mirror of
https://github.com/andrey271192/PCA_Phobos.git
synced 2026-09-20 11:55:32 +00:00
turnkey installer: full primary stack one-command + session improvements
- install.sh: rewritten as self-contained turnkey primary installer (deps, wg-obfuscator from Ground-Zerro, wg0, obfuscator services, Phobos repo + PCA overlay patches, web panel, nginx, router watchdog). - app.py: current panel (RU/EN, tunnel-pull config endpoint, fan-out, load-aware rebalance, online-anywhere status, '?' help). - overlay/: patched onboarding scripts (phobos-client.sh 403 fix, install-router.sh.template tunnel-pull+cron+client_id, router-configure-wireguard public WG, phobos-pull.sh tunnel-first). - server/: phobos-health.sh (self-heal+apply-server), phobos-pull.sh, phobos-router-watchdog.py, api.py (agent + /api/router-config).
This commit is contained in:
phobos
241
install.sh
Normal file → Executable file
241
install.sh
Normal file → Executable file
@@ -1,59 +1,169 @@
|
||||
#!/bin/bash
|
||||
# ============================================================
|
||||
# PCA Phobos — Web Panel Installer
|
||||
# Requires: Phobos already installed (/opt/Phobos)
|
||||
# PCA Phobos — TURNKEY installer (primary / panel node)
|
||||
#
|
||||
# Usage:
|
||||
# One command, all dependencies, from a clean VPS:
|
||||
# bash <(curl -fsSL https://raw.githubusercontent.com/andrey271192/PCA_Phobos/main/install.sh)
|
||||
#
|
||||
# Custom port:
|
||||
# PANEL_PORT=39172 bash <(curl ...)
|
||||
# Installs, in order:
|
||||
# deps -> wg-obfuscator (Ground-Zerro) -> WireGuard wg0 ->
|
||||
# obfuscator services -> Phobos repo (onboarding scripts) +
|
||||
# PCA patches -> web panel -> nginx (/init,/packages) ->
|
||||
# server-side router watchdog.
|
||||
#
|
||||
# Env (all optional):
|
||||
# PANEL_PORT random 10000-59999 web panel port
|
||||
# PANEL_PASS OcAdmin2026! panel admin password
|
||||
# API_KEY random shared key (agents + router pull token)
|
||||
# OBF_PORTS 2083,5443,993 obfuscator listen ports
|
||||
# TG_TOKEN / TG_CHAT Telegram alerts
|
||||
# PCA_BRANCH main branch to pull PCA files from
|
||||
# ============================================================
|
||||
|
||||
set -e
|
||||
|
||||
PANEL_PASS="${PANEL_PASS:-OcAdmin2026!}"
|
||||
TG_TOKEN="${TG_TOKEN:-}"
|
||||
TG_CHAT="${TG_CHAT:-}"
|
||||
OBF_PORTS="${OBF_PORTS:-2083,5443,993}"
|
||||
PCA_BRANCH="${PCA_BRANCH:-main}"
|
||||
PHOBOS_DIR="/opt/Phobos"
|
||||
PANEL_DIR="/opt/phobos-panel"
|
||||
RAW="https://raw.githubusercontent.com/andrey271192/PCA_Phobos/${PCA_BRANCH}"
|
||||
|
||||
[ "$EUID" -eq 0 ] || { echo "Run as root"; exit 1; }
|
||||
|
||||
# Generate random 5-digit port (10000-59999) if not specified
|
||||
if [ -z "$PANEL_PORT" ]; then
|
||||
PANEL_PORT=$(shuf -i 10000-59999 -n 1 2>/dev/null || awk 'BEGIN{srand(); print int(10000+rand()*50000)}')
|
||||
fi
|
||||
API_KEY="${API_KEY:-$(head -c 24 /dev/urandom | base64 | tr -d '/+=' | head -c 24)}"
|
||||
|
||||
# ── Check Phobos is installed ──
|
||||
if [ ! -d "/opt/Phobos" ]; then
|
||||
echo "ERROR: Phobos not found at /opt/Phobos"
|
||||
echo "Install Phobos first: https://git.zerrolabs.org/Ground-Zerro/Phobos"
|
||||
exit 1
|
||||
fi
|
||||
SERVER_IP=$(curl -s -m8 https://api.ipify.org || hostname -I | awk '{print $1}')
|
||||
IFACE=$(ip route get 8.8.8.8 2>/dev/null | awk '{for(i=1;i<NF;i++) if($i=="dev") print $(i+1)}' | head -1)
|
||||
IFACE="${IFACE:-eth0}"
|
||||
ARCH=$(uname -m)
|
||||
|
||||
echo ""
|
||||
echo "╔══════════════════════════════════════════════════════╗"
|
||||
echo "║ PCA Phobos Panel Installer ║"
|
||||
echo "╠══════════════════════════════════════════════════════╣"
|
||||
echo "║ Panel port : $PANEL_PORT"
|
||||
echo "║ Phobos dir : /opt/Phobos"
|
||||
echo "╚══════════════════════════════════════════════════════╝"
|
||||
echo ""
|
||||
echo "============================================"
|
||||
echo " PCA Phobos - turnkey primary install"
|
||||
echo " IP=$SERVER_IP iface=$IFACE arch=$ARCH"
|
||||
echo " panel port=$PANEL_PORT obf ports=$OBF_PORTS"
|
||||
echo "============================================"
|
||||
|
||||
# ── 1. Install dependencies ──
|
||||
echo "[1/3] Installing dependencies..."
|
||||
# ── 1. dependencies ──
|
||||
echo "[1/9] dependencies..."
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
apt-get update -qq
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3 python3-flask gunicorn
|
||||
apt-get install -y -qq wireguard wireguard-tools iptables jq curl git \
|
||||
python3 python3-flask gunicorn nginx cron >/dev/null
|
||||
systemctl enable cron -q 2>/dev/null || true; systemctl start cron 2>/dev/null || true
|
||||
|
||||
# ── 2. Install panel ──
|
||||
echo "[2/3] Installing web panel..."
|
||||
# ── 2. wg-obfuscator binary (Ground-Zerro) ──
|
||||
echo "[2/9] wg-obfuscator..."
|
||||
mkdir -p "$PHOBOS_DIR"/{server,clients,bin,tokens,www/init,www/packages,packages}
|
||||
if [ ! -x /usr/local/bin/wg-obfuscator ]; then
|
||||
R=/tmp/phobos-obf; rm -rf "$R"; mkdir -p "$R"; cd "$R"
|
||||
git init -q; git remote add origin https://github.com/Ground-Zerro/Phobos.git
|
||||
git config core.sparseCheckout true; echo "wg-obfuscator" > .git/info/sparse-checkout
|
||||
git pull origin main -q
|
||||
cp -f "wg-obfuscator/bin/wg-obfuscator-${ARCH}" "$PHOBOS_DIR/bin/" 2>/dev/null || true
|
||||
chmod +x "$PHOBOS_DIR/bin/"wg-obfuscator-* 2>/dev/null || true
|
||||
ln -sf "$PHOBOS_DIR/bin/wg-obfuscator-${ARCH}" /usr/local/bin/wg-obfuscator
|
||||
cd /; rm -rf "$R"
|
||||
fi
|
||||
[ -x /usr/local/bin/wg-obfuscator ] || { echo "ERROR: obfuscator binary for $ARCH missing"; exit 1; }
|
||||
|
||||
# ── 3. Phobos repo (onboarding scripts) ──
|
||||
echo "[3/9] Phobos repo (onboarding scripts)..."
|
||||
R="$PHOBOS_DIR/repo"; rm -rf "$R"; mkdir -p "$R"; cd "$R"
|
||||
git init -q; git remote add origin https://github.com/Ground-Zerro/Phobos.git
|
||||
git config core.sparseCheckout true
|
||||
printf 'server\nclient\n' > .git/info/sparse-checkout
|
||||
git pull origin main -q; rm -rf .git
|
||||
find "$R" -name '*.sh' -exec chmod +x {} \; 2>/dev/null || true
|
||||
cd /
|
||||
|
||||
# ── 4. WireGuard wg0 (primary) ──
|
||||
echo "[4/9] WireGuard wg0..."
