" Caddyfile "$CADDYFILE" || failed=1
edge_routing_restore_file "$snapshot" xray.json "$XRAY_CONFIG" || failed=1
edge_routing_restore_file "$snapshot" haproxy.cfg "$HAPROXY_CFG" || failed=1
edge_routing_restore_file "$snapshot" haproxy.rsyslog "$HAPROXY_RSYSLOG_CONF" || failed=1
edge_routing_restore_file "$snapshot" haproxy.logrotate "$HAPROXY_LOGROTATE_CONF" || failed=1
edge_routing_restore_file "$snapshot" haproxy.sysctl "$HAPROXY_SYSCTL_CONF" || failed=1
systemctl daemon-reload >/dev/null 2>&1 || true
while IFS='|' read -r unit enabled active; do
[[ -n "$unit" ]] || continue
if [[ "$enabled" == "yes" ]]; then systemctl enable "$unit" >/dev/null 2>&1 || failed=1
else systemctl disable "$unit" >/dev/null 2>&1 || true
fi
if [[ "$active" == "yes" ]]; then systemctl restart "$unit" >/dev/null 2>&1 || failed=1
else systemctl stop "$unit" >/dev/null 2>&1 || true
fi
done < "$snapshot/services.state"
rm -rf -- "$snapshot"
[[ "$failed" -eq 0 ]]
}
edge_routing_discard_snapshot() {
local snapshot="$1"
[[ -n "$snapshot" && "$snapshot" == /tmp/yurich-edge-routing.* ]] && rm -rf -- "$snapshot"
}
edge_routing_transition_failed() {
local snapshot="$1" message="$2"
err "$message"
if edge_routing_restore "$snapshot"; then
warn "Предыдущий режим 443 восстановлен"
else
err "Автоматический rollback режима 443 выполнен не полностью. Проверь Caddy/HAProxy/Xray вручную."
fi
return 1
}
apply_haproxy_sni_mux_runtime() {
local routing_snapshot
load_config
check_installed || { err "Сначала установи Yurich Panel"; return 1; }
if ! is_valid_domain "${DOMAIN:-}"; then
err "Домен не настроен или некорректен: ${DOMAIN:-}"
return 1
fi
ensure_haproxy_packages || return 1
routing_snapshot=$(edge_routing_snapshot) || { err "Не удалось создать rollback-снимок режима 443"; return 1; }
write_haproxy_logging_config || { edge_routing_transition_failed "$routing_snapshot" "Не удалось настроить HAProxy logging"; return 1; }
set_edge_routing_mode "haproxy" || { edge_routing_transition_failed "$routing_snapshot" "Не удалось выбрать HAProxy mode"; return 1; }
save_config || { edge_routing_transition_failed "$routing_snapshot" "Не удалось сохранить HAProxy mode"; return 1; }
info "Пересобираю Caddy для внутреннего TLS порта ${XRAY_CADDY_FALLBACK_PORT}"
rewrite_caddyfile_current || { edge_routing_transition_failed "$routing_snapshot" "Caddy fallback-конфиг не собран"; return 1; }
if ! systemctl reload caddy 2>/dev/null && ! systemctl restart caddy; then
err "Caddy не применил fallback-конфиг для HAProxy"
edge_routing_transition_failed "$routing_snapshot" "Caddy не применил fallback-конфиг для HAProxy"
return 1
fi
if [[ -x "$XRAY_BIN" && -s "$XRAY_USERS_FILE" ]]; then
info "Проверяю Xray Reality на TCP/${XRAY_REALITY_PORT:-$XRAY_REALITY_PORT_DEFAULT}"
write_xray_config || { edge_routing_transition_failed "$routing_snapshot" "Xray config не собран"; return 1; }
write_xray_service
systemctl restart xray || { edge_routing_transition_failed "$routing_snapshot" "Xray не перезапустился"; return 1; }
else
warn "Xray не установлен или нет пользователей. HAProxy применится, но Reality backend будет DOWN до настройки Xray."
fi
write_haproxy_sni_mux_config || { edge_routing_transition_failed "$routing_snapshot" "HAProxy config не собран"; return 1; }
systemctl enable haproxy --quiet || { edge_routing_transition_failed "$routing_snapshot" "HAProxy не включён"; return 1; }
if ! systemctl reload haproxy 2>/dev/null && ! systemctl restart haproxy; then
edge_routing_transition_failed "$routing_snapshot" "HAProxy не применил конфигурацию"
return 1
fi
sleep 1
if ! systemctl is-active --quiet haproxy; then
err "HAProxy не запустился"
journalctl -u haproxy -n 50 --no-pager
edge_routing_transition_failed "$routing_snapshot" "HAProxy не запустился"
return 1
fi
apply_xray_reality_firewall
edge_routing_discard_snapshot "$routing_snapshot"
ok "HAProxy SNI mux применён: ${DOMAIN}:443 -> Caddy, default SNI -> Xray Reality"
}
apply_caddy_only_runtime() {
local routing_snapshot
load_config
check_installed || { err "Сначала установи Yurich Panel"; return 1; }
routing_snapshot=$(edge_routing_snapshot) || { err "Не удалось создать rollback-снимок режима 443"; return 1; }
set_edge_routing_mode "caddy" || { edge_routing_transition_failed "$routing_snapshot" "Не удалось выбрать Caddy-only mode"; return 1; }
save_config || { edge_routing_transition_failed "$routing_snapshot" "Не удалось сохранить Caddy-only mode"; return 1; }
info "Останавливаю HAProxy, чтобы освободить TCP/443 для Caddy"
systemctl disable --now haproxy >/dev/null 2>&1 || true
systemctl stop haproxy >/dev/null 2>&1 || true
pkill -x haproxy >/dev/null 2>&1 || true
info "Пересобираю Caddyfile для прямого Caddy-only режима на 443"
rewrite_caddyfile_current || { edge_routing_transition_failed "$routing_snapshot" "Caddy-only конфиг не собран"; return 1; }
if ! systemctl reload caddy 2>/dev/null && ! systemctl restart caddy; then
err "Caddy не применил Caddy-only конфиг"
edge_routing_transition_failed "$routing_snapshot" "Caddy не применил Caddy-only конфиг"
return 1
fi
if [[ -x "$XRAY_BIN" && -s "$XRAY_USERS_FILE" ]]; then
info "Пересобираю Xray Reality для прямого TCP-порта ${XRAY_REALITY_PORT:-$XRAY_REALITY_PORT_DEFAULT}"
write_xray_config || { edge_routing_transition_failed "$routing_snapshot" "Xray config не собран"; return 1; }
write_xray_service
systemctl restart xray || { edge_routing_transition_failed "$routing_snapshot" "Xray не перезапустился"; return 1; }
fi
apply_xray_reality_firewall
edge_routing_discard_snapshot "$routing_snapshot"
ok "Caddy-only применён: Caddy держит 443, Reality использует отдельный TCP-порт"
}
refresh_haproxy_if_enabled() {
load_config
edge_routing_mode_is_haproxy || return 0
command -v haproxy >/dev/null 2>&1 || return 0
write_haproxy_sni_mux_config || return 1
systemctl reload haproxy 2>/dev/null || systemctl restart haproxy
}
cmd_edge_routing_mode() {
load_config
local mode="${1:-}"
if [[ -z "$mode" ]]; then
prompt_edge_routing_mode || return 1
mode="${EDGE_ROUTING_MODE:-caddy}"
else
set_edge_routing_mode "$mode" || return 1
fi
if [[ "$mode" == "haproxy" ]]; then
apply_haproxy_sni_mux_runtime || return 1
cmd_haproxy_status
else
apply_caddy_only_runtime || return 1
cmd_health_check
fi
}
cmd_haproxy_apply() {
load_config
check_installed || { err "Сначала установи Yurich Panel"; return 1; }
if ! is_valid_domain "${DOMAIN:-}"; then
err "Домен не настроен или некорректен: ${DOMAIN:-}"
return 1
fi
hr
echo -e "${BOLD} Применение HAProxy SNI mux${RESET}"
hr
apply_haproxy_sni_mux_runtime || return 1
cmd_haproxy_status
}
cmd_haproxy_menu() {
while true; do
load_config
hr
echo -e "${BOLD} Routing mode / HAProxy SNI mux${RESET}"
hr
echo -e " Текущий режим: ${CYAN}$(edge_routing_mode_label)${RESET}"
echo -e " ${BOLD}1)${RESET} Статус и маршруты"
echo -e " ${BOLD}2)${RESET} Применить / пересобрать SNI mux"
echo -e " ${BOLD}3)${RESET} Последние SNI-логи"
echo -e " ${BOLD}4)${RESET} Переключить на Caddy-only"
echo -e " ${BOLD}0)${RESET} Назад"
hr
echo -ne "${CYAN}Выбор: ${RESET}"
read -r choice
case "$choice" in
1) cmd_haproxy_status ;;
2) cmd_haproxy_apply ;;
3) cmd_haproxy_logs ;;
4) cmd_edge_routing_mode caddy ;;
0|"") return ;;
*) warn "Неверный выбор" ;;
esac
echo -ne "${DIM}Enter для продолжения...${RESET}"; read -r _
done
}
cmd_security_audit() {
load_config 2>/dev/null || true
local failed=0 warn_count=0 value owner perms tcp_ports udp_service_ports service service_hardening_failed
hr
echo -e "${BOLD} Security audit${RESET}"
hr
if command -v ufw >/dev/null 2>&1; then
if ufw status 2>/dev/null | grep -qi '^Status: active'; then
ok "UFW active"
else
err "UFW не active"
failed=$((failed + 1))
fi
else
warn "UFW не установлен"
warn_count=$((warn_count + 1))
fi
if command -v sshd >/dev/null 2>&1; then
value=$(sshd -T 2>/dev/null | awk '/^passwordauthentication /{print $2; exit}' || true)
[[ "$value" == "no" ]] && ok "SSH password login disabled" || { err "SSH passwordauthentication=${value:-unknown}"; failed=$((failed + 1)); }
value=$(sshd -T 2>/dev/null | awk '/^permitrootlogin /{print $2; exit}' || true)
case "$value" in
no|prohibit-password|without-password|forced-commands-only) ok "SSH root login restricted: ${value}" ;;
*) err "SSH permitrootlogin=${value:-unknown}"; failed=$((failed + 1)) ;;
esac
else
warn "sshd не найден"
warn_count=$((warn_count + 1))
fi
if systemctl is-active --quiet fail2ban 2>/dev/null; then
ok "Fail2Ban active"
else
warn "Fail2Ban не active"
warn_count=$((warn_count + 1))
fi
if systemctl is-active --quiet crowdsec 2>/dev/null; then
ok "CrowdSec active"
else
warn "CrowdSec не active"
warn_count=$((warn_count + 1))
fi
for service in auditd apparmor unattended-upgrades; do
if systemctl is-active --quiet "$service" 2>/dev/null; then
ok "${service}: active"
else
warn "${service}: не active"
warn_count=$((warn_count + 1))
fi
done
for service in caddy xray hysteria haproxy unbound; do
[[ "$(systemctl show -p LoadState --value "${service}.service" 2>/dev/null || true)" == "loaded" ]] || continue
service_hardening_failed=0
[[ "$(systemctl show -p NoNewPrivileges --value "${service}.service" 2>/dev/null || true)" == "yes" ]] || service_hardening_failed=1
[[ "$(systemctl show -p PrivateTmp --value "${service}.service" 2>/dev/null || true)" == "yes" ]] || service_hardening_failed=1
value=$(systemctl show -p ProtectSystem --value "${service}.service" 2>/dev/null || true)
[[ "$value" == "full" || "$value" == "strict" ]] || service_hardening_failed=1
if [[ "$service_hardening_failed" -eq 0 ]]; then
ok "${service}: systemd hardening enabled"
else
warn "${service}: systemd hardening incomplete"
warn_count=$((warn_count + 1))
fi
done
if [[ -f "$CONFIG_FILE" ]]; then
owner=$(stat -c '%U' "$CONFIG_FILE" 2>/dev/null || echo unknown)
perms=$(stat -c '%a' "$CONFIG_FILE" 2>/dev/null || echo 000)
[[ "$owner" == "root" && "$perms" == "600" ]] && ok "$CONFIG_FILE permissions OK" || { err "$CONFIG_FILE owner=$owner perms=$perms"; failed=$((failed + 1)); }
else
err "$CONFIG_FILE не найден"
failed=$((failed + 1))
fi
tcp_ports=$(ss -H -ltnp 2>/dev/null | awk '{print $4}' | sed -E 's/.*:([0-9]+)$/\1/' | sort -n | uniq | tr '\n' ' ' || true)
udp_service_ports=$(ss -H -lunp 2>/dev/null | awk '$0 !~ /xray/ {print $4}' | sed -E 's/.*:([0-9]+)$/\1/' | sort -n | uniq | tr '\n' ' ' || true)
echo "TCP listen ports: ${tcp_ports:-n/a}"
echo "UDP service ports: ${udp_service_ports:-n/a}"
if ss -H -ltnp 2>/dev/null | awk '
{
port=$4
sub(/.*:/, "", port)
if (port ~ /^(23|25|3306|5432|6379|9200)$/) found=1
}
END { exit(found ? 0 : 1) }
'; then
err "Найдены потенциально лишние публичные порты"
failed=$((failed + 1))
else
ok "Критичных лишних портов не видно"
fi
if ss -H -lntu 2>/dev/null | awk '
{
endpoint=$5
port=endpoint
sub(/.*:/, "", port)
host=endpoint
sub(/:[^:]*$/, "", host)
gsub(/^\[|\]$/, "", host)
if (port == "53" && host !~ /^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|::1$)/) found=1
}
END { exit(found ? 0 : 1) }
'; then
err "DNS/53 слушает wildcard или публичный адрес"
failed=$((failed + 1))
else
ok "DNS/53 доступен только на loopback/private адресах"
fi
if [[ -f "${WEBROOT}/robots.txt" ]] && grep -qi 'Disallow: /s/' "${WEBROOT}/robots.txt" 2>/dev/null; then
ok "Subscription pages закрыты от индексации robots.txt"
else
warn "robots.txt не закрывает /s/"
warn_count=$((warn_count + 1))
fi
local legacy_credentials
legacy_credentials=$(credential_plaintext_count)
if [[ "$legacy_credentials" -eq 0 ]]; then
ok "Proxy user store: plaintext credentials не найдены"
else
warn "Proxy user store: ${legacy_credentials} legacy plaintext записей; запусти credentials-migrate"
warn_count=$((warn_count + 1))
fi
if [[ -s "$CREDENTIALS_PRIVATE_KEY" ]]; then
[[ "$(stat -c '%a' "$CREDENTIALS_DIR" 2>/dev/null || echo 0)" == "700" ]] \
&& ok "Credential vault directory: mode 700" \
|| { err "Credential vault directory имеет небезопасные права"; failed=$((failed + 1)); }
[[ "$(stat -c '%a' "$CREDENTIALS_PRIVATE_KEY" 2>/dev/null || echo 0)" == "600" ]] \
&& ok "Credential vault private key: mode 600" \
|| { err "Credential vault private key имеет небезопасные права"; failed=$((failed + 1)); }
[[ -s "$USERS_SECRETS_FILE" ]] \
&& ok "Encrypted credential vault: доступен" \
|| { err "Encrypted credential vault отсутствует"; failed=$((failed + 1)); }
if [[ "$legacy_credentials" -eq 0 ]]; then
credential_store_integrity_check \
&& ok "Credential vault integrity: bcrypt/keypair/ciphertext OK" \
|| failed=$((failed + 1))
fi
elif [[ "$(get_users | wc -l)" -gt 0 && "$legacy_credentials" -eq 0 ]]; then
err "Credential vault key отсутствует при bcrypt users.conf"
failed=$((failed + 1))
fi
if grep -Eq '^[[:space:]]+basic_auth[[:space:]]+[A-Za-z0-9_-]{2,32}[[:space:]]+[A-Za-z0-9_-]{8,64}[[:space:]]*$' "$CADDYFILE" 2>/dev/null; then
err "Caddyfile содержит legacy plaintext proxy auth"
failed=$((failed + 1))
else
ok "Caddy auth config: bcrypt/no plaintext"
fi
if grep -q 'type: userpass' "$HYSTERIA_CONFIG" 2>/dev/null; then
warn "Hysteria использует legacy userpass; запусти credentials-migrate"
warn_count=$((warn_count + 1))
elif [[ -f "$HYSTERIA_CONFIG" ]]; then
grep -q 'type: command' "$HYSTERIA_CONFIG" \
&& ok "Hysteria auth: bcrypt verifier" \
|| { warn "Hysteria auth backend не распознан"; warn_count=$((warn_count + 1)); }
fi
if [[ -f "$HYSTERIA_CONFIG" ]]; then
if hysteria_tls_layout_needs_repair; then
err "Hysteria TLS sandbox несовместим с текущим cert path; запусти hysteria-repair"
failed=$((failed + 1))
else
ok "Hysteria TLS: изолирован, mode 700/600, sync timer enabled"
fi
fi
[[ -d "$BACKUP_DIR" ]] && ok "Backup dir exists: $BACKUP_DIR" || { warn "Backup dir отсутствует: $BACKUP_DIR"; warn_count=$((warn_count + 1)); }
if find "$BACKUP_DIR" -maxdepth 1 -type f -name 'naiveproxy-full-*.tar.gz.enc' -mtime -7 -print -quit 2>/dev/null | grep -q .; then
ok "Recent encrypted backup: найден"
else
warn "Recent encrypted backup младше 7 дней не найден"
warn_count=$((warn_count + 1))
fi
if find "$SUBS_WEB_DIR" -maxdepth 1 -type d -name '.*.build.*' -mmin +60 -print -quit 2>/dev/null | grep -q .; then
warn "Найдены старые staging-каталоги подписок"
warn_count=$((warn_count + 1))
else
ok "Subscription staging: старых каталогов нет"
fi
[[ -f "$PROTOCOL_BENCHMARK_CRON" ]] && ok "Protocol benchmark cron installed" || warn "Protocol benchmark cron не установлен"
[[ -f "$EXPIRY_NOTIFY_CRON" ]] && ok "Expiry notify cron installed" || warn "Expiry notify cron не установлен"
hr
echo "security audit: failed=${failed} warnings=${warn_count}"
[[ "$failed" -eq 0 ]]
}
cmd_backup_encrypted() {
load_config 2>/dev/null || true
command -v openssl >/dev/null 2>&1 || { err "openssl не найден"; return 1; }
command -v tar >/dev/null 2>&1 || { err "tar не найден"; return 1; }
mkdir -p "$BACKUP_DIR"
chmod 700 "$BACKUP_DIR"
local pass pass_file ts backup_file backup_tmp item includes=()
if [[ -n "${NAIVEPROXY_BACKUP_PASSPHRASE:-}" ]]; then
pass="$NAIVEPROXY_BACKUP_PASSPHRASE"
else
echo -ne "${CYAN}Пароль для encrypted backup: ${RESET}"
read -r -s pass
echo
fi
[[ -n "$pass" ]] || { err "Пароль пустой"; return 1; }
for item in "$CONFIG_DIR" "$CADDYFILE" "$CADDY_SERVICE" "$XRAY_CONFIG_DIR" "$XRAY_SERVICE" "$HYSTERIA_SERVICE" "$SUBS_WEB_DIR" "$PRIVATE_WEB_DIR"; do
[[ -e "$item" ]] && includes+=("$item")
done
[[ "${#includes[@]}" -gt 0 ]] || { err "Нечего бэкапить"; return 1; }
pass_file=$(mktemp /tmp/naiveproxy_backup_pass_XXXXXX)
chmod 600 "$pass_file"
printf '%s' "$pass" > "$pass_file"
ts=$(date +%Y%m%d_%H%M%S)
backup_file="$BACKUP_DIR/naiveproxy-full-${ts}.tar.gz.enc"
backup_tmp=$(mktemp "/var/tmp/naiveproxy-full-${ts}.XXXXXX.tar.gz.enc") || { rm -f "$pass_file"; return 1; }
chmod 600 "$backup_tmp"
if tar --exclude="${BACKUP_DIR#/}" --exclude="${EXPORT_DIR#/}" -czf - "${includes[@]}" 2>/dev/null \
| openssl enc -aes-256-cbc -pbkdf2 -salt -out "$backup_tmp" -pass "file:$pass_file" \
&& install -o root -g root -m 600 "$backup_tmp" "$backup_file"; then
rm -f "$backup_tmp"
ok "Encrypted backup создан: $backup_file"
else
rm -f "$backup_tmp" "$backup_file" 2>/dev/null || true
err "Encrypted backup не создан"
rm -f "$pass_file"
return 1
fi
rm -f "$pass_file"
}
cmd_export_state() {
mkdir -p "$EXPORT_DIR"
chmod 700 "$EXPORT_DIR"
local ts out items=()
ts=$(date +%Y%m%d_%H%M%S)
out="$EXPORT_DIR/naiveproxy-state-${ts}.tar.gz"
for item in naive.conf users.conf credentials users.d subscriptions subscription-aliases.conf xray-users.conf xray-compat-users.conf xray-users.disabled users.disabled bridge.conf nodes.conf; do
[[ -e "$CONFIG_DIR/$item" ]] && items+=("$item")
done
[[ "${#items[@]}" -gt 0 ]] || { err "Нет данных для export"; return 1; }
tar -C "$CONFIG_DIR" -czf "$out" "${items[@]}"
chmod 600 "$out"
ok "Export создан: $out"
}
import_shell_word_is_safe() {
local word="${1-}" inner char
local i escaped=0
[[ -z "$word" || "$word" == "''" ]] && return 0
if [[ "${word:0:2}" == "\$'" && "${word: -1}" == "'" && ${#word} -ge 3 ]]; then
inner="${word:2:${#word}-3}"
for ((i = 0; i < ${#inner}; i++)); do
char="${inner:i:1}"
if [[ "$escaped" -eq 1 ]]; then
escaped=0
continue
fi
if [[ "$char" == '\\' ]]; then
escaped=1
elif [[ "$char" == "'" ]]; then
return 1
fi
done
[[ "$escaped" -eq 0 ]]
return
fi
for ((i = 0; i < ${#word}; i++)); do
char="${word:i:1}"
if [[ "$escaped" -eq 1 ]]; then
escaped=0
continue
fi
if [[ "$char" == '\\' ]]; then
escaped=1
continue
fi
case "$char" in
[[:space:]]|'$'|'`'|"'"|'"'|';'|'&'|'|'|'('|')'|'<'|'>') return 1 ;;
esac
done
[[ "$escaped" -eq 0 ]]
}
is_valid_import_chat_id_list() {
local raw="${1:-}" item count=0
local -a items=()
[[ -z "$raw" ]] && return 0
raw="${raw// /}"
[[ "$raw" != ,* && "$raw" != *, && "$raw" != *,,* ]] || return 1
IFS=',' read -r -a items <<< "$raw"
for item in "${items[@]}"; do
count=$((count + 1))
(( count <= 32 )) || return 1
[[ "$item" =~ ^[0-9]{5,20}$ ]] || return 1
done
(( count > 0 ))
}
is_valid_sales_plans_value() {
local raw="${1:-}" item term price normalized count=0
local -A seen_terms=()
local -a items=()
[[ -n "$raw" ]] || return 1
[[ "$raw" != ,* && "$raw" != *, && "$raw" != *,,* ]] || return 1
IFS=',' read -r -a items <<< "$raw"
for item in "${items[@]}"; do
count=$((count + 1))
(( count <= 24 )) || return 1
[[ "$item" =~ ^([^:]+):([^:]+)$ ]] || return 1
term="${BASH_REMATCH[1]}"
price="${BASH_REMATCH[2]}"
normalized=$(normalize_user_term "$term" 2>/dev/null || true)
[[ -n "$normalized" && -z "${seen_terms[$normalized]+x}" ]] || return 1
is_canonical_uint_in_range "$price" 1 1000000000 || return 1
seen_terms[$normalized]=1
done
(( count > 0 ))
}
sanitize_imported_shell_data_file() {
local source_file="$1" output_file="$2" mode="${3:-naive}"
local max_size=1048576 file_size allowed_keys line key value line_no=0 safe_tmp import_value dom
local -a imported_keys=()
local -A seen_keys=()
[[ -f "$source_file" && ! -L "$source_file" ]] || {
err "Импортируемый data-файл не является обычным файлом: $source_file"
return 1
}
file_size=$(stat -c '%s' "$source_file" 2>/dev/null || echo 0)
[[ "$file_size" =~ ^[0-9]+$ && "$file_size" -le "$max_size" ]] || {
err "Импортируемый data-файл слишком большой: $source_file"
return 1
}
case "$mode" in
naive)
allowed_keys=$(declare -f save_config | sed -nE "s/.*printf '([A-Z][A-Z0-9_]*)=%q\\\\n'.*/\\1/p")
;;
bridge)
allowed_keys=$'BRIDGE_ENABLED\nBRIDGE_NAME\nBRIDGE_ENTRY_PROTOCOL\nBRIDGE_EXIT_PROTOCOL\nBRIDGE_EXIT_URI\nUPDATED_AT'
;;
*)
err "Неизвестный тип import data-файла: $mode"
return 1
;;
esac
[[ -n "$allowed_keys" ]] || { err "Не удалось построить allowlist import-конфига"; return 1; }
safe_tmp="${output_file}.tmp"
: > "$safe_tmp"
chmod 600 "$safe_tmp"
while IFS= read -r line || [[ -n "$line" ]]; do
line_no=$((line_no + 1))
line="${line%$'\r'}"
[[ ${#line} -le 65536 ]] || { err "Слишком длинная строка ${line_no} в $source_file"; rm -f "$safe_tmp"; return 1; }
[[ "$line" =~ ^[[:space:]]*(#|$) ]] && continue
if [[ ! "$line" =~ ^([A-Z][A-Z0-9_]*)=(.*)$ ]]; then
err "Небезопасная строка ${line_no} в import-конфиге"
rm -f "$safe_tmp"
return 1
fi
key="${BASH_REMATCH[1]}"
value="${BASH_REMATCH[2]}"
if ! grep -Fxq -- "$key" <<< "$allowed_keys"; then
warn "Import: неизвестный ключ $key пропущен"
continue
fi
if [[ -n "${seen_keys[$key]+x}" ]]; then
err "Import: ключ $key указан несколько раз"
rm -f "$safe_tmp"
return 1
fi
if ! import_shell_word_is_safe "$value"; then
err "Import: небезопасное значение ключа $key"
rm -f "$safe_tmp"
return 1
fi
seen_keys[$key]=1
imported_keys+=("$key")
printf '%s=%s\n' "$key" "$value" >> "$safe_tmp"
done < "$source_file"
[[ -s "$safe_tmp" ]] || { err "Import data-файл не содержит поддерживаемых ключей"; rm -f "$safe_tmp"; return 1; }
mv -f "$safe_tmp" "$output_file"
chmod 600 "$output_file"
if ! (
local bool_key port_key range_spec min_value max_value cidr_item hop_start hop_end
local -a cidr_items=()
for key in "${imported_keys[@]}"; do unset "$key"; done
# Файл уже прошёл строгую проверку shell-слов и allowlist ключей.
# shellcheck source=/dev/null
source "$output_file"
for key in "${imported_keys[@]}"; do
import_value="${!key-}"
if [[ "$import_value" == *$'\n'* || "$import_value" == *$'\r'* || "$import_value" == *$'\t'* ]]; then
err "Import: управляющие символы запрещены в $key"
exit 1
fi
done
if [[ "$mode" == "naive" ]]; then
for bool_key in \
SUBSCRIPTION_LOCAL_ENABLED SUBSCRIPTION_XHTTP_NODE_EXCLUSIVE SUBSCRIPTION_XHTTP_MAIN_ENABLED \
SUBSCRIPTION_NODE_PREFETCH_ENABLED SUBSCRIPTION_ATOMIC_PUBLISH \
BROWSER_PROXY_COMPAT BROWSER_PROXY_SEND_PROXY_V2 \
PROTOCOL_BENCHMARK_RECOVERY_ALERT PROTOCOL_MONITOR_RECOVERY_ALERT DNS_MONITOR_RECOVERY_ALERT HYSTERIA_ENABLED \
HYSTERIA_WARP_ENABLED HYSTERIA_PORT_HOP_ENABLED UNBOUND_ENABLED UNBOUND_ADBLOCK \
UNBOUND_MANAGED_GATEWAY UNBOUND_VPN_ENABLED UNBOUND_FILTER_ENABLED WARP_PROXY_ENABLED \
XRAY_WARP_ENABLED DEVICE_LIMIT_ENABLED XRAY_ENABLED XRAY_FALLBACK_ENABLED \
XRAY_REALITY_ENABLED XRAY_REALITY_SNI_MUX_ENABLED XRAY_XHTTP_ENABLED \
XRAY_MOBILE_ALT_ENABLED XRAY_GITHUB_TEST_ENABLED XRAY_ZAPRET_ENABLED BRIDGE_ENABLED; do
[[ -n "${seen_keys[$bool_key]+x}" ]] || continue
import_value="${!bool_key}"
[[ "$import_value" =~ ^[01]$ ]] || { err "Import: $bool_key должен быть 0 или 1"; exit 1; }
done
for port_key in HYSTERIA_PORT WARP_PROXY_PORT BROWSER_PROXY_BACKEND_PORT XRAY_REALITY_PORT XRAY_REALITY_PUBLIC_PORT \
XRAY_MKCP_PORT XRAY_VISION_PORT XRAY_XHTTP_PORT XRAY_WS_PORT XRAY_HTTPUPGRADE_PORT \
XRAY_CADDY_FALLBACK_PORT XRAY_GITHUB_TEST_PORT; do
[[ -n "${seen_keys[$port_key]+x}" ]] || continue
import_value="${!port_key}"
is_valid_port "$import_value" || { err "Import: некорректный порт $port_key"; exit 1; }
done
for range_spec in \
PROTOCOL_BENCHMARK_ROUNDS:1:20 PROTOCOL_BENCHMARK_MAX_AVG_MS:100:600000 \
PROTOCOL_BENCHMARK_MONITOR_MIN_ROUNDS:1:20 PROTOCOL_BENCHMARK_SLOW_MIN_HITS:1:20 \
PROTOCOL_BENCHMARK_WARN_MIN_OK_HITS:1:20 PROTOCOL_BENCHMARK_ALERT_REPEAT:1:100 \
PROTOCOL_BENCHMARK_HARD_ALERT_REPEAT:1:100 PROTOCOL_BENCHMARK_ALERT_COOLDOWN_MINUTES:1:10080 \
PROTOCOL_MONITOR_ALERT_REPEAT:1:100 PROTOCOL_MONITOR_ALERT_COOLDOWN_MINUTES:1:10080 \
DNS_MONITOR_ALERT_REPEAT:1:100 DNS_MONITOR_ALERT_COOLDOWN_MINUTES:1:10080 \
SALES_BOT_CAPTCHA_TTL_SECONDS:300:2592000 SALES_BOT_ORDER_MIN_INTERVAL_SECONDS:10:3600 \
SALES_BOT_MAX_PENDING_PER_CHAT:1:10 SALES_BOT_MAX_ORDER_FILES:100:50000 \
UNBOUND_FILTER_MAX_DOMAINS:1000:500000 DEVICE_LIMIT:1:50 DEVICE_WINDOW_HOURS:1:168 \
EXPIRED_DELETE_GRACE_DAYS:0:3650; do
IFS=':' read -r key min_value max_value <<< "$range_spec"
[[ -n "${seen_keys[$key]+x}" ]] || continue
import_value="${!key}"
is_canonical_uint_in_range "$import_value" "$min_value" "$max_value" \
|| { err "Import: $key вне безопасного диапазона $min_value..$max_value"; exit 1; }
done
if [[ -n "${seen_keys[LANG_UI]+x}" ]]; then
[[ "${LANG_UI}" == "ru" || "${LANG_UI}" == "en" ]] || { err "Import: некорректный LANG_UI"; exit 1; }
fi
if [[ -n "${seen_keys[SUBSCRIPTION_LOCAL_POSITION]+x}" ]]; then
[[ "${SUBSCRIPTION_LOCAL_POSITION}" == "first" || "${SUBSCRIPTION_LOCAL_POSITION}" == "last" ]] || { err "Import: некорректный SUBSCRIPTION_LOCAL_POSITION"; exit 1; }
fi
if [[ -n "${seen_keys[EDGE_ROUTING_MODE]+x}" ]]; then
[[ "${EDGE_ROUTING_MODE}" == "caddy" || "${EDGE_ROUTING_MODE}" == "haproxy" ]] || { err "Import: некорректный EDGE_ROUTING_MODE"; exit 1; }
fi
if [[ -n "${seen_keys[UNBOUND_MODE]+x}" ]]; then
[[ "${UNBOUND_MODE}" == "recursive" || "${UNBOUND_MODE}" == "forward" ]] || { err "Import: некорректный UNBOUND_MODE"; exit 1; }
fi
if [[ -n "${seen_keys[WARP_MODE]+x}" ]]; then
case "${WARP_MODE}" in off|proxy|warp|warp+doh) ;; *) err "Import: некорректный WARP_MODE"; exit 1 ;; esac
fi
if [[ -n "${seen_keys[WARP_PROTOCOL]+x}" ]]; then
case "${WARP_PROTOCOL}" in auto|MASQUE|WireGuard) ;; *) err "Import: некорректный WARP_PROTOCOL"; exit 1 ;; esac
fi
if [[ -n "${seen_keys[DEVICE_LIMIT_MODE]+x}" ]]; then
case "${DEVICE_LIMIT_MODE}" in alert|lock-user) ;; *) err "Import: некорректный DEVICE_LIMIT_MODE"; exit 1 ;; esac
fi
if [[ -n "${seen_keys[PROTOCOL_BENCHMARK_USER]+x}" && -n "${PROTOCOL_BENCHMARK_USER}" ]]; then
is_valid_proxy_user "${PROTOCOL_BENCHMARK_USER}" || { err "Import: некорректный PROTOCOL_BENCHMARK_USER"; exit 1; }
fi
if [[ -n "${seen_keys[TG_ADMINS]+x}" ]]; then
is_valid_import_chat_id_list "${TG_ADMINS}" || { err "Import: некорректный TG_ADMINS"; exit 1; }
fi
if [[ -n "${seen_keys[SALES_BOT_ADMINS]+x}" ]]; then
is_valid_import_chat_id_list "${SALES_BOT_ADMINS}" || { err "Import: некорректный SALES_BOT_ADMINS"; exit 1; }
fi
if [[ -n "${seen_keys[SALES_BOT_PLANS]+x}" ]]; then
is_valid_sales_plans_value "${SALES_BOT_PLANS}" || { err "Import: некорректный SALES_BOT_PLANS"; exit 1; }
fi
if [[ -n "${seen_keys[SALES_BOT_CURRENCY]+x}" ]]; then
[[ "${SALES_BOT_CURRENCY}" =~ ^[A-Z]{3,8}$ ]] || { err "Import: некорректный SALES_BOT_CURRENCY"; exit 1; }
fi
if [[ -n "${seen_keys[HYSTERIA_PORT_HOP_PORTS]+x}" ]]; then
[[ "${HYSTERIA_PORT_HOP_PORTS}" =~ ^([1-9][0-9]{0,4})-([1-9][0-9]{0,4})$ ]] || { err "Import: некорректный HYSTERIA_PORT_HOP_PORTS"; exit 1; }
hop_start="${BASH_REMATCH[1]}"; hop_end="${BASH_REMATCH[2]}"
is_valid_local_proxy_port "$hop_start" && is_valid_local_proxy_port "$hop_end" \
&& (( 10#$hop_start < 10#$hop_end && 10#$hop_end - 10#$hop_start <= 1000 )) \
|| { err "Import: небезопасный диапазон Hysteria port hopping"; exit 1; }
fi
if [[ -n "${seen_keys[UNBOUND_GATEWAY_IP]+x}" && -n "${UNBOUND_GATEWAY_IP}" ]]; then
is_private_vpn_ipv4 "${UNBOUND_GATEWAY_IP}" || { err "Import: UNBOUND_GATEWAY_IP должен быть private/CGNAT адресом"; exit 1; }
fi
if [[ -n "${seen_keys[UNBOUND_VPN_CIDRS]+x}" ]]; then
normalize_cidr_list "${UNBOUND_VPN_CIDRS}" >/dev/null || { err "Import: некорректный UNBOUND_VPN_CIDRS"; exit 1; }
fi
if [[ -n "${seen_keys[WARP_SSH_ALLOW_CIDRS]+x}" && -n "${WARP_SSH_ALLOW_CIDRS}" ]]; then
read -r -a cidr_items <<< "${WARP_SSH_ALLOW_CIDRS//,/ }"
(( ${#cidr_items[@]} <= 32 )) || { err "Import: слишком много WARP SSH CIDR"; exit 1; }
for cidr_item in "${cidr_items[@]}"; do
is_valid_cidr4 "$cidr_item" || { err "Import: некорректный WARP SSH CIDR"; exit 1; }
is_canonical_uint_in_range "${cidr_item#*/}" 8 32 || { err "Import: WARP SSH CIDR шире /8 запрещён"; exit 1; }
done
fi
if [[ -n "${seen_keys[SUBSCRIPTION_HTTP_NODE_SOURCES]+x}" ]]; then
subscription_http_node_sources_is_valid "${SUBSCRIPTION_HTTP_NODE_SOURCES}" \
|| { err "Import: некорректный SUBSCRIPTION_HTTP_NODE_SOURCES"; exit 1; }
fi
if [[ -n "${DOMAIN:-}" ]] && ! is_valid_domain "$DOMAIN"; then err "Import: некорректный DOMAIN"; exit 1; fi
if [[ -n "${SUBSCRIPTION_DOMAIN:-}" ]] && ! is_valid_domain "$SUBSCRIPTION_DOMAIN"; then err "Import: некорректный SUBSCRIPTION_DOMAIN"; exit 1; fi
if [[ -n "${BROWSER_PROXY_SNI_DOMAIN:-}" ]] && ! is_valid_domain "$BROWSER_PROXY_SNI_DOMAIN"; then err "Import: некорректный BROWSER_PROXY_SNI_DOMAIN"; exit 1; fi
if [[ -n "${DOMAINS:-}" ]]; then
while IFS= read -r dom; do
dom="${dom//[[:space:]]/}"
[[ -z "$dom" ]] && continue
is_valid_domain "$dom" || { err "Import: некорректный домен $dom"; exit 1; }
done < <(printf '%s\n' "$DOMAINS" | tr ',' '\n')
fi
[[ -z "${TG_TOKEN:-}" || "$TG_TOKEN" =~ ^[0-9]+:[A-Za-z0-9_-]{20,}$ ]] || { err "Import: некорректный TG_TOKEN"; exit 1; }
[[ -z "${SALES_BOT_TOKEN:-}" || "$SALES_BOT_TOKEN" =~ ^[0-9]+:[A-Za-z0-9_-]{20,}$ ]] || { err "Import: некорректный SALES_BOT_TOKEN"; exit 1; }
[[ -z "${TG_CHAT_ID:-}" || "$TG_CHAT_ID" =~ ^-?[0-9]{5,20}$ ]] || { err "Import: некорректный TG_CHAT_ID"; exit 1; }
[[ -z "${SALES_BOT_ADMIN_ID:-}" || "$SALES_BOT_ADMIN_ID" =~ ^-?[0-9]{5,20}$ ]] || { err "Import: некорректный SALES_BOT_ADMIN_ID"; exit 1; }
[[ -z "${CADDY_VERSION_PIN:-}" || "$CADDY_VERSION_PIN" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || { err "Import: некорректный CADDY_VERSION_PIN"; exit 1; }
[[ -z "${XCADDY_VERSION_PIN:-}" || "$XCADDY_VERSION_PIN" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || { err "Import: некорректный XCADDY_VERSION_PIN"; exit 1; }
[[ -z "${FORWARDPROXY_REF_PIN:-}" || "$FORWARDPROXY_REF_PIN" =~ ^[a-fA-F0-9]{40}$ ]] || { err "Import: FORWARDPROXY_REF_PIN должен быть полным commit SHA"; exit 1; }
[[ -z "${XRAY_VERSION_PIN:-}" || "$XRAY_VERSION_PIN" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || { err "Import: некорректный XRAY_VERSION_PIN"; exit 1; }
[[ -z "${HYSTERIA_VERSION_PIN:-}" || "$HYSTERIA_VERSION_PIN" =~ ^app/v[0-9]+\.[0-9]+\.[0-9]+$ ]] || { err "Import: некорректный HYSTERIA_VERSION_PIN"; exit 1; }
[[ -z "${PROTOCOL_BENCHMARK_LOG:-}" || "$PROTOCOL_BENCHMARK_LOG" == "$PROTOCOL_BENCHMARK_LOG_DEFAULT" ]] || { err "Import: PROTOCOL_BENCHMARK_LOG должен использовать управляемый путь"; exit 1; }
[[ -z "${SUBSCRIPTION_REBUILD_JOBS:-}" ]] || is_canonical_uint_in_range "$SUBSCRIPTION_REBUILD_JOBS" 0 8 || { err "Import: SUBSCRIPTION_REBUILD_JOBS должен быть от 0 до 8"; exit 1; }
[[ -z "${PROTOCOL_BENCHMARK_ALERT_STATE:-}" || "$PROTOCOL_BENCHMARK_ALERT_STATE" == "$CONFIG_DIR/protocol-benchmark-alert.state" ]] || { err "Import: некорректный PROTOCOL_BENCHMARK_ALERT_STATE"; exit 1; }
[[ -z "${PROTOCOL_MONITOR_ALERT_STATE:-}" || "$PROTOCOL_MONITOR_ALERT_STATE" == "$CONFIG_DIR/protocol-health-alert.state" ]] || { err "Import: некорректный PROTOCOL_MONITOR_ALERT_STATE"; exit 1; }
import_path_is_within "${SALES_BOT_PAYMENT_QR_PATH:-$SALES_BOT_PAYMENT_QR_PATH_DEFAULT}" "$SALES_BOT_DIR" || { err "Import: QR оплаты должен находиться в $SALES_BOT_DIR"; exit 1; }
import_path_is_within "${SALES_BOT_WELCOME_ANIMATION_PATH:-$SALES_BOT_WELCOME_ANIMATION_PATH_DEFAULT}" "$SALES_BOT_DIR" || { err "Import: welcome animation должна находиться в $SALES_BOT_DIR"; exit 1; }
import_path_is_within "${SALES_BOT_WELCOME_IMAGE_PATH:-$SALES_BOT_WELCOME_IMAGE_PATH_DEFAULT}" "$SALES_BOT_DIR" || { err "Import: welcome image должна находиться в $SALES_BOT_DIR"; exit 1; }
[[ -z "${XRAY_ZAPRET_DAT:-}" || "$XRAY_ZAPRET_DAT" == "$XRAY_ZAPRET_DAT_DEFAULT" ]] || { err "Import: XRAY_ZAPRET_DAT должен использовать управляемый путь"; exit 1; }
import_https_url_list_is_safe "${XRAY_ZAPRET_URL:-}" || { err "Import: XRAY_ZAPRET_URL должен быть безопасным HTTPS URL"; exit 1; }
import_https_url_list_is_safe "${UNBOUND_FILTER_URLS:-}" || { err "Import: UNBOUND_FILTER_URLS содержит небезопасный URL"; exit 1; }
else
[[ "${BRIDGE_ENABLED:-0}" =~ ^[01]$ ]] || { err "Import: некорректный BRIDGE_ENABLED"; exit 1; }
[[ -z "${BRIDGE_EXIT_URI:-}" || "$BRIDGE_EXIT_URI" =~ ^(vless|trojan|hysteria2|hy2|socks|socks5|http|https):// ]] || { err "Import: некорректный BRIDGE_EXIT_URI"; exit 1; }
fi
); then
rm -f "$output_file"
return 1
fi
}
import_path_is_within() {
local path="$1" base="$2" normalized normalized_base
[[ "$path" == /* && "$base" == /* ]] || return 1
normalized=$(readlink -m -- "$path" 2>/dev/null) || return 1
normalized_base=$(readlink -m -- "$base" 2>/dev/null) || return 1
[[ "$normalized" == "$normalized_base" || "$normalized" == "$normalized_base"/* ]]
}
import_https_url_list_is_safe() {
local raw="${1:-}" url count=0 remainder authority host port
[[ -z "$raw" ]] && return 0
for url in $raw; do
count=$((count + 1))
(( count <= 16 )) || return 1
[[ "$url" == https://* && "$url" != *"@"* && "$url" != *\\* ]] || return 1
[[ "$url" != *$'\r'* && "$url" != *$'\n'* && "$url" != *$'\t'* ]] || return 1
remainder="${url#https://}"
[[ "$remainder" == */* ]] || return 1
authority="${remainder%%/*}"
[[ -n "$authority" ]] || return 1
if [[ "$authority" == *:* ]]; then
host="${authority%:*}"
port="${authority##*:}"
is_valid_port "$port" || return 1
else
host="$authority"
fi
is_valid_domain "$host" || return 1
done
}
sanitize_imported_colon_file() {
local source_file="$1" output_file="$2" mode="$3"
local line record user secret extra count=0 tmp
[[ -f "$source_file" && ! -L "$source_file" ]] || return 1
[[ "$(stat -c '%s' "$source_file" 2>/dev/null || echo 0)" -le 1048576 ]] || { err "Import: слишком большой credentials-файл"; return 1; }
tmp="${output_file}.tmp"
: > "$tmp"
chmod 600 "$tmp"
while IFS= read -r line || [[ -n "$line" ]]; do
line="${line%$'\r'}"
[[ "$line" =~ ^[[:space:]]*(#|$) ]] && continue
count=$((count + 1))
(( count <= 10000 )) || { err "Import: слишком много credentials-записей"; rm -f "$tmp"; return 1; }
record="${line%%$'\t'#*}"
record="${record%% #*}"
IFS=':' read -r user secret extra <<< "$record"
if ! is_valid_proxy_user "$user" || [[ -n "$extra" ]]; then
err "Import: некорректная credentials-запись для $user"
rm -f "$tmp"
return 1
fi
case "$mode" in
proxy) { is_valid_proxy_pass "$secret" || is_valid_proxy_hash "$secret"; } || { err "Import: некорректный proxy credential для $user"; rm -f "$tmp"; return 1; } ;;
xray) is_valid_xray_uuid "$secret" || { err "Import: некорректный Xray UUID для $user"; rm -f "$tmp"; return 1; } ;;
*) rm -f "$tmp"; return 1 ;;
esac
printf '%s:%s\n' "$user" "$secret" >> "$tmp"
done < "$source_file"
install -m 600 "$tmp" "$output_file"
rm -f "$tmp"
}
sanitize_imported_nodes_file() {
local source_file="$1" output_file="$2" line name count=0 tmp
local -A seen=()
[[ -f "$source_file" && ! -L "$source_file" ]] || return 1
[[ "$(stat -c '%s' "$source_file" 2>/dev/null || echo 0)" -le 1048576 ]] || { err "Import: nodes.conf слишком большой"; return 1; }
tmp="${output_file}.tmp"
{
echo "# Yurich Panel nodes"
echo "# format: name|host|ssh_port|ssh_user|domain|role|weight|enabled"
} > "$tmp"
while IFS= read -r line || [[ -n "$line" ]]; do
line="${line%$'\r'}"
[[ "$line" =~ ^[[:space:]]*(#|$) ]] && continue
count=$((count + 1))
(( count <= 128 )) || { err "Import: слишком много nodes (максимум 128)"; rm -f "$tmp"; return 1; }
nodes_validate_line "$line" || { err "Import: некорректная node-запись"; rm -f "$tmp"; return 1; }
name="${line%%|*}"
[[ -z "${seen[$name]+x}" ]] || { err "Import: node $name указана несколько раз"; rm -f "$tmp"; return 1; }
seen[$name]=1
printf '%s\n' "$line" >> "$tmp"
done < "$source_file"
install -m 600 "$tmp" "$output_file"
rm -f "$tmp"
}
sanitize_imported_aliases_file() {
local source_file="$1" output_file="$2" line alias target user extra count=0 tmp
local -A seen=()
[[ -f "$source_file" && ! -L "$source_file" ]] || return 1
[[ "$(stat -c '%s' "$source_file" 2>/dev/null || echo 0)" -le 1048576 ]] || { err "Import: aliases-файл слишком большой"; return 1; }
tmp="${output_file}.tmp"
: > "$tmp"
while IFS= read -r line || [[ -n "$line" ]]; do
line="${line%$'\r'}"
[[ "$line" =~ ^[[:space:]]*(#|$) ]] && continue
read -r alias target user extra <<< "$line"
[[ "$alias" =~ ^[A-Fa-f0-9]{32,64}$ && "$target" =~ ^[A-Fa-f0-9]{32,64}$ && "$alias" != "$target" && -z "$extra" ]] || { err "Import: некорректный subscription alias"; rm -f "$tmp"; return 1; }
[[ -z "$user" ]] || is_valid_proxy_user "$user" || { err "Import: некорректный пользователь alias"; rm -f "$tmp"; return 1; }
count=$((count + 1))
(( count <= 4096 )) || { err "Import: слишком много aliases"; rm -f "$tmp"; return 1; }
[[ -z "${seen[$alias]+x}" ]] || { err "Import: alias $alias указан несколько раз"; rm -f "$tmp"; return 1; }
seen[$alias]=1
printf '%s %s%s\n' "$alias" "$target" "${user:+ $user}" >> "$tmp"
done < "$source_file"
install -m 600 "$tmp" "$output_file"
rm -f "$tmp"
}
sanitize_imported_credentials_dir() {
local source_dir="$1" output_dir="$2" file name private_key public_key secrets_file active_file tmp line user encrypted extra pass count=0
local -A seen=()
[[ -d "$source_dir" && ! -L "$source_dir" ]] || return 1
while IFS= read -r file; do
name=$(basename "$file")
case "$name" in
private.pem|public.pem|users.secrets|users.active.htpasswd|credentials.lock|migration.receipt) ;;
*) err "Import: неизвестный файл credential vault: $name"; return 1 ;;
esac
[[ -f "$file" && ! -L "$file" ]] || { err "Import: credential vault содержит не обычный файл"; return 1; }
[[ "$(stat -c '%s' "$file" 2>/dev/null || echo 0)" -le 4194304 ]] || { err "Import: credential-файл слишком большой: $name"; return 1; }
done < <(find "$source_dir" -mindepth 1 -maxdepth 1 -print)
private_key="$source_dir/private.pem"
public_key="$source_dir/public.pem"
secrets_file="$source_dir/users.secrets"
active_file="$source_dir/users.active.htpasswd"
[[ -s "$private_key" && -s "$public_key" && -f "$secrets_file" ]] || { err "Import: credential vault неполный"; return 1; }
openssl pkey -in "$private_key" -check -noout >/dev/null 2>&1 || { err "Import: private key vault повреждён"; return 1; }
openssl pkey -pubin -in "$public_key" -noout >/dev/null 2>&1 || { err "Import: public key vault повреждён"; return 1; }
local derived_hash public_hash
derived_hash=$(openssl pkey -in "$private_key" -pubout -outform DER 2>/dev/null | sha256sum | awk '{print $1}')
public_hash=$(openssl pkey -pubin -in "$public_key" -outform DER 2>/dev/null | sha256sum | awk '{print $1}')
[[ -n "$derived_hash" && "$derived_hash" == "$public_hash" ]] || { err "Import: private/public key vault не совпадают"; return 1; }
mkdir -p "$output_dir"
chmod 700 "$output_dir"
tmp="$output_dir/users.secrets.tmp"
: > "$tmp"
while IFS= read -r line || [[ -n "$line" ]]; do
line="${line%$'\r'}"
[[ "$line" =~ ^[[:space:]]*(#|$) ]] && continue
IFS=: read -r user encrypted extra <<< "$line"
is_valid_proxy_user "$user" && is_valid_encrypted_proxy_secret "$encrypted" && [[ -z "$extra" ]] \
|| { err "Import: некорректная encrypted credential-запись"; rm -f "$tmp"; return 1; }
[[ -z "${seen[$user]+x}" ]] || { err "Import: duplicate encrypted credential $user"; rm -f "$tmp"; return 1; }
pass=$(decrypt_proxy_password_with_key "$encrypted" "$private_key" 2>/dev/null || true)
is_valid_proxy_pass "$pass" || { err "Import: encrypted credential $user не расшифровывается"; rm -f "$tmp"; return 1; }
seen[$user]=1
count=$((count + 1)); (( count <= 10000 )) || { rm -f "$tmp"; return 1; }
printf '%s:%s\n' "$user" "$encrypted" >> "$tmp"
done < "$secrets_file"
install -m 600 "$private_key" "$output_dir/private.pem"
install -m 644 "$public_key" "$output_dir/public.pem"
install -m 600 "$tmp" "$output_dir/users.secrets"
rm -f "$tmp"
if [[ -f "$active_file" ]]; then
sanitize_imported_colon_file "$active_file" "$output_dir/users.active.htpasswd" proxy || return 1
fi
: > "$output_dir/credentials.lock"
chmod 600 "$output_dir/credentials.lock"
}
validate_imported_user_vault() {
local users_file="$1" credentials_dir="$2" user hash encrypted pass
[[ -f "$users_file" && -d "$credentials_dir" ]] || return 0
while IFS=: read -r user hash; do
[[ -z "$user" || "$user" == \#* ]] && continue
encrypted=$(credential_file_value "$credentials_dir/users.secrets" "$user" 2>/dev/null || true)
if is_valid_proxy_hash "$hash"; then
pass=$(decrypt_proxy_password_with_key "$encrypted" "$credentials_dir/private.pem" 2>/dev/null || true)
if ! verify_proxy_password_hash "$user" "$pass" "$hash"; then
err "Import: vault credential $user не соответствует bcrypt в $(basename "$users_file")"
return 1
fi
elif [[ -n "$encrypted" ]]; then
pass=$(decrypt_proxy_password_with_key "$encrypted" "$credentials_dir/private.pem" 2>/dev/null || true)
if [[ "$pass" != "$hash" ]]; then
err "Import: legacy credential $user конфликтует с encrypted vault"
return 1
fi
else
continue
fi
if [[ -z "$pass" ]]; then
err "Import: vault credential $user не соответствует bcrypt в $(basename "$users_file")"
return 1
fi
done < "$users_file"
}
sanitize_imported_token_file() {
local source_file="$1" output_file="$2" token
[[ -f "$source_file" && ! -L "$source_file" ]] || return 1
[[ "$(stat -c '%s' "$source_file" 2>/dev/null || echo 0)" -le 256 ]] || { err "Import: token-файл слишком большой"; return 1; }
token=$(tr -d '\r\n' < "$source_file")
[[ "$token" =~ ^[A-Fa-f0-9]{48}$ ]] || { err "Import: некорректный subscription token"; return 1; }
printf '%s\n' "$token" > "${output_file}.tmp"
install -m 600 "${output_file}.tmp" "$output_file"
rm -f "${output_file}.tmp"
}
sanitize_imported_user_meta_file() {
local source_file="$1" output_file="$2" expected_user="$3" line key value count=0
[[ -f "$source_file" && ! -L "$source_file" ]] || return 1
[[ "$(stat -c '%s' "$source_file" 2>/dev/null || echo 0)" -le 65536 ]] || { err "Import: metadata-файл слишком большой"; return 1; }
printf 'USER=%q\n' "$expected_user" > "${output_file}.tmp"
while IFS= read -r line || [[ -n "$line" ]]; do
line="${line%$'\r'}"
[[ "$line" =~ ^[[:space:]]*(#|$) ]] && continue
[[ "$line" =~ ^([A-Z][A-Z0-9_]*)=(.*)$ ]] || { err "Import: некорректная metadata-строка"; rm -f "${output_file}.tmp"; return 1; }
key="${BASH_REMATCH[1]}"
value="${BASH_REMATCH[2]}"
[[ "$key" == "USER" ]] && continue
import_shell_word_is_safe "$value" || { err "Import: небезопасное metadata-значение"; rm -f "${output_file}.tmp"; return 1; }
count=$((count + 1))
(( count <= 128 )) || { err "Import: слишком много metadata-полей"; rm -f "${output_file}.tmp"; return 1; }
printf '%s=%s\n' "$key" "$value" >> "${output_file}.tmp"
done < "$source_file"
install -m 600 "${output_file}.tmp" "$output_file"
rm -f "${output_file}.tmp"
}
cmd_import_state() {
local archive="${1:-}" name import_work_dir import_archive payload archive_size archive_stats entry_count unpacked_size safe_naive safe_bridge safe_nodes safe_aliases safe_credentials state_file
local existing_state=0 imported_has_bcrypt=0
[[ -n "$archive" ]] || { echo -ne "${CYAN}Путь к export .tar.gz: ${RESET}"; read -r archive; }
[[ -f "$archive" ]] || { err "Файл не найден: $archive"; return 1; }
archive_size=$(stat -c '%s' "$archive" 2>/dev/null || echo 0)
[[ "$archive_size" =~ ^[0-9]+$ && "$archive_size" -le 52428800 ]] || {
err "Import-архив слишком большой (лимит 50 MiB)"
return 1
}
import_work_dir=$(mktemp -d /tmp/naiveproxy_import_XXXXXX)
import_archive="${import_work_dir}/state.tar.gz"
payload="${import_work_dir}/payload"
mkdir -m 700 "$payload"
trap '[[ -n "${import_work_dir:-}" && "$import_work_dir" == /tmp/naiveproxy_import_* ]] && rm -rf -- "$import_work_dir" 2>/dev/null; trap - RETURN' RETURN
if ! install -m 600 -- "$archive" "$import_archive"; then
err "Не удалось создать защищённую копию import-архива"
return 1
fi
archive_size=$(stat -c '%s' "$import_archive" 2>/dev/null || echo 0)
[[ "$archive_size" =~ ^[0-9]+$ && "$archive_size" -le 52428800 ]] || { err "Защищённая копия import-архива превышает лимит"; return 1; }
if ! archive_stats=$(timeout 30s tar --numeric-owner -tvzf "$import_archive" 2>/dev/null | awk '{count++; if ($3 ~ /^[0-9]+$/) total += $3} END {print count+0, total+0}'); then
err "Не удалось безопасно прочитать import-архив"
return 1
fi
read -r entry_count unpacked_size <<< "$archive_stats"
[[ "$entry_count" =~ ^[0-9]+$ && "$entry_count" -le 10000 ]] || { err "В import-архиве слишком много записей"; return 1; }
[[ "$unpacked_size" =~ ^[0-9]+$ && "$unpacked_size" -le 209715200 ]] || { err "Распакованный import-архив превышает 200 MiB"; return 1; }
if ! timeout 30s tar -tzf "$import_archive" 2>/dev/null \
| awk 'BEGIN { bad=0 } /(^\/|(^|\/)\.\.(\/|$))/ { bad=1 } END { exit bad ? 1 : 0 }'; then
err "Архив содержит небезопасные пути или не читается"
return 1
fi
if ! timeout 30s tar -tzf "$import_archive" 2>/dev/null \
| awk '/^(naive\.conf|users\.conf|users\.disabled|xray-users\.conf|xray-compat-users\.conf|xray-users\.disabled|bridge\.conf|nodes\.conf|subscription-aliases\.conf|credentials\/|credentials\/(private\.pem|public\.pem|users\.secrets|users\.active\.htpasswd|credentials\.lock|migration\.receipt)|users\.d\/|users\.d\/[A-Za-z0-9_-]+\.env|subscriptions\/|subscriptions\/[A-Za-z0-9_-]+\.token)$/ { next } { bad=1 } END { exit bad ? 1 : 0 }'; then
err "Архив содержит неизвестные файлы. Импорт остановлен."
