mirror of
https://github.com/hackdiaz-dev/free-turn-proxy.git
synced 2026-10-12 09:41:53 +02:00
samosvalishe
3123 lines
126 KiB
Bash
Executable File
3123 lines
126 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
# Free Turn Proxy - установщик и контроллер сервера.
|
||
# Единый файл: устанавливает и обслуживает сервер, служит бэкендом JSON RPC для мобильного приложения.
|
||
|
||
set -Eeuo pipefail
|
||
umask 077
|
||
|
||
PROTO_VERSION=2
|
||
|
||
# Пути
|
||
PREFIX="${FT_PREFIX:-/opt/free-turn-proxy}"
|
||
STATE_FILE="$PREFIX/state"
|
||
PIDFILE="$PREFIX/proxy.pid"
|
||
LOCKFILE="$PREFIX/control.lock"
|
||
PEERS_LOCK="$PREFIX/peers.lock"
|
||
LOGFILE="$PREFIX/server.log"
|
||
VERFILE="$PREFIX/version"
|
||
ARGSFILE="$PREFIX/run.args"
|
||
ENVFILE="$PREFIX/run.env"
|
||
LAUNCHER="$PREFIX/launch.sh"
|
||
CLIENTSFILE="$PREFIX/auth/clients.json"
|
||
OWNERCIDFILE="$PREFIX/owner.cid"
|
||
SHARE_DIR="$PREFIX/share"
|
||
APP_DIR="$PREFIX"
|
||
CONF_FILE="${PREFIX}/install.conf"
|
||
AUTH_DIR="$PREFIX/auth"
|
||
|
||
# Веб-раздача: QR-коды AWG 3.1 (~600 Б конфига) не влезают в 80 колонок терминала,
|
||
# картинку надо снять телефоном. Сервер поднимается по требованию и умирает через TTL -
|
||
# порт с приватными ключами не должен стоять открытым между добавлениями клиентов.
|
||
WEB_ROOT="$PREFIX/web"
|
||
WEB_TOKEN_FILE="$PREFIX/web.token"
|
||
WEB_LOG="$PREFIX/web.log"
|
||
WEB_UNIT="freeturn-web"
|
||
WEB_PROBE_EXT=".ok"
|
||
FT_WEB_PORT="${FT_WEB_PORT:-8080}"
|
||
FT_WEB_TTL="${FT_WEB_TTL:-900}"
|
||
|
||
# Службы и контейнеры
|
||
SERVICE="free-turn-proxy.service"
|
||
UNIT_NAME="$SERVICE"
|
||
UNIT_FILE="/etc/systemd/system/${SERVICE}"
|
||
UNIT_PATH="$UNIT_FILE"
|
||
COMPOSE_FILE="${PREFIX}/docker-compose.yml"
|
||
CONTAINER="free-turn-proxy"
|
||
AWG_CONTAINER="freeturn-awg"
|
||
GUM_VERSION="0.17.0"
|
||
|
||
# AmneziaWG и WireGuard
|
||
AWG_DIR="${PREFIX}/awg"
|
||
AWG_IFACE="${FT_AWG_IFACE:-ftawg0}"
|
||
AWG_CONF="${AWG_DIR}/${AWG_IFACE}.conf"
|
||
AWG_NET="10.13.13"
|
||
WG_DIR="${FT_WG_DIR:-/etc/wireguard}"
|
||
WG_IFACE="${FT_WG_IFACE:-ft-wg0}"
|
||
WG_CONF="${WG_DIR}/${WG_IFACE}.conf"
|
||
WG_MARKER="# managed-by: free-turn-proxy"
|
||
AWG_MTU_DEFAULT=1280 # тот же фоллбэк, что в start.sh контейнера AWG
|
||
# Каталог артефактов клиента (ключи, QR). Раздаётся наружу - метаданные и allowlist держим вне его.
|
||
CLIENTS_DIR="${PREFIX}/clients"
|
||
CLIENTS_META="${PREFIX}/clients.list"
|
||
|
||
# Репозитории и ссылки
|
||
REPO="samosvalishe/free-turn-proxy"
|
||
IMAGE="ghcr.io/${REPO}"
|
||
AWG_IMAGE="ghcr.io/samosvalishe/freeturn-awg:latest"
|
||
RELEASES_URL="https://github.com/${REPO}/releases"
|
||
BASE_URL="${RELEASES_URL}/latest/download"
|
||
|
||
# Цвета (Material Design 3 + ANSI fallback)
|
||
MD_PRIMARY="#D0BCFF"
|
||
MD_SECONDARY="#CCC2DC"
|
||
MD_TERTIARY="#EFB8C8"
|
||
MD_SUCCESS="#81C784"
|
||
MD_ERROR="#F2B8B5"
|
||
BANNER_GRADIENT=("#EADDFF" "#D0BCFF" "#B69DF8" "#9A82DB" "#7F67BE" "#6750A4")
|
||
C_RED='\033[0;31m' C_GREEN='\033[0;32m' C_YELLOW='\033[1;33m' C_CYAN='\033[0;36m' C_NC='\033[0m'
|
||
|
||
# Конфигурация сервера
|
||
INSTALL_METHOD="docker" # docker | systemd
|
||
INSTALL_FREETURN=1 # 1 = ставить релей FreeTurn
|
||
INSTALL_AWG=1 # 1 = ставить AmneziaWG 3.1
|
||
VERSION="latest"
|
||
PROVIDER="vk"
|
||
PROXY_MODE="udp" # udp | tcp
|
||
BACKEND_PORT="51820"
|
||
LISTEN_PORT="56000"
|
||
AWG_DIRECT_PORT=1 # 1 = открыть BACKEND_PORT/udp в файрволе
|
||
OBF_PROFILE="rtpopus3" # rtpopus3 | rtpopus2 | rtpopus | none
|
||
OBF_KEY=""
|
||
CLIENTS_FILE_CONF="${AUTH_DIR}/clients.json"
|
||
WG_ENDPOINT="127.0.0.1:9000"
|
||
AWG_LOG_LEVEL="${FT_AWG_LOG_LEVEL:-error}"
|
||
|
||
# AmneziaWG 3.1 параметры
|
||
AWG_JC=""
|
||
AWG_JMIN=""
|
||
AWG_JMAX=""
|
||
AWG_S1=""
|
||
AWG_S2=""
|
||
AWG_S3=""
|
||
AWG_S4=""
|
||
AWG_H1=""
|
||
AWG_H2=""
|
||
AWG_H3=""
|
||
AWG_H4=""
|
||
AWG_HPK=""
|
||
|
||
# Состояние рантайма
|
||
HAS_GUM=0
|
||
GOARCH=""
|
||
WG_PORT=""
|
||
NONINTERACTIVE=0
|
||
OPEN_FIREWALL=""
|
||
PURGE=0
|
||
ACTION=""
|
||
CLIENT_SUBCOMMAND=""
|
||
CLIENT_SUBARG=""
|
||
UNINSTALL_TARGET="all" # freeturn | awg | all
|
||
NEW_CLIENT="" # клиент, созданный этим прогоном - только ему печатаем ссылки
|
||
OVERRIDES=()
|
||
|
||
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-}"
|
||
export PATH
|
||
export COLORFGBG="15;0"
|
||
|
||
valid_port() { [[ "$1" =~ ^[0-9]+$ ]] && [ "$1" -ge 1 ] && [ "$1" -le 65535 ]; }
|
||
valid_hex64() { [[ "$1" =~ ^[0-9a-fA-F]{64}$ ]]; }
|
||
valid_endpoint() { [[ "$1" =~ ^(\[[0-9a-fA-F:]+\]|[a-zA-Z0-9._-]+):[0-9]{1,5}$ ]]; }
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# JSON RPC v2 для Android ServerControl.kt (буферизация в 1 JSON-объект, trap EXIT)
|
||
|
||
_DATA=() # "key":<json-value>
|
||
_LOGS=() # заковыченные JSON-строки
|
||
_EMITTED=0 # защита от двойной печати
|
||
_STAGE="init"
|
||
_IS_RPC=0 # 1 = режим JSON RPC для Android / API
|
||
|
||
stage() { _STAGE="$1"; }
|
||
|
||
esc() {
|
||
local s=${1-}
|
||
s=${s//\\/\\\\}
|
||
s=${s//\"/\\\"}
|
||
s=${s//$'\t'/\\t}
|
||
s=${s//$'\r'/\\r}
|
||
s=${s//$'\n'/\\n}
|
||
s=${s//[$'\001'-$'\037'$'\177']/}
|
||
printf '%s' "$s"
|
||
}
|
||
|
||
d_str() { _DATA+=("\"$1\":\"$(esc "${2-}")\""); }
|
||
d_num() { _DATA+=("\"$1\":${2:-0}"); }
|
||
d_bool() { _DATA+=("\"$1\":$2"); }
|
||
d_raw() { _DATA+=("\"$1\":$2"); }
|
||
|
||
log() {
|
||
if [ "$_IS_RPC" = 1 ]; then
|
||
_LOGS+=("\"$(esc "$*")\"")
|
||
else
|
||
log_info "$*"
|
||
fi
|
||
}
|
||
|
||
_join() { local IFS=','; printf '%s' "${*-}"; }
|
||
_data_json() { if [ "${#_DATA[@]}" -gt 0 ]; then _join "${_DATA[@]}"; fi; }
|
||
_logs_json() { if [ "${#_LOGS[@]}" -gt 0 ]; then _join "${_LOGS[@]}"; fi; }
|
||
|
||
ok() {
|
||
[ "$_EMITTED" -eq 1 ] && return 0
|
||
_EMITTED=1
|
||
trap - EXIT
|
||
printf '{"proto":%d,"result":"ok","data":{%s},"logs":[%s]}\n' \
|
||
"$PROTO_VERSION" "$(_data_json)" "$(_logs_json)"
|
||
}
|
||
|
||
fail() {
|
||
local code=$1 msg=${2:-$1}
|
||
[ "$_EMITTED" -eq 1 ] && exit 1
|
||
_EMITTED=1
|
||
trap - EXIT
|
||
printf '{"proto":%d,"result":"err","code":"%s","msg":"%s","stage":"%s","logs":[%s]}\n' \
|
||
"$PROTO_VERSION" "$code" "$(esc "$msg")" "$_STAGE" "$(_logs_json)"
|
||
exit 1
|
||
}
|
||
|
||
_on_exit() {
|
||
local rc=$?
|
||
[ "$_EMITTED" -eq 1 ] && return
|
||
[ "$_IS_RPC" -ne 1 ] && return
|
||
_EMITTED=1
|
||
printf '{"proto":%d,"result":"err","code":"internal","msg":"unexpected exit %d","stage":"%s","logs":[%s]}\n' \
|
||
"$PROTO_VERSION" "$rc" "$_STAGE" "$(_logs_json)"
|
||
}
|
||
trap _on_exit EXIT
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# UI-слой: обёртки над gum с plain-fallback при отсутствии gum.
|
||
gum() {
|
||
local sub="${1:-}"
|
||
case "$sub" in
|
||
style|join|format|log)
|
||
if [ -t 0 ]; then
|
||
command gum "$@" </dev/null
|
||
else
|
||
command gum "$@"
|
||
fi
|
||
;;
|
||
*)
|
||
command gum "$@"
|
||
;;
|
||
esac
|
||
}
|
||
|
||
log_info() {
|
||
[ "$_IS_RPC" = 1 ] && { _LOGS+=("\"$(esc "$*")\""); return 0; }
|
||
if [ "$HAS_GUM" = 1 ]; then gum log --level info -- "$1"; else echo -e "${C_CYAN}[*]${C_NC} $1"; fi
|
||
}
|
||
|
||
log_warn() {
|
||
[ "$_IS_RPC" = 1 ] && { _LOGS+=("\"$(esc "WARN: $*")\""); return 0; }
|
||
if [ "$HAS_GUM" = 1 ]; then gum log --level warn -- "$1"; else echo -e "${C_YELLOW}[!]${C_NC} $1" >&2; fi
|
||
}
|
||
|
||
log_error() {
|
||
[ "$_IS_RPC" = 1 ] && { _LOGS+=("\"$(esc "ERROR: $*")\""); return 0; }
|
||
if [ "$HAS_GUM" = 1 ]; then gum log --level error -- "$1"; else echo -e "${C_RED}[x]${C_NC} $1" >&2; fi
|
||
}
|
||
|
||
log_success() {
|
||
[ "$_IS_RPC" = 1 ] && { _LOGS+=("\"$(esc "$*")\""); return 0; }
|
||
if [ "$HAS_GUM" = 1 ]; then gum style --foreground "$MD_SUCCESS" "✔ $1"; else echo -e "${C_GREEN}[+]${C_NC} $1"; fi
|
||
}
|
||
|
||
die() {
|
||
if [ "$_IS_RPC" = 1 ]; then fail internal "$1"; fi
|
||
log_error "$1"
|
||
exit 1
|
||
}
|
||
|
||
ui_drain_input() {
|
||
[ -t 0 ] || [ -r /dev/tty ] || return 0
|
||
stty -echo </dev/tty 2>/dev/null || true
|
||
local discard
|
||
while read -r -t 0.05 -n 1000 discard </dev/tty 2>/dev/null; do :; done
|
||
stty echo </dev/tty 2>/dev/null || true
|
||
}
|
||
|
||
ui_abort() { ui_drain_input; log_info "Отменено."; exit 0; }
|
||
|
||
ui_banner() {
|
||
[ "$_IS_RPC" = 1 ] && return 0
|
||
local art=(
|
||
'███████╗██████╗ ███████╗███████╗████████╗██╗ ██╗██████╗ ███╗ ██╗'
|
||
'██╔════╝██╔══██╗██╔════╝██╔════╝╚══██╔══╝██║ ██║██╔══██╗████╗ ██║'
|
||
'█████╗ ██████╔╝█████╗ █████╗ ██║ ██║ ██║██████╔╝██╔██╗ ██║'
|
||
'██╔══╝ ██╔══██╗██╔══╝ ██╔══╝ ██║ ██║ ██║██╔══██╗██║╚██╗██║'
|
||
'██║ ██║ ██║███████╗███████╗ ██║ ╚██████╔╝██║ ██║██║ ╚████║'
|
||
'╚═╝ ╚═╝ ╚═╝╚══════╝╚══════╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝')
|
||
printf '\n'
|
||
if [ "$HAS_GUM" = 1 ]; then
|
||
local i lines=()
|
||
for i in "${!art[@]}"; do
|
||
lines+=("$(gum style --foreground "${BANNER_GRADIENT[$i]}" "${art[$i]}")")
|
||
done
|
||
gum join --vertical "${lines[@]}"
|
||
gum style --foreground "$MD_SECONDARY" --italic --margin "0 0 1 1" \
|
||
"FreeTurn & AmneziaWG 3.1 · установщик сервера"
|
||
else
|
||
echo -e "${C_CYAN}"; printf '%s\n' "${art[@]}"; echo -e "${C_NC}"
|
||
echo " FreeTurn & AmneziaWG 3.1 · установщик сервера"; echo
|
||
fi
|
||
}
|
||
|
||
ui_note() {
|
||
[ "$_IS_RPC" = 1 ] && return 0
|
||
if [ "$HAS_GUM" = 1 ]; then
|
||
gum style --border rounded --border-foreground "$MD_PRIMARY" --padding "0 1" --margin "1 0" \
|
||
"$(gum style --foreground "$MD_PRIMARY" --bold "$1")" "$2"
|
||
else
|
||
echo; log_warn "$1: $2"
|
||
fi
|
||
}
|
||
|
||
ui_input() {
|
||
local __var="$1" __prompt="$2" __def="${3:-}" __ans
|
||
if [ "$HAS_GUM" = 1 ]; then
|
||
__ans=$(gum input --prompt "$__prompt: " --prompt.foreground "$MD_PRIMARY" \
|
||
--cursor.foreground "$MD_TERTIARY" --value "$__def" </dev/tty) || ui_abort
|
||
else
|
||
if [ -n "$__def" ]; then read -r -p "$__prompt [$__def]: " __ans </dev/tty
|
||
else read -r -p "$__prompt: " __ans </dev/tty; fi
|
||
fi
|
||
printf -v "$__var" '%s' "${__ans:-$__def}"
|
||
}
|
||
|
||
ui_yesno() {
|
||
local __prompt="$1" __def="${2:-Y}" __ans
|
||
if [ "$HAS_GUM" = 1 ]; then
|
||
local flags=(--selected.background "$MD_PRIMARY" --selected.foreground "#1C1B1F")
|
||
[ "$__def" = "N" ] && flags+=(--default=false)
|
||
gum confirm "${flags[@]}" "$__prompt" </dev/tty
|
||
return $?
|
||
fi
|
||
local hint; [ "$__def" = "Y" ] && hint="Y/n" || hint="y/N"
|
||
read -r -p "$__prompt [$hint]: " __ans </dev/tty
|
||
[[ "${__ans:-$__def}" =~ ^[Yy]$ ]]
|
||
}
|
||
|
||
ui_menu() {
|
||
local __var="$1" __prompt="$2" __def_tag="$3"; shift 3
|
||
local tags=() labels=()
|
||
while [ $# -gt 0 ]; do tags+=("$1"); labels+=("$2"); shift 2; done
|
||
|
||
if [ "$HAS_GUM" = 1 ]; then
|
||
local i def_label="" sel
|
||
for i in "${!tags[@]}"; do [ "${tags[$i]}" = "$__def_tag" ] && def_label="${labels[$i]}"; done
|
||
sel=$(gum choose --header "$__prompt" --header.foreground "$MD_PRIMARY" \
|
||
--cursor "❯ " --cursor.foreground "$MD_TERTIARY" \
|
||
--selected.foreground "$MD_PRIMARY" --selected "$def_label" \
|
||
"${labels[@]}" </dev/tty) || ui_abort
|
||
for i in "${!labels[@]}"; do
|
||
[ "${labels[$i]}" = "$sel" ] && { printf -v "$__var" '%s' "${tags[$i]}"; return; }
|
||
done
|
||
ui_abort
|
||
else
|
||
local i sel
|
||
echo; log_info "$__prompt"
|
||
for i in "${!tags[@]}"; do
|
||
if [ "${tags[$i]}" = "$__def_tag" ]; then echo -e " ${C_GREEN}${tags[$i]}${C_NC}) ${labels[$i]}"
|
||
else echo " ${tags[$i]}) ${labels[$i]}"; fi
|
||
done
|
||
while :; do
|
||
read -r -p "Выбор [${__def_tag}]: " sel </dev/tty
|
||
sel="${sel:-$__def_tag}"
|
||
for i in "${!tags[@]}"; do
|
||
[ "$sel" = "${tags[$i]}" ] && { printf -v "$__var" '%s' "$sel"; return; }
|
||
done
|
||
log_warn "Неверный выбор: $sel"
|
||
done
|
||
fi
|
||
}
|
||
|
||
ask_port() {
|
||
local __var="$1" __prompt="$2" __def="$3"
|
||
while :; do
|
||
ui_input "$__var" "$__prompt" "$__def"
|
||
valid_port "${!__var}" && break
|
||
ui_note "Ошибка" "Порт - число 1-65535. Получено: '${!__var}'"
|
||
done
|
||
}
|
||
|
||
ui_spin() {
|
||
local title="$1"; shift
|
||
local rc=0 log; log="$(mktemp)"
|
||
if [ "$HAS_GUM" = 1 ]; then
|
||
( "$@" >"$log" 2>&1 ) &
|
||
local pid=$!
|
||
gum spin --spinner dot --spinner.foreground "$MD_PRIMARY" --title "$title" \
|
||
-- bash -c 'while kill -0 "$1" 2>/dev/null; do sleep 0.1; done' _ "$pid" 2>/dev/null || true
|
||
wait "$pid" 2>/dev/null && rc=0 || rc=$?
|
||
if [ "$rc" -eq 0 ]; then log_success "$title"
|
||
else
|
||
log_error "$title - ошибка (код $rc)"
|
||
tail -n 40 "$log" | gum style --border rounded --border-foreground "$MD_ERROR" --padding "0 1"
|
||
fi
|
||
elif [ -t 1 ]; then
|
||
( "$@" >"$log" 2>&1 ) &
|
||
local pid=$! i=0 ch='|/-'$'\\'
|
||
while kill -0 "$pid" 2>/dev/null; do
|
||
i=$(((i + 1) % 4)); printf "\r${C_CYAN}[*]${C_NC} %s %s" "$title" "${ch:$i:1}"; sleep 0.2
|
||
done
|
||
wait "$pid" 2>/dev/null && rc=0 || rc=$?
|
||
if [ "$rc" -eq 0 ]; then printf "\r${C_GREEN}[+]${C_NC} %s\033[K\n" "$title"
|
||
else printf "\r${C_RED}[x]${C_NC} %s\033[K\n" "$title"; tail -n 40 "$log" >&2; fi
|
||
else
|
||
log_info "$title..."
|
||
"$@" >"$log" 2>&1 && rc=0 || rc=$?
|
||
[ "$rc" -ne 0 ] && tail -n 40 "$log" >&2
|
||
fi
|
||
rm -f "$log"
|
||
return "$rc"
|
||
}
|
||
|
||
# Генерация файла картинки QR-кода (PNG) с высоким разрешением
|
||
generate_qr_png_file() {
|
||
local conf_file="$1" png_file="$2"
|
||
[ -f "$conf_file" ] || return 0
|
||
command -v qrencode >/dev/null 2>&1 || pkg_install qrencode || true
|
||
if command -v qrencode >/dev/null 2>&1; then
|
||
qrencode -s 8 -m 2 -o "$png_file" < "$conf_file" 2>/dev/null || true
|
||
[ -f "$png_file" ] && chmod 0600 "$png_file" 2>/dev/null || true
|
||
fi
|
||
}
|
||
|
||
generate_qr_png_text() {
|
||
local text="$1" png_file="$2"
|
||
[ -n "$text" ] || return 0
|
||
command -v qrencode >/dev/null 2>&1 || pkg_install qrencode || true
|
||
if command -v qrencode >/dev/null 2>&1; then
|
||
printf '%s' "$text" | qrencode -s 8 -m 2 -o "$png_file" 2>/dev/null || true
|
||
[ -f "$png_file" ] && chmod 0600 "$png_file" 2>/dev/null || true
|
||
fi
|
||
}
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# Системные примитивы: блокировки flock, пакетный менеджер, детекция окружения.