|
||||
if [ ! -f /etc/wireguard/wg0.conf ]; then
|
||||
WG_PRIV=$(wg genkey); WG_PUB=$(echo "$WG_PRIV" | wg pubkey)
|
||||
cat > /etc/wireguard/wg0.conf <<WG
|
||||
[Interface]
|
||||
Address = 10.25.0.1/16
|
||||
ListenPort = 51820
|
||||
PrivateKey = $WG_PRIV
|
||||
PostUp = iptables -I FORWARD 1 -i wg0 -j ACCEPT; iptables -I FORWARD 1 -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT; iptables -t nat -A POSTROUTING -o $IFACE -j MASQUERADE
|
||||
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT; iptables -t nat -D POSTROUTING -o $IFACE -j MASQUERADE
|
||||
WG
|
||||
chmod 600 /etc/wireguard/wg0.conf
|
||||
else
|
||||
WG_PRIV=$(grep '^PrivateKey' /etc/wireguard/wg0.conf | cut -d= -f2- | tr -d ' ')
|
||||
WG_PUB=$(echo "$WG_PRIV" | wg pubkey)
|
||||
fi
|
||||
sysctl -w net.ipv4.ip_forward=1 -q
|
||||
grep -q '^net.ipv4.ip_forward = 1' /etc/sysctl.conf || echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
|
||||
systemctl enable wg-quick@wg0 -q 2>/dev/null || true
|
||||
systemctl restart wg-quick@wg0
|
||||
|
||||
# ── 5. obfuscator services (multi-port) ──
|
||||
echo "[5/9] obfuscator services..."
|
||||
OBF_KEY=$(head -c 32 /dev/urandom | base64 | tr -d '/+=' | head -c 32)
|
||||
iptables -C INPUT -p udp --dport 51820 ! -s 127.0.0.1 -j DROP 2>/dev/null \
|
||||
|| iptables -A INPUT -p udp --dport 51820 ! -s 127.0.0.1 -j DROP
|
||||
IFS=',' read -ra PORTS <<< "$OBF_PORTS"
|
||||
for PORT in "${PORTS[@]}"; do
|
||||
cat > "$PHOBOS_DIR/server/wg-obfuscator-${PORT}.conf" <<EOF
|
||||
[instance]
|
||||
source-if = 0.0.0.0
|
||||
source-lport = ${PORT}
|
||||
target = 127.0.0.1:51820
|
||||
key = ${OBF_KEY}
|
||||
masking = AUTO
|
||||
verbose = INFO
|
||||
idle-timeout = 300
|
||||
max-dummy = 50
|
||||
EOF
|
||||
cat > /etc/systemd/system/wg-obfuscator-${PORT}.service <<EOF
|
||||
[Unit]
|
||||
Description=WireGuard Obfuscator (port ${PORT})
|
||||
After=network.target wg-quick@wg0.service
|
||||
[Service]
|
||||
Type=simple
|
||||
ExecStart=/usr/local/bin/wg-obfuscator --config ${PHOBOS_DIR}/server/wg-obfuscator-${PORT}.conf
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
done
|
||||
systemctl daemon-reload
|
||||
for PORT in "${PORTS[@]}"; do systemctl enable wg-obfuscator-${PORT} -q; systemctl restart wg-obfuscator-${PORT}; done
|
||||
|
||||
# server.env (primary)
|
||||
cat > "$PHOBOS_DIR/server/server.env" <<EOF
|
||||
SERVER_WG_PRIVATE_KEY=$WG_PRIV
|
||||
SERVER_WG_PUBLIC_KEY=$WG_PUB
|
||||
SERVER_PUBLIC_IP_V4=$SERVER_IP
|
||||
OBFUSCATOR_KEY=$OBF_KEY
|
||||
OBFUSCATOR_PORTS=$OBF_PORTS
|
||||
CLIENT_WG_PORT=51820
|
||||
ROLE=primary
|
||||
EOF
|
||||
|
||||
# ── 6. PCA patches over onboarding scripts + server-side helpers ──
|
||||
echo "[6/9] PCA patches (tunnel-pull, self-heal, watchdog, 403 fix)..."
|
||||
fetch() { curl -fsSL -m20 "$RAW/$1" -o "$2" && return 0; echo " WARN: fetch $1 failed"; return 1; }
|
||||
fetch overlay/phobos-client.sh "$PHOBOS_DIR/repo/server/scripts/phobos-client.sh" && chmod +x "$PHOBOS_DIR/repo/server/scripts/phobos-client.sh"
|
||||
fetch overlay/install-router.sh.template "$PHOBOS_DIR/repo/client/templates/install-router.sh.template"
|
||||
fetch overlay/router-configure-wireguard.sh "$PHOBOS_DIR/repo/client/templates/router-configure-wireguard.sh" && chmod +x "$PHOBOS_DIR/repo/client/templates/router-configure-wireguard.sh"
|
||||
fetch overlay/phobos-pull.sh "$PHOBOS_DIR/repo/client/templates/phobos-pull.sh" && chmod +x "$PHOBOS_DIR/repo/client/templates/phobos-pull.sh"
|
||||
fetch server/phobos-health.sh "$PHOBOS_DIR/server/phobos-health.sh" && chmod +x "$PHOBOS_DIR/server/phobos-health.sh"
|
||||
fetch server/phobos-pull.sh "$PHOBOS_DIR/server/phobos-pull.sh" && chmod +x "$PHOBOS_DIR/server/phobos-pull.sh"
|
||||
fetch server/phobos-router-watchdog.py "$PHOBOS_DIR/server/phobos-router-watchdog.py"
|
||||
[ -f "$PHOBOS_DIR/tokens/tokens.json" ] || echo '[]' > "$PHOBOS_DIR/tokens/tokens.json"
|
||||
|
||||
# ── 7. web panel ──
|
||||
echo "[7/9] web panel..."
|
||||
mkdir -p "$PANEL_DIR"
|
||||
|
||||
SERVER_IP=$(curl -s https://api.ipify.org || hostname -I | awk '{print $1}')
|
||||
|
||||
curl -fsSL "https://raw.githubusercontent.com/andrey271192/PCA_Phobos/main/app.py" \
|
||||
| sed "s|SERVER_IP = .*|SERVER_IP = \"$SERVER_IP\"|g" \
|
||||
> "$PANEL_DIR/app.py"
|
||||
|
||||
# Create initial settings
|
||||
fetch app.py "$PANEL_DIR/app.py" || { echo "ERROR: panel app.py fetch failed"; exit 1; }
|
||||
if [ ! -f "$PANEL_DIR/settings.json" ]; then
|
||||
cat > "$PANEL_DIR/settings.json" <<EOF
|
||||
{
|
||||
@@ -61,24 +171,20 @@ if [ ! -f "$PANEL_DIR/settings.json" ]; then
|
||||
"tg_bot_token": "$TG_TOKEN",
|
||||
"tg_chat_id": "$TG_CHAT",
|
||||
"monitor_interval": 30,
|
||||
"server_api_key": "$API_KEY",
|
||||
"labels": {},
|
||||
"subscriptions": {}
|
||||
"subscriptions": {},
|
||||
"router_access": {},
|
||||
"client_assignments": {}
|
||||
}
|
||||
EOF
|
||||
fi
|
||||
|
||||
# Save port for future reference
|
||||
echo "$PANEL_PORT" > "$PANEL_DIR/.port"
|
||||
|
||||
# ── 3. Setup systemd service ──
|
||||
echo "[3/3] Setting up service..."
|
||||
|
||||
cat > /etc/systemd/system/phobos-panel.service <<EOF
|
||||
[Unit]
|
||||
Description=Phobos VPN Web Panel
|
||||
After=network.target wg-quick@wg0.service
|
||||
Wants=wg-quick@wg0.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
WorkingDirectory=$PANEL_DIR
|
||||
@@ -86,25 +192,44 @@ ExecStart=/usr/bin/gunicorn -w 1 -b 0.0.0.0:$PANEL_PORT app:app
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
Environment=PYTHONUNBUFFERED=1
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
systemctl daemon-reload; systemctl enable phobos-panel -q; systemctl restart phobos-panel
|
||||
|
||||
# ── 8. nginx (serve /init + /packages over plain HTTP for routers) ──
|
||||
echo "[8/9] nginx..."
|
||||
rm -f /etc/nginx/sites-enabled/default 2>/dev/null || true
|
||||
cat > /etc/nginx/sites-available/phobos <<'NGINX'
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
location /init/ { alias /opt/Phobos/www/init/; default_type application/x-sh; }
|
||||
location /packages/ { alias /opt/Phobos/www/packages/; default_type application/octet-stream; }
|
||||
location / { return 404; }
|
||||
}
|
||||
NGINX
|
||||
ln -sf /etc/nginx/sites-available/phobos /etc/nginx/sites-enabled/phobos
|
||||
chmod 755 /opt/Phobos/www /opt/Phobos/www/init /opt/Phobos/www/packages
|
||||
nginx -t >/dev/null 2>&1 && systemctl enable nginx -q 2>/dev/null && systemctl restart nginx || echo " WARN: nginx config test failed"
|
||||
|
||||
# ── 9. router watchdog (auto reboot-recovery) ──
|
||||
echo "[9/9] router watchdog..."