return 1
fi
if tar -tvzf "$import_archive" | awk '{ t=substr($1,1,1); if (t != "-" && t != "d") bad=1 } END { exit bad ? 0 : 1 }'; then
err "Архив содержит symlink/hardlink/special-файлы. Импорт остановлен."
return 1
fi
if ! tar --no-same-owner --no-same-permissions -xzf "$import_archive" -C "$payload"; then
err "Не удалось распаковать import-архив"
return 1
fi
if [[ -f "$payload/naive.conf" ]]; then
safe_naive="${import_work_dir}/naive.conf.safe"
sanitize_imported_shell_data_file "$payload/naive.conf" "$safe_naive" naive || return 1
fi
if [[ -f "$payload/bridge.conf" ]]; then
safe_bridge="${import_work_dir}/bridge.conf.safe"
sanitize_imported_shell_data_file "$payload/bridge.conf" "$safe_bridge" bridge || return 1
fi
if [[ -f "$payload/nodes.conf" ]]; then
safe_nodes="${import_work_dir}/nodes.conf.safe"
sanitize_imported_nodes_file "$payload/nodes.conf" "$safe_nodes" || return 1
fi
if [[ -f "$payload/subscription-aliases.conf" ]]; then
safe_aliases="${import_work_dir}/subscription-aliases.conf.safe"
sanitize_imported_aliases_file "$payload/subscription-aliases.conf" "$safe_aliases" || return 1
fi
if [[ -d "$payload/credentials" ]]; then
safe_credentials="${import_work_dir}/credentials.safe"
sanitize_imported_credentials_dir "$payload/credentials" "$safe_credentials" || return 1
fi
for name in users.conf users.disabled; do
[[ -f "$payload/$name" ]] || continue
sanitize_imported_colon_file "$payload/$name" "${import_work_dir}/${name}.safe" proxy || return 1
done
if [[ -n "${safe_credentials:-}" && ! -f "${import_work_dir}/users.conf.safe" ]]; then
err "Import: credential vault без users.conf запрещён"
return 1
fi
for name in users.conf users.disabled; do
if [[ -f "${import_work_dir}/${name}.safe" ]] \
&& awk -F: 'NF >= 2 && $1 !~ /^#/ && $2 ~ /^\$2[aby]\$/ {found=1} END {exit found ? 0 : 1}' "${import_work_dir}/${name}.safe"; then
imported_has_bcrypt=1
fi
done
if [[ "$imported_has_bcrypt" -eq 1 && -z "${safe_credentials:-}" ]]; then
err "Import: bcrypt users.conf требует каталог credentials с encrypted vault"
return 1
fi
if [[ -n "${safe_credentials:-}" ]]; then
if [[ -f "${import_work_dir}/users.conf.safe" ]]; then
validate_imported_user_vault "${import_work_dir}/users.conf.safe" "$safe_credentials" || return 1
fi
if [[ -f "${import_work_dir}/users.disabled.safe" ]]; then
validate_imported_user_vault "${import_work_dir}/users.disabled.safe" "$safe_credentials" || return 1
fi
fi
for name in xray-users.conf xray-compat-users.conf xray-users.disabled; do
[[ -f "$payload/$name" ]] || continue
sanitize_imported_colon_file "$payload/$name" "${import_work_dir}/${name}.safe" xray || return 1
done
echo -ne "${YELLOW}Импорт перезапишет users/subscriptions/config. Продолжить? [y/N]: ${RESET}"
read -r ans
[[ "${ans,,}" == "y" ]] || return 0
for state_file in naive.conf users.conf credentials users.d subscriptions subscription-aliases.conf xray-users.conf xray-compat-users.conf xray-users.disabled users.disabled bridge.conf nodes.conf; do
[[ -e "$CONFIG_DIR/$state_file" ]] && { existing_state=1; break; }
done
if [[ "$existing_state" -eq 1 ]]; then
info "Делаю обязательный export текущего состояния перед import..."
if ! cmd_export_state >/dev/null 2>&1; then
err "Pre-import export не создан. Импорт отменён без изменений."
return 1
fi
else
info "Текущее состояние пустое, pre-import export не требуется"
fi
mkdir -p "$CONFIG_DIR"
chmod 700 "$CONFIG_DIR"
for name in naive.conf users.conf users.disabled xray-users.conf xray-compat-users.conf xray-users.disabled bridge.conf nodes.conf subscription-aliases.conf; do
case "$name" in
naive.conf) [[ -n "${safe_naive:-}" && -f "$safe_naive" ]] && install -m 600 "$safe_naive" "$CONFIG_DIR/$name" ;;
bridge.conf) [[ -n "${safe_bridge:-}" && -f "$safe_bridge" ]] && install -m 600 "$safe_bridge" "$CONFIG_DIR/$name" ;;
nodes.conf) [[ -n "${safe_nodes:-}" && -f "$safe_nodes" ]] && install -m 600 "$safe_nodes" "$CONFIG_DIR/$name" ;;
subscription-aliases.conf) [[ -n "${safe_aliases:-}" && -f "$safe_aliases" ]] && install -m 600 "$safe_aliases" "$CONFIG_DIR/$name" ;;
users.conf|users.disabled|xray-users.conf|xray-compat-users.conf|xray-users.disabled)
[[ -f "${import_work_dir}/${name}.safe" ]] && install -m 600 "${import_work_dir}/${name}.safe" "$CONFIG_DIR/$name"
;;
*) [[ -f "$payload/$name" ]] && install -m 600 "$payload/$name" "$CONFIG_DIR/$name" ;;
esac
done
if [[ -n "${safe_credentials:-}" && -d "$safe_credentials" ]]; then
rm -rf "$CREDENTIALS_DIR"
cp -a "$safe_credentials" "$CREDENTIALS_DIR"
chown -R root:root "$CREDENTIALS_DIR" 2>/dev/null || true
chmod 700 "$CREDENTIALS_DIR"
chmod 600 "$CREDENTIALS_PRIVATE_KEY" "$USERS_SECRETS_FILE" "$ACTIVE_USERS_HASH_FILE" "$CREDENTIALS_LOCK_FILE" 2>/dev/null || true
chmod 644 "$CREDENTIALS_PUBLIC_KEY" 2>/dev/null || true
elif [[ -f "${import_work_dir}/users.conf.safe" ]]; then
# A legacy import must not inherit encrypted secrets from the previous install.
rm -rf "$CREDENTIALS_DIR"
fi
if [[ -d "$payload/users.d" ]]; then
mkdir -p "$USER_META_DIR"
chmod 700 "$USER_META_DIR"
find "$payload/users.d" -maxdepth 1 -type f -name '*.env' -print0 2>/dev/null \
| while IFS= read -r -d '' meta_file; do
name=$(basename "$meta_file" .env)
is_valid_proxy_user "$name" || { err "Import: некорректное имя metadata-файла"; exit 1; }
sanitize_imported_user_meta_file "$meta_file" "$USER_META_DIR/${name}.env" "$name" || exit 1
done
fi
if [[ -d "$payload/subscriptions" ]]; then
mkdir -p "$SUBS_DIR"
chmod 700 "$SUBS_DIR"
find "$payload/subscriptions" -maxdepth 1 -type f -name '*.token' -print0 2>/dev/null \
| while IFS= read -r -d '' token_file; do
name=$(basename "$token_file" .token)
is_valid_proxy_user "$name" || { err "Import: некорректное имя token-файла"; exit 1; }
sanitize_imported_token_file "$token_file" "$SUBS_DIR/${name}.token" || exit 1
done
fi
ok "Import завершён"
warn "После импорта запусти: sudo bash yurich-panel.sh safe-apply"
}
cmd_bridge_configure() {
load_config 2>/dev/null || true
hr
echo -e "${BOLD} Bridge builder${RESET}"
hr
echo -e " Схема: мобилка → этот VPS (${DOMAIN:-domain}) → второй VPS"
echo -ne "${CYAN}Название bridge [ru-to-eu]: ${RESET}"
read -r BRIDGE_NAME
BRIDGE_NAME="${BRIDGE_NAME:-ru-to-eu}"
echo -ne "${CYAN}Входной протокол на этом VPS [naive]: ${RESET}"
read -r BRIDGE_ENTRY_PROTOCOL
BRIDGE_ENTRY_PROTOCOL="${BRIDGE_ENTRY_PROTOCOL:-naive}"
echo -ne "${CYAN}Выходной протокол второго VPS [vless]: ${RESET}"
read -r BRIDGE_EXIT_PROTOCOL
BRIDGE_EXIT_PROTOCOL="${BRIDGE_EXIT_PROTOCOL:-vless}"
echo -ne "${CYAN}URI второго VPS (vless://, trojan://, hysteria2://, socks://, http://): ${RESET}"
read -r BRIDGE_EXIT_URI
if [[ ! "$BRIDGE_EXIT_URI" =~ ^(vless|trojan|hysteria2|hy2|socks|socks5|http|https):// ]]; then
err "Нужен корректный URI второго VPS"
return 1
fi
BRIDGE_ENABLED="1"
save_config
install -d -m 700 "$CONFIG_DIR"
{
printf 'BRIDGE_ENABLED=%q\n' "$BRIDGE_ENABLED"
printf 'BRIDGE_NAME=%q\n' "$BRIDGE_NAME"
printf 'BRIDGE_ENTRY_PROTOCOL=%q\n' "$BRIDGE_ENTRY_PROTOCOL"
printf 'BRIDGE_EXIT_PROTOCOL=%q\n' "$BRIDGE_EXIT_PROTOCOL"
printf 'BRIDGE_EXIT_URI=%q\n' "$BRIDGE_EXIT_URI"
printf 'UPDATED_AT=%q\n' "$(date '+%Y-%m-%d %H:%M:%S')"
} > "$BRIDGE_CONFIG"
chmod 600 "$BRIDGE_CONFIG"
ok "Bridge profile сохранён: $BRIDGE_CONFIG"
cmd_bridge_show
}
cmd_bridge_show() {
load_config 2>/dev/null || true
if [[ -f "$BRIDGE_CONFIG" ]]; then
local bridge_owner
bridge_owner=$(stat -c '%U' "$BRIDGE_CONFIG" 2>/dev/null || echo unknown)
if [[ "$bridge_owner" == "root" ]]; then
chmod 600 "$BRIDGE_CONFIG" 2>/dev/null || true
# shellcheck source=/dev/null
source "$BRIDGE_CONFIG" 2>/dev/null || true
else
warn "$BRIDGE_CONFIG принадлежит не root — не загружаю"
fi
fi
hr
echo -e "${BOLD} Bridge profile${RESET}"
hr
if [[ "${BRIDGE_ENABLED:-0}" != "1" ]]; then
warn "Bridge не настроен"
return 0
fi
echo -e " Name: ${CYAN}${BRIDGE_NAME:-bridge}${RESET}"
echo -e " Entry: ${CYAN}${BRIDGE_ENTRY_PROTOCOL:-naive}${RESET} на этом VPS"
echo -e " Exit: ${CYAN}${BRIDGE_EXIT_PROTOCOL:-vless}${RESET} на втором VPS"
echo -e " URI: ${DIM}${BRIDGE_EXIT_URI:-не задан}${RESET}"
echo
warn "Caddy/Naive сам по себе не умеет upstream chaining. Для полного bridge используй Xray/sing-box outbound на первом VPS."
echo -e "${CYAN} Следующий шаг:${RESET} включить Xray на этом VPS и добавить outbound на второй VPS по URI выше."
hr
}
cmd_bridge_remove() {
rm -f "$BRIDGE_CONFIG" 2>/dev/null || true
BRIDGE_ENABLED="0"
BRIDGE_EXIT_URI=""
save_config
ok "Bridge profile удалён"
}
cmd_bridge_menu() {
while true; do
hr
echo -e "${BOLD} Bridge builder${RESET}"
hr
echo -e " ${BOLD}1)${RESET} Создать / изменить bridge profile"
echo -e " ${BOLD}2)${RESET} Показать bridge profile"
echo -e " ${BOLD}3)${RESET} Удалить bridge profile"
echo -e " ${BOLD}0)${RESET} Назад"
hr
echo -ne "${CYAN}Выбор: ${RESET}"
read -r choice
case "$choice" in
1) cmd_bridge_configure ;;
2) cmd_bridge_show ;;
3) cmd_bridge_remove ;;
0) break ;;
*) warn "Неверный выбор" ;;
esac
echo -ne "${YELLOW}Enter для продолжения...${RESET}"
read -r
done
}
# ─── MULTI-SERVER NODES ───────────────────────────────────────
is_valid_node_name() {
[[ "${1:-}" =~ ^[a-zA-Z0-9_-]{2,32}$ ]]
}
is_valid_ssh_user() {
[[ "${1:-}" =~ ^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,31}$ ]]
}
is_valid_node_host() {
local host="${1:-}"
[[ -n "$host" && "$host" != *"|"* ]] || return 1
if is_valid_domain "$host"; then
return 0
fi
[[ "$host" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] || return 1
local IFS=. part
for part in $host; do
[[ "$part" =~ ^[0-9]{1,3}$ ]] || return 1
[[ "$part" == "0" || "$part" != 0* ]] || return 1
(( 10#$part <= 255 )) || return 1
done
}
is_valid_node_role() {
case "${1:-}" in
edge|bridge|exit|backup) return 0 ;;
*) return 1 ;;
esac
}
is_valid_node_weight() {
local value="${1:-}"
[[ "$value" =~ ^[1-9][0-9]{0,2}$ ]] && (( 10#$value <= 999 ))
}
nodes_ensure_file() {
mkdir -p "$CONFIG_DIR"
if [[ ! -f "$NODES_FILE" ]]; then
{
echo "# Yurich Panel nodes"
echo "# format: name|host|ssh_port|ssh_user|domain|role|weight|enabled"
} > "$NODES_FILE"
chmod 600 "$NODES_FILE"
fi
}
nodes_list_lines() {
local line
[[ -f "$NODES_FILE" ]] || return 0
while IFS= read -r line || [[ -n "$line" ]]; do
[[ "$line" =~ ^[[:space:]]*(#|$) ]] && continue
if nodes_validate_line "$line"; then
printf '%s\n' "$line"
else
warn "Пропускаю некорректную node-запись в $NODES_FILE"
fi
done < "$NODES_FILE"
}
nodes_count() {
nodes_list_lines | wc -l
}
nodes_get_line() {
local lookup="${1:-}"
local line
is_valid_node_name "$lookup" || return 1
line=$(nodes_list_lines | awk -F'|' -v name="$lookup" '$1 == name && !found {print; found=1}')
[[ -n "$line" ]] || return 1
nodes_validate_line "$line" || return 1
printf '%s\n' "$line"
}
nodes_validate_line() {
local line="$1"
local name host port ssh_user node_domain role weight enabled
IFS='|' read -r name host port ssh_user node_domain role weight enabled <<< "$line"
is_valid_node_name "$name" || return 1
is_valid_node_host "$host" || return 1
is_valid_port "$port" || return 1
is_valid_ssh_user "$ssh_user" || return 1
if [[ -n "$node_domain" && "$node_domain" != "-" ]]; then
is_valid_domain "$node_domain" || return 1
fi
is_valid_node_role "$role" || return 1
is_valid_node_weight "$weight" || return 1
[[ "$enabled" == "1" || "$enabled" == "0" ]] || return 1
}
nodes_upsert_line() {
local line="$1"
local name tmp
nodes_validate_line "$line" || { err "Некорректная запись node"; return 1; }
name="${line%%|*}"
nodes_ensure_file
tmp=$(mktemp)
awk -F'|' -v name="$name" 'BEGIN{OFS=FS} /^#/ || /^[[:space:]]*$/ {print; next} $1 != name {print}' "$NODES_FILE" > "$tmp"
printf '%s\n' "$line" >> "$tmp"
install -m 600 "$tmp" "$NODES_FILE"
rm -f "$tmp"
}
nodes_remove_line() {
local name="${1:-}" tmp
is_valid_node_name "$name" || { err "Некорректное имя node"; return 1; }
nodes_ensure_file
tmp=$(mktemp)
awk -F'|' -v name="$name" 'BEGIN{OFS=FS} /^#/ || /^[[:space:]]*$/ {print; next} $1 != name {print}' "$NODES_FILE" > "$tmp"
install -m 600 "$tmp" "$NODES_FILE"
rm -f "$tmp"
}
nodes_prompt_name() {
local provided="${1:-}" name
if [[ -n "$provided" ]]; then
is_valid_node_name "$provided" || return 1
printf '%s\n' "$provided"
return 0
fi
cmd_nodes_list >&2
echo -ne "${CYAN}Node name: ${RESET}" >&2
read -r name
is_valid_node_name "$name" || return 1
printf '%s\n' "$name"
}
nodes_known_host_lookup_names() {
local host="$1" port="$2"
printf '%s\n' "$host"
[[ "$port" == "22" ]] || printf '[%s]:%s\n' "$host" "$port"
}
nodes_known_host_is_trusted() {
local host="$1" port="$2" lookup
[[ -f "$NODES_KNOWN_HOSTS_FILE" ]] || return 1
while IFS= read -r lookup; do
ssh-keygen -F "$lookup" -f "$NODES_KNOWN_HOSTS_FILE" >/dev/null 2>&1 && return 0
done < <(nodes_known_host_lookup_names "$host" "$port")
return 1
}
nodes_import_existing_host_key() {
local host="$1" port="$2" default_file="${HOME:-/root}/.ssh/known_hosts" lookup tmp
[[ -f "$default_file" ]] || return 1
tmp=$(mktemp)
while IFS= read -r lookup; do
ssh-keygen -F "$lookup" -f "$default_file" 2>/dev/null | grep -v '^#' >> "$tmp" || true
done < <(nodes_known_host_lookup_names "$host" "$port")
if [[ -s "$tmp" ]]; then
mkdir -p "$(dirname "$NODES_KNOWN_HOSTS_FILE")"
touch "$NODES_KNOWN_HOSTS_FILE"
chmod 600 "$NODES_KNOWN_HOSTS_FILE"
cat "$tmp" >> "$NODES_KNOWN_HOSTS_FILE"
sort -u "$NODES_KNOWN_HOSTS_FILE" -o "$NODES_KNOWN_HOSTS_FILE"
rm -f "$tmp"
return 0
fi
rm -f "$tmp"
return 1
}
nodes_ensure_host_key() {
local line="$1" node_name node_host node_port node_user node_domain node_role node_weight node_enabled tmp ans
nodes_validate_line "$line" || { err "Небезопасная node-запись"; return 1; }
IFS='|' read -r node_name node_host node_port node_user node_domain node_role node_weight node_enabled <<< "$line"
mkdir -p "$(dirname "$NODES_KNOWN_HOSTS_FILE")"
touch "$NODES_KNOWN_HOSTS_FILE"
chmod 600 "$NODES_KNOWN_HOSTS_FILE"
nodes_known_host_is_trusted "$node_host" "$node_port" && return 0
if nodes_import_existing_host_key "$node_host" "$node_port" && nodes_known_host_is_trusted "$node_host" "$node_port"; then
ok "SSH host key для ${node_name} импортирован из существующего known_hosts"
return 0
fi
[[ -t 0 ]] || { err "SSH host key для ${node_name} не доверен. Запусти интерактивно: nodes-test ${node_name}"; return 1; }
command -v ssh-keyscan >/dev/null 2>&1 || { err "Не найден ssh-keyscan"; return 1; }
tmp=$(mktemp)
if ! ssh-keyscan -T 8 -p "$node_port" "$node_host" > "$tmp" 2>/dev/null || [[ ! -s "$tmp" ]]; then
rm -f "$tmp"
err "Не удалось получить SSH host key: ${node_host}:${node_port}"
return 1
fi
echo -e "${YELLOW}Сверь fingerprint ${node_name} с панелью провайдера:${RESET}"
ssh-keygen -lf "$tmp" || { rm -f "$tmp"; return 1; }
echo -ne "${YELLOW}Если fingerprint совпадает, введи TRUST: ${RESET}"
read -r ans
if [[ "$ans" != "TRUST" ]]; then
rm -f "$tmp"
err "Host key не добавлен"
return 1
fi
cat "$tmp" >> "$NODES_KNOWN_HOSTS_FILE"
sort -u "$NODES_KNOWN_HOSTS_FILE" -o "$NODES_KNOWN_HOSTS_FILE"
chmod 600 "$NODES_KNOWN_HOSTS_FILE"
rm -f "$tmp"
ok "SSH host key закреплён: ${node_name}"
}
nodes_ssh() {
local line="$1" remote_cmd="$2"
local node_name node_host node_port node_user node_domain node_role node_weight node_enabled
local ssh_timeout="${NODES_SSH_TIMEOUT_SECONDS:-600}"
nodes_validate_line "$line" || { err "Небезопасная node-запись"; return 1; }
nodes_ensure_host_key "$line" || return 1
IFS='|' read -r node_name node_host node_port node_user node_domain node_role node_weight node_enabled <<< "$line"
if command -v timeout >/dev/null 2>&1; then
timeout "${ssh_timeout}s" ssh \
-n \
-o BatchMode=yes \
-o ConnectTimeout=8 \
-o ServerAliveInterval=5 \
-o ServerAliveCountMax=2 \
-o StrictHostKeyChecking=yes \
-o UserKnownHostsFile="$NODES_KNOWN_HOSTS_FILE" \
-p "$node_port" \
"${node_user}@${node_host}" \
"$remote_cmd"
return $?
fi
ssh \
-n \
-o BatchMode=yes \
-o ConnectTimeout=8 \
-o ServerAliveInterval=5 \
-o ServerAliveCountMax=2 \
-o StrictHostKeyChecking=yes \
-o UserKnownHostsFile="$NODES_KNOWN_HOSTS_FILE" \
-p "$node_port" \
"${node_user}@${node_host}" \
"$remote_cmd"
}
nodes_scp_to() {
local line="$1" src="$2" dest="$3"
local node_name node_host node_port node_user node_domain node_role node_weight node_enabled
nodes_validate_line "$line" || { err "Небезопасная node-запись"; return 1; }
nodes_ensure_host_key "$line" || return 1
IFS='|' read -r node_name node_host node_port node_user node_domain node_role node_weight node_enabled <<< "$line"
scp \
-P "$node_port" \
-o BatchMode=yes \
-o ConnectTimeout=8 \
-o StrictHostKeyChecking=yes \
-o UserKnownHostsFile="$NODES_KNOWN_HOSTS_FILE" \
-- "$src" "${node_user}@${node_host}:${dest}"
}
nodes_remote_sudo_prefix() {
local ssh_user="${1:-root}"
if [[ "$ssh_user" == "root" ]]; then
printf ''
else
printf 'sudo -n '
fi
}
nodes_local_script_source() {
if [[ -r "${BASH_SOURCE[0]:-}" && "${BASH_SOURCE[0]}" != /dev/fd/* ]]; then
printf '%s\n' "${BASH_SOURCE[0]}"
return 0
fi
if [[ -r "$SCRIPT_PATH" ]]; then
printf '%s\n' "$SCRIPT_PATH"
return 0
fi
err "Не найден локальный файл скрипта для отправки на node"
return 1
}
cmd_nodes_list() {
nodes_ensure_file
hr
echo -e "${BOLD} Multi-server nodes${RESET}"
hr
if [[ "$(nodes_count)" -eq 0 ]]; then
warn "Ноды не добавлены"
echo -e " Файл: ${NODES_FILE}"
return 0
fi
printf ' %-14s %-22s %-7s %-10s %-24s %-8s %-6s %s\n' "NAME" "HOST" "SSH" "USER" "DOMAIN" "ROLE" "WEIGHT" "ON"
nodes_list_lines | while IFS='|' read -r name host port ssh_user node_domain role weight enabled; do
[[ "$enabled" == "1" ]] && enabled="yes" || enabled="no"
[[ -z "$node_domain" || "$node_domain" == "-" ]] && node_domain="-"
printf ' %-14s %-22s %-7s %-10s %-24s %-8s %-6s %s\n' "$name" "$host" "$port" "$ssh_user" "$node_domain" "$role" "$weight" "$enabled"
done
}
cmd_nodes_add() {
nodes_ensure_file
local name host port ssh_user node_domain role weight enabled ans line
hr
echo -e "${BOLD} Добавить / изменить node${RESET}"
hr
echo -ne "${CYAN}Node name [eu-1]: ${RESET}"
read -r name
name="${name:-eu-1}"
echo -ne "${CYAN}SSH host/IP: ${RESET}"
read -r host
echo -ne "${CYAN}SSH port [22]: ${RESET}"
read -r port
port="${port:-22}"
echo -ne "${CYAN}SSH user [root]: ${RESET}"
read -r ssh_user
ssh_user="${ssh_user:-root}"
echo -ne "${CYAN}Публичный домен node для ссылок (Enter = host если это домен): ${RESET}"
read -r node_domain
if [[ -z "$node_domain" && "$host" =~ [a-zA-Z] ]]; then
node_domain="$host"
fi
[[ -z "$node_domain" ]] && node_domain="-"
echo -ne "${CYAN}Role [edge/bridge/exit/backup, Enter=edge]: ${RESET}"
read -r role
role="${role:-edge}"
echo -ne "${CYAN}Weight [100]: ${RESET}"
read -r weight
weight="${weight:-100}"
echo -ne "${CYAN}Включить node в подписки? [Y/n]: ${RESET}"
read -r ans
[[ "${ans,,}" == "n" ]] && enabled="0" || enabled="1"
if ! is_valid_node_name "$name"; then err "Node name: 2-32 символа A-Z a-z 0-9 _ -"; return 1; fi
if ! is_valid_node_host "$host"; then err "Некорректный host/IP"; return 1; fi
if ! is_valid_port "$port"; then err "Некорректный SSH порт"; return 1; fi
if ! is_valid_ssh_user "$ssh_user"; then err "Некорректный SSH user"; return 1; fi
if [[ "$node_domain" != "-" ]] && ! is_valid_domain "$node_domain"; then err "Некорректный домен node"; return 1; fi
if ! is_valid_node_role "$role"; then err "Role должен быть edge, bridge, exit или backup"; return 1; fi
if ! is_valid_node_weight "$weight"; then err "Weight: 1-999"; return 1; fi
line="${name}|${host}|${port}|${ssh_user}|${node_domain}|${role}|${weight}|${enabled}"
nodes_upsert_line "$line"
ok "Node сохранена: ${name}"
warn "Для управления node нужен SSH key login и, если user не root, NOPASSWD sudo."
}
cmd_nodes_remove() {
load_config
local name node_line node_domain configured entry host label new_profiles="" browser_changed=0
local -a browser_entries=()
name=$(nodes_prompt_name "${1:-}") || { err "Node не выбрана"; return 1; }
node_line=$(nodes_get_line "$name") || { err "Node не найдена: $name"; return 1; }
IFS='|' read -r _ _ _ _ node_domain _ _ _ <<< "$node_line"
configured="${BROWSER_SUBSCRIPTION_PROFILES:-}"
if [[ -n "$configured" ]]; then
IFS=';' read -r -a browser_entries <<< "$configured"
for entry in "${browser_entries[@]}"; do
[[ "$entry" == *"|"* ]] || continue
host="${entry%%|*}"
label="${entry#*|}"
host=$(printf '%s' "$host" | tr '[:upper:]' '[:lower:]' | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//')
label=$(printf '%s' "$label" | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//')
if [[ "$label" == "$name" || ( "$node_domain" != "-" && "$host" == "${node_domain,,}" ) ]]; then
browser_changed=1
continue
fi
new_profiles+="${new_profiles:+;}${entry}"
done
fi
nodes_remove_line "$name" || return 1
if [[ "$browser_changed" -eq 1 ]]; then
BROWSER_SUBSCRIPTION_PROFILES="$new_profiles"
if ! save_config; then
nodes_upsert_line "$node_line" >/dev/null 2>&1 || true
err "Не удалось обновить browser-профили; запись node восстановлена"
return 1
fi
ok "Browser-профили node удалены из конфигурации"
fi
ok "Node удалена из реестра: $name"
warn "Запусти nodes-subscriptions, чтобы убрать node из опубликованных страниц"
}
cmd_nodes_test() {
local name="${1:-}" line failed=0 explicit_target=0
nodes_ensure_file
if [[ -n "$name" && "$name" != "all" ]]; then
explicit_target=1
line=$(nodes_get_line "$name") || { err "Node не найдена: $name"; return 1; }
set -- "$line"
else
mapfile -t _nodes_to_check < <(nodes_list_lines)
if [[ "${#_nodes_to_check[@]}" -eq 0 ]]; then
warn "Ноды не добавлены"
return 0
fi
set -- "${_nodes_to_check[@]}"
fi
for line in "$@"; do
local node_name node_host node_port node_user node_domain node_role node_weight node_enabled
IFS='|' read -r node_name node_host node_port node_user node_domain node_role node_weight node_enabled <<< "$line"
if [[ "$node_enabled" != "1" && "$explicit_target" != "1" ]]; then
info "Node ${node_name} выключена, пропускаю"
continue
fi
hr
echo -e "${BOLD} Node status: ${node_name}${RESET} (${node_user}@${node_host}:${node_port})"
hr
if nodes_ssh "$line" 'printf "host=%s\n" "$(hostname)"; printf "time=%s\n" "$(date "+%Y-%m-%d %H:%M:%S")"; uptime; printf "caddy="; systemctl is-active caddy 2>/dev/null || true; printf "xray="; systemctl is-active xray 2>/dev/null || true; printf "hysteria="; systemctl is-active hysteria 2>/dev/null || true; printf "unbound="; systemctl is-active unbound 2>/dev/null || true; ss -tulpn 2>/dev/null | grep -E ":(443|8443|8444)([[:space:]]|$)" || true'; then
ok "SSH/status OK: ${node_name}"
else
err "SSH/status failed: ${node_name}"
failed=1
fi
done
return "$failed"
}
cmd_nodes_deploy_script() {
local name line src remote_tmp node_name node_host node_port node_user node_domain node_role node_weight node_enabled sudo_cmd
name=$(nodes_prompt_name "${1:-}") || { err "Node не выбрана"; return 1; }
line=$(nodes_get_line "$name") || { err "Node не найдена: $name"; return 1; }
IFS='|' read -r node_name node_host node_port node_user node_domain node_role node_weight node_enabled <<< "$line"
src=$(nodes_local_script_source) || return 1
remote_tmp="/tmp/yurich-panel-node-${RANDOM}-$$.sh"
sudo_cmd=$(nodes_remote_sudo_prefix "$node_user")
info "Отправляю текущий скрипт на ${node_name}..."
nodes_scp_to "$line" "$src" "$remote_tmp" || return 1
nodes_ssh "$line" "${sudo_cmd}install -m 755 ${remote_tmp} ${SCRIPT_PATH} && ${sudo_cmd}install -m 755 ${remote_tmp} ${LEGACY_SCRIPT_PATH} && ${sudo_cmd}rm -f ${remote_tmp} && ${sudo_cmd}bash ${SCRIPT_PATH} version" || return 1
ok "Скрипт установлен/обновлён на node: ${node_name}"
echo -ne "${CYAN}Запустить интерактивную установку Yurich Panel на node сейчас? [y/N]: ${RESET}"
read -r ans
if [[ "${ans,,}" == "y" ]]; then
nodes_ensure_host_key "$line" || return 1
ssh -tt \
-o BatchMode=yes \
-o ConnectTimeout=8 \
-o StrictHostKeyChecking=yes \
-o UserKnownHostsFile="$NODES_KNOWN_HOSTS_FILE" \
-p "$node_port" \
"${node_user}@${node_host}" \
"${sudo_cmd}bash ${SCRIPT_PATH} install"
fi
}
cmd_nodes_sync_users() {
local target="${1:-}" archive remote_tmp failed=0 lines=() items=()
load_config
load_users
nodes_ensure_file
[[ -f "$USERS_FILE" ]] || { err "users.conf не найден, нечего синхронизировать"; return 1; }
ensure_credential_keypair || return 1
write_active_users_hash_file || return 1
for item in users.conf credentials users.d subscriptions subscription-aliases.conf xray-users.conf xray-compat-users.conf xray-users.disabled users.disabled; do
[[ -e "$CONFIG_DIR/$item" ]] && items+=("$item")
done
[[ "${#items[@]}" -gt 0 ]] || { err "Нет файлов состояния для sync"; return 1; }
archive=$(mktemp /tmp/yurich-panel-node-sync-XXXXXX.tar.gz)
tar -C "$CONFIG_DIR" -czf "$archive" "${items[@]}"
if [[ -n "$target" && "$target" != "all" ]]; then
local selected
selected=$(nodes_get_line "$target") || { rm -f "$archive"; err "Node не найдена: $target"; return 1; }
lines+=("$selected")
else
mapfile -t lines < <(nodes_list_lines)
fi
if [[ "${#lines[@]}" -eq 0 ]]; then
rm -f "$archive"
rm -f "$NODES_PENDING_SYNC_FILE"
warn "Ноды не добавлены"
return 0
fi
for line in "${lines[@]}"; do
local node_name node_host node_port node_user node_domain node_role node_weight node_enabled sudo_cmd
IFS='|' read -r node_name node_host node_port node_user node_domain node_role node_weight node_enabled <<< "$line"
[[ "$node_enabled" == "1" ]] || { warn "Node ${node_name} выключена, пропускаю"; continue; }
remote_tmp="/tmp/yurich-panel-node-sync-${RANDOM}-$$.tar.gz"
sudo_cmd=$(nodes_remote_sudo_prefix "$node_user")
info "Синхронизирую пользователей на ${node_name}..."