|
||
|
||
with_lock() {
|
||
command -v flock >/dev/null 2>&1 || return 0
|
||
[ -d "$PREFIX" ] || mkdir -p "$PREFIX" 2>/dev/null || return 0
|
||
[ -w "$PREFIX" ] || return 0
|
||
exec 8>"$LOCKFILE" 2>/dev/null || return 0
|
||
flock -w 300 8 2>/dev/null || true
|
||
}
|
||
|
||
with_peers_lock() {
|
||
command -v flock >/dev/null 2>&1 || return 0
|
||
[ -d "$PREFIX" ] || mkdir -p "$PREFIX" 2>/dev/null || return 0
|
||
exec 9>"$PEERS_LOCK" 2>/dev/null || return 0
|
||
flock -w 60 9 2>/dev/null || true
|
||
}
|
||
|
||
pkg_mgr() {
|
||
local m
|
||
for m in apt-get dnf yum apk pacman zypper; do
|
||
if command -v "$m" >/dev/null 2>&1; then echo "$m"; return 0; fi
|
||
done
|
||
return 1
|
||
}
|
||
|
||
_apt_wait_lock() {
|
||
command -v fuser >/dev/null 2>&1 || return 0
|
||
local i=0
|
||
while fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1 \
|
||
|| fuser /var/lib/dpkg/lock >/dev/null 2>&1; do
|
||
[ "$i" -ge 60 ] && return 0
|
||
log "ожидание dpkg lock ($((i * 2))s)..."
|
||
sleep 2
|
||
i=$((i + 1))
|
||
done
|
||
}
|
||
|
||
pkg_install() {
|
||
local mgr; mgr=$(pkg_mgr) || return 1
|
||
case "$mgr" in
|
||
apt-get)
|
||
_apt_wait_lock
|
||
DEBIAN_FRONTEND=noninteractive NEEDRESTART_SUSPEND=1 \
|
||
apt-get -o DPkg::Lock::Timeout=300 update -qq >/dev/null 2>&1 || true
|
||
DEBIAN_FRONTEND=noninteractive NEEDRESTART_SUSPEND=1 \
|
||
apt-get -o DPkg::Lock::Timeout=300 install -y -qq "$@" >/dev/null 2>&1 ;;
|
||
dnf) dnf install -y -q "$@" >/dev/null 2>&1 ;;
|
||
yum) yum install -y -q "$@" >/dev/null 2>&1 ;;
|
||
apk) apk add --no-cache "$@" >/dev/null 2>&1 ;;
|
||
pacman) pacman -Sy --noconfirm "$@" >/dev/null 2>&1 ;;
|
||
zypper) zypper --non-interactive install "$@" >/dev/null 2>&1 ;;
|
||
*) return 1 ;;
|
||
esac
|
||
}
|
||
|
||
pkg_remove() {
|
||
local mgr; mgr=$(pkg_mgr) || return 1
|
||
case "$mgr" in
|
||
apt-get)
|
||
_apt_wait_lock
|
||
DEBIAN_FRONTEND=noninteractive NEEDRESTART_SUSPEND=1 \
|
||
apt-get -o DPkg::Lock::Timeout=300 remove -y -qq "$@" >/dev/null 2>&1 ;;
|
||
dnf) dnf remove -y -q "$@" >/dev/null 2>&1 ;;
|
||
yum) yum remove -y -q "$@" >/dev/null 2>&1 ;;
|
||
apk) apk del "$@" >/dev/null 2>&1 ;;
|
||
pacman) pacman -Rns --noconfirm "$@" >/dev/null 2>&1 ;;
|
||
zypper) zypper --non-interactive remove "$@" >/dev/null 2>&1 ;;
|
||
*) return 1 ;;
|
||
esac
|
||
}
|
||
export -f pkg_mgr _apt_wait_lock pkg_install pkg_remove 2>/dev/null || true
|
||
|
||
ensure_base_deps() {
|
||
local missing=() b
|
||
for b in curl jq openssl tar; do
|
||
command -v "$b" >/dev/null 2>&1 || missing+=("$b")
|
||
done
|
||
[ "${#missing[@]}" -eq 0 ] && return 0
|
||
if [ "$_IS_RPC" = 1 ]; then
|
||
pkg_install "${missing[@]}" || true
|
||
else
|
||
ui_spin "Установка зависимостей: ${missing[*]}" pkg_install "${missing[@]}"
|
||
fi
|
||
missing=()
|
||
for b in curl jq openssl tar; do
|
||
command -v "$b" >/dev/null 2>&1 || missing+=("$b")
|
||
done
|
||
if [ "${#missing[@]}" -ne 0 ]; then
|
||
die "Не удалось установить: ${missing[*]}. Установите их вручную."
|
||
fi
|
||
}
|
||
|
||
gum_download() {
|
||
local ver="$1" arch tmp bin
|
||
case "$(uname -m 2>/dev/null || echo "")" in
|
||
x86_64|amd64) arch="x86_64" ;;
|
||
aarch64|arm64) arch="arm64" ;;
|
||
*) return 1 ;;
|
||
esac
|
||
local url="https://github.com/charmbracelet/gum/releases/download/v${ver}/gum_${ver}_Linux_${arch}.tar.gz"
|
||
tmp="$(mktemp -d)"
|
||
if curl -fsSL --connect-timeout 10 --max-time 30 "$url" | tar -xz -C "$tmp" 2>/dev/null; then
|
||
bin="$(find "$tmp" -name gum -type f 2>/dev/null | head -n1 || true)"
|
||
[ -n "$bin" ] && install -m 0755 "$bin" /usr/local/bin/gum 2>/dev/null
|
||
fi
|
||
rm -rf "$tmp"
|
||
command -v gum >/dev/null 2>&1
|
||
}
|
||
|
||
ensure_gum() {
|
||
[ "$_IS_RPC" = 1 ] && { HAS_GUM=0; return 0; }
|
||
command -v gum >/dev/null 2>&1 && { HAS_GUM=1; return 0; }
|
||
log_info "Установка gum ${GUM_VERSION}..."
|
||
if gum_download "$GUM_VERSION"; then HAS_GUM=1; return 0; fi
|
||
local latest
|
||
latest="$(curl -s --max-time 10 'https://api.github.com/repos/charmbracelet/gum/releases/latest' \
|
||
| jq -r '.tag_name // empty' 2>/dev/null | sed 's/^v//' || true)"
|
||
if [ -n "$latest" ] && gum_download "$latest"; then HAS_GUM=1; return 0; fi
|
||
HAS_GUM=0
|
||
log_warn "gum недоступен - классический текстовый режим."
|
||
}
|
||
|
||
compose_cmd() {
|
||
if docker compose version >/dev/null 2>&1; then
|
||
docker compose "$@"
|
||
elif command -v docker-compose >/dev/null 2>&1; then
|
||
docker-compose "$@"
|
||
else
|
||
die "Docker Compose не найден."
|
||
fi
|
||
}
|
||
export -f compose_cmd 2>/dev/null || true
|
||
|
||
_install_compose_step() {
|
||
local mgr; mgr=$(pkg_mgr 2>/dev/null || true)
|
||
if [ -n "$mgr" ]; then
|
||
case "$mgr" in
|
||
apt-get)
|
||
pkg_install docker-compose-v2 || pkg_install docker-compose-plugin || pkg_install docker-compose || true ;;
|
||
dnf|yum)
|
||
pkg_install docker-compose-plugin || pkg_install docker-compose || true ;;
|
||
apk)
|
||
pkg_install docker-cli-compose || pkg_install docker-compose || true ;;
|
||
*)
|
||
pkg_install docker-compose || true ;;
|
||
esac
|
||
fi
|
||
|
||
if command -v docker-compose >/dev/null 2>&1 && ! docker compose version >/dev/null 2>&1; then
|
||
mkdir -p /usr/local/lib/docker/cli-plugins
|
||
ln -sf "$(command -v docker-compose)" /usr/local/lib/docker/cli-plugins/docker-compose 2>/dev/null || true
|
||
fi
|
||
|
||
if docker compose version >/dev/null 2>&1; then
|
||
return 0
|
||
fi
|
||
|
||
local m; m=$(uname -m 2>/dev/null || echo "x86_64")
|
||
case "$m" in
|
||
x86_64|amd64) m="x86_64" ;;
|
||
aarch64|arm64) m="aarch64" ;;
|
||
armv7*) m="armv7" ;;
|
||
armv6*) m="armv6" ;;
|
||
riscv64) m="riscv64" ;;
|
||
s390x) m="s390x" ;;
|
||
ppc64le) m="ppc64le" ;;
|
||
*) return 1 ;;
|
||
esac
|
||
|
||
local plugin_dir="/usr/local/lib/docker/cli-plugins"
|
||
mkdir -p "$plugin_dir" /usr/local/bin
|
||
if curl -fsSL "https://github.com/docker/compose/releases/latest/download/docker-compose-linux-$m" \
|
||
-o "$plugin_dir/docker-compose" 2>/dev/null; then
|
||
chmod +x "$plugin_dir/docker-compose"
|
||
ln -sf "$plugin_dir/docker-compose" /usr/local/bin/docker-compose 2>/dev/null || true
|
||
return 0
|
||
fi
|
||
return 1
|
||
}
|
||
export -f _install_compose_step 2>/dev/null || true
|
||
|
||
ensure_compose() {
|
||
if docker compose version >/dev/null 2>&1; then
|
||
return 0
|
||
fi
|
||
if command -v docker-compose >/dev/null 2>&1; then
|
||
mkdir -p /usr/local/lib/docker/cli-plugins
|
||
ln -sf "$(command -v docker-compose)" /usr/local/lib/docker/cli-plugins/docker-compose 2>/dev/null || true
|
||
if docker compose version >/dev/null 2>&1; then
|
||
return 0
|
||
fi
|
||
fi
|
||
|
||
if [ "$_IS_RPC" = 1 ]; then
|
||
_install_compose_step >/dev/null 2>&1 || fail compose_install_failed "docker compose install failed"
|
||
else
|
||
ui_spin "Установка Docker Compose" _install_compose_step || die "Установка Docker Compose не удалась."
|
||
fi
|
||
|
||
if ! docker compose version >/dev/null 2>&1 && ! command -v docker-compose >/dev/null 2>&1; then
|
||
die "Docker Compose не появился в системе."
|
||
fi
|
||
}
|
||
|
||
ensure_docker() {
|
||
if ! command -v docker >/dev/null 2>&1; then
|
||
if [ "$NONINTERACTIVE" != 1 ] && [ "$_IS_RPC" != 1 ]; then
|
||
if ! ui_yesno "Docker не найден. Установить автоматически?" "Y"; then
|
||
die "Для выбранного метода требуется Docker."
|
||
fi
|
||
fi
|
||
if [ "$_IS_RPC" = 1 ]; then
|
||
curl -fsSL https://get.docker.com | sh >/dev/null 2>&1 || fail docker_install_failed "docker install failed"
|
||
else
|
||
ui_spin "Установка Docker" sh -c 'curl -fsSL https://get.docker.com | sh' || die "Установка Docker не удалась."
|
||
fi
|
||
command -v docker >/dev/null 2>&1 || die "Docker не появился в PATH."
|
||
fi
|
||
|
||
if ! docker info >/dev/null 2>&1; then
|
||
systemctl start docker >/dev/null 2>&1 || service docker start >/dev/null 2>&1 || true
|
||
fi
|
||
|
||
ensure_compose
|
||
}
|
||
|
||
_mips_is_le() {
|
||
local hex; hex=$(printf '\1\0' | od -An -tx2 -N2 2>/dev/null | tr -d ' \n')
|
||
[ "$hex" = "0001" ]
|
||
}
|
||
|
||
detect_arch() {
|
||
local m; m=$(uname -m 2>/dev/null || echo "")
|
||
case "$m" in
|
||
x86_64|amd64) GOARCH="amd64"; echo "server-linux-amd64" ;;
|
||
aarch64|arm64) GOARCH="arm64"; echo "server-linux-arm64" ;;
|
||
armv7l|armv6l|armv5*|arm) GOARCH="arm"; echo "server-linux-arm" ;;
|
||
i386|i486|i586|i686) GOARCH="386"; echo "server-linux-386" ;;
|
||
riscv64) GOARCH="riscv64"; echo "server-linux-riscv64" ;;
|
||
mips64|mips64le)
|
||
if _mips_is_le; then GOARCH="mips64le"; echo "server-linux-mips64le"; else echo ""; return 1; fi ;;
|
||
mips|mipsel|mipsle)
|
||
if _mips_is_le; then GOARCH="mipsle"; echo "server-linux-mipsle"; else GOARCH="mips"; echo "server-linux-mips"; fi ;;
|
||
*) echo ""; return 1 ;;
|
||
esac
|
||
}
|
||
|
||
ensure_arch() {
|
||
local a; a=$(detect_arch) || {
|
||
if [ "$_IS_RPC" = 1 ]; then fail unsupported_arch "unsupported arch: $(uname -m)"; else die "Неподдерживаемая архитектура: $(uname -m)"; fi
|
||
}
|
||
case "$a" in
|
||
server-linux-amd64) GOARCH="amd64" ;;
|
||
server-linux-arm64) GOARCH="arm64" ;;
|
||
server-linux-arm) GOARCH="arm" ;;
|
||
server-linux-386) GOARCH="386" ;;
|
||
server-linux-riscv64) GOARCH="riscv64" ;;
|
||
server-linux-mips64le) GOARCH="mips64le" ;;
|
||
server-linux-mipsle) GOARCH="mipsle" ;;
|
||
server-linux-mips) GOARCH="mips" ;;
|
||
esac
|
||
}
|
||
|
||
detect_virt() {
|
||
local v
|
||
if command -v systemd-detect-virt >/dev/null 2>&1; then
|
||
v=$(systemd-detect-virt 2>/dev/null || true)
|
||
[ -n "$v" ] && { echo "$v"; return 0; }
|
||
fi
|
||
[ -f /.dockerenv ] && { echo docker; return 0; }
|
||
grep -qa 'container=lxc' /proc/1/environ 2>/dev/null && { echo lxc; return 0; }
|
||
echo none
|
||
}
|
||
|
||
wg_kernel_ok() {
|
||
[ -d /sys/module/wireguard ] && return 0
|
||
modprobe wireguard >/dev/null 2>&1
|
||
}
|
||
|
||
has_systemd() {
|
||
command -v systemctl >/dev/null 2>&1 && [ -d /run/systemd/system ]
|
||
}
|
||
|
||
conflict_warp() {
|
||
command -v warp-cli >/dev/null 2>&1 && return 0
|
||
ip link show 2>/dev/null | grep -qi 'CloudflareWARP' && return 0
|
||
ls "$WG_DIR"/wgcf*.conf >/dev/null 2>&1 && return 0
|
||
return 1
|
||
}
|
||
|
||
conflict_x3ui() {
|
||
[ -d /etc/x-ui ] || [ -d /usr/local/x-ui ] && return 0
|
||
command -v x-ui >/dev/null 2>&1 && return 0
|
||
has_systemd && systemctl list-unit-files 2>/dev/null | grep -qi '^x-ui' && return 0
|
||
return 1
|
||
}
|
||
|
||
conflict_wgeasy() {
|
||
if command -v docker >/dev/null 2>&1; then
|
||
docker ps --format '{{.Names}} {{.Image}}' 2>/dev/null | grep -qi 'wg-easy' && return 0
|
||
fi
|
||
[ -n "${WG_HOST:-}" ] && return 0
|
||
return 1
|
||
}
|
||
|
||
conflict_tailscale() {
|
||
command -v tailscale >/dev/null 2>&1 && return 0
|
||
ip link show 2>/dev/null | grep -qi 'tailscale' && return 0
|
||
return 1
|
||
}
|
||
|
||
other_wg_ifaces_csv() {
|
||
command -v wg >/dev/null 2>&1 || return 0
|
||
local i out="" first=1
|
||
for i in $(wg show interfaces 2>/dev/null || true); do
|
||
[ "$i" = "$WG_IFACE" ] && continue
|
||
[ "$i" = "$AWG_IFACE" ] && continue
|
||
[ "$first" -eq 1 ] && first=0 || out="$out,"
|
||
out="$out\"$(esc "$i")\""
|
||
done
|
||
printf '%s' "$out"
|
||
}
|
||
|
||
port_owner() {
|
||
local proto=$1 port=$2 letter line name
|
||
case "$proto" in tcp) letter=t ;; udp) letter=u ;; *) echo unknown; return 0 ;; esac
|
||
if command -v ss >/dev/null 2>&1; then
|
||
line=$(ss -H -ln"$letter"p 2>/dev/null | awk -v p=":${port}\$" '$4 ~ p {print; exit}' || true)
|
||
[ -z "$line" ] && { echo free; return 0; }
|
||
name=$(printf '%s' "$line" | sed -nE 's/.*users:\(\("([^"]+)".*/\1/p')
|
||
echo "${name:-unknown}"; return 0
|
||
fi
|
||
echo unknown
|
||
}
|
||
|
||
port_pid() {
|
||
local proto=$1 port=$2 letter line
|
||
case "$proto" in tcp) letter=t ;; udp) letter=u ;; *) return 0 ;; esac
|
||
command -v ss >/dev/null 2>&1 || return 0
|
||
line=$(ss -H -ln"$letter"p 2>/dev/null | awk -v p=":${port}\$" '$4 ~ p {print; exit}' || true)
|
||
printf '%s' "$line" | sed -nE 's/.*pid=([0-9]+).*/\1/p'
|
||
}
|
||
|
||
pid_is_ours() {
|
||
local exe; exe=$(readlink "/proc/$1/exe" 2>/dev/null || true)
|
||
case "$exe" in "$PREFIX"/*) return 0 ;; esac
|
||
return 1
|
||
}
|
||
|
||
get_public_ip() {
|
||
local ip="" url
|
||
for url in "https://api.ipify.org" "https://icanhazip.com" "https://ifconfig.me/ip" "https://ident.me"; do
|
||
ip="$(curl -4 -fsSL --connect-timeout 3 --max-time 5 "$url" 2>/dev/null | tr -d ' \r\n' || true)"
|
||
if [[ "$ip" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
|
||
echo "$ip"; return 0
|
||
fi
|
||
done
|
||
# Плейсхолдер уехал бы в Endpoint конфига и в ссылку - лучше явная ошибка.
|
||
return 1
|
||
}
|
||
|
||
detect_wg_port() {
|
||
WG_PORT=""
|
||
if [ -f "$AWG_CONF" ]; then
|
||
WG_PORT="$(sed -n 's/^[[:space:]]*ListenPort[[:space:]]*=[[:space:]]*//Ip' "$AWG_CONF" | head -n1 | tr -d ' \r')"
|
||
[ -n "$WG_PORT" ] && return 0
|
||
fi
|
||
if [ -f "$WG_CONF" ]; then
|
||
WG_PORT="$(sed -n 's/^[[:space:]]*ListenPort[[:space:]]*=[[:space:]]*//Ip' "$WG_CONF" | head -n1 | tr -d ' \r')"
|
||
[ -n "$WG_PORT" ] && return 0
|
||
fi
|
||
command -v wg >/dev/null 2>&1 || return 0
|
||
if wg show all listen-port >/dev/null 2>&1; then
|
||
WG_PORT="$(wg show all listen-port 2>/dev/null | head -n1 | awk '{print $2}' || true)"
|
||
fi
|
||
}
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# Сохранение, загрузка и валидация конфигурации сервера (install.conf и state).