|
||||
if [ -f "$PHOBOS_DIR/server/phobos-router-watchdog.py" ]; then
|
||||
( crontab -l 2>/dev/null | grep -v phobos-router-watchdog; \
|
||||
echo "*/3 * * * * /usr/bin/python3 $PHOBOS_DIR/server/phobos-router-watchdog.py >/dev/null 2>&1" ) | crontab -
|
||||
fi
|
||||
|
||||
systemctl daemon-reload
|
||||
systemctl enable phobos-panel -q
|
||||
systemctl restart phobos-panel
|
||||
sleep 2
|
||||
systemctl is-active --quiet phobos-panel && echo " Panel running." || { echo "ERROR: panel failed!"; journalctl -u phobos-panel -n 20; exit 1; }
|
||||
|
||||
echo ""
|
||||
echo "╔══════════════════════════════════════════════════════╗"
|
||||
echo "║ Installation Complete! ║"
|
||||
echo "╠══════════════════════════════════════════════════════╣"
|
||||
echo "║ Web Panel : http://$SERVER_IP:$PANEL_PORT"
|
||||
echo "║ Admin login : admin"
|
||||
echo "║ Admin pass : $PANEL_PASS"
|
||||
echo "║ ║"
|
||||
echo "║ ⚠ Запомните порт: $PANEL_PORT ║"
|
||||
echo "╚══════════════════════════════════════════════════════╝"
|
||||
echo ""
|
||||
echo "============================================"
|
||||
echo " Installation complete"
|
||||
echo " Panel : http://$SERVER_IP:$PANEL_PORT"
|
||||
echo " Login : admin"
|
||||
echo " Pass : $PANEL_PASS"
|
||||
echo " API key (agents+pull): $API_KEY"
|
||||
echo " WG pub: $WG_PUB"
|
||||
echo "============================================"
|
||||
echo "Status:"
|
||||
for s in wg-quick@wg0 phobos-panel nginx; do printf " %-18s %s\n" "$s" "$(systemctl is-active $s 2>/dev/null)"; done
|
||||
for PORT in "${PORTS[@]}"; do printf " %-18s %s\n" "wg-obfuscator-$PORT" "$(systemctl is-active wg-obfuscator-$PORT 2>/dev/null)"; done
|
||||
|
||||
669
overlay/install-router.sh.template
Normal file
669
overlay/install-router.sh.template
Normal file
@@ -0,0 +1,669 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
CLIENT_NAME="{{CLIENT_NAME}}"
|
||||
PHOBOS_DIR=""
|
||||
ROUTER_PLATFORM=""
|
||||
|
||||
. "$(dirname "$0")/lib-client.sh"
|
||||
. "$(dirname "$0")/install-obfuscator.sh"
|
||||
. "$(dirname "$0")/install-wireguard.sh"
|
||||
|
||||
detect_3xui_mode() {
|
||||
local platform="$1"
|
||||
|
||||
if [ "$platform" = "linux" ] && [ -f /etc/x-ui/x-ui.db ]; then
|
||||
echo "true"
|
||||
else
|
||||
echo "false"
|
||||
fi
|
||||
}
|
||||
|
||||
check_dependencies() {
|
||||
local platform="$1"
|
||||
local missing=""
|
||||
local base_deps="grep cut date tee tar curl jq"
|
||||
local platform_deps=""
|
||||
|
||||
if [ "$platform" = "openwrt" ]; then
|
||||
platform_deps="uci"
|
||||
fi
|
||||
|
||||
for cmd in $base_deps $platform_deps; do
|
||||
if ! command -v "$cmd" >/dev/null 2>&1; then
|
||||
missing="$missing $cmd"
|
||||
fi
|
||||
done
|
||||
|
||||
if [ -n "$missing" ]; then
|
||||
log "ВНИМАНИЕ: Отсутствуют необходимые утилиты:$missing"
|
||||
|
||||
if [ "$platform" = "linux" ]; then
|
||||
log "Устанавливаю недостающие пакеты через apt-get..."
|
||||
|
||||
if command -v apt-get >/dev/null 2>&1; then
|
||||
if ! apt-get update; then
|
||||
log "ОШИБКА: Не удалось обновить список пакетов apt-get"
|
||||
return 1
|
||||
fi
|
||||
|
||||
for cmd in $missing; do
|
||||
log "Установка $cmd..."
|
||||
if ! apt-get install -y "$cmd" 2>/dev/null; then
|
||||
log "ПРЕДУПРЕЖДЕНИЕ: Не удалось установить $cmd через apt-get"
|
||||
fi
|
||||
done
|
||||
else
|
||||
log "ОШИБКА: apt-get не найден. Невозможно установить зависимости."
|
||||
return 1
|
||||
fi
|
||||
else
|
||||
log "Устанавливаю недостающие пакеты через opkg..."
|
||||
|
||||
if command -v opkg >/dev/null 2>&1; then
|
||||
if ! opkg update; then
|
||||
log "ОШИБКА: Не удалось обновить список пакетов opkg"
|
||||
return 1
|
||||
fi
|
||||
|
||||
for cmd in $missing; do
|
||||
log "Установка $cmd..."
|
||||
if ! opkg install "$cmd" 2>/dev/null; then
|
||||
log "ПРЕДУПРЕЖДЕНИЕ: Не удалось установить $cmd через opkg"
|
||||
fi
|
||||
done
|
||||
else
|
||||
log "ОШИБКА: opkg не найден. Невозможно установить зависимости."
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
setup_configs() {
|
||||
log "Настройка конфигураций..."
|
||||
|
||||
mkdir -p "$PHOBOS_DIR"
|
||||
|
||||
cp wg-obfuscator.conf "$PHOBOS_DIR/${OBF_CONF_NAME}"
|
||||
chmod 600 "$PHOBOS_DIR/${OBF_CONF_NAME}"
|
||||
|
||||
cp "${CLIENT_NAME}.conf" "$PHOBOS_DIR/${CLIENT_NAME}.conf"
|
||||
chmod 600 "$PHOBOS_DIR/${CLIENT_NAME}.conf"
|
||||
|
||||
printf '%s' "${CLIENT_NAME}" > "$PHOBOS_DIR/${OBF_CONF_NAME%.conf}.link"
|
||||
|
||||
if [ "$OBF_BINARY_NAME" != "wg-obfuscator" ]; then
|
||||
local used_ports=""
|
||||
for existing_conf in "$PHOBOS_DIR"/wg-obfuscator*.conf; do
|
||||
[ -f "$existing_conf" ] || continue
|
||||
[ "$(basename "$existing_conf")" = "${OBF_CONF_NAME}" ] && continue
|
||||
local port
|
||||
port=$(grep 'source-lport' "$existing_conf" 2>/dev/null | tr -d ' ' | cut -d'=' -f2)
|
||||
[ -n "$port" ] && used_ports="${used_ports} ${port}"
|
||||
done
|
||||
|
||||
local new_port=13255
|
||||
local port_taken=1
|
||||
while [ "$port_taken" -eq 1 ]; do
|
||||
port_taken=0
|
||||
for p in $used_ports; do
|
||||
if [ "$p" = "$new_port" ]; then
|
||||
port_taken=1
|
||||
new_port=$((new_port + 1))
|
||||
break
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
sed -i "s/^source-lport = [0-9]*/source-lport = ${new_port}/" "$PHOBOS_DIR/${OBF_CONF_NAME}"
|
||||
sed -i "s/^Endpoint = 127\.0\.0\.1:[0-9]*/Endpoint = 127.0.0.1:${new_port}/" "$PHOBOS_DIR/${CLIENT_NAME}.conf"
|
||||
|
||||
log " Назначен локальный порт obfuscator: $new_port"
|
||||
fi
|
||||
|
||||
log "Конфигурации установлены:"
|
||||
log " - Obfuscator: $PHOBOS_DIR/${OBF_CONF_NAME}"
|
||||
log " - WireGuard: $PHOBOS_DIR/${CLIENT_NAME}.conf"
|
||||
}
|
||||
|
||||
deploy_lib_client() {
|
||||
if [ -f "lib-client.sh" ]; then
|
||||
cp "lib-client.sh" "$PHOBOS_DIR/lib-client.sh"
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
deploy_uninstall_script() {
|
||||
log "Развертывание скрипта удаления Phobos..."
|
||||
|
||||
if [ -f "phobos-uninstall.sh" ]; then
|
||||
cp "phobos-uninstall.sh" "$PHOBOS_DIR/phobos-uninstall.sh"
|
||||
chmod +x "$PHOBOS_DIR/phobos-uninstall.sh"
|
||||
log "Скрипт удаления установлен: $PHOBOS_DIR/phobos-uninstall.sh"
|
||||
else
|
||||
log "ПРЕДУПРЕЖДЕНИЕ: phobos-uninstall.sh не найден в архиве"
|
||||
fi
|
||||
}
|
||||
|
||||
deploy_3xui_script() {
|
||||
log "Развертывание скрипта 3xui.sh..."