if ! nodes_scp_to "$line" "$archive" "$remote_tmp"; then
err "Не удалось отправить архив на ${node_name}"
failed=1
continue
fi
if nodes_ssh "$line" "trap 'rm -f ${remote_tmp}' EXIT; ${sudo_cmd}chmod 600 ${remote_tmp} || exit 16; ${sudo_cmd}mkdir -p ${CONFIG_DIR} ${BACKUP_DIR} ${USER_META_DIR} ${SUBS_DIR} || exit 17; ${sudo_cmd}tar -tzf ${remote_tmp} >/dev/null || exit 18; ${sudo_cmd}tar -C ${CONFIG_DIR} -czf ${BACKUP_DIR}/node-sync-before-\$(date +%Y%m%d_%H%M%S).tar.gz users.conf credentials users.d subscriptions subscription-aliases.conf xray-users.conf xray-compat-users.conf xray-users.disabled users.disabled 2>/dev/null || true; ${sudo_cmd}find ${BACKUP_DIR} -maxdepth 1 -type f -name 'node-sync-before-*.tar.gz' -exec chmod 600 {} +; ${sudo_cmd}tar -C ${CONFIG_DIR} -xzf ${remote_tmp} || exit 19; ${sudo_cmd}chmod 700 ${CONFIG_DIR} ${CREDENTIALS_DIR} ${USER_META_DIR} ${SUBS_DIR} 2>/dev/null || true; ${sudo_cmd}chmod 600 ${USERS_FILE} ${DISABLED_USERS_FILE} ${CREDENTIALS_PRIVATE_KEY} ${USERS_SECRETS_FILE} ${ACTIVE_USERS_HASH_FILE} ${CREDENTIALS_LOCK_FILE} ${XRAY_USERS_FILE} ${XRAY_COMPAT_USERS_FILE} ${XRAY_DISABLED_USERS_FILE} ${SUBS_ALIASES_FILE} ${USER_META_DIR}/*.env ${SUBS_DIR}/*.token 2>/dev/null || true; ${sudo_cmd}chmod 644 ${CREDENTIALS_PUBLIC_KEY} 2>/dev/null || true; sync_status=0; if ${sudo_cmd}test -x ${SCRIPT_PATH}; then if ${sudo_cmd}test -x ${CADDY_BIN} && ${sudo_cmd}test -f ${CADDYFILE}; then ${sudo_cmd}bash ${SCRIPT_PATH} safe-apply || sync_status=20; fi; if ${sudo_cmd}test -x ${HYSTERIA_BIN} || ${sudo_cmd}test -f ${HYSTERIA_CONFIG}; then ${sudo_cmd}bash ${SCRIPT_PATH} hysteria-sync >/dev/null 2>&1 || sync_status=21; fi; if ${sudo_cmd}test -x ${XRAY_BIN} || ${sudo_cmd}test -f ${XRAY_CONFIG}; then ${sudo_cmd}bash ${SCRIPT_PATH} xray-rebuild >/dev/null 2>&1 || sync_status=22; fi; ${sudo_cmd}bash ${SCRIPT_PATH} nodes-subscriptions >/dev/null 2>&1 || sync_status=23; else sync_status=24; fi; exit \$sync_status"; then
ok "Users synced: ${node_name}"
else
err "Sync failed: ${node_name}"
failed=1
fi
done
rm -f "$archive"
if [[ "$failed" -eq 0 ]]; then
rm -f "$NODES_PENDING_SYNC_FILE"
else
touch "$NODES_PENDING_SYNC_FILE"
chmod 600 "$NODES_PENDING_SYNC_FILE"
fi
return "$failed"
}
node_links_for_user() {
local user="$1" pass="$2" expiry_tag="${3:-active}"
[[ -n "$pass" ]] || return 0
[[ -f "$NODES_FILE" ]] || return 0
nodes_list_lines | while IFS='|' read -r name host port ssh_user node_domain role weight enabled; do
[[ "$enabled" == "1" ]] || continue
[[ "${role:-edge}" == "edge" ]] || continue
[[ -n "$node_domain" && "$node_domain" != "-" ]] || continue
is_valid_domain "$node_domain" || continue
subscription_node_core_enabled "$name" || continue
printf 'naive+https://%s:%s@%s:443#%s\n' "$user" "$pass" "$node_domain" \
"$(uri_fragment_encode "$(pretty_profile_name "$user" "HTTPS" "$name")")"
done
}
naive_extra_links_for_user() {
local user="$1" pass="$2" expiry_tag="${3:-active}" configured entry host node
local -a entries=()
local -A seen_hosts=()
is_valid_proxy_user "$user" || return 1
subscription_name_in_list "$user" "${NAIVE_EXTRA_USERS:-}" || return 0
configured="${NAIVE_EXTRA_PROFILES:-}"
[[ -n "$configured" && -n "$pass" ]] || return 0
is_valid_proxy_pass "$pass" || return 1
IFS=';' read -r -a entries <<< "$configured"
for entry in "${entries[@]}"; do
entry=$(printf '%s' "$entry" | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//')
[[ -n "$entry" ]] || continue
[[ "$entry" == *"|"* ]] || return 1
host="${entry%%|*}"
node="${entry#*|}"
host=$(printf '%s' "$host" | tr '[:upper:]' '[:lower:]' | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//')
node=$(printf '%s' "$node" | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//')
is_valid_domain "$host" || return 1
[[ "$node" =~ ^[A-Za-z0-9_-]{1,32}$ ]] || return 1
[[ -z "${seen_hosts[$host]+x}" ]] || continue
seen_hosts["$host"]=1
printf 'naive+https://%s:%s@%s:443#%s\n' "$user" "$pass" "$host" \
"$(uri_fragment_encode "$(pretty_profile_name "$user" "HTTPS" "$node")")"
done
}
subscription_http_node_sources_is_valid() {
local configured="${1:-}" entry node domain ip extra count=0
local -a entries=()
[[ -z "$configured" ]] && return 0
IFS=';' read -r -a entries <<< "$configured"
for entry in "${entries[@]}"; do
entry=$(printf '%s' "$entry" | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//')
[[ -n "$entry" ]] || continue
count=$((count + 1))
(( count <= 16 )) || return 1
IFS='|' read -r node domain ip extra <<< "$entry"
[[ -z "$extra" ]] || return 1
is_valid_node_name "$node" || return 1
is_valid_domain "$domain" || return 1
is_valid_ipv4 "$ip" || return 1
done
(( count > 0 ))
}
subscription_http_node_links_for_user() {
local user="$1" configured entry node domain ip extra token token_file tmp candidate authority endpoint host protocol accepted
local -a entries=()
is_valid_proxy_user "$user" || return 1
configured="${SUBSCRIPTION_HTTP_NODE_SOURCES:-}"
[[ -n "$configured" ]] || return 0
subscription_http_node_sources_is_valid "$configured" || return 1
token_file="${SUBS_DIR}/${user}.token"
token=$(cat "$token_file" 2>/dev/null || true)
[[ "$token" =~ ^[a-fA-F0-9]{32,64}$ ]] || return 1
IFS=';' read -r -a entries <<< "$configured"
for entry in "${entries[@]}"; do
entry=$(printf '%s' "$entry" | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//')
[[ -n "$entry" ]] || continue
IFS='|' read -r node domain ip extra <<< "$entry"
tmp=$(mktemp /tmp/yurich-http-node-links-XXXXXX) || return 1
chmod 600 "$tmp"
if ! curl --proto '=https' --tlsv1.2 -fsS \
--connect-timeout 5 --max-time 15 --max-filesize 1048576 \
--resolve "${domain}:443:${ip}" \
"https://${domain}/s/${token}/links.txt" -o "$tmp" 2>/dev/null; then
rm -f "$tmp"
return 1
fi
accepted=0
while IFS= read -r candidate || [[ -n "$candidate" ]]; do
[[ -n "$candidate" && "$candidate" != \#* ]] || continue
protocol_line_allowed "$candidate" || continue
authority="${candidate#*://}"
authority="${authority%%[/?#]*}"
endpoint="${authority##*@}"
host="${endpoint%:*}"
[[ "${host,,}" == "${domain,,}" ]] || continue
case "$candidate" in
naive+https://*) protocol="HTTPS" ;;
hy2://*|hysteria2://*) protocol="Turbo" ;;
vless://*type=xhttp*) protocol="XHTTP" ;;
vless://*security=reality*) protocol="Reality" ;;
*) continue ;;
esac
uri_with_profile_name "$candidate" "$(pretty_profile_name "$user" "$protocol" "$node")"
accepted=$((accepted + 1))
done < "$tmp"
rm -f "$tmp"
(( accepted > 0 )) || return 1
done
}
browser_subscription_node_is_enabled() {
local node_name="$1" browser_host="${2:-}" line _name _host _port _user _domain _role _weight enabled
[[ -n "$node_name" ]] || return 1
subscription_node_relay_only "$node_name" && return 1
# Backward compatibility: custom browser labels that are not registered nodes
# remain valid. Registered nodes always obey their enabled flag.
if ! line=$(nodes_get_line "$node_name" 2>/dev/null); then
if is_valid_domain "$browser_host"; then
while IFS='|' read -r _name _host _port _user _domain _role _weight enabled; do
if [[ "${_domain,,}" == "${browser_host,,}" ]]; then
[[ "$enabled" == "1" ]]
return
fi
done < <(nodes_list_lines)
fi
return 0
fi
IFS='|' read -r _name _host _port _user _domain _role _weight enabled <<< "$line"
[[ "$enabled" == "1" ]]
}
browser_subscription_links_for_user() {
local user="$1" pass="$2" configured entry host node emit_profiles=1
local -a entries=()
local -A seen_hosts=()
is_valid_proxy_user "$user" || return 1
configured="${BROWSER_SUBSCRIPTION_PROFILES:-}"
[[ -n "$configured" ]] || return 0
if [[ -z "$pass" ]]; then
emit_profiles=0
else
is_valid_proxy_pass "$pass" || return 1
fi
IFS=';' read -r -a entries <<< "$configured"
for entry in "${entries[@]}"; do
entry=$(printf '%s' "$entry" | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//')
[[ -n "$entry" ]] || continue
[[ "$entry" == *"|"* ]] || return 1
host="${entry%%|*}"
node="${entry#*|}"
host=$(printf '%s' "$host" | tr '[:upper:]' '[:lower:]' | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//')
node=$(printf '%s' "$node" | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//')
is_valid_domain "$host" || return 1
[[ "$node" =~ ^[A-Za-z0-9_-]{1,32}$ ]] || return 1
browser_subscription_node_is_enabled "$node" "$host" || continue
[[ -z "${seen_hosts[$host]+x}" ]] || continue
seen_hosts["$host"]=1
if [[ "$emit_profiles" == "1" ]]; then
uri_with_profile_name \
"https://${user}:${pass}@${host}:443" \
"$(pretty_profile_name "$user" "Browser HTTPS" "$node")"
fi
done
}
node_xhttp_link_for_user() {
local user="$1" node_name="$2" node_domain="$3" uuid
[[ -n "$user" && -n "$node_domain" ]] || return 0
is_valid_domain "$node_domain" || return 0
uuid=$(get_xray_user_uuid "$user" 2>/dev/null || true)
[[ -n "$uuid" ]] || return 0
printf 'vless://%s@%s:443?encryption=none&security=tls&type=xhttp&host=%s&path=%%2Fxhttp&mode=packet-up&sni=%s&fp=chrome&alpn=h2#%s\n' \
"$uuid" "$node_domain" "$node_domain" "$node_domain" \
"$(uri_fragment_encode "$(pretty_profile_name "$user" "XHTTP" "$node_name")")"
}
subscription_name_in_list() {
local needle="$1" raw_list="$2" item
[[ -n "$needle" && -n "$raw_list" ]] || return 1
raw_list="${raw_list//,/ }"
for item in $raw_list; do
[[ "$item" == "*" || "$item" == "all" || "$item" == "$needle" ]] && return 0
done
return 1
}
subscription_node_xhttp_enabled() {
local node_name="$1" xhttp_nodes="${SUBSCRIPTION_XHTTP_NODE_NAMES:-all}"
subscription_name_in_list "$node_name" "$xhttp_nodes"
}
subscription_user_xhttp_enabled() {
local user="$1" node_name="$2"
local canary_users="${SUBSCRIPTION_XHTTP_CANARY_USERS:-}"
subscription_node_xhttp_enabled "$node_name" && return 0
subscription_name_in_list "$node_name" "${SUBSCRIPTION_XHTTP_CANARY_NODE_NAMES:-}" || return 1
[[ "$canary_users" == "*" ]] && return 0
subscription_name_in_list "$user" "$canary_users"
}
subscription_node_core_enabled() {
local node_name="$1"
subscription_node_relay_only "$node_name" && return 1
if [[ "${SUBSCRIPTION_XHTTP_NODE_EXCLUSIVE:-0}" == "1" ]] && subscription_node_xhttp_enabled "$node_name"; then
return 1
fi
return 0
}
subscription_node_relay_only() {
local node_name="$1"
subscription_name_in_list "$node_name" "${SUBSCRIPTION_RELAY_ONLY_NODE_NAMES:-}"
}
cmd_node_subscription_export() {
load_config
load_users
local selected_user="${1:-}" user hy2_uri uuid reality_link reality_public_port
local hysteria_active=0 xray_active=0
if [[ -n "$selected_user" ]]; then
is_valid_proxy_user "$selected_user" || return 1
subscription_user_exists "$selected_user" || return 1
fi
systemctl is-active --quiet hysteria 2>/dev/null && hysteria_active=1
systemctl is-active --quiet xray 2>/dev/null && xray_active=1
reality_public_port=$(xray_reality_public_port)
while IFS= read -r user; do
[[ -n "$user" ]] || continue
[[ -z "$selected_user" || "$user" == "$selected_user" ]] || continue
user_is_expired "$user" && continue
if [[ "$hysteria_active" -eq 1 && -n "${HYSTERIA_OBFS_PASSWORD:-}" ]]; then
hy2_uri=$(hysteria_uri_for_user "$user" 2>/dev/null || true)
if [[ -n "$hy2_uri" ]]; then
hy2_uri=$(uri_with_profile_name "$hy2_uri" "$(pretty_profile_name "$user" "Turbo")")
printf '%s\t%s\n' "$user" "$hy2_uri"
fi
fi
if [[ "$xray_active" -eq 1 && -n "${XRAY_REALITY_PUBLIC_KEY:-}" && -n "${XRAY_REALITY_SHORT_ID:-}" ]]; then
uuid=$(get_xray_user_uuid "$user" 2>/dev/null || true)
if [[ -n "$uuid" ]]; then
reality_link=$(uri_with_profile_name \
"vless://${uuid}@${DOMAIN}:${reality_public_port}?encryption=none&security=reality&type=tcp&flow=xtls-rprx-vision&sni=${XRAY_REALITY_SERVER_NAME:-www.microsoft.com}&fp=chrome&pbk=${XRAY_REALITY_PUBLIC_KEY}&sid=${XRAY_REALITY_SHORT_ID}&spx=%2F" \
"$(pretty_profile_name "$user" "Reality")")
printf '%s\t%s\n' "$user" "$reality_link"
fi
fi
done < <(list_subscription_users)
}
subscription_node_cache_ready() {
local node_name="$1" cache_dir="${SUBSCRIPTION_NODE_LINK_CACHE_DIR:-}"
[[ -n "$cache_dir" && -d "$cache_dir" && -f "$cache_dir/.ready.${node_name}" ]]
}
subscription_node_cached_links_for_user() {
local user="$1" node_name="$2" cache_dir="${SUBSCRIPTION_NODE_LINK_CACHE_DIR:-}" cache_file
is_valid_proxy_user "$user" || return 1
is_valid_node_name "$node_name" || return 1
cache_file="${cache_dir}/${user}.links"
[[ -f "$cache_file" ]] || return 0
awk -F '\t' -v node="$node_name" '$1 == node {print substr($0, index($0, "\t") + 1)}' "$cache_file"
}
subscription_prepare_node_link_cache() {
local cache_dir="$1" line name host port ssh_user node_domain role weight enabled
local sudo_cmd remote_script remote_b64 remote_cmd output cache_user candidate ready=0
[[ -d "$cache_dir" ]] || return 1
while IFS='|' read -r name host port ssh_user node_domain role weight enabled; do
[[ "$enabled" == "1" ]] || continue
[[ -n "$node_domain" && "$node_domain" != "-" ]] || continue
is_valid_domain "$node_domain" || continue
subscription_node_core_enabled "$name" || continue
line="${name}|${host}|${port}|${ssh_user}|${node_domain}|${role}|${weight}|${enabled}"
sudo_cmd=$(nodes_remote_sudo_prefix "$ssh_user")
remote_script=$(cat <<'EOS'
set -euo pipefail
if [[ -x /usr/local/bin/yurich-panel.sh ]]; then
if grep -q 'node-subscription-export)' /usr/local/bin/yurich-panel.sh 2>/dev/null; then
/usr/local/bin/yurich-panel.sh node-subscription-export
exit 0
fi
/usr/local/bin/yurich-panel.sh nodes-subscriptions >/dev/null 2>&1
fi
shopt -s nullglob
for token_file in /etc/naiveproxy/subscriptions/*.token; do
user=${token_file##*/}
user=${user%.token}
[[ "$user" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,63}$ ]] || continue
token=$(tr -dc 'a-fA-F0-9' < "$token_file" | head -c 64)
[[ "$token" =~ ^[a-fA-F0-9]{32,64}$ ]] || continue
links="/var/www/html/s/${token}/links.txt"
[[ -s "$links" ]] || continue
if systemctl is-active --quiet hysteria 2>/dev/null; then
awk -v user="$user" '/^(hy2:\/\/|hysteria2:\/\/)/ && $0 !~ /[Hh]op/ {printf "%s\t%s\n", user, $0}' "$links"
fi
if systemctl is-active --quiet xray 2>/dev/null; then
awk -v user="$user" '/^vless:\/\// && /security=reality/ && /type=tcp/ {printf "%s\t%s\n", user, $0}' "$links"
fi
done
EOS
)
remote_b64=$(printf '%s' "$remote_script" | base64 -w0)
remote_cmd="${sudo_cmd}bash -c 'printf %s ${remote_b64} | base64 -d | bash'"
if ! output=$(nodes_ssh "$line" "$remote_cmd" 2>/dev/null); then
warn "Node cache недоступен: ${name}; будет использован точечный SSH fallback"
continue
fi
while IFS=$'\t' read -r cache_user candidate; do
is_valid_proxy_user "$cache_user" || continue
[[ "$candidate" == *"@${node_domain}:"* ]] || continue
protocol_line_allowed "$candidate" || continue
printf '%s\t%s\n' "$name" "$candidate" >> "${cache_dir}/${cache_user}.links"
chmod 600 "${cache_dir}/${cache_user}.links"
done <<< "$output"
: > "$cache_dir/.ready.${name}"
chmod 600 "$cache_dir/.ready.${name}"
ready=$((ready + 1))
done < <(nodes_list_lines)
[[ "$ready" -gt 0 ]]
}
node_app_links_for_user() {
local user="$1"
[[ -n "$user" ]] || return 0
[[ -f "$NODES_FILE" ]] || return 0
nodes_list_lines | while IFS='|' read -r name host port ssh_user node_domain role weight enabled; do
[[ "$enabled" == "1" ]] || continue
[[ -n "$node_domain" && "$node_domain" != "-" ]] || continue
is_valid_domain "$node_domain" || continue
local line sudo_cmd remote_cmd
line="${name}|${host}|${port}|${ssh_user}|${node_domain}|${role}|${weight}|${enabled}"
if subscription_node_relay_only "$name"; then
continue
fi
if ! subscription_node_core_enabled "$name"; then
if [[ "${SUBSCRIPTION_XHTTP_MAIN_ENABLED:-1}" == "1" ]]; then
subscription_user_xhttp_enabled "$user" "$name" && node_xhttp_link_for_user "$user" "$name" "$node_domain"
fi
continue
fi
if subscription_node_cache_ready "$name"; then
subscription_node_cached_links_for_user "$user" "$name"
if [[ "${SUBSCRIPTION_XHTTP_MAIN_ENABLED:-1}" == "1" ]]; then
subscription_user_xhttp_enabled "$user" "$name" && node_xhttp_link_for_user "$user" "$name" "$node_domain"
fi
continue
fi
sudo_cmd=$(nodes_remote_sudo_prefix "$ssh_user")
remote_cmd="${sudo_cmd}bash -lc 'u=\"${user}\"; token_file=\"/etc/naiveproxy/subscriptions/\${u}.token\"; token=\$(cat \"\$token_file\" 2>/dev/null || true); links=\"/var/www/html/s/\${token}/links.txt\"; if { [ -z \"\$token\" ] || [ ! -s \"\$links\" ]; } && [ -x /usr/local/bin/yurich-panel.sh ]; then bash /usr/local/bin/yurich-panel.sh nodes-subscriptions >/dev/null 2>&1 || true; token=\$(cat \"\$token_file\" 2>/dev/null || true); links=\"/var/www/html/s/\${token}/links.txt\"; fi; if [ -s \"\$links\" ]; then if systemctl is-active --quiet hysteria 2>/dev/null; then awk '\''/^(hy2:\\/\\/|hysteria2:\\/\\/)/ && \$0 !~ /[Hh]op/ {print}'\'' \"\$links\" || true; fi; if systemctl is-active --quiet xray 2>/dev/null; then awk '\''/^vless:\\/\\// && \$0 ~ /security=reality/ && \$0 ~ /type=tcp/ && \$0 ~ /^vless:\\/\\/[^@]+@[^/?#]+:[0-9]+\\?/ {print}'\'' \"\$links\" || true; fi; fi'"
local output attempt fetched=0
for ((attempt = 1; attempt <= 3; attempt++)); do
if output=$(nodes_ssh "$line" "$remote_cmd" 2>/dev/null); then
fetched=1
[[ -n "$output" ]] && printf '%s\n' "$output" | awk -v domain="$node_domain" 'index($0, "@" domain ":")'
if [[ "${SUBSCRIPTION_XHTTP_MAIN_ENABLED:-1}" == "1" ]]; then
subscription_user_xhttp_enabled "$user" "$name" && node_xhttp_link_for_user "$user" "$name" "$node_domain"
fi
break
fi
sleep 2
done
if (( fetched == 0 )); then
err "SSH node ${name} недоступен при сборке подписки ${user}"
return 1
fi
done
}
node_relay_source_link_for_user() {
local user="$1" line="$2" node_domain="$3" transport="$4"
local node_name node_host node_port node_user node_role node_weight node_enabled
local sudo_cmd remote_cmd output quoted_user awk_filter
is_valid_proxy_user "$user" || return 1
nodes_validate_line "$line" || return 1
is_valid_domain "$node_domain" || return 1
case "$transport" in
reality)
awk_filter='/^vless:\/\// && /security=reality/ && /type=tcp/ {print; exit}'
;;
xhttp)
awk_filter='/^vless:\/\// && /security=tls/ && /type=xhttp/ {print; exit}'
;;
*) return 1 ;;
esac
IFS='|' read -r node_name node_host node_port node_user _ node_role node_weight node_enabled <<< "$line"
sudo_cmd=$(nodes_remote_sudo_prefix "$node_user")
printf -v quoted_user '%q' "$user"
remote_cmd="${sudo_cmd}bash -lc 'u=${quoted_user}; token_file=\"/etc/naiveproxy/subscriptions/\${u}.token\"; token=\$(tr -dc \"a-fA-F0-9\" < \"\$token_file\" 2>/dev/null | head -c 64); links=\"/var/www/html/s/\${token}/links.txt\"; [ -s \"\$links\" ] || exit 3; awk '\''${awk_filter}'\'' \"\$links\"'"
output=$(nodes_ssh "$line" "$remote_cmd") || return 1
printf '%s\n' "$output" | awk -v authority="@${node_domain}:443?" 'index($0, authority) {print; exit}'
}
subscription_vless_relay_links_for_user() {
local user="$1" source_links="$2" configured entry source_node relay_host relay_port transports
local node_line node_host node_port node_user source_domain node_role node_weight node_enabled
local transport source_link relay_link protocol_label
local -a entries=()
local -A seen=()
[[ -n "$user" ]] || return 0
subscription_name_in_list "$user" "${VLESS_RELAY_USERS:-}" || return 0
configured="${VLESS_RELAY_PROFILES:-}"
[[ -n "$configured" ]] || return 0
IFS=';' read -r -a entries <<< "$configured"
for entry in "${entries[@]}"; do
entry=$(printf '%s' "$entry" | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//')
[[ -n "$entry" ]] || continue
IFS='|' read -r source_node relay_host relay_port transports <<< "$entry"
[[ "$source_node" =~ ^[A-Za-z0-9_-]{1,32}$ ]] || return 1
is_valid_domain "$relay_host" || return 1
[[ "$relay_port" =~ ^[0-9]{2,5}$ ]] && ((relay_port >= 1024 && relay_port <= 65535)) || return 1
if [[ "$source_node" == "local" ]]; then
node_line=""
source_domain="$DOMAIN"
else
node_line=$(nodes_get_line "$source_node" 2>/dev/null) || return 1
IFS='|' read -r _ node_host node_port node_user source_domain node_role node_weight node_enabled <<< "$node_line"
fi
is_valid_domain "$source_domain" || return 1
transports="${transports//,/ }"
for transport in $transports; do
case "$transport" in
reality)
source_link=$(printf '%s\n' "$source_links" | awk -v authority="@${source_domain}:443?" '
/^vless:\/\// && index($0, authority) && /security=reality/ && /type=tcp/ {print; exit}
')
protocol_label="Reality Relay"
;;
xhttp)
source_link=$(printf '%s\n' "$source_links" | awk -v authority="@${source_domain}:443?" '
/^vless:\/\// && index($0, authority) && /security=tls/ && /type=xhttp/ {print; exit}
')
protocol_label="XHTTP Relay"
;;
*) return 1 ;;
esac
if [[ -z "$source_link" && "$source_node" != "local" ]]; then
source_link=$(node_relay_source_link_for_user "$user" "$node_line" "$source_domain" "$transport") || return 1
fi
[[ -n "$source_link" ]] || return 1
relay_link="${source_link%%#*}"
relay_link="${relay_link/@${source_domain}:443/@${relay_host}:${relay_port}}"
if [[ "$source_node" == "local" ]]; then
relay_link=$(uri_with_profile_name "$relay_link" "$(pretty_profile_name "$user" "$protocol_label")")
else
relay_link=$(uri_with_profile_name "$relay_link" "$(pretty_profile_name "$user" "$protocol_label" "$source_node")")
fi
[[ -z "${seen[$relay_link]+x}" ]] || continue
seen["$relay_link"]=1
printf '%s\n' "$relay_link"
done
done
}
subscription_filter_published_links() {
awk '
/Reality GitHub TEST/ { next }
/spx=%2Fgithub-test-/ { next }
NF && !seen[$0]++ { print }
'
}
subscription_rebuild_worker_count() {
local requested="${SUBSCRIPTION_REBUILD_JOBS:-0}" cpu_count
if is_canonical_uint_in_range "$requested" 1 8; then
printf '%s\n' "$requested"
return 0
fi
cpu_count=$(nproc 2>/dev/null || echo 1)
[[ "$cpu_count" =~ ^[0-9]+$ && "$cpu_count" -gt 0 ]] || cpu_count=1
(( cpu_count > 4 )) && cpu_count=4
printf '%s\n' "$cpu_count"
}
subscription_generate_pages_parallel() {
local jobs="$1" log_dir="$2" users_file="$3"
local user log_file pid failed=0 seq=0
local -a worker_pids=() worker_users=() worker_logs=()
is_canonical_uint_in_range "$jobs" 1 8 || return 1
[[ -d "$log_dir" && -f "$users_file" ]] || return 1
while IFS= read -r user; do
[[ -n "$user" ]] || continue
seq=$((seq + 1))
if ! is_valid_proxy_user "$user"; then
printf 'FAIL\tinvalid-entry-%s\n' "$seq"
failed=1
continue
fi
log_file="${log_dir}/${seq}-${user}.log"
(
SUBSCRIPTION_REBUILD_WORKER=1
generate_subscription_page "$user"
) >"$log_file" 2>&1 &
pid=$!
worker_pids+=("$pid")
worker_users+=("$user")
worker_logs+=("$log_file")
if (( ${#worker_pids[@]} >= jobs )); then
if wait "${worker_pids[0]}"; then
printf 'OK\t%s\n' "${worker_users[0]}"
rm -f -- "${worker_logs[0]}"
else
printf 'FAIL\t%s\n' "${worker_users[0]}"
failed=1
fi
worker_pids=("${worker_pids[@]:1}")
worker_users=("${worker_users[@]:1}")
worker_logs=("${worker_logs[@]:1}")
fi
done < "$users_file"
while (( ${#worker_pids[@]} > 0 )); do
if wait "${worker_pids[0]}"; then
printf 'OK\t%s\n' "${worker_users[0]}"
rm -f -- "${worker_logs[0]}"
else
printf 'FAIL\t%s\n' "${worker_users[0]}"
failed=1
fi
worker_pids=("${worker_pids[@]:1}")
worker_users=("${worker_users[@]:1}")
worker_logs=("${worker_logs[@]:1}")
done
return "$failed"
}
cmd_nodes_rebuild_subscriptions() {
load_config
load_users
local lock_fd cache_dir="" build_log_dir="" active_users_file="" results_file=""
local failed=0 failed_users="" jobs status user expected=0 result_count=0
install -d -m 755 /run/lock
exec {lock_fd}>/run/lock/yurich-subscription-rebuild.lock
if ! flock -n "$lock_fd"; then
err "Другая пересборка подписок уже выполняется"
return 75
fi
cleanup_orphan_subscription_pages
ensure_web_privacy_files
subscription_build_traffic_cache >/dev/null 2>&1 || true
ensure_qrencode_for_subscriptions >/dev/null 2>&1 || warn "qrencode недоступен; QR-коды будут пропущены"
local count=0
if [[ "${SUBSCRIPTION_NODE_PREFETCH_ENABLED:-1}" == "1" && "$(nodes_count 2>/dev/null || echo 0)" -gt 0 ]]; then
cache_dir=$(mktemp -d /run/yurich-subscription-cache.XXXXXX)
chmod 700 "$cache_dir"
if subscription_prepare_node_link_cache "$cache_dir"; then
SUBSCRIPTION_NODE_LINK_CACHE_DIR="$cache_dir"
else
warn "Пакетный cache нод не собран полностью; включён совместимый SSH fallback"
fi
fi
active_users_file=$(mktemp /tmp/yurich-subscription-users.XXXXXX) || return 1
results_file=$(mktemp /tmp/yurich-subscription-results.XXXXXX) || { rm -f -- "$active_users_file"; return 1; }
build_log_dir=$(mktemp -d /tmp/yurich-subscription-logs.XXXXXX) || { rm -f -- "$active_users_file" "$results_file"; return 1; }
chmod 600 "$active_users_file" "$results_file"
chmod 700 "$build_log_dir"
while IFS= read -r user; do
[[ -z "$user" ]] && continue
if user_is_expired "$user"; then
cleanup_subscription_page "$user"
continue
fi
printf '%s\n' "$user" >> "$active_users_file"
done < <(list_subscription_users)
jobs=$(subscription_rebuild_worker_count)
info "Пересборка подписок: workers=${jobs}"
subscription_generate_pages_parallel "$jobs" "$build_log_dir" "$active_users_file" > "$results_file" || true
while IFS=$'\t' read -r status user; do
[[ -n "$user" ]] || continue
result_count=$((result_count + 1))
if [[ "$status" == "OK" ]]; then
count=$((count + 1))
else
failed=$((failed + 1))
failed_users+=" ${user}"
fi
done < "$results_file"
expected=$(awk 'NF{c++} END{print c+0}' "$active_users_file")
if [[ "$result_count" -ne "$expected" ]]; then
failed=$((failed + 1))
failed_users+=" internal-worker-result"
fi
find "$build_log_dir" -xdev -mindepth 1 -type f -delete 2>/dev/null || true
rmdir "$build_log_dir" 2>/dev/null || true
rm -f -- "$active_users_file" "$results_file"
unset SUBSCRIPTION_NODE_LINK_CACHE_DIR
if [[ -n "$cache_dir" && -d "$cache_dir" ]]; then
find "$cache_dir" -mindepth 1 -maxdepth 1 -type f -delete
rmdir "$cache_dir" 2>/dev/null || true
fi
if [[ "$failed" -gt 0 ]]; then
err "Не пересобраны подписки:${failed_users}"
err "Успешно: ${count}, ошибок: ${failed}; прежние страницы сохранены"
return 1
fi
apply_subscription_aliases >/dev/null 2>&1 || { err "Не удалось обновить alias URL"; return 1; }
ok "Пересобраны страницы подписки: ${count}"
}
cmd_subscription_rebuild_clean() {
load_config
load_users
local forbidden="${1:-}" failed=0 item matches
cmd_nodes_rebuild_subscriptions || failed=1
cleanup_orphan_subscription_pages
if [[ -n "$forbidden" ]]; then
forbidden="${forbidden//,/ }"
for item in $forbidden; do
[[ -z "$item" ]] && continue
matches=$(grep -R -n --exclude='*.png' -- "$item" "$SUBS_WEB_DIR" 2>/dev/null | head -n 20 || true)
if [[ -n "$matches" ]]; then
printf '%s\n' "$matches"
err "Запрещённый домен всё ещё найден в подписках: $item"
failed=1
else
ok "Запрещённый домен не найден: $item"
fi
done
fi
cmd_protocol_validate || failed=1
[[ "$failed" -eq 0 ]]
}
protocol_line_allowed() {
local line="${1:-}"
[[ -z "$line" || "$line" == \#* ]] && return 0
case "$line" in
naive+https://*) return 0 ;;
hy2://*|hysteria2://*)
[[ "$line" != *"Hop"* && "$line" != *"Hysteria2%20Hop"* ]]
return
;;
vless://*)
if [[ "$line" == *"type=xhttp"* ]]; then
[[ "$line" == *"security=tls"* && "$line" == *"path=%2Fxhttp"* && "$line" == *"mode=packet-up"* && "$line" == *"alpn=h2"* && "$line" =~ ^vless://[^@]+@[^/?#]+:[0-9]{1,5}\? ]]
return
fi
[[ "$line" == *"security=reality"* && "$line" == *"type=tcp"* && "$line" =~ ^vless://[^@]+@[^/?#]+:[0-9]{1,5}\? ]]
return
;;
esac
return 1
}
protocol_line_forbidden() {
local line="${1:-}"
[[ -z "$line" || "$line" == \#* ]] && return 1
[[ "$line" == *"type=ws"* ]] && return 0
[[ "$line" == *"type=httpupgrade"* ]] && return 0
[[ "$line" == *"type=kcp"* ]] && return 0
[[ "$line" == *"security=tls"* && "$line" != *"type=xhttp"* ]] && return 0
[[ "$line" == *"VLESS%20Vision"* ]] && return 0
[[ "$line" == *"VLESS%20WebSocket"* ]] && return 0
[[ "$line" == *"VLESS%20HTTPUpgrade"* ]] && return 0
[[ "$line" == *"VLESS%20mKCP"* ]] && return 0
[[ "$line" == *"Hysteria2%20Hop"* || "$line" == *"Hop%20"* ]] && return 0
[[ "$line" == vless://* && ! "$line" =~ ^vless://[^@]+@[^/?#]+:[0-9]{1,5}\? ]] && return 0
return 1
}
cmd_protocol_validate() {
load_config
load_users
local failed=0 checked=0 user token file line count bad files
files="links.txt hiddify.txt streisand.txt happ.txt nekobox.txt v2rayng.txt"
while IFS= read -r user; do
[[ -z "$user" ]] && continue
if user_is_expired "$user"; then
printf 'SKIP %-24s expired\n' "$user"
continue
fi
token=$(cat "${SUBS_DIR}/${user}.token" 2>/dev/null || true)
if [[ -z "$token" ]]; then
printf 'FAIL %-24s no_token\n' "$user"
failed=$((failed + 1))
continue
fi
for file in $files; do
local path="${SUBS_WEB_DIR}/${token}/${file}"
if [[ ! -s "$path" ]]; then
printf 'FAIL %-24s %s missing\n' "$user" "$file"
failed=$((failed + 1))
continue
fi
count=0
bad=0
while IFS= read -r line || [[ -n "$line" ]]; do
[[ -z "$line" || "$line" == \#* ]] && continue
count=$((count + 1))
if protocol_line_forbidden "$line" || ! protocol_line_allowed "$line"; then
bad=$((bad + 1))
fi
done < "$path"
checked=$((checked + 1))
if [[ "$bad" -gt 0 ]]; then
printf 'FAIL %-24s %s lines=%s bad=%s\n' "$user" "$file" "$count" "$bad"
failed=$((failed + 1))
else
printf 'OK %-24s %s lines=%s\n' "$user" "$file" "$count"
fi
done
done < <(list_subscription_users)
printf 'protocol validate: checked=%s failed=%s\n' "$checked" "$failed"
[[ "$failed" -eq 0 ]]
}
cmd_protocol_benchmark() {
load_config
load_users
local user="${1:-}" rounds="${2:-1}" token links_file tmp_py
if [[ -z "$user" ]]; then
echo -ne "${CYAN}Пользователь: ${RESET}"
read -r user
fi
if ! is_valid_proxy_user "$user" || ! subscription_user_exists "$user"; then
err "Пользователь не найден: ${user:-empty}"
return 1
fi
is_canonical_uint_in_range "$rounds" 1 5 || rounds=1
generate_subscription_page "$user" >/dev/null 2>&1 || true
token=$(cat "${SUBS_DIR}/${user}.token" 2>/dev/null || true)
links_file="${SUBS_WEB_DIR}/${token}/links.txt"
if [[ -z "$token" || ! -s "$links_file" ]]; then
err "links.txt не найден для пользователя: $user"
return 1
fi
tmp_py=$(mktemp /tmp/yurich-protocol-benchmark-XXXXXX.py)
cat > "$tmp_py" <<'PY'
import csv
import datetime as dt
import json
import os
import re
import socket
import subprocess
import sys
import tempfile
import time
from pathlib import Path
from urllib.parse import parse_qs, unquote, urlsplit
links_path = Path(sys.argv[1])
rounds = int(sys.argv[2])
lines = [x.strip() for x in links_path.read_text(encoding="utf-8", errors="replace").splitlines() if x.strip() and not x.startswith("#")]
csv_path = os.environ.get("YURICH_BENCHMARK_CSV", "").strip()
csv_user = os.environ.get("YURICH_BENCHMARK_USER", "").strip()
try:
slow_threshold_ms = int(os.environ.get("YURICH_BENCHMARK_MAX_AVG_MS", "2500"))
except Exception:
slow_threshold_ms = 2500
if slow_threshold_ms < 1:
slow_threshold_ms = 2500
profiles = []
for line in lines:
u = urlsplit(line)
qs = parse_qs(u.query, keep_blank_values=True)
profiles.append({
"scheme": u.scheme.lower(),
"host": u.hostname or "",
"port": u.port or 443,
"name": unquote(u.fragment or ""),
"username": unquote(u.username or ""),
"password": unquote(u.password or ""),
"qs": {k: v[0] for k, v in qs.items()},
})
def wait_port(port, timeout=8.0):
end = time.time() + timeout
while time.time() < end:
try:
with socket.create_connection(("127.0.0.1", port), timeout=0.2):
return True
except Exception:
time.sleep(0.1)
return False
def allocate_local_port():
with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
sock.bind(("127.0.0.1", 0))
return sock.getsockname()[1]
def stop_process(proc):
if not proc:
return
try:
proc.terminate()
proc.wait(timeout=2)
except Exception:
try:
proc.kill()
proc.wait(timeout=1)
except Exception:
pass
def safe_client_log(log_path):
try:
text = Path(log_path).read_text(encoding="utf-8", errors="replace")
except Exception:
return "client log unavailable"
text = re.sub(r"(?i)(hy2|hysteria2)://[^@\s]+@", r"\1://[redacted]@", text)
text = re.sub(r"(?i)\b(auth|password|token)\b(\s*[:=]\s*)\S+", r"\1\2[redacted]", text)
lines = [line.strip() for line in text.splitlines() if line.strip()]
return " | ".join(lines[-3:])[-240:] if lines else "client exited without log"
def start_local_client(profile, socks_port, log_path):
scheme = profile["scheme"]
if scheme in ("hy2", "hysteria2"):
qs = profile["qs"]
auth = profile["username"] + ((":" + profile["password"]) if profile["password"] else "")
auth = auth or qs.get("auth", "")
yaml_string = lambda value: json.dumps(str(value), ensure_ascii=False)
server_address = f"{profile['host']}:{profile['port']}"
socks_address = f"127.0.0.1:{socks_port}"
text = (
f"server: {yaml_string(server_address)}\n"
f"auth: {yaml_string(auth)}\n"
"tls:\n"
f" sni: {yaml_string(qs.get('sni', profile['host']))}\n"
" insecure: false\n"
"obfs:\n"
f" type: {yaml_string(qs.get('obfs', 'salamander'))}\n"
" salamander:\n"
f" password: {yaml_string(qs.get('obfs-password', ''))}\n"
"socks5:\n"
f" listen: {yaml_string(socks_address)}\n"
)
suffix = ".yaml"
command = lambda cfg: ["hysteria", "client", "-c", cfg]
elif scheme == "vless":
qs = profile["qs"]
user = {"id": profile["username"], "encryption": "none"}
network = qs.get("type", "tcp")
security = qs.get("security", "reality")
if qs.get("flow") and network != "xhttp":
user["flow"] = qs.get("flow")
stream_settings = {
"network": network,
"security": security,
}
if network == "xhttp":
alpn = [x for x in qs.get("alpn", "h2").split(",") if x]
stream_settings["tlsSettings"] = {
"serverName": qs.get("sni", profile["host"]),
"fingerprint": qs.get("fp", "chrome"),
"alpn": alpn or ["h2"],
"allowInsecure": False,
}
stream_settings["xhttpSettings"] = {
"path": qs.get("path", "/xhttp"),
"mode": qs.get("mode", "packet-up"),
"host": qs.get("host", profile["host"]),
}
else:
stream_settings["security"] = "reality"
stream_settings["realitySettings"] = {
"serverName": qs.get("sni", ""),
"fingerprint": qs.get("fp", "chrome"),
"publicKey": qs.get("pbk", ""),
"shortId": qs.get("sid", ""),
"spiderX": qs.get("spx", "/"),
}
text = json.dumps({
"log": {"loglevel": "warning"},
"inbounds": [{"listen": "127.0.0.1", "port": socks_port, "protocol": "socks", "settings": {"udp": True}}],
"outbounds": [{
"protocol": "vless",
"settings": {"vnext": [{"address": profile["host"], "port": profile["port"], "users": [user]}]},
"streamSettings": stream_settings,
}],
})
suffix = ".json"
command = lambda cfg: ["xray", "run", "-config", cfg]
else:
raise ValueError(f"unsupported scheme {scheme}")
fd, cfg = tempfile.mkstemp(prefix=f"{scheme}_benchmark_", suffix=suffix)
os.close(fd)
Path(cfg).write_text(text, encoding="utf-8")
log_handle = open(log_path, "w", encoding="utf-8")
try:
proc = subprocess.Popen(command(cfg), stdout=log_handle, stderr=subprocess.STDOUT)
except Exception:
log_handle.close()
os.remove(cfg)
raise
return proc, cfg, log_handle
def run_curl(cmd, timeout=18):
try:
r = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=timeout)
text = (r.stdout or "").strip()
ok = r.returncode == 0 and "code=200" in text
total = None
for item in text.split():
if item.startswith("total="):
try:
total = float(item.split("=", 1)[1])
except Exception:
pass
return ok, total, (r.stderr or "").strip()[-120:]
except Exception as exc:
return False, None, repr(exc)[-120:]
def curl_socks(port):
return run_curl([
"curl", "-sS", "--max-time", "15",
"--socks5-hostname", f"127.0.0.1:{port}",
"-o", "/dev/null",
"-w", "code=%{http_code} total=%{time_total}",
"https://www.cloudflare.com/cdn-cgi/trace",
])
def curl_naive(profile):
auth = profile["username"] + (( ":" + profile["password"]) if profile["password"] else "")
return run_curl([
"curl", "-k", "--proxy-insecure", "-sS", "--max-time", "15",
"--proxy", f"https://{profile['host']}:{profile['port']}",
"--proxy-user", auth,
"-o", "/dev/null",
"-w", "code=%{http_code} total=%{time_total}",
"https://www.cloudflare.com/cdn-cgi/trace",
])
def percentile(values, pct):
if not values:
return None
ordered = sorted(values)
if len(ordered) == 1:
return ordered[0]
pos = (len(ordered) - 1) * pct
lower = int(pos)
upper = min(lower + 1, len(ordered) - 1)
weight = pos - lower
return ordered[lower] * (1 - weight) + ordered[upper] * weight
def fmt_seconds(value):
return f"{value:.3f}s" if value is not None else "-"
def bench_profile(index, profile):
scheme = profile["scheme"]
proc = None
cfg = None
log_handle = None
log_path = None
try:
if scheme == "naive+https":
values = []
errors = []
for _ in range(rounds):
ok, total, err = curl_naive(profile)
if ok and total is not None:
values.append(total)
elif err:
errors.append(err)
return values, errors
startup_attempts = 2 if scheme in ("hy2", "hysteria2") else 1
startup_errors = []
socks_port = None
for attempt in range(1, startup_attempts + 1):
socks_port = allocate_local_port()
log_path = f"/tmp/yurich-benchmark-{os.getpid()}-{index}-{attempt}.log"
try:
proc, cfg, log_handle = start_local_client(profile, socks_port, log_path)
except Exception as exc:
startup_errors.append(f"client start failed ({attempt}/{startup_attempts}): {exc!r}"[-240:])
else:
if wait_port(socks_port):
break
stop_process(proc)
proc = None
if log_handle:
log_handle.close()
log_handle = None
startup_errors.append(
f"local socks not ready ({attempt}/{startup_attempts}): {safe_client_log(log_path)}"
)
if cfg:
try:
os.remove(cfg)
except Exception:
pass
cfg = None
if log_path:
try:
os.remove(log_path)
except Exception:
pass
log_path = None
if attempt < startup_attempts:
time.sleep(0.5)
else:
return [], [startup_errors[-1] if startup_errors else "local socks not ready"]
values = []
errors = []
for _ in range(rounds):
ok, total, err = curl_socks(socks_port)
if ok and total is not None:
values.append(total)
elif err:
errors.append(err)
return values, errors
finally:
stop_process(proc)
if log_handle:
try:
log_handle.close()
except Exception:
pass
if cfg:
try:
os.remove(cfg)
except Exception:
pass
if log_path:
try:
os.remove(log_path)
except Exception:
pass
print(f"{'STATUS':<6} {'PROTO':<12} {'HOST':<22} {'OK':<5} {'BEST':>8} {'AVG':>8} {'MEDIAN':>8} {'P95':>8} {'WORST':>8} {'SLOW':>7} NAME")
print("-" * 128)
failed = 0
csv_rows = []
now_iso = dt.datetime.now(dt.timezone.utc).replace(microsecond=0).isoformat()
try:
load1 = round(os.getloadavg()[0], 2)
except (AttributeError, OSError):
load1 = ""
try:
meminfo = {}
for item in Path('/proc/meminfo').read_text().splitlines():
key, value = item.split(':', 1)
meminfo[key] = int(value.strip().split()[0])
mem_total = meminfo.get('MemTotal', 0)
mem_available = meminfo.get('MemAvailable', 0)
mem_used_pct = round((mem_total - mem_available) * 100 / mem_total, 1) if mem_total else ""
except (OSError, ValueError):
mem_used_pct = ""
for index, profile in enumerate(profiles):
values, errors = bench_profile(index, profile)
ok_count = len(values)
status = "OK" if ok_count == rounds else ("WARN" if ok_count else "FAIL")
if status == "FAIL":
failed += 1
best_value = min(values) if values else None
avg_value = (sum(values) / len(values)) if values else None
median_value = percentile(values, 0.50) if values else None
p95_value = percentile(values, 0.95) if values else None
worst_value = max(values) if values else None
jitter_value = (sum(abs(values[i] - values[i - 1]) for i in range(1, len(values))) / (len(values) - 1)) if len(values) > 1 else 0 if values else None
loss_pct = round((rounds - ok_count) * 100 / rounds, 1)
slow_count = sum(1 for value in values if int(value * 1000) > slow_threshold_ms)
slow_label = f"slow={slow_count}/{ok_count}" if values else f"slow=0/{rounds}"
best = fmt_seconds(best_value)
avg = fmt_seconds(avg_value)
median = fmt_seconds(median_value)
p95 = fmt_seconds(p95_value)
worst = fmt_seconds(worst_value)
name = profile["name"][:48]
print(f"{status:<6} {profile['scheme']:<12} {profile['host']:<22} {ok_count}/{rounds:<3} {best:>8} {avg:>8} {median:>8} {p95:>8} {worst:>8} {slow_label:>7} {name}")
csv_rows.append({
"ts": now_iso,
"user": csv_user,
"status": status,
"scheme": profile["scheme"],
"host": profile["host"],
"ok": ok_count,
"rounds": rounds,
"best_ms": int(best_value * 1000) if best_value is not None else "",
"avg_ms": int(avg_value * 1000) if avg_value is not None else "",
"median_ms": int(median_value * 1000) if median_value is not None else "",
"p95_ms": int(p95_value * 1000) if p95_value is not None else "",
"worst_ms": int(worst_value * 1000) if worst_value is not None else "",
"jitter_ms": int(jitter_value * 1000) if jitter_value is not None else "",
"loss_pct": loss_pct,
"load1": load1,
"mem_used_pct": mem_used_pct,
"slow_threshold_ms": slow_threshold_ms,
"slow_count": slow_count if values else "",
"slow_total": ok_count if values else "",
"name": profile["name"],
})
if not values and errors:
print(f" error: {errors[-1]}")
if csv_path and csv_rows:
path = Path(csv_path)
path.parent.mkdir(parents=True, exist_ok=True)
fieldnames = list(csv_rows[0].keys())
new_file = not path.exists() or path.stat().st_size == 0
if not new_file:
try:
with path.open("r", newline="", encoding="utf-8", errors="replace") as f:
header = next(csv.reader(f), [])
if header != fieldnames:
backup = path.with_name(f"{path.name}.{dt.datetime.now().strftime('%Y%m%d%H%M%S')}.bak")
path.replace(backup)
new_file = True
except Exception:
new_file = True
with path.open("a", newline="", encoding="utf-8") as f:
writer = csv.DictWriter(f, fieldnames=fieldnames)
if new_file:
writer.writeheader()
writer.writerows(csv_rows)
print("-" * 128)
print(f"protocol benchmark: checked={len(profiles)} failed={failed} rounds={rounds}")
sys.exit(0 if failed == 0 else 1)
PY
echo -e "${BOLD}Protocol benchmark:${RESET} user=${user} rounds=${rounds}"
local rc=0
python3 "$tmp_py" "$links_file" "$rounds" || rc=$?