|
||
|
||
state_get() {
|
||
[ -f "$STATE_FILE" ] || return 0
|
||
sed -n "s/^$1=//p" "$STATE_FILE" 2>/dev/null | head -n1
|
||
}
|
||
|
||
state_set() {
|
||
local k=$1 v=$2 tmp
|
||
[ -d "$PREFIX" ] || mkdir -p "$PREFIX" 2>/dev/null || return 0
|
||
[ -w "$PREFIX" ] || return 0
|
||
tmp=$(mktemp "$STATE_FILE.XXXXXX" 2>/dev/null) || return 0
|
||
if [ -f "$STATE_FILE" ]; then
|
||
grep -v "^$k=" "$STATE_FILE" > "$tmp" 2>/dev/null || true
|
||
fi
|
||
printf '%s=%s\n' "$k" "$v" >> "$tmp"
|
||
chmod 0600 "$tmp"
|
||
mv -f "$tmp" "$STATE_FILE"
|
||
}
|
||
|
||
is_installed() {
|
||
[ -f "$CONF_FILE" ] || [ -f "$COMPOSE_FILE" ] || [ -f "$UNIT_FILE" ] || [ -f "$AWG_CONF" ]
|
||
}
|
||
|
||
# Установки до 3.4.1 держали allowlist и метаданные внутри раздаваемого наружу clients/.
|
||
migrate_layout() {
|
||
[ -d "$PREFIX" ] || return 0
|
||
mkdir -p "$AUTH_DIR" 2>/dev/null || return 0
|
||
chmod 0700 "$AUTH_DIR" 2>/dev/null || true
|
||
local old_json="${CLIENTS_DIR}/clients.json" old_meta="${CLIENTS_DIR}/clients.list"
|
||
if [ -f "$old_json" ] && [ ! -f "$CLIENTSFILE" ]; then
|
||
mv -f "$old_json" "$CLIENTSFILE" 2>/dev/null || true
|
||
chmod 0600 "$CLIENTSFILE" 2>/dev/null || true
|
||
fi
|
||
[ -f "$old_json" ] && rm -f "$old_json"
|
||
if [ -f "$old_meta" ] && [ ! -f "$CLIENTS_META" ]; then
|
||
mv -f "$old_meta" "$CLIENTS_META" 2>/dev/null || true
|
||
fi
|
||
[ -f "$old_meta" ] && rm -f "$old_meta"
|
||
[ -d "$CLIENTS_DIR" ] && chmod 0700 "$CLIENTS_DIR" 2>/dev/null || true
|
||
migrate_client_dirs
|
||
return 0
|
||
}
|
||
|
||
# Те же установки держали артефакты плоско в clients/ - один секрет открывал всех клиентов.
|
||
migrate_client_dirs() {
|
||
[ -s "$CLIENTS_META" ] || return 0
|
||
local name suf src dst
|
||
while IFS='|' read -r name _; do
|
||
valid_client_name "$name" || continue
|
||
dst="${CLIENTS_DIR}/${name}"
|
||
[ -d "$dst" ] && continue
|
||
for suf in direct.conf relay.conf freeturn.txt freeturn-vpn.txt \
|
||
direct.png relay.png freeturn.png freeturn-vpn.png; do
|
||
src="${CLIENTS_DIR}/${name}-${suf}"
|
||
[ -f "$src" ] || continue
|
||
mkdir -p "$dst" 2>/dev/null && chmod 0700 "$dst" 2>/dev/null || true
|
||
mv -f "$src" "$dst/" 2>/dev/null || true
|
||
done
|
||
done < "$CLIENTS_META"
|
||
return 0
|
||
}
|
||
|
||
# shellcheck disable=SC1090
|
||
load_config() {
|
||
[ -f "$CONF_FILE" ] && . "$CONF_FILE" || true
|
||
if [ -n "${AWG_SETUP:-}" ]; then INSTALL_AWG="$AWG_SETUP"; fi
|
||
case "$CLIENTS_FILE_CONF" in
|
||
"${CLIENTS_DIR}/"*) CLIENTS_FILE_CONF="$CLIENTSFILE" ;;
|
||
esac
|
||
migrate_layout
|
||
return 0
|
||
}
|
||
|
||
save_config() {
|
||
mkdir -p "$APP_DIR" 2>/dev/null || true
|
||
cat > "$CONF_FILE" <<EOF
|
||
INSTALL_METHOD="$INSTALL_METHOD"
|
||
INSTALL_FREETURN="$INSTALL_FREETURN"
|
||
INSTALL_AWG="$INSTALL_AWG"
|
||
VERSION="$VERSION"
|
||
PROVIDER="$PROVIDER"
|
||
PROXY_MODE="$PROXY_MODE"
|
||
BACKEND_PORT="$BACKEND_PORT"
|
||
LISTEN_PORT="$LISTEN_PORT"
|
||
FT_WEB_PORT="$FT_WEB_PORT"
|
||
FT_WEB_TTL="$FT_WEB_TTL"
|
||
AWG_DIRECT_PORT="$AWG_DIRECT_PORT"
|
||
OBF_PROFILE="$OBF_PROFILE"
|
||
OBF_KEY="$OBF_KEY"
|
||
CLIENTS_FILE_CONF="$CLIENTS_FILE_CONF"
|
||
WG_ENDPOINT="$WG_ENDPOINT"
|
||
AWG_LOG_LEVEL="$AWG_LOG_LEVEL"
|
||
AWG_JC="$AWG_JC"
|
||
AWG_JMIN="$AWG_JMIN"
|
||
AWG_JMAX="$AWG_JMAX"
|
||
AWG_S1="$AWG_S1"
|
||
AWG_S2="$AWG_S2"
|
||
AWG_S3="$AWG_S3"
|
||
AWG_S4="$AWG_S4"
|
||
AWG_H1="$AWG_H1"
|
||
AWG_H2="$AWG_H2"
|
||
AWG_H3="$AWG_H3"
|
||
AWG_H4="$AWG_H4"
|
||
AWG_HPK="$AWG_HPK"
|
||
EOF
|
||
chmod 0600 "$CONF_FILE"
|
||
}
|
||
|
||
apply_overrides() {
|
||
local kv k v
|
||
for kv in "${OVERRIDES[@]+"${OVERRIDES[@]}"}"; do
|
||
k="${kv%%=*}"; v="${kv#*=}"; printf -v "$k" '%s' "$v"
|
||
done
|
||
}
|
||
|
||
connect_addr() { echo "127.0.0.1:${BACKEND_PORT}"; }
|
||
|
||
validate_config() {
|
||
[ "$INSTALL_FREETURN" != "1" ] && [ "$INSTALL_AWG" != "1" ] \
|
||
&& die "Не выбран ни один компонент для установки (FreeTurn или AmneziaWG)."
|
||
|
||
valid_port "${FT_WEB_PORT:-8080}" || die "web-port невалиден: '${FT_WEB_PORT}'"
|
||
[[ "${FT_WEB_TTL:-900}" =~ ^[0-9]+$ ]] && [ "${FT_WEB_TTL:-900}" -ge 60 ] \
|
||
|| die "web-ttl - число секунд, минимум 60. Получено: '${FT_WEB_TTL}'"
|
||
|
||
if [ "$INSTALL_FREETURN" = "1" ]; then
|
||
case "$INSTALL_METHOD" in docker | systemd) ;; *) die "method: docker|systemd, а не '$INSTALL_METHOD'" ;; esac
|
||
case "$PROVIDER" in vk) ;; *) die "provider: vk, а не '$PROVIDER'" ;; esac
|
||
case "$PROXY_MODE" in udp | tcp) ;; *) die "mode: udp|tcp, а не '$PROXY_MODE'" ;; esac
|
||
valid_port "$LISTEN_PORT" || die "listen-port невалиден: '$LISTEN_PORT'"
|
||
case "$OBF_PROFILE" in
|
||
rtpopus3 | rtpopus2 | rtpopus)
|
||
[ -z "$OBF_KEY" ] && { OBF_KEY="$(openssl rand -hex 32)"; log_info "Сгенерирован ключ обфускации."; }
|
||
valid_hex64 "$OBF_KEY" || die "obf-key должен состоять ровно из 64 hex-символов" ;;
|
||
none) OBF_KEY="" ;;
|
||
*) die "obf: rtpopus3|rtpopus2|rtpopus|none, а не '$OBF_PROFILE'" ;;
|
||
esac
|
||
fi
|
||
|
||
if [ "$INSTALL_AWG" = "1" ]; then
|
||
valid_port "$BACKEND_PORT" || die "backend-port невалиден: '$BACKEND_PORT'"
|
||
valid_endpoint "$WG_ENDPOINT" || die "wg-endpoint невалиден (host:port): '$WG_ENDPOINT'"
|
||
fi
|
||
return 0
|
||
}
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# Загрузка бинарников и проверка целостности.
|
||
|
||
_dl() {
|
||
local url=$1 out=$2
|
||
if command -v curl >/dev/null 2>&1; then
|
||
curl -fsSL --connect-timeout 15 --max-time 300 -o "$out" "$url"
|
||
elif command -v wget >/dev/null 2>&1; then
|
||
wget -q --timeout=300 -O "$out" "$url"
|
||
else
|
||
fail download_failed "neither curl nor wget present"
|
||
fi
|
||
}
|
||
|
||
_resolve_version() {
|
||
local url=$1 loc=""
|
||
if command -v curl >/dev/null 2>&1; then
|
||
loc=$(curl -sI "$url" 2>/dev/null | awk -F': ' 'tolower($1)=="location"{print $2}' | tr -d '\r' | head -n1)
|
||
elif command -v wget >/dev/null 2>&1; then
|
||
loc=$(wget --spider --server-response "$url" 2>&1 | awk '/[Ll]ocation:/{print $2}' | tr -d '\r' | head -n1)
|
||
fi
|
||
printf '%s' "$loc" | sed -nE 's#.*/releases/download/([^/]+)/.*#\1#p'
|
||
}
|
||
|
||
gh_latest_version() {
|
||
curl -s --max-time 10 "https://api.github.com/repos/${REPO}/releases/latest" 2>/dev/null | jq -r '.tag_name // empty' 2>/dev/null || true
|
||
}
|
||
|
||
gh_recent_versions() {
|
||
curl -s --max-time 10 "https://api.github.com/repos/${REPO}/releases?per_page=6" 2>/dev/null | jq -r '.[].tag_name' 2>/dev/null || true
|
||
}
|
||
|
||
resolve_asset_url() {
|
||
local ver=$1 asset=$2 api
|
||
[ "$ver" = "latest" ] && api="https://api.github.com/repos/${REPO}/releases/latest" \
|
||
|| api="https://api.github.com/repos/${REPO}/releases/tags/$ver"
|
||
curl -s --max-time 15 "$api" 2>/dev/null | jq -r --arg n "$asset" '.assets[] | select(.name==$n) | .browser_download_url' 2>/dev/null || true
|
||
}
|
||
|
||
image_tag() {
|
||
[ "$VERSION" = "latest" ] && echo "latest" || echo "$VERSION"
|
||
}
|
||
|
||
_verify_download() {
|
||
local f=$1 want=${2:-} size magic got
|
||
size=$(wc -c < "$f" 2>/dev/null || echo 0)
|
||
[ "$size" -lt 100000 ] && { rm -f "$f"; fail too_small "Файл слишком мал ($size байт)"; }
|
||
|
||
if command -v od >/dev/null 2>&1; then
|
||
magic=$(od -An -tx1 -N4 "$f" 2>/dev/null | tr -d ' \n')
|
||
if [ -n "$magic" ] && [ "$magic" != "7f454c46" ]; then
|
||
rm -f "$f"
|
||
fail not_elf "Файл не является бинарником ELF (magic: $magic)"
|
||
fi
|
||
fi
|
||
|
||
if [ -n "$want" ] && command -v sha256sum >/dev/null 2>&1; then
|
||
got=$(sha256sum "$f" | awk '{print $1}')
|
||
if [ -n "$got" ] && [ "$got" != "$want" ]; then
|
||
rm -f "$f"
|
||
fail sha_mismatch "Не совпадает sha256: ожидался $want, получен $got"
|
||
fi
|
||
fi
|
||
}
|
||
|
||
download_binary() {
|
||
ensure_arch
|
||
local asset="server-linux-${GOARCH}"
|
||
local url tmp
|
||
url="$(resolve_asset_url "$VERSION" "$asset" || true)"
|
||
[ -z "$url" ] && url="${BASE_URL}/${asset}"
|
||
|
||
tmp=$(mktemp "${APP_DIR}/server.new.XXXXXX" 2>/dev/null) || tmp="${APP_DIR}/server.new.$$"
|
||
if [ "$_IS_RPC" = 1 ]; then
|
||
_dl "$url" "$tmp" || fail download_failed "Не удалось скачать $url"
|
||
else
|
||
ui_spin "Скачивание ${asset} (${VERSION})" _dl "$url" "$tmp" || die "Не удалось скачать $url"
|
||
fi
|
||
_verify_download "$tmp" "${ARG_SHA256:-}"
|
||
chmod 0755 "$tmp"
|
||
with_lock
|
||
[ -f "${APP_DIR}/server" ] && cp -f "${APP_DIR}/server" "${APP_DIR}/server.bak" 2>/dev/null || true
|
||
mv -f "$tmp" "${APP_DIR}/server"
|
||
cp -f "${APP_DIR}/server" "${APP_DIR}/${asset}" 2>/dev/null || true
|
||
echo "$VERSION" > "$VERFILE"
|
||
}
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# VPN-бэкенд AmneziaWG (AWG 3.1); ft-wg0 - только детекция legacy-установок.
|
||
|
||
init_awg_params() {
|
||
if [ -f "$AWG_CONF" ]; then
|
||
AWG_JC="$(sed -n 's/^[[:space:]]*Jc[[:space:]]*=[[:space:]]*//Ip' "$AWG_CONF" | head -n1 | tr -d ' \r')"
|
||
AWG_HPK="$(sed -n 's/^[[:space:]]*HeaderProtectionKey[[:space:]]*=[[:space:]]*//Ip' "$AWG_CONF" | head -n1 | tr -d ' \r')"
|
||
if [ -n "$AWG_JC" ] && [ -n "$AWG_HPK" ]; then
|
||
AWG_JMIN="$(sed -n 's/^[[:space:]]*Jmin[[:space:]]*=[[:space:]]*//Ip' "$AWG_CONF" | head -n1 | tr -d ' \r')"
|
||
AWG_JMAX="$(sed -n 's/^[[:space:]]*Jmax[[:space:]]*=[[:space:]]*//Ip' "$AWG_CONF" | head -n1 | tr -d ' \r')"
|
||
AWG_S1="$(sed -n 's/^[[:space:]]*S1[[:space:]]*=[[:space:]]*//Ip' "$AWG_CONF" | head -n1 | tr -d ' \r')"
|
||
AWG_S2="$(sed -n 's/^[[:space:]]*S2[[:space:]]*=[[:space:]]*//Ip' "$AWG_CONF" | head -n1 | tr -d ' \r')"
|
||
AWG_S3="$(sed -n 's/^[[:space:]]*S3[[:space:]]*=[[:space:]]*//Ip' "$AWG_CONF" | head -n1 | tr -d ' \r')"
|
||
AWG_S4="$(sed -n 's/^[[:space:]]*S4[[:space:]]*=[[:space:]]*//Ip' "$AWG_CONF" | head -n1 | tr -d ' \r')"
|
||
AWG_H1="$(sed -n 's/^[[:space:]]*H1[[:space:]]*=[[:space:]]*//Ip' "$AWG_CONF" | head -n1 | tr -d ' \r')"
|
||
AWG_H2="$(sed -n 's/^[[:space:]]*H2[[:space:]]*=[[:space:]]*//Ip' "$AWG_CONF" | head -n1 | tr -d ' \r')"
|
||
AWG_H3="$(sed -n 's/^[[:space:]]*H3[[:space:]]*=[[:space:]]*//Ip' "$AWG_CONF" | head -n1 | tr -d ' \r')"
|
||
AWG_H4="$(sed -n 's/^[[:space:]]*H4[[:space:]]*=[[:space:]]*//Ip' "$AWG_CONF" | head -n1 | tr -d ' \r')"
|
||
return 0
|
||
fi
|
||
fi
|
||
|
||
AWG_JC=$((RANDOM % 3 + 4))
|
||
AWG_JMIN=10
|
||
AWG_JMAX=50
|
||
|
||
local s1 s2 s3 s4=12
|
||
s1=$((RANDOM % 136 + 15))
|
||
while :; do
|
||
s2=$((RANDOM % 136 + 15))
|
||
[ "$s2" -ne "$s1" ] && [ "$s2" -ne "$s4" ] && [ $((s1 + 148)) -ne $((s2 + 92)) ] && break
|
||
done
|
||
while :; do
|
||
s3=$((RANDOM % 50 + 15))
|
||
[ "$s3" -ne "$s1" ] && [ "$s3" -ne "$s2" ] && [ "$s3" -ne "$s4" ] && \
|
||
[ $((s1 + 148)) -ne $((s3 + 64)) ] && [ $((s2 + 92)) -ne $((s3 + 64)) ] && break
|
||
done
|
||
|
||
AWG_S1="$s1"
|
||
AWG_S2="$s2"
|
||
AWG_S3="$s3"
|
||
AWG_S4="$s4"
|
||
AWG_H1=1
|
||
AWG_H2=2
|
||
AWG_H3=3
|
||
AWG_H4=4
|
||
AWG_HPK="$(openssl rand 32 2>/dev/null | base64 | tr -d '\r\n')"
|
||
}
|
||
|
||
ensure_awg_image() {
|
||
[ "$INSTALL_AWG" = "1" ] || return 0
|
||
command -v docker >/dev/null 2>&1 || return 0
|
||
if docker image inspect "${AWG_IMAGE}" >/dev/null 2>&1; then
|
||
return 0
|
||
fi
|
||
if docker pull "${AWG_IMAGE}" >/dev/null 2>&1; then
|
||
return 0
|
||
fi
|
||
|
||
local script_dir repo_dir
|
||
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" 2>/dev/null && pwd || echo "")"
|
||
repo_dir="$(cd "$script_dir/.." 2>/dev/null && pwd || echo "")"
|
||
if [ -f "$repo_dir/docker/awg/Dockerfile" ]; then
|
||
if [ "$_IS_RPC" = 1 ]; then
|
||
docker build -t "${AWG_IMAGE}" -f "$repo_dir/docker/awg/Dockerfile" "$repo_dir" >/dev/null 2>&1 || true
|
||
else
|
||
ui_spin "Сборка Docker-образа AmneziaWG" docker build -t "${AWG_IMAGE}" -f "$repo_dir/docker/awg/Dockerfile" "$repo_dir" || true
|
||
fi
|
||
if docker image inspect "${AWG_IMAGE}" >/dev/null 2>&1; then
|
||
return 0
|
||
fi
|
||
fi
|
||
|
||
local bdir raw_url
|
||
bdir="$(mktemp -d)"
|
||
raw_url="https://raw.githubusercontent.com/${REPO}/master"
|
||
if curl -fsSL "$raw_url/docker/awg/Dockerfile" -o "$bdir/Dockerfile" 2>/dev/null && \
|
||
mkdir -p "$bdir/docker/awg" && \
|
||
curl -fsSL "$raw_url/docker/awg/start.sh" -o "$bdir/docker/awg/start.sh" 2>/dev/null; then
|
||
if [ "$_IS_RPC" = 1 ]; then
|
||
docker build -t "${AWG_IMAGE}" "$bdir" >/dev/null 2>&1 || true
|
||
else
|
||
ui_spin "Сборка Docker-образа AmneziaWG" docker build -t "${AWG_IMAGE}" "$bdir" || true
|
||
fi
|
||
fi
|
||
rm -rf "$bdir"
|
||
|
||
docker image inspect "${AWG_IMAGE}" >/dev/null 2>&1 || die "Не удалось получить или собрать образ ${AWG_IMAGE}."
|
||
}
|
||
|
||
generate_awg_keypair() {
|
||
local priv="" pub=""
|
||
if command -v awg >/dev/null 2>&1; then
|
||
priv="$(awg genkey 2>/dev/null || true)"
|
||
[ -n "$priv" ] && pub="$(awg pubkey <<< "$priv" 2>/dev/null || true)"
|
||
elif [ "$(docker inspect -f '{{.State.Running}}' "$AWG_CONTAINER" 2>/dev/null || echo false)" = "true" ]; then
|
||
priv="$(docker exec "$AWG_CONTAINER" awg genkey 2>/dev/null || true)"
|
||
[ -n "$priv" ] && pub="$(docker exec -i "$AWG_CONTAINER" awg pubkey <<< "$priv" 2>/dev/null || true)"
|
||
elif command -v docker >/dev/null 2>&1; then
|
||
ensure_awg_image
|
||
priv="$(docker run --rm "${AWG_IMAGE}" awg genkey 2>/dev/null || true)"
|
||
[ -n "$priv" ] && pub="$(docker run --rm -i "${AWG_IMAGE}" awg pubkey <<< "$priv" 2>/dev/null || true)"
|
||
elif command -v wg >/dev/null 2>&1; then
|
||
priv="$(wg genkey 2>/dev/null || true)"
|
||
[ -n "$priv" ] && pub="$(wg pubkey <<< "$priv" 2>/dev/null || true)"
|
||
fi
|
||
[ -z "$priv" ] || [ -z "$pub" ] && die "Не удалось сгенерировать ключи VPN."
|
||
echo "$priv $pub"
|
||
}
|
||
|
||
awg_present() { [ -f "$AWG_CONF" ]; }
|
||
|
||
awg_port() {
|
||
[ -f "$AWG_CONF" ] || return 0
|
||
sed -n 's/^[[:space:]]*ListenPort[[:space:]]*=[[:space:]]*//Ip' "$AWG_CONF" 2>/dev/null \
|
||
| head -n1 | sed 's/[#;].*//' | tr -d ' \r'
|
||
}
|
||
|
||
wg_present() { [ -f "$WG_CONF" ] || [ -f "$WG_DIR/wg0.conf" ]; }
|
||
|
||
wg_is_ours() {
|
||
[ -f "$WG_CONF" ] || return 1
|
||
grep -qF "$WG_MARKER" "$WG_CONF" 2>/dev/null
|
||
}
|
||
|
||
wg_port() {
|
||
local p=""
|
||
if command -v wg >/dev/null 2>&1; then
|
||
p=$(wg show "$WG_IFACE" listen-port 2>/dev/null | tr -d ' \r' || true)
|
||
case "$p" in ''|0) p="" ;; esac
|
||
if [ -n "$p" ]; then echo "$p"; return 0; fi
|
||
fi
|
||
if [ -f "$WG_CONF" ]; then
|
||
p=$(sed -n 's/^[[:space:]]*ListenPort[[:space:]]*=[[:space:]]*//Ip' "$WG_CONF" 2>/dev/null \
|
||
| head -n1 | sed 's/[#;].*//' | tr -d ' \r')
|
||
case "$p" in ''|*[!0-9]*) p="" ;; esac
|
||
if [ -n "$p" ]; then echo "$p"; return 0; fi
|
||
fi
|
||
}
|
||
|
||
alloc_client_ip() {
|
||
local conf=$1 net_prefix=$2 max_ip=1 ips num
|
||
if [ -f "$conf" ]; then
|
||
ips=$(grep -oE "${net_prefix}\.[0-9]+" "$conf" 2>/dev/null | awk -F. '{print $4}' | sort -n || true)
|
||
for num in $ips; do
|
||
[ "$num" -gt "$max_ip" ] && max_ip="$num"
|
||
done
|
||
fi
|
||
# .1 - сервер, .255 - broadcast: за 254 клиента /24 кончается.
|
||
[ "$max_ip" -ge 254 ] && { log_error "Подсеть ${net_prefix}.0/24 исчерпана (254 клиента)."; return 1; }
|
||
echo "${net_prefix}.$((max_ip + 1))"
|
||
}
|
||
|
||
enable_ip_forwarding() {
|
||
[ -d /etc/sysctl.d ] || mkdir -p /etc/sysctl.d 2>/dev/null || true
|
||
echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-free-turn-proxy.conf 2>/dev/null || true
|
||
sysctl -q -w net.ipv4.ip_forward=1 >/dev/null 2>&1 || true
|
||
}
|
||
|
||
awg_bootstrap() {
|
||
[ "$INSTALL_AWG" = "1" ] || return 0
|
||
enable_ip_forwarding
|
||
mkdir -p "$AWG_DIR" "$CLIENTS_DIR"
|
||
init_awg_params
|
||
[ -f "$AWG_CONF" ] && return 0
|
||
|
||
log_info "Инициализация AmneziaWG (AWG 3.1)..."