|
||||
|
||||
if [ -f "3xui.sh" ]; then
|
||||
cp "3xui.sh" "$PHOBOS_DIR/3xui.sh"
|
||||
chmod +x "$PHOBOS_DIR/3xui.sh"
|
||||
log "Скрипт 3xui.sh установлен: $PHOBOS_DIR/3xui.sh"
|
||||
else
|
||||
log "ПРЕДУПРЕЖДЕНИЕ: 3xui.sh не найден в архиве"
|
||||
fi
|
||||
}
|
||||
|
||||
run_3xui_integration() {
|
||||
log ""
|
||||
log "==> Интеграция WireGuard конфигурации в 3x-ui..."
|
||||
|
||||
if [ ! -f "$PHOBOS_DIR/3xui.sh" ]; then
|
||||
log "ОШИБКА: Скрипт $PHOBOS_DIR/3xui.sh не найден"
|
||||
return 1
|
||||
fi
|
||||
|
||||
for cmd in jq sqlite3; do
|
||||
if ! command -v "$cmd" >/dev/null 2>&1; then
|
||||
log "Устанавливаю $cmd..."
|
||||
if command -v apt-get >/dev/null 2>&1; then
|
||||
apt-get update -qq && apt-get install -y -qq "$cmd" >/dev/null 2>&1
|
||||
elif command -v yum >/dev/null 2>&1; then
|
||||
yum install -y -q "${cmd/sqlite3/sqlite}" >/dev/null 2>&1
|
||||
elif command -v dnf >/dev/null 2>&1; then
|
||||
dnf install -y -q "${cmd/sqlite3/sqlite}" >/dev/null 2>&1
|
||||
elif command -v apk >/dev/null 2>&1; then
|
||||
apk add --quiet "${cmd/sqlite3/sqlite}" >/dev/null 2>&1
|
||||
fi
|
||||
if ! command -v "$cmd" >/dev/null 2>&1; then
|
||||
log "ОШИБКА: не удалось установить $cmd"
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
local wg_config="$PHOBOS_DIR/${CLIENT_NAME}.conf"
|
||||
|
||||
if [ ! -f "$wg_config" ]; then
|
||||
log "ОШИБКА: Конфигурация WireGuard не найдена: $wg_config"
|
||||
return 1
|
||||
fi
|
||||
|
||||
log "Запуск интеграции: $PHOBOS_DIR/3xui.sh $wg_config"
|
||||
|
||||
if "$PHOBOS_DIR/3xui.sh" "$wg_config"; then
|
||||
log "[OK] WireGuard конфигурация успешно интегрирована в 3x-ui"
|
||||
log "[OK] Outbound 'Phobos' добавлен в конфигурацию 3x-ui"
|
||||
return 0
|
||||
else
|
||||
log "ОШИБКА: Не удалось интегрировать конфигурацию в 3x-ui"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
cleanup_3xui_script() {
|
||||
local keep_script="$1"
|
||||
|
||||
if [ "$keep_script" = "true" ]; then
|
||||
log "Скрипт 3xui.sh сохранен для использования в 3x-ui режиме"
|
||||
else
|
||||
if [ -f "$PHOBOS_DIR/3xui.sh" ]; then
|
||||
rm -f "$PHOBOS_DIR/3xui.sh"
|
||||
log "Скрипт 3xui.sh удален (не требуется в обычном режиме)"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
install_wireguard_openwrt() {
|
||||
log "Установка пакетов WireGuard для OpenWRT..."
|
||||
|
||||
if ! command -v wg >/dev/null 2>&1; then
|
||||
log "Установка kmod-wireguard и wireguard-tools..."
|
||||
opkg update
|
||||
opkg install kmod-wireguard wireguard-tools luci-proto-wireguard
|
||||
else
|
||||
log "WireGuard уже установлен"
|
||||
fi
|
||||
|
||||
log "Установка luci-app-wireguard для веб-интерфейса..."
|
||||
opkg install luci-app-wireguard >/dev/null 2>&1 || log "ПРЕДУПРЕЖДЕНИЕ: luci-app-wireguard не удалось установить"
|
||||
|
||||
log "✓ Пакеты WireGuard установлены"
|
||||
}
|
||||
|
||||
configure_wireguard_openwrt() {
|
||||
log ""
|
||||
log "==> Автоматическая настройка WireGuard через UCI..."
|
||||
|
||||
extract_wireguard_params
|
||||
|
||||
if [ ! -f "./router-configure-wireguard-openwrt.sh" ]; then
|
||||
log "⚠ Скрипт router-configure-wireguard-openwrt.sh не найден"
|
||||
log " Используйте ручную настройку через LuCI или UCI"
|
||||
return 1
|
||||
fi
|
||||
|
||||
chmod +x ./router-configure-wireguard-openwrt.sh
|
||||
|
||||
if ./router-configure-wireguard-openwrt.sh \
|
||||
--client-name "$CLIENT_NAME" \
|
||||
--client-private-key "$WG_PRIVATE_KEY" \
|
||||
--client-ip "$CLIENT_IP" \
|
||||
--client-ipv6 "$CLIENT_IPV6" \
|
||||
--server-public-key "$WG_SERVER_PUBKEY" \
|
||||
--endpoint-port "$WG_ENDPOINT_PORT" \
|
||||
--keepalive 25 \
|
||||
--mtu 1420 \
|
||||
--fallback-config "$PHOBOS_DIR/${CLIENT_NAME}.conf"; then
|
||||
|
||||
return 0
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
extract_wireguard_params() {
|
||||
log "Извлечение параметров WireGuard из конфигурации..."
|
||||
|
||||
local config_file="$PHOBOS_DIR/${CLIENT_NAME}.conf"
|
||||
|
||||
WG_PRIVATE_KEY=$(grep '^PrivateKey' "$config_file" | cut -d'=' -f2- | tr -d ' \t\n\r')
|
||||
WG_ADDRESS=$(grep '^Address' "$config_file" | cut -d'=' -f2- | tr -d ' \t\n\r')
|
||||
WG_SERVER_PUBKEY=$(grep '^PublicKey' "$config_file" | cut -d'=' -f2- | tr -d ' \t\n\r')
|
||||
WG_ENDPOINT_PORT=$(grep '^Endpoint' "$config_file" | cut -d':' -f2 | tr -d ' \t\n\r')
|
||||
|
||||
CLIENT_IP=$(echo "$WG_ADDRESS" | cut -d',' -f1 | tr -d ' ')
|
||||
CLIENT_IPV6=$(echo "$WG_ADDRESS" | cut -d',' -f2 | tr -d ' ')
|
||||
|
||||
if [ -z "$CLIENT_IPV6" ] || [ "$CLIENT_IPV6" = "$CLIENT_IP" ]; then
|
||||
CLIENT_IPV6=$(grep -A 10 '\[Interface\]' "$config_file" | grep '^Address' | grep -o 'fd[0-9a-f:\/]*' | head -1)
|
||||
fi
|
||||
|
||||
if [ -z "$CLIENT_IPV6" ]; then
|
||||
CLIENT_IPV6="none"
|
||||
fi
|
||||
|
||||
if [ -z "$WG_ENDPOINT_PORT" ]; then
|
||||
WG_ENDPOINT_PORT=13255
|
||||
fi
|
||||
|
||||
log " Private Key: ${WG_PRIVATE_KEY:0:20}..."
|
||||
log " IPv4: $CLIENT_IP"
|
||||
log " IPv6: $CLIENT_IPV6"
|
||||
log " Server PubKey: ${WG_SERVER_PUBKEY:0:20}..."
|
||||
log " Endpoint port: $WG_ENDPOINT_PORT"
|
||||
}
|
||||
|
||||
configure_wireguard_rci() {
|
||||
log ""
|
||||
log "==> Автоматическая настройка WireGuard через RCI API..."