rm -f "$tmp_py" 2>/dev/null || true
return "$rc"
}
protocol_benchmark_default_user() {
local configured="${PROTOCOL_BENCHMARK_USER:-}" first_user
if [[ -n "$configured" ]] && is_valid_proxy_user "$configured" && subscription_user_exists "$configured"; then
printf '%s\n' "$configured"
return 0
fi
first_user=$(list_subscription_users | head -n1 || true)
[[ -n "$first_user" ]] || return 1
printf '%s\n' "$first_user"
}
monitor_issue_fingerprint() {
sed -E \
-e $'s/\033\\[[0-9;]*[[:alpha:]]//g' \
-e 's/(avg=)[0-9]+ms/\1$(hostname)
👤 Пользователь: $(html_escape_text "$user")
📈 Порог: ${max_ms} ms, ${slow_min_hits}/${rounds} медленных попыток
🔕 ${safe_alert_note}
🕐 $(date '+%Y-%m-%d %H:%M:%S')
Проблемы:
${safe_issues}
Последний тест:
${safe_tail}"
else
if [[ -s "$alert_state" && "$recovery_alert" == "1" ]]; then
state_line=$(head -n1 "$alert_state" 2>/dev/null || true)
IFS='|' read -r state_a state_b state_c state_d state_e state_f <<< "$state_line" || true
if [[ "$state_a" == "PROTOBM1" ]]; then
prev_class="$state_b"; prev_count="$state_c"; prev_sent="$state_d"
else
prev_class="$state_a"; prev_count="$state_b"; prev_sent="$state_c"
fi
is_canonical_uint_in_range "$prev_sent" 0 9999999999 || prev_sent=0
if (( prev_sent > 0 )); then
tg_send "✅ Yurich Connect protocol benchmark восстановлен
📡 Сервер: $(hostname)
👤 Пользователь: $(html_escape_text "$user")
🕐 $(date '+%Y-%m-%d %H:%M:%S')
Проблемы больше не повторяются. Последний тест прошёл без FAIL/SLOW по заданным порогам." fi fi rm -f "$alert_state" 2>/dev/null || true fi rm -f "$tmp" return "$rc" } cmd_protocol_benchmark_history() { load_config 2>/dev/null || true local log_file="${PROTOCOL_BENCHMARK_LOG:-$PROTOCOL_BENCHMARK_LOG_DEFAULT}" rows="${1:-30}" is_canonical_uint_in_range "$rows" 1 200 || rows=30 if [[ ! -s "$log_file" ]]; then warn "История benchmark пока пуста: $log_file" return 0 fi python3 - "$log_file" "$rows" <<'PY' import csv import sys from collections import defaultdict path, limit = sys.argv[1], int(sys.argv[2]) with open(path, "r", encoding="utf-8", errors="replace") as f: rows = list(csv.DictReader(f)) rows = rows[-limit:] print(f"{'TIME':<20} {'STATUS':<6} {'PROTO':<12} {'HOST':<22} {'AVG':>7} {'JITTER':>8} {'LOSS':>7} {'P95':>7} {'SLOW':>9} NAME") print("-" * 132) for r in rows: ts = (r.get("ts") or "")[:19].replace("T", " ") avg = (r.get("avg_ms") or "-") avg = f"{avg}ms" if avg != "-" else "-" jitter = (r.get("jitter_ms") or "-") jitter = f"{jitter}ms" if jitter != "-" else "-" loss = (r.get("loss_pct") or "-") loss = f"{loss}%" if loss != "-" else "-" p95 = (r.get("p95_ms") or "-") p95 = f"{p95}ms" if p95 != "-" else "-" slow_count = r.get("slow_count") or "" slow_total = r.get("slow_total") or r.get("ok") or r.get("rounds") or "" slow = f"{slow_count}/{slow_total}" if slow_count and slow_total else "-" print(f"{ts:<20} {r.get('status',''):<6} {r.get('scheme',''):<12} {r.get('host',''):<22} {avg:>7} {jitter:>8} {loss:>7} {p95:>7} {slow:>9} {(r.get('name') or '')[:38]}") stats = defaultdict(lambda: {"total": 0, "fail": 0, "avg_sum": 0, "avg_count": 0, "jitter_sum": 0, "jitter_count": 0, "loss_sum": 0}) for r in rows: key = (r.get("scheme", ""), r.get("host", "")) item = stats[key] item["total"] += 1 if r.get("status") == "FAIL": item["fail"] += 1 try: item["avg_sum"] += int(r.get("avg_ms") or 0) item["avg_count"] += 1 except Exception: pass try: item["jitter_sum"] += int(r.get("jitter_ms") or 0) item["jitter_count"] += 1 except Exception: pass try: item["loss_sum"] += float(r.get("loss_pct") or 0) except Exception: pass if stats: print("-" * 132) print("Summary:") for (scheme, host), item in sorted(stats.items(), key=lambda x: (x[1]["fail"], (x[1]["avg_sum"] / max(x[1]["avg_count"], 1)))): avg = int(item["avg_sum"] / max(item["avg_count"], 1)) if item["avg_count"] else 0 jitter = int(item["jitter_sum"] / max(item["jitter_count"], 1)) if item["jitter_count"] else 0 loss = round(item["loss_sum"] / max(item["total"], 1), 1) print(f"{scheme:<12} {host:<22} fail={item['fail']}/{item['total']} avg={avg}ms jitter={jitter}ms loss={loss}%") PY } cmd_protocol_stability_report() { load_config 2>/dev/null || true local log_file="${PROTOCOL_BENCHMARK_LOG:-$PROTOCOL_BENCHMARK_LOG_DEFAULT}" hours="${1:-24}" is_canonical_uint_in_range "$hours" 1 168 || hours=24 if [[ ! -s "$log_file" ]]; then warn "История benchmark пока пуста: $log_file" return 0 fi python3 - "$log_file" "$hours" <<'PY' import csv import datetime as dt import statistics import sys from collections import defaultdict path, hours = sys.argv[1], int(sys.argv[2]) cutoff = dt.datetime.now(dt.timezone.utc) - dt.timedelta(hours=hours) groups = defaultdict(list) load_values = [] mem_values = [] with open(path, "r", encoding="utf-8", errors="replace") as f: for row in csv.DictReader(f): try: stamp = dt.datetime.fromisoformat((row.get("ts") or "").replace("Z", "+00:00")) if stamp.tzinfo is None: stamp = stamp.replace(tzinfo=dt.timezone.utc) except ValueError: continue if stamp < cutoff: continue groups[(row.get("scheme", ""), row.get("host", ""))].append(row) try: load_values.append(float(row.get("load1") or "")) except ValueError: pass try: mem_values.append(float(row.get("mem_used_pct") or "")) except ValueError: pass def nums(rows, key): result = [] for row in rows: try: result.append(float(row.get(key) or "")) except ValueError: pass return result print(f"Yurich stability report: last {hours}h") print(f"{'PROTO':<12} {'HOST':<24} {'RUNS':>5} {'FAIL':>6} {'WARN':>6} {'AVG':>8} {'JITTER':>9} {'LOSS':>8} {'P95 MAX':>9}") print("-" * 100) for (scheme, host), rows in sorted(groups.items()): avg = nums(rows, "avg_ms") jitter = nums(rows, "jitter_ms") loss = nums(rows, "loss_pct") p95 = nums(rows, "p95_ms") fails = sum(1 for row in rows if row.get("status") == "FAIL") warns = sum(1 for row in rows if row.get("status") == "WARN") fmt = lambda values, suffix: f"{statistics.fmean(values):.0f}{suffix}" if values else "-" p95_max = f"{max(p95):.0f}ms" if p95 else "-" print(f"{scheme:<12} {host:<24} {len(rows):>5} {fails:>6} {warns:>6} {fmt(avg, 'ms'):>8} {fmt(jitter, 'ms'):>9} {fmt(loss, '%'):>8} {p95_max:>9}") print("-" * 100) print(f"rows={sum(map(len, groups.values()))} max_load1={max(load_values) if load_values else '-'} max_mem={str(max(mem_values)) + '%' if mem_values else '-'}") PY } normalize_monitor_noise_settings() { local spec key minimum current for spec in \ PROTOCOL_BENCHMARK_ALERT_REPEAT:3 \ PROTOCOL_BENCHMARK_HARD_ALERT_REPEAT:3 \ PROTOCOL_BENCHMARK_ALERT_COOLDOWN_MINUTES:60 \ PROTOCOL_MONITOR_ALERT_REPEAT:3 \ PROTOCOL_MONITOR_ALERT_COOLDOWN_MINUTES:60 \ DNS_MONITOR_ALERT_REPEAT:3 \ DNS_MONITOR_ALERT_COOLDOWN_MINUTES:180; do key="${spec%%:*}" minimum="${spec##*:}" current="${!key:-}" if ! [[ "$current" =~ ^[0-9]+$ ]] || (( 10#$current < minimum )); then printf -v "$key" '%s' "$minimum" fi done } cmd_protocol_benchmark_install() { load_config load_users normalize_monitor_noise_settings local user="${1:-${PROTOCOL_BENCHMARK_USER:-}}" rounds="${2:-${PROTOCOL_BENCHMARK_ROUNDS:-3}}" script_path="${SCRIPT_PATH:-/usr/local/bin/yurich-panel.sh}" if [[ -z "$user" ]]; then user=$(protocol_benchmark_default_user) || { err "Нет пользователя для benchmark monitor"; return 1; } fi if ! is_valid_proxy_user "$user" || ! subscription_user_exists "$user"; then err "Пользователь не найден: $user" return 1 fi is_canonical_uint_in_range "$rounds" 1 5 || rounds=1 (( rounds < 3 )) && rounds=3 PROTOCOL_BENCHMARK_USER="$user" PROTOCOL_BENCHMARK_ROUNDS="$rounds" PROTOCOL_BENCHMARK_LOG="${PROTOCOL_BENCHMARK_LOG:-$PROTOCOL_BENCHMARK_LOG_DEFAULT}" save_config cat > "$PROTOCOL_BENCHMARK_CRON" <
$(hostname)
🌐 Домен: ${DOMAIN:-unknown}
🔕 Антиспам: повтор ${issue_count}, cooldown ${alert_cooldown_minutes} мин.
🕐 $(date '+%Y-%m-%d %H:%M:%S')
$(tail -n 30 "$tmp" | sed 's/&/\&/g; s//\>/g')" else info "Protocol health alert suppressed: repeat=${issue_count}/${alert_repeat}, same_issue=$((1 - issue_changed)), cooldown=${alert_cooldown_minutes}m" fi else if [[ -s "$alert_state" && "$recovery_alert" == "1" ]]; then state_line=$(head -n1 "$alert_state" 2>/dev/null || true) IFS='|' read -r state_a state_b state_c state_d state_e <<< "$state_line" || true if [[ "$state_a" == "PROTOHEALTH1" ]]; then prev_sent="$state_c" else prev_sent="$state_c" fi is_canonical_uint_in_range "$prev_sent" 0 9999999999 || prev_sent=0 if (( prev_sent > 0 )); then tg_send "✅ Yurich Connect protocol health восстановлен 📡 Сервер:
$(hostname)
🌐 Домен: ${DOMAIN:-unknown}
🕐 $(date '+%Y-%m-%d %H:%M:%S')
Health-check снова проходит без ошибок." fi fi rm -f "$alert_state" 2>/dev/null || true fi cat "$tmp" rm -f "$tmp" return "$rc" } cmd_protocol_monitor_install() { load_config normalize_monitor_noise_settings save_config local script_path="${SCRIPT_PATH:-/usr/local/bin/yurich-panel.sh}" cron_file="/etc/cron.d/yurich-protocol-monitor" log_file="/var/log/yurich-protocol-monitor.log" cat > "$cron_file" <
Срок подписки ${safe_user} закончился. Профили временно отозваны.
После продления эта же ссылка снова станет активной.
Ручной резервный туннель через ICMP. Он не импортируется напрямую в Hiddify, v2rayNG, NekoBox или Streisand: сначала запускается локальный SOCKS5-клиент, потом приложение или браузер направляется на 127.0.0.1:10888.
pingtunnel.txt и выполни команду клиента.127.0.0.1:10888.Современная страница подключения для телефона и компьютера: одна подписка, быстрый импорт в приложения, QR-коды и рекомендации по рабочим локациям.
${safe_traffic_summary}
${safe_expiry_label}
${safe_active_locations}
Собираем помощь для развития Yurich Connect и разработки приложений для Android и iPhone. Поддержка помогает быстрее выпускать обновления, улучшать стабильность серверов и делать подключение проще.
Чтобы получать напоминания об окончании подписки и новости, отправь разработчику свой Telegram ID.
${safe_user}.Собираем помощь для развития проекта Yurich Connect и разработки приложений для Android и iPhone. Каждый вклад помогает быстрее выпускать обновления, улучшать стабильность подключений и делать приложение удобнее.
${safe_user}.Единая страница для установки приложения, импорта подписки и копирования отдельных профилей. Ссылка скрыта от индексации, но доступна всем, у кого есть этот URL.
${safe_traffic_summary}
Активные профили по доступным серверам.
$(date '+%Y-%m-%d') по времени сервера.
Чтобы получать напоминания об окончании подписки и важные новости, отправь разработчику свой Telegram ID.
${safe_user}.Чтобы получать напоминания об окончании подписки и важные новости, отправь разработчику свой Telegram ID.
${safe_user}.Личная страница для заметок по инфраструктуре, релизам и тестовым окружениям. Публичная часть сайта остаётся обычным техническим блогом, эта страница живёт только по секретному адресу.
План на неделю: проверить резервные копии, обновить список зависимостей, прогнать диагностику TLS/HTTP3, сверить правила firewall и журнал systemd.
Последняя проверка: $(date '+%Y-%m-%d %H:%M')
${new_dom}"
;;
2)
# Защита: считаем сколько доменов
local _dom_total
_dom_total=$(echo "$current_domains" | tr ',' '\n' | grep -c '\S' || echo 0)
if [[ ${_dom_total} -le 1 ]]; then
err "Нельзя удалить последний домен!"
err "Сервер перестанет работать без домена."
err "Сначала добавь новый домен (вариант 1), потом удаляй старый."
echo -ne "${YELLOW}Enter для продолжения...${RESET}"; read -r
continue
fi
echo -ne "${CYAN}Номер домена для удаления: ${RESET}"
read -r del_idx
local new_domains=""
local j=1
IFS=',' read -ra dlist2 <<< "$current_domains"
for d in "${dlist2[@]}"; do
d="${d// /}"
[[ -z "$d" ]] && continue
if [[ "$j" != "$del_idx" ]]; then
new_domains="${new_domains},${d}"
fi
j=$((j+1))
done
DOMAINS="${new_domains#,}"
DOMAIN=$(echo "$DOMAINS" | cut -d',' -f1)
save_config
backup_config
write_caddyfile_multi
systemctl reload caddy 2>/dev/null || systemctl restart caddy
ok "Домен удалён"
;;
0) break ;;
*) warn "Неверный выбор" ;;
esac
echo -ne "${YELLOW}Enter для продолжения...${RESET}"; read -r
done
}
# ─── УПРАВЛЕНИЕ ПОЛЬЗОВАТЕЛЯМИ ────────────────────────────────
restore_user_credentials_backup() {
local backup_dir="$1"
if [[ -d "$backup_dir/credential-state" ]]; then
credential_state_restore "$backup_dir/credential-state"
else
cp -a "$backup_dir/users.conf" "$USERS_FILE"
fi
if [[ -f "$backup_dir/xray-users.conf" ]]; then
cp -a "$backup_dir/xray-users.conf" "$XRAY_USERS_FILE"
else
rm -f "$XRAY_USERS_FILE"
fi
if [[ -f "$backup_dir/xray-compat-users.conf" ]]; then
cp -a "$backup_dir/xray-compat-users.conf" "$XRAY_COMPAT_USERS_FILE"
else
rm -f "$XRAY_COMPAT_USERS_FILE"
fi
}
rotate_user_credentials() {
local target="$1" new_pass="$2" backup_dir tmp new_uuid changed_xray=0
is_valid_proxy_user "$target" || return 1
is_valid_proxy_pass "$new_pass" || return 1
get_user_hash "$target" >/dev/null 2>&1 || { err "Пользователь $target не найден"; return 1; }
if [[ -n "${BROWSER_SUBSCRIPTION_PROFILES:-}" ]] \
&& ! browser_subscription_links_for_user "$target" "$new_pass" >/dev/null; then
err "Ротация отменена: некорректный BROWSER_SUBSCRIPTION_PROFILES"
return 1
fi
if ! subscription_vless_relay_links_for_user "$target" "" >/dev/null; then
err "Ротация отменена: некорректный VLESS_RELAY_PROFILES"
return 1
fi
backup_dir=$(mktemp -d /tmp/yurich-rotate-user.XXXXXX)
chmod 700 "$backup_dir"
credential_state_backup "$backup_dir/credential-state"
[[ -f "$XRAY_USERS_FILE" ]] && cp -a "$XRAY_USERS_FILE" "$backup_dir/xray-users.conf"
[[ -f "$XRAY_COMPAT_USERS_FILE" ]] && cp -a "$XRAY_COMPAT_USERS_FILE" "$backup_dir/xray-compat-users.conf"
if ! credential_set_user "$target" "$new_pass"; then
restore_user_credentials_backup "$backup_dir"
rm -rf -- "$backup_dir"
return 1
fi
if [[ -n "$(get_xray_user_uuid "$target" 2>/dev/null || true)" ]]; then
if ! new_uuid=$(xray_generate_uuid); then
restore_user_credentials_backup "$backup_dir"
rm -rf -- "$backup_dir"
err "Не удалось создать новый VLESS UUID; изменения отменены"
return 1
fi
tmp=$(mktemp)
awk -F: -v OFS=: -v user="$target" -v uuid="$new_uuid" '$1 == user {$2=uuid} {print}' "$XRAY_USERS_FILE" > "$tmp"
install -m 600 "$tmp" "$XRAY_USERS_FILE"
rm -f "$tmp"
changed_xray=1
fi
if [[ -n "$(get_xray_compat_user_uuid "$target" 2>/dev/null || true)" ]]; then
if ! new_uuid=$(xray_generate_uuid); then
restore_user_credentials_backup "$backup_dir"
rm -rf -- "$backup_dir"
err "Не удалось создать новый VLESS Compat UUID; изменения отменены"
return 1
fi
tmp=$(mktemp)
awk -F: -v OFS=: -v user="$target" -v uuid="$new_uuid" '$1 == user {$2=uuid} {print}' "$XRAY_COMPAT_USERS_FILE" > "$tmp"
install -m 600 "$tmp" "$XRAY_COMPAT_USERS_FILE"
rm -f "$tmp"
changed_xray=1
fi
if ! apply_user_access_runtime; then
restore_user_credentials_backup "$backup_dir"
apply_user_access_runtime >/dev/null 2>&1 || true
rm -rf -- "$backup_dir"
err "Ротация не применена; прежние credentials восстановлены"
return 1
fi
rm -rf -- "$backup_dir"
generate_subscription_page "$target" >/dev/null 2>&1 || { err "Credentials обновлены, но страницу подписки не удалось пересобрать"; return 1; }
cmd_nodes_rebuild_subscriptions >/dev/null 2>&1 || true
if [[ "$(nodes_count 2>/dev/null || echo 0)" -gt 0 ]] && ! cmd_nodes_sync_users all >/dev/null 2>&1; then
err "Credentials обновлены локально; синхронизация nodes поставлена в повтор"
return 1
fi
if [[ "$changed_xray" -eq 1 ]]; then
ok "Naive/Hysteria password обновлён, VLESS UUID ротирован"
else
ok "Naive/Hysteria password обновлён"
fi
warn "На устройствах нужно обновить подписку, старые профили больше не действуют"
}
cmd_users_list_machine() {
local user state expires days chat_id credential_state subscription_state
local stored_hash encrypted_secret token token_file page_dir
while IFS= read -r user; do
is_valid_proxy_user "$user" || continue
state="lifetime"
expires=$(get_user_expiry "$user" 2>/dev/null || true)
days=""
if user_is_blocked "$user"; then
state="blocked"
elif [[ -n "$expires" ]]; then
days=$(days_until_expiry "$expires" 2>/dev/null || true)
if [[ "$days" =~ ^-?[0-9]+$ ]]; then
if (( days < 0 )); then
state="expired"
elif (( days <= 5 )); then
state="expiring"
else
state="active"
fi
else
expires=""
days=""
fi
fi
chat_id=$(user_meta_get "$user" TELEGRAM_CHAT_ID 2>/dev/null || true)
if is_valid_tg_chat_id "$chat_id"; then
chat_id="yes"
else
chat_id="no"
fi
credential_state="xray-only"
if get_user_hash "$user" >/dev/null 2>&1; then
stored_hash=$(credential_file_value "$USERS_FILE" "$user" 2>/dev/null || true)
encrypted_secret=$(credential_file_value "$USERS_SECRETS_FILE" "$user" 2>/dev/null || true)
if is_valid_proxy_hash "$stored_hash" && is_valid_encrypted_proxy_secret "$encrypted_secret"; then
credential_state="protected"
else
credential_state="legacy"
fi
fi
subscription_state="no"
token_file="${SUBS_DIR}/${user}.token"
token=$(tr -d '\r\n' < "$token_file" 2>/dev/null || true)
if [[ "$token" =~ ^[A-Fa-f0-9]{48}$ ]]; then
page_dir="${SUBS_WEB_DIR}/${token}"
if [[ -s "$page_dir/index.html" ]]; then
subscription_state="yes"
fi
fi
printf 'USER|%s|%s|%s|%s|%s|%s|%s\n' \
"$user" "$state" "$expires" "$days" "$chat_id" "$credential_state" "$subscription_state"
done < <(list_subscription_users)
}
cmd_users() {
load_users
while true; do
hr
echo -e "${BOLD} Управление пользователями${RESET}"
hr
echo -e " ${BOLD}1)${RESET} Список пользователей"
echo -e " ${BOLD}2)${RESET} Добавить пользователя"
echo -e " ${BOLD}3)${RESET} Удалить пользователя"
echo -e " ${BOLD}4)${RESET} Ротировать пароль и VLESS UUID"
echo -e " ${BOLD}5)${RESET} Показать ссылку пользователя"
echo -e " ${BOLD}6)${RESET} Статус защищённого хранения"
echo -e " ${BOLD}7)${RESET} Мигрировать legacy-пароли в bcrypt + vault"
echo -e " ${BOLD}0)${RESET} Назад"
hr
echo -ne "${CYAN}Выбор: ${RESET}"
read -r choice; echo
case "$choice" in
1)
local count=0
while IFS=: read -r u _; do
count=$((count+1))
local store_label="${GREEN}bcrypt+vault${RESET}"
if ! is_valid_proxy_hash "$(credential_file_value "$USERS_FILE" "$u" 2>/dev/null || true)" \
|| ! is_valid_encrypted_proxy_secret "$(credential_file_value "$USERS_SECRETS_FILE" "$u" 2>/dev/null || true)"; then
store_label="${YELLOW}legacy/needs migration${RESET}"
fi
echo -e " ${count}. ${BOLD}${u}${RESET} ${store_label} ${DIM}срок: $(user_expiry_label "$u")${RESET}"
done < <(get_users)
[[ $count -eq 0 ]] && warn "Нет пользователей"
echo -e " Итого: $count"
;;
2)
echo -ne "${CYAN}Новый логин: ${RESET}"; read -r new_user
[[ -z "$new_user" ]] && { err "Логин не может быть пустым"; continue; }
# Валидация: только буквы, цифры, дефис, подчёркивание (защита от sed-инъекции)
if ! is_valid_proxy_user "$new_user"; then
err "Логин: 2-32 символа, только A-Z a-z 0-9 _ -"
continue
fi
if get_user_hash "$new_user" >/dev/null; then
err "Пользователь $new_user уже существует"
continue
fi
echo -ne "${CYAN}Пароль (Enter = случайный): ${RESET}"; read -rs new_pass; echo
if [[ -z "$new_pass" ]]; then
new_pass=$(random_safe_token 20)
info "Сгенерирован пароль: $new_pass"
fi
if ! is_valid_proxy_pass "$new_pass"; then
err "Пароль: 8-64 символа, только A-Z a-z 0-9 _ -"
continue
fi
local new_months
new_months=$(prompt_user_term_months 12) || continue
local users_backup
users_backup=$(mktemp -d /run/yurich-add-user.XXXXXX)
credential_state_backup "$users_backup/credential-state"
if ! credential_set_user "$new_user" "$new_pass"; then
rm -rf "$users_backup"
err "Пользователь $new_user не создан"
continue
fi
set_user_expiry_months "$new_user" "$new_months" || true
backup_config
if ! rewrite_caddyfile_current; then
credential_state_restore "$users_backup/credential-state"
rm -rf "$users_backup"
cleanup_user_metadata "$new_user"
err "Caddyfile не собрался, пользователь $new_user отменён"
continue
fi
if ! systemctl reload caddy 2>/dev/null && ! systemctl restart caddy 2>/dev/null; then
credential_state_restore "$users_backup/credential-state"
rm -rf "$users_backup"
cleanup_user_metadata "$new_user"
rewrite_caddyfile_current >/dev/null 2>&1 || true
err "Caddy не перезагрузился, пользователь $new_user отменён"
continue
fi
rm -rf "$users_backup"
ok "Пользователь $new_user добавлен"
local hy_added=0
if [[ -f "$HYSTERIA_CONFIG" || -x "$HYSTERIA_BIN" ]]; then
if sync_hysteria_users_if_active; then
hy_added=1
fi
fi
local xray_added=0
if [[ "${XRAY_ENABLED:-0}" == "1" && -x "$XRAY_BIN" && -f "$XRAY_CONFIG" ]]; then
echo -ne "${CYAN}Создать Xray/VLESS конфиги для ${new_user} тоже? [Y/n]: ${RESET}"
read -r add_xray_ans
if [[ "${add_xray_ans,,}" != "n" ]]; then
if provision_xray_user "$new_user"; then
xray_added=1
ok "Xray/VLESS конфиги для ${new_user} готовы"
else
warn "Naive пользователь создан, но Xray профиль не применён"
fi
fi
fi
local sub_url
sub_url=$(generate_subscription_page "$new_user" 2>/dev/null || true)
if [[ -n "$sub_url" ]]; then
ok "Страница подписки создана: $sub_url"
echo -e " links.txt: ${sub_url}links.txt"
else
warn "Страница подписки не создана автоматически. Проверь: sudo bash yurich-panel.sh subscription ${new_user}"
fi
print_client_config "$new_user"
if [[ "$hy_added" -eq 1 ]]; then
print_hysteria_client_config "$new_user"
fi
if [[ "$xray_added" -eq 1 ]]; then
print_xray_client_config "$new_user"
fi
tg_send "👤 Новый пользователь Yurich Panel
🔑 Логин: ${new_user}
🕐 $(date '+%Y-%m-%d %H:%M:%S')"
;;
3)
echo -ne "${CYAN}Логин для удаления: ${RESET}"; read -r del_user
if ! delete_subscription_user_everywhere "$del_user"; then
warn "Удаление $del_user не выполнено"
continue
fi
tg_send "🗑 Пользователь удалён полностью: ${del_user}
🕐 $(date '+%Y-%m-%d %H:%M:%S')"
;;
4)
echo -ne "${CYAN}Логин: ${RESET}"; read -r chg_user
if ! is_valid_proxy_user "$chg_user" || ! get_user_hash "$chg_user" >/dev/null; then
err "Пользователь $chg_user не найден"; continue
fi
echo -ne "${CYAN}Новый пароль (Enter = случайный): ${RESET}"; read -rs chg_pass; echo
if [[ -z "$chg_pass" ]]; then
chg_pass=$(random_safe_token 20)
info "Сгенерирован пароль: $chg_pass"
fi
if ! is_valid_proxy_pass "$chg_pass"; then
err "Пароль: 8-64 символа, только A-Z a-z 0-9 _ -"; continue
fi
backup_config
rotate_user_credentials "$chg_user" "$chg_pass" || { warn "Ротация $chg_user не завершена"; continue; }
;;
5)
echo -ne "${CYAN}Логин: ${RESET}"; read -r show_user
print_client_config "$show_user"
;;
6) cmd_credentials_status ;;
7) cmd_credentials_migrate ;;
0) break ;;
*) warn "Неверный выбор" ;;
esac
echo -ne "${YELLOW}Enter для продолжения...${RESET}"; read -r
done
}
# ─── ЛИМИТ УСТРОЙСТВ / АНТИ-ШАРИНГ ────────────────────────────
device_log_files() {
local f
for f in "${LOG_DIR}/naive.log" "${LOG_DIR}"/naive.log.* "${LOG_DIR}"/naive_*.log "${LOG_DIR}"/naive_*.log.*; do
[[ -f "$f" ]] && printf '%s\n' "$f"
done
}
xray_log_files() {
local f
for f in /var/log/xray/access.log /var/log/xray/access.log.*; do
[[ -f "$f" ]] && printf '%s\n' "$f"
done
}
device_usage_report() {
local window="${1:-${DEVICE_WINDOW_HOURS:-$DEVICE_WINDOW_HOURS_DEFAULT}}"
local since since_text pair_file
since=$(date -d "${window} hours ago" +%s 2>/dev/null || echo 0)
since_text=$(date -d "${window} hours ago" '+%Y/%m/%d %H:%M:%S' 2>/dev/null || echo "")
[[ "$since" =~ ^[0-9]+$ ]] || since=0
pair_file=$(mktemp)
trap 'rm -f "${pair_file:-}" 2>/dev/null; trap - RETURN' RETURN
local logs=()
mapfile -t logs < <(device_log_files)
if [[ "${#logs[@]}" -gt 0 ]]; then
awk -v since="$since" '
{
ts=0; user=""; ip="";
if ($0 !~ /"user_id":/ || $0 !~ /"remote_ip":/) next;
tmp=$0;
sub(/^.*"ts":/, "", tmp);
sub(/[,}].*$/, "", tmp);
ts=tmp+0;
if (ts < since) next;
tmp=$0;
sub(/^.*"user_id":"/, "", tmp);
sub(/".*$/, "", tmp);
user=tmp;
tmp=$0;
sub(/^.*"remote_ip":"/, "", tmp);
sub(/".*$/, "", tmp);
ip=tmp;
if (user != "" && ip != "") print user "\t" ip;
}
' "${logs[@]}" >> "$pair_file"
fi
local xlogs=()
mapfile -t xlogs < <(xray_log_files)
if [[ "${#xlogs[@]}" -gt 0 && -f "$XRAY_USERS_FILE" ]]; then
awk -v since_text="$since_text" -v users_file="$XRAY_USERS_FILE" '
BEGIN {
while ((getline line < users_file) > 0) {
split(line, a, ":");
if (a[1] != "") users[a[1]]=1;
}
}
{
if (since_text != "" && substr($0, 1, 19) < since_text) next;
user=""; ip="";
for (u in users) {
if ($0 ~ ("email[:= ]+" u "([^A-Za-z0-9_-]|$)") || $0 ~ ("\\[" u "\\]") || $0 ~ (" " u "([^A-Za-z0-9_-]|$)")) {
user=u;
break;
}
}
if (user == "") next;
if (match($0, /(tcp|udp):\[[0-9A-Fa-f:]+\]:[0-9]+/)) {
ip=substr($0, RSTART, RLENGTH);
sub(/^(tcp|udp):\[/, "", ip);
sub(/\]:[0-9]+$/, "", ip);
} else if (match($0, /(tcp|udp):[0-9][0-9.]*:[0-9]+/)) {
ip=substr($0, RSTART, RLENGTH);
sub(/^(tcp|udp):/, "", ip);
sub(/:[0-9]+$/, "", ip);
} else if (match($0, / [0-9][0-9.]*:[0-9]+ accepted/)) {
ip=substr($0, RSTART + 1, RLENGTH - 10);
sub(/:[0-9]+$/, "", ip);
}
if (ip != "") print user "\t" ip;
}
' "${xlogs[@]}" >> "$pair_file"
fi
[[ -s "$pair_file" ]] || return 1
awk -F'\t' '
{ if ($1 != "" && $2 != "") seen[$1 SUBSEP $2]=1; }
END {
for (k in seen) {
split(k, a, SUBSEP);
counts[a[1]]++;
ips[a[1]]=ips[a[1]] " " a[2];
}
for (u in counts) {
out=ips[u];
sub(/^ /, "", out);
print u "\t" counts[u] "\t" out;
}
}
' "$pair_file" | sort -k2,2nr -k1,1
}
write_device_cron() {
if [[ "${DEVICE_LIMIT_ENABLED:-0}" == "1" ]]; then
cat > "$DEVICE_CRON" <${user}
📱 IP за ${window} ч: ${count} / лимит ${limit}
🔒 Режим: ${mode}"
if [[ "$enabled" == "1" && "$mode" == "lock-user" ]]; then
device_disable_user "$user" || true
fi
fi
done < "$report_file"
echo
if [[ "$exceeded" -eq 0 ]]; then
ok "Превышений нет"
elif [[ "$enabled" != "1" ]]; then
warn "Автолимит выключен. Это только отчёт."
fi
}
cmd_devices_config() {
load_config
hr
echo -e "${BOLD} Настройка лимита устройств${RESET}"
hr
echo -e " Текущий лимит: ${CYAN}${DEVICE_LIMIT:-$DEVICE_LIMIT_DEFAULT}${RESET}"
echo -e " Окно анализа: ${CYAN}${DEVICE_WINDOW_HOURS:-$DEVICE_WINDOW_HOURS_DEFAULT}${RESET} ч"
echo -e " Режим: ${CYAN}${DEVICE_LIMIT_MODE:-alert}${RESET}"
echo
local ans
echo -ne "${CYAN}Лимит IP на пользователя [${DEVICE_LIMIT:-$DEVICE_LIMIT_DEFAULT}]: ${RESET}"
read -r ans
DEVICE_LIMIT="${ans:-${DEVICE_LIMIT:-$DEVICE_LIMIT_DEFAULT}}"
if ! is_canonical_uint_in_range "$DEVICE_LIMIT" 1 50; then
err "Лимит должен быть числом 1-50"
return 1
fi
echo -ne "${CYAN}Окно анализа, часов [${DEVICE_WINDOW_HOURS:-$DEVICE_WINDOW_HOURS_DEFAULT}]: ${RESET}"
read -r ans
DEVICE_WINDOW_HOURS="${ans:-${DEVICE_WINDOW_HOURS:-$DEVICE_WINDOW_HOURS_DEFAULT}}"
if ! is_canonical_uint_in_range "$DEVICE_WINDOW_HOURS" 1 168; then
err "Окно должно быть числом 1-168 часов"
return 1
fi
echo -e "${CYAN}Режим:${RESET}"
echo -e " 1) alert — только предупреждать"
echo -e " 2) lock-user — отключать пользователя при превышении"
echo -ne "${CYAN}Выбор [1]: ${RESET}"
read -r ans
case "${ans:-1}" in
1) DEVICE_LIMIT_MODE="alert" ;;
2) DEVICE_LIMIT_MODE="lock-user" ;;
*) err "Неверный режим"; return 1 ;;
esac
DEVICE_LIMIT_ENABLED="1"
save_config
write_device_cron
ok "Лимит устройств включён"
}
cmd_devices_disable() {
load_config
DEVICE_LIMIT_ENABLED="0"
save_config
write_device_cron
}
cmd_devices_unlock_all() {
load_config
load_users
local users_file restored=0 user tmp
tmp=$(mktemp)
for users_file in "$DISABLED_USERS_FILE" "$XRAY_DISABLED_USERS_FILE"; do
[[ -s "$users_file" ]] || continue
awk -F: 'NF && $1 !~ /^#/ {print $1}' "$users_file" >> "$tmp"
done
if [[ ! -s "$tmp" ]]; then
rm -f "$tmp"
ok "Отключенных пользователей нет"
return 0
fi
sort -u "$tmp" | while IFS= read -r user; do
[[ -n "$user" ]] || continue
device_enable_user "$user" && restored=$((restored + 1)) || true
done
rm -f "$tmp"
sync_hysteria_users_if_active >/dev/null 2>&1 || true
cmd_nodes_rebuild_subscriptions >/dev/null 2>&1 || true
ok "Восстановление отключенных пользователей завершено"
}
cmd_devices_menu() {
while true; do
load_config
hr
echo -e "${BOLD} Лимит устройств / анти-шаринг${RESET}"
hr
echo -e " ${BOLD}1)${RESET} Отчёт и проверка сейчас"
echo -e " ${BOLD}2)${RESET} Настроить и включить"
echo -e " ${BOLD}3)${RESET} Отключить автолимит"
echo -e " ${BOLD}4)${RESET} Отключить пользователя вручную"
echo -e " ${BOLD}5)${RESET} Вернуть отключенного пользователя"
echo -e " ${BOLD}6)${RESET} Список отключенных"
echo -e " ${BOLD}0)${RESET} Назад"
hr
echo -e " Авто: ${CYAN}${DEVICE_LIMIT_ENABLED:-0}${RESET} | Лимит: ${CYAN}${DEVICE_LIMIT:-$DEVICE_LIMIT_DEFAULT}${RESET} | Окно: ${CYAN}${DEVICE_WINDOW_HOURS:-$DEVICE_WINDOW_HOURS_DEFAULT}ч${RESET} | Режим: ${CYAN}${DEVICE_LIMIT_MODE:-alert}${RESET}"
echo -ne "${CYAN}Выбор: ${RESET}"
read -r choice
case "$choice" in
1) cmd_devices_scan ;;
2) cmd_devices_config ;;
3) cmd_devices_disable ;;
4)
echo -ne "${CYAN}Логин: ${RESET}"; read -r u
device_disable_user "$u"
;;
5)
echo -ne "${CYAN}Логин: ${RESET}"; read -r u
device_enable_user "$u"
;;
6)
local shown=0
if [[ -s "$DISABLED_USERS_FILE" ]]; then
echo -e " ${BOLD}Naive:${RESET}"
awk -F: '{print " • " $1}' "$DISABLED_USERS_FILE"
shown=1
fi
if [[ -s "$XRAY_DISABLED_USERS_FILE" ]]; then
echo -e " ${BOLD}Xray:${RESET}"
awk -F: '{print " • " $1}' "$XRAY_DISABLED_USERS_FILE"
shown=1
fi
[[ "$shown" -eq 0 ]] && warn "Отключенных пользователей нет"
;;
0) return ;;
*) warn "Неверный выбор" ;;
esac
echo -ne "${DIM}Enter для продолжения...${RESET}"; read -r _
done
}
# ─── МОНИТОРИНГ ──────────────────────────────────────────────
cmd_monitor() {
hr
echo -e "${BOLD} Мониторинг и статистика${RESET}"
hr
if systemctl is-active --quiet caddy 2>/dev/null; then
echo -e " Caddy: ${GREEN}● работает${RESET}"
else
echo -e " Caddy: ${RED}● остановлен${RESET}"
fi
local uptime_str
uptime_str=$(systemctl show caddy --property=ActiveEnterTimestamp 2>/dev/null \
| cut -d= -f2 | xargs -I{} date -d "{}" '+%Y-%m-%d %H:%M' 2>/dev/null || echo "н/д")
echo -e " Запущен: $uptime_str"
echo -e " Caddy: $("$CADDY_BIN" version 2>/dev/null | head -1 | awk '{print $1}' || echo н/д)"
echo -e " Юзеров: $(get_users | wc -l)"
local iface
iface=$(ip route | awk '/default/{print $5}' | head -1)
if [[ -n "$iface" ]]; then
local rx tx
rx=$(cat /sys/class/net/"$iface"/statistics/rx_bytes 2>/dev/null || echo 0)
tx=$(cat /sys/class/net/"$iface"/statistics/tx_bytes 2>/dev/null || echo 0)
echo
echo -e " ${BOLD}Трафик ($iface, с ребута):${RESET}"
echo -e " ⬇ Входящий: $(numfmt --to=iec "$rx" 2>/dev/null || echo $rx)"
echo -e " TX: $(numfmt --to=iec "$tx" 2>/dev/null || echo $tx)"
fi
echo
echo -e " ${BOLD}Ресурсы:${RESET}"
echo -e " RAM: $(free -h | awk '/Mem:/{print $3" / "$2}')"
echo -e " Диск: $(df -h / | awk 'NR==2{print $3" / "$2" ("$5")"}')"
echo -e " Uptime: $(uptime -p)"
if edge_routing_mode_is_haproxy; then
echo
echo -e " ${BOLD}HAProxy SNI mux:${RESET}"
haproxy_stats_text | sed 's/^/ /' || true
fi
load_config
if [[ -n "${DOMAIN:-}" ]]; then
echo
info "Проверяю доступность https://${DOMAIN}..."
local http_code
http_code=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 "https://${DOMAIN}" 2>/dev/null || echo "000")
if [[ "$http_code" =~ ^[23] ]]; then
ok "https://${DOMAIN} доступен (HTTP $http_code)"
else
warn "https://${DOMAIN} — HTTP $http_code"
fi
check_cert "${DOMAIN:-}"
fi
echo
echo -ne "${YELLOW}Отправить статистику в Telegram? [y/N]: ${RESET}"
read -r ans
[[ "${ans,,}" == "y" ]] && tg_send_stats && ok "Отправлено в Telegram"
hr
}
# ─── УСТАНОВКА ───────────────────────────────────────────────
cmd_install() {
hr
echo -e "${BOLD} Установка Yurich Panel v${VERSION}${RESET}"
hr
if check_installed; then
warn "Yurich Panel уже установлен."
echo -ne "${YELLOW}Переустановить? [y/N]: ${RESET}"
read -r ans
[[ "${ans,,}" == "y" ]] || return
fi
# ── Шаг 0: Обновление системы ────────────────────────────
if [[ ! -f "$SYSUPDATE_DONE" ]]; then
echo -ne "${YELLOW}Обновить систему перед установкой? [Y/n]: ${RESET}"
read -r ans
[[ "${ans,,}" != "n" ]] && cmd_sysupdate
else
info "Система уже обновлялась: $(cat "$SYSUPDATE_DONE")"
fi
# ── Шаг 1: SSH Hardening ─────────────────────────────────
if [[ ! -f "$SSH_HARDENING_DONE" ]]; then
warn "SSH Hardening может сменить порт и правила входа. По умолчанию пропускаю, чтобы не потерять SSH."
echo -ne "${YELLOW}Выполнить SSH Hardening сейчас? [y/N]: ${RESET}"
read -r ans
[[ "${ans,,}" == "y" ]] && cmd_ssh_hardening
else
info "SSH уже настроен: $(grep SSH_PORT "$SSH_HARDENING_DONE" | cut -d= -f2)"
fi
prompt_params
prompt_edge_routing_mode || return 1
check_domain "$DOMAIN"
install_deps
build_caddy
write_caddyfile
write_service
setup_firewall
if systemctl is-active --quiet fail2ban 2>/dev/null; then
setup_fail2ban "$(current_ssh_port)" || warn "Fail2Ban уже установлен, но автонастройка не прошла"
else
echo -ne "${YELLOW}Включить Fail2Ban защиту SSH + Caddy auth? [Y/n]: ${RESET}"
read -r ans
[[ "${ans,,}" != "n" ]] && setup_fail2ban "$(current_ssh_port)"
fi
enable_bbr
echo
echo -ne "${YELLOW}Настроить Telegram-уведомления? [y/N]: ${RESET}"
read -r ans
[[ "${ans,,}" == "y" ]] && setup_telegram
save_config
install_monitor
cmd_notify_expiry_install
info "Запускаю Caddy..."
systemctl restart caddy
sleep 3
if systemctl is-active --quiet caddy; then
ok "Caddy запущен успешно"
tg_alert_up
else
err "Caddy не запустился. Лог:"
journalctl -u caddy -n 30 --no-pager
exit 1
fi
if edge_routing_mode_is_haproxy; then
apply_haproxy_sni_mux_runtime || exit 1
fi
print_client_config
cmd_health_check
}
# ─── ПРОВЕРКА СЕРТИФИКАТА ─────────────────────────────────────
check_cert() {
local domain="${1:-${DOMAIN:-}}"
[[ -z "$domain" ]] && return
echo
echo -e " ${BOLD}TLS Сертификат:${RESET}"
local cert_info
cert_info=$(echo | timeout 5 openssl s_client -connect "${domain}:443" -servername "$domain" 2>/dev/null | openssl x509 -noout -dates -issuer -subject 2>/dev/null || echo "")
if [[ -z "$cert_info" ]]; then
warn "Не удалось получить данные сертификата"
return
fi
local not_after issuer
not_after=$(echo "$cert_info" | grep "notAfter" | cut -d= -f2)
issuer=$(echo "$cert_info" | grep "issuer" | grep -oP "O=\K[^,]+" || echo "н/д")
# Считаем дней до истечения
local expire_ts now_ts days_left
expire_ts=$(date -d "$not_after" +%s 2>/dev/null || echo 0)
now_ts=$(date +%s)
days_left=$(( (expire_ts - now_ts) / 86400 ))
# Цвет в зависимости от срока
local days_color
if [[ $days_left -gt 30 ]]; then
days_color="${GREEN}"
elif [[ $days_left -gt 7 ]]; then
days_color="${YELLOW}"
else
days_color="${RED}"
fi
echo -e " Домен: ${CYAN}${domain}${RESET}"
echo -e " Истекает: ${not_after}"
echo -e " Осталось: ${days_color}${days_left} дней${RESET}"
echo -e " Выдан: ${issuer}"
if [[ $days_left -le 7 ]]; then
err "СЕРТИФИКАТ ИСТЕКАЕТ МЕНЕЕ ЧЕМ ЧЕРЕЗ 7 ДНЕЙ!"
tg_send "⚠️ Сертификат истекает!
🌐 Домен: ${domain}
📅 Осталось: ${days_left} дней
🕐 $(date '+%Y-%m-%d %H:%M:%S')
🔧 Caddy обновит автоматически — проверь что он запущен!"
elif [[ $days_left -le 30 ]]; then
warn "Сертификат истекает через ${days_left} дней — Caddy обновит автоматически"
else
ok "Сертификат действителен ещё ${days_left} дней"
fi
}
# ══════════════════════════════════════════════════════════════
# SELF-UPDATE СКРИПТА
# ══════════════════════════════════════════════════════════════
cmd_self_update() {
hr
echo -e "${BOLD} Обновление скрипта Yurich Panel${RESET}"
hr
info "Текущая версия: ${BOLD}v${VERSION}${RESET}"
info "Проверяю последнюю версию на GitHub..."