|
||
local kp priv pub
|
||
kp="$(generate_awg_keypair)"
|
||
priv="${kp%% *}"; pub="${kp##* }"
|
||
|
||
echo "$priv" > "${AWG_DIR}/server.key"; chmod 0600 "${AWG_DIR}/server.key"
|
||
echo "$pub" > "${AWG_DIR}/server.pub"
|
||
|
||
( umask 077
|
||
cat > "$AWG_CONF" <<EOF
|
||
[Interface]
|
||
Address = ${AWG_NET}.1/24
|
||
ListenPort = ${BACKEND_PORT}
|
||
PrivateKey = ${priv}
|
||
Jc = ${AWG_JC}
|
||
Jmin = ${AWG_JMIN}
|
||
Jmax = ${AWG_JMAX}
|
||
S1 = ${AWG_S1}
|
||
S2 = ${AWG_S2}
|
||
S3 = ${AWG_S3}
|
||
S4 = ${AWG_S4}
|
||
H1 = ${AWG_H1}
|
||
H2 = ${AWG_H2}
|
||
H3 = ${AWG_H3}
|
||
H4 = ${AWG_H4}
|
||
HeaderProtectionKey = ${AWG_HPK}
|
||
ContentPaddingAddition = 10
|
||
RekeyAfterTime = 110
|
||
RekeyTimeout = 5
|
||
RejectAfterTime = 160
|
||
KeepaliveTimeout = 10
|
||
MaxHandshakeAttempts = 15
|
||
RandomTrailers = on
|
||
DisableCookies = on
|
||
EOF
|
||
)
|
||
log_success "Конфигурация AmneziaWG создана (${AWG_CONF})."
|
||
}
|
||
|
||
awg_reconcile() {
|
||
if [ "$(docker inspect -f '{{.State.Running}}' "$AWG_CONTAINER" 2>/dev/null || echo false)" = "true" ]; then
|
||
docker exec "$AWG_CONTAINER" ft-awg-start sync >/dev/null 2>&1 || true
|
||
elif command -v awg >/dev/null 2>&1; then
|
||
awg syncconf "$AWG_IFACE" <(awg-quick strip "$AWG_IFACE" 2>/dev/null) 2>/dev/null || true
|
||
fi
|
||
}
|
||
|
||
wg_reconcile() {
|
||
command -v wg >/dev/null 2>&1 || return 0
|
||
ip link show "$WG_IFACE" >/dev/null 2>&1 || return 0
|
||
wg syncconf "$WG_IFACE" <(wg-quick strip "$WG_IFACE" 2>/dev/null) 2>/dev/null || true
|
||
}
|
||
|
||
_pub_fs() { printf '%s' "$1" | tr '/+' '_-' | tr -d '='; }
|
||
|
||
generate_freeturn_uri() {
|
||
local peer="$1" mode="$2" obf="$3" key="$4" cid="${5:-}" name="${6:-}" wg_conf="${7:-}"
|
||
local json b64
|
||
json="{\"v\":1,\"provider\":\"$(esc "${PROVIDER:-vk}")\",\"peer\":\"$(esc "$peer")\""
|
||
if [ -n "$mode" ] && [ "$mode" != "udp" ]; then
|
||
json="$json,\"mode\":\"$(esc "$mode")\""
|
||
fi
|
||
if [ -n "$obf" ] && [ "$obf" != "none" ]; then
|
||
json="$json,\"obf\":\"$(esc "$obf")\",\"key\":\"$(esc "$key")\""
|
||
fi
|
||
# n/spc не пишем: клиент подставит свои дефолты, второй источник значений не нужен.
|
||
if [ -n "$cid" ]; then
|
||
json="$json,\"cid\":\"$(esc "$cid")\""
|
||
fi
|
||
if [ -n "$name" ]; then
|
||
json="$json,\"name\":\"$(esc "$name")\""
|
||
fi
|
||
if [ -n "$wg_conf" ]; then
|
||
json="$json,\"wg\":\"$(esc "$wg_conf")\""
|
||
fi
|
||
json="$json}"
|
||
b64=$(printf '%s' "$json" | openssl base64 -A 2>/dev/null || printf '%s' "$json" | base64 | tr -d '\r\n')
|
||
b64=$(printf '%s' "$b64" | tr '+/' '-_' | tr -d '=')
|
||
echo "freeturn://${b64}"
|
||
}
|
||
|
||
peers_json() {
|
||
local target_conf="" iface=""
|
||
if [ -f "$AWG_CONF" ]; then target_conf="$AWG_CONF"; iface="$AWG_IFACE"
|
||
elif wg_present && wg_is_ours; then target_conf="$WG_CONF"; iface="$WG_IFACE"
|
||
else printf '[]'; return 0; fi
|
||
|
||
local hs="" out="" first=1 in_peer=0 pub="" name="" ip="" raw line val
|
||
command -v wg >/dev/null 2>&1 && hs=$(wg show "$iface" latest-handshakes 2>/dev/null || true)
|
||
|
||
flush_peer() {
|
||
if [ "$in_peer" = 1 ] && [ -n "$pub" ]; then
|
||
local h conf_yes el
|
||
h=$(printf '%s\n' "$hs" | awk -v p="$pub" '$1==p{print $2}')
|
||
[ -f "$SHARE_DIR/$(_pub_fs "$pub").conf" ] || [ -f "$CLIENTS_DIR/$(_pub_fs "$pub").conf" ] \
|
||
&& conf_yes=true || conf_yes=false
|
||
el="{\"pub\":\"$(esc "$pub")\""
|
||
[ -n "$name" ] && el="$el,\"name_b64\":\"$(esc "$name")\""
|
||
[ -n "$ip" ] && el="$el,\"ip\":\"$(esc "$ip")\""
|
||
[ -n "$h" ] && [ "$h" != 0 ] && el="$el,\"hs\":$h"
|
||
el="$el,\"has_conf\":$conf_yes}"
|
||
[ "$first" = 1 ] && first=0 || out="$out,"
|
||
out="$out$el"
|
||
fi
|
||
pub=""; name=""; ip=""
|
||
}
|
||
|
||
while IFS= read -r raw || [ -n "$raw" ]; do
|
||
line=${raw//$'\r'/}; line=${line#"${line%%[![:space:]]*}"}; line=${line%"${line##*[![:space:]]}"}
|
||
case "$line" in
|
||
"["*) flush_peer; case "$line" in \[[Pp]eer\]) in_peer=1 ;; *) in_peer=0 ;; esac ;;
|
||
"# ft-user: "*) [ "$in_peer" = 1 ] && name="${line#\# ft-user: }" ;;
|
||
"# client: "*) [ "$in_peer" = 1 ] && name=$(printf '%s' "${line#\# client: }" | base64 | tr -d '\r\n') ;;
|
||
PublicKey*=*) [ "$in_peer" = 1 ] && { val=${line#*=}; pub=${val// /}; } ;;
|
||
AllowedIPs*=*) [ "$in_peer" = 1 ] && [ -z "$ip" ] && { val=${line#*=}; val=${val%%,*}; val=${val%%/*}; ip=${val// /}; } ;;
|
||
esac
|
||
done < "$target_conf"
|
||
flush_peer
|
||
printf '[%s]' "$out"
|
||
}
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# Управление рантаймами (Docker Compose / Systemd), процессами и файрволом.
|
||
|
||
current_runtime() {
|
||
local r; r=$(state_get runtime)
|
||
[ -n "$r" ] && { echo "$r"; return 0; }
|
||
[ -f "$COMPOSE_FILE" ] || [ "$INSTALL_METHOD" = "docker" ] && { echo "docker"; return 0; }
|
||
has_systemd && echo "systemd" || echo "nohup"
|
||
}
|
||
|
||
_running_nohup() {
|
||
if [ -f "$PIDFILE" ]; then
|
||
local pid; pid=$(cat "$PIDFILE" 2>/dev/null || echo "")
|
||
[ -n "$pid" ] && kill -0 "$pid" 2>/dev/null && return 0
|
||
fi
|
||
pgrep -f "^$PREFIX/(server|server-linux-)" >/dev/null 2>&1
|
||
}
|
||
|
||
rt_running() {
|
||
case "$(current_runtime)" in
|
||
docker)
|
||
if [ "$INSTALL_FREETURN" = "1" ]; then
|
||
[ "$(docker inspect -f '{{.State.Running}}' "$CONTAINER" 2>/dev/null || echo false)" = "true" ]
|
||
elif [ "$INSTALL_AWG" = "1" ]; then
|
||
[ "$(docker inspect -f '{{.State.Running}}' "$AWG_CONTAINER" 2>/dev/null || echo false)" = "true" ]
|
||
else
|
||
return 1
|
||
fi ;;
|
||
systemd)
|
||
systemctl is-active --quiet "$UNIT_NAME" ;;
|
||
nohup)
|
||
_running_nohup ;;
|
||
*) return 1 ;;
|
||
esac
|
||
}
|
||
|
||
rt_pid() {
|
||
case "$(current_runtime)" in
|
||
docker)
|
||
docker inspect -f '{{.State.Pid}}' "$CONTAINER" 2>/dev/null || echo 0 ;;
|
||
systemd)
|
||
local p; p=$(systemctl show -p MainPID --value "$UNIT_NAME" 2>/dev/null || echo 0)
|
||
[ -n "$p" ] && [ "$p" != "0" ] && echo "$p" || true ;;
|
||
nohup)
|
||
[ -f "$PIDFILE" ] && cat "$PIDFILE" 2>/dev/null || true ;;
|
||
esac
|
||
}
|
||
|
||
current_cmdline() {
|
||
local p; p=$(rt_pid)
|
||
[ -n "$p" ] && [ -r "/proc/$p/cmdline" ] && tr '\0' ' ' < "/proc/$p/cmdline" || true
|
||
}
|
||
|
||
_wait_running() {
|
||
local i=0
|
||
while [ "$i" -lt 5 ]; do
|
||
rt_running >/dev/null 2>&1 && return 0
|
||
sleep 1
|
||
i=$((i + 1))
|
||
done
|
||
return 1
|
||
}
|
||
|
||
_install_systemd_unit() {
|
||
local launcher_content unit_content need_reload=0
|
||
launcher_content=$(cat <<'LAUNCH_EOF'
|
||
#!/bin/bash
|
||
set -e
|
||
PREFIX="/opt/free-turn-proxy"
|
||
[ -f "$PREFIX/run.args" ] || { echo "run.args missing" >&2; exit 1; }
|
||
a=()
|
||
while IFS= read -r line || [ -n "$line" ]; do a+=("$line"); done < "$PREFIX/run.args"
|
||
if [ -x "$PREFIX/server" ]; then exec "$PREFIX/server" "${a[@]}"; fi
|
||
arch=server-linux-amd64
|
||
case "$(uname -m 2>/dev/null || echo "")" in
|
||
x86_64|amd64) arch=server-linux-amd64 ;;
|
||
aarch64|arm64) arch=server-linux-arm64 ;;
|
||
armv7l|armv6l|armv5*|arm) arch=server-linux-arm ;;
|
||
i386|i486|i586|i686) arch=server-linux-386 ;;
|
||
riscv64) arch=server-linux-riscv64 ;;
|
||
esac
|
||
exec "$PREFIX/$arch" "${a[@]}"
|
||
LAUNCH_EOF
|
||
)
|
||
if [ ! -f "$LAUNCHER" ] || [ "$(cat "$LAUNCHER" 2>/dev/null)" != "$launcher_content" ]; then
|
||
printf '%s\n' "$launcher_content" > "$LAUNCHER"
|
||
chmod 0755 "$LAUNCHER"
|
||
fi
|
||
|
||
unit_content=$(cat <<UNIT_EOF
|
||
[Unit]
|
||
Description=free-turn-proxy server
|
||
After=network-online.target
|
||
Wants=network-online.target
|
||
|
||
[Service]
|
||
Type=simple
|
||
EnvironmentFile=-$ENVFILE
|
||
ExecStart=$LAUNCHER
|
||
Restart=on-failure
|
||
RestartSec=2
|
||
LimitNOFILE=65536
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
UNIT_EOF
|
||
)
|
||
if [ ! -f "$UNIT_PATH" ] || [ "$(cat "$UNIT_PATH" 2>/dev/null)" != "$unit_content" ]; then
|
||
printf '%s\n' "$unit_content" > "$UNIT_PATH"
|
||
chmod 0644 "$UNIT_PATH"
|
||
need_reload=1
|
||
fi
|
||
[ "$need_reload" = "1" ] && systemctl daemon-reload
|
||
systemctl enable "$UNIT_NAME" >/dev/null 2>&1 || true
|
||
}
|
||
|
||
_write_args_file() {
|
||
local tmp="$ARGSFILE.tmp"
|
||
( umask 077; : > "$tmp" )
|
||
{
|
||
echo "-listen"; echo "${ARG_LISTEN:-0.0.0.0:${LISTEN_PORT}}"
|
||
echo "-connect"; echo "${ARG_CONNECT:-$(connect_addr)}"
|
||
if [ "${ARG_MODE:-$PROXY_MODE}" = "tcp" ]; then
|
||
echo "-mode"; echo "tcp"
|
||
local tok; for tok in ${ARG_KCP[@]+"${ARG_KCP[@]}"}; do echo "$tok"; done
|
||
else
|
||
echo "-mode"; echo "udp"
|
||
fi
|
||
local prof="${ARG_OBF_PROFILE:-$OBF_PROFILE}"
|
||
local key="${ARG_OBF_KEY:-$OBF_KEY}"
|
||
if [ "$prof" != "none" ] && [ -z "$key" ]; then
|
||
key="$(openssl rand -hex 32 2>/dev/null || head -c 32 /dev/urandom | xxd -p -c 32 2>/dev/null || true)"
|
||
OBF_KEY="$key"
|
||
fi
|
||
if [ "$prof" != "none" ] && [ -n "$key" ]; then
|
||
echo "-obf-profile"; echo "$prof"
|
||
echo "-obf-key"; echo "$key"
|
||
[ -n "${ARG_OBF_TIMING:-}" ] && { echo "-obf-timing"; echo "$ARG_OBF_TIMING"; }
|
||
fi
|
||
if [ -n "${ARG_CLIENT_ID:-}" ] || [ -n "${CLIENTS_FILE_CONF:-}" ]; then
|
||
echo "-clients-file"; echo "${CLIENTS_FILE_CONF:-$CLIENTSFILE}"
|
||
fi
|
||
} >> "$tmp"
|
||
chmod 0600 "$tmp"
|
||
mv -f "$tmp" "$ARGSFILE"
|
||
}
|
||
|
||
_write_env_file() {
|
||
local tmp="$ENVFILE.tmp"
|
||
( umask 077; : > "$tmp" )
|
||
chmod 0600 "$tmp"
|
||
mv -f "$tmp" "$ENVFILE"
|
||
}
|
||
|
||
_stop_docker() {
|
||
if [ -f "$COMPOSE_FILE" ] && command -v docker >/dev/null 2>&1; then
|
||
( cd "$APP_DIR" && compose_cmd stop ) >/dev/null 2>&1 || true
|
||
fi
|
||
docker stop "$CONTAINER" "$AWG_CONTAINER" >/dev/null 2>&1 || true
|
||
}
|
||
|
||
_stop_systemd() {
|
||
systemctl stop "$UNIT_NAME" 2>/dev/null || true
|
||
rm -f "$ENVFILE"
|
||
}
|
||
|
||
_stop_nohup() {
|
||
if [ -f "$PIDFILE" ]; then
|
||
local pid; pid=$(cat "$PIDFILE" 2>/dev/null || echo "")
|
||
[ -n "$pid" ] && { kill "$pid" 2>/dev/null || true; sleep 1; kill -9 "$pid" 2>/dev/null || true; }
|
||
rm -f "$PIDFILE"
|
||
fi
|
||
pkill -9 -f "^$PREFIX/(server|server-linux-)" 2>/dev/null || true
|
||
rm -f "$ENVFILE"
|
||
}
|
||
|
||
rt_stop() {
|
||
case "$(current_runtime)" in
|
||
docker) _stop_docker ;;
|
||
systemd) _stop_systemd ;;
|
||
nohup) _stop_nohup ;;
|
||
esac
|
||
}
|
||
|
||
init_clients_file() {
|
||
local cfile="${CLIENTS_FILE_CONF:-$CLIENTSFILE}"
|
||
[ -z "$cfile" ] && return 0
|
||
mkdir -p "$(dirname "$cfile")" 2>/dev/null || true
|
||
if [ ! -f "$cfile" ]; then
|
||
echo '{"clients":{}}' > "$cfile"
|
||
chmod 0600 "$cfile"
|
||
fi
|
||
}
|
||
|
||
healthcheck_docker() {
|
||
sleep 2
|
||
if [ "$INSTALL_FREETURN" = "1" ]; then
|
||
[ "$(docker inspect -f '{{.State.Running}}' "$CONTAINER" 2>/dev/null || echo false)" = "true" ] \
|
||
&& log_success "Контейнер FreeTurn работает." \
|
||
|| {
|
||
log_warn "Логи ${CONTAINER}:"
|
||
docker logs --tail 30 "$CONTAINER" 2>&1 || true
|
||
die "Контейнер FreeTurn не запустился."
|
||
}
|
||
fi
|
||
if [ "$INSTALL_AWG" = "1" ]; then
|
||
[ "$(docker inspect -f '{{.State.Running}}' "$AWG_CONTAINER" 2>/dev/null || echo false)" = "true" ] \
|
||
&& log_success "Контейнер AmneziaWG работает." \
|
||
|| {
|
||
log_warn "Логи ${AWG_CONTAINER}:"
|
||
docker logs --tail 30 "$AWG_CONTAINER" 2>&1 || true
|
||
die "Контейнер AmneziaWG не запустился."
|
||
}
|
||
fi
|
||
}
|
||
|
||
apply_docker() {
|
||
state_set runtime docker
|
||
ensure_docker
|
||
init_clients_file
|
||
mkdir -p "$APP_DIR"
|
||
|
||
local mode="${ARG_MODE:-$PROXY_MODE}"
|
||
local prof="${ARG_OBF_PROFILE:-$OBF_PROFILE}"
|
||
local key="${ARG_OBF_KEY:-$OBF_KEY}"
|
||
local listen_val="${ARG_LISTEN:-0.0.0.0:${LISTEN_PORT}}"
|
||
local connect_val="${ARG_CONNECT:-$(connect_addr)}"
|
||
if [ "$prof" != "none" ] && [ -z "$key" ]; then
|
||
key="$(openssl rand -hex 32 2>/dev/null || head -c 32 /dev/urandom | xxd -p -c 32 2>/dev/null || true)"
|
||
OBF_KEY="$key"
|
||
fi
|
||
|
||
write_compose_file "$mode" "$prof" "$key" "$listen_val" "$connect_val"
|
||
|
||
if [ "$INSTALL_FREETURN" = "1" ]; then
|
||
if [ "$_IS_RPC" = 1 ]; then
|
||
docker pull "${IMAGE}:$(image_tag)" >/dev/null 2>&1 || true
|
||
else
|
||
ui_spin "Загрузка Docker-образа FreeTurn" docker pull "${IMAGE}:$(image_tag)" || true
|
||
fi
|
||
fi
|
||
|
||
if [ "$INSTALL_AWG" = "1" ]; then
|
||
ensure_awg_image
|
||
fi
|
||
|
||
if [ "$_IS_RPC" = 1 ]; then
|
||
( cd "$APP_DIR" && compose_cmd up -d >/dev/null 2>&1 ) \
|
||
|| fail compose_up_failed "docker compose up failed"
|
||
else
|
||
( cd "$APP_DIR" && ui_spin "Запуск служб" compose_cmd up -d ) || die "docker compose up не удался."
|
||
fi
|
||
healthcheck_docker
|
||
}
|
||
|
||
# Отдельно от apply_docker: частичное удаление обязано перегенерировать файл,
|
||
# иначе следующий `compose up` воскресит снесённый сервис.
|
||
write_compose_file() {
|
||
local mode="${1:-$PROXY_MODE}" prof="${2:-$OBF_PROFILE}" key="${3:-$OBF_KEY}"
|
||
local listen_val="${4:-0.0.0.0:${LISTEN_PORT}}" connect_val="${5:-$(connect_addr)}"
|
||
|
||
if [ "$INSTALL_FREETURN" != "1" ] && [ "$INSTALL_AWG" != "1" ]; then
|
||
rm -f "$COMPOSE_FILE"
|
||
return 0
|
||
fi
|
||
|
||
{
|
||
echo "services:"
|
||
if [ "$INSTALL_FREETURN" = "1" ]; then
|
||
echo " free-turn-proxy:"
|
||
echo " image: ${IMAGE}:$(image_tag)"
|
||
echo " container_name: ${CONTAINER}"
|
||
echo " network_mode: \"host\""
|
||
echo " restart: unless-stopped"
|
||
echo " environment:"
|
||
echo " - CONNECT_ADDR=${connect_val}"
|
||
echo " - LISTEN_ADDR=${listen_val}"
|
||
echo " - MODE=${mode}"
|
||
echo " - OBF_PROFILE=${prof}"
|
||
[ "$prof" != "none" ] && [ -n "$key" ] && echo " - OBF_KEY=${key}"
|
||
[ -n "${ARG_OBF_TIMING:-}" ] && echo " - OBF_TIMING=${ARG_OBF_TIMING}"
|
||
if [ -n "$CLIENTS_FILE_CONF" ]; then
|
||
local cdir; cdir="$(dirname "$CLIENTS_FILE_CONF")"
|
||
echo " - CLIENTS_FILE=${CLIENTS_FILE_CONF}"
|
||
echo " volumes:"
|
||
echo " - ${cdir}:${cdir}"
|
||
fi
|
||
fi
|
||
if [ "$INSTALL_AWG" = "1" ]; then
|
||
[ "$INSTALL_FREETURN" = "1" ] && echo ""
|
||
echo " freeturn-awg:"
|
||
echo " image: ${AWG_IMAGE}"
|
||
echo " container_name: ${AWG_CONTAINER}"
|
||
echo " network_mode: \"host\""
|
||
echo " environment:"
|
||
echo " - AWG_IFACE=${AWG_IFACE}"
|
||
echo " - AWG_CONF=/etc/awg/${AWG_IFACE}.conf"
|
||
echo " - AWG_LOG_LEVEL=${AWG_LOG_LEVEL:-error}"
|
||
echo " cap_add:"
|
||
echo " - NET_ADMIN"
|
||
echo " devices:"
|
||
echo " - /dev/net/tun"
|
||
echo " restart: unless-stopped"
|
||
echo " volumes:"
|
||
echo " - ${AWG_CONF}:/etc/awg/${AWG_IFACE}.conf:ro"
|
||
fi
|
||
} > "$COMPOSE_FILE"
|
||
chmod 0600 "$COMPOSE_FILE"
|
||
}
|
||
|
||
healthcheck_systemd() {
|
||
sleep 1
|
||
systemctl is-active --quiet "$SERVICE" && { log_success "Служба ${SERVICE} активна."; return 0; }
|
||
log_warn "Служба не активна. Логи:"
|
||
journalctl -u "$SERVICE" --no-pager -n 40 2>&1 || true
|
||
die "$SERVICE не запустилась."