|
||||
|
||||
extract_wireguard_params
|
||||
|
||||
if [ ! -f "./router-configure-wireguard.sh" ]; then
|
||||
log "⚠ Скрипт router-configure-wireguard.sh не найден"
|
||||
log " Используйте ручной импорт (см. инструкции ниже)"
|
||||
return 1
|
||||
fi
|
||||
|
||||
chmod +x ./router-configure-wireguard.sh
|
||||
|
||||
if ./router-configure-wireguard.sh \
|
||||
--client-name "$CLIENT_NAME" \
|
||||
--client-private-key "$WG_PRIVATE_KEY" \
|
||||
--client-ip "$CLIENT_IP" \
|
||||
--client-ipv6 "$CLIENT_IPV6" \
|
||||
--server-public-key "$WG_SERVER_PUBKEY" \
|
||||
--endpoint-port "$WG_ENDPOINT_PORT" \
|
||||
--keepalive 25 \
|
||||
--mtu 1420 \
|
||||
--fallback-config "$PHOBOS_DIR/${CLIENT_NAME}.conf"; then
|
||||
|
||||
return 0
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
show_manual_instructions() {
|
||||
log ""
|
||||
log "╔════════════════════════════════════════════════════════════╗"
|
||||
log "║ Требуется ручной импорт WireGuard конфигурации ║"
|
||||
log "╚════════════════════════════════════════════════════════════╝"
|
||||
log ""
|
||||
log "Выполните следующие шаги:"
|
||||
log ""
|
||||
|
||||
if [ "$ROUTER_PLATFORM" = "keenetic" ]; then
|
||||
log "1. Откройте веб-панель администрирования роутера Keenetic"
|
||||
log " (http://192.168.1.1 или http://my.keenetic.net)"
|
||||
log ""
|
||||
log "2. Перейдите в раздел: Интернет → Другие подключения"
|
||||
log ""
|
||||
log "3. Выберите 'Загрузить конфигурацию из файла' в разделе 'WireGuard'"
|
||||
log ""
|
||||
log "4. Укажите путь к файлу:"
|
||||
log " $PHOBOS_DIR/${CLIENT_NAME}.conf"
|
||||
log ""
|
||||
log "5. Активируйте подключение"
|
||||
elif [ "$ROUTER_PLATFORM" = "openwrt" ]; then
|
||||
log "1. Откройте веб-интерфейс LuCI роутера OpenWRT"
|
||||
log " (обычно http://192.168.1.1)"
|
||||
log ""
|
||||
log "2. Перейдите в: Network → Interfaces"
|
||||
log ""
|
||||
log "3. Создайте новый интерфейс с протоколом WireGuard"
|
||||
log ""
|
||||
log "4. Используйте параметры из файла:"
|
||||
log " $PHOBOS_DIR/${CLIENT_NAME}.conf"
|
||||
log ""
|
||||
log "5. Настройте файрволл зону для интерфейса"
|
||||
fi
|
||||
|
||||
log ""
|
||||
}
|
||||
|
||||
show_final_info() {
|
||||
log ""
|
||||
log "╔════════════════════════════════════════════════════════════╗"
|
||||
log "║ Информация об установке ║"
|
||||
log "╚════════════════════════════════════════════════════════════╝"
|
||||
log ""
|
||||
log "Файлы установки:"
|
||||
|
||||
if [ "$ROUTER_PLATFORM" = "keenetic" ]; then
|
||||
log " Бинарник: /opt/bin/${OBF_BINARY_NAME}"
|
||||
elif [ "$ROUTER_PLATFORM" = "openwrt" ]; then
|
||||
log " Бинарник: /usr/bin/${OBF_BINARY_NAME}"
|
||||
elif [ "$ROUTER_PLATFORM" = "linux" ]; then
|
||||
log " Бинарник: /usr/local/bin/${OBF_BINARY_NAME}"
|
||||
fi
|
||||
|
||||
log " Конфиг obfuscator: $PHOBOS_DIR/${OBF_CONF_NAME}"
|
||||
log " Конфиг WireGuard: $PHOBOS_DIR/${CLIENT_NAME}.conf"
|
||||
|
||||
if [ "$ROUTER_PLATFORM" = "keenetic" ] || [ -f /opt/etc/init.d/${OBF_INIT_NAME} ]; then
|
||||
log " Init-скрипт: /opt/etc/init.d/${OBF_INIT_NAME}"
|
||||
elif [ "$ROUTER_PLATFORM" = "openwrt" ] && [ -f /etc/init.d/${OBF_SERVICE_NAME} ]; then
|
||||
log " Init-скрипт: /etc/init.d/${OBF_SERVICE_NAME}"
|
||||
elif [ "$ROUTER_PLATFORM" = "linux" ]; then
|
||||
log " Systemd service: /etc/systemd/system/${OBF_SERVICE_NAME}.service"
|
||||
log " WireGuard конфиг: /etc/wireguard/${OBF_WG_IFACE}.conf"
|
||||
fi
|
||||
|
||||
log " Uninstall: $PHOBOS_DIR/phobos-uninstall.sh"
|
||||
log " Health monitor: $PHOBOS_DIR/phobos-health.sh"
|
||||
log " Failover config: $PHOBOS_DIR/failover.conf"
|
||||
log ""
|
||||
log "Управление:"
|
||||
|
||||
if [ "$ROUTER_PLATFORM" = "keenetic" ] || [ -f /opt/etc/init.d/${OBF_INIT_NAME} ]; then
|
||||
log " /opt/etc/init.d/${OBF_INIT_NAME} status # Проверить что obfuscator запущен"
|
||||
elif [ "$ROUTER_PLATFORM" = "openwrt" ] && [ -f /etc/init.d/${OBF_SERVICE_NAME} ]; then
|
||||
log " /etc/init.d/${OBF_SERVICE_NAME} status # Проверить что obfuscator запущен"
|
||||
elif [ "$ROUTER_PLATFORM" = "linux" ]; then
|
||||
log " systemctl status ${OBF_SERVICE_NAME} # Проверить что obfuscator запущен"
|
||||
log " systemctl status wg-quick@${OBF_WG_IFACE} # Проверить что WireGuard запущен"
|
||||
fi
|
||||
|
||||
log " $PHOBOS_DIR/phobos-uninstall.sh # Удалить Phobos"
|
||||
log ""
|
||||
}
|
||||
|
||||
|
||||
deploy_health_monitor() {
|
||||
log "Развертывание монитора здоровья Phobos..."
|
||||
|
||||
if [ ! -f "phobos-health.sh" ]; then
|
||||
log "ПРЕДУПРЕЖДЕНИЕ: phobos-health.sh не найден в архиве"
|
||||
return 0
|
||||
fi
|
||||
|
||||
cp "phobos-health.sh" "$PHOBOS_DIR/phobos-health.sh"
|
||||
chmod +x "$PHOBOS_DIR/phobos-health.sh"
|
||||
|
||||
if [ -f "failover.conf" ]; then
|
||||
cp "failover.conf" "$PHOBOS_DIR/failover.conf"
|
||||
chmod 600 "$PHOBOS_DIR/failover.conf"
|
||||
fi
|
||||
|
||||
mkdir -p "$PHOBOS_DIR/state"
|
||||
|
||||
# --- Phobos pull agent: panel -> router config sync (NAT-friendly) ---
|
||||
# Routers behind NAT cannot be reached by the panel over SSH, so they PULL
|
||||
# their failover.conf over HTTP. Ships client_id + pull_token from the package.
|
||||
if [ -f "phobos-pull.sh" ]; then
|
||||
cp "phobos-pull.sh" "$PHOBOS_DIR/phobos-pull.sh"
|
||||
chmod +x "$PHOBOS_DIR/phobos-pull.sh"
|
||||
echo "{{CLIENT_NAME}}" > "$PHOBOS_DIR/client_id"
|
||||
[ -f "pull_token" ] && cp "pull_token" "$PHOBOS_DIR/pull_token"
|
||||
log " Pull-агент установлен (client_id={{CLIENT_NAME}})"
|
||||
fi
|
||||
|
||||
local cron_line="*/1 * * * * $PHOBOS_DIR/phobos-health.sh"
|
||||
local pull_line="*/1 * * * * $PHOBOS_DIR/phobos-pull.sh"
|
||||
[ -f "$PHOBOS_DIR/phobos-pull.sh" ] || pull_line=""
|
||||
|
||||
if [ "$ROUTER_PLATFORM" = "keenetic" ]; then
|
||||
# Install cron if not present (Entware)
|
||||
if ! command -v crontab >/dev/null 2>&1 && command -v opkg >/dev/null 2>&1; then
|
||||
log " Установка cron через opkg..."