# Источник обновления — raw main, поэтому именно его VERSION является авторитетным.
# Release API используется только для диагностики рассинхронизации.
local latest_ver api_ver raw_ver
api_ver=$(curl -s --max-time 10 "$GITHUB_API" 2>/dev/null | grep '"tag_name"' | grep -oP '"\K[^"]+' | head -1 | tr -d 'v' || echo "")
raw_ver=$(curl -s --max-time 10 "$GITHUB_RAW" 2>/dev/null | grep '^VERSION=' | grep -oP '"\K[^"]+' || echo "")
latest_ver="$raw_ver"
if [[ -z "$latest_ver" ]]; then
err "Не удалось получить VERSION из raw main. Обновление остановлено."
return 1
fi
if [[ -n "$api_ver" && "$api_ver" != "$raw_ver" ]]; then
warn "GitHub Release v${api_ver} и raw main v${raw_ver} различаются; устанавливаю проверенный raw main v${raw_ver}"
fi
info "Последняя версия: ${BOLD}v${latest_ver}${RESET}"
if [[ "$latest_ver" == "$VERSION" ]]; then
ok "У тебя уже последняя версия v${VERSION}"
return 0
fi
echo
echo -e " ${YELLOW}Доступно обновление: v${VERSION} → v${latest_ver}${RESET}"
echo -ne "${CYAN}Обновить? [Y/n]: ${RESET}"
read -r ans
[[ "${ans,,}" == "n" ]] && return 0
# Скачиваем новую версию во временный файл
local tmp_script tmp_sha expected_sha actual_sha downloaded_ver staging_script=""
tmp_script=$(mktemp /tmp/naiveproxy_update_XXXXXX.sh)
tmp_sha=$(mktemp /tmp/naiveproxy_update_sha_XXXXXX)
# Cleanup при любом выходе из функции
trap 'rm -f "${tmp_script:-}" "${tmp_sha:-}" "${staging_script:-}" 2>/dev/null; trap - RETURN' RETURN
info "Скачиваю v${latest_ver}..."
if ! curl -fsSL --max-time 60 "$GITHUB_RAW" -o "$tmp_script" 2>/dev/null; then
err "Ошибка загрузки скрипта"
rm -f "$tmp_script"
return 1
fi
info "Проверяю SHA256 релиза..."
if curl -fsSL --max-time 20 "$GITHUB_SHA256_RAW" -o "$tmp_sha" 2>/dev/null; then
expected_sha=$(awk '{print $1; exit}' "$tmp_sha" | tr -d '\r\n')
actual_sha=$(sha256sum "$tmp_script" | awk '{print $1}')
if [[ ! "$expected_sha" =~ ^[a-fA-F0-9]{64}$ ]]; then
warn "Файл SHA256 найден, но формат некорректный"
[[ "${NAIVEPROXY_REQUIRE_SHA:-1}" == "1" ]] && return 1
elif [[ "$actual_sha" != "$expected_sha" ]]; then
err "SHA256 не совпадает. Обновление остановлено."
echo " expected: $expected_sha"
echo " actual: $actual_sha"
return 1
else
ok "SHA256 релиза подтверждён"
fi
else
warn "SHA256 файл релиза не найден. Для аварийного обхода: NAIVEPROXY_REQUIRE_SHA=0"
[[ "${NAIVEPROXY_REQUIRE_SHA:-1}" == "1" ]] && return 1
fi
# Проверяем что скачали валидный bash скрипт
if ! bash -n "$tmp_script" 2>/dev/null; then
err "Скачанный скрипт содержит ошибки синтаксиса! Отменяю обновление."
rm -f "$tmp_script"
return 1
fi
# Проверяем что это действительно наш скрипт; второй маркер нужен только для совместимости старых self-update.
if ! grep -Eq "Yurich Panel|NaiveProxy Manager" "$tmp_script" 2>/dev/null; then
err "Скачанный файл не является Yurich Panel. Отменяю."
rm -f "$tmp_script"
return 1
fi
downloaded_ver=$(sed -nE 's/^VERSION="([0-9]+\.[0-9]+\.[0-9]+)".*/\1/p' "$tmp_script" | head -1)
if [[ -z "$downloaded_ver" || "$downloaded_ver" != "$latest_ver" ]]; then
err "VERSION скачанного файла не совпадает с объявленной версией"
echo " announced: $latest_ver"
echo " downloaded: ${downloaded_ver:-unknown}"
return 1
fi
# Определяем куда установлен скрипт
local current_script
current_script=$(realpath "$0" 2>/dev/null || echo "")
if [[ -z "$current_script" || "$current_script" == /dev/fd/* || "$current_script" == /proc/* ]]; then
current_script="$SCRIPT_PATH"
fi
[[ -f "$current_script" ]] || { err "Текущий скрипт не найден: $current_script"; return 1; }
# Бэкап обязателен, а staging создаётся в том же каталоге для атомарного rename.
local backup_path="${current_script}.v${VERSION}.bak" current_dir installed_ver
current_dir=$(dirname "$current_script")
staging_script=$(mktemp "${current_dir}/.yurich-panel.update.XXXXXX") || {
err "Не удалось создать staging-файл рядом с $current_script"
return 1
}
if ! cp -p -- "$current_script" "$backup_path"; then
err "Не удалось создать обязательный бэкап: $backup_path"
return 1
fi
ok "Бэкап текущей версии: $backup_path"
if ! install -m 755 "$tmp_script" "$staging_script" || ! mv -f -- "$staging_script" "$current_script"; then
err "Не удалось атомарно установить обновление"
install -m 755 "$backup_path" "$current_script" 2>/dev/null || true
return 1
fi
staging_script=""
installed_ver=$(bash "$current_script" version 2>/dev/null | sed -nE 's/^Yurich Panel v([0-9]+\.[0-9]+\.[0-9]+)$/\1/p' | head -1)
if [[ "$installed_ver" != "$downloaded_ver" ]]; then
err "Проверка установленного скрипта не пройдена. Выполняю rollback."
install -m 755 "$backup_path" "$current_script"
return 1
fi
info "Запускаю безопасные post-update миграции..."
if ! bash "$current_script" post-update "$VERSION"; then
err "Post-update миграция не пройдена. Возвращаю предыдущую версию скрипта."
install -m 755 "$backup_path" "$current_script"
return 1
fi
# Обновляем основной путь и legacy alias, чтобы старые установки не ломались.
if [[ "$current_script" != "$SCRIPT_PATH" ]]; then
install -m 755 "$current_script" "$SCRIPT_PATH" 2>/dev/null || warn "Не удалось синхронизировать $SCRIPT_PATH"
fi
if [[ -n "${LEGACY_SCRIPT_PATH:-}" && "$current_script" != "$LEGACY_SCRIPT_PATH" ]]; then
install -m 755 "$current_script" "$LEGACY_SCRIPT_PATH" 2>/dev/null || warn "Не удалось синхронизировать $LEGACY_SCRIPT_PATH"
fi
ok "Скрипт обновлён: v${VERSION} → v${latest_ver}"
tg_send "🔄 Yurich Panel обновлён
📦 Было: v${VERSION}
📦 Стало: v${latest_ver}
🕐 $(date '+%Y-%m-%d %H:%M:%S')"
echo
info "Перезапускаю обновлённый скрипт..."
sleep 1
local restart_script="$current_script"
if [[ -n "${LEGACY_SCRIPT_PATH:-}" && "$current_script" == "$LEGACY_SCRIPT_PATH" ]]; then
restart_script="$SCRIPT_PATH"
fi
exec bash "$restart_script"
}
# ── Тихая проверка обновлений при запуске ─────────────────────
check_update_available() {
# Запускаем в фоне чтобы не тормозить старт
(
local latest_ver
latest_ver=$(curl -s --max-time 5 "$GITHUB_RAW" 2>/dev/null | grep '^VERSION=' | grep -oP '"\K[^"]+' || echo "")
if [[ -n "$latest_ver" && "$latest_ver" != "$VERSION" ]]; then
echo -e "\n ${YELLOW}[UPDATE] Доступно обновление скрипта: v${VERSION} → v${latest_ver}${RESET}"
echo -e " ${YELLOW} Меню → 14) Обновить скрипт${RESET}\n"
fi
) &
}
# ─── ДИАГНОСТИКА СИСТЕМЫ ──────────────────────────────────────
cmd_diagnose_fix() {
load_config 2>/dev/null || true
load_users 2>/dev/null || true
hr
echo -e "${BOLD} [FIX] Автофикс Yurich Panel${RESET}"
hr
local changed=0
mkdir -p "$CONFIG_DIR" "$CADDY_DIR" "$LOG_DIR" "$WEBROOT" 2>/dev/null || true
ensure_web_privacy_files 2>/dev/null || true
[[ -f "$CONFIG_FILE" ]] && chown root:root "$CONFIG_FILE" 2>/dev/null || true
[[ -f "$CONFIG_FILE" ]] && chmod 600 "$CONFIG_FILE" 2>/dev/null || true
[[ -f "$USERS_FILE" ]] && chown root:root "$USERS_FILE" 2>/dev/null || true
[[ -f "$USERS_FILE" ]] && chmod 600 "$USERS_FILE" 2>/dev/null || true
[[ -f "$XRAY_USERS_FILE" ]] && chmod 600 "$XRAY_USERS_FILE" 2>/dev/null || true
[[ -f "$XRAY_COMPAT_USERS_FILE" ]] && chmod 600 "$XRAY_COMPAT_USERS_FILE" 2>/dev/null || true
if [[ -n "${DOMAIN:-}" && -f "$USERS_FILE" && "$(active_user_count)" -gt 0 ]]; then
info "Перегенерирую Caddyfile по текущему режиму..."
if rewrite_caddyfile_current; then
changed=1
else
warn "Caddyfile не удалось перегенерировать"
fi
else
warn "Caddyfile не генерирую: не задан DOMAIN или нет активных пользователей"
fi
if [[ -x "$CADDY_BIN" && -f "$CADDYFILE" ]]; then
if "$CADDY_BIN" validate --config "$CADDYFILE" >/dev/null 2>&1; then
if systemctl is-active caddy >/dev/null 2>&1; then
systemctl reload caddy >/dev/null 2>&1 || systemctl restart caddy >/dev/null 2>&1 || true
else
systemctl restart caddy >/dev/null 2>&1 || true
fi
ok "Caddy validate/start/reload выполнен"
else
err "Caddyfile всё ещё невалиден: caddy validate --config $CADDYFILE"
fi
else
warn "Caddy binary или Caddyfile отсутствует. Если модуль forward_proxy пропал — запусти: sudo bash yurich-panel.sh update"
fi
if hysteria_tls_layout_needs_repair; then
info "Исправляю TLS sandbox Hysteria 2..."
if cmd_hysteria_repair; then
changed=1
else
warn "Автофикс Hysteria не выполнен; рабочее состояние восстановлено"
fi
fi
if command -v ufw >/dev/null 2>&1; then
setup_firewall || true
[[ -n "${HYSTERIA_PORT:-}" ]] && ufw allow "${HYSTERIA_PORT}/udp" comment "Hysteria2 QUIC" >/dev/null 2>&1 || true
apply_hysteria_port_hop || true
if [[ -x "$XRAY_BIN" || -f "$XRAY_CONFIG" ]]; then
apply_xray_reality_firewall
cleanup_xray_legacy_transports
fi
ok "UFW правила проверены/обновлены"
else
apt-get update -qq && apt-get install -y -q ufw && setup_firewall || warn "Не удалось установить/настроить UFW"
fi
if [[ "${DEVICE_LIMIT_ENABLED:-0}" == "1" ]]; then
write_device_cron
fi
if [[ ! -f "$EXPIRY_NOTIFY_CRON" ]]; then
cmd_notify_expiry_install || warn "Не удалось установить ежедневный expiry enforcement"
fi
if command -v fail2ban-client >/dev/null 2>&1; then
systemctl restart fail2ban >/dev/null 2>&1 || true
fi
if [[ -x "$XRAY_BIN" && -f "$XRAY_CONFIG" ]]; then
if "$XRAY_BIN" run -test -config "$XRAY_CONFIG" >/dev/null 2>&1; then
systemctl restart xray >/dev/null 2>&1 || true
ok "Xray config валиден, сервис перезапущен"
else
warn "Xray config невалиден. Попробуй: sudo bash yurich-panel.sh xray-install"
fi
fi
if [[ "${WARP_PROXY_ENABLED:-0}" == "1" ]] && command -v warp-cli >/dev/null 2>&1; then
systemctl enable --now warp-svc >/dev/null 2>&1 || systemctl enable --now cloudflare-warp >/dev/null 2>&1 || true
warp_cli connect >/dev/null 2>&1 || true
fi
systemctl daemon-reload >/dev/null 2>&1 || true
ok "Автофикс завершён"
[[ "$changed" -eq 1 ]] && info "После автофикса можно проверить: sudo bash yurich-panel.sh diagnose"
}
cmd_diagnose() {
if [[ "${1:-}" == "--fix" || "${1:-}" == "fix" ]]; then
cmd_diagnose_fix
return
fi
load_config 2>/dev/null || true
local pass=0 warn=0 fail=0
local report=""
# Хелперы вывода — используем pass+=1 вместо pass=$((pass+1)) из-за set -e
_ok() { echo -e " ${GREEN}[OK] $1${RESET}"; report+="[OK] $1\n"; pass=$((pass+1)); }
_warn() { echo -e " ${YELLOW}[WARN] $1${RESET}"; report+="[WARN] $1\n"; warn=$((warn+1)); }
_fail() { echo -e " ${RED}[FAIL] $1${RESET}"; report+="[FAIL] $1\n"; fail=$((fail+1)); }
_info() { echo -e " ${CYAN}[INFO] $1${RESET}"; }
_sep() { echo -e " ${DIM}──────────────────────────────────────${RESET}"; }
hr
echo -e "${BOLD} [DIAG] Диагностика Yurich Panel v${VERSION}${RESET}"
echo -e " $(date '+%Y-%m-%d %H:%M:%S') · $(hostname)"
hr
echo
# ── БЛОК 1: CADDY ─────────────────────────────────────────
echo -e " ${BOLD}[1/7] Caddy${RESET}"
_sep
# Caddy существует
if [[ -f "${CADDY_BIN}" ]]; then
local caddy_ver
caddy_ver=$("${CADDY_BIN}" version 2>/dev/null | head -1 || echo "неизвестно")
_ok "Caddy найден: ${caddy_ver}"
else
_fail "Caddy не найден: ${CADDY_BIN}"
fi
# Caddy запущен
if systemctl is-active caddy &>/dev/null; then
local uptime_caddy
uptime_caddy=$(systemctl show caddy --property=ActiveEnterTimestamp | cut -d= -f2 | xargs -I{} date -d "{}" '+%Y-%m-%d %H:%M' 2>/dev/null || echo "н/д")
_ok "Caddy запущен (с ${uptime_caddy})"
else
_fail "Caddy НЕ запущен! Запусти: systemctl start caddy"
fi
# Naive padding в бинарнике
if ! command -v strings &>/dev/null; then
info "Устанавливаю binutils для проверки padding..."
apt-get install -y -q binutils 2>/dev/null || true
fi
if command -v strings &>/dev/null && [[ -f "${CADDY_BIN}" ]]; then
# Проверяем naive padding по нескольким признакам
local _pad_count
_pad_count=$(strings "${CADDY_BIN}" 2>/dev/null | grep -cE "^(Padding|SetPadding|WithPadding|writePadding|PaddingLength)$" || true)
_pad_count="${_pad_count//[^0-9]/}"
_pad_count="${_pad_count:-0}"
if [[ "${_pad_count}" -ge 2 ]]; then
_ok "Naive padding модуль подтверждён (${_pad_count} символов)"
else
_fail "Naive padding НЕ найден в Caddy — пересобери: sudo bash yurich-panel.sh update"
fi
else
_warn "strings недоступен — установи: apt install binutils"
fi
# forward_proxy модуль
if "${CADDY_BIN}" list-modules 2>/dev/null | grep "forward_proxy" >/dev/null; then
_ok "Модуль forward_proxy загружен"
else
_fail "Модуль forward_proxy НЕ найден"
fi
echo
# ── БЛОК 2: CADDYFILE ─────────────────────────────────────
echo -e " ${BOLD}[2/7] Конфигурация${RESET}"
_sep
if [[ -f "${CADDYFILE}" ]]; then
_ok "Caddyfile найден: ${CADDYFILE}"
# Naive CONNECT uses the target host in :authority, so the proxy block needs :443 catch-all.
if grep -q "^:443," "${CADDYFILE}"; then
_ok "Caddyfile: Naive forward proxy catch-all ':443, domain'"
elif edge_routing_mode_is_haproxy && grep -q "^:${XRAY_CADDY_FALLBACK_PORT:-$XRAY_CADDY_FALLBACK_PORT_DEFAULT}," "${CADDYFILE}"; then
_ok "Caddyfile: HAProxy fallback port ${XRAY_CADDY_FALLBACK_PORT:-$XRAY_CADDY_FALLBACK_PORT_DEFAULT}"
elif grep -qE "^http://127\\.0\\.0\\.1:[0-9]+" "${CADDYFILE}"; then
_ok "Caddyfile: Xray fallback mode"
elif grep -qE "^[[:alnum:].-]+:443[[:space:]]*\\{" "${CADDYFILE}"; then
_warn "Caddyfile: 'domain:443' может ломать Naive CONNECT — перегенерируй через safe-apply"
else
_warn "Caddyfile: не распознал site label"
fi
local hosts_overrides hosts_domains
hosts_overrides=$(hosts_public_domain_overrides | head -5 || true)
if [[ -n "$hosts_overrides" ]]; then
hosts_domains=$(printf '%s\n' "$hosts_overrides" | format_hosts_override_domains)
_warn "/etc/hosts подменяет публичные домены: ${hosts_domains}"
else
_ok "/etc/hosts не подменяет публичные домены"
fi
# order forward_proxy
if grep -q "order forward_proxy before file_server" "${CADDYFILE}"; then
_ok "Caddyfile: order forward_proxy — OK"
else
_warn "Caddyfile: отсутствует 'order forward_proxy before file_server'"
fi
# probe_resistance
if grep -q "probe_resistance" "${CADDYFILE}"; then
_ok "probe_resistance включён"
else
_warn "probe_resistance отключён — сервер видим для сканеров"
fi
# Пользователи
local user_count=0
[[ -f "${USERS_FILE}" ]] && user_count=$(get_users | wc -l)
if [[ ${user_count} -gt 0 ]]; then
_ok "Пользователей: ${user_count}"
else
_fail "Нет пользователей! Добавь: sudo bash yurich-panel.sh users"
fi
# Caddy validate
if "${CADDY_BIN}" validate --config "${CADDYFILE}" &>/dev/null; then
_ok "Caddyfile валиден (caddy validate passed)"
else
_fail "Ошибка в Caddyfile! Проверь: caddy validate --config ${CADDYFILE}"
fi
else
_fail "Caddyfile не найден: ${CADDYFILE}"
fi
echo
# ── БЛОК 3: TLS / СЕТЬ ────────────────────────────────────
echo -e " ${BOLD}[3/7] TLS и сеть${RESET}"
_sep
local domain="${DOMAIN:-}"
if [[ -z "${domain}" ]]; then
_warn "Домен не настроен — пропускаю сетевые проверки"
else
_info "Домен: ${domain}"
# DNS → IP
local dns_ip server_ip
dns_ip=$(dig +short "${domain}" 2>/dev/null | grep -E '^[0-9]+\.' | head -1 || echo "")
server_ip=$(curl -s4 --max-time 5 https://ifconfig.me 2>/dev/null || curl -s4 --max-time 5 https://api.ipify.org 2>/dev/null || echo "")
if [[ -z "${dns_ip}" ]]; then
_fail "DNS не резолвится для ${domain}"
elif [[ "${dns_ip}" == "${server_ip}" ]]; then
_ok "DNS: ${domain} → ${dns_ip} (совпадает с IP сервера)"
else
_fail "DNS: ${domain} → ${dns_ip} НЕ совпадает с IP сервера ${server_ip}"
fi
# Порт 80
if ss -tlnp | grep -E ":80([[:space:]]|$)" >/dev/null; then
_ok "Порт 80 слушается (ACME)"
else
_warn "Порт 80 не слушается — Let's Encrypt может не работать"
fi
# Порт 443
if ss -tlnp | grep -E ":443([[:space:]]|$)" >/dev/null; then
_ok "Порт 443 слушается"
else
_fail "Порт 443 не слушается!"
fi
# ALPN h2
local alpn
alpn=$(echo | timeout 8 openssl s_client \
-connect "${domain}:443" \
-alpn h2 \
-servername "${domain}" \
2>/dev/null | grep -a "ALPN protocol" | awk '{print $3}')
alpn="${alpn//[^a-z0-9]/}" # убираем лишние символы
if [[ "${alpn}" == "h2" ]]; then
_ok "ALPN: h2 ✓ (HTTP/2 работает)"
else
_warn "ALPN: не h2 (получено: '${alpn}') — возможно сервер за NAT или firewall"
fi
# TLS сертификат
local cert_days=0
local cert_info
cert_info=$(echo | timeout 8 openssl s_client \
-connect "${domain}:443" \
-servername "${domain}" \
2>/dev/null | openssl x509 -noout -dates 2>/dev/null || echo "")
if [[ -n "${cert_info}" ]]; then
local not_after expire_ts now_ts
not_after=$(echo "${cert_info}" | grep "notAfter" | cut -d= -f2)
expire_ts=$(date -d "${not_after}" +%s 2>/dev/null || echo 0)
now_ts=$(date +%s)
cert_days=$(( (expire_ts - now_ts) / 86400 ))
if [[ ${cert_days} -gt 30 ]]; then
_ok "TLS сертификат действителен ещё ${cert_days} дней"
elif [[ ${cert_days} -gt 7 ]]; then
_warn "TLS сертификат истекает через ${cert_days} дней"
else
_fail "TLS сертификат истекает через ${cert_days} дней! Срочно!"
fi
else
_fail "Не удалось получить TLS сертификат для ${domain}"
fi
fi
echo
# ── БЛОК 4: FIREWALL ──────────────────────────────────────
echo -e " ${BOLD}[4/7] Firewall${RESET}"
_sep
# UFW
if command -v ufw &>/dev/null; then
if ufw status | grep -q "Status: active"; then
_ok "UFW активен"
# Проверяем нужные порты
for port in "80/tcp" "443/tcp" "443/udp"; do
if ufw status | grep -q "${port}"; then
_ok "UFW: порт ${port} открыт"
else
_warn "UFW: порт ${port} НЕ открыт"
fi
done
else
_fail "UFW неактивен! Включи: ufw enable"
fi
else
_warn "UFW не установлен"
fi
# Fail2Ban
if systemctl is-active fail2ban &>/dev/null; then
local banned_count
banned_count=$(fail2ban-client status sshd 2>/dev/null | grep "Currently banned" | awk '{print $NF}' || echo "0")
_ok "Fail2Ban активен (сейчас забанено SSH: ${banned_count})"
else
_warn "Fail2Ban не запущен — SSH не защищён от брутфорса"
fi
# DNS / Unbound
if command -v unbound &>/dev/null; then
if systemctl is-active --quiet unbound 2>/dev/null; then
_ok "DNS (Unbound): $(unbound_mode_label), gateway=${UNBOUND_GATEWAY_IP:-127.0.0.1}, vpn=${UNBOUND_VPN_ENABLED:-0}"
else
_warn "DNS (Unbound) установлен, но сервис не активен"
fi
if [[ -f "${DNS_CONF:-/etc/unbound/unbound.conf.d/yurich-dns.conf}" ]] && unbound-checkconf "${DNS_CONF:-/etc/unbound/unbound.conf.d/yurich-dns.conf}" >/dev/null 2>&1; then
_ok "Unbound config валиден"
else
_warn "Unbound config не найден или содержит ошибку"
fi
if command -v dig >/dev/null 2>&1 && dig "@127.0.0.1" google.com +short +time=2 +tries=1 2>/dev/null | grep -Eq '^[0-9a-fA-F:.]+$'; then
_ok "DNS (Unbound) отвечает на 127.0.0.1:53"
else
_warn "DNS (Unbound) test не прошёл"
fi
else
_info "DNS (Unbound) не установлен (меню → 17)"
fi
# WARP modes — proxy/full-tunnel
if command -v warp-cli &>/dev/null; then
local warp_port warp_trace warp_mode
warp_port="${WARP_PROXY_PORT:-$WARP_PROXY_PORT_DEFAULT}"
warp_mode="${WARP_MODE:-off}"
if [[ "$warp_mode" == "warp" || "$warp_mode" == "warp+doh" ]]; then
warp_trace=$(curl -fsSL --connect-timeout 5 --max-time 12 \
https://www.cloudflare.com/cdn-cgi/trace 2>/dev/null || true)
if echo "$warp_trace" | grep -q '^warp=on'; then
_ok "WARP full tunnel: warp=on (${warp_mode}, ${WARP_PROTOCOL:-auto})"
elif [[ -n "$warp_trace" ]]; then
_warn "WARP full tunnel не подтвердил warp=on"
else
_warn "WARP full tunnel test не прошёл"
fi
else
if ss -tlnp 2>/dev/null | grep -Eq "(127\.0\.0\.1|\*):${warp_port}[[:space:]]|:${warp_port}[[:space:]]"; then
_ok "WARP proxy слушает локально: 127.0.0.1:${warp_port}"
else
_warn "WARP установлен, но локальный proxy порт ${warp_port} не слушается"
fi
warp_trace=$(curl -fsSL --connect-timeout 5 --max-time 9 -x "http://127.0.0.1:${warp_port}" \
https://www.cloudflare.com/cdn-cgi/trace 2>/dev/null || \
curl -fsSL --connect-timeout 5 --max-time 9 --socks5-hostname "127.0.0.1:${warp_port}" \
https://www.cloudflare.com/cdn-cgi/trace 2>/dev/null || true)
if echo "$warp_trace" | grep -q '^warp=on'; then
_ok "WARP proxy test: warp=on"
elif [[ -n "$warp_trace" ]]; then
_warn "WARP proxy отвечает, но trace не показал warp=on — общий IP VPS в proxy mode не меняется"
else
_warn "WARP proxy test не прошёл"
fi
fi
else
_info "WARP не установлен (опционально: меню → 21)"
fi
if [[ -x "$XRAY_BIN" || -f "$XRAY_CONFIG" ]]; then
if systemctl is-active xray &>/dev/null; then
_ok "Xray: сервис активен"
else
_warn "Xray установлен, но сервис не активен"
fi
if [[ -x "$XRAY_BIN" && -f "$XRAY_CONFIG" ]] && "$XRAY_BIN" run -test -config "$XRAY_CONFIG" >/dev/null 2>&1; then
_ok "Xray config валиден"
else
_warn "Xray config не проверен или содержит ошибку"
fi
if [[ "${XRAY_FALLBACK_ENABLED:-0}" == "1" ]]; then
if ss -tlnp 2>/dev/null | grep -E ":443([[:space:]]|$)" >/dev/null; then
_ok "Xray fallback hub: порт 443 слушается"
else
_fail "Xray fallback hub включён, но порт 443 не слушается"
fi
fi
else
_info "Xray Modern не установлен (опционально: меню → 23)"
fi
echo
# ── БЛОК 5: РЕСУРСЫ ───────────────────────────────────────
echo -e " ${BOLD}[5/7] Ресурсы системы${RESET}"
_sep
# RAM
local ram_used ram_total ram_pct
ram_used=$(free -m | awk '/Mem:/{print $3}')
ram_total=$(free -m | awk '/Mem:/{print $2}')
ram_pct=$(( ram_used * 100 / ram_total ))
if [[ ${ram_pct} -lt 80 ]]; then
_ok "RAM: ${ram_used}/${ram_total} MB (${ram_pct}%)"
elif [[ ${ram_pct} -lt 95 ]]; then
_warn "RAM: ${ram_used}/${ram_total} MB (${ram_pct}%) — высокое потребление"
else
_fail "RAM: ${ram_used}/${ram_total} MB (${ram_pct}%) — критически мало!"
fi
# Диск
local disk_used disk_total disk_pct
disk_pct=$(df / | awk 'NR==2{print $5}' | tr -d '%')
disk_used=$(df -h / | awk 'NR==2{print $3}')
disk_total=$(df -h / | awk 'NR==2{print $2}')
if [[ ${disk_pct} -lt 80 ]]; then
_ok "Диск: ${disk_used}/${disk_total} (${disk_pct}%)"
elif [[ ${disk_pct} -lt 95 ]]; then
_warn "Диск: ${disk_used}/${disk_total} (${disk_pct}%) — мало места"
else
_fail "Диск: ${disk_used}/${disk_total} (${disk_pct}%) — критически мало!"
fi
# Load average
local load
load=$(uptime | awk -F'load average:' '{print $2}' | awk '{print $1}' | tr -d ',')
local cpus
cpus=$(nproc)
local load_pct
load_pct=$(echo "${load} ${cpus}" | awk '{printf "%d", ($1/$2)*100}')
if [[ ${load_pct} -lt 80 ]]; then
_ok "Нагрузка CPU: ${load} (${load_pct}% от ${cpus} ядер)"
else
_warn "Нагрузка CPU: ${load} (${load_pct}%) — высокая"
fi
echo
# ── БЛОК 6: ЛОГИ ──────────────────────────────────────────
echo -e " ${BOLD}[6/7] Анализ логов${RESET}"
_sep
local log_errors=0
if [[ -f "${LOG_DIR}/access.log" ]]; then
# Считаем ошибки за последние 100 строк
log_errors=$(tail -100 "${LOG_DIR}/access.log" 2>/dev/null \
| python3 -c "
import sys,json
errs=0
for line in sys.stdin:
try:
d=json.loads(line)
if d.get('status',200) >= 500: errs+=1
except: pass
print(errs)
" 2>/dev/null || true)
log_errors="${log_errors//[^0-9]/}"
log_errors="${log_errors:-0}"
local connect_count
connect_count=$(tail -100 "${LOG_DIR}/access.log" 2>/dev/null \
| grep -c '"CONNECT"' 2>/dev/null || true)
connect_count="${connect_count//[^0-9]/}"
connect_count="${connect_count:-0}"
if [[ ${log_errors} -eq 0 ]]; then
_ok "Логи: нет серверных ошибок (последние 100 запросов)"
else
_warn "Логи: ${log_errors} ошибок в последних 100 запросах"
fi
_info "CONNECT туннелей в последних 100 записях: ${connect_count}"
if [[ "${DEVICE_LIMIT_ENABLED:-0}" == "1" ]]; then
local dev_report dev_over
dev_report=$(mktemp)
if device_usage_report "${DEVICE_WINDOW_HOURS:-$DEVICE_WINDOW_HOURS_DEFAULT}" > "$dev_report"; then
dev_over=$(awk -F'\t' -v limit="${DEVICE_LIMIT:-$DEVICE_LIMIT_DEFAULT}" '$2+0 > limit {c++} END{print c+0}' "$dev_report")
if [[ "$dev_over" -eq 0 ]]; then
_ok "Лимит устройств: превышений нет"
else
_warn "Лимит устройств: пользователей с превышением: ${dev_over}"
fi
else
_warn "Лимит устройств включён, но naive.log не найден"
fi
rm -f "$dev_report"
else
_info "Лимит устройств выключен (опционально: меню → 22)"
fi
else
_warn "Лог файл не найден: ${LOG_DIR}/access.log"
fi
# Ошибки Caddy в journald
local caddy_errors
caddy_errors=$(journalctl -u caddy -n 50 --no-pager 2>/dev/null \
| grep -ci "error\|panic\|fatal" 2>/dev/null || true)
caddy_errors="${caddy_errors//[^0-9]/}" # оставляем только цифры
caddy_errors="${caddy_errors:-0}"
if [[ "${caddy_errors}" -eq 0 ]]; then
_ok "journald: нет критических ошибок Caddy"
else
_warn "journald: найдено ${caddy_errors} строк с ошибками — проверь: journalctl -u caddy -n 50"
fi
echo
# ── БЛОК 7: ВЕРСИЯ И ОБНОВЛЕНИЯ ───────────────────────────
echo -e " ${BOLD}[7/7] Версия и обновления${RESET}"
_sep
_info "Текущая версия скрипта: v${VERSION}"
local latest_ver
latest_ver=$(curl -s --max-time 8 "${GITHUB_RAW}" 2>/dev/null | grep '^VERSION=' | grep -oP '"\K[^"]+' || echo "")
if [[ -n "${latest_ver}" ]]; then
if [[ "${latest_ver}" == "${VERSION}" ]]; then
_ok "Скрипт актуален: v${VERSION}"
else
_warn "Доступно обновление: v${VERSION} → v${latest_ver} (меню → 14)"
fi
else
_warn "Не удалось проверить обновления"
fi
# SSH Hardening выполнен?
if [[ -f "${SSH_HARDENING_DONE}" ]]; then
local ssh_port_saved
ssh_port_saved=$(grep SSH_PORT "${SSH_HARDENING_DONE}" 2>/dev/null | cut -d= -f2 || echo "н/д")
_ok "SSH Hardening выполнен (порт: ${ssh_port_saved})"
else
_warn "SSH Hardening не выполнен — рекомендуется: меню → 12"
fi
# ── ИТОГ ──────────────────────────────────────────────────
echo
hr
echo -e " ${BOLD}[SUMMARY] ИТОГ ДИАГНОСТИКИ${RESET}"
hr
echo -e " ${GREEN}[OK] Пройдено: ${pass}${RESET}"
echo -e " ${YELLOW}[WARN] Внимание: ${warn}${RESET}"
echo -e " ${RED}[FAIL] Проблемы: ${fail}${RESET}"
echo
if [[ ${fail} -eq 0 && ${warn} -eq 0 ]]; then
echo -e " ${GREEN}${BOLD}[OK] Всё работает отлично!${RESET}"
elif [[ ${fail} -eq 0 ]]; then
echo -e " ${YELLOW}${BOLD}[WARN] Есть предупреждения — рекомендуется проверить${RESET}"
else
echo -e " ${RED}${BOLD}[FAIL] Найдены проблемы — требуется вмешательство${RESET}"
fi
hr
# Отправляем отчёт в Telegram если настроен
echo -ne "\n${YELLOW}Отправить отчёт в Telegram? [y/N]: ${RESET}"
read -r ans
if [[ "${ans,,}" == "y" ]]; then
tg_send "🔍 Диагностика Yurich Panel
🖥 Сервер: $(hostname)
🕐 $(date '+%Y-%m-%d %H:%M:%S')
${report}
✅ Пройдено: ${pass} ⚠️ Внимание: ${warn} ❌ Проблемы: ${fail}"
ok "Отчёт отправлен в Telegram"
fi
}
# ══════════════════════════════════════════════════════════════
# TELEGRAM BOT — ИНТЕРАКТИВНОЕ УПРАВЛЕНИЕ
# ══════════════════════════════════════════════════════════════
# Проверка что пользователь является администратором
tg_is_admin() {
local from_id="$1"
# Валидация: from_id должен быть числом
[[ ! "${from_id}" =~ ^[0-9]+$ ]] && return 1
# Основной admin
[[ -n "${TG_CHAT_ID:-}" && "${from_id}" == "${TG_CHAT_ID}" ]] && return 0
# Дополнительные admins
if [[ -n "${TG_ADMINS:-}" ]]; then
local IFS=','
for admin_id in ${TG_ADMINS}; do
admin_id="${admin_id// /}"
[[ "${from_id}" == "${admin_id}" ]] && return 0
done
fi
return 1
}
tg_admin_ids() {
local admin_id
if [[ -n "${TG_CHAT_ID:-}" && "${TG_CHAT_ID}" =~ ^[0-9]+$ ]]; then
printf '%s\n' "$TG_CHAT_ID"
fi
if [[ -n "${TG_ADMINS:-}" ]]; then
local IFS=','
for admin_id in ${TG_ADMINS}; do
admin_id="${admin_id// /}"
[[ "$admin_id" =~ ^[0-9]+$ ]] && printf '%s\n' "$admin_id"
done
fi
}
# Отправка сообщения конкретному chat_id
tg_reply() {
local chat_id="$1"
local message="$2"
[[ -z "${TG_TOKEN:-}" ]] && return
tg_api "sendMessage" -s --max-time 10 -X POST --data-urlencode "chat_id=${chat_id}" --data-urlencode "parse_mode=HTML" --data-urlencode "text=${message}" >/dev/null 2>&1 || true
}
tg_user_commands_json() {
cat <<'EOF'
[
{"command":"start","description":"Открыть пользовательское меню"},
{"command":"help","description":"Как подключить уведомления"},
{"command":"myid","description":"Показать мой Telegram ID"},
{"command":"apps","description":"Скачать приложения"},
{"command":"support","description":"Связаться с поддержкой"}
]
EOF
}
tg_bot_commands_json() {
cat <<'EOF'
[
{"command":"start","description":"Открыть меню"},
{"command":"help","description":"Помощь и список команд"},
{"command":"menu","description":"Показать кнопки управления"},
{"command":"status","description":"Статус сервера"},
{"command":"stats","description":"Статистика ресурсов и трафика"},
{"command":"haproxy","description":"HAProxy SNI mux и маршруты"},
{"command":"diagnose","description":"Диагностика системы"},
{"command":"logs","description":"Последние логи Caddy"},
{"command":"cert","description":"Статус TLS сертификата"},
{"command":"users","description":"Список пользователей"},
{"command":"adduser","description":"Добавить пользователя"},
{"command":"deluser","description":"Удалить пользователя"},
{"command":"qr","description":"QR и ссылка пользователя"},
{"command":"sub","description":"Страница подписки"},
{"command":"subreset","description":"Перевыпустить подписку"},
{"command":"expiring","description":"Сроки подписок и Telegram ID"},
{"command":"bindtg","description":"Привязать Telegram ID к пользователю"},
{"command":"notifyrun","description":"Запустить проверку уведомлений"},
{"command":"testnotify","description":"Тест уведомления пользователю"},
{"command":"news_test","description":"Тест новости себе"},
{"command":"news","description":"Разослать новость пользователям"},
{"command":"devices","description":"Лимит устройств"},
{"command":"lockuser","description":"Отключить пользователя"},
{"command":"unlockuser","description":"Включить пользователя"},
{"command":"xray","description":"Xray ссылки пользователя"},
{"command":"xrayadduser","description":"Создать Xray пользователя"},
{"command":"xraystatus","description":"Статус Xray"},
{"command":"hysteria","description":"Статус Hysteria 2"},
{"command":"warp","description":"Статус WARP"},
{"command":"restart","description":"Перезапустить Caddy"},
{"command":"update","description":"Обновить Caddy"},
{"command":"selfupdate","description":"Обновить скрипт"},
{"command":"diagfix","description":"Автофикс проблем"},
{"command":"privatepage","description":"Личная фейковая страница"},
{"command":"admins","description":"Список администраторов"},
{"command":"addadmin","description":"Добавить администратора"},
{"command":"deladmin","description":"Удалить администратора"},
{"command":"donate","description":"Поддержать проект"}
]
EOF
}
tg_apply_bot_menu() {
[[ -z "${TG_TOKEN:-}" ]] && { err "Telegram не настроен"; return 1; }
local user_commands admin_commands menu_button resp_cmd resp_menu admin_id admin_scope admin_resp failed=0
user_commands=$(tg_user_commands_json | tr -d '\n')
admin_commands=$(tg_bot_commands_json | tr -d '\n')
menu_button='{"type":"commands"}'
resp_cmd=$(tg_api "setMyCommands" -s --max-time 15 \
-X POST \
--data-urlencode "commands=${user_commands}" \
2>/dev/null || echo "{}")
if ! echo "$resp_cmd" | grep -q '"ok":true'; then
err "Не удалось установить пользовательское Telegram commands menu"
echo "$resp_cmd"
return 1
fi
while IFS= read -r admin_id; do
[[ -z "$admin_id" ]] && continue
admin_scope=$(printf '{"type":"chat","chat_id":%s}' "$admin_id")
admin_resp=$(tg_api "setMyCommands" -s --max-time 15 \
-X POST \
--data-urlencode "commands=${admin_commands}" \
--data-urlencode "scope=${admin_scope}" \
2>/dev/null || echo "{}")
if ! echo "$admin_resp" | grep -q '"ok":true'; then
warn "Не удалось установить админское меню для Telegram ID ${admin_id}"
failed=$((failed + 1))
fi
done < <(tg_admin_ids | sort -u)
resp_menu=$(tg_api "setChatMenuButton" -s --max-time 15 \
-X POST \
--data-urlencode "menu_button=${menu_button}" \
2>/dev/null || echo "{}")
if echo "$resp_menu" | grep -q '"ok":true'; then
ok "Telegram Menu button включён"
else
warn "Команды установлены, но Menu button не подтвердился"
echo "$resp_menu"
fi
[[ "$failed" -eq 0 ]]
}
tg_apply_bot_menu_silent() {
tg_apply_bot_menu >/dev/null 2>&1 || true
}
tg_main_menu_markup() {
cat <<'EOF'
{"keyboard":[[{"text":"📊 Статус"},{"text":"👥 Пользователи"}],[{"text":"➕ Добавить пользователя"},{"text":"🗑 Удалить пользователя"}],[{"text":"📱 QR / ссылка"},{"text":"🔗 Подписка"}],[{"text":"📰 Новости"},{"text":"🔔 Уведомления"}],[{"text":"🧬 Xray"},{"text":"⚡ Hysteria"},{"text":"🌀 WARP"}],[{"text":"🔀 HAProxy"},{"text":"🔍 Диагностика"}],[{"text":"📄 Логи"},{"text":"♻️ Restart Caddy"}],[{"text":"🛠 Автофикс"},{"text":"💛 Донат"}],[{"text":"❓ Помощь"}]],"resize_keyboard":true,"one_time_keyboard":false,"is_persistent":true}
EOF
}
tg_user_menu_markup() {
cat <<'EOF'
{"keyboard":[[{"text":"🆔 Мой Telegram ID"},{"text":"🔔 Уведомления"}],[{"text":"📱 Приложения"},{"text":"💬 Поддержка"}]],"resize_keyboard":true,"one_time_keyboard":false,"is_persistent":true}
EOF
}
tg_reply_menu() {
local chat_id="$1"
local message="$2"
local menu_kind="${3:-admin}"
local reply_markup
[[ -z "${TG_TOKEN:-}" ]] && return
if [[ "$menu_kind" == "user" ]]; then
reply_markup=$(tg_user_menu_markup)
else
reply_markup=$(tg_main_menu_markup)
fi
tg_api "sendMessage" -s --max-time 10 \
-X POST \
--data-urlencode "chat_id=${chat_id}" \
--data-urlencode "parse_mode=HTML" \
--data-urlencode "text=${message}" \
--data-urlencode "reply_markup=${reply_markup}" \
>/dev/null 2>&1 || true
}
tg_user_welcome_message() {
local from_id="$1" safe_id safe_android safe_windows safe_support
safe_id=$(html_escape_text "$from_id")
safe_android=$(html_escape_text "$ANDROID_APP_RELEASES_URL")
safe_windows=$(html_escape_text "$WINDOWS_APP_RELEASES_URL")
safe_support=$(html_escape_text "$TELEGRAM_COMMUNITY_URL")
cat <${safe_id}
Отправь этот ID Ивану Юрьевичу вместе с именем профиля, чтобы получать уведомления об окончании подписки, важные новости и сервисные сообщения.
📱 Android: ${safe_android}
🖥 Windows: ${safe_windows}
💬 Поддержка: ${safe_support}
EOF
}
# ─── SALES BOT: продажи и автовыдача подписок ────────────────
sales_tg_api() {
[[ -n "${SALES_BOT_TOKEN:-}" ]] || return 1
tg_api_with_token "$SALES_BOT_TOKEN" "$@"
}
sales_reply() {
local chat_id="$1" message="$2"
[[ -n "${SALES_BOT_TOKEN:-}" ]] || return 0
sales_tg_api "sendMessage" -s --max-time 12 \
-X POST \
--data-urlencode "chat_id=${chat_id}" \
--data-urlencode "parse_mode=HTML" \
--data-urlencode "disable_web_page_preview=true" \
--data-urlencode "text=${message}" \
>/dev/null 2>&1 || true
}
sales_menu_markup() {
cat <<'EOF'
{"keyboard":[[{"text":"💎 Купить VPN"},{"text":"🟢 Моя подписка"}],[{"text":"📲 Приложения"},{"text":"🚀 Как подключить"}],[{"text":"📣 Канал"},{"text":"🛟 Поддержка"}]],"resize_keyboard":true,"one_time_keyboard":false,"is_persistent":true}
EOF
}
sales_admin_menu_markup() {
cat <<'EOF'
{"keyboard":[[{"text":"🧾 Заявки"},{"text":"📊 Статус продаж"}],[{"text":"💎 Купить VPN"},{"text":"🟢 Моя подписка"}],[{"text":"📲 Приложения"},{"text":"📣 Канал"}],[{"text":"🛟 Поддержка"}]],"resize_keyboard":true,"one_time_keyboard":false,"is_persistent":true}
EOF
}
sales_reply_menu() {
local chat_id="$1" message="$2" kind="${3:-user}" reply_markup
[[ "$kind" == "admin" ]] && reply_markup=$(sales_admin_menu_markup) || reply_markup=$(sales_menu_markup)
sales_tg_api "sendMessage" -s --max-time 12 \
-X POST \
--data-urlencode "chat_id=${chat_id}" \
--data-urlencode "parse_mode=HTML" \
--data-urlencode "disable_web_page_preview=true" \
--data-urlencode "text=${message}" \
--data-urlencode "reply_markup=${reply_markup}" \
>/dev/null 2>&1 || true
}
sales_welcome_text() {
cat <<'EOF'
🤖 Yurich Connect VPN
Быстрые VPN-подписки для телефона и компьютера.
✨ Что внутри
• стабильные профили HTTPS, Turbo и Reality;
• личная страница подписки;
• удобный импорт в Yurich Connect, Hiddify, NekoBox, v2rayNG и Streisand;
• уведомления о сроке подписки в Telegram.
Выбери тариф ниже, оплати по QR и отправь скрин платежа сюда в бот.
EOF
}
sales_send_welcome_visual() {
local chat_id="$1" kind="${2:-user}" caption reply_markup animation_path image_path response
caption=$(sales_welcome_text)
[[ "$kind" == "admin" ]] && reply_markup=$(sales_admin_menu_markup) || reply_markup=$(sales_menu_markup)
animation_path="${SALES_BOT_WELCOME_ANIMATION_PATH:-$SALES_BOT_WELCOME_ANIMATION_PATH_DEFAULT}"
image_path="${SALES_BOT_WELCOME_IMAGE_PATH:-$SALES_BOT_WELCOME_IMAGE_PATH_DEFAULT}"
if [[ -s "$animation_path" ]]; then
response=$(sales_tg_api "sendAnimation" -s --max-time 45 \
-X POST \
--form-string "chat_id=${chat_id}" \
--form-string "parse_mode=HTML" \
--form-string "caption=${caption}" \
--form-string "reply_markup=${reply_markup}" \
-F "animation=@${animation_path};type=image/gif" \
2>/dev/null || echo "{}")
echo "$response" | grep -q '"ok":true' && return 0
fi
if [[ -s "$image_path" ]]; then
response=$(sales_tg_api "sendPhoto" -s --max-time 30 \
-X POST \
--form-string "chat_id=${chat_id}" \
--form-string "parse_mode=HTML" \
--form-string "caption=${caption}" \
--form-string "reply_markup=${reply_markup}" \
-F "photo=@${image_path};type=image/jpeg" \
2>/dev/null || echo "{}")
echo "$response" | grep -q '"ok":true' && return 0
fi
return 1
}
sales_reply_start() {
local chat_id="$1" kind="${2:-user}"
if ! sales_send_welcome_visual "$chat_id" "$kind"; then
sales_reply_menu "$chat_id" "$(sales_welcome_text)" "$kind"
fi
sales_reply_buy_menu "$chat_id" "$(sales_plans_text)"
}
sales_bot_commands_json() {
cat <<'EOF'
[
{"command":"start","description":"Открыть меню"},
{"command":"plans","description":"Посмотреть тарифы"},
{"command":"status","description":"Моя подписка"},
{"command":"apps","description":"Скачать приложения"},
{"command":"channel","description":"Канал Yurich Connect"},
{"command":"support","description":"Поддержка"}
]
EOF
}
sales_bot_admin_commands_json() {
cat <<'EOF'
[
{"command":"start","description":"Открыть меню"},
{"command":"sales_orders","description":"Новые заявки"},
{"command":"approve","description":"Подтвердить заявку"},
{"command":"reject","description":"Отклонить заявку"},
{"command":"sales_status","description":"Статус продаж"},
{"command":"plans","description":"Тарифы"},
{"command":"status","description":"Моя подписка"},
{"command":"apps","description":"Скачать приложения"},
{"command":"channel","description":"Канал Yurich Connect"},
{"command":"support","description":"Поддержка"}
]
EOF
}
sales_admin_ids() {
local admin_id
if [[ -n "${SALES_BOT_ADMIN_ID:-}" && "${SALES_BOT_ADMIN_ID}" =~ ^[0-9]+$ ]]; then
printf '%s\n' "$SALES_BOT_ADMIN_ID"
fi
if [[ -n "${SALES_BOT_ADMINS:-}" ]]; then
local IFS=','
for admin_id in ${SALES_BOT_ADMINS}; do
admin_id="${admin_id// /}"
[[ "$admin_id" =~ ^[0-9]+$ ]] && printf '%s\n' "$admin_id"
done
fi
}
sales_is_admin() {
local from_id="$1" admin_id
while IFS= read -r admin_id; do
[[ -n "$admin_id" && "$from_id" == "$admin_id" ]] && return 0
done < <(sales_admin_ids | sort -u)
return 1
}
sales_apply_bot_menu() {
[[ -n "${SALES_BOT_TOKEN:-}" ]] || { err "Sales bot token не настроен"; return 1; }
local user_commands admin_commands menu_button resp admin_id admin_scope admin_resp failed=0
user_commands=$(sales_bot_commands_json | tr -d '\n')
admin_commands=$(sales_bot_admin_commands_json | tr -d '\n')
menu_button='{"type":"commands"}'
sales_tg_api "setMyName" -s --max-time 15 \
-X POST \
--data-urlencode "name=Yurich Connect VPN" \
>/dev/null 2>&1 || true
sales_tg_api "setMyShortDescription" -s --max-time 15 \
-X POST \
--data-urlencode "short_description=VPN-подписки от 50 руб: оплата по QR, выдача после проверки." \
>/dev/null 2>&1 || true
sales_tg_api "setMyDescription" -s --max-time 15 \
-X POST \
--data-urlencode "description=Yurich Connect VPN: HTTPS, Turbo и Reality-профили для телефона и компьютера. Выберите тариф на 1 день, 1, 3, 6 или 12 месяцев, оплатите по QR и отправьте скрин платежа в бот. После проверки бот пришлёт страницу подписки. Канал: ${SALES_BOT_CHANNEL_URL:-$SALES_BOT_CHANNEL_URL_DEFAULT}" \
>/dev/null 2>&1 || true
resp=$(sales_tg_api "setMyCommands" -s --max-time 15 \
-X POST \
--data-urlencode "commands=${user_commands}" \
2>/dev/null || echo "{}")
echo "$resp" | grep -q '"ok":true' || { err "Не удалось установить команды sales bot"; echo "$resp"; return 1; }
while IFS= read -r admin_id; do
[[ -z "$admin_id" ]] && continue
admin_scope=$(printf '{"type":"chat","chat_id":%s}' "$admin_id")
admin_resp=$(sales_tg_api "setMyCommands" -s --max-time 15 \
-X POST \
--data-urlencode "commands=${admin_commands}" \
--data-urlencode "scope=${admin_scope}" \
2>/dev/null || echo "{}")
echo "$admin_resp" | grep -q '"ok":true' || failed=$((failed + 1))
done < <(sales_admin_ids | sort -u)
sales_tg_api "setChatMenuButton" -s --max-time 15 \
-X POST \
--data-urlencode "menu_button=${menu_button}" \
>/dev/null 2>&1 || true
[[ "$failed" -eq 0 ]]
}
sales_plan_price() {
local term item key p normalized plans
normalized=$(normalize_user_term "${1:-}" 2>/dev/null || true)
[[ -n "$normalized" ]] || return 1
plans="${SALES_BOT_PLANS:-$SALES_BOT_PLANS_DEFAULT}"
is_valid_sales_plans_value "$plans" || plans="$SALES_BOT_PLANS_DEFAULT"
IFS=',' read -ra _sales_plan_items <<< "$plans"
for item in "${_sales_plan_items[@]}"; do
key="${item%%:*}"
p="${item#*:}"
[[ "$key" =~ ^[0-9]+$ ]] && key="${key}m"
if [[ "$key" == "$normalized" ]] && is_canonical_uint_in_range "$p" 1 1000000000; then
printf '%s\n' "$p"
return 0
fi
done
return 1
}
sales_plan_regular_price() {
local term
term=$(normalize_user_term "${1:-}" 2>/dev/null || true)
case "$term" in
1d) printf '50\n' ;;
*m) printf '%s\n' $(( ${term%m} * 250 )) ;;
*) return 1 ;;
esac
}
sales_plans_text() {
local item key term p regular discount pct per_month currency channel plan_lines="" icon badge plans
currency="${SALES_BOT_CURRENCY:-$SALES_BOT_CURRENCY_DEFAULT}"
channel="${SALES_BOT_CHANNEL_URL:-$SALES_BOT_CHANNEL_URL_DEFAULT}"
plans="${SALES_BOT_PLANS:-$SALES_BOT_PLANS_DEFAULT}"
is_valid_sales_plans_value "$plans" || plans="$SALES_BOT_PLANS_DEFAULT"
IFS=',' read -ra _sales_plan_items <<< "$plans"
for item in "${_sales_plan_items[@]}"; do
key="${item%%:*}"
p="${item#*:}"
[[ "$key" =~ ^[0-9]+$ ]] && key="${key}m"
term=$(normalize_user_term "$key" 2>/dev/null || true)
if [[ -z "$term" ]] || ! is_canonical_uint_in_range "$p" 1 1000000000; then
continue
fi
case "$term" in
1d) icon="⚡"; badge="тест на день" ;;
1m) icon="🚀"; badge="стартовый" ;;
3m) icon="⭐"; badge="выгоднее" ;;
6m) icon="🔥"; badge="популярный" ;;
12m) icon="👑"; badge="максимальная выгода" ;;
*) icon="💎"; badge="тариф" ;;
esac
regular=$(sales_plan_regular_price "$term" 2>/dev/null || echo "$p")
if [[ "$p" -lt "$regular" ]]; then
discount=$((regular - p))
pct=$(((discount * 100 + regular / 2) / regular))
if [[ "$term" == *m ]]; then
per_month=$((p / ${term%m}))
plan_lines="${plan_lines}${icon} $(user_term_label "$term") — ${p} ${currency}
${badge}: ~${per_month} руб/мес, экономия ${discount} руб / ${pct}%
"
else
plan_lines="${plan_lines}${icon} $(user_term_label "$term") — ${p} ${currency}
${badge}: экономия ${discount} руб / ${pct}%
"
fi
else
plan_lines="${plan_lines}${icon} $(user_term_label "$term") — ${p} ${currency}
${badge}
"
fi
done
cat </buy day, /buy 1, /buy 3, /buy 6, /buy 12
EOF
}
sales_buy_menu_markup() {
local pd p1 p3 p6 p12 currency
pd=$(sales_plan_price 1d 2>/dev/null || printf '50')
p1=$(sales_plan_price 1m 2>/dev/null || printf '250')
p3=$(sales_plan_price 3m 2>/dev/null || printf '700')
p6=$(sales_plan_price 6m 2>/dev/null || printf '1300')
p12=$(sales_plan_price 12m 2>/dev/null || printf '2400')
currency="${SALES_BOT_CURRENCY:-$SALES_BOT_CURRENCY_DEFAULT}"
cat <${question}
После правильного ответа открою тарифы и оплату."