|
||
}
|
||
|
||
apply_systemd() {
|
||
state_set runtime systemd
|
||
if [ "$INSTALL_FREETURN" = "1" ]; then
|
||
download_binary
|
||
init_clients_file
|
||
_write_args_file
|
||
_write_env_file
|
||
_install_systemd_unit
|
||
systemctl restart "$UNIT_NAME" || fail start_failed "systemctl restart failed"
|
||
healthcheck_systemd
|
||
else
|
||
systemctl disable --now "$UNIT_NAME" 2>/dev/null || true
|
||
fi
|
||
}
|
||
|
||
rt_start() {
|
||
local bin=${1:-}
|
||
case "$(current_runtime)" in
|
||
docker) apply_docker ;;
|
||
systemd)
|
||
_install_systemd_unit
|
||
_write_args_file
|
||
_write_env_file
|
||
systemctl restart "$UNIT_NAME" || fail start_failed "systemctl restart failed"
|
||
_wait_running || fail start_failed "server failed to start; journalctl -u $UNIT_NAME" ;;
|
||
nohup)
|
||
[ -z "$bin" ] && bin="$PREFIX/server"
|
||
[ -f "$PIDFILE" ] && _stop_nohup
|
||
_write_env_file
|
||
local args=(-listen "${ARG_LISTEN:-0.0.0.0:${LISTEN_PORT}}" -connect "${ARG_CONNECT:-$(connect_addr)}")
|
||
[ "${ARG_MODE:-$PROXY_MODE}" = "tcp" ] && args+=(-mode tcp ${ARG_KCP[@]+"${ARG_KCP[@]}"}) || args+=(-mode udp)
|
||
local prof="${ARG_OBF_PROFILE:-$OBF_PROFILE}" key="${ARG_OBF_KEY:-$OBF_KEY}"
|
||
if [ "$prof" != "none" ] && [ -z "$key" ]; then
|
||
key="$(openssl rand -hex 32 2>/dev/null || head -c 32 /dev/urandom | xxd -p -c 32 2>/dev/null || true)"
|
||
OBF_KEY="$key"
|
||
fi
|
||
[ "$prof" != "none" ] && [ -n "$key" ] && args+=(-obf-profile "$prof" -obf-key "$key")
|
||
[ -n "${ARG_OBF_TIMING:-}" ] && args+=(-obf-timing "$ARG_OBF_TIMING")
|
||
if [ -n "${ARG_CLIENT_ID:-}" ] || [ -n "${CLIENTS_FILE_CONF:-}" ]; then
|
||
args+=(-clients-file "${CLIENTS_FILE_CONF:-$CLIENTSFILE}")
|
||
fi
|
||
( cd "$PREFIX" && nohup "$bin" "${args[@]}" >"$LOGFILE" 2>&1 & echo $! > "$PIDFILE" )
|
||
sleep 1; kill -0 "$(<"$PIDFILE")" 2>/dev/null || fail start_failed "nohup start failed" ;;
|
||
*) fail start_failed "unknown runtime" ;;
|
||
esac
|
||
local pid; pid=$(rt_pid)
|
||
[ -n "$pid" ] && [ "$pid" != "0" ] && d_num pid "$pid"
|
||
}
|
||
|
||
firewall_open_port() {
|
||
local port=${1:-} proto=${2:-udp}
|
||
[[ "$port" =~ ^[0-9]+$ ]] || return 0
|
||
if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "Status: active"; then
|
||
ufw allow "${port}/${proto}" >/dev/null 2>&1 || true
|
||
elif command -v iptables >/dev/null 2>&1; then
|
||
if ! iptables -C INPUT -p "$proto" --dport "$port" -j ACCEPT 2>/dev/null; then
|
||
iptables -I INPUT -p "$proto" --dport "$port" -j ACCEPT 2>/dev/null || true
|
||
command -v netfilter-persistent >/dev/null 2>&1 && netfilter-persistent save >/dev/null 2>&1 || true
|
||
fi
|
||
fi
|
||
}
|
||
|
||
firewall_close_port() {
|
||
local port=${1:-} proto=${2:-udp}
|
||
[[ "$port" =~ ^[0-9]+$ ]] || return 0
|
||
if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "Status: active"; then
|
||
ufw delete allow "${port}/${proto}" >/dev/null 2>&1 || true
|
||
elif command -v iptables >/dev/null 2>&1; then
|
||
iptables -D INPUT -p "$proto" --dport "$port" -j ACCEPT 2>/dev/null || true
|
||
command -v netfilter-persistent >/dev/null 2>&1 && netfilter-persistent save >/dev/null 2>&1 || true
|
||
fi
|
||
}
|
||
|
||
firewall_open() {
|
||
if [ "$INSTALL_FREETURN" = "1" ]; then
|
||
firewall_open_port "$LISTEN_PORT" "udp"
|
||
[ "$PROXY_MODE" = "tcp" ] && firewall_open_port "$LISTEN_PORT" "tcp"
|
||
fi
|
||
if [ "$INSTALL_AWG" = "1" ] && [ "$AWG_DIRECT_PORT" = "1" ] && [ -n "$BACKEND_PORT" ]; then
|
||
firewall_open_port "$BACKEND_PORT" "udp"
|
||
fi
|
||
}
|
||
|
||
_bin_path() {
|
||
[ -x "$PREFIX/server" ] && { echo "$PREFIX/server"; return 0; }
|
||
local arch; arch=$(detect_arch) || arch=""
|
||
[ -n "$arch" ] && [ -x "$PREFIX/$arch" ] && { echo "$PREFIX/$arch"; return 0; }
|
||
}
|
||
|
||
_run_clients_cmd() {
|
||
local cfile="${CLIENTS_FILE_CONF:-$CLIENTSFILE}" bin; bin=$(_bin_path)
|
||
if [ -n "$bin" ] && [ -x "$bin" ]; then
|
||
CLIENTS_FILE="$cfile" "$bin" clients "$@"
|
||
return $?
|
||
fi
|
||
if [ "$(docker inspect -f '{{.State.Running}}' "$CONTAINER" 2>/dev/null || echo false)" = "true" ]; then
|
||
docker exec -i "$CONTAINER" env CLIENTS_FILE="$cfile" /app/server clients "$@"
|
||
return $?
|
||
fi
|
||
return 1
|
||
}
|
||
|
||
clients_add() {
|
||
_run_clients_cmd add "$1" "$2" >/dev/null 2>&1 || {
|
||
[ "$_IS_RPC" = 1 ] && fail clients_cmd_failed "clients add failed" || log_warn "Не удалось добавить в clients.json"
|
||
}
|
||
}
|
||
|
||
clients_remove_soft() {
|
||
_run_clients_cmd remove "$1" >/dev/null 2>&1 || true
|
||
}
|
||
|
||
clients_json() {
|
||
local cfile="${CLIENTS_FILE_CONF:-$CLIENTSFILE}" owner="" mapped="" f out="" first=1 line id comment el
|
||
[ -f "$OWNERCIDFILE" ] && owner=$(tr -d ' \r\n' < "$OWNERCIDFILE")
|
||
if [ -d "$SHARE_DIR" ]; then
|
||
for f in "$SHARE_DIR"/*.cid; do
|
||
[ -f "$f" ] && mapped="$mapped $(tr -d ' \r\n' < "$f")"
|
||
done
|
||
fi
|
||
|
||
local raw; raw=$(_run_clients_cmd list 2>/dev/null) || { printf '[]'; return 0; }
|
||
|
||
while IFS= read -r line; do
|
||
case "$line" in " - "*) ;; *) continue ;; esac
|
||
id=${line#" - "}; id=${id%% *}
|
||
[ -n "$id" ] || continue
|
||
[ "$id" = "$owner" ] && continue
|
||
case " $mapped " in *" $id "*) continue ;; esac
|
||
comment=$(printf '%s' "$line" | sed -nE 's/^ - [^ ]+ \(Comment: (.*)\)$/\1/p')
|
||
el="{\"id\":\"$(esc "$id")\""
|
||
[ -n "$comment" ] && el="$el,\"name_b64\":\"$(printf '%s' "$comment" | base64 | tr -d '\r\n')\""
|
||
el="$el}"
|
||
[ "$first" = 1 ] && first=0 || out="$out,"
|
||
out="$out$el"
|
||
done <<< "$raw"
|
||
printf '[%s]' "$out"
|
||
}
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# Обработчики команд JSON RPC v2, CLI управления клиентами и интерактивных мастеров.
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# JSON RPC v2 парсер и команды
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
ARG_LISTEN="" ARG_CONNECT="" ARG_MODE="" ARG_KCP=() ARG_OBF_PROFILE=""
|
||
ARG_OBF_KEY="" ARG_OBF_TIMING="" ARG_TAIL=80 ARG_WG_PORT="" ARG_WG_ENDPOINT=""
|
||
ARG_NAME_B64="" ARG_PUBKEY="" ARG_CLIENT_ID="" ARG_SHA256="" ARG_DNS="1.1.1.1"
|
||
ARG_WITH_WG_PKG=0 ARG_DRY_RUN=0 ARG_TARGET="all"
|
||
|
||
parse_rpc_args() {
|
||
while [ $# -gt 0 ]; do
|
||
case "$1" in
|
||
--listen=*) ARG_LISTEN="${1#*=}" ;;
|
||
--connect=*) ARG_CONNECT="${1#*=}" ;;
|
||
--mode=*) ARG_MODE="${1#*=}" ;;
|
||
--obf-profile=*) ARG_OBF_PROFILE="${1#*=}" ;;
|
||
--obf-timing=*) ARG_OBF_TIMING="${1#*=}" ;;
|
||
--obf-key=*) ARG_OBF_KEY="${1#*=}" ;;
|
||
--tail=*) ARG_TAIL="${1#*=}" ;;
|
||
--port=*) ARG_WG_PORT="${1#*=}" ;;
|
||
--endpoint=*) ARG_WG_ENDPOINT="${1#*=}" ;;
|
||
--name-b64=*) ARG_NAME_B64="${1#*=}" ;;
|
||
--pubkey=*) ARG_PUBKEY="${1#*=}" ;;
|
||
--client-id=*) ARG_CLIENT_ID="${1#*=}" ;;
|
||
--sha256=*) ARG_SHA256="${1#*=}" ;;
|
||
--dns=*) ARG_DNS="${1#*=}" ;;
|
||
--target=*) ARG_TARGET="${1#*=}" ;;
|
||
--with-wg-pkg) ARG_WITH_WG_PKG=1 ;;
|
||
--dry-run) ARG_DRY_RUN=1 ;;
|
||
--kcp-acknodelay=*) ARG_KCP+=("-kcp-acknodelay=${1#*=}") ;;
|
||
--kcp-*) ARG_KCP+=("-${1%%=*}" "${1#*=}") ;;
|
||
*) fail bad_arg "unknown arg: $1" ;;
|
||
esac
|
||
shift
|
||
done
|
||
}
|
||
|
||
cmd_probe() {
|
||
stage probe
|
||
local arch bin="" installed=false running=false version="" sha="" obf="none" mode="udp"
|
||
arch=$(detect_arch) || arch=""
|
||
[ -n "$arch" ] && [ -x "$PREFIX/$arch" ] && bin="$PREFIX/$arch"
|
||
[ -z "$bin" ] && [ -x "$PREFIX/server" ] && bin="$PREFIX/server"
|
||
|
||
if [ -n "$bin" ]; then
|
||
installed=true
|
||
sha=$(sha256sum "$bin" 2>/dev/null | awk '{print $1}' || true)
|
||
[ -f "$VERFILE" ] && version=$(cat "$VERFILE" 2>/dev/null || true)
|
||
elif [ -f "$COMPOSE_FILE" ]; then
|
||
installed=true; version="docker"
|
||
fi
|
||
|
||
local runtime; runtime=$(current_runtime)
|
||
if rt_running; then
|
||
running=true
|
||
local cmdline; cmdline=$(current_cmdline)
|
||
if [ -n "$cmdline" ]; then
|
||
obf=$(printf '%s' "$cmdline" | sed -nE 's/.*-obf-profile[= ]+([a-z0-9]+).*/\1/p'); obf=${obf:-none}
|
||
mode=$(printf '%s' "$cmdline" | sed -nE 's/.*-mode[= ]+(udp|tcp).*/\1/p'); mode=${mode:-udp}
|
||
elif [ "$runtime" = "docker" ]; then
|
||
load_config; obf="${OBF_PROFILE:-none}"; mode="${PROXY_MODE:-udp}"
|
||
fi
|
||
fi
|
||
|
||
local wgpresent=false wgp=""
|
||
if awg_present; then wgpresent=true; wgp=$(awg_port)
|
||
elif wg_present; then wgpresent=true; wgp=$(wg_port); fi
|
||
|
||
local virt wgkernel=false
|
||
virt=$(detect_virt)
|
||
if wg_kernel_ok; then wgkernel=true; fi
|
||
|
||
local cw=false cx=false cwe=false cts=false
|
||
if conflict_warp; then cw=true; fi
|
||
if conflict_x3ui; then cx=true; fi
|
||
if conflict_wgeasy; then cwe=true; fi
|
||
if conflict_tailscale; then cts=true; fi
|
||
|
||
d_bool installed "$installed"
|
||
[ -n "$version" ] && d_str version "$version"
|
||
[ -n "$sha" ] && d_str bin_sha256 "$sha"
|
||
d_bool running "$running"
|
||
[ "$running" = true ] && { d_str mode "$mode"; d_str obf "$obf"; }
|
||
d_str runtime "$runtime"
|
||
d_num euid "$(id -u 2>/dev/null || echo -1)"
|
||
[ -n "$wgp" ] && d_raw wg "{\"present\":$wgpresent,\"port\":$wgp}" || d_raw wg "{\"present\":$wgpresent,\"port\":null}"
|
||
d_str virt "$virt"
|
||
d_bool wg_kernel "$wgkernel"
|
||
d_raw conflicts "{\"warp\":$cw,\"x3ui\":$cx,\"wgeasy\":$cwe,\"tailscale\":$cts,\"other_ifaces\":[$(other_wg_ifaces_csv)]}"
|
||
ok
|
||
}
|
||
|
||
cmd_wg_setup() {
|
||
stage wg_setup
|
||
[ -n "$ARG_WG_PORT" ] || fail bad_arg "--port required"
|
||
[ -n "$ARG_WG_ENDPOINT" ] || fail bad_arg "--endpoint required"
|
||
[ "$(id -u 2>/dev/null || echo -1)" -eq 0 ] || fail needs_root "root required"
|
||
with_lock
|
||
|
||
BACKEND_PORT="$ARG_WG_PORT"
|
||
WG_ENDPOINT="$ARG_WG_ENDPOINT"
|
||
awg_bootstrap
|
||
local port; port=$(awg_port); [ -n "$port" ] || port="$ARG_WG_PORT"
|
||
local existed=false; awg_present && existed=true
|
||
d_raw wg "{\"port\":$port,\"existed\":$existed}"
|
||
ok
|
||
}
|
||
|
||
cmd_install() {
|
||
stage install
|
||
[ "$(id -u 2>/dev/null || echo -1)" -eq 0 ] || fail needs_root "root required"
|
||
mkdir -p "$PREFIX" || fail not_writable "cannot create $PREFIX"
|
||
|
||
local name bin latest_url asset_url tmp ver curver="" cached=0
|
||
name=$(detect_arch) || fail unsupported_arch "unsupported arch: $(uname -m)"
|
||
bin="$PREFIX/$name"
|
||
latest_url="$BASE_URL/$name"
|
||
[ -f "$VERFILE" ] && curver=$(cat "$VERFILE" 2>/dev/null || true)
|
||
|
||
ver=$(_resolve_version "$latest_url")
|
||
if [ -z "$ver" ]; then
|
||
if [ -x "$bin" ] || [ -x "$PREFIX/server" ]; then ver="${curver:-installed}"; cached=1
|
||
else fail version_resolve_failed "cannot resolve latest version"; fi
|
||
elif [ -x "$bin" ] && [ "$ver" = "$curver" ]; then cached=1; fi
|
||
|
||
asset_url="$RELEASES_URL/download/$ver/$name"
|
||
if [ "$cached" = 0 ]; then
|
||
tmp=$(mktemp "$bin.XXXXXX" 2>/dev/null) || tmp="$bin.new.$$"
|
||
_dl "$asset_url" "$tmp" || _dl "$latest_url" "$tmp" || { rm -f "$tmp"; fail download_failed "download failed"; }
|
||
_verify_download "$tmp" "$ARG_SHA256"
|
||
chmod 0755 "$tmp"
|
||
with_lock
|
||
[ -f "$bin" ] && cp -f "$bin" "$bin.bak" 2>/dev/null || true
|
||
mv -f "$tmp" "$bin"
|
||
cp -f "$bin" "$PREFIX/server" 2>/dev/null || true
|
||
echo "$ver" > "$VERFILE"
|
||
fi
|
||
|
||
local was_running=false; rt_running && was_running=true
|
||
if has_systemd; then _install_systemd_unit; state_set runtime systemd
|
||
else state_set runtime nohup; fi
|
||
|
||
d_str stage "$([ "$cached" = 1 ] && echo cached || echo downloaded)"
|
||
d_str bin "$name"
|
||
d_str version "$ver"
|
||
d_str runtime "$(current_runtime)"
|
||
d_bool needs_restart "$([ "$was_running" = true ] && [ "$cached" = 0 ] && echo true || echo false)"
|
||
ok
|
||
}
|
||
|
||
cmd_start() {
|
||
stage start
|
||
[ -n "$ARG_LISTEN" ] || fail bad_arg "--listen required"
|
||
[ -n "$ARG_CONNECT" ] || fail bad_arg "--connect required"
|
||
load_config
|
||
with_lock
|
||
|
||
if [ -n "$ARG_CLIENT_ID" ]; then
|
||
init_clients_file
|
||
clients_add "$ARG_CLIENT_ID" "owner"
|
||
printf '%s\n' "$ARG_CLIENT_ID" > "$OWNERCIDFILE"; chmod 0600 "$OWNERCIDFILE"
|
||
fi
|
||
|
||
local port proto=udp owner opid; port=${ARG_LISTEN##*:}
|
||
[ "${ARG_MODE:-$PROXY_MODE}" = "tcp" ] && proto=tcp
|
||
if [[ "$port" =~ ^[0-9]+$ ]]; then
|
||
owner=$(port_owner "$proto" "$port")
|
||
case "$owner" in
|
||
free|unknown) : ;;
|
||
*) opid=$(port_pid "$proto" "$port")
|
||
[ -n "$opid" ] && ! pid_is_ours "$opid" && fail listen_port_busy "$proto port $port busy" ;;
|
||
esac
|
||
firewall_open_port "$port" "$proto"
|
||
fi
|
||
|
||
rt_stop
|
||
rt_start
|
||
ok
|
||
}
|
||
|
||
cmd_stop() { stage stop; with_lock; rt_stop; d_bool stopped true; ok; }
|
||
|
||
cmd_logs() {
|
||
stage logs
|
||
case "$(current_runtime)" in
|
||
docker)
|
||
command -v docker >/dev/null 2>&1 && while IFS= read -r l; do log "$l"; done < <(docker logs --tail "$ARG_TAIL" "$CONTAINER" 2>&1 || true) ;;
|
||
systemd)
|
||
command -v journalctl >/dev/null 2>&1 && while IFS= read -r l; do log "$l"; done < <(journalctl -u "$UNIT_NAME" -n "$ARG_TAIL" --no-pager 2>/dev/null || true) ;;
|
||
nohup)
|
||
[ -f "$LOGFILE" ] && while IFS= read -r l; do log "$l"; done < <(tail -n "$ARG_TAIL" "$LOGFILE") ;;
|
||
esac
|
||
ok
|
||
}
|
||
|
||
cmd_share_info() {
|
||
stage share_info
|
||
load_config
|
||
local backend=false
|
||
if awg_present || { wg_present && wg_is_ours; }; then
|
||
backend=true
|
||
fi
|
||
d_bool wg_backend "$backend"
|
||
d_str mode "${PROXY_MODE:-udp}"
|
||
d_str obf_profile "${OBF_PROFILE:-none}"
|
||
if [ -n "${OBF_KEY:-}" ]; then d_str obf_key "$OBF_KEY"; fi
|
||
if awg_present; then d_str backend_type "awg"; fi
|
||
ok
|
||
}
|
||
|
||
cmd_share_list() {
|
||
stage share_list
|
||
d_raw peers "$(peers_json)"
|
||
local cj; cj=$(clients_json) || fail clients_cmd_failed "clients list failed"
|
||
d_raw clients "$cj"
|
||
ok
|
||
}
|
||
|
||
cmd_peer_add() {
|
||
stage peer_add
|
||
[ -n "$ARG_NAME_B64" ] || fail bad_arg "--name-b64 required"
|
||
[ -n "$ARG_WG_ENDPOINT" ] || fail bad_arg "--endpoint required"
|
||
with_lock
|
||
mkdir -p "$SHARE_DIR" "$CLIENTS_DIR"
|
||
|
||
[ -n "$ARG_CLIENT_ID" ] && clients_add "$ARG_CLIENT_ID" "$(printf '%s' "$ARG_NAME_B64" | base64 -d 2>/dev/null || echo "client")"
|
||
with_peers_lock
|
||
|
||
local cname; cname="$(printf '%s' "$ARG_NAME_B64" | base64 -d 2>/dev/null || echo "client")"
|
||
init_awg_params
|
||
local cli_ip; cli_ip=$(alloc_client_ip "$AWG_CONF" "$AWG_NET")
|
||
|
||
local kp cli_priv cli_pub srv_pub
|
||
kp="$(generate_awg_keypair)"; cli_priv="${kp%% *}"; cli_pub="${kp##* }"
|
||