|
||||
opkg update >/dev/null 2>&1
|
||||
opkg install cron >/dev/null 2>&1
|
||||
/opt/etc/init.d/S10cron start >/dev/null 2>&1 || true
|
||||
fi
|
||||
local cron_file="/opt/etc/crontab"
|
||||
# Create crontab file if missing
|
||||
if [ ! -f "$cron_file" ]; then
|
||||
mkdir -p /opt/etc
|
||||
touch "$cron_file"
|
||||
fi
|
||||
if ! grep -q "phobos-health" "$cron_file" 2>/dev/null; then
|
||||
echo "$cron_line" >> "$cron_file"
|
||||
log " Cron (health) добавлен в $cron_file"
|
||||
fi
|
||||
if [ -n "$pull_line" ] && ! grep -q "phobos-pull" "$cron_file" 2>/dev/null; then
|
||||
echo "$pull_line" >> "$cron_file"
|
||||
log " Cron (pull) добавлен в $cron_file"
|
||||
fi
|
||||
/opt/etc/init.d/S10cron restart >/dev/null 2>&1 || true
|
||||
elif [ "$ROUTER_PLATFORM" = "openwrt" ]; then
|
||||
(crontab -l 2>/dev/null | grep -v "phobos-health" | grep -v "phobos-pull"; echo "$cron_line"; [ -n "$pull_line" ] && echo "$pull_line") | crontab -
|
||||
log " Cron добавлен через crontab (health + pull)"
|
||||
elif [ "$ROUTER_PLATFORM" = "linux" ]; then
|
||||
{ echo "$cron_line"; [ -n "$pull_line" ] && echo "$pull_line"; } > /etc/cron.d/phobos-health
|
||||
chmod 644 /etc/cron.d/phobos-health
|
||||
log " Cron добавлен в /etc/cron.d/phobos-health (health + pull)"
|
||||
fi
|
||||
|
||||
log " Монитор здоровья: $PHOBOS_DIR/phobos-health.sh"
|
||||
log " Failover конфиг: $PHOBOS_DIR/failover.conf"
|
||||
log " Проверка каждую минуту через cron"
|
||||
}
|
||||
|
||||
main() {
|
||||
ROUTER_PLATFORM=$(detect_router_platform)
|
||||
PHOBOS_DIR=$(detect_phobos_dir "$ROUTER_PLATFORM")
|
||||
IS_3XUI_MODE=$(detect_3xui_mode "$ROUTER_PLATFORM")
|
||||
|
||||
log "==> Определена платформа: $ROUTER_PLATFORM"
|
||||
log "==> Директория Phobos: $PHOBOS_DIR"
|
||||
|
||||
resolve_install_names
|
||||
log "==> Режим установки obfuscator: binary=${OBF_BINARY_NAME}, conf=${OBF_CONF_NAME}, init=${OBF_INIT_NAME}, service=${OBF_SERVICE_NAME}"
|
||||
|
||||
if [ "$IS_3XUI_MODE" = "true" ]; then
|
||||
log "==> Обнаружен режим установки: 3x-ui"
|
||||
log "==> В этом режиме WireGuard не устанавливается"
|
||||
log "==> Будет развернут только wg-obfuscator и интеграция с 3x-ui"
|
||||
fi
|
||||
|
||||
if [ "$ROUTER_PLATFORM" = "unknown" ]; then
|
||||
log "ОШИБКА: Неподдерживаемая платформа"
|
||||
log "Вывод uname -a: $(uname -a)"
|
||||
log ""
|
||||
log "Поддерживаемые платформы:"
|
||||
log " - Keenetic/Netcraze (определяется по 'Keenetic' или 'Netcraze' в uname)"
|
||||
log " - OpenWRT (определяется по 'OpenWrt', 'LEDE' или 'ImmortalWrt' в uname)"
|
||||
log " - Linux (Ubuntu/Debian)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p "$PHOBOS_DIR"
|
||||
log "==> Начало установки Phobos на роутер $ROUTER_PLATFORM"
|
||||
log "==> Клиент: $CLIENT_NAME"
|
||||
|
||||
check_root
|
||||
|
||||
if ! check_dependencies "$ROUTER_PLATFORM"; then
|
||||
log "ОШИБКА: Не удалось установить зависимости"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
ARCH=$(detect_arch)
|
||||
log "Определена архитектура: $ARCH"
|
||||
|
||||
if [ "$ARCH" = "unknown" ]; then
|
||||
log "Ошибка: неподдерживаемая архитектура"
|
||||
log "Вывод uname -m: $(uname -m)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
install_obfuscator "$ARCH"
|
||||
setup_configs
|
||||
deploy_lib_client
|
||||
deploy_uninstall_script
|
||||
deploy_health_monitor
|
||||
|
||||
if [ "$IS_3XUI_MODE" = "true" ]; then
|
||||
deploy_3xui_script
|
||||
fi
|
||||
|
||||
if [ "$ROUTER_PLATFORM" = "keenetic" ]; then
|
||||
create_init_script
|
||||
start_obfuscator
|
||||
|
||||
if configure_wireguard_rci; then
|
||||
log ""
|
||||
log "╔════════════════════════════════════════════════════════════╗"
|
||||
log "║ ✓ Установка завершена успешно! ║"
|
||||
log "║ ✓ WireGuard настроен автоматически через RCI API ║"
|
||||
log "╚════════════════════════════════════════════════════════════╝"
|
||||
show_final_info
|
||||
else
|
||||
log ""
|
||||
log "╔════════════════════════════════════════════════════════════╗"
|
||||
log "║ ✓ Obfuscator установлен успешно ║"
|
||||
log "║ ⚠ WireGuard требует ручной настройки ║"
|
||||
log "╚════════════════════════════════════════════════════════════╝"
|
||||
show_manual_instructions
|
||||
show_final_info
|
||||
fi
|
||||
|
||||
elif [ "$ROUTER_PLATFORM" = "openwrt" ]; then
|
||||
install_wireguard_openwrt
|
||||
|
||||
if [ -d "/opt/etc" ]; then
|
||||
create_init_script
|
||||
else
|
||||
create_procd_init_script
|
||||
fi
|
||||
|
||||
start_obfuscator
|
||||
|
||||
if configure_wireguard_openwrt; then
|
||||
log ""
|
||||
log "╔════════════════════════════════════════════════════════════╗"
|
||||
log "║ ✓ Установка завершена успешно! ║"
|
||||
log "║ ✓ WireGuard настроен автоматически через UCI ║"
|
||||
log "╚════════════════════════════════════════════════════════════╝"
|
||||
show_final_info
|
||||
else
|
||||
log ""
|
||||
log "╔════════════════════════════════════════════════════════════╗"
|
||||
log "║ ✓ Obfuscator установлен успешно ║"
|
||||
log "║ ⚠ WireGuard требует ручной настройки ║"
|
||||
log "╚════════════════════════════════════════════════════════════╝"
|
||||
show_manual_instructions
|
||||
show_final_info
|
||||
fi
|
||||
|
||||
elif [ "$ROUTER_PLATFORM" = "linux" ]; then
|
||||
if [ "$IS_3XUI_MODE" = "true" ]; then
|
||||
log ""
|
||||
log "╔════════════════════════════════════════════════════════════╗"
|
||||
log "║ Режим установки: 3x-ui ║"
|
||||
log "╚════════════════════════════════════════════════════════════╝"
|
||||
log ""
|
||||
|
||||
create_systemd_obfuscator_service
|
||||
|
||||
if run_3xui_integration; then
|
||||
cleanup_3xui_script "true"
|
||||
log ""
|
||||
log "╔════════════════════════════════════════════════════════════╗"
|
||||
log "║ ✓ Установка в режиме 3x-ui завершена успешно! ║"
|
||||
log "║ ✓ Obfuscator настроен через systemd ║"
|
||||
log "║ ✓ Outbound 'Phobos' добавлен в конфигурацию 3x-ui ║"
|
||||
log "╚════════════════════════════════════════════════════════════╝"
|
||||
log ""
|
||||
log "Файлы установки:"
|
||||
log " Бинарник: /usr/local/bin/wg-obfuscator"
|
||||
log " Конфиг obfuscator: $PHOBOS_DIR/wg-obfuscator.conf"
|
||||
log " Конфиг WireGuard: $PHOBOS_DIR/${CLIENT_NAME}.conf"
|
||||
log " Скрипт 3xui.sh: $PHOBOS_DIR/3xui.sh"
|
||||
log " Systemd service: /etc/systemd/system/phobos-obfuscator.service"
|
||||
log ""
|
||||
log "Управление:"
|
||||
log " systemctl status phobos-obfuscator # Проверить что obfuscator запущен"
|
||||
log ""
|
||||
log "Примечание:"
|
||||
log " WireGuard управляется через 3x-ui панель"
|
||||
log " Скрипт 3xui.sh сохранен для повторной интеграции при необходимости"
|
||||
log ""
|
||||
else
|
||||
log ""
|
||||
log "╔════════════════════════════════════════════════════════════╗"
|
||||
log "║ ✗ Установка в режиме 3x-ui завершена с ошибками ║"
|
||||
log "╚════════════════════════════════════════════════════════════╝"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
install_wireguard_linux || {
|
||||
log "ОШИБКА: Не удалось установить WireGuard"
|
||||
exit 1
|
||||
}
|
||||
|
||||
create_systemd_obfuscator_service
|
||||
|
||||
if configure_wireguard_linux; then
|
||||
configure_ufw_linux
|
||||
cleanup_3xui_script "false"
|
||||
log ""
|
||||
log "╔════════════════════════════════════════════════════════════╗"
|
||||
log "║ ✓ Установка завершена успешно! ║"
|
||||
log "║ ✓ WireGuard и Obfuscator настроены через systemd ║"
|
||||
log "╚════════════════════════════════════════════════════════════╝"
|
||||
show_final_info
|
||||
else
|
||||
cleanup_3xui_script "false"
|
||||
log ""
|
||||
log "╔════════════════════════════════════════════════════════════╗"
|
||||
log "║ ⚠ Установка завершена с предупреждениями ║"
|
||||
log "║ ⚠ Проверьте статус служб вручную ║"
|
||||
log "╚════════════════════════════════════════════════════════════╝"
|
||||
show_final_info
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
log "==> Установка завершена."