}
sales_captcha_check() {
local chat_id="$1" text="$2" file now pending_ttl user_answer tries tmp ttl verified_file expires
file=$(sales_captcha_file "$chat_id") || return 1
if [[ ! -f "$file" ]]; then
sales_captcha_prompt "$chat_id"
return 0
fi
unset ANSWER CREATED_AT TRIES
# shellcheck source=/dev/null
source "$file" 2>/dev/null || true
now=$(date +%s)
pending_ttl=900
if ! is_canonical_uint_in_range "${ANSWER:-}" 0 999 \
|| ! is_canonical_uint_in_range "${CREATED_AT:-}" 0 9999999999 \
|| ! is_canonical_uint_in_range "${TRIES:-0}" 0 3 \
|| (( now - CREATED_AT > pending_ttl )); then
sales_captcha_prompt "$chat_id"
return 0
fi
user_answer=$(printf '%s' "$text" | tr -d '[:space:]')
if [[ ! "$user_answer" =~ ^[0-9]{1,3}$ ]]; then
sales_reply "$chat_id" "Напиши ответ на проверку только цифрами."
return 0
fi
if [[ "$user_answer" == "$ANSWER" ]]; then
ttl=$(sales_captcha_ttl)
expires=$((now + ttl))
verified_file=$(sales_verified_file "$chat_id") || return 1
mkdir -p "$SALES_BOT_VERIFIED_DIR"
tmp="${verified_file}.tmp"
printf '%s\n' "$expires" > "$tmp"
install -m 600 "$tmp" "$verified_file"
rm -f "$tmp" "$file"
sales_reply_buy_menu "$chat_id" "Проверка пройдена
Теперь можно выбрать тариф и оплатить подписку."
return 0
fi
tries=$(( ${TRIES:-0} + 1 ))
if [[ "$tries" -ge 3 ]]; then
sales_captcha_prompt "$chat_id"
sales_reply "$chat_id" "Слишком много неверных ответов. Я создал новый пример."
return 0
fi
tmp="${file}.tmp"
{
printf 'ANSWER=%q\n' "$ANSWER"
printf 'CREATED_AT=%q\n' "$CREATED_AT"
printf 'TRIES=%q\n' "$tries"
} > "$tmp"
install -m 600 "$tmp" "$file"
rm -f "$tmp"
sales_reply "$chat_id" "Ответ неверный. Попробуй ещё раз."
}
sales_send_payment_qr() {
local chat_id="$1" caption="$2" qr_path="${SALES_BOT_PAYMENT_QR_PATH:-$SALES_BOT_PAYMENT_QR_PATH_DEFAULT}" response safe_path mime_type
safe_path=$(html_escape_text "$qr_path")
[[ -n "${SALES_BOT_TOKEN:-}" ]] || return 1
if [[ ! -s "$qr_path" ]]; then
warn "Sales bot QR не найден или пустой: ${qr_path}"
sales_reply "$chat_id" "QR-код для оплаты временно не найден на сервере. Реквизиты выше актуальны, после оплаты отправь скрин сюда в бот."
sales_notify_admins "Ошибка QR оплаты
Файл QR не найден или пустой:
${safe_path}"
return 1
fi
case "${qr_path,,}" in
*.png) mime_type="image/png" ;;
*.jpg|*.jpeg) mime_type="image/jpeg" ;;
*) mime_type="application/octet-stream" ;;
esac
response=$(sales_tg_api "sendPhoto" -s --max-time 30 \
-X POST \
--form-string "chat_id=${chat_id}" \
--form-string "parse_mode=HTML" \
--form-string "caption=${caption}" \
-F "photo=@${qr_path};type=${mime_type}" \
2>/dev/null || echo "{}")
if echo "$response" | grep -q '"ok":true'; then
return 0
fi
warn "Telegram sendPhoto для QR вернул ошибку"
sales_reply "$chat_id" "QR-код для оплаты не отправился автоматически. Реквизиты выше актуальны, после оплаты отправь скрин сюда в бот."
sales_notify_admins "Ошибка отправки QR оплаты
Telegram не принял QR-файл:
${safe_path}
Проверь файл и логи:
journalctl -u yurich-sales-bot -n 80 --no-pager"
return 1
}
sales_latest_pending_order_for_chat() {
local chat_id="$1" file order_id status best_file="" best_order=""
mkdir -p "$SALES_BOT_ORDERS_DIR"
shopt -s nullglob
for file in "$SALES_BOT_ORDERS_DIR"/*.env; do
unset ORDER_ID STATUS CHAT_ID
# shellcheck source=/dev/null
source "$file" 2>/dev/null || continue
[[ "${CHAT_ID:-}" == "$chat_id" ]] || continue
[[ "${STATUS:-}" == "pending" ]] || continue
order_id="${ORDER_ID:-$(basename "$file" .env)}"
if [[ -z "$best_order" || "$order_id" > "$best_order" ]]; then
best_order="$order_id"
best_file="$file"
fi
done
shopt -u nullglob
[[ -n "$best_file" ]] || return 1
printf '%s\n' "$best_file"
}
sales_handle_payment_proof() {
local chat_id="$1" from_id="$2" username="$3" first_name="$4" message_id="$5" proof_kind="$6" order_file order_id safe_user safe_name admin_id
if ! order_file=$(sales_latest_pending_order_for_chat "$chat_id" 2>/dev/null); then
sales_reply "$chat_id" "Скрин оплаты получил, но активной заявки не нашёл. Сначала выбери тариф через /plans."
return 0
fi
# shellcheck source=/dev/null
source "$order_file"
order_id="${ORDER_ID:-$(basename "$order_file" .env)}"
safe_user=$(html_escape_text "${username:-без username}")
safe_name=$(html_escape_text "${first_name:-без имени}")
{
grep -vE '^(PROOF_SENT_AT|PROOF_MESSAGE_ID|PROOF_KIND)=' "$order_file" 2>/dev/null || true
printf 'PROOF_SENT_AT=%q\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
printf 'PROOF_MESSAGE_ID=%q\n' "$message_id"
printf 'PROOF_KIND=%q\n' "$proof_kind"
} > "${order_file}.tmp"
install -m 600 "${order_file}.tmp" "$order_file"
rm -f "${order_file}.tmp"
while IFS= read -r admin_id; do
[[ -z "$admin_id" ]] && continue
sales_reply "$admin_id" "Скрин оплаты по заявке
ORDER: ${order_id}
Клиент: ${chat_id}
Username: ${safe_user}
Имя: ${safe_name}
Тип файла: ${proof_kind}
Тариф: $(user_term_label "${TERM:-${MONTHS:-?}}")
Сумма: ${PRICE:-?} ${CURRENCY:-RUB}
Подтвердить:
/approve ${order_id}
Отклонить:
/reject ${order_id}"
sales_tg_api "forwardMessage" -s --max-time 20 \
-X POST \
--data-urlencode "chat_id=${admin_id}" \
--data-urlencode "from_chat_id=${chat_id}" \
--data-urlencode "message_id=${message_id}" \
>/dev/null 2>&1 || true
done < <(sales_admin_ids | sort -u)
sales_reply "$chat_id" "Скрин оплаты получил и отправил администратору. После проверки тебе придёт ссылка на подписку."
}
sales_create_order() {
local chat_id="$1" from_id="$2" username="$3" first_name="$4" term="$5" price order_id order_file created safe_user safe_name payment_text term_label
local order_lock_fd file file_values file_chat file_status file_epoch now pending_count=0 total_count=0 newest_epoch=0
local min_interval max_pending max_files
term=$(normalize_user_term "$term" 2>/dev/null || true)
price=$(sales_plan_price "$term") || { sales_reply "$chat_id" "Этот тариф не найден. Открой /plans."; return 1; }
term_label=$(user_term_label "$term")
mkdir -p "$SALES_BOT_ORDERS_DIR" "$SALES_BOT_CAPTCHA_DIR" "$SALES_BOT_VERIFIED_DIR"
chmod 700 "$SALES_BOT_DIR" "$SALES_BOT_ORDERS_DIR" "$SALES_BOT_CAPTCHA_DIR" "$SALES_BOT_VERIFIED_DIR" 2>/dev/null || true
command -v flock >/dev/null 2>&1 || { sales_reply "$chat_id" "Сервис заявок временно недоступен. Напиши в поддержку."; return 1; }
exec {order_lock_fd}>"${SALES_BOT_ORDERS_DIR}/.orders.lock"
if ! flock -w 5 "$order_lock_fd"; then
sales_reply "$chat_id" "Сервис обрабатывает другую заявку. Повтори через минуту."
exec {order_lock_fd}>&-
return 1
fi
min_interval="${SALES_BOT_ORDER_MIN_INTERVAL_SECONDS:-$SALES_BOT_ORDER_MIN_INTERVAL_SECONDS_DEFAULT}"
max_pending="${SALES_BOT_MAX_PENDING_PER_CHAT:-$SALES_BOT_MAX_PENDING_PER_CHAT_DEFAULT}"
max_files="${SALES_BOT_MAX_ORDER_FILES:-$SALES_BOT_MAX_ORDER_FILES_DEFAULT}"
is_canonical_uint_in_range "$min_interval" 10 3600 || min_interval="$SALES_BOT_ORDER_MIN_INTERVAL_SECONDS_DEFAULT"
is_canonical_uint_in_range "$max_pending" 1 10 || max_pending="$SALES_BOT_MAX_PENDING_PER_CHAT_DEFAULT"
is_canonical_uint_in_range "$max_files" 100 50000 || max_files="$SALES_BOT_MAX_ORDER_FILES_DEFAULT"
shopt -s nullglob
for file in "$SALES_BOT_ORDERS_DIR"/*.env; do
total_count=$((total_count + 1))
file_values=$( (
unset CHAT_ID STATUS
# Order files are root-owned 0600 files generated below with printf %q.
# shellcheck source=/dev/null
source "$file" 2>/dev/null || exit 0
printf '%s|%s\n' "${CHAT_ID:-}" "${STATUS:-}"
) )
IFS='|' read -r file_chat file_status <<< "$file_values"
if [[ "$file_chat" == "$chat_id" ]]; then
[[ "$file_status" == "pending" || "$file_status" == "processing" ]] && pending_count=$((pending_count + 1))
file_epoch=$(stat -c '%Y' "$file" 2>/dev/null || echo 0)
[[ "$file_epoch" =~ ^[0-9]+$ && "$file_epoch" -gt "$newest_epoch" ]] && newest_epoch="$file_epoch"
fi
done
shopt -u nullglob
now=$(date +%s)
if (( total_count >= max_files )); then
flock -u "$order_lock_fd"; exec {order_lock_fd}>&-
sales_reply "$chat_id" "Новые заявки временно приостановлены. Администратор уже получил уведомление."
sales_notify_admins "Лимит файлов заявок достигнут: ${total_count}/${max_files}. Нужна ручная архивация."
return 1
fi
if (( pending_count >= max_pending )); then
flock -u "$order_lock_fd"; exec {order_lock_fd}>&-
sales_reply "$chat_id" "У тебя уже есть ${pending_count} необработанные заявки. Сначала дождись решения по ним."
return 1
fi
if (( newest_epoch > 0 && now - newest_epoch < min_interval )); then
flock -u "$order_lock_fd"; exec {order_lock_fd}>&-
sales_reply "$chat_id" "Заявка уже создавалась недавно. Подожди немного и повтори."
return 1
fi
created=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
order_id="$(date -u '+%Y%m%d%H%M%S')-${chat_id#-}-${RANDOM}"
order_file="${SALES_BOT_ORDERS_DIR}/${order_id}.env"
{
printf 'ORDER_ID=%q\n' "$order_id"
printf 'STATUS=%q\n' "pending"
printf 'CHAT_ID=%q\n' "$chat_id"
printf 'FROM_ID=%q\n' "$from_id"
printf 'USERNAME=%q\n' "$username"
printf 'FIRST_NAME=%q\n' "$first_name"
printf 'TERM=%q\n' "$term"
if [[ "$term" == *m ]]; then
printf 'MONTHS=%q\n' "${term%m}"
else
printf 'MONTHS=%q\n' ""
fi
printf 'PRICE=%q\n' "$price"
printf 'CURRENCY=%q\n' "${SALES_BOT_CURRENCY:-RUB}"
printf 'CREATED_AT=%q\n' "$created"
} > "$order_file"
chmod 600 "$order_file"
flock -u "$order_lock_fd"
exec {order_lock_fd}>&-
payment_text=$(html_escape_text "${SALES_BOT_PAYMENT_TEXT:-Оплата пока подтверждается вручную.}")
sales_reply "$chat_id" "Заявка создана
Номер: ${order_id}
Тариф: Yurich Connect на ${term_label}
Сумма: ${price} ${SALES_BOT_CURRENCY:-RUB}
${payment_text}
После оплаты отправь скрин платежа сюда в бот. Я перешлю его администратору, и после проверки бот пришлёт ссылку на подписку."
sales_send_payment_qr "$chat_id" "QR-код для оплаты
Заявка: ${order_id}
Сумма: ${price} ${SALES_BOT_CURRENCY:-RUB}
После оплаты отправь скрин платежа сюда в бот."
safe_user=$(html_escape_text "${username:-без username}")
safe_name=$(html_escape_text "${first_name:-без имени}")
sales_notify_admins "Новая заявка VPN
ORDER: ${order_id}
Клиент: ${chat_id}
Username: ${safe_user}
Имя: ${safe_name}
Тариф: ${term_label}
Сумма: ${price} ${SALES_BOT_CURRENCY:-RUB}
Подтвердить:
/approve ${order_id}
Отклонить:
/reject ${order_id}"
}
sales_subscription_status_text() {
local chat_id="$1" user sub_url expires channel
user=$(sales_user_for_chat "$chat_id")
if ! subscription_user_exists "$user"; then
cat <${user}
Срок: ${expires}
Страница подписки:
${sub_url:-не удалось создать ссылку}
Канал:
${channel}
EOF
}
sales_restore_issue_state() {
local user="$1" users_backup="$2" meta_backup="$3" meta_existed="$4" meta_file
meta_file=$(user_meta_file "$user")
[[ -d "$users_backup/credential-state" ]] && credential_state_restore "$users_backup/credential-state"
if [[ "$meta_existed" == "1" && -f "$meta_backup" ]]; then
cp -a "$meta_backup" "$meta_file"
else
rm -f "$meta_file"
fi
rewrite_caddyfile_current >/dev/null 2>&1 || true
systemctl reload caddy >/dev/null 2>&1 || systemctl restart caddy >/dev/null 2>&1 || true
}
sales_issue_subscription() {
local chat_id="$1" term="$2" order_id="${3:-manual}" user pass users_backup meta_backup meta_file meta_existed=0 created=0 sub_url sync_note="" last_order
user=$(sales_user_for_chat "$chat_id")
term=$(normalize_user_term "$term" 2>/dev/null || true)
if ! is_valid_user_term "$term"; then
err "Некорректный срок sales-подписки"
return 1
fi
if ! is_valid_proxy_user "$user"; then
err "Некорректный auto-user: $user"
return 1
fi
load_config
load_users
mkdir -p "$(dirname "$USERS_FILE")"
touch "$USERS_FILE"
chmod 600 "$USERS_FILE"
last_order=$(user_meta_get "$user" LAST_SALES_ORDER_ID 2>/dev/null || true)
if [[ "$order_id" != "manual" && "$last_order" == "$order_id" ]]; then
apply_user_access_runtime || return 1
sub_url=$(generate_subscription_page "$user" 2>/dev/null || true)
[[ -n "$sub_url" ]] || return 1
printf 'USER=%s\nCREATED=0\nSUB_URL=%s\nSYNC_NOTE=%s\n' "$user" "$sub_url" "Заявка уже была применена; повторное продление не выполнялось."
return 0
fi
pass=$(get_user_pass "$user" 2>/dev/null || true)
users_backup=$(mktemp -d /run/yurich-sales-user.XXXXXX)
credential_state_backup "$users_backup/credential-state"
meta_file=$(user_meta_file "$user")
meta_backup=$(mktemp)
if [[ -f "$meta_file" ]]; then
cp -a "$meta_file" "$meta_backup"
meta_existed=1
fi
if [[ -z "$pass" ]]; then
pass=$(random_safe_token 20)
credential_set_user "$user" "$pass" || { rm -rf "$users_backup"; rm -f "$meta_backup"; return 1; }
created=1
fi
set_user_expiry_extend_term "$user" "$term" || { sales_restore_issue_state "$user" "$users_backup" "$meta_backup" "$meta_existed"; rm -rf "$users_backup"; rm -f "$meta_backup"; return 1; }
[[ "$order_id" == "manual" ]] || user_meta_set "$user" LAST_SALES_ORDER_ID "$order_id" || { sales_restore_issue_state "$user" "$users_backup" "$meta_backup" "$meta_existed"; rm -rf "$users_backup"; rm -f "$meta_backup"; return 1; }
if ! rewrite_caddyfile_current >/dev/null 2>&1; then
sales_restore_issue_state "$user" "$users_backup" "$meta_backup" "$meta_existed"
rm -rf "$users_backup"; rm -f "$meta_backup"
return 1
fi
if ! systemctl reload caddy >/dev/null 2>&1 && ! systemctl restart caddy >/dev/null 2>&1; then
sales_restore_issue_state "$user" "$users_backup" "$meta_backup" "$meta_existed"
rm -rf "$users_backup"; rm -f "$meta_backup"
return 1
fi
rm -rf "$users_backup"; rm -f "$meta_backup"
if [[ -f "$HYSTERIA_CONFIG" || -x "$HYSTERIA_BIN" ]]; then
sync_hysteria_users_if_active >/dev/null 2>&1 || { err "Hysteria не применил пользователя $user"; return 1; }
fi
if [[ "${XRAY_ENABLED:-0}" == "1" && -x "$XRAY_BIN" && -f "$XRAY_CONFIG" ]]; then
provision_xray_user "$user" >/dev/null 2>&1 || { err "Xray не применил пользователя $user"; return 1; }
fi
cmd_notify_bind_tg "$user" "$chat_id" >/dev/null 2>&1 || true
if [[ "$(nodes_count 2>/dev/null || echo 0)" -gt 0 ]]; then
if command -v systemd-run >/dev/null 2>&1; then
local sync_unit
sync_unit="yurich-sales-node-sync-${user}-$(date +%s)"
systemd-run --quiet --unit "$sync_unit" --description "Yurich sales node sync for ${user}" /bin/bash "$SCRIPT_PATH" nodes-sync all >/dev/null 2>&1 \
|| sync_note="Ноды синхронизируются с задержкой; основная подписка уже готова."
else
( /bin/bash "$SCRIPT_PATH" nodes-sync all >> /var/log/yurich-sales-node-sync.log 2>&1 & ) \
|| sync_note="Ноды синхронизируются с задержкой; основная подписка уже готова."
fi
[[ -z "$sync_note" ]] && sync_note="Ноды синхронизируются в фоне; если часть профилей заработает не сразу, обнови подписку через 1-3 минуты."
fi
sub_url=$(generate_subscription_page "$user" 2>/dev/null || true)
[[ -n "$sub_url" ]] || return 1
printf 'USER=%s\nCREATED=%s\nSUB_URL=%s\nSYNC_NOTE=%s\n' "$user" "$created" "$sub_url" "$sync_note"
}
sales_approve_order() {
# FROM_ID/FIRST_NAME are intentionally local: sourced order fields must not leak globally.
# shellcheck disable=SC2034
local order_id="$1" admin_id="$2" order_file STATUS CHAT_ID FROM_ID USERNAME FIRST_NAME TERM MONTHS PRICE CURRENCY issue_tmp rc sub_url user sync_note term approval_lock_fd
sales_order_valid_id "$order_id" || { sales_reply "$admin_id" "Неверный ORDER ID."; return 1; }
order_file="${SALES_BOT_ORDERS_DIR}/${order_id}.env"
[[ -f "$order_file" ]] || { sales_reply "$admin_id" "Заявка не найдена: ${order_id}"; return 1; }
command -v flock >/dev/null 2>&1 || { sales_reply "$admin_id" "flock не установлен; подтверждение остановлено безопасно."; return 1; }
exec {approval_lock_fd}>"${order_file}.lock"
if ! flock -n "$approval_lock_fd"; then
sales_reply "$admin_id" "Заявка уже обрабатывается: ${order_id}"
exec {approval_lock_fd}>&-
return 1
fi
# shellcheck source=/dev/null
source "$order_file"
if [[ "${STATUS:-}" != "pending" ]]; then
sales_reply "$admin_id" "Заявка уже обработана: ${STATUS:-unknown}"
flock -u "$approval_lock_fd"; exec {approval_lock_fd}>&-
return 1
fi
{
grep -vE '^(STATUS|PROCESSING_AT|PROCESSING_BY|ISSUE_ERROR_AT)=' "$order_file" 2>/dev/null || true
printf 'STATUS=%q\n' "processing"
printf 'PROCESSING_AT=%q\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
printf 'PROCESSING_BY=%q\n' "$admin_id"
} > "${order_file}.tmp"
install -m 600 "${order_file}.tmp" "$order_file"
rm -f "${order_file}.tmp"
issue_tmp=$(mktemp)
term="${TERM:-${MONTHS:-}}"
if sales_issue_subscription "$CHAT_ID" "$term" "$order_id" > "$issue_tmp" 2>&1; then
rc=0
else
rc=$?
fi
if [[ "$rc" -ne 0 ]]; then
{
grep -vE '^(STATUS|ISSUE_ERROR_AT)=' "$order_file" 2>/dev/null || true
printf 'STATUS=%q\n' "error"
printf 'ISSUE_ERROR_AT=%q\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
} > "${order_file}.tmp"
install -m 600 "${order_file}.tmp" "$order_file"
rm -f "${order_file}.tmp"
sales_reply "$admin_id" "Ошибка выдачи подписки
ORDER: ${order_id}
Статус: error, повторное продление заблокировано до ручной проверки.
$(html_escape_text "$(tail -n 40 "$issue_tmp")")" rm -f "$issue_tmp" flock -u "$approval_lock_fd"; exec {approval_lock_fd}>&- return 1 fi user=$(awk -F= '$1=="USER"{print $2}' "$issue_tmp") sub_url=$(awk -F= '$1=="SUB_URL"{print $2}' "$issue_tmp") sync_note=$(awk -F= '$1=="SYNC_NOTE"{print $2}' "$issue_tmp") { grep -vE '^(STATUS|PROCESSING_AT|PROCESSING_BY|ISSUE_ERROR_AT|APPROVED_AT|APPROVED_BY|ISSUED_USER|SUB_URL)=' "$order_file" 2>/dev/null || true printf 'STATUS=%q\n' "approved" printf 'APPROVED_AT=%q\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" printf 'APPROVED_BY=%q\n' "$admin_id" printf 'ISSUED_USER=%q\n' "$user" printf 'SUB_URL=%q\n' "$sub_url" } > "${order_file}.tmp" install -m 600 "${order_file}.tmp" "$order_file" rm -f "${order_file}.tmp" "$issue_tmp" flock -u "$approval_lock_fd" exec {approval_lock_fd}>&- sales_reply "$CHAT_ID" "Подписка активирована Срок:
$(user_expiry_label "$user")
Страница подписки:
${sub_url}
Открой ссылку и импортируй подписку в Yurich Connect, Hiddify, NekoBox, v2rayNG или Streisand.
Android:
${ANDROID_APP_RELEASES_URL}
Windows:
${WINDOWS_APP_RELEASES_URL}
Канал:
${SALES_BOT_CHANNEL_URL:-$SALES_BOT_CHANNEL_URL_DEFAULT}
${sync_note:+
${sync_note}}"
sales_reply "$admin_id" "Заявка подтверждена
ORDER: ${order_id}
Пользователь: ${user}
Ссылка: ${sub_url}"
}
sales_reject_order() {
local order_id="$1" admin_id="$2" reason="${3:-}" order_file STATUS CHAT_ID
sales_order_valid_id "$order_id" || { sales_reply "$admin_id" "Неверный ORDER ID."; return 1; }
order_file="${SALES_BOT_ORDERS_DIR}/${order_id}.env"
[[ -f "$order_file" ]] || { sales_reply "$admin_id" "Заявка не найдена: ${order_id}"; return 1; }
# shellcheck source=/dev/null
source "$order_file"
[[ "${STATUS:-}" == "pending" ]] || { sales_reply "$admin_id" "Заявка уже обработана: ${STATUS:-unknown}"; return 1; }
{
grep -vE '^(STATUS|REJECTED_AT|REJECTED_BY|REJECT_REASON)=' "$order_file" 2>/dev/null || true
printf 'STATUS=%q\n' "rejected"
printf 'REJECTED_AT=%q\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
printf 'REJECTED_BY=%q\n' "$admin_id"
printf 'REJECT_REASON=%q\n' "${reason:-manual reject}"
} > "${order_file}.tmp"
install -m 600 "${order_file}.tmp" "$order_file"
rm -f "${order_file}.tmp"
sales_reply "$CHAT_ID" "Заявка отклонена${reason:+
Причина: $(html_escape_text "$reason")}"
sales_reply "$admin_id" "Заявка отклонена: ${order_id}"
}
sales_orders_text() {
mkdir -p "$SALES_BOT_ORDERS_DIR"
local file count=0 out=""
for file in "$SALES_BOT_ORDERS_DIR"/*.env; do
[[ -f "$file" ]] || continue
unset ORDER_ID STATUS CHAT_ID USERNAME TERM MONTHS PRICE CURRENCY CREATED_AT
# shellcheck source=/dev/null
source "$file"
[[ "${STATUS:-}" == "pending" ]] || continue
count=$((count + 1))
out="${out}${count}. ${ORDER_ID}
Клиент: ${CHAT_ID:-} @$(html_escape_text "${USERNAME:-none}")
Тариф: $(user_term_label "${TERM:-${MONTHS:-?}}") / ${PRICE:-?} ${CURRENCY:-RUB}
Подтвердить: /approve ${ORDER_ID}
Отклонить: /reject ${ORDER_ID}
"
done
if [[ "$count" -eq 0 ]]; then
printf 'Новых заявок нет.'
else
printf '%s' "$out"
fi
}
sales_handle_command() {
local chat_id="$1" from_id="$2" username="$3" first_name="$4" text="$5" is_admin=0 term order_id reason
set +e
sales_is_admin "$from_id" && is_admin=1
if [[ "$is_admin" -ne 1 ]]; then
if sales_captcha_has_pending "$chat_id"; then
sales_captcha_check "$chat_id" "$text"
return
fi
case "$text" in
*"Купить VPN"*|*"Тарифы"*|/start|/menu|/plans|/buy|/buy*)
if ! sales_captcha_is_verified "$chat_id"; then
sales_captcha_prompt "$chat_id"
return
fi
;;
*)
term=$(sales_months_from_text "$text" 2>/dev/null || true)
if [[ -n "$term" ]] && ! sales_captcha_is_verified "$chat_id"; then
sales_captcha_prompt "$chat_id"
return
fi
;;
esac
fi
case "$text" in
/start|/menu)
sales_reply_start "$chat_id" "$([[ "$is_admin" -eq 1 ]] && echo admin || echo user)"
;;
*"Купить VPN"*|*"Тарифы"*|/plans|/buy)
sales_reply_buy_menu "$chat_id" "$(sales_plans_text)"
;;
*"Моя подписка"*|/status|/sub|/subscription)
sales_reply_menu "$chat_id" "$(sales_subscription_status_text "$chat_id")" "$([[ "$is_admin" -eq 1 ]] && echo admin || echo user)"
;;
*"Как подключить"*|/help)
sales_reply_menu "$chat_id" "Как подключить
1. Выбери тариф на 1 день, 1, 3, 6 или 12 месяцев.
2. Оплати по QR-коду и отправь скрин платежа сюда в бот.
3. После подтверждения оплаты бот пришлёт страницу подписки.
4. Открой страницу в приложении или скопируй URL.
Android: Yurich Connect, Hiddify, NekoBox, v2rayNG.
iPhone: Streisand.
Windows: Yurich Connect Windows, v2rayN, Hiddify." "$([[ "$is_admin" -eq 1 ]] && echo admin || echo user)"
;;
*"Приложения"*|/apps)
sales_reply_menu "$chat_id" "Приложения
Тариф включает телефон и компьютер.
Android:
${ANDROID_APP_RELEASES_URL}
Windows:
${WINDOWS_APP_RELEASES_URL}
iPhone:
${STREISAND_APP_URL}" "$([[ "$is_admin" -eq 1 ]] && echo admin || echo user)"
;;
*"Канал"*|/channel)
sales_reply_menu "$chat_id" "Канал Yurich Connect
Новости, обновления приложения и важные сообщения:
${SALES_BOT_CHANNEL_URL:-$SALES_BOT_CHANNEL_URL_DEFAULT}" "$([[ "$is_admin" -eq 1 ]] && echo admin || echo user)"
;;
*"Поддержка"*|/support)
sales_reply_menu "$chat_id" "Поддержка
Telegram: ${TELEGRAM_COMMUNITY_URL}
Email: ${SUPPORT_EMAIL}" "$([[ "$is_admin" -eq 1 ]] && echo admin || echo user)"
;;
*"Заявки"*|/sales_orders)
if [[ "$is_admin" -ne 1 ]]; then sales_reply "$chat_id" "Команда доступна только администратору."; return; fi
sales_reply_menu "$chat_id" "$(sales_orders_text)" "admin"
;;
*"Статус продаж"*|/sales_status)
if [[ "$is_admin" -ne 1 ]]; then sales_reply "$chat_id" "Команда доступна только администратору."; return; fi
sales_reply_menu "$chat_id" "Бот продаж Yurich Connect
Сервис: yurich-sales-bot.service
Тарифы: ${SALES_BOT_PLANS:-}
Валюта: ${SALES_BOT_CURRENCY:-RUB}
Канал: ${SALES_BOT_CHANNEL_URL:-$SALES_BOT_CHANNEL_URL_DEFAULT}
Лимит устройств: выключен
Заявки: ${SALES_BOT_ORDERS_DIR}" "admin"
;;
/approve*)
if [[ "$is_admin" -ne 1 ]]; then sales_reply "$chat_id" "Команда доступна только администратору."; return; fi
order_id=$(printf '%s\n' "$text" | awk '{print $2}')
sales_approve_order "$order_id" "$chat_id"
;;
/reject*)
if [[ "$is_admin" -ne 1 ]]; then sales_reply "$chat_id" "Команда доступна только администратору."; return; fi
order_id=$(printf '%s\n' "$text" | awk '{print $2}')
reason=$(printf '%s\n' "$text" | cut -d' ' -f3-)
[[ "$reason" == "$text" ]] && reason=""
sales_reject_order "$order_id" "$chat_id" "$reason"
;;
*)
term=$(sales_months_from_text "$text" 2>/dev/null || true)
if [[ -n "$term" ]]; then
sales_create_order "$chat_id" "$from_id" "$username" "$first_name" "$term"
else
sales_reply_menu "$chat_id" "Не понял команду. Открой меню или напиши /plans." "$([[ "$is_admin" -eq 1 ]] && echo admin || echo user)"
fi
;;
esac
}
cmd_sales_bot() {
[[ -n "${SALES_BOT_TOKEN:-}" ]] || { err "Sales bot не настроен. Запусти интерактивно: sudo bash ${SCRIPT_PATH} sales-bot-install"; return 1; }
sales_apply_bot_menu >/dev/null 2>&1 || true
mkdir -p "$SALES_BOT_ORDERS_DIR" "$SALES_BOT_CAPTCHA_DIR" "$SALES_BOT_VERIFIED_DIR"
chmod 700 "$SALES_BOT_DIR" "$SALES_BOT_ORDERS_DIR" "$SALES_BOT_CAPTCHA_DIR" "$SALES_BOT_VERIFIED_DIR" 2>/dev/null || true
info "Запускаю Yurich Sales Bot..."
local offset=0 response updates
while true; do
response=$(sales_tg_api "getUpdates?offset=${offset}&timeout=30&allowed_updates=%5B%22message%22%5D" -s --max-time 35 2>/dev/null || echo "")
if [[ -z "$response" ]]; then
sleep 5
continue
fi
updates=$(echo "$response" | python3 -c "
import json, sys
try:
data=json.load(sys.stdin)
if not data.get('ok'): sys.exit(0)
for u in data.get('result', []):
uid=u.get('update_id',0)
msg=u.get('message') or {}
chat=msg.get('chat') or {}
frm=msg.get('from') or {}
text=str(msg.get('text') or '')
kind='text'
if not text:
if msg.get('photo'):
kind='photo'
text='__PAYMENT_PROOF__'
elif msg.get('document'):
kind='document'
text='__PAYMENT_PROOF__'
else:
continue
def clean(v):
return str(v or '').replace('|',' ').replace('\\r',' ').replace('\\n',' ')[:120]
print('|'.join([str(uid), clean(chat.get('id')), clean(chat.get('type')), clean(frm.get('id')), clean(frm.get('username')), clean(frm.get('first_name')), clean(msg.get('message_id')), clean(kind), clean(text)]))
except Exception:
pass
" 2>/dev/null || echo "")
while IFS='|' read -r update_id chat_id chat_type from_id username first_name message_id kind text; do
[[ -z "${update_id:-}" ]] && continue
if is_canonical_uint_in_range "$update_id" 0 2147483646; then
offset=$(( update_id + 1 ))
fi
[[ "$chat_type" == "private" ]] || continue
if [[ "${kind:-text}" == "photo" || "${kind:-text}" == "document" ]]; then
sales_handle_payment_proof "$chat_id" "$from_id" "$username" "$first_name" "$message_id" "$kind"
else
sales_handle_command "$chat_id" "$from_id" "$username" "$first_name" "$text"
fi
done <<< "$updates"
sleep 1
done
}
install_sales_bot_service() {
local token="${1:-}" admin_id="${2:-}" script_path="${SCRIPT_PATH:-/usr/local/bin/yurich-panel.sh}" response bot_name
load_config 2>/dev/null || true
if [[ -n "$token" ]]; then
warn "Передача token через argv видна в history/process list. В следующий раз запускай sales-bot-install без аргументов."
SALES_BOT_TOKEN="$token"
fi
if [[ -n "$admin_id" ]]; then
SALES_BOT_ADMIN_ID="$admin_id"
fi
if [[ -z "${SALES_BOT_TOKEN:-}" ]]; then
echo -ne "${CYAN}Sales bot token: ${RESET}"
read -rs SALES_BOT_TOKEN
echo
fi
if [[ -z "${SALES_BOT_ADMIN_ID:-}" ]]; then
echo -ne "${CYAN}Telegram admin ID: ${RESET}"
read -r SALES_BOT_ADMIN_ID
fi
if [[ ! "${SALES_BOT_TOKEN:-}" =~ ^[0-9]+:[A-Za-z0-9_-]{20,}$ ]]; then
err "Sales bot token выглядит некорректно"
return 1
fi
if ! is_valid_tg_chat_id "${SALES_BOT_ADMIN_ID:-}"; then
err "Передай корректный Telegram admin ID"
return 1
fi
response=$(tg_api_with_token "$SALES_BOT_TOKEN" "getMe" -s --max-time 15 2>/dev/null || echo "{}")
if ! echo "$response" | grep -q '"ok":true'; then
err "Telegram API не подтвердил sales bot token"
echo "$response"
return 1
fi
bot_name=$(echo "$response" | grep -o '"username":"[^"]*"' | cut -d'"' -f4)
save_config
mkdir -p "$SALES_BOT_ORDERS_DIR"
chmod 700 "$SALES_BOT_DIR" "$SALES_BOT_ORDERS_DIR" 2>/dev/null || true
install -m 755 "$script_path" "$script_path" 2>/dev/null || true
cat > "$SALES_BOT_SERVICE" <@${bot_name:-unknown}
Команды администратора:
/sales_orders
/approve ORDER
/reject ORDER"
ok "Бот продаж установлен и запущен: yurich-sales-bot.service"
[[ -n "$bot_name" ]] && ok "Bot: @${bot_name}"
}
cmd_sales_bot_apply_defaults() {
local existing_sales_token=""
load_config 2>/dev/null || true
existing_sales_token="${SALES_BOT_TOKEN:-}"
if [[ -z "${SALES_BOT_TOKEN:-}" && -n "$existing_sales_token" ]]; then
SALES_BOT_TOKEN="$existing_sales_token"
fi
SALES_BOT_PLANS="$SALES_BOT_PLANS_DEFAULT"
SALES_BOT_CURRENCY="$SALES_BOT_CURRENCY_DEFAULT"
SALES_BOT_CHANNEL_URL="$SALES_BOT_CHANNEL_URL_DEFAULT"
SALES_BOT_PAYMENT_TEXT="$SALES_BOT_PAYMENT_TEXT_DEFAULT"
SALES_BOT_PAYMENT_QR_PATH="${SALES_BOT_PAYMENT_QR_PATH:-$SALES_BOT_PAYMENT_QR_PATH_DEFAULT}"
SALES_BOT_CAPTCHA_TTL_SECONDS="${SALES_BOT_CAPTCHA_TTL_SECONDS:-$SALES_BOT_CAPTCHA_TTL_SECONDS_DEFAULT}"
DEVICE_LIMIT_ENABLED="0"
DEVICE_LIMIT="5"
DEVICE_WINDOW_HOURS="${DEVICE_WINDOW_HOURS:-$DEVICE_WINDOW_HOURS_DEFAULT}"
DEVICE_LIMIT_MODE="alert"
save_config
write_device_cron
mkdir -p "$SALES_BOT_DIR" "$SALES_BOT_ORDERS_DIR" "$SALES_BOT_CAPTCHA_DIR" "$SALES_BOT_VERIFIED_DIR"
chmod 700 "$SALES_BOT_DIR" "$SALES_BOT_ORDERS_DIR" "$SALES_BOT_CAPTCHA_DIR" "$SALES_BOT_VERIFIED_DIR" 2>/dev/null || true
if [[ -n "${SALES_BOT_TOKEN:-}" ]]; then
sales_apply_bot_menu || warn "Не удалось применить меню бота продаж через Telegram API"
if systemctl list-unit-files yurich-sales-bot.service >/dev/null 2>&1; then
systemctl restart yurich-sales-bot || warn "Не удалось перезапустить yurich-sales-bot.service"
fi
else
warn "SALES_BOT_TOKEN не настроен, меню Telegram не применялось"
fi
ok "Настройки продаж применены: тарифы 1 день/1/3/6/12 месяцев, QR, канал, автобан выключен"
}
tg_reply_pre() {
local chat_id="$1"
local title="$2"
local content="$3"
content=$(printf '%s' "$content" | sed -r 's/\x1B\[[0-9;]*[mK]//g' | sed 's/&/\&/g; s//\>/g' | head -c 3400 || true)
[[ -z "$content" ]] && content="нет вывода"
tg_reply "$chat_id" "${title}
${content}"
}
tg_reply_file_tail() {
local chat_id="$1"
local title="$2"
local file="$3"
local tail_lines="${4:-60}"
local content
if [[ -f "$file" ]]; then
content=$(tail -n "$tail_lines" "$file" 2>/dev/null || true)
else
content="файл не найден: ${file}"
fi
tg_reply_pre "$chat_id" "$title" "$content"
}
# Отправка фото (QR код)
tg_send_photo() {
local chat_id="$1"
local photo_path="$2"
local caption="$3"
[[ -z "${TG_TOKEN:-}" || ! -f "${photo_path}" ]] && return
# Используем только -F для multipart (-F и --data-urlencode несовместимы)
tg_api "sendPhoto" -s --max-time 30 \
-X POST \
-F "chat_id=${chat_id}" \
-F "caption=${caption}" \
-F "photo=@${photo_path}" \
>/dev/null 2>&1 || true
}
tg_send_naive_qr() {
local chat_id="$1"
local user="$2"
local uri="$3"
if ! command -v qrencode &>/dev/null; then
tg_reply "${chat_id}" "📦 Устанавливаю qrencode для QR..."
apt-get install -y -q qrencode >/dev/null 2>&1 || true
fi
if command -v qrencode &>/dev/null; then
local qr_file="/tmp/naiveproxy_qr_${user}_$$.png"
if qrencode -o "${qr_file}" -s 8 "${uri}" 2>/dev/null && [[ -s "${qr_file}" ]]; then
tg_send_photo "${chat_id}" "${qr_file}" "📱 Yurich Proxy QR для ${user}@${DOMAIN}"
rm -f "${qr_file}"
return 0
fi
rm -f "${qr_file}"
fi
return 1
}
tg_send_hysteria_qr() {
local chat_id="$1"
local user="$2"
local uri="$3"
if ! command -v qrencode &>/dev/null; then
tg_reply "${chat_id}" "📦 Устанавливаю qrencode для Hysteria QR..."
apt-get install -y -q qrencode >/dev/null 2>&1 || true
fi
if command -v qrencode &>/dev/null; then
local qr_file="/tmp/hysteria_qr_${user}_$$.png"
if qrencode -o "${qr_file}" -s 8 "${uri}" 2>/dev/null && [[ -s "${qr_file}" ]]; then
tg_send_photo "${chat_id}" "${qr_file}" "⚡ Hysteria 2 QR для ${user}@${DOMAIN}"
rm -f "${qr_file}"
return 0
fi
rm -f "${qr_file}"
fi
return 1
}
# Обработка одной команды
tg_handle_command() {
local chat_id="$1"
local from_id="$2"
local text="$3"
# Отключаем строгий режим внутри обработчика — иначе любая ошибка ломает бот
set +e
load_config 2>/dev/null || true
local is_admin=0
tg_is_admin "${from_id}" && is_admin=1
# Очищаем text от \r \n и невидимых символов
text="${text//$'\r'/}"
text="${text//$'\n'/}"
# Русские кнопки Telegram reply keyboard -> существующие команды
case "${text}" in
"🆔 Мой Telegram ID") text="/myid" ;;
"🔔 Уведомления") text="/help" ;;
"📱 Приложения") text="/apps" ;;
"💬 Поддержка") text="/support" ;;
"📊 Статус") text="/status" ;;
"👥 Пользователи") text="/users" ;;
"➕ Добавить пользователя") text="/adduser" ;;
"🗑 Удалить пользователя") text="/deluser" ;;
"📱 QR / ссылка") text="/qr" ;;
"🔗 Подписка") text="/sub" ;;
"📰 Новости") text="/news" ;;
"🧬 Xray") text="/xray" ;;
"⚡ Hysteria") text="/hysteria" ;;
"🌀 WARP") text="/warp" ;;
"🔀 HAProxy") text="/haproxy" ;;
"🔍 Диагностика") text="/diagnose" ;;
"📄 Логи") text="/logs" ;;
"♻️ Restart Caddy") text="/restart" ;;
"🛠 Автофикс") text="/diagfix" ;;
"💛 Донат") text="/donate" ;;
"❓ Помощь") text="/menu" ;;
esac
# Лимит длины команды — защита от flood/injection, но новости могут быть длиннее обычных команд.
if [[ ${#text} -gt 3500 ]]; then
tg_reply "${chat_id}" "❌ Команда слишком длинная. Максимум 3500 символов."
return
fi
# Парсим команду и аргументы
local cmd args
cmd=$(echo "${text}" | awk '{print $1}' | tr '[:upper:]' '[:lower:]' | tr -d '\r\n[:cntrl:]')
# args = всё после первого пробела
if [[ "${text}" == *" "* ]]; then
args="${text#* }"
# Trim leading/trailing whitespace
args="${args#"${args%%[![:space:]]*}"}"
args="${args%"${args##*[![:space:]]}"}"
else
args=""
fi
# Убираем потенциально опасные символы из args (но оставляем безопасные)
args=$(echo "${args}" | tr -d '`$();<>&|\\')
if [[ "$is_admin" -ne 1 ]]; then
case "${cmd}" in
/start|/help|/menu)
tg_reply_menu "${chat_id}" "$(tg_user_welcome_message "${from_id}")" "user"
;;
/myid|/id)
tg_reply_menu "${chat_id}" "🆔 Твой Telegram ID: ${from_id}
Отправь его Ивану Юрьевичу вместе с именем профиля, чтобы подключить уведомления." "user"
;;
/apps)
tg_reply_menu "${chat_id}" "📱 Приложения Yurich Connect
Android: ${ANDROID_APP_RELEASES_URL}
Windows: ${WINDOWS_APP_RELEASES_URL}" "user"
;;
/support)
tg_reply_menu "${chat_id}" "💬 Поддержка
Напиши в поддержку: ${TELEGRAM_COMMUNITY_URL}
Не забудь отправить свой Telegram ID: ${from_id}" "user"
;;
*)
tg_reply_menu "${chat_id}" "👋 Это пользовательское меню Yurich Connect.
Твой Telegram ID: ${from_id}
Админские команды скрыты. Для уведомлений отправь этот ID Ивану Юрьевичу вместе с именем профиля." "user"
;;
esac
return
fi
case "${cmd}" in
/start|/help|/menu)
tg_reply_menu "${chat_id}" "🛡 Yurich Panel v${VERSION}
🖥 Сервер: $(hostname)
Русское меню включено. Кнопки ниже запускают основные действия, а команды руками тоже работают.