srv_pub=$(cat "${AWG_DIR}/server.pub" 2>/dev/null || true)
|
||
|
||
cat >> "$AWG_CONF" <<EOF
|
||
|
||
[Peer]
|
||
# ft-user: ${ARG_NAME_B64}
|
||
# client: ${cname}
|
||
PublicKey = ${cli_pub}
|
||
AllowedIPs = ${cli_ip}/32
|
||
EOF
|
||
awg_reconcile
|
||
|
||
local stored="$SHARE_DIR/$(_pub_fs "$cli_pub").conf"
|
||
( umask 077
|
||
cat > "$stored" <<EOF
|
||
[Interface]
|
||
Address = ${cli_ip}/32
|
||
DNS = ${ARG_DNS:-1.1.1.1}
|
||
PrivateKey = ${cli_priv}
|
||
Jc = ${AWG_JC}
|
||
Jmin = ${AWG_JMIN}
|
||
Jmax = ${AWG_JMAX}
|
||
S1 = ${AWG_S1}
|
||
S2 = ${AWG_S2}
|
||
S3 = ${AWG_S3}
|
||
S4 = ${AWG_S4}
|
||
H1 = ${AWG_H1}
|
||
H2 = ${AWG_H2}
|
||
H3 = ${AWG_H3}
|
||
H4 = ${AWG_H4}
|
||
HeaderProtectionKey = ${AWG_HPK}
|
||
ContentPaddingAddition = 10
|
||
RekeyAfterTime = 110
|
||
RekeyTimeout = 5
|
||
RejectAfterTime = 160
|
||
KeepaliveTimeout = 10
|
||
MaxHandshakeAttempts = 15
|
||
RandomTrailers = on
|
||
DisableCookies = on
|
||
|
||
[Peer]
|
||
PublicKey = ${srv_pub}
|
||
AllowedIPs = 0.0.0.0/0, ::/0
|
||
Endpoint = ${ARG_WG_ENDPOINT}
|
||
PersistentKeepalive = 25
|
||
EOF
|
||
)
|
||
|
||
[ -n "$ARG_CLIENT_ID" ] && { printf '%s\n' "$ARG_CLIENT_ID" > "$SHARE_DIR/$(_pub_fs "$cli_pub").cid"; d_str client_id "$ARG_CLIENT_ID"; }
|
||
d_raw peer "{\"pub\":\"$(esc "$cli_pub")\",\"ip\":\"$(esc "$cli_ip")\"}"
|
||
d_str client_conf_b64 "$(base64 < "$stored" | tr -d '\n')"
|
||
ok
|
||
}
|
||
|
||
cmd_peer_conf() {
|
||
stage peer_conf
|
||
[ -n "$ARG_PUBKEY" ] || fail bad_arg "--pubkey required"
|
||
local stored="$SHARE_DIR/$(_pub_fs "$ARG_PUBKEY").conf"
|
||
[ -f "$stored" ] || fail no_stored_conf "conf not found"
|
||
local cidfile="$SHARE_DIR/$(_pub_fs "$ARG_PUBKEY").cid"
|
||
[ -f "$cidfile" ] && d_str client_id "$(cat "$cidfile" | tr -d ' \r\n')"
|
||
d_str client_conf_b64 "$(base64 < "$stored" | tr -d '\n')"
|
||
ok
|
||
}
|
||
|
||
cmd_peer_remove() {
|
||
stage peer_remove
|
||
[ -n "$ARG_PUBKEY" ] || fail bad_arg "--pubkey required"
|
||
with_lock
|
||
|
||
local target_conf=""
|
||
[ -f "$AWG_CONF" ] && target_conf="$AWG_CONF"
|
||
[ -z "$target_conf" ] && wg_present && target_conf="$WG_CONF"
|
||
[ -z "$target_conf" ] && fail no_wg_backend "no managed vpn backend"
|
||
|
||
local cidfile="$SHARE_DIR/$(_pub_fs "$ARG_PUBKEY").cid"
|
||
[ -f "$cidfile" ] && { clients_remove_soft "$(cat "$cidfile" | tr -d ' \r\n')"; rm -f "$cidfile"; }
|
||
|
||
with_peers_lock
|
||
local tmp="$target_conf.tmp"
|
||
awk -v key="$ARG_PUBKEY" '
|
||
function flushbuf() { for (j = 0; j < n; j++) print buf[j]; n = 0 }
|
||
/^[ \t]*\[/ { if (insec) { if (drop) n = 0; flushbuf() }; insec = 1; drop = 0; buf[n++] = $0; next }
|
||
{ if (!insec) { print; next }; buf[n++] = $0; line = $0; gsub(/[ \t\r]/, "", line); if (line == "PublicKey=" key) drop = 1 }
|
||
END { if (insec) { if (drop) n = 0; flushbuf() } }
|
||
' "$target_conf" > "$tmp" 2>/dev/null || rm -f "$tmp"
|
||
if [ -s "$tmp" ]; then
|
||
chmod 0600 "$tmp"; mv -f "$tmp" "$target_conf"
|
||
awg_reconcile; wg_reconcile
|
||
fi
|
||
rm -f "$tmp" "$SHARE_DIR/$(_pub_fs "$ARG_PUBKEY").conf"
|
||
d_bool removed true
|
||
ok
|
||
}
|
||
|
||
cmd_client_add() {
|
||
stage client_add
|
||
[ -n "$ARG_CLIENT_ID" ] || fail bad_arg "--client-id required"
|
||
[ -n "$ARG_NAME_B64" ] || fail bad_arg "--name-b64 required"
|
||
with_lock
|
||
clients_add "$ARG_CLIENT_ID" "$(printf '%s' "$ARG_NAME_B64" | base64 -d 2>/dev/null || echo "$ARG_CLIENT_ID")"
|
||
ok
|
||
}
|
||
|
||
cmd_client_remove() {
|
||
stage client_remove
|
||
[ -n "$ARG_CLIENT_ID" ] || fail bad_arg "--client-id required"
|
||
with_lock
|
||
clients_remove_soft "$ARG_CLIENT_ID"
|
||
ok
|
||
}
|
||
|
||
awg_conf_mtu() {
|
||
local v
|
||
v=$(sed -n "/^[[:space:]]*\[[pP][eE][eE][rR]\]/q; s/^[[:space:]]*MTU[[:space:]]*=[[:space:]]*//Ip" "$AWG_CONF" 2>/dev/null \
|
||
| head -n1 | sed 's/[#;].*//' | tr -d ' \r')
|
||
case "$v" in ''|*[!0-9]*) v="$AWG_MTU_DEFAULT" ;; esac
|
||
echo "$v"
|
||
}
|
||
|
||
# start.sh контейнера AWG пишет правила в host netns (network_mode: host) - убирать за ним.
|
||
awg_firewall_cleanup() {
|
||
command -v iptables >/dev/null 2>&1 || return 0
|
||
# MSS берём из того же conf, что и start.sh, иначе -D не совпадёт с поставленным правилом.
|
||
local wan mss=$(( $(awg_conf_mtu) - 40 ))
|
||
wan=$(ip route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<NF;i++) if($i=="dev"){print $(i+1); exit}}' || true)
|
||
iptables -D FORWARD -i "$AWG_IFACE" -j ACCEPT 2>/dev/null || true
|
||
iptables -D FORWARD -o "$AWG_IFACE" -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || true
|
||
iptables -t mangle -D FORWARD -o "$AWG_IFACE" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss "$mss" 2>/dev/null || true
|
||
[ -n "$wan" ] || return 0
|
||
iptables -t nat -D POSTROUTING -s "${AWG_NET}.0/24" -o "$wan" -j MASQUERADE 2>/dev/null || true
|
||
iptables -t mangle -D FORWARD -o "$wan" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null || true
|
||
}
|
||
|
||
do_uninstall() {
|
||
local target=${1:-all} purge=${2:-0}
|
||
load_config
|
||
apply_overrides # load_config перечитал install.conf - вернуть флаги CLI поверх него
|
||
with_lock
|
||
|
||
case "$target" in
|
||
freeturn)
|
||
log_info "Удаление FreeTurn..."
|
||
if [ -f "$COMPOSE_FILE" ] && command -v docker >/dev/null 2>&1; then
|
||
docker stop "$CONTAINER" >/dev/null 2>&1 || true
|
||
docker rm -f "$CONTAINER" >/dev/null 2>&1 || true
|
||
fi
|
||
if has_systemd; then
|
||
systemctl disable --now "$SERVICE" >/dev/null 2>&1 || true
|
||
rm -f "$UNIT_FILE" "$LAUNCHER"; systemctl daemon-reload || true
|
||
fi
|
||
firewall_close_port "$LISTEN_PORT" "udp"
|
||
firewall_close_port "$LISTEN_PORT" "tcp"
|
||
INSTALL_FREETURN=0
|
||
[ -f "$COMPOSE_FILE" ] && write_compose_file
|
||
save_config
|
||
log_success "FreeTurn удалён. AmneziaWG остался активен."
|
||
;;
|
||
awg)
|
||
log_info "Удаление AmneziaWG / WireGuard..."
|
||
if [ -f "$COMPOSE_FILE" ] && command -v docker >/dev/null 2>&1; then
|
||
docker stop "$AWG_CONTAINER" >/dev/null 2>&1 || true
|
||
docker rm -f "$AWG_CONTAINER" >/dev/null 2>&1 || true
|
||
fi
|
||
if has_systemd; then
|
||
systemctl disable --now "wg-quick@${WG_IFACE}" >/dev/null 2>&1 || true
|
||
fi
|
||
awg_firewall_cleanup
|
||
firewall_close_port "$BACKEND_PORT" "udp"
|
||
rm -rf "$AWG_DIR"
|
||
stop_web_server
|
||
INSTALL_AWG=0
|
||
[ -f "$COMPOSE_FILE" ] && write_compose_file
|
||
save_config
|
||
log_success "AmneziaWG удалён. FreeTurn остался активен."
|
||
;;
|
||
all)
|
||
log_info "Полное удаление..."
|
||
rt_stop
|
||
if [ -f "$COMPOSE_FILE" ] && command -v docker >/dev/null 2>&1; then
|
||
( cd "$APP_DIR" && compose_cmd down -v ) >/dev/null 2>&1 || true
|
||
fi
|
||
if has_systemd; then
|
||
systemctl disable --now "$SERVICE" >/dev/null 2>&1 || true
|
||
systemctl disable --now "wg-quick@${WG_IFACE}" >/dev/null 2>&1 || true
|
||
rm -f "$UNIT_FILE" "$LAUNCHER"
|
||
systemctl daemon-reload || true
|
||
fi
|
||
firewall_close_port "$LISTEN_PORT" "udp"
|
||
firewall_close_port "$LISTEN_PORT" "tcp"
|
||
[ -n "$BACKEND_PORT" ] && firewall_close_port "$BACKEND_PORT" "udp"
|
||
awg_firewall_cleanup
|
||
stop_web_server
|
||
rm -f "$COMPOSE_FILE" /etc/sysctl.d/99-free-turn-proxy.conf
|
||
if [ "$purge" = "1" ] || [ "$PURGE" = "1" ]; then
|
||
rm -rf "$APP_DIR"
|
||
rm -f /usr/local/bin/freeturn /usr/local/bin/free-turn-proxy 2>/dev/null || true
|
||
log_success "Каталог $APP_DIR полностью удалён."
|
||
fi
|
||
log_success "Все компоненты удалены."
|
||
;;
|
||
esac
|
||
}
|
||
|
||
cmd_uninstall() {
|
||
stage uninstall
|
||
[ "$(id -u 2>/dev/null || echo -1)" -eq 0 ] || fail needs_root "root required"
|
||
do_uninstall "${ARG_TARGET:-all}" "$ARG_WITH_WG_PKG"
|
||
d_str target "${ARG_TARGET:-all}"
|
||
d_bool uninstalled true
|
||
ok
|
||
}
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# Веб-сервер раздачи файлов клиентов и QR-кодов
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# Секрет живёт столько же, сколько установка: ссылки, выданные раньше, не должны протухать.
|
||
# Токен читается заново в каждом $(...) - subshell не вернёт кэш. Поэтому он обязан
|
||
# лечь на диск: незаписанный токен = новая ссылка на каждый вызов, т.е. нерабочая ссылка.
|
||
web_token() {
|
||
if [ -s "$WEB_TOKEN_FILE" ]; then
|
||
tr -d ' \r\n' < "$WEB_TOKEN_FILE"
|
||
return 0
|
||
fi
|
||
local tok
|
||
tok=$(openssl rand -hex 16 2>/dev/null || head -c 16 /dev/urandom | od -An -tx1 | tr -d ' \n')
|
||
[ -n "$tok" ] || return 1
|
||
mkdir -p "$PREFIX" 2>/dev/null || true
|
||
printf '%s\n' "$tok" > "$WEB_TOKEN_FILE" 2>/dev/null || return 1
|
||
chmod 0600 "$WEB_TOKEN_FILE" 2>/dev/null || true
|
||
printf '%s' "$tok"
|
||
}
|
||
|
||
# Токен на клиента, а не один на всех: ссылка на 'phone' не должна открывать конфиги 'laptop'.
|
||
# Выводится из мастер-секрета, поэтому отдельного состояния на клиента хранить не надо.
|
||
client_token() {
|
||
local master h; master=$(web_token) || return 1
|
||
h=$(printf '%s:%s' "$master" "$1" | sha256sum 2>/dev/null | awk '{print $1}')
|
||
[ -n "$h" ] || h=$(printf '%s:%s' "$master" "$1" | openssl dgst -sha256 2>/dev/null | awk '{print $NF}')
|
||
case "$h" in [0-9a-f][0-9a-f]*) ;; *) return 1 ;; esac
|
||
printf '%s' "${h:0:32}"
|
||
}
|
||
|
||
web_base_url() {
|
||
local tok; tok=$(client_token "$2") || return 1
|
||
printf 'http://%s:%s/%s' "$1" "${FT_WEB_PORT:-8080}" "$tok"
|
||
}
|
||
|
||
# docroot отдаёт только index.html; каталог клиента - за симлинком с именем-секретом.
|
||
_web_layout() {
|
||
local master; master=$(web_token) || { log_warn "Не удалось сохранить $WEB_TOKEN_FILE - веб-раздача выключена."; return 1; }
|
||
mkdir -p "$WEB_ROOT" "$CLIENTS_DIR" 2>/dev/null || return 1
|
||
chmod 0755 "$WEB_ROOT" 2>/dev/null || true
|
||
chmod 0700 "$CLIENTS_DIR" 2>/dev/null || true
|
||
printf '<!doctype html><title>freeturn</title>\n' > "$WEB_ROOT/index.html"
|
||
chmod 0644 "$WEB_ROOT/index.html" 2>/dev/null || true
|
||
# Пустой маяк на неугадываемом имени: по нему _web_listening узнаёт свой сервер.
|
||
: > "$WEB_ROOT/${master}${WEB_PROBE_EXT}"
|
||
chmod 0644 "$WEB_ROOT/${master}${WEB_PROBE_EXT}" 2>/dev/null || true
|
||
|
||
local keep=" " name tok link
|
||
while IFS='|' read -r name _; do
|
||
[ -n "$name" ] && [ -d "${CLIENTS_DIR}/${name}" ] || continue
|
||
tok=$(client_token "$name") || continue
|
||
ln -sfn "${CLIENTS_DIR}/${name}" "$WEB_ROOT/$tok" 2>/dev/null || return 1
|
||
keep="${keep}${tok} "
|
||
done < <(cat "$CLIENTS_META" 2>/dev/null)
|
||
|
||
for link in "$WEB_ROOT"/*; do
|
||
[ -L "$link" ] || continue
|
||
case "$keep" in *" ${link##*/} "*) ;; *) rm -f "$link" ;; esac
|
||
done
|
||
return 0
|
||
}
|
||
|
||
_web_systemd_active() {
|
||
has_systemd && systemctl is-active --quiet "${WEB_UNIT}.service" 2>/dev/null
|
||
}
|
||
|
||
# Пробой по маяку, а не по ss: ss может отсутствовать, и 200 на нём отдаём только мы -
|
||
# чужой слушатель на этом порту вернёт 404.
|
||
_web_listening() {
|
||
local i=${1:-1}
|
||
while :; do
|
||
curl -fsS --max-time 2 -o /dev/null "http://127.0.0.1:${FT_WEB_PORT:-8080}/$(web_token)${WEB_PROBE_EXT}" 2>/dev/null \
|
||
&& return 0
|
||
i=$((i - 1))
|
||
[ "$i" -le 0 ] && return 1
|
||
sleep 1
|
||
done
|
||
}
|
||
|
||
# Закрытие порта нужно уже вне этого скрипта (ExecStopPost юнита, детач-обёртка фоллбэка),
|
||
# поэтому строкой, а не функцией. Зеркалит firewall_open_port: ufw ИЛИ iptables, не оба,
|
||
# иначе снесём постоянное правило админа на этом порту. Пути абсолютные - PATH юнита чужой.
|
||
_web_close_cmd() {
|
||
local port=$1 ufw_bin ipt_bin
|
||
ufw_bin=$(command -v ufw 2>/dev/null || true)
|
||
ipt_bin=$(command -v iptables 2>/dev/null || true)
|
||
if [ -n "$ufw_bin" ] && ufw status 2>/dev/null | grep -q "Status: active"; then
|
||
printf "%s delete allow %s/tcp >/dev/null 2>&1; exit 0" "$ufw_bin" "$port"
|
||
elif [ -n "$ipt_bin" ]; then
|
||
printf "%s -D INPUT -p tcp --dport %s -j ACCEPT >/dev/null 2>&1; exit 0" "$ipt_bin" "$port"
|
||
else
|
||
printf "exit 0"
|
||
fi
|
||
}
|
||
|
||
# Чем поднимать раздачу, по одному аргументу на строку. Оба сервера отдают файлы через
|
||
# симлинк docroot и режут traversal; busybox идёт вторым, т.к. не умеет листинг каталога.
|
||
# Ставить python3 пакетом - только если нет ни того, ни другого.
|
||
_web_server_argv() {
|
||
local port=$1
|
||
if command -v python3 >/dev/null 2>&1; then
|
||
printf '%s\n' python3 -m http.server "$port" --directory "$WEB_ROOT"
|
||
elif command -v busybox >/dev/null 2>&1; then
|
||
printf '%s\n' busybox httpd -f -p "$port" -h "$WEB_ROOT"
|
||
else
|
||
pkg_install python3 >/dev/null 2>&1 || true
|
||
command -v python3 >/dev/null 2>&1 || return 1
|
||
printf '%s\n' python3 -m http.server "$port" --directory "$WEB_ROOT"
|
||
fi
|
||
}
|
||
|
||
# Транзиентный юнит: RuntimeMaxSec гасит сервер сам, ExecStopPost закрывает порт при любом
|
||
# исходе, включая SIGKILL. Файл юнита не создаётся, --collect убирает его после смерти.
|
||
_web_start_systemd() {
|
||
local port=$1 ttl=$2; shift 2
|
||
has_systemd || return 1
|
||
command -v systemd-run >/dev/null 2>&1 || return 1
|
||
systemd-run --collect --quiet --unit="$WEB_UNIT" \
|
||
--property=RuntimeMaxSec="$ttl" \
|
||
--property=WorkingDirectory="$WEB_ROOT" \
|
||
--property=ExecStopPost="/bin/sh -c \"$(_web_close_cmd "$port")\"" \
|
||
"$@" >/dev/null 2>&1
|
||
}
|
||
|
||
# Фоллбэк без systemd: одна отвязанная обёртка держит и таймер, и закрытие порта -
|
||
# отдельный сторож пришлось бы ждать через wait, а он потомок не наш.
|
||
_web_start_nohup() {
|
||
local port=$1 ttl=$2; shift 2
|
||
command -v timeout >/dev/null 2>&1 || return 1
|
||
local cmd; cmd=$(printf '%q ' "$@")
|
||
setsid nohup bash -c \
|
||
"timeout $ttl $cmd >>'$WEB_LOG' 2>&1; $(_web_close_cmd "$port")" \
|
||
>/dev/null 2>&1 &
|
||
_web_listening 8
|
||
}
|
||
|
||
ensure_web_server() {
|
||
local port="${FT_WEB_PORT:-8080}" ttl="${FT_WEB_TTL:-900}"
|
||
_web_layout || return 1
|
||
# Сервер ещё жив с прошлого вызова - правило в файрволе могли снести извне, вернуть.
|
||
if _web_systemd_active || _web_listening; then
|
||
firewall_open_port "$port" tcp
|
||
return 0
|
||
fi
|
||
|
||
local argv=()
|
||
while IFS= read -r a; do argv+=("$a"); done < <(_web_server_argv "$port")
|
||
[ "${#argv[@]}" -gt 0 ] || { log_warn "нет ни python3, ни busybox - веб-раздача выключена."; return 1; }
|
||
|
||
# Чужой слушатель на порту: выдавать его ответы за свои ссылки нельзя.
|
||
local owner; owner=$(port_owner tcp "$port")
|
||
case "$owner" in
|
||
free | unknown) ;;
|
||
*) log_warn "Порт ${port}/tcp занят процессом '${owner}' - веб-раздача выключена, задайте --web-port."