|
||||
}
|
||||
|
||||
main "$@"
|
||||
399
overlay/phobos-client.sh
Executable file
399
overlay/phobos-client.sh
Executable file
@@ -0,0 +1,399 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
source "$(dirname "${BASH_SOURCE[0]}")/lib-core.sh"
|
||||
|
||||
check_root
|
||||
load_env
|
||||
ensure_dirs
|
||||
|
||||
CMD="${1:-help}"
|
||||
CLIENT_ARG="${2:-}"
|
||||
EXTRA_ARG="${3:-}"
|
||||
|
||||
resolve_client() {
|
||||
local name="$1"
|
||||
local id=$(echo "$name" | tr ' ' '-' | tr '[:upper:]' '[:lower:]')
|
||||
|
||||
if [[ -d "$CLIENTS_DIR/$id" ]]; then
|
||||
echo "$id"
|
||||
return 0
|
||||
fi
|
||||
return 1
|
||||
}
|
||||
|
||||
action_add() {
|
||||
local name="$CLIENT_ARG"
|
||||
local manual_ip="$EXTRA_ARG"
|
||||
|
||||
if [[ -z "$name" ]]; then die "Использование: $0 add <client_name> [ip]"; fi
|
||||
|
||||
local id=$(echo "$name" | tr ' ' '-' | tr '[:upper:]' '[:lower:]')
|
||||
local dir="$CLIENTS_DIR/$id"
|
||||
|
||||
if [[ -d "$dir" ]]; then die "Клиент $id уже существует."; fi
|
||||
|
||||
if [[ -z "$SERVER_WG_PUBLIC_KEY" ]]; then
|
||||
die "Публичный ключ сервера не найден в server.env. Запустите установку."
|
||||
fi
|
||||
|
||||
local server_pub="$SERVER_WG_PUBLIC_KEY"
|
||||
local server_ip_v4="${SERVER_PUBLIC_IP_V4:-}"
|
||||
local server_ip_v6="${SERVER_PUBLIC_IP_V6:-}"
|
||||
|
||||
local client_ip_v4="$manual_ip"
|
||||
local ipv4_prefix_main=$(echo "${SERVER_WG_IPV4_NETWORK:-10.25.0.0/16}" | cut -d'/' -f1 | cut -d'.' -f1-2)
|
||||
local ipv6_prefix_main=$(echo "${SERVER_WG_IPV6_NETWORK:-fd00:10:25::/48}" | cut -d'/' -f1 | sed 's/::.*//')
|
||||
|
||||
if [[ -z "$client_ip_v4" ]]; then
|
||||
log_info "Поиск свободного IP..."
|
||||
declare -A used_ips
|
||||
|
||||
for d in "$CLIENTS_DIR"/*; do
|
||||
if [[ -d "$d" ]] && [[ -f "$d/metadata.json" ]]; then
|
||||
local ip=$(jq -r '.tunnel_ip_v4 // empty' "$d/metadata.json" 2>/dev/null)
|
||||
[[ -n "$ip" ]] && used_ips["$ip"]=1
|
||||
fi
|
||||
done
|
||||
|
||||
used_ips["${ipv4_prefix_main}.0.1"]=1
|
||||
|
||||
local found=false
|
||||
for oct3 in {0..255}; do
|
||||
local start_oct4=2
|
||||
for oct4 in $(seq $start_oct4 254); do
|
||||
local candidate="${ipv4_prefix_main}.${oct3}.${oct4}"
|
||||
if [[ -z "${used_ips[$candidate]:-}" ]]; then
|
||||
client_ip_v4="$candidate"
|
||||
found=true
|
||||
break 2
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
[[ "$found" == "false" ]] && die "Нет свободных IP в подсети."
|
||||
fi
|
||||
|
||||
local oct3=$(echo "$client_ip_v4" | cut -d. -f3)
|
||||
local oct4=$(echo "$client_ip_v4" | cut -d. -f4)
|
||||
local hex_part=$(printf "%x:%x" "$oct3" "$oct4")
|
||||
local client_ip_v6=""
|
||||
[[ -n "$server_ip_v6" ]] && client_ip_v6="${ipv6_prefix_main}::${hex_part}"
|
||||
|
||||
log_info "Назначен IP: $client_ip_v4 $([[ -n $client_ip_v6 ]] && echo "/ $client_ip_v6")"
|
||||
|
||||
mkdir -p "$dir"
|
||||
umask 077
|
||||
wg genkey > "$dir/client_private.key"
|
||||
wg pubkey < "$dir/client_private.key" > "$dir/client_public.key"
|
||||
local priv_key=$(cat "$dir/client_private.key")
|
||||
local pub_key=$(cat "$dir/client_public.key")
|
||||
|
||||
local allowed_ips="0.0.0.0/0"
|
||||
local addr_str="$client_ip_v4/32"
|
||||
if [[ -n "$client_ip_v6" ]]; then
|
||||
allowed_ips="0.0.0.0/0, ::/0"
|
||||
addr_str="$client_ip_v4/32, $client_ip_v6/128"
|
||||
fi
|
||||
|
||||
cat > "$dir/${id}.conf" <<EOF
|
||||
[Interface]
|
||||
PrivateKey = $priv_key
|
||||
Address = $addr_str
|
||||
DNS = 1.1.1.1, 8.8.8.8
|
||||
MTU = 1420
|
||||
|
||||
[Peer]
|
||||
PublicKey = $server_pub
|
||||
Endpoint = 127.0.0.1:${CLIENT_WG_PORT:-13255}
|
||||
AllowedIPs = $allowed_ips
|
||||
PersistentKeepalive = 25
|
||||
EOF
|
||||
chmod 600 "$dir/${id}.conf"
|
||||
|
||||
cat > "$dir/wg-obfuscator.conf" <<EOF
|
||||
[instance]
|
||||
source-if = 127.0.0.1
|
||||
source-lport = ${CLIENT_WG_PORT:-13255}
|
||||
target = $SERVER_PUBLIC_IP_V4:${OBFUSCATOR_PORT:-51821}
|
||||
key = ${OBFUSCATOR_KEY:-KEY}
|
||||
masking = ${OBFUSCATOR_MASKING:-AUTO}
|
||||
verbose = INFO
|
||||
idle-timeout = ${OBFUSCATOR_IDLE:-300}
|
||||
max-dummy = ${OBFUSCATOR_DUMMY:-4}
|
||||
EOF
|
||||
chmod 600 "$dir/wg-obfuscator.conf"
|
||||
|
||||
cat > "$dir/metadata.json" <<EOF
|
||||
{
|
||||
"client_id": "$id",
|
||||
"client_name": "$name",
|
||||
"tunnel_ip_v4": "$client_ip_v4",
|
||||
"tunnel_ip_v6": "$client_ip_v6",
|
||||
"public_key": "$pub_key",
|
||||
"created_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
|
||||
"obfuscator_key": "${OBFUSCATOR_KEY:-}",
|
||||
"obfuscator_dummy": "${OBFUSCATOR_DUMMY:-4}",
|
||||
"obfuscator_idle": "${OBFUSCATOR_IDLE:-300}",
|
||||
"server_ip_v4": "$SERVER_PUBLIC_IP_V4",
|
||||
"server_port": "${OBFUSCATOR_PORT:-}"
|
||||
}
|
||||
EOF
|
||||
chmod 600 "$dir/metadata.json"
|
||||
|
||||
local peer_ips="$client_ip_v4/32"
|
||||
[[ -n "$client_ip_v6" ]] && peer_ips="$peer_ips, $client_ip_v6/128"
|
||||
|
||||
cat >> "$WG_CONFIG" <<EOF
|
||||
|
||||
[Peer]
|
||||
PublicKey = $pub_key
|
||||
AllowedIPs = $peer_ips
|
||||
EOF
|
||||
|
||||
wg syncconf wg0 <(wg-quick strip wg0 2>/dev/null) 2>/dev/null
|
||||
log_success "Клиент $name создан."
|
||||
|
||||
CLIENT_ARG="$id"
|
||||
action_package
|
||||
action_link
|
||||
}
|
||||
|
||||
action_remove() {
|
||||
local id=$(resolve_client "$CLIENT_ARG")
|
||||
if [[ -z "$id" ]]; then die "Клиент не найден."; fi
|
||||
local dir="$CLIENTS_DIR/$id"
|
||||
|
||||
log_info "Удаление клиента $id..."
|
||||
|
||||
if [[ -f "$dir/client_public.key" ]]; then
|
||||
local pub=$(cat "$dir/client_public.key")
|
||||
if grep -qF "$pub" "$WG_CONFIG"; then
|
||||
awk -v key="$pub" '
|
||||
BEGIN {RS=""; ORS="\n\n"}
|
||||
index($0, key) == 0 {print $0}
|
||||
' "$WG_CONFIG" > "$WG_CONFIG.tmp" && mv "$WG_CONFIG.tmp" "$WG_CONFIG"
|
||||
|
||||
sed -i '/^$/N;/^\n$/D' "$WG_CONFIG"
|
||||
|
||||
wg syncconf wg0 <(wg-quick strip wg0 2>/dev/null) 2>/dev/null
|
||||
log_success "Peer удален из конфигурации."