Доступные команды:
📊 Информация
/status — статус сервера и сертификата
/stats — статистика трафика и ресурсов
/haproxy — HAProxy SNI mux, маршруты Naive/Reality и SNI-лог
/diagnose — полная диагностика системы
/logs — последние 20 строк логов
/users — список пользователей
/cert — статус TLS сертификата
👥 Пользователи
/adduser логин [1-12 мес] — создать безопасный пароль, QR и подписку
/deluser логин — удалить пользователя + страницу
/qr логин — QR код для подключения
/sub логин — страница подписки пользователя
/subreset логин — перевыпустить ссылку подписки
/expiring — сроки подписок и привязки Telegram
/bindtg логин telegram_id — включить напоминания
/notifyrun — проверить и отправить напоминания
/testnotify логин — тест напоминания
/news_test текст — тест новости себе
/news текст — рассылка новости всем с Telegram ID
/devices — отчёт по лимиту устройств
/lockuser логин — отключить пользователя
/unlockuser логин — вернуть пользователя
🧬 Xray / Modern
/xray логин — ссылки VLESS/Trojan/REALITY
/xrayadduser логин — создать Xray пользователя + подписка
/xraystatus — статус Xray
/hysteria — статус Hysteria 2
/warp — статус и тест WARP proxy
⚙️ Управление
/restart — перезапустить Caddy
/update — обновить Caddy
/selfupdate — обновить скрипт
/diagfix — автофикс диагностики
/privatepage — личная фейковая страница
/admins — список администраторов
/addadmin ID — добавить администратора
/deladmin ID — удалить администратора
💛 /donate — поддержать проект"
;;
/status)
local caddy_status="🔴 Остановлен"
systemctl is-active caddy &>/dev/null && caddy_status="🟢 Работает"
local cert_info=""
if [[ -n "${DOMAIN:-}" ]]; then
local not_after expire_ts now_ts cert_days
not_after=$(echo | timeout 5 openssl s_client -connect "${DOMAIN}:443" -servername "${DOMAIN}" 2>/dev/null | openssl x509 -noout -dates 2>/dev/null | grep "notAfter" | cut -d= -f2 || echo "")
if [[ -n "${not_after}" ]]; then
expire_ts=$(date -d "${not_after}" +%s 2>/dev/null || echo 0)
now_ts=$(date +%s)
cert_days=$(( (expire_ts - now_ts) / 86400 ))
cert_info="
🔐 Сертификат: ${cert_days} дней"
fi
fi
tg_reply "${chat_id}" "📡 Статус Yurich Panel
🖥 Сервер: $(hostname)
${caddy_status}
🌐 Домен: ${DOMAIN:-не настроен}
👥 Пользователей: $(get_users | wc -l)
💾 RAM: $(free -h | awk '/Mem:/{print $3"/"$2}')
💿 Диск: $(df -h / | awk 'NR==2{print $3"/"$2" ("$5")"}')
🕐 $(date '+%Y-%m-%d %H:%M:%S')${cert_info}"
;;
/stats)
tg_send_stats_to "${chat_id}"
;;
/diagnose)
tg_reply "${chat_id}" "🔍 Запускаю диагностику, подожди..."
local diag_result=""
local pass=0 warn=0 fail=0
# Caddy
if systemctl is-active caddy &>/dev/null; then
diag_result+="✅ Caddy запущен
"
pass=$((pass+1))
else
diag_result+="❌ Caddy НЕ запущен
"
fail=$((fail+1))
fi
# Padding
local _p
_p=$(strings /usr/local/bin/caddy 2>/dev/null | grep -cE "^(Padding|SetPadding|WithPadding)$" || true)
_p="${_p//[^0-9]/}"; _p="${_p:-0}"
if command -v strings &>/dev/null && [[ "${_p}" -ge 2 ]]; then
diag_result+="✅ Naive padding OK
"
pass=$((pass+1))
else
diag_result+="⚠️ Padding не проверен
"
warn=$((warn+1))
fi
# Caddyfile
if grep -qE "^:443,|^http://127\\.0\\.0\\.1:[0-9]+" "${CADDYFILE:-/etc/caddy/Caddyfile}" 2>/dev/null \
|| { edge_routing_mode_is_haproxy && grep -q "^:${XRAY_CADDY_FALLBACK_PORT:-$XRAY_CADDY_FALLBACK_PORT_DEFAULT}," "${CADDYFILE:-/etc/caddy/Caddyfile}" 2>/dev/null; }; then
diag_result+="✅ Caddyfile формат OK
"
pass=$((pass+1))
elif grep -qE "^[[:alnum:].-]+:443[[:space:]]*\\{" "${CADDYFILE:-/etc/caddy/Caddyfile}" 2>/dev/null; then
diag_result+="⚠️ Caddyfile domain:443 ломает Naive CONNECT
"
warn=$((warn+1))
else
diag_result+="❌ Caddyfile неправильный формат
"
fail=$((fail+1))
fi
local hosts_overrides hosts_domains
hosts_overrides=$(hosts_public_domain_overrides | head -5 || true)
if [[ -n "$hosts_overrides" ]]; then
hosts_domains=$(printf '%s\n' "$hosts_overrides" | format_hosts_override_domains)
diag_result+="⚠️ /etc/hosts: ${hosts_domains}
"
warn=$((warn+1))
else
diag_result+="✅ /etc/hosts clean
"
pass=$((pass+1))
fi
# ALPN
if [[ -n "${DOMAIN:-}" ]]; then
local alpn
alpn=$(echo | timeout 5 openssl s_client -connect "${DOMAIN}:443" -alpn h2 2>/dev/null | grep -a "ALPN protocol" | awk '{print $3}' || echo "")
if [[ "${alpn}" == "h2" ]]; then
diag_result+="✅ ALPN h2 OK
"
pass=$((pass+1))
else
diag_result+="❌ ALPN не h2
"
fail=$((fail+1))
fi
fi
# UFW
if ufw status 2>/dev/null | grep -q "Status: active"; then
diag_result+="✅ UFW активен
"
pass=$((pass+1))
else
diag_result+="⚠️ UFW неактивен
"
warn=$((warn+1))
fi
# Fail2Ban
if systemctl is-active fail2ban &>/dev/null; then
diag_result+="✅ Fail2Ban активен
"
pass=$((pass+1))
else
diag_result+="⚠️ Fail2Ban не запущен
"
warn=$((warn+1))
fi
# RAM
local ram_pct
ram_pct=$(free | awk '/Mem:/{printf "%d", $3/$2*100}')
if [[ ${ram_pct} -lt 90 ]]; then
diag_result+="✅ RAM: ${ram_pct}%
"
pass=$((pass+1))
else
diag_result+="❌ RAM критически: ${ram_pct}%
"
fail=$((fail+1))
fi
tg_reply "${chat_id}" "🔍 Диагностика Yurich Panel
${diag_result}
✅ Пройдено: ${pass} ⚠️ Внимание: ${warn} ❌ Проблемы: ${fail}"
;;
/logs)
local log_lines
log_lines=$(journalctl -u caddy -n 20 --no-pager 2>/dev/null | tail -20 | sed 's//\>/g' || echo "Логи недоступны")
tg_reply "${chat_id}" "📋 Логи Caddy (последние 20):
${log_lines}"
;;
/users)
local user_list
user_list=$(get_users | awk -F: '{print "• "$1""}' | head -20 || echo "Нет пользователей")
tg_reply "${chat_id}" "👥 Пользователи ($(get_users | wc -l)):
${user_list}"
;;
/adduser)
local new_user new_pass new_months arg2 arg3
new_user=$(echo "${args}" | awk '{print $1}')
arg2=$(echo "${args}" | awk '{print $2}')
arg3=$(echo "${args}" | awk '{print $3}')
new_months="${arg2:-12}"
if [[ -z "${new_user}" ]]; then
tg_reply "${chat_id}" "❌ Использование: /adduser логин [месяцы 1-12]
Бот сам создаёт безопасный пароль и показывает его один раз.
Пример: /adduser alice 6"
return
fi
if [[ -n "$arg3" ]]; then
tg_reply "${chat_id}" "❌ Пароль больше нельзя передавать в Telegram-команде.
Используй: /adduser ${new_user} 12"
return
fi
if ! is_valid_user_months "$new_months"; then
tg_reply "${chat_id}" "❌ Срок должен быть от 1 до 12 месяцев"
return
fi
# Валидация логина
if ! is_valid_proxy_user "${new_user}"; then
tg_reply "${chat_id}" "❌ Неверный логин ${new_user}
Только буквы, цифры, _, - (2-32 символа)"
return
fi
new_pass=$(random_safe_token 20)
if get_user_hash "${new_user}" >/dev/null; then
tg_reply "${chat_id}" "❌ Пользователь ${new_user} уже существует"
return
fi
# Создаём папку и файл если нет
mkdir -p "$(dirname "${USERS_FILE}")"
touch "${USERS_FILE}"
chmod 600 "${USERS_FILE}"
local users_backup
users_backup=$(mktemp -d /run/yurich-bot-add-user.XXXXXX)
credential_state_backup "$users_backup/credential-state"
if ! credential_set_user "${new_user}" "${new_pass}"; then
rm -rf "$users_backup"
tg_reply "${chat_id}" "❌ Не удалось безопасно сохранить credentials пользователя ${new_user}."
return
fi
set_user_expiry_months "${new_user}" "${new_months}" || true
if rewrite_caddyfile_current 2>/dev/null; then
if ! systemctl reload caddy 2>/dev/null && ! systemctl restart caddy 2>/dev/null; then
credential_state_restore "$users_backup/credential-state"
rm -rf "$users_backup"
cleanup_user_metadata "${new_user}"
rewrite_caddyfile_current >/dev/null 2>&1 || true
tg_reply "${chat_id}" "❌ Caddy не перезагрузился. Пользователь ${new_user} отменён."
return
fi
rm -rf "$users_backup"
local uri branded_uri sub_url sub_links xray_note xray_tmp xray_ok hy_note hy_uri hy_ok
uri="naive+https://${new_user}:${new_pass}@${DOMAIN}:443"
branded_uri=$(yurich_proxy_uri "${new_user}" "${new_pass}" "${new_user}-yurich")
xray_note=""
xray_ok=0
hy_note=""
hy_uri=""
hy_ok=0
if [[ -f "$HYSTERIA_CONFIG" || -x "$HYSTERIA_BIN" ]]; then
if sync_hysteria_users_if_active >/dev/null 2>&1; then
hy_ok=1
hy_uri=$(hysteria_uri_for_user "${new_user}" 2>/dev/null || true)
hy_note="⚡ Hysteria 2: создан персональный профиль"
else
hy_note="⚠️ Hysteria 2: пользователь создан, но конфиг не обновился"
fi
fi
if [[ "${XRAY_ENABLED:-0}" == "1" && -x "$XRAY_BIN" && -f "$XRAY_CONFIG" ]]; then
xray_tmp=$(mktemp)
if provision_xray_user "${new_user}" > "$xray_tmp" 2>&1; then
xray_ok=1
xray_note="🧬 Xray/VLESS: создан для этого же пользователя"
else
xray_note="⚠️ Xray/VLESS: Naive создан, но Xray профиль не применён"
fi
fi
sub_url=$(generate_subscription_page "${new_user}" 2>/dev/null || true)
sub_links="${sub_url:+${sub_url}links.txt}"
tg_reply "${chat_id}" "✅ Пользователь добавлен
👤 Логин: ${new_user}
🔑 Пароль: ${new_pass}
🔒 На сервере: bcrypt + encrypted vault
⚠️ Пароль показан в этом сообщении для настройки клиента.
📅 Срок: $(user_expiry_label "${new_user}")
${hy_note}
${xray_note}
🌐 Yurich Proxy:
${branded_uri}
Совместимый URI:
${uri}
⚡ Hysteria 2:
${hy_uri:-не создано}
📄 Страница:
${sub_url:-не создана автоматически}
Raw links:
${sub_links:-не создано}"
if ! tg_send_naive_qr "${chat_id}" "${new_user}" "${uri}"; then
tg_reply "${chat_id}" "⚠️ QR не удалось создать автоматически. URI выше рабочий."
fi
if [[ "$hy_ok" -eq 1 && -n "$hy_uri" ]]; then
tg_send_hysteria_qr "${chat_id}" "${new_user}" "$hy_uri" || true
fi
if [[ "$xray_ok" -eq 1 ]]; then
local x_links
x_links=$(print_xray_client_config "${new_user}" 2>&1)
tg_reply_pre "${chat_id}" "🧬 Xray ссылки для ${new_user}" "$x_links"
elif [[ -n "${xray_tmp:-}" && -f "$xray_tmp" ]]; then
tg_reply_file_tail "${chat_id}" "⚠️ Xray профиль не применён" "$xray_tmp" 60
fi
[[ -n "${xray_tmp:-}" ]] && rm -f "$xray_tmp"
else
credential_state_restore "$users_backup/credential-state"
rm -rf "$users_backup"
cleanup_user_metadata "${new_user}"
tg_reply "${chat_id}" "❌ Caddyfile не обновлён. Пользователь ${new_user} отменён."
fi
;;
/deluser)
local del_user="${args%% *}"
if [[ -z "${del_user}" ]]; then
tg_reply "${chat_id}" "❌ Использование: /deluser логин"
return
fi
if ! is_valid_proxy_user "${del_user}" || ! subscription_user_exists "${del_user}"; then
tg_reply "${chat_id}" "❌ Пользователь ${del_user} не найден"
return
fi
if ! delete_subscription_user_everywhere "${del_user}"; then
tg_reply "${chat_id}" "❌ Не удалось полностью удалить ${del_user}. Проверь логи панели."
return
fi
tg_reply "${chat_id}" "🗑 Пользователь ${del_user} полностью удалён
📄 Подписка, token и публичные ссылки тоже удалены"
;;
/qr)
local qr_user="${args%% *}"
# Если args содержит ":" — значит это конкретный логин с двоеточием (не должно быть)
if [[ -z "${qr_user}" ]]; then
# QR для первого пользователя
qr_user=$(get_users | head -1 | cut -d: -f1)
fi
if [[ -z "${qr_user}" ]]; then
tg_reply "${chat_id}" "❌ Нет пользователей. Добавь: /adduser логин [месяцы]"
return
fi
local qr_pass
qr_pass=$(get_user_pass "${qr_user}" || true)
if [[ -z "${qr_pass}" ]]; then
tg_reply "${chat_id}" "❌ Пользователь ${qr_user} не найден
Список пользователей: /users"
return
fi
if [[ -z "${DOMAIN:-}" ]]; then
tg_reply "${chat_id}" "❌ Домен не настроен в конфиге"
return
fi
local uri branded_uri
uri="naive+https://${qr_user}:${qr_pass}@${DOMAIN}:443"
branded_uri=$(yurich_proxy_uri "${qr_user}" "${qr_pass}" "${qr_user}-yurich")
# Авто-установка qrencode если нет
if ! command -v qrencode &>/dev/null; then
tg_reply "${chat_id}" "📦 Устанавливаю qrencode..."
apt-get install -y -q qrencode &>/dev/null
fi
if command -v qrencode &>/dev/null; then
local qr_file="/tmp/naiveproxy_qr_${qr_user}_$$.png"
if qrencode -o "${qr_file}" -s 8 "${uri}" 2>/dev/null && [[ -s "${qr_file}" ]]; then
tg_send_photo "${chat_id}" "${qr_file}" "📱 Yurich Proxy QR для ${qr_user}@${DOMAIN}"
# Дополнительно отправляем URI текстом
tg_reply "${chat_id}" "🔗 Yurich Proxy:
${branded_uri}
Совместимый URI:
${uri}"
rm -f "${qr_file}"
else
tg_reply "${chat_id}" "⚠️ Ошибка генерации QR
Yurich Proxy: ${branded_uri}
Совместимый URI: ${uri}"
fi
else
tg_reply "${chat_id}" "📱 Yurich Proxy для ${qr_user}:
${branded_uri}
Совместимый URI:
${uri}
(установи qrencode на сервере для QR картинки)"
fi
;;
/sub)
local sub_user="${args%% *}"
if [[ -z "${sub_user}" ]]; then
sub_user=$(get_users | head -1 | cut -d: -f1)
[[ -z "$sub_user" && -s "$XRAY_USERS_FILE" ]] && sub_user=$(head -1 "$XRAY_USERS_FILE" | cut -d: -f1)
fi
if [[ -z "$sub_user" ]]; then
tg_reply "${chat_id}" "❌ Нет пользователей. Создай Naive или Xray пользователя."
return
fi
local sub_out sub_rc
sub_out=$(generate_subscription_page "$sub_user" 2>&1)
sub_rc=$?
if [[ "$sub_rc" -eq 0 ]]; then
tg_reply "${chat_id}" "🔗 Подписка для ${sub_user}
${sub_out}
Raw links:
${sub_out}links.txt"
else
tg_reply_pre "${chat_id}" "❌ Ошибка создания подписки" "$sub_out"
fi
;;
/subreset)
local reset_user="${args%% *}"
if [[ -z "$reset_user" ]]; then
tg_reply "${chat_id}" "❌ Использование: /subreset логин"
return
fi
local reset_out reset_rc
reset_out=$(cmd_subscription_reset "$reset_user" 2>&1)
reset_rc=$?
if [[ "$reset_rc" -eq 0 ]]; then
tg_reply_pre "${chat_id}" "✅ Подписка перевыпущена" "$reset_out"
else
tg_reply_pre "${chat_id}" "❌ Ошибка перевыпуска подписки" "$reset_out"
fi
;;
/expiring|/expires|/notifylist)
local exp_tmp
exp_tmp=$(mktemp)
cmd_notify_expiry_list > "$exp_tmp" 2>&1
tg_reply_file_tail "${chat_id}" "📅 Сроки подписок" "$exp_tmp" 120
rm -f "$exp_tmp"
;;
/bindtg|/tgbind)
local bind_user bind_chat bind_tmp bind_rc
bind_user=$(echo "${args}" | awk '{print $1}')
bind_chat=$(echo "${args}" | awk '{print $2}')
if [[ -z "$bind_user" || -z "$bind_chat" ]]; then
tg_reply "${chat_id}" "❌ Использование: /bindtg логин telegram_id"
return
fi
bind_tmp=$(mktemp)
cmd_notify_bind_tg "$bind_user" "$bind_chat" > "$bind_tmp" 2>&1
bind_rc=$?
if [[ "$bind_rc" -eq 0 ]]; then
tg_reply_file_tail "${chat_id}" "✅ Telegram ID привязан" "$bind_tmp" 40
else
tg_reply_file_tail "${chat_id}" "❌ Telegram ID не привязан" "$bind_tmp" 40
fi
rm -f "$bind_tmp"
;;
/untg|/unbindtg)
local unbind_user unbind_tmp unbind_rc
unbind_user="${args%% *}"
if [[ -z "$unbind_user" ]]; then
tg_reply "${chat_id}" "❌ Использование: /untg логин"
return
fi
unbind_tmp=$(mktemp)
cmd_notify_unbind_tg "$unbind_user" > "$unbind_tmp" 2>&1
unbind_rc=$?
if [[ "$unbind_rc" -eq 0 ]]; then
tg_reply_file_tail "${chat_id}" "✅ Telegram уведомления отключены" "$unbind_tmp" 40
else
tg_reply_file_tail "${chat_id}" "❌ Не удалось отключить Telegram" "$unbind_tmp" 40
fi
rm -f "$unbind_tmp"
;;
/notifyrun|/notifynow)
local notify_tmp notify_rc
notify_tmp=$(mktemp)
cmd_notify_expiry_run > "$notify_tmp" 2>&1
notify_rc=$?
if [[ "$notify_rc" -eq 0 ]]; then
tg_reply_file_tail "${chat_id}" "🔔 Проверка уведомлений выполнена" "$notify_tmp" 40
else
tg_reply_file_tail "${chat_id}" "⚠️ Проверка уведомлений с ошибками" "$notify_tmp" 40
fi
rm -f "$notify_tmp"
;;
/testnotify)
local test_user test_tmp test_rc
test_user="${args%% *}"
if [[ -z "$test_user" ]]; then
tg_reply "${chat_id}" "❌ Использование: /testnotify логин"
return
fi
test_tmp=$(mktemp)
cmd_notify_expiry_test "$test_user" > "$test_tmp" 2>&1
test_rc=$?
if [[ "$test_rc" -eq 0 ]]; then
tg_reply_file_tail "${chat_id}" "✅ Тест отправлен" "$test_tmp" 40
else
tg_reply_file_tail "${chat_id}" "❌ Тест не отправлен" "$test_tmp" 40
fi
rm -f "$test_tmp"
;;
/news_test|/newstest|/broadcast_test|/broadcasttest)
local news_test_tmp news_test_rc
if [[ -z "$args" ]]; then
tg_reply "${chat_id}" "❌ Использование: /news_test текст новости
Пример:
/news_test Обновили профили и улучшили стабильность подключения."
return
fi
news_test_tmp=$(mktemp)
cmd_notify_news_test "$args" "$chat_id" > "$news_test_tmp" 2>&1
news_test_rc=$?
if [[ "$news_test_rc" -eq 0 ]]; then
tg_reply_file_tail "${chat_id}" "✅ Тест новости отправлен" "$news_test_tmp" 40
else
tg_reply_file_tail "${chat_id}" "❌ Тест новости не отправлен" "$news_test_tmp" 40
fi
rm -f "$news_test_tmp"
;;
/news|/broadcast)
local news_tmp news_rc
if [[ -z "$args" ]]; then
tg_reply "${chat_id}" "📰 Рассылка новостей Yurich Connect
Сначала проверь внешний вид:
/news_test текст новости
Потом отправь всем пользователям с привязанным Telegram ID:
/news текст новости"
return
fi
news_tmp=$(mktemp)
cmd_notify_news_broadcast "$args" > "$news_tmp" 2>&1
news_rc=$?
if [[ "$news_rc" -eq 0 ]]; then
tg_reply_file_tail "${chat_id}" "✅ Новость разослана" "$news_tmp" 40
else
tg_reply_file_tail "${chat_id}" "⚠️ Рассылка завершилась с проблемами" "$news_tmp" 40
fi
rm -f "$news_tmp"
;;
/devices)
local dev_tmp dev_rc
dev_tmp=$(mktemp)
cmd_devices_scan > "$dev_tmp" 2>&1
dev_rc=$?
if [[ "$dev_rc" -eq 0 ]]; then
tg_reply_file_tail "${chat_id}" "📱 Лимит устройств" "$dev_tmp" 80
else
tg_reply_file_tail "${chat_id}" "⚠️ Лимит устройств" "$dev_tmp" 80
fi
rm -f "$dev_tmp"
;;
/lockuser)
local lock_user="${args%% *}"
if [[ -z "$lock_user" ]]; then
tg_reply "${chat_id}" "❌ Использование: /lockuser логин"
return
fi
local lock_out lock_rc
lock_out=$(device_disable_user "$lock_user" 2>&1)
lock_rc=$?
if [[ "$lock_rc" -eq 0 ]]; then
tg_reply_pre "${chat_id}" "🔒 Пользователь отключён" "$lock_out"
else
tg_reply_pre "${chat_id}" "❌ Не удалось отключить пользователя" "$lock_out"
fi
;;
/unlockuser)
local unlock_user="${args%% *}"
if [[ -z "$unlock_user" ]]; then
tg_reply "${chat_id}" "❌ Использование: /unlockuser логин"
return
fi
local unlock_out unlock_rc
unlock_out=$(device_enable_user "$unlock_user" 2>&1)
unlock_rc=$?
if [[ "$unlock_rc" -eq 0 ]]; then
tg_reply_pre "${chat_id}" "🔓 Пользователь возвращён" "$unlock_out"
else
tg_reply_pre "${chat_id}" "❌ Не удалось вернуть пользователя" "$unlock_out"
fi
;;
/xray)
local x_user="${args%% *}"
if [[ ! -s "$XRAY_USERS_FILE" ]]; then
tg_reply "${chat_id}" "❌ Xray пользователи не найдены. Сначала настрой Xray: sudo bash yurich-panel.sh xray-install"
return
fi
[[ -z "$x_user" ]] && x_user=$(head -1 "$XRAY_USERS_FILE" | cut -d: -f1)
local x_out x_rc
x_out=$(print_xray_client_config "$x_user" 2>&1)
x_rc=$?
if [[ "$x_rc" -eq 0 ]]; then
tg_reply_pre "${chat_id}" "🧬 Xray ссылки для ${x_user}" "$x_out"
else
tg_reply_pre "${chat_id}" "❌ Xray config недоступен" "$x_out"
fi
;;
/xrayadduser|/xrayuser)
local x_new x_months
x_new=$(echo "${args}" | awk '{print $1}')
x_months=$(echo "${args}" | awk '{print $2}')
x_months="${x_months:-12}"
if [[ -z "$x_new" ]]; then
tg_reply "${chat_id}" "❌ Использование: /xrayadduser логин [месяцы 1-12]"
return
fi
if ! is_valid_user_months "$x_months"; then
tg_reply "${chat_id}" "❌ Срок должен быть от 1 до 12 месяцев"
return
fi
local xa_tmp xa_rc
xa_tmp=$(mktemp)
cmd_xray_add_user "$x_new" "$x_months" > "$xa_tmp" 2>&1
xa_rc=$?
if [[ "$xa_rc" -eq 0 ]]; then
tg_reply_file_tail "${chat_id}" "✅ Xray пользователь создан" "$xa_tmp" 100
else
tg_reply_file_tail "${chat_id}" "❌ Xray пользователь не создан" "$xa_tmp" 100
fi
rm -f "$xa_tmp"
;;
/xraystatus)
local xs_tmp
xs_tmp=$(mktemp)
cmd_xray_status > "$xs_tmp" 2>&1
tg_reply_file_tail "${chat_id}" "🧬 Xray статус" "$xs_tmp" 80
rm -f "$xs_tmp"
;;
/hysteria|/hy2|/hysteriastatus|/hy2status)
local hy_tmp
hy_tmp=$(mktemp)
cmd_hysteria_status > "$hy_tmp" 2>&1
tg_reply_file_tail "${chat_id}" "⚡ Hysteria 2 статус" "$hy_tmp" 80
rm -f "$hy_tmp"
;;
/warp|/warpstatus)
local warp_tmp
warp_tmp=$(mktemp)
cmd_warp_status > "$warp_tmp" 2>&1
echo >> "$warp_tmp"
cmd_warp_test >> "$warp_tmp" 2>&1 || true
tg_reply_file_tail "${chat_id}" "🌀 WARP proxy статус" "$warp_tmp" 100
rm -f "$warp_tmp"
;;
/haproxy|/sni|/sni_mux)
local hap_tmp
hap_tmp=$(mktemp)
cmd_haproxy_status > "$hap_tmp" 2>&1
tg_reply_file_tail "${chat_id}" "🔀 HAProxy SNI mux" "$hap_tmp" 120
rm -f "$hap_tmp"
;;
/diagfix)
local fix_tmp fix_rc
fix_tmp=$(mktemp)
tg_reply "${chat_id}" "🛠 Запускаю автофикс, подожди..."
cmd_diagnose_fix > "$fix_tmp" 2>&1
fix_rc=$?
if [[ "$fix_rc" -eq 0 ]]; then
tg_reply_file_tail "${chat_id}" "✅ Автофикс завершён" "$fix_tmp" 80
else
tg_reply_file_tail "${chat_id}" "⚠️ Автофикс завершился с ошибкой" "$fix_tmp" 80
fi
rm -f "$fix_tmp"
;;
/privatepage)
local private_out private_rc
private_out=$(install_private_camouflage_page 2>&1)
private_rc=$?
if [[ "$private_rc" -eq 0 ]]; then
tg_reply_pre "${chat_id}" "🎭 Личная фейковая страница" "$private_out"
else
tg_reply_pre "${chat_id}" "❌ Ошибка личной страницы" "$private_out"
fi
;;
/donate)
local donate_link donate_label
donate_link="${PROJECT_DONATION_URL:-$PROJECT_GITHUB_URL}"
donate_label="$([[ -n "${PROJECT_DONATION_URL:-}" ]] && printf 'Поддержать проект' || printf 'GitHub проекта')"
tg_reply "${chat_id}" "💛 Поддержать проект
Если Yurich Panel помог тебе — поддержи разработку!
👉 $(html_escape_text "$donate_label")
Что даст твой донат:
🚀 Больше времени на разработку
🐛 Быстрые фиксы багов
✨ Новые фичи каждый месяц
📚 Документация и поддержка
Спасибо за поддержку! 🙏"
;;
/cert)
if [[ -z "${DOMAIN:-}" ]]; then
tg_reply "${chat_id}" "❌ Домен не настроен"
return
fi
local cert_out
cert_out=$(echo | timeout 5 openssl s_client -connect "${DOMAIN}:443" -servername "${DOMAIN}" 2>/dev/null | openssl x509 -noout -dates -issuer 2>/dev/null || echo "")
if [[ -z "${cert_out}" ]]; then
tg_reply "${chat_id}" "❌ Не удалось получить сертификат для ${DOMAIN}"
return
fi
local not_after issuer cert_days
not_after=$(echo "${cert_out}" | grep "notAfter" | cut -d= -f2)
issuer=$(echo "${cert_out}" | grep "issuer" | grep -oP 'O=\K[^,]+' || echo "н/д")
expire_ts=$(date -d "${not_after}" +%s 2>/dev/null || echo 0)
cert_days=$(( ($(date +%s) - expire_ts) / -86400 ))
local cert_icon="🟢"
[[ ${cert_days} -lt 30 ]] && cert_icon="🟡"
[[ ${cert_days} -lt 7 ]] && cert_icon="🔴"
tg_reply "${chat_id}" "${cert_icon} TLS Сертификат
🌐 Домен: ${DOMAIN}
📅 Истекает: ${not_after}
⏳ Осталось: ${cert_days} дней
🏢 Выдан: ${issuer}"
;;
/restart)
tg_reply "${chat_id}" "🔄 Перезапускаю Caddy..."
if systemctl restart caddy 2>/dev/null; then
sleep 2
tg_reply "${chat_id}" "✅ Caddy перезапущен"
else
tg_reply "${chat_id}" "❌ Ошибка перезапуска. Проверь: journalctl -u caddy -n 20"
fi
;;
/update)
tg_reply "${chat_id}" "🔄 Обновляю Caddy, подожди 5-15 минут..."
local _script
_script="${SCRIPT_PATH:-/usr/local/bin/yurich-panel.sh}"
if [[ ! -f "${_script}" ]]; then
tg_reply "${chat_id}" "❌ Скрипт не найден: ${_script}"
return
fi
if bash "${_script}" update >/dev/null 2>&1; then
tg_reply "${chat_id}" "✅ Caddy обновлён"
else
tg_reply "${chat_id}" "❌ Ошибка обновления Caddy"
fi
;;
/selfupdate)
tg_reply "${chat_id}" "⬆️ Проверяю обновления скрипта..."
local latest_ver
latest_ver=$(curl -s --max-time 8 "${GITHUB_RAW}" 2>/dev/null | grep '^VERSION=' | grep -oP '"\K[^"]+' || echo "")
if [[ -z "${latest_ver}" ]]; then
tg_reply "${chat_id}" "❌ Не удалось проверить обновления"
elif [[ "${latest_ver}" == "${VERSION}" ]]; then
tg_reply "${chat_id}" "✅ Скрипт актуален: v${VERSION}"
else
tg_reply "${chat_id}" "⬆️ Доступно обновление v${VERSION} → v${latest_ver}
Запусти на сервере: sudo bash yurich-panel.sh self-update"
fi
;;
/admins)
local admin_list="• Главный: ${TG_CHAT_ID}"
if [[ -n "${TG_ADMINS:-}" ]]; then
local IFS=','
for aid in ${TG_ADMINS}; do
aid="${aid// /}"
admin_list+="
• ${aid}"
done
fi
tg_reply "${chat_id}" "👮 Администраторы:
${admin_list}"
;;
/addadmin)
local new_admin="${args%% *}"
# Защита: только числа, разумная длина
if [[ -z "${new_admin}" || ! "${new_admin}" =~ ^[0-9]{5,15}$ ]]; then
tg_reply "${chat_id}" "❌ Использование: /addadmin 123456789"
return
fi
if [[ -z "${TG_ADMINS}" ]]; then
TG_ADMINS="${new_admin}"
else
TG_ADMINS="${TG_ADMINS},${new_admin}"
fi
save_config
tg_reply "${chat_id}" "✅ Администратор ${new_admin} добавлен"
;;
/deladmin)
local del_admin="${args%% *}"
if [[ -z "${del_admin}" || ! "${del_admin}" =~ ^[0-9]{5,15}$ ]]; then
tg_reply "${chat_id}" "❌ Использование: /deladmin 123456789"
return
fi
TG_ADMINS=$(echo "${TG_ADMINS}" | tr ',' '
' | grep -Fvx "${del_admin}" | tr '
' ',' | sed 's/,$//')
save_config
tg_reply "${chat_id}" "🗑 Администратор ${del_admin} удалён"
;;
*)
tg_reply_menu "${chat_id}" "❓ Неизвестная команда. Используй /help или кнопки меню."
;;
esac
}
# Основной цикл бота (long polling)
cmd_bot() {
[[ -z "${TG_TOKEN:-}" ]] && err "Telegram не настроен. Запусти: sudo bash yurich-panel.sh" && return 1
tg_apply_bot_menu_silent
info "Запускаю Telegram бот..."
info "Бот работает. Нажми Menu или напиши /menu в Telegram."
info "Для остановки: Ctrl+C"
echo
local offset=0
while true; do
# Получаем обновления
local response
response=$(tg_api "getUpdates?offset=${offset}&timeout=30&allowed_updates=%5B%22message%22%5D" -s --max-time 35 \
2>/dev/null || echo "")
if [[ -z "${response}" ]]; then
sleep 5
continue
fi
# Парсим обновления через python3
local updates
updates=$(echo "${response}" | python3 -c "
import sys, json
try:
data = json.load(sys.stdin)
if not data.get('ok'): sys.exit(0)
for u in data.get('result', []):
uid = u.get('update_id', 0)
msg = u.get('message', {})
chat = msg.get('chat', {})
chat_id = chat.get('id', '')
chat_type = chat.get('type', '')
from_id = msg.get('from', {}).get('id', '')
text = str(msg.get('text') or '')
if text:
text = text.replace('|', ' ').replace('\\r', ' ').replace('\\n', ' ')
print(f'{uid}|{chat_id}|{chat_type}|{from_id}|{text}')
except: pass
" 2>/dev/null || echo "")
while IFS='|' read -r update_id chat_id chat_type from_id text; do
[[ -z "${update_id}" ]] && continue
# Защита от переполнения
if is_canonical_uint_in_range "${update_id}" 0 2147483646; then
offset=$(( update_id + 1 ))
fi
[[ "$chat_type" == "private" ]] || continue
tg_handle_command "${chat_id}" "${from_id}" "${text}"
done <<< "${updates}"
sleep 1
done
}
# Запуск бота как systemd сервиса
install_bot_service() {
local script_path="${SCRIPT_PATH:-/usr/local/bin/yurich-panel.sh}"
local running_script
running_script=$(realpath "$0" 2>/dev/null || echo "")
mkdir -p "$(dirname "$script_path")"
if [[ -n "$running_script" && -f "$running_script" && "$running_script" != /dev/fd/* && "$running_script" != /proc/* ]]; then
if bash -n "$running_script" 2>/dev/null; then
install -m 755 "$running_script" "$script_path" 2>/dev/null || true
fi
fi
if [[ ! -f "$script_path" ]]; then
err "Не найден ${script_path}. Сначала обнови скрипт: sudo bash yurich-panel.sh self-update"
return 1
fi
chmod +x "$script_path" 2>/dev/null || true
if [[ -n "${LEGACY_SCRIPT_PATH:-}" && "$script_path" != "$LEGACY_SCRIPT_PATH" ]]; then
install -m 755 "$script_path" "$LEGACY_SCRIPT_PATH" 2>/dev/null || true
fi
cat > /etc/systemd/system/naiveproxy-bot.service << EOF
[Unit]
Description=Yurich Panel Telegram Bot
After=network-online.target caddy.service
Wants=network-online.target
StartLimitIntervalSec=60
StartLimitBurst=5
[Service]
Type=simple
ExecStart=/bin/bash ${script_path} bot
Restart=always
RestartSec=10
User=root
UMask=0077
NoNewPrivileges=true
PrivateTmp=true
KeyringMode=private
LimitNOFILE=65536
TasksMax=512
TimeoutStopSec=20s
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable naiveproxy-bot --quiet
tg_apply_bot_menu || warn "Команды Telegram Menu можно применить позже: sudo bash yurich-panel.sh bot-menu"
systemctl restart naiveproxy-bot
ok "Telegram бот установлен как системный сервис"
ok "Статус: systemctl status naiveproxy-bot"
}
# Обёртка tg_send_stats_to для отправки конкретному chat_id
tg_send_stats_to() {
local target_chat="$1"
local caddy_ver
caddy_ver=$(/usr/local/bin/caddy version 2>/dev/null | head -1 | awk '{print $1}' || echo "н/д")
local caddy_status="🔴 Остановлен"
systemctl is-active caddy &>/dev/null && caddy_status="🟢 Работает"
local cert_days="н/д"
if [[ -n "${DOMAIN:-}" ]]; then
local not_after expire_ts
not_after=$(echo | timeout 5 openssl s_client -connect "${DOMAIN}:443" -servername "${DOMAIN}" 2>/dev/null | openssl x509 -noout -dates 2>/dev/null | grep "notAfter" | cut -d= -f2 || echo "")
if [[ -n "${not_after}" ]]; then
expire_ts=$(date -d "${not_after}" +%s 2>/dev/null || echo 0)
cert_days=$(( (expire_ts - $(date +%s)) / 86400 ))
fi
fi
local haproxy_raw="" haproxy_block=""
if edge_routing_mode_is_haproxy; then
haproxy_raw=$(haproxy_stats_text 2>/dev/null | head -n 18 || true)
if [[ -n "$haproxy_raw" ]]; then
haproxy_block=$'\n\n🔀 HAProxy SNI mux\n'"$(html_escape_text "$haproxy_raw")"$'' fi fi tg_reply "${target_chat}" "📊 Статистика Yurich Panel 🌐 Домен:
${DOMAIN:-н/д}
📡 Статус: ${caddy_status}
📦 Caddy: ${caddy_ver}
👥 Пользователей: $(get_users | wc -l)
🖥 Сервер: $(hostname)
💾 RAM: $(free -h | awk '/Mem:/{print $3"/"$2}')
💿 Диск: $(df -h / | awk 'NR==2{print $3"/"$2" ("$5")"}')
⚡ CPU: $(uptime | awk -F'load average:' '{print $2}' | awk '{print $1}' | tr -d ',')
🔐 Сертификат: ${cert_days} дней
🕐 $(date '+%Y-%m-%d %H:%M:%S')${haproxy_block}"
}
# ══════════════════════════════════════════════════════════════
# YURICH DNS (Unbound recursive resolver for VPN clients)
# ══════════════════════════════════════════════════════════════
DNS_CONF="/etc/unbound/unbound.conf.d/yurich-dns.conf"
DNS_BLOCKLIST_CONF="/etc/unbound/unbound.conf.d/yurich-dns-blocklist.conf"
DNS_ALLOWLIST_FILE="/etc/naiveproxy/dns-allowlist.txt"
DNS_FILTER_STATE_FILE="/etc/naiveproxy/dns-filter.state"
DNS_FILTER_CRON="/etc/cron.d/yurich-dns-filter"
DNS_FILTER_MONITOR_CRON="/etc/cron.d/yurich-dns-monitor"
DNS_FILTER_LOG="/var/log/yurich-dns-filter.log"
DNS_FILTER_MONITOR_LOG="/var/log/yurich-dns-monitor.log"
DNS_FILTER_URLS_DEFAULT="https://urlhaus.abuse.ch/downloads/hostfile/ https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt"
DNS_FILTER_MAX_DOMAINS_DEFAULT="200000"
DNS_LEGACY_OLD_DNS_CONF="/etc/unbound/unbound.conf.d/aurum-vpn.conf"
DNS_LEGACY_CONF="/etc/unbound/unbound.conf.d/naiveproxy-dns.conf"
DNS_LEGACY_BLOCKLIST="/etc/unbound/blocklist.conf"
DNS_LEGACY_WHITELIST="/etc/unbound/whitelist.txt"
DNS_RESOLVED_NO_STUB="/etc/systemd/resolved.conf.d/no-stub.conf"
DNS_GATEWAY_SERVICE="/etc/systemd/system/yurich-dns-gateway.service"
DNS_LEGACY_GATEWAY_SERVICE="/etc/systemd/system/aurum-dns-gateway.service"
DNS_DEFAULT_GATEWAY_IP="10.0.0.1"
DNS_DEFAULT_VPN_CIDRS="10.0.0.0/24"
DNS_STATS_FILE="/etc/naiveproxy/dns_stats"
DNS_LAST_CONFIG_BACKUP=""
is_valid_ipv4() {
local ip="$1" part
local -a oct
[[ "$ip" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] || return 1
IFS='.' read -r -a oct <<< "$ip"
for part in "${oct[@]}"; do
[[ "$part" =~ ^[0-9]+$ ]] || return 1
[[ "$part" == "0" || "$part" != 0* ]] || return 1
(( 10#$part <= 255 )) || return 1
done
}
is_valid_cidr4() {
local cidr="$1" ip part
local -a oct
[[ "$cidr" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$ ]] || return 1
ip="${cidr%/*}"
IFS='.' read -r -a oct <<< "$ip"
for part in "${oct[@]}"; do
[[ "$part" =~ ^[0-9]+$ ]] || return 1
[[ "$part" == "0" || "$part" != 0* ]] || return 1
(( 10#$part <= 255 )) || return 1
done
}
is_private_vpn_ipv4() {
local ip="$1" a b
is_valid_ipv4 "$ip" || return 1
IFS='.' read -r a b _ _ <<< "$ip"
case "$a" in
10) return 0 ;;
172) (( 10#$b >= 16 && 10#$b <= 31 )) ;;
192) (( 10#$b == 168 )) ;;
100) (( 10#$b >= 64 && 10#$b <= 127 )) ;;
127) [[ "$ip" == "127.0.0.1" ]] ;;
*) return 1 ;;
esac
}
is_allowed_vpn_cidr4() {
local cidr="$1" ip mask a b
is_valid_cidr4 "$cidr" || return 1
ip="${cidr%/*}"
mask="${cidr#*/}"
IFS='.' read -r a b _ _ <<< "$ip"
case "$a" in
10) (( mask >= 8 )) ;;
172) (( 10#$b >= 16 && 10#$b <= 31 && mask >= 12 )) ;;
192) (( 10#$b == 168 && mask >= 16 )) ;;
100) (( 10#$b >= 64 && 10#$b <= 127 && mask >= 10 )) ;;
*) [[ "${YURICH_DNS_ALLOW_PUBLIC_CIDRS:-0}" == "1" && "$mask" -ge 24 ]] ;;
esac
}
normalize_cidr_list() {
local raw="$1" item out="" count=0
local -a cidrs
raw="${raw// /}"
IFS=',' read -ra cidrs <<< "$raw"
for item in "${cidrs[@]}"; do
[[ -z "$item" ]] && continue
if ! is_valid_cidr4 "$item"; then
err "Некорректная VPN CIDR подсеть: $item"
return 1
fi
if ! is_allowed_vpn_cidr4 "$item"; then
err "Небезопасная VPN CIDR: $item. Разрешены private/CGNAT сети; публичные требуют YURICH_DNS_ALLOW_PUBLIC_CIDRS=1 и /24 или уже."
return 1
fi
count=$((count + 1))
if (( count > 32 )); then
err "Слишком много VPN CIDR (максимум 32)"
return 1
fi
out="${out},${item}"
done
if [[ -z "$out" ]]; then
err "Нужна хотя бы одна VPN CIDR подсеть"
return 1
fi
printf '%s\n' "${out#,}"
}
unbound_mode_label() {
echo "Yurich recursive DNSSEC"
}
dns_config_backup() {
local file="$1"
[[ -f "$file" ]] || return 0
cp -a "$file" "${file}.bak.$(date '+%Y%m%d-%H%M%S')" 2>/dev/null || true
}
get_unbound_vpn_bind_ips() {
command -v ip >/dev/null 2>&1 || return 0
ip -o -4 addr show up 2>/dev/null \
| awk '{split($4, a, "/"); if (a[1] != "" && a[1] !~ /^127\./ && a[1] !~ /^169\.254\./) print a[1]}' \
| sort -u
}
ip_is_on_server() {
local ip_addr="$1"
[[ "$ip_addr" == "127.0.0.1" ]] && return 0
get_unbound_vpn_bind_ips | grep -Fxq "$ip_addr"
}
ensure_managed_dns_gateway() {
local gateway_ip="$1"
local ip_bin
is_valid_ipv4 "$gateway_ip" || return 1
ip_bin=$(command -v ip || echo "/usr/sbin/ip")
cat > "$DNS_GATEWAY_SERVICE" <$(hostname)
🌐 Домен: ${DOMAIN:-unknown}
🔕 Антиспам: повтор ${issue_count}, cooldown ${alert_cooldown_minutes} мин.
🕐 $(date '+%Y-%m-%d %H:%M:%S')
DNS monitor failed=${failed}
${safe_fail_details}
filter=${status:-unknown} count=${count:-0} updated=${updated_at:-unknown}
${message:-}"
else
info "DNS alert suppressed: repeat=${issue_count}/${alert_repeat}, cooldown=${alert_cooldown_minutes}m"
fi
return 1
fi
if [[ -s "$alert_state" && "$recovery_alert" == "1" ]]; then
state_line=$(head -n1 "$alert_state" 2>/dev/null || true)
IFS='|' read -r state_a state_b state_c state_d <<< "$state_line" || true
prev_sent=0
[[ "$state_a" == "DNSMON1" ]] && prev_sent="$state_c"
is_canonical_uint_in_range "$prev_sent" 0 9999999999 || prev_sent=0
if (( prev_sent > 0 )); then
tg_send "✅ Yurich DNS monitor восстановлен
📡 Сервер: $(hostname)
🌐 Домен: ${DOMAIN:-unknown}
🕐 $(date '+%Y-%m-%d %H:%M:%S')
DNS, DNSSEC и security filter снова проходят проверку." fi fi rm -f "$alert_state" 2>/dev/null || true } cmd_dns_monitor_install() { load_config normalize_monitor_noise_settings save_config cat > "$DNS_FILTER_MONITOR_CRON" <
$(hostname)
🔒 Режим: recursive DNSSEC, gateway=${UNBOUND_GATEWAY_IP:-127.0.0.1}, VPN=${UNBOUND_VPN_ENABLED:-0}
🕐 $(date '+%Y-%m-%d %H:%M:%S')"
}
cmd_dns_restart() {
load_config
hr
echo -e "${BOLD} [DNS] Restart DNS (Unbound)${RESET}"
hr
if ! command -v unbound &>/dev/null; then
err "unbound не установлен"
return 1
fi
if [[ "${UNBOUND_VPN_ENABLED:-0}" == "1" && "${UNBOUND_MANAGED_GATEWAY:-0}" == "1" && -n "${UNBOUND_GATEWAY_IP:-}" ]]; then
ensure_managed_dns_gateway "$UNBOUND_GATEWAY_IP" || return 1
fi
write_unbound_config
restart_unbound_checked || return 1
ok "DNS (Unbound) перезапущен"
}
# Статус и тест DNS (Unbound)
cmd_dns_status() {
load_config
hr
echo -e "${BOLD} [DNS] Yurich DNS (Unbound)${RESET}"
hr
if ! command -v unbound &>/dev/null; then
warn "unbound не установлен"
return
fi
if systemctl is-active unbound &>/dev/null; then
ok "unbound: запущен"
else
err "unbound: остановлен"
fi
echo -e " Режим: ${CYAN}$(unbound_mode_label)${RESET}"
echo -e " Local DNS: ${CYAN}127.0.0.1:53${RESET}"
if [[ "${UNBOUND_VPN_ENABLED:-0}" == "1" ]]; then
echo -e " VPN DNS: ${CYAN}${UNBOUND_GATEWAY_IP:-не задан}:53${RESET} только для ${CYAN}${UNBOUND_VPN_CIDRS:-$DNS_DEFAULT_VPN_CIDRS}${RESET}"
echo -e " Gateway mode: ${CYAN}$([[ "${UNBOUND_MANAGED_GATEWAY:-0}" == "1" ]] && echo "auto lo /32" || echo "server interface")${RESET}"
else
echo -e " VPN DNS: ${YELLOW}выключен${RESET}"
fi
if [[ "${UNBOUND_FILTER_ENABLED:-1}" == "1" ]]; then
local filter_status filter_count filter_updated
filter_status=$(dns_filter_state_value STATUS 2>/dev/null || echo "unknown")
filter_count=$(dns_filter_state_value COUNT 2>/dev/null || echo "0")
filter_updated=$(dns_filter_state_value UPDATED_AT 2>/dev/null || echo "unknown")
echo -e " Security filter: ${CYAN}${filter_status}${RESET}, доменов: ${CYAN}${filter_count}${RESET}, обновлено: ${CYAN}${filter_updated}${RESET}"
else
echo -e " Security filter: ${YELLOW}выключен${RESET}"
fi
[[ -f "$DNS_CONF" ]] && unbound-checkconf "$DNS_CONF" >/dev/null 2>&1 && ok "Конфиг Unbound валиден" || warn "Конфиг Unbound не прошёл проверку"
if unbound-checkconf -o serve-expired "$DNS_CONF" 2>/dev/null | grep -qi '^yes$'; then
ok "Serve-expired включён для устойчивости DNS"
else
warn "Serve-expired не включён"
fi
echo
info "Порт 53:"
port53_listeners || true
echo
info "Тест DNS-запросов..."
local ok_domains=("google.com" "cloudflare.com")
for domain in "${ok_domains[@]}"; do
local result
result=$(dig "@127.0.0.1" "${domain}" +short +time=3 +tries=1 2>/dev/null | head -1)
if [[ -n "${result}" ]]; then
echo -e " ${GREEN}[OK] ${domain} → ${result}${RESET}"
else
echo -e " ${RED}[FAIL] ${domain} — не резолвится!${RESET}"
fi
done
echo
info "DNSSEC test..."
if dig "@127.0.0.1" sigok.verteiltesysteme.net A +time=4 +tries=1 2>/dev/null | grep -q "status: NOERROR"; then
echo -e " ${GREEN}[OK] DNSSEC valid domain: OK${RESET}"
else
echo -e " ${YELLOW}[WARN] DNSSEC valid test не дал NOERROR${RESET}"
fi
if dig "@127.0.0.1" dnssec-failed.org A +time=4 +tries=1 2>/dev/null | grep -q "status: SERVFAIL"; then
echo -e " ${GREEN}[OK] DNSSEC invalid domain отклонён${RESET}"
else
echo -e " ${YELLOW}[WARN] DNSSEC invalid test не подтвердил SERVFAIL${RESET}"
fi
echo
info "Последние логи Unbound:"
journalctl -u unbound -n 20 --no-pager 2>/dev/null || true
hr
}
cmd_dns_set_mode() {
load_config
hr
echo -e "${BOLD} [DNS] DNS (Unbound) mode${RESET}"
hr
warn "Forward/adblock режимы не используются. DNS работает как recursive resolver, security-фильтр включается отдельно."