|
||
return 1 ;;
|
||
esac
|
||
|
||
firewall_open_port "$port" tcp
|
||
if _web_start_systemd "$port" "$ttl" "${argv[@]}"; then
|
||
_web_listening 8 && return 0
|
||
# Юнит есть, а сервера нет - снять, иначе фоллбэк не забиндит порт.
|
||
systemctl stop "${WEB_UNIT}.service" >/dev/null 2>&1 || true
|
||
fi
|
||
_web_start_nohup "$port" "$ttl" "${argv[@]}" && return 0
|
||
firewall_close_port "$port" tcp
|
||
log_warn "Не удалось поднять веб-раздачу."
|
||
return 1
|
||
}
|
||
|
||
stop_web_server() {
|
||
local port="${FT_WEB_PORT:-8080}"
|
||
has_systemd && systemctl stop "${WEB_UNIT}.service" >/dev/null 2>&1 || true
|
||
pkill -f "http\.server ${port} --directory ${WEB_ROOT}" >/dev/null 2>&1 || true
|
||
pkill -f "httpd -f -p ${port} -h ${WEB_ROOT}" >/dev/null 2>&1 || true
|
||
firewall_close_port "$port" tcp
|
||
rm -rf "$WEB_ROOT"
|
||
rm -f "$WEB_LOG"
|
||
}
|
||
|
||
show_client_links() {
|
||
local cname="$1" title="${2:-Клиент '$1' готов!}"
|
||
local cdir; cdir="$(client_dir "$cname")"
|
||
local ext_ip; ext_ip="$(get_public_ip)" || { log_error "Не удалось определить внешний IP."; return 1; }
|
||
if ! ensure_web_server; then
|
||
log_warn "Файлы клиента '${cname}' лежат в ${cdir}."
|
||
log_warn "Заберите их так: scp -r root@${ext_ip}:${cdir} ."
|
||
return 0
|
||
fi
|
||
local base_url; base_url="$(web_base_url "$ext_ip" "$cname")"
|
||
local ttl_min=$(( ${FT_WEB_TTL:-900} / 60 ))
|
||
# busybox httpd листинга не отдаёт - ссылку на каталог показываем, только если она рабочая.
|
||
local dir_ok=0
|
||
curl -fsS --max-time 2 -o /dev/null \
|
||
"http://127.0.0.1:${FT_WEB_PORT:-8080}/$(client_token "$cname")/" 2>/dev/null && dir_ok=1
|
||
|
||
local direct_png="${cdir}/${cname}-direct.png"
|
||
local ft_vpn_png="${cdir}/${cname}-freeturn-vpn.png"
|
||
local ft_png="${cdir}/${cname}-freeturn.png"
|
||
local relay_png="${cdir}/${cname}-relay.png"
|
||
|
||
echo
|
||
if [ "$HAS_GUM" = 1 ]; then
|
||
local lines=()
|
||
lines+=("$(gum style --foreground "$MD_SUCCESS" --bold "✔ ${title}")")
|
||
lines+=("")
|
||
lines+=("$(gum style --foreground "$MD_PRIMARY" --bold "Ссылки на QR-коды и конфиги:")")
|
||
[ -f "$direct_png" ] && lines+=(" • AmneziaWG Direct: ${base_url}/${cname}-direct.png")
|
||
[ -f "$ft_vpn_png" ] && lines+=(" • FreeTurn App (VPN): ${base_url}/${cname}-freeturn-vpn.png")
|
||
[ -f "$ft_png" ] && [ ! -f "$ft_vpn_png" ] && lines+=(" • FreeTurn App: ${base_url}/${cname}-freeturn.png")
|
||
[ -f "$relay_png" ] && lines+=(" • AmneziaWG Relay: ${base_url}/${cname}-relay.png")
|
||
[ "$dir_ok" = 1 ] && lines+=(" • Каталог файлов: ${base_url}/")
|
||
lines+=("")
|
||
lines+=("$(gum style --foreground "$MD_TERTIARY" "Раздача живёт ${ttl_min} мин, потом порт закрывается. Снова: freeturn client qr ${cname}")")
|
||
lines+=("$(gum style --foreground "$MD_TERTIARY" "Ссылка содержит приватные ключи '${cname}' - открыта всем, у кого она есть.")")
|
||
lines+=("$(gum style --foreground "$MD_SECONDARY" --italic "Скачать на ПК (SCP): scp -r root@${ext_ip}:${cdir} .")")
|
||
|
||
local body; body=$(printf '%s\n' "${lines[@]}")
|
||
gum style --border rounded --border-foreground "$MD_PRIMARY" --padding "1 2" "$body"
|
||
else
|
||
echo "========================================================"
|
||
echo " ${title}"
|
||
echo "========================================================"
|
||
[ -f "$direct_png" ] && echo " AmneziaWG Direct: ${base_url}/${cname}-direct.png"
|
||
[ -f "$ft_vpn_png" ] && echo " FreeTurn App (VPN): ${base_url}/${cname}-freeturn-vpn.png"
|
||
[ -f "$ft_png" ] && [ ! -f "$ft_vpn_png" ] && echo " FreeTurn App: ${base_url}/${cname}-freeturn.png"
|
||
[ -f "$relay_png" ] && echo " AmneziaWG Relay: ${base_url}/${cname}-relay.png"
|
||
[ "$dir_ok" = 1 ] && echo " Каталог файлов: ${base_url}/"
|
||
echo " Раздача живёт ${ttl_min} мин, потом порт закрывается (freeturn client qr ${cname})."
|
||
echo " ВНИМАНИЕ: ссылка содержит приватные ключи '${cname}' - открыта всем, у кого она есть."
|
||
echo " Скачать на ПК (SCP): scp -r root@${ext_ip}:${cdir} ."
|
||
echo "========================================================"
|
||
fi
|
||
}
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# CLI управление клиентами
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# Имя уходит в пути файлов - допускаем только безопасный алфавит (ни '/', ни ведущей точки).
|
||
valid_client_name() { [[ "$1" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$ ]]; }
|
||
|
||
client_dir() { printf '%s/%s' "$CLIENTS_DIR" "$1"; }
|
||
|
||
client_add() {
|
||
local cname="${1:-}" silent="${2:-0}"
|
||
mkdir -p "$CLIENTS_DIR" "$SHARE_DIR"; chmod 0700 "$CLIENTS_DIR" 2>/dev/null || true
|
||
local ext_ip; ext_ip="$(get_public_ip)" || die "Не удалось определить внешний IP сервера - конфиг клиента был бы нерабочим."
|
||
|
||
if [ -z "$cname" ]; then
|
||
local next_num=1
|
||
[ -f "$CLIENTS_META" ] && next_num="$(( $(wc -l < "$CLIENTS_META") + 1 ))"
|
||
while :; do
|
||
ui_input cname "Имя нового клиента" "client-${next_num}"
|
||
valid_client_name "$cname" && break
|
||
ui_note "Ошибка" "Имя: латиница, цифры, . _ - (до 32 символов). Получено: '$cname'"
|
||
done
|
||
fi
|
||
valid_client_name "$cname" || die "Недопустимое имя клиента: '$cname' (латиница, цифры, . _ -)"
|
||
awk -F'|' -v n="$cname" '$1 == n { found = 1 } END { exit !found }' "$CLIENTS_META" 2>/dev/null \
|
||
&& die "Клиент '$cname' уже существует."
|
||
|
||
local cdir; cdir="$(client_dir "$cname")"
|
||
mkdir -p "$cdir"; chmod 0700 "$cdir" 2>/dev/null || true
|
||
|
||
local cid=""
|
||
if [ "$INSTALL_FREETURN" = "1" ] && [ -n "$CLIENTS_FILE_CONF" ]; then
|
||
cid="$(openssl rand -hex 16)"
|
||
clients_add "$cid" "$cname"
|
||
fi
|
||
|
||
local direct_conf="" relay_conf="" ft_file="" client_ip=""
|
||
if [ "$INSTALL_AWG" = "1" ] && [ -f "$AWG_CONF" ]; then
|
||
init_awg_params
|
||
client_ip=$(alloc_client_ip "$AWG_CONF" "$AWG_NET")
|
||
|
||
local kp cli_priv cli_pub srv_pub
|
||
kp="$(generate_awg_keypair)"; cli_priv="${kp%% *}"; cli_pub="${kp##* }"
|
||
srv_pub="$(cat "${AWG_DIR}/server.pub" 2>/dev/null || true)"
|
||
|
||
cat >> "$AWG_CONF" <<EOF
|
||
|
||
[Peer]
|
||
# ft-user: $(printf '%s' "$cname" | base64 | tr -d '\r\n')
|
||
# client: ${cname}
|
||
PublicKey = ${cli_pub}
|
||
AllowedIPs = ${client_ip}/32
|
||
EOF
|
||
awg_reconcile
|
||
|
||
direct_conf="${cdir}/${cname}-direct.conf"
|
||
relay_conf="${cdir}/${cname}-relay.conf"
|
||
|
||
( umask 077
|
||
cat > "$direct_conf" <<EOF
|
||
[Interface]
|
||
Address = ${client_ip}/32
|
||
DNS = 1.1.1.1, 1.0.0.1
|
||
PrivateKey = ${cli_priv}
|
||
Jc = ${AWG_JC}
|
||
Jmin = ${AWG_JMIN}
|
||
Jmax = ${AWG_JMAX}
|
||
S1 = ${AWG_S1}
|
||
S2 = ${AWG_S2}
|
||
S3 = ${AWG_S3}
|
||
S4 = ${AWG_S4}
|
||
H1 = ${AWG_H1}
|
||
H2 = ${AWG_H2}
|
||
H3 = ${AWG_H3}
|
||
H4 = ${AWG_H4}
|
||
HeaderProtectionKey = ${AWG_HPK}
|
||
ContentPaddingAddition = 10
|
||
RekeyAfterTime = 110
|
||
RekeyTimeout = 5
|
||
RejectAfterTime = 160
|
||
KeepaliveTimeout = 10
|
||
MaxHandshakeAttempts = 15
|
||
RandomTrailers = on
|
||
DisableCookies = on
|
||
|
||
[Peer]
|
||
PublicKey = ${srv_pub}
|
||
AllowedIPs = 0.0.0.0/0, ::/0
|
||
Endpoint = ${ext_ip}:${BACKEND_PORT}
|
||
PersistentKeepalive = 25
|
||
EOF
|
||
)
|
||
|
||
( umask 077
|
||
cat > "$relay_conf" <<EOF
|
||
[Interface]
|
||
Address = ${client_ip}/32
|
||
DNS = 1.1.1.1, 1.0.0.1
|
||
PrivateKey = ${cli_priv}
|
||
Jc = ${AWG_JC}
|
||
Jmin = ${AWG_JMIN}
|
||
Jmax = ${AWG_JMAX}
|
||
S1 = ${AWG_S1}
|
||
S2 = ${AWG_S2}
|
||
S3 = ${AWG_S3}
|
||
S4 = ${AWG_S4}
|
||
H1 = ${AWG_H1}
|
||
H2 = ${AWG_H2}
|
||
H3 = ${AWG_H3}
|
||
H4 = ${AWG_H4}
|
||
HeaderProtectionKey = ${AWG_HPK}
|
||
ContentPaddingAddition = 10
|
||
RekeyAfterTime = 110
|
||
RekeyTimeout = 5
|
||
RejectAfterTime = 160
|
||
KeepaliveTimeout = 10
|
||
MaxHandshakeAttempts = 15
|
||
RandomTrailers = on
|
||
DisableCookies = on
|
||
|
||
[Peer]
|
||
PublicKey = ${srv_pub}
|
||
AllowedIPs = 0.0.0.0/0, ::/0
|
||
Endpoint = ${WG_ENDPOINT}
|
||
PersistentKeepalive = 25
|
||
EOF
|
||
)
|
||
cp -f "$direct_conf" "$SHARE_DIR/$(_pub_fs "$cli_pub").conf" 2>/dev/null || true
|
||
[ -n "$cid" ] && printf '%s\n' "$cid" > "$SHARE_DIR/$(_pub_fs "$cli_pub").cid" 2>/dev/null || true
|
||
local direct_png="${cdir}/${cname}-direct.png"
|
||
local relay_png="${cdir}/${cname}-relay.png"
|
||
generate_qr_png_file "$direct_conf" "$direct_png"
|
||
[ -f "$relay_conf" ] && generate_qr_png_file "$relay_conf" "$relay_png"
|
||
fi
|
||
|
||
local ft_uri="" ft_vpn_uri="" ft_png="" ft_vpn_png=""
|
||
if [ "$INSTALL_FREETURN" = "1" ]; then
|
||
ft_uri="$(generate_freeturn_uri "${ext_ip}:${LISTEN_PORT}" "${PROXY_MODE}" "${OBF_PROFILE}" "${OBF_KEY}" "${cid}" "${cname}")"
|
||
ft_file="${cdir}/${cname}-freeturn.txt"
|
||
ft_png="${cdir}/${cname}-freeturn.png"
|
||
echo "$ft_uri" > "$ft_file"; chmod 0600 "$ft_file"
|
||
generate_qr_png_text "$ft_uri" "$ft_png"
|
||
|
||
if [ -f "$relay_conf" ]; then
|
||
ft_vpn_uri="$(generate_freeturn_uri "${ext_ip}:${LISTEN_PORT}" "${PROXY_MODE}" "${OBF_PROFILE}" "${OBF_KEY}" "${cid}" "${cname}" "$(<"$relay_conf")")"
|
||
local ft_vpn_file="${cdir}/${cname}-freeturn-vpn.txt"
|
||
ft_vpn_png="${cdir}/${cname}-freeturn-vpn.png"
|
||
echo "$ft_vpn_uri" > "$ft_vpn_file"; chmod 0600 "$ft_vpn_file"
|
||
generate_qr_png_text "$ft_vpn_uri" "$ft_vpn_png"
|
||
fi
|
||
fi
|
||
|
||
echo "${cname}|${client_ip}|${cid}|$(date '+%Y-%m-%d %H:%M')" >> "$CLIENTS_META"
|
||
chmod 0600 "$CLIENTS_META" 2>/dev/null || true
|
||
|
||
# silent=1 - первый клиент в ходе установки: ссылки покажет print_summary.
|
||
if [ "$silent" = "1" ]; then
|
||
return 0
|
||
fi
|
||
|
||
log_success "Клиент '${cname}' добавлен!"
|
||
show_client_links "$cname" "Клиент '${cname}' готов!"
|
||
}
|
||
|
||
client_list() {
|
||
mkdir -p "$CLIENTS_DIR"
|
||
[ ! -s "$CLIENTS_META" ] && { log_warn "Список клиентов пуст."; return 0; }
|
||
echo
|
||
if [ "$HAS_GUM" = 1 ]; then
|
||
{ echo "ИМЯ,IP,CLIENT_ID,ДАТА"; while IFS='|' read -r name ip cid dt; do echo "${name},${ip:--},${cid:--},${dt}"; done < "$CLIENTS_META"; } \
|
||
| gum table --border rounded
|
||
else
|
||
printf "%-15s %-16s %-34s %s\n" "Имя" "IP" "Client ID" "Дата"
|
||
echo "-----------------------------------------------------------------------------"
|
||
while IFS='|' read -r name ip cid dt; do printf "%-15s %-16s %-34s %s\n" "$name" "${ip:--}" "${cid:--}" "$dt"; done < "$CLIENTS_META"
|
||
fi
|
||
}
|
||
|
||
client_resolve_name() {
|
||
local input="${1:-}"
|
||
[ -z "$input" ] && return 1
|
||
[ ! -s "$CLIENTS_META" ] && return 1
|
||
# 1. Точное совпадение
|
||
if awk -F'|' -v n="$input" '$1 == n { found = 1 } END { exit !found }' "$CLIENTS_META" 2>/dev/null; then
|
||
echo "$input"; return 0
|
||
fi
|
||
# 2. Совпадение без дефисов и подчеркиваний (например client1 -> client-1)
|
||
local clean_in; clean_in=$(printf '%s' "$input" | tr -d '-_')
|
||
local name
|
||
while IFS='|' read -r name _ _ _; do
|
||
local clean_name; clean_name=$(printf '%s' "$name" | tr -d '-_')
|
||
if [ "${clean_in,,}" = "${clean_name,,}" ]; then
|
||
echo "$name"; return 0
|
||
fi
|
||
done < "$CLIENTS_META"
|
||
# 3. Подстрока без учета регистра
|
||
while IFS='|' read -r name _ _ _; do
|
||
if [[ "${name,,}" == *"${input,,}"* ]]; then
|
||
echo "$name"; return 0
|
||
fi
|
||
done < "$CLIENTS_META"
|
||
return 1
|
||
}
|
||
|
||
client_qr() {
|
||
local cname="${1:-}"
|
||
if [ -z "$cname" ]; then
|
||
[ ! -s "$CLIENTS_META" ] && die "Нет клиентов."
|
||
local names=()
|
||
while IFS='|' read -r n _ _ _; do names+=("$n"); done < "$CLIENTS_META"
|
||
[ "$HAS_GUM" = 1 ] && cname=$(gum choose --header "Клиент:" "${names[@]}" </dev/tty) || ui_input cname "Имя" "${names[0]}"
|
||
else
|
||
local resolved; resolved=$(client_resolve_name "$cname" || true)
|
||
if [ -n "$resolved" ]; then
|
||
cname="$resolved"
|
||
else
|
||
log_error "Клиент '$cname' не найден."
|
||
echo
|
||
client_list
|
||
return 1
|
||
fi
|
||
fi
|
||
|
||
show_client_links "$cname" "Ссылки для клиента '${cname}'"
|
||
}
|
||
|
||
client_remove() {
|
||
local cname="${1:-}"
|
||
if [ -z "$cname" ]; then
|
||
[ ! -s "$CLIENTS_META" ] && die "Нет клиентов."
|
||
local names=()
|
||
while IFS='|' read -r n _ _ _; do names+=("$n"); done < "$CLIENTS_META"
|
||
[ "$HAS_GUM" = 1 ] && cname=$(gum choose --header "Удалить клиента:" "${names[@]}" </dev/tty) || ui_input cname "Имя" "${names[0]}"
|
||
else
|
||
local resolved; resolved=$(client_resolve_name "$cname" || true)
|
||
[ -n "$resolved" ] || { log_error "Клиент '$cname' не найден."; client_list; return 1; }
|
||
cname="$resolved"
|
||
fi
|
||
valid_client_name "$cname" || die "Недопустимое имя клиента: '$cname'"
|
||
|
||
local cid=""; [ -f "$CLIENTS_META" ] && cid=$(awk -F'|' -v n="$cname" '$1 == n { print $3; exit }' "$CLIENTS_META" || true)
|
||
[ -n "$cid" ] && clients_remove_soft "$cid"
|
||
|
||
if [ -f "$AWG_CONF" ]; then
|
||
local tmp="$AWG_CONF.tmp"
|
||
awk -v name="$cname" '
|
||
function flushbuf() { for (j = 0; j < n; j++) print buf[j]; n = 0 }
|
||
/^[ \t]*\[/ { if (insec) { if (drop) n = 0; flushbuf() }; insec = 1; drop = 0; buf[n++] = $0; next }
|
||
{ if (!insec) { print; next }; buf[n++] = $0; line = $0; gsub(/[ \t\r]/, "", line); if (line == "#client:" name) drop = 1 }
|
||
END { if (insec) { if (drop) n = 0; flushbuf() } }
|
||
' "$AWG_CONF" > "$tmp" 2>/dev/null || rm -f "$tmp"
|
||
[ -s "$tmp" ] && { chmod 0600 "$tmp"; mv -f "$tmp" "$AWG_CONF"; awg_reconcile; }
|
||
rm -f "$tmp"
|
||
fi
|
||
|
||
rm -rf "$(client_dir "$cname")"
|
||
local tok; tok=$(client_token "$cname" 2>/dev/null || true)
|
||
[ -n "$tok" ] && rm -f "$WEB_ROOT/$tok"
|
||
if [ -f "$CLIENTS_META" ]; then
|
||
local meta_tmp="$CLIENTS_META.tmp"
|
||
awk -F'|' -v n="$cname" '$1 != n' "$CLIENTS_META" > "$meta_tmp" && mv -f "$meta_tmp" "$CLIENTS_META"
|
||
chmod 0600 "$CLIENTS_META" 2>/dev/null || true
|
||
fi
|
||
log_success "Клиент '${cname}' удалён."
|
||
}
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# TUI Мастер
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
wizard() {
|
||
local comp_choice="full"
|
||
if [ "$INSTALL_FREETURN" = "1" ] && [ "$INSTALL_AWG" = "1" ]; then comp_choice="full"
|
||
elif [ "$INSTALL_FREETURN" = "0" ] && [ "$INSTALL_AWG" = "1" ]; then comp_choice="awg_only"
|
||
elif [ "$INSTALL_FREETURN" = "1" ] && [ "$INSTALL_AWG" = "0" ]; then comp_choice="freeturn_only"
|
||
fi
|
||
|
||
ui_menu comp_choice "Состав установки:" "$comp_choice" \
|
||
full "FreeTurn + AmneziaWG 3.1 (рекомендуется - полный комплект)" \
|
||
awg_only "Только AmneziaWG 3.1 (чистый VPN-сервер без релея)" \
|
||
freeturn_only "Только FreeTurn (релей для стороннего бэкенда)"
|
||
|
||
case "$comp_choice" in
|
||
full) INSTALL_FREETURN=1; INSTALL_AWG=1 ;;
|
||
awg_only) INSTALL_FREETURN=0; INSTALL_AWG=1 ;;
|
||
freeturn_only) INSTALL_FREETURN=1; INSTALL_AWG=0 ;;
|
||
esac
|
||
|
||
ui_menu INSTALL_METHOD "Метод запуска:" "$INSTALL_METHOD" \
|
||
docker "Docker Compose (удобно, изолированно)" \
|
||
systemd "Systemd (прямо на хосте)"
|
||
|
||
if [ "$INSTALL_FREETURN" = "1" ]; then
|
||
ui_menu PROXY_MODE "Режим релея:" "$PROXY_MODE" \
|
||
udp "UDP-relay (AmneziaWG / WireGuard)" \
|
||
tcp "TCP-forward (Xray / sing-box)"
|
||
ask_port LISTEN_PORT "Внешний порт FreeTurn" "${LISTEN_PORT:-56000}"
|
||
ui_menu OBF_PROFILE "Обфускация FreeTurn:" "$OBF_PROFILE" \
|
||
rtpopus3 "rtpopus3 (RTP/opus + RFC 8285 + ChaCha20)" \
|
||
rtpopus2 "rtpopus2 (RTP/opus + RFC 8285)" \
|
||
rtpopus "rtpopus (базовый RTP/opus)" \
|
||
none "none (без обфускации)"
|
||
if [ "$OBF_PROFILE" != "none" ]; then
|
||
[ -z "$OBF_KEY" ] && OBF_KEY="$(openssl rand -hex 32)"
|
||
else OBF_KEY=""; fi
|
||
ui_yesno "Включить авторизацию по Client ID (allowlist)?" "Y" \
|
||
&& CLIENTS_FILE_CONF="${AUTH_DIR}/clients.json" || CLIENTS_FILE_CONF=""
|
||
fi
|
||
|
||
if [ "$INSTALL_AWG" = "1" ]; then
|
||
ask_port BACKEND_PORT "Порт AmneziaWG" "${BACKEND_PORT:-51820}"
|
||
ui_yesno "Открыть порт AmneziaWG (${BACKEND_PORT}/udp) для прямого подключения?" "Y" \
|
||
&& AWG_DIRECT_PORT=1 || AWG_DIRECT_PORT=0
|
||
ui_input WG_ENDPOINT "Локальный Endpoint клиента (-listen)" "${WG_ENDPOINT:-127.0.0.1:9000}"
|
||
elif [ "$INSTALL_FREETURN" = "1" ]; then
|
||
ask_port BACKEND_PORT "Порт бэкенда (куда пересылать трафик)" "${BACKEND_PORT:-51820}"
|
||
fi
|
||
|
||
ui_yesno "Открыть необходимые порты в файрволе сервера?" "Y" \
|
||
&& OPEN_FIREWALL=1 || OPEN_FIREWALL=0
|
||
}
|
||
|
||
review_config() {
|
||
local comp_name="FreeTurn + AmneziaWG 3.1"
|
||
[ "$INSTALL_FREETURN" = "0" ] && comp_name="Только AmneziaWG 3.1"
|
||
[ "$INSTALL_AWG" = "0" ] && comp_name="Только FreeTurn"
|
||
|
||
if [ "$HAS_GUM" = 1 ]; then
|
||
local lines=()
|
||
lines+=("$(gum style --foreground "$MD_PRIMARY" --bold "Настройки установки")")
|
||
lines+=("")
|
||
lines+=("$(printf '%-20s %s' "Компоненты:" "$comp_name")")
|
||
lines+=("$(printf '%-20s %s' "Метод запуска:" "$INSTALL_METHOD")")
|
||
[ "$INSTALL_FREETURN" = "1" ] && lines+=("$(printf '%-20s %s' "Порт FreeTurn:" "0.0.0.0:$LISTEN_PORT")")
|
||
[ "$INSTALL_FREETURN" = "1" ] && lines+=("$(printf '%-20s %s' "Режим релея:" "$PROXY_MODE")")
|
||
[ "$INSTALL_FREETURN" = "1" ] && lines+=("$(printf '%-20s %s' "Обфускация:" "$OBF_PROFILE")")
|
||
[ "$INSTALL_AWG" = "1" ] && lines+=("$(printf '%-20s %s' "Порт AmneziaWG:" "$BACKEND_PORT")")
|
||
[ "$INSTALL_AWG" = "1" ] && lines+=("$(printf '%-20s %s' "Прямой AWG:" "$([ "$AWG_DIRECT_PORT" = "1" ] && echo "да" || echo "нет")")")
|
||
lines+=("$(printf '%-20s %s' "Файрвол:" "$([ "$OPEN_FIREWALL" = "1" ] && echo "открыть" || echo "не трогать")")")
|
||
|
||
local body; body=$(printf '%s\n' "${lines[@]}")
|
||
gum style --border double --border-foreground "$MD_PRIMARY" --padding "1 2" "$body"
|
||
else
|
||
echo; log_info "Настройки: components=$comp_name method=$INSTALL_METHOD"
|
||
fi
|
||
ui_drain_input
|
||
ui_yesno "Применить конфигурацию?" "Y" || ui_abort
|
||
}
|
||
|
||
install_cli_symlink() {
|
||
mkdir -p "$PREFIX" 2>/dev/null || true
|
||
mkdir -p /usr/local/bin 2>/dev/null || true
|
||
|
||
local script_target="$PREFIX/install.sh"
|
||
local cur_script="${BASH_SOURCE[0]:-$0}"
|
||
|
||
if [ -f "$cur_script" ]; then
|
||
if [ "$(readlink -f "$cur_script" 2>/dev/null || true)" != "$(readlink -f "$script_target" 2>/dev/null || true)" ]; then
|
||
cp -f "$cur_script" "$script_target" 2>/dev/null || true
|
||
fi
|
||
elif [ ! -f "$script_target" ]; then
|
||
# Сюда попадаем только из `curl | bash`, т.е. текущий скрипт и есть master.
|
||
local repo_raw="https://raw.githubusercontent.com/${REPO}/master/scripts/install.sh"
|
||
if command -v curl >/dev/null 2>&1; then
|
||
curl -sSL "$repo_raw" -o "$script_target" 2>/dev/null || true
|
||
elif command -v wget >/dev/null 2>&1; then
|
||
wget -qO "$script_target" "$repo_raw" 2>/dev/null || true
|
||
fi
|
||
fi
|
||
|
||
if [ -f "$script_target" ]; then
|
||
chmod 0755 "$script_target" 2>/dev/null || true
|
||
ln -sf "$script_target" /usr/local/bin/freeturn 2>/dev/null || true
|
||
ln -sf "$script_target" /usr/local/bin/free-turn-proxy 2>/dev/null || true
|
||
fi
|
||
}
|
||
|
||
apply() {
|
||
save_config
|
||
[ "$INSTALL_AWG" = "1" ] && awg_bootstrap
|
||
if [ "$INSTALL_METHOD" = "docker" ]; then
|
||
apply_docker
|
||
else
|
||
apply_systemd
|
||
fi
|
||
[ "$OPEN_FIREWALL" = 1 ] && firewall_open
|
||
if [ ! -s "$CLIENTS_META" ]; then
|
||
client_add "client-1" 1
|
||
NEW_CLIENT="client-1"
|
||
fi
|
||
install_cli_symlink
|
||
return 0
|
||
}
|
||
|
||
print_summary() {
|
||
ui_drain_input
|
||
local ext_ip; ext_ip="$(get_public_ip)" || ext_ip="?"
|
||
echo
|
||
if [ "$HAS_GUM" = 1 ]; then
|
||
local lines=()
|
||
lines+=("$(gum style --foreground "$MD_SUCCESS" --bold "✔ Установка успешно завершена!")")
|
||
lines+=("")
|
||
lines+=("$(gum style --foreground "$MD_PRIMARY" --bold "Параметры сервера:")")
|
||
if [ "$INSTALL_FREETURN" = "1" ]; then
|
||
lines+=(" • Сервер FreeTurn: $(gum style --bold "${ext_ip}:${LISTEN_PORT}") $(gum style --foreground "$MD_TERTIARY" "(${OBF_PROFILE})")")
|
||
fi
|
||
if [ "$INSTALL_AWG" = "1" ]; then
|
||
local awg_info=""
|
||
[ "$AWG_DIRECT_PORT" = "1" ] && awg_info=" (прямой доступ открыт)"
|
||
lines+=(" • AmneziaWG 3.1: $(gum style --bold "порт ${BACKEND_PORT}")${awg_info}")
|
||
fi
|
||
|
||
lines+=("")
|
||
lines+=("$(gum style --foreground "$MD_PRIMARY" --bold "Управление клиентами:")")
|
||
lines+=(" freeturn client add [name] - добавить клиента")
|
||
lines+=(" freeturn client list - список клиентов")
|
||
lines+=(" freeturn client qr [name] - показать ссылки на QR-коды")
|
||
lines+=(" freeturn client remove [name] - удалить клиента")
|
||
|
||
local body; body=$(printf '%s\n' "${lines[@]}")
|
||
gum style --border rounded --border-foreground "$MD_SUCCESS" --padding "1 2" "$body"
|
||
else
|
||
echo "========================================================"
|
||
echo " Установка успешно завершена!"
|
||
echo "========================================================"
|
||
[ "$INSTALL_FREETURN" = "1" ] && echo "FreeTurn: ${ext_ip}:${LISTEN_PORT} (${OBF_PROFILE})"
|
||
[ "$INSTALL_AWG" = "1" ] && echo "AmneziaWG: порт ${BACKEND_PORT}"
|
||
echo
|
||
echo "Управление клиентами: freeturn client <add|list|qr|remove>"
|
||
echo "========================================================"
|
||
fi
|
||
|
||
# Только свежесозданный клиент: --update и --reconfigure не должны заново
|
||
# открывать порт с чужими приватными ключами (для этого есть client qr).
|
||
if [ -n "$NEW_CLIENT" ]; then
|
||
show_client_links "$NEW_CLIENT" "Ссылки для клиента '${NEW_CLIENT}'"
|
||
else
|
||
log_info "Ссылки на конфиги и QR: freeturn client qr [name]"
|
||
fi
|
||
ui_drain_input
|
||
}
|
||
|
||
flow_install() { wizard; validate_config; review_config; apply; print_summary; }
|
||
flow_reconfigure() { load_config; wizard; validate_config; review_config; apply; print_summary; }
|
||
flow_update() { load_config; validate_config; apply; print_summary; }
|
||
|
||
flow_uninstall() {
|
||
local choice
|
||
ui_menu choice "Что удалить?" "all" \
|
||
freeturn "Только FreeTurn (сохранить AmneziaWG для прямого доступа)" \
|
||
awg "Только AmneziaWG (сохранить FreeTurn)" \
|
||
all "Всё полностью (FreeTurn + AmneziaWG + конфиги и ключи)" \
|
||
back "Отмена"
|
||
[ "$choice" = "back" ] && return 0
|
||
ui_yesno "Вы уверены?" "N" || ui_abort
|
||
do_uninstall "$choice" 1
|
||
}
|
||
|
||
menu_existing() {
|
||
local choice
|
||
ui_menu choice "Сервер настроен. Действие:" "clients" \
|
||
clients "Управление клиентами (добавить, список, QR/файлы)" \
|
||
reconfigure "Изменить настройки (переконфигурировать)" \
|
||
update "Обновить версию" \
|
||
logs "Просмотреть последние логи" \
|
||
uninstall "Удалить (полностью или раздельно)" \
|
||
exit "Выход"
|
||
case "$choice" in
|
||
clients)
|
||
while :; do
|
||
local c; ui_menu c "Клиенты:" "add" add "Добавить" list "Список" qr "Ссылки на QR/файлы" remove "Удалить" back "Назад"
|
||
case "$c" in add) client_add "" 0 ;; list) client_list ;; qr) client_qr "" ;; remove) client_remove "" ;; back) break ;; esac
|
||
done; menu_existing ;;
|
||
reconfigure) flow_reconfigure ;;
|
||
update) flow_update ;;
|
||
logs)
|
||
case "$(current_runtime)" in
|
||
docker) docker logs --tail 40 "$CONTAINER" 2>&1 | ${PAGER:-cat} ;;
|
||
systemd) journalctl -u "$UNIT_NAME" -n 40 --no-pager ;;
|
||
nohup) tail -n 40 "$LOGFILE" 2>/dev/null || echo "Лог пуст" ;;
|
||
esac; menu_existing ;;
|
||
uninstall) flow_uninstall ;;
|
||
exit) ui_abort ;;
|
||
esac
|
||
}
|
||
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
# Точка входа: маршрутизация RPC, CLI управления пирами, non-interactive и TUI мастера.
|
||
|
||
# Диспетчер цепляется за точные имена: проверка «по форме строки» ловила бы и CLI-флаги (-y, --update).
|
||
RPC_COMMANDS="probe install wg-setup start stop logs share-info share-list peer-add peer-conf peer-remove client-add client-remove uninstall"
|
||
|
||
is_rpc_command() {
|
||
local c
|
||
for c in $RPC_COMMANDS; do [ "$1" = "$c" ] && return 0; done
|
||
return 1
|
||
}
|
||
|
||
usage() {
|
||
cat <<EOF
|
||
Free Turn Proxy & AmneziaWG - установщик и контроллер сервера.
|
||
|
||
Использование:
|
||
freeturn интерактивный мастер (gum TUI)
|
||
freeturn client add [name] добавить клиента и показать ссылки
|
||
freeturn client list список клиентов
|
||
freeturn client qr [name] ссылки на QR-коды и конфиги
|
||
freeturn client remove [name] удалить клиента
|
||
freeturn -y [опции] неинтерактивная установка (скрипты/CI)
|
||
|
||
Опции компонентов:
|
||
--only-awg установить только AmneziaWG 3.1 (без FreeTurn)
|
||
--only-freeturn установить только FreeTurn (без AmneziaWG)
|
||
--with-freeturn доустановить FreeTurn
|
||
--with-awg доустановить AmneziaWG
|
||
|
||
Опции конфигурации:
|
||
-y, --yes, --non-interactive без интерактивных вопросов
|
||
--method docker|systemd метод запуска (default: docker)
|
||
--mode udp|tcp режим туннеля (default: udp)
|
||
--backend-port N порт AmneziaWG (default: 51820)
|
||
--listen-port N внешний порт FreeTurn (default: 56000)
|
||
--web-port N порт веб-раздачи QR и файлов (default: 8080)
|
||
--web-ttl SEC сколько секунд живёт веб-раздача (default: 900)
|
||
--wg-endpoint HOST:PORT Endpoint в relay-конфиге клиента (default: 127.0.0.1:9000)
|
||
--version TAG версия FreeTurn (default: latest)
|
||
--awg-direct | --no-awg-direct прямой доступ к порту AWG (default: да)
|
||
--obf rtpopus3|rtpopus2|rtpopus|none обфускация (default: rtpopus3)
|
||
--obf-key HEX64 ключ обфускации (нет -> сгенерируется)
|
||
--clients-auth | --no-clients-auth авторизация по Client ID
|
||
--firewall | --no-firewall открывать порты FreeTurn и AWG в файрволе
|
||
|
||
Файлы клиента отдаются по ссылке http://IP:PORT/<токен клиента>/ на --web-port.
|
||
У каждого клиента ссылка своя, живёт --web-ttl секунд и равносильна его конфигу.
|
||
Показать снова - freeturn client qr <name>; сбросить все - rm /opt/free-turn-proxy/web.token.
|
||
|
||
Действия:
|
||
--reconfigure переконфигурировать сервер
|
||
--update обновить версию
|
||
--uninstall удалить сервер
|
||
--only freeturn|awg|all цель удаления (default: all)
|
||
--purge удалить каталог /opt/free-turn-proxy
|
||
-h, --help справка
|
||
|
||
Машиночитаемый JSON RPC v2 (мобильное приложение):
|
||
freeturn <$(printf "%s" "${RPC_COMMANDS// /|}")> [flags]
|
||
EOF
|
||
}
|
||
|
||
parse_cli_args() {
|
||
while [ $# -gt 0 ]; do
|
||
case "$1" in
|
||
-y | --yes | --non-interactive) NONINTERACTIVE=1 ;;
|
||
--only-awg) OVERRIDES+=("INSTALL_FREETURN=0" "INSTALL_AWG=1" "AWG_DIRECT_PORT=1") ;;
|
||
--only-freeturn) OVERRIDES+=("INSTALL_FREETURN=1" "INSTALL_AWG=0") ;;
|
||
--with-freeturn) OVERRIDES+=("INSTALL_FREETURN=1") ;;
|
||
--with-awg) OVERRIDES+=("INSTALL_AWG=1") ;;
|
||
--method) OVERRIDES+=("INSTALL_METHOD=${2:-docker}"); shift ;;
|
||
--mode) OVERRIDES+=("PROXY_MODE=${2:-udp}"); shift ;;
|
||
--backend-port) OVERRIDES+=("BACKEND_PORT=${2:-51820}"); shift ;;
|
||
--listen-port) OVERRIDES+=("LISTEN_PORT=${2:-56000}"); shift ;;
|
||
--web-port) OVERRIDES+=("FT_WEB_PORT=${2:-8080}"); shift ;;
|
||
--web-ttl) OVERRIDES+=("FT_WEB_TTL=${2:-900}"); shift ;;
|
||
--awg-direct) OVERRIDES+=("AWG_DIRECT_PORT=1") ;;
|
||
--no-awg-direct) OVERRIDES+=("AWG_DIRECT_PORT=0") ;;
|
||
--obf) OVERRIDES+=("OBF_PROFILE=${2:-rtpopus3}"); shift ;;
|
||
--obf-key) OVERRIDES+=("OBF_KEY=${2:-}"); shift ;;
|
||
--clients-auth) OVERRIDES+=("CLIENTS_FILE_CONF=${AUTH_DIR}/clients.json") ;;
|
||
--no-clients-auth) OVERRIDES+=("CLIENTS_FILE_CONF=") ;;
|
||
--wg-endpoint) OVERRIDES+=("WG_ENDPOINT=${2:-}"); shift ;;
|
||
--version) OVERRIDES+=("VERSION=${2:-latest}"); shift ;;
|
||
--firewall) OPEN_FIREWALL=1 ;;
|
||
--no-firewall) OPEN_FIREWALL=0 ;;
|
||
--reconfigure) ACTION="reconfigure" ;;
|
||
--update) ACTION="update"; NONINTERACTIVE=1 ;;
|
||
--uninstall) ACTION="uninstall"; NONINTERACTIVE=1 ;;
|
||
--only) UNINSTALL_TARGET="${2:-all}"; shift ;;
|
||
--purge) PURGE=1 ;;
|
||
-h | --help) usage; exit 0 ;;
|
||
*) die "Неизвестный аргумент: $1 (см. --help)" ;;
|
||
esac
|
||
shift
|
||
done
|
||
}
|
||
|
||
main() {
|
||
for arg in "$@"; do
|
||
if [ "$arg" = "-h" ] || [ "$arg" = "--help" ]; then
|
||
usage; return 0
|
||
fi
|
||
done
|
||
|
||
local rpc_cmd=""
|
||
if is_rpc_command "${1:-}"; then
|
||
rpc_cmd="$1"
|
||
else
|
||
case "${1:-}" in
|
||
""|-*|client) ;;
|
||
*) _IS_RPC=1; HAS_GUM=0; fail bad_arg "unknown subcommand: $1" ;;
|
||
esac
|
||
fi
|
||
if [ -n "$rpc_cmd" ]; then
|
||
_IS_RPC=1; HAS_GUM=0; shift
|
||
parse_rpc_args "$@"
|
||
case "$rpc_cmd" in
|
||
probe) cmd_probe ;;
|
||
install) cmd_install ;;
|
||
wg-setup) cmd_wg_setup ;;
|
||
start) cmd_start ;;
|
||
stop) cmd_stop ;;
|
||
logs) cmd_logs ;;
|
||
share-info) cmd_share_info ;;
|
||
share-list) cmd_share_list ;;
|
||
peer-add) cmd_peer_add ;;
|
||
peer-conf) cmd_peer_conf ;;
|
||
peer-remove) cmd_peer_remove ;;
|
||
client-add) cmd_client_add ;;
|
||
client-remove) cmd_client_remove ;;
|
||
uninstall) cmd_uninstall ;;
|
||
esac
|
||
return 0
|
||
fi
|
||
|
||
# Проверка прав root
|
||
[ "$(id -u 2>/dev/null || echo -1)" -ne 0 ] && die "Запустите скрипт от root (sudo)."
|
||
ensure_base_deps
|
||
detect_arch >/dev/null 2>&1 || true
|
||
|
||
# CLI управление клиентами
|
||
if [ $# -ge 1 ] && [ "$1" = "client" ]; then
|
||
shift
|
||
local sub="${1:-}"
|
||
[ -n "$sub" ] && shift || true
|
||
load_config
|
||
case "$sub" in
|
||
add) client_add "${1:-}" 0 ;;
|
||
list) client_list ;;
|
||
qr|web) client_qr "${1:-}" ;;
|
||
remove) client_remove "${1:-}" ;;
|
||
*) die "Использование: freeturn client <add|list|qr|remove>" ;;
|
||
esac
|
||
return 0
|
||
fi
|
||
|
||
parse_cli_args "$@"
|
||
|
||
if [ "$NONINTERACTIVE" = 1 ]; then
|
||
is_installed && load_config || true
|
||
apply_overrides
|
||
if [ "$ACTION" = "uninstall" ]; then
|
||
do_uninstall "$UNINSTALL_TARGET" "$PURGE"
|
||
return 0
|
||
fi
|
||
validate_config
|
||
[ -z "$OPEN_FIREWALL" ] && OPEN_FIREWALL=1
|
||
apply
|
||
print_summary
|
||
return 0
|
||
fi
|
||
|
||
ensure_gum
|
||
ui_banner
|
||
if [ "$ACTION" = "reconfigure" ]; then
|
||
flow_reconfigure
|
||
elif [ "$ACTION" = "uninstall" ]; then
|
||
flow_uninstall
|
||
elif is_installed; then
|
||
load_config
|
||
menu_existing
|
||
else
|
||
flow_install
|
||
fi
|
||
ui_drain_input
|
||
}
|
||
|
||
if [ "${BASH_SOURCE[0]:-$0}" = "$0" ]; then
|
||
main "$@"
|
||
fi
|