UNBOUND_MODE="recursive"
UNBOUND_ADBLOCK="0"
UNBOUND_ENABLED="1"
save_config
if command -v unbound &>/dev/null; then
write_unbound_config
restart_unbound_checked || return 1
ok "Режим применён: $(unbound_mode_label)"
else
info "Unbound ещё не установлен. Запусти меню 17 → 1."
fi
}
cmd_dns_vpn_access() {
load_config
local old_unbound_vpn_cidrs="${UNBOUND_VPN_CIDRS:-}"
local old_unbound_gateway="${UNBOUND_GATEWAY_IP:-}"
local old_unbound_managed="${UNBOUND_MANAGED_GATEWAY:-0}"
hr
echo -e "${BOLD} 🔐 DNS доступ для VPN-клиентов${RESET}"
hr
echo -e " Сейчас: VPN=${CYAN}${UNBOUND_VPN_ENABLED:-0}${RESET}, gateway=${CYAN}${UNBOUND_GATEWAY_IP:-нет}${RESET}, CIDR=${CYAN}${UNBOUND_VPN_CIDRS:-нет}${RESET}"
echo
warn "Не включай DNS для 0.0.0.0/0. Скрипт откажется делать open resolver."
echo -e " ${BOLD}1)${RESET} Включить / изменить VPN DNS"
echo -e " ${BOLD}2)${RESET} Выключить VPN DNS"
echo -e " ${BOLD}0)${RESET} Назад"
echo -ne "${CYAN}Выбор: ${RESET}"
read -r choice
case "$choice" in
1)
local cidrs gateway_input detected_gateway
detected_gateway=$(detect_private_dns_gateway || true)
echo -ne "${CYAN}VPN gateway IP [${UNBOUND_GATEWAY_IP:-${detected_gateway:-$DNS_DEFAULT_GATEWAY_IP}}]: ${RESET}"
read -r gateway_input
gateway_input="${gateway_input:-${UNBOUND_GATEWAY_IP:-${detected_gateway:-$DNS_DEFAULT_GATEWAY_IP}}}"
if ! is_valid_ipv4 "$gateway_input"; then
err "Некорректный IPv4: $gateway_input"
return 1
fi
if [[ "$old_unbound_managed" == "1" && -n "$old_unbound_gateway" && "$old_unbound_gateway" != "$gateway_input" ]]; then
remove_managed_dns_gateway
fi
prepare_unbound_gateway_ip "$gateway_input" || return 1
echo -ne "${CYAN}VPN CIDR через запятую [${UNBOUND_VPN_CIDRS:-$DNS_DEFAULT_VPN_CIDRS}]: ${RESET}"
read -r cidrs
UNBOUND_VPN_CIDRS=$(normalize_cidr_list "${cidrs:-${UNBOUND_VPN_CIDRS:-$DNS_DEFAULT_VPN_CIDRS}}") || return 1
if [[ "$UNBOUND_VPN_CIDRS" == *"0.0.0.0/0"* ]]; then
err "Open resolver запрещён: 0.0.0.0/0 использовать нельзя"
return 1
fi
UNBOUND_GATEWAY_IP="$gateway_input"
UNBOUND_VPN_ENABLED="1"
;;
2)
UNBOUND_VPN_ENABLED="0"
UNBOUND_GATEWAY_IP=""
UNBOUND_MANAGED_GATEWAY="0"
remove_unbound_ufw_rules "$old_unbound_vpn_cidrs"
[[ "$old_unbound_managed" == "1" ]] && remove_managed_dns_gateway
;;
0) return 0 ;;
*) err "Неверный выбор"; return 1 ;;
esac
UNBOUND_MODE="recursive"
UNBOUND_ADBLOCK="0"
write_unbound_config
restart_unbound_checked || return 1
remove_unbound_ufw_rules "$old_unbound_vpn_cidrs"
apply_unbound_ufw_rules
save_config
[[ "$old_unbound_gateway" != "${UNBOUND_GATEWAY_IP:-}" ]] && info "Gateway изменён: ${old_unbound_gateway:-нет} → ${UNBOUND_GATEWAY_IP:-нет}"
ok "VPN DNS настройки применены"
}
# Совместимость со старым пунктом whitelist.
cmd_dns_whitelist() {
hr
echo -e "${BOLD} [DNS] Allowlist security filter${RESET}"
hr
ensure_dns_allowlist_file
echo -e "Файл allowlist: ${CYAN}${DNS_ALLOWLIST_FILE}${RESET}"
echo -e "${DIM}Добавь домен по одному на строку, затем запусти: sudo yurich-panel.sh dns-update${RESET}"
sed -n '1,80p' "$DNS_ALLOWLIST_FILE" 2>/dev/null || true
}
# Удалить DNS (Unbound)
cmd_dns_remove() {
echo -ne "${YELLOW}Удалить DNS (Unbound) конфиг и команды? [y/N]: ${RESET}"
read -r ans
[[ "${ans,,}" != "y" ]] && return
systemctl stop unbound 2>/dev/null || true
systemctl disable unbound 2>/dev/null || true
remove_unbound_ufw_rules
[[ "${UNBOUND_MANAGED_GATEWAY:-0}" == "1" || -f "$DNS_GATEWAY_SERVICE" ]] && remove_managed_dns_gateway
cleanup_legacy_dns_files
dns_config_backup "$DNS_CONF"
dns_config_backup "$DNS_BLOCKLIST_CONF"
rm -f "$DNS_CONF" "$DNS_BLOCKLIST_CONF" "$DNS_LEGACY_OLD_DNS_CONF"
rm -f "$DNS_FILTER_CRON" "$DNS_FILTER_MONITOR_CRON" "$DNS_FILTER_STATE_FILE" 2>/dev/null || true
rm -f /usr/local/bin/yurich-dns-status /usr/local/bin/yurich-dns-test /usr/local/bin/yurich-dns-restart 2>/dev/null || true
rm -f /usr/local/bin/aurum-dns-status /usr/local/bin/aurum-dns-test /usr/local/bin/aurum-dns-restart 2>/dev/null || true
if [[ -f "$DNS_RESOLVED_NO_STUB" ]]; then
dns_config_backup "$DNS_RESOLVED_NO_STUB"
rm -f "$DNS_RESOLVED_NO_STUB"
systemctl restart systemd-resolved 2>/dev/null || true
fi
UNBOUND_ENABLED="0"
UNBOUND_GATEWAY_IP=""
UNBOUND_MANAGED_GATEWAY="0"
UNBOUND_VPN_ENABLED="0"
UNBOUND_ADBLOCK="0"
UNBOUND_FILTER_ENABLED="0"
save_config
systemctl daemon-reload 2>/dev/null || true
ok "Yurich DNS (Unbound) удалён. Пакеты unbound/dnsutils не удалял."
}
# ─── Донат ─────────────────────────────────────────────────────
cmd_donate() {
local support_url="${PROJECT_DONATION_URL:-$PROJECT_GITHUB_URL}"
clear 2>/dev/null || true
echo
echo -e "${BOLD}${GOLD} ╔════════════════════════════════════════════╗${RESET}"
echo -e "${BOLD}${GOLD} ║ ПОДДЕРЖАТЬ ПРОЕКТ ║${RESET}"
echo -e "${BOLD}${GOLD} ╚════════════════════════════════════════════╝${RESET}"
echo
echo -e " ${CYAN}Если Yurich Panel помог тебе —${RESET}"
echo -e " ${CYAN}поддержи разработку! Это очень мотивирует.${RESET}"
echo
if [[ -n "${PROJECT_DONATION_URL:-}" ]]; then
echo -e " ${BOLD}Ссылка на поддержку:${RESET}"
echo -e " ${BOLD}${GOLD}👉 ${PROJECT_DONATION_URL}${RESET}"
else
echo -e " ${BOLD}Поддержать проект можно через GitHub:${RESET}"
echo -e " ${BOLD}${GOLD}👉 ${PROJECT_GITHUB_URL}${RESET}"
fi
echo
echo -e " ${DIM}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}"
echo -e " ${BOLD}Что даст твой донат:${RESET}"
echo -e " ${GREEN}-${RESET} Больше времени на разработку"
echo -e " ${GREEN}🐛${RESET} Быстрые фиксы багов"
echo -e " ${GREEN}✨${RESET} Новые фичи каждый месяц"
echo -e " ${GREEN}📚${RESET} Документация и поддержка"
echo -e " ${GREEN}🆕${RESET} Эксклюзив для донатеров в Telegram"
echo -e " ${DIM}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}"
echo
echo -e " ${BOLD}Другие способы поддержки:${RESET}"
echo -e " ${CYAN}⭐${RESET} Поставь звезду: ${PROJECT_GITHUB_SHORT}"
[[ -n "${TELEGRAM_COMMUNITY_URL:-}" ]] && echo -e " ${CYAN}[TG]${RESET} Telegram канал: ${TELEGRAM_COMMUNITY_URL}"
[[ -n "${PROJECT_WEBSITE_URL:-}" ]] && echo -e " ${CYAN}[WEB]${RESET} Сайт: ${PROJECT_WEBSITE_URL}"
echo -e " ${CYAN}📢${RESET} Расскажи друзьям!"
echo
echo -e " ${BOLD}${GOLD}Спасибо за поддержку! 🙏${RESET}"
echo
if command -v qrencode &>/dev/null; then
echo -e " ${DIM}QR код:${RESET}"
qrencode -t ANSIUTF8 "$support_url" 2>/dev/null | sed 's/^/ /'
echo
fi
echo -ne " ${YELLOW}Enter для возврата в меню...${RESET}"
read -r
}
# Меню DNS (Unbound)
cmd_dns_menu() {
while true; do
load_config
hr
echo -e "${BOLD} [DNS] Yurich DNS (Unbound)${RESET}"
hr
local dns_status="${RED}не установлен${RESET}"
if command -v unbound &>/dev/null; then
dns_status="${YELLOW}установлен, не запущен${RESET}"
systemctl is-active --quiet unbound 2>/dev/null && dns_status="${GREEN}активен${RESET}"
fi
echo -e " Статус: ${dns_status}"
echo -e " Режим: ${CYAN}$(unbound_mode_label)${RESET}"
echo -e " VPN DNS: ${CYAN}${UNBOUND_VPN_ENABLED:-0}${RESET} | Gateway: ${CYAN}${UNBOUND_GATEWAY_IP:-нет}${RESET} | CIDR: ${CYAN}${UNBOUND_VPN_CIDRS:-$DNS_DEFAULT_VPN_CIDRS}${RESET}"
echo -e " Security filter: ${CYAN}${UNBOUND_FILTER_ENABLED:-1}${RESET} | Domains: ${CYAN}$(dns_filter_state_value COUNT 2>/dev/null || echo 0)${RESET}"
[[ "${UNBOUND_MANAGED_GATEWAY:-0}" == "1" ]] && echo -e " Gateway mode: ${CYAN}auto lo /32${RESET}"
echo
echo -e " ${BOLD}1)${RESET} Установить / переустановить DNS (Unbound)"
echo -e " ${BOLD}2)${RESET} Настроить DNS для VPN-клиентов"
echo -e " ${BOLD}3)${RESET} Статус, порт 53, DNSSEC и тесты"
echo -e " ${BOLD}4)${RESET} Перезапустить DNS (Unbound)"
echo -e " ${BOLD}5)${RESET} Обновить security-фильтр"
echo -e " ${BOLD}6)${RESET} Allowlist security-фильтра"
echo -e " ${BOLD}7)${RESET} Включить DNS monitor"
echo -e " ${BOLD}8)${RESET} Проверить open-resolver с внешних node"
echo -e " ${BOLD}9)${RESET} Latency/cache-warm отчёт по локациям"
echo -e " ${BOLD}10)${RESET} Удалить DNS (Unbound)"
echo -e " ${BOLD}0)${RESET} Назад"
hr
echo -ne "${CYAN}Выбор: ${RESET}"
read -r choice
case "${choice}" in
1) cmd_dns_install ;;
2) cmd_dns_vpn_access ;;
3) cmd_dns_status ;;
4) cmd_dns_restart ;;
5) cmd_dns_filter_install ;;
6) cmd_dns_whitelist ;;
7) cmd_dns_monitor_install ;;
8) cmd_dns_open_resolver_check ;;
9) cmd_dns_latency_report ;;
10) cmd_dns_remove ;;
0) break ;;
*) warn "Неверный выбор" ;;
esac
echo -ne "${YELLOW}Enter для продолжения...${RESET}"; read -r
done
}
cmd_unbound_plugin() {
cmd_dns_menu
}
# ─── СТАТУС ──────────────────────────────────────────────────
cmd_status() {
hr
echo -e "${BOLD} Статус Yurich Panel${RESET}"
hr
systemctl is-active --quiet caddy 2>/dev/null \
&& ok "Caddy: ${GREEN}работает${RESET}" \
|| err "Caddy: ${RED}не работает${RESET}"
systemctl is-enabled --quiet caddy 2>/dev/null \
&& ok "Автозапуск: включён" \
|| warn "Автозапуск: выключен"
load_config
[[ -n "${DOMAIN:-}" ]] && echo -e "\n Домен: $DOMAIN"
echo -e " Юзеров: $(get_users | wc -l)"
if [[ -f "$HYSTERIA_CONFIG" || -x "$HYSTERIA_BIN" ]]; then
systemctl is-active --quiet hysteria 2>/dev/null \
&& ok "Hysteria 2: работает на UDP/${HYSTERIA_PORT:-8443}" \
|| warn "Hysteria 2: установлен, но не работает"
fi
if command -v warp-cli &>/dev/null; then
ok "WARP proxy: установлен, порт ${WARP_PROXY_PORT:-$WARP_PROXY_PORT_DEFAULT}"
fi
if [[ -x "$XRAY_BIN" || -f "$XRAY_CONFIG" ]]; then
systemctl is-active --quiet xray 2>/dev/null \
&& ok "Xray: работает (fallback 443: ${XRAY_FALLBACK_ENABLED:-0})" \
|| warn "Xray: установлен, но не работает"
fi
if [[ "${DEVICE_LIMIT_ENABLED:-0}" == "1" ]]; then
ok "Лимит устройств: ${DEVICE_LIMIT:-$DEVICE_LIMIT_DEFAULT} IP / ${DEVICE_WINDOW_HOURS:-$DEVICE_WINDOW_HOURS_DEFAULT} ч (${DEVICE_LIMIT_MODE:-alert})"
else
warn "Лимит устройств: выключен"
fi
if command -v unbound &>/dev/null; then
systemctl is-active --quiet unbound 2>/dev/null \
&& ok "DNS (Unbound): $(unbound_mode_label), gateway=${UNBOUND_GATEWAY_IP:-127.0.0.1}, vpn=${UNBOUND_VPN_ENABLED:-0}" \
|| warn "DNS (Unbound): установлен, но не работает"
fi
check_cert "${DOMAIN:-}"
echo
info "Последние 10 строк лога:"
journalctl -u caddy -n 10 --no-pager 2>/dev/null || true
hr
}
# ─── ПЕРЕЗАПУСК ──────────────────────────────────────────────
cmd_restart() {
info "Перезапускаю Caddy..."
systemctl restart caddy
sleep 2
if systemctl is-active --quiet caddy; then
ok "Caddy перезапущен"
load_config; tg_alert_up
else
err "Caddy не запустился:"
journalctl -u caddy -n 20 --no-pager
fi
}
cmd_reload() {
info "Проверяю Caddyfile перед reload..."
if ! "$CADDY_BIN" validate --config "$CADDYFILE" >/dev/null 2>&1; then
err "Caddyfile содержит ошибку. Reload отменён."
"$CADDY_BIN" validate --config "$CADDYFILE" || true
return 1
fi
"$CADDY_BIN" fmt --overwrite "$CADDYFILE" >/dev/null 2>&1 || true
info "Применяю конфиг без полного перезапуска Caddy..."
if systemctl reload caddy; then
ok "Caddy reload выполнен без разрыва активных соединений"
load_config; tg_alert_up
else
err "Reload не удался. Caddy не перезапускал, смотри лог:"
journalctl -u caddy -n 20 --no-pager
return 1
fi
}
# ─── ОБНОВЛЕНИЕ ──────────────────────────────────────────────
cmd_update() {
hr
echo -e "${BOLD} Обновление Caddy${RESET}"
hr
check_installed || { err "Yurich Panel не установлен"; return 1; }
local old_ver
old_ver=$("$CADDY_BIN" version 2>/dev/null | head -1 || echo "unknown")
info "Текущая версия: $old_ver"
backup_config
local tmp_caddy_dir tmp_caddy backup_bin="" staging_bin="" restore_stage=""
tmp_caddy_dir=$(mktemp -d /tmp/naiveproxy_caddy_XXXXXX)
tmp_caddy="${tmp_caddy_dir}/caddy"
trap 'rm -rf "${tmp_caddy_dir:-}" 2>/dev/null; rm -f "${backup_bin:-}" "${staging_bin:-}" "${restore_stage:-}" 2>/dev/null; trap - RETURN' RETURN
build_caddy "$tmp_caddy" || return 1
if ! "$tmp_caddy" validate --config "$CADDYFILE" >/dev/null 2>&1; then
err "Новый Caddy не принимает текущий Caddyfile. Обновление отменено."
"$tmp_caddy" validate --config "$CADDYFILE" || true
return 1
fi
if ! "$tmp_caddy" list-modules 2>/dev/null | grep -Fxq 'http.handlers.forward_proxy'; then
err "Новый Caddy не содержит forward_proxy. Обновление отменено."
return 1
fi
backup_bin=$(mktemp "${CADDY_BIN}.rollback.XXXXXX") || { err "Не удалось создать rollback-файл Caddy"; return 1; }
if ! cp -p -- "$CADDY_BIN" "$backup_bin"; then
err "Не удалось сохранить текущий бинарник Caddy"
return 1
fi
staging_bin=$(mktemp "${CADDY_BIN}.update.XXXXXX") || { err "Не удалось создать staging-файл Caddy"; return 1; }
if ! install -m 755 "$tmp_caddy" "$staging_bin" || ! mv -f -- "$staging_bin" "$CADDY_BIN"; then
err "Не удалось атомарно заменить Caddy"
return 1
fi
staging_bin=""
if ! systemctl restart caddy \
|| ! timeout 20s bash -c 'until systemctl is-active --quiet caddy; do sleep 1; done'; then
err "Новый Caddy не запустился. Возвращаю предыдущий бинарник."
restore_stage=$(mktemp "${CADDY_BIN}.restore.XXXXXX") || true
if [[ -n "$restore_stage" ]] \
&& install -m 755 "$backup_bin" "$restore_stage" \
&& mv -f -- "$restore_stage" "$CADDY_BIN"; then
restore_stage=""
systemctl restart caddy || true
if systemctl is-active --quiet caddy; then
ok "Rollback Caddy выполнен, рабочая версия восстановлена"
else
err "Rollback-файл возвращён, но Caddy не active. Проверь journalctl -u caddy"
fi
else
err "Автоматический rollback Caddy не удался. Бэкап: $backup_bin"
backup_bin=""
fi
journalctl -u caddy -n 40 --no-pager 2>/dev/null || true
return 1
fi
local new_ver
new_ver=$("$CADDY_BIN" version 2>/dev/null | head -1 || echo "unknown")
rm -f "$backup_bin"
backup_bin=""
ok "Обновлено: $old_ver → $new_ver"
load_config; tg_alert_updated "$old_ver" "$new_ver"
}
# ─── УДАЛЕНИЕ ────────────────────────────────────────────────
cmd_remove() {
hr
echo -e "${BOLD}${RED} Удаление Yurich Panel${RESET}"
hr
echo -ne "${RED}Удалить всё? [y/N]: ${RESET}"
read -r ans
[[ "${ans,,}" == "y" ]] || return
systemctl stop caddy 2>/dev/null || true
systemctl disable caddy 2>/dev/null || true
systemctl stop hysteria 2>/dev/null || true
systemctl disable hysteria 2>/dev/null || true
systemctl stop xray 2>/dev/null || true
systemctl disable xray 2>/dev/null || true
systemctl stop warp-svc cloudflare-warp >/dev/null 2>&1 || true
rm -f "$CADDY_SERVICE" "$CADDY_BIN" "$CADDYFILE" "$HYSTERIA_SERVICE" "$HYSTERIA_BIN" "$HYSTERIA_CONFIG" "$XRAY_SERVICE" "$XRAY_BIN" "$XRAY_CONFIG" "$DEVICE_CRON"
[[ -n "${CONFIG_DIR:-}" && "$CONFIG_DIR" != "/" ]] && rm -rf "$CONFIG_DIR"
systemctl daemon-reload
ufw delete allow 80/tcp >/dev/null 2>&1 || true
ufw delete allow 443/tcp >/dev/null 2>&1 || true
ufw delete allow 443/udp >/dev/null 2>&1 || true
ufw delete allow "${HYSTERIA_PORT:-8443}/udp" >/dev/null 2>&1 || true
ufw delete allow "${XRAY_REALITY_PORT:-8444}/tcp" >/dev/null 2>&1 || true
ufw delete allow "${XRAY_MKCP_PORT:-8446}/udp" >/dev/null 2>&1 || true
ufw delete allow 8447/tcp >/dev/null 2>&1 || true
ufw delete allow "${XRAY_XHTTP_PORT:-8448}/tcp" >/dev/null 2>&1 || true
( crontab -l 2>/dev/null | grep -v "naiveproxy\|monitor\.sh" || true ) | crontab -
ok "Yurich Panel удалён"
}
# ─── ЛОГИ ────────────────────────────────────────────────────
cmd_logs() {
echo -e "${BOLD}Лог Caddy (Ctrl+C для выхода):${RESET}"
journalctl -u caddy -n 50 -f
}
cmd_language() {
load_config 2>/dev/null || true
hr
echo -e "${BOLD} $(t "Язык SSH-панели" "SSH panel language")${RESET}"
hr
echo -e " $(t "Текущий язык" "Current language"): ${CYAN}${LANG_UI:-ru}${RESET}"
echo
echo -e " ${BOLD}1)${RESET} Русский"
echo -e " ${BOLD}2)${RESET} English"
echo -e " ${BOLD}0)${RESET} $(t "Назад" "Back")"
hr
echo -ne "${CYAN}$(t "Выбор" "Choice") [0-2]: ${RESET}"
read -r lang_choice
case "${lang_choice,,}" in
1|ru|rus|russian|русский)
LANG_UI="ru"
save_config
ok "Язык панели: Русский"
;;
2|en|eng|english)
LANG_UI="en"
save_config
ok "Panel language: English"
;;
0|"")
return 0
;;
*)
warn "$(t "Неверный выбор" "Invalid choice")"
return 1
;;
esac
}
# ─── МЕНЮ ────────────────────────────────────────────────────
show_menu() {
clear
load_config
local status_str
status_str="${YELLOW}● $(t "не установлен" "not installed")${RESET}"
if check_installed; then
systemctl is-active --quiet caddy 2>/dev/null \
&& status_str="${GREEN}● $(t "работает" "running")${RESET}" \
|| status_str="${RED}● $(t "остановлен" "stopped")${RESET}"
fi
local tg_str
tg_str="${RED}$(t "не настроен" "not configured")${RESET}"
[[ -n "${TG_TOKEN:-}" ]] && tg_str="${GREEN}$(t "подключён" "connected")${RESET}"
hr
echo -e "${BOLD}${CYAN} Yurich Panel v${VERSION}${RESET} ${DIM}[$(t "РУС" "ENG")]${RESET}"
echo -e " $(t "Статус" "Status"): ${status_str} | $(t "Домен" "Domain"): ${CYAN}${DOMAIN:-$(t "не задан" "not set")}${RESET}"
local ssh_str
ssh_str="${YELLOW}$(t "не настроен" "not configured")${RESET}"
[[ -f "$SSH_HARDENING_DONE" ]] && ssh_str="${GREEN}$(grep SSH_PORT "$SSH_HARDENING_DONE" 2>/dev/null | cut -d= -f2)${RESET}"
echo -e " Telegram: ${tg_str} | $(t "Юзеров" "Users"): $(get_users | wc -l) | $(t "SSH порт" "SSH port"): ${ssh_str}"
local hysteria_str
hysteria_str="${YELLOW}$(t "не установлен" "not installed")${RESET}"
if [[ -f "$HYSTERIA_CONFIG" || -x "$HYSTERIA_BIN" ]]; then
systemctl is-active --quiet hysteria 2>/dev/null \
&& hysteria_str="${GREEN}UDP/${HYSTERIA_PORT:-8443}${RESET}" \
|| hysteria_str="${RED}$(t "остановлен" "stopped")${RESET}"
fi
echo -e " Hysteria 2: ${hysteria_str}"
local warp_str
warp_str="${YELLOW}$(t "не установлен" "not installed")${RESET}"
if command -v warp-cli &>/dev/null; then
case "${WARP_MODE:-off}" in
proxy) warp_str="${GREEN}proxy 127.0.0.1:${WARP_PROXY_PORT:-$WARP_PROXY_PORT_DEFAULT}${RESET}" ;;
warp|warp+doh) warp_str="${GREEN}full ${WARP_MODE}${RESET}" ;;
*) warp_str="${YELLOW}$(t "установлен" "installed")${RESET}" ;;
esac
fi
echo -e " WARP: ${warp_str}"
local xray_str
xray_str="${YELLOW}$(t "не установлен" "not installed")${RESET}"
if [[ -x "$XRAY_BIN" || -f "$XRAY_CONFIG" ]]; then
systemctl is-active --quiet xray 2>/dev/null \
&& xray_str="${GREEN}active${RESET}" \
|| xray_str="${RED}$(t "остановлен" "stopped")${RESET}"
[[ "${XRAY_FALLBACK_ENABLED:-0}" == "1" ]] && xray_str="${xray_str} ${CYAN}443-fallback${RESET}"
fi
echo -e " Xray Modern: ${xray_str}"
local unbound_str
unbound_str="${YELLOW}$(t "не установлен" "not installed")${RESET}"
if command -v unbound &>/dev/null; then
if systemctl is-active --quiet unbound 2>/dev/null; then
unbound_str="${GREEN}active${RESET} ${CYAN}${UNBOUND_GATEWAY_IP:-127.0.0.1}${RESET}"
else
unbound_str="${RED}$(t "остановлен" "stopped")${RESET}"
fi
fi
echo -e " DNS (Unbound): ${unbound_str}"
local device_str
device_str="${YELLOW}$(t "выкл" "off")${RESET}"
if [[ "${DEVICE_LIMIT_ENABLED:-0}" == "1" ]]; then
device_str="${GREEN}${DEVICE_LIMIT:-$DEVICE_LIMIT_DEFAULT}/${DEVICE_WINDOW_HOURS:-$DEVICE_WINDOW_HOURS_DEFAULT}ч ${DEVICE_LIMIT_MODE:-alert}${RESET}"
fi
echo -e " $(t "Лимит устройств" "Device limit"): ${device_str}"
local nodes_str="${YELLOW}0${RESET}"
if [[ -f "$NODES_FILE" ]]; then
nodes_str="${GREEN}$(nodes_count)${RESET}"
fi
echo -e " Multi-server nodes: ${nodes_str}"
echo -e " Режим 443: ${GREEN}$(edge_routing_mode_label)${RESET}"
local credential_str
if [[ "$(credential_plaintext_count)" -eq 0 && -s "$CREDENTIALS_PRIVATE_KEY" ]]; then
credential_str="${GREEN}bcrypt + encrypted vault${RESET}"
elif [[ "$(credential_plaintext_count)" -gt 0 ]]; then
credential_str="${YELLOW}legacy, нужна миграция${RESET}"
else
credential_str="${YELLOW}будет создан при первом пользователе${RESET}"
fi
echo -e " Credentials: ${credential_str}"
hr
echo -e " ${BOLD}1)${RESET} $(t "Установить Yurich Panel" "Install Yurich Panel")"
echo -e " ${BOLD}2)${RESET} $(t "Статус" "Status")"
echo -e " ${BOLD}3)${RESET} $(t "Клиентский конфиг" "Client config")"
echo -e " ${BOLD}4)${RESET} $(t "Управление пользователями" "User management")"
echo -e " ${BOLD}5)${RESET} [DOM] $(t "Управление доменами" "Domain management")"
echo -e " ${BOLD}6)${RESET} $(t "Мониторинг и статистика" "Monitoring and stats")"
echo -e " ${BOLD}7)${RESET} $(t "Настройка Telegram + Бот" "Telegram + Bot setup")"
echo -e " ${BOLD}8)${RESET} $(t "Перезапустить Caddy" "Restart Caddy")"
echo -e " ${BOLD}9)${RESET} $(t "Обновить Caddy" "Update Caddy")"
echo -e " ${BOLD}10)${RESET} $(t "Логи" "Logs")"
echo -e " ${BOLD}11)${RESET} $(t "Удалить Yurich Panel" "Remove Yurich Panel")"
echo -e " ${BOLD}16)${RESET} [DIAG] $(t "Диагностика системы" "System diagnostics")"
echo -e " ${BOLD}17)${RESET} [DNS] Yurich DNS (Unbound)"
echo -e " ${BOLD}18)${RESET} [DONATE] $(t "Поддержать проект (донат)" "Support project (donation)")"
echo -e " ──────────────────────────"
echo -e " ${BOLD}12)${RESET} [SSH] SSH Hardening"
echo -e " ${BOLD}13)${RESET} [SYS] $(t "Обновить систему" "Update system")"
echo -e " ${BOLD}14)${RESET} [UPD] $(t "Обновить скрипт" "Update script")"
echo -e " ${BOLD}15)${RESET} [CAMO] $(t "Обновить камуфляж" "Update camouflage")"
echo -e " ${BOLD}19)${RESET} [RLD] $(t "Reload Caddy без разрыва" "Reload Caddy without restart")"
echo -e " ${BOLD}20)${RESET} [HY2] Hysteria 2 ($(t "UDP порт на выбор" "custom UDP port"))"
echo -e " ${BOLD}21)${RESET} [WARP] WARP modes (proxy/full tunnel)"
echo -e " ${BOLD}22)${RESET} [DEV] $(t "Лимит устройств / анти-шаринг" "Device limit / anti-sharing")"
echo -e " ${BOLD}23)${RESET} [XRAY] Xray VLESS/Trojan/REALITY fallback"
echo -e " ${BOLD}24)${RESET} [FIX] Diagnose --fix"
echo -e " ${BOLD}25)${RESET} [SUB] $(t "Страница подписки пользователя" "User subscription page")"
echo -e " ${BOLD}26)${RESET} [PAGE] $(t "Личная фейковая страница" "Private camouflage page")"
echo -e " ${BOLD}27)${RESET} [PROD] Production tools / Bridge"
echo -e " ${BOLD}28)${RESET} [LANG] $(t "Язык панели RU/EN" "Panel language RU/EN")"
echo -e " ${BOLD}29)${RESET} [NODES] Multi-server management"
echo -e " ${BOLD}30)${RESET} [EDGE] Routing mode / HAProxy"
echo -e " ${BOLD}31)${RESET} [SALES] VPN sales Telegram bot"
echo -e " ${BOLD}0)${RESET} $(t "Выход" "Exit")"
hr
echo -ne "${CYAN}$(t "Выбор" "Choice") [0-31]: ${RESET}"
}
# ─── MAIN ────────────────────────────────────────────────────
main() {
if [[ $# -gt 0 ]]; then
case "$1" in
version|--version|-v)
echo "Yurich Panel v${VERSION}"
[[ -n "${TELEGRAM_COMMUNITY_URL:-}" ]] && echo "Telegram: ${TELEGRAM_COMMUNITY_URL}"
[[ -n "${PROJECT_WEBSITE_URL:-}" ]] && echo "Website: ${PROJECT_WEBSITE_URL}"
echo "GitHub: ${PROJECT_GITHUB_SHORT}"
return 0
;;
help|--help|-h)
echo "Yurich Panel v${VERSION}"
echo "Usage: sudo bash yurich-panel.sh [command]"
echo "Commands: install status config [user] reload restart update remove logs monitor credentials-status credentials-migrate routing-mode haproxy-status haproxy-apply haproxy-logs haproxy-tg users users-list-machine hysteria hy2 hysteria-sync hysteria-repair hysteria-port hysteria-warp-enable hysteria-warp-disable hysteria-hop-enable hysteria-hop-disable warp warp-proxy warp-full warp-health warp-protocol warp-ssh-allow xray xray-target xray-add-user [user] xray-rebuild vless-tune egress-ipv4 egress-dualstack pingtunnel-install pingtunnel-status pingtunnel-config pingtunnel-rotate pingtunnel-remove xray-zapret devices subscription subscription-clean private-page protocol-health protocol-validate protocol-benchmark protocol-benchmark-monitor protocol-benchmark-install protocol-benchmark-history protocol-stability-report protocol-monitor protocol-monitor-install security-audit notify-expiry-list notify-bind-tg notify-expiry-run notify-news notify-news-test expiry-enforce notify-expiry-install tg-stats bot-menu health safe-apply backup export import bridge nodes node-subscription-export fail2ban language ssh-hardening ssh-rescue sysupdate cert domains dns unbound yurich-dns yurich-dns-status yurich-dns-restart dns-open-check dns-latency-report self-update version camouflage"
return 0
;;
esac
fi
check_root
check_os
run_startup_migrations || true
if [[ $# -gt 0 ]]; then
load_config; load_users
case "$1" in
install) cmd_install ;;
status) cmd_status ;;
config) print_client_config "${2:-}" ;;
reload) cmd_reload ;;
restart) cmd_restart ;;
update) cmd_update ;;
remove) cmd_remove ;;
logs) cmd_logs ;;
monitor) cmd_monitor ;;
routing-mode|edge-mode|frontend-mode) cmd_edge_routing_mode "${2:-}" ;;
haproxy-status|haproxy) cmd_haproxy_status ;;
haproxy-apply|haproxy-sni-apply) cmd_haproxy_apply ;;
haproxy-logs|sni-logs) cmd_haproxy_logs ;;
haproxy-tg|haproxy-telegram) cmd_haproxy_tg ;;
users) cmd_users ;;
users-list-machine) cmd_users_list_machine ;;
credentials-status|credential-status) cmd_credentials_status ;;
credentials-migrate|credential-migrate) cmd_credentials_migrate ;;
hysteria|hy2) cmd_hysteria_menu ;;
hysteria-install|hy2-install) cmd_hysteria_install ;;
hysteria-config|hy2-config) print_hysteria_client_config "${2:-}" ;;
hysteria-status|hy2-status) cmd_hysteria_status ;;
hysteria-repair|hy2-repair) cmd_hysteria_repair ;;
hysteria-logs|hy2-logs) cmd_hysteria_logs ;;
hysteria-sync|hy2-sync) cmd_hysteria_sync_cli ;;
hysteria-port|hy2-port) cmd_hysteria_change_port "${2:-}" ;;
hysteria-warp-enable|hy2-warp-enable|turbo-warp-enable) cmd_hysteria_warp_enable ;;
hysteria-warp-disable|hy2-warp-disable|turbo-warp-disable) cmd_hysteria_warp_disable ;;
hysteria-hop-enable|hy2-hop-enable) cmd_hysteria_hop_enable "${2:-}" ;;
hysteria-hop-disable|hy2-hop-disable) cmd_hysteria_hop_disable ;;
hysteria-remove|hy2-remove) cmd_hysteria_remove ;;
warp) cmd_warp_menu ;;
warp-install|warp-proxy) cmd_warp_install ;;
warp-full|warp-full-install) cmd_warp_full_install ;;
warp-config) print_warp_proxy_config ;;
warp-status) cmd_warp_status ;;
warp-test) cmd_warp_test ;;
warp-full-test) cmd_warp_test_full ;;
warp-health) cmd_warp_health ;;
warp-protocol) cmd_warp_protocol ;;
warp-ssh-allow|warp-ssh|warp-allow) cmd_warp_ssh_allow ;;
warp-logs) cmd_warp_logs ;;
warp-disable) cmd_warp_disable ;;
warp-remove) cmd_warp_remove ;;
xray) cmd_xray_menu ;;
xray-install) cmd_xray_install ;;
xray-target|xray-reality-target) cmd_xray_reality_target ;;
xray-add-user|xray-user) cmd_xray_add_user "${2:-}" "${3:-}" ;;
xray-compat-user|xray-reality-compat) cmd_xray_add_compat_user "${2:-}" ;;
xray-rebuild) cmd_xray_rebuild ;;
vless-tune|xray-tune|reality-tune) cmd_vless_tune ;;
egress-ipv4|egress-prefer-ipv4|location-ipv4) cmd_egress_prefer_ipv4 ;;
egress-dualstack|egress-ipv6-restore|location-dualstack) cmd_egress_dualstack ;;
pingtunnel-install|icmp-install) cmd_pingtunnel_install ;;
pingtunnel-status|icmp-status) cmd_pingtunnel_status ;;
pingtunnel-config|icmp-config) cmd_pingtunnel_config "${2:-}" ;;
pingtunnel-rotate|icmp-rotate) cmd_pingtunnel_rotate ;;
pingtunnel-remove|icmp-remove) cmd_pingtunnel_remove ;;
xray-zapret) cmd_xray_zapret "${2:-enable}" ;;
xray-config) print_xray_client_config "${2:-}" ;;
xray-status) cmd_xray_status ;;
xray-logs) cmd_xray_logs ;;
xray-remove) cmd_xray_remove ;;
devices) cmd_devices_menu ;;
devices-scan) cmd_devices_scan ;;
devices-config) cmd_devices_config ;;
devices-disable) cmd_devices_disable ;;
devices-lock) device_disable_user "${2:-}" ;;
devices-unlock) device_enable_user "${2:-}" ;;
devices-unlock-all) cmd_devices_unlock_all ;;
subscription|sub) cmd_subscription_user "${2:-}" ;;
subscription-reset|sub-reset) cmd_subscription_reset "${2:-}" ;;
subscription-clean|subscriptions-clean|subscription-rebuild-clean) cmd_subscription_rebuild_clean "${2:-}" ;;
protocol-validate|protocols-validate) cmd_protocol_validate ;;
protocol-benchmark|protocols-benchmark|benchmark) cmd_protocol_benchmark "${2:-}" "${3:-1}" ;;
protocol-benchmark-monitor|protocols-benchmark-monitor|benchmark-monitor) cmd_protocol_benchmark_monitor "${2:-}" "${3:-}" ;;
protocol-benchmark-install|protocols-benchmark-install|benchmark-install) cmd_protocol_benchmark_install "${2:-}" "${3:-}" ;;
protocol-benchmark-history|protocols-benchmark-history|benchmark-history) cmd_protocol_benchmark_history "${2:-30}" ;;
protocol-stability-report|stability-report) cmd_protocol_stability_report "${2:-24}" ;;
protocol-health|protocols-health) cmd_protocol_health ;;
protocol-monitor|protocols-monitor) cmd_protocol_monitor ;;
protocol-monitor-install|protocols-monitor-install) cmd_protocol_monitor_install ;;
private-page) install_private_camouflage_page "${2:-}" ;;
notify-bind-tg|bind-tg) cmd_notify_bind_tg "${2:-}" "${3:-}" ;;
notify-unbind-tg|unbind-tg) cmd_notify_unbind_tg "${2:-}" ;;
notify-expiry-list|notify-list|expiring) cmd_notify_expiry_list ;;
notify-expiry-run|notify-run) cmd_notify_expiry_run ;;
expiry-enforce|notify-expiry-enforce) cmd_enforce_expired_users ;;
notify-expiry-test|notify-test|test-notify) cmd_notify_expiry_test "${2:-}" ;;
notify-news-test|news-test|broadcast-test) shift; cmd_notify_news_test "$*" ;;
notify-news|news|broadcast) shift; cmd_notify_news_broadcast "$*" ;;
notify-expiry-install|notify-install) cmd_notify_expiry_install ;;
tg-stats) tg_send_stats; ok "Отправлено" ;;
security-audit|audit-security) cmd_security_audit ;;
ssh-hardening) cmd_ssh_hardening ;;
ssh-rescue) cmd_ssh_rescue ;;
sysupdate) cmd_sysupdate ;;
cert) load_config; check_cert "${DOMAIN:-}" ;;
domains) load_config; cmd_domains ;;
qr) load_config; print_client_config ;;
ssh-key) cat "${CONFIG_DIR}/ssh_private_key" 2>/dev/null || err "Ключ не найден: ${CONFIG_DIR}/ssh_private_key" ;;
diagnose) cmd_diagnose "${2:-}" ;;
dns|unbound|yurich-dns|aurum-dns) cmd_unbound_plugin ;;
dns-install|unbound-install|yurich-dns-install|aurum-dns-install) cmd_dns_install ;;
dns-mode|unbound-mode) cmd_dns_set_mode ;;
dns-vpn|unbound-vpn|yurich-dns-vpn|aurum-dns-vpn) cmd_dns_vpn_access ;;
dns-update|unbound-update) cmd_dns_update ;;
dns-filter-install|unbound-filter-install) cmd_dns_filter_install ;;
dns-monitor|unbound-monitor) cmd_dns_monitor ;;
dns-monitor-install|unbound-monitor-install) cmd_dns_monitor_install ;;
dns-open-check|dns-external-check|unbound-open-check) cmd_dns_open_resolver_check "${2:-}" ;;
dns-latency-report|dns-latency|unbound-latency) cmd_dns_latency_report ;;
dns-latency-local) cmd_dns_latency_local "${2:-local}" "${3:-127.0.0.1}" ;;
dns-allowlist|unbound-allowlist|dns-whitelist|unbound-whitelist) cmd_dns_whitelist ;;
dns-status|unbound-status|unbound-test|yurich-dns-status|yurich-dns-test|aurum-dns-status|aurum-dns-test) cmd_dns_status ;;
dns-restart|unbound-restart|yurich-dns-restart|aurum-dns-restart) cmd_dns_restart ;;
dns-remove|unbound-remove|yurich-dns-remove|aurum-dns-remove) cmd_dns_remove ;;
bot) load_config; cmd_bot ;;
bot-install) load_config; install_bot_service ;;
bot-menu) load_config; tg_apply_bot_menu ;;
sales-bot) load_config; cmd_sales_bot ;;
sales-bot-install|sales-install) load_config; install_sales_bot_service "${2:-}" "${3:-}" ;;
sales-bot-menu|sales-menu) load_config; sales_apply_bot_menu ;;
sales-bot-defaults|sales-defaults|sales-config) load_config; cmd_sales_bot_apply_defaults ;;
sales-orders) load_config; sales_orders_text ;;
health|health-check) cmd_health_check ;;
safe-apply) cmd_safe_apply ;;
backup|backup-encrypted) cmd_backup_encrypted ;;
export|export-state) cmd_export_state ;;
import|import-state) cmd_import_state "${2:-}" ;;
bridge) cmd_bridge_menu ;;
bridge-show) cmd_bridge_show ;;
bridge-remove) cmd_bridge_remove ;;
nodes|node|multi-server) cmd_nodes_menu ;;
nodes-list|node-list) cmd_nodes_list ;;
nodes-add|node-add) cmd_nodes_add ;;
nodes-test|node-test) cmd_nodes_test "${2:-all}" ;;
nodes-deploy|node-deploy) cmd_nodes_deploy_script "${2:-}" ;;
nodes-sync|node-sync) cmd_nodes_sync_users "${2:-all}" ;;
nodes-subscriptions|nodes-rebuild-subscriptions) cmd_nodes_rebuild_subscriptions ;;
node-subscription-export) cmd_node_subscription_export "${2:-}" ;;
nodes-remove|node-remove) cmd_nodes_remove "${2:-}" ;;
fail2ban|f2b|security) setup_fail2ban "$(current_ssh_port)" ;;
language|lang) cmd_language ;;
self-update) load_config; cmd_self_update ;;
post-update) cmd_post_update "${2:-unknown}" ;;
camouflage) install_camouflage_page ;;
version)
echo "Yurich Panel v${VERSION}"
[[ -n "${TELEGRAM_COMMUNITY_URL:-}" ]] && echo "Telegram: ${TELEGRAM_COMMUNITY_URL}"
[[ -n "${PROJECT_WEBSITE_URL:-}" ]] && echo "Website: ${PROJECT_WEBSITE_URL}"
echo "GitHub: ${PROJECT_GITHUB_SHORT}"
;;
*) err "Неизвестная команда: $1"
echo "Доступные: install status config [user] reload restart update remove logs monitor credentials-status credentials-migrate routing-mode haproxy-status haproxy-apply haproxy-logs haproxy-tg users users-list-machine hysteria hy2 hysteria-sync hysteria-repair hysteria-port hysteria-warp-enable hysteria-warp-disable hysteria-hop-enable hysteria-hop-disable warp warp-proxy warp-full warp-health warp-protocol warp-ssh-allow xray xray-target xray-add-user [user] xray-compat-user [user] xray-rebuild vless-tune egress-ipv4 egress-dualstack pingtunnel-install pingtunnel-status pingtunnel-config pingtunnel-rotate pingtunnel-remove xray-zapret devices subscription subscription-clean private-page protocol-health protocol-validate protocol-benchmark protocol-benchmark-monitor protocol-benchmark-install protocol-benchmark-history protocol-stability-report protocol-monitor protocol-monitor-install security-audit notify-expiry-list notify-bind-tg notify-expiry-run notify-news notify-news-test expiry-enforce notify-expiry-install tg-stats bot-menu health safe-apply backup export import bridge nodes node-subscription-export fail2ban language ssh-hardening ssh-rescue sysupdate cert domains dns unbound yurich-dns yurich-dns-status yurich-dns-restart dns-open-check dns-latency-report self-update version camouflage"
exit 1 ;;
esac
exit 0
fi
# Тихая проверка обновлений в фоне
check_update_available
while true; do
show_menu
read -r choice; echo
load_config; load_users
case "$choice" in
1) cmd_install ;;
2) cmd_status ;;
3) print_client_config ;;
4) cmd_users ;;
5) cmd_domains ;;
6) cmd_monitor ;;
7) setup_telegram ;;
8) cmd_restart ;;
9) cmd_update ;;
10) cmd_logs ;;
11) cmd_remove ;;
12) cmd_ssh_hardening ;;
13) cmd_sysupdate ;;
14) cmd_self_update ;;
15) install_camouflage_page && ok "Камуфляж обновлён" ;;
16) cmd_diagnose ;;
17) cmd_dns_menu ;;
18) cmd_donate ;;
19) cmd_reload ;;
20) cmd_hysteria_menu ;;
21) cmd_warp_menu ;;
22) cmd_devices_menu ;;
23) cmd_xray_menu ;;
24) cmd_diagnose_fix ;;
25) cmd_subscription_user ;;
26) install_private_camouflage_page ;;
27) cmd_production_tools_menu ;;
28) cmd_language ;;
29) cmd_nodes_menu ;;
30) cmd_haproxy_menu ;;
31) install_sales_bot_service ;;
0) echo -e "${GREEN}$(t "Пока!" "Bye!")${RESET}"; exit 0 ;;
*) warn "$(t "Неверный выбор" "Invalid choice")" ;;
esac
echo
echo -ne "${YELLOW}$(t "Нажми Enter чтобы вернуться в меню..." "Press Enter to return to menu...")${RESET}"
read -r
done
}
if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
main "$@"
fi