|
||||
fi
|
||||
fi
|
||||
|
||||
rm -rf "$dir"
|
||||
rm -f "$PACKAGES_DIR/phobos-$id.tar.gz"
|
||||
|
||||
if [[ -f "$TOKENS_FILE" ]] && command -v jq >/dev/null; then
|
||||
local tokens=$(jq -r ".[] | select(.client == \"$id\") | .token" "$TOKENS_FILE")
|
||||
for t in $tokens; do
|
||||
rm -f "$WWW_DIR/init/$t.sh"
|
||||
rm -rf "$WWW_DIR/packages/$t"
|
||||
done
|
||||
jq "map(select(.client != \"$id\"))" "$TOKENS_FILE" > "$TOKENS_FILE.tmp" && mv "$TOKENS_FILE.tmp" "$TOKENS_FILE"
|
||||
fi
|
||||
|
||||
log_success "Клиент $id полностью удален."
|
||||
}
|
||||
|
||||
action_package() {
|
||||
local id=$(resolve_client "$CLIENT_ARG")
|
||||
if [[ -z "$id" ]]; then die "Клиент не найден."; fi
|
||||
|
||||
log_info "Сборка пакета для $id..."
|
||||
local dir="$CLIENTS_DIR/$id"
|
||||
local tmp=$(mktemp -d)
|
||||
local pkg_root="$tmp/phobos-$id"
|
||||
|
||||
mkdir -p "$pkg_root/bin"
|
||||
|
||||
cp "$dir/${id}.conf" "$pkg_root/${id}.conf"
|
||||
cp "$dir/wg-obfuscator.conf" "$pkg_root/wg-obfuscator.conf"
|
||||
|
||||
for arch in mipsel mips aarch64 armv7 x86_64; do
|
||||
[[ -f "$PHOBOS_DIR/bin/wg-obfuscator-$arch" ]] && cp "$PHOBOS_DIR/bin/wg-obfuscator-$arch" "$pkg_root/bin/"
|
||||
done
|
||||
|
||||
local tpl_dir="$REPO_DIR/client/templates"
|
||||
|
||||
if [[ -d "$tpl_dir" ]]; then
|
||||
cp "$tpl_dir/install-router.sh.template" "$pkg_root/install-router.sh"
|
||||
sed -i "s|{{CLIENT_NAME}}|${id}|g" "$pkg_root/install-router.sh"
|
||||
chmod +x "$pkg_root/install-router.sh"
|
||||
[[ -f "$tpl_dir/lib-client.sh" ]] && cp "$tpl_dir/lib-client.sh" "$pkg_root/lib-client.sh"
|
||||
[[ -f "$tpl_dir/install-obfuscator.sh" ]] && cp "$tpl_dir/install-obfuscator.sh" "$pkg_root/install-obfuscator.sh"
|
||||
[[ -f "$tpl_dir/install-wireguard.sh" ]] && cp "$tpl_dir/install-wireguard.sh" "$pkg_root/install-wireguard.sh"
|
||||
for f in router-configure-wireguard router-configure-wireguard-openwrt phobos-uninstall 3xui; do
|
||||
[[ -f "$tpl_dir/$f.sh" ]] && cp "$tpl_dir/$f.sh" "$pkg_root/$f.sh" && chmod +x "$pkg_root/$f.sh"
|
||||
done
|
||||
else
|
||||
log_warn "Шаблоны не найдены в $tpl_dir"
|
||||
fi
|
||||
|
||||
echo "Phobos Client Package for $id" > "$pkg_root/README.txt"
|
||||
echo "Date: $(date)" >> "$pkg_root/README.txt"
|
||||
|
||||
# Health monitor + failover
|
||||
if [[ -f "$PHOBOS_DIR/server/phobos-health.sh" ]]; then
|
||||
cp "$PHOBOS_DIR/server/phobos-health.sh" "$pkg_root/phobos-health.sh"
|
||||
chmod +x "$pkg_root/phobos-health.sh"
|
||||
fi
|
||||
# Pull agent: panel -> router config sync (NAT-friendly). Token = panel
|
||||
# server_api_key (the /api/router-config endpoint accepts it as a fallback).
|
||||
for src in "$tpl_dir/phobos-pull.sh" "$PHOBOS_DIR/server/phobos-pull.sh"; do
|
||||
if [[ -f "$src" ]]; then cp "$src" "$pkg_root/phobos-pull.sh"; chmod +x "$pkg_root/phobos-pull.sh"; break; fi
|
||||
done
|
||||
local PULL_TOKEN=""
|
||||
command -v jq >/dev/null && PULL_TOKEN=$(jq -r '.server_api_key // empty' /opt/phobos-panel/settings.json 2>/dev/null)
|
||||
[[ -n "$PULL_TOKEN" ]] && echo "$PULL_TOKEN" > "$pkg_root/pull_token"
|
||||
# Generate failover.conf with current server data
|
||||
source "$PHOBOS_DIR/server/server.env"
|
||||
cat > "$pkg_root/failover.conf" <<FAILEOF
|
||||
# Phobos Failover Configuration
|
||||
SERVER_1=${SERVER_PUBLIC_IP_V4}:51821,51822,51823
|
||||
KEY_1=${OBFUSCATOR_KEY}
|
||||
FAILEOF
|
||||
|
||||
find "$pkg_root" -type f ! -path "*/bin/*" -exec sed -i 's/\r$//' {} \;
|
||||
|
||||
tar -C "$tmp" -czf "$PACKAGES_DIR/phobos-$id.tar.gz" "phobos-$id"
|
||||
rm -rf "$tmp"
|
||||
|
||||
log_success "Пакет создан: $PACKAGES_DIR/phobos-$id.tar.gz"
|
||||
}
|
||||
|
||||
action_check() {
|
||||
local id=$(resolve_client "$CLIENT_ARG")
|
||||
if [[ -z "$id" ]]; then die "Клиент не найден."; fi
|
||||
|
||||
local dir="$CLIENTS_DIR/$id"
|
||||
local changes=()
|
||||
|
||||
if [[ ! -f "$dir/metadata.json" ]]; then
|
||||
echo "metadata_missing"
|
||||
return 1
|
||||
fi
|
||||
|
||||
local client_server_ip=$(jq -r '.server_ip_v4 // ""' "$dir/metadata.json")
|
||||
local client_obf_key=$(jq -r '.obfuscator_key // ""' "$dir/metadata.json")
|
||||
local client_obf_port=$(jq -r '.server_port // ""' "$dir/metadata.json")
|
||||
local client_obf_dummy=$(jq -r '.obfuscator_dummy // "4"' "$dir/metadata.json")
|
||||
local client_obf_idle=$(jq -r '.obfuscator_idle // "300"' "$dir/metadata.json")
|
||||
|
||||
local client_wg_pubkey=""
|
||||
if [[ -f "$dir/${id}.conf" ]]; then
|
||||
client_wg_pubkey=$(grep "^PublicKey" "$dir/${id}.conf" | cut -d'=' -f2- | tr -d ' ')
|
||||
fi
|
||||
|
||||
[[ "$client_server_ip" != "$SERVER_PUBLIC_IP_V4" ]] && changes+=("IP сервера: $client_server_ip -> $SERVER_PUBLIC_IP_V4")
|
||||
[[ "$client_obf_key" != "$OBFUSCATOR_KEY" ]] && changes+=("Ключ обфускатора: изменен")
|
||||
[[ "$client_obf_port" != "$OBFUSCATOR_PORT" ]] && changes+=("Порт обфускатора: $client_obf_port -> $OBFUSCATOR_PORT")
|
||||
[[ "$client_obf_dummy" != "$OBFUSCATOR_DUMMY" ]] && changes+=("Max dummy: изменен")
|
||||
[[ "$client_obf_idle" != "$OBFUSCATOR_IDLE" ]] && changes+=("Idle таймаут: изменен")
|
||||
[[ -n "$client_wg_pubkey" && "$client_wg_pubkey" != "$SERVER_WG_PUBLIC_KEY" ]] && changes+=("Публичный ключ WG: изменен")
|
||||
|
||||
if [[ ${#changes[@]} -gt 0 ]]; then
|
||||
echo "ИЗМЕНЕНИЯ КОНФИГУРАЦИИ:"
|
||||
for c in "${changes[@]}"; do
|
||||
echo " - $c"
|
||||
done
|
||||
return 1
|
||||
fi
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
action_link() {
|
||||
local id=$(resolve_client "$CLIENT_ARG")
|
||||
if [[ -z "$id" ]]; then die "Клиент не найден."; fi
|
||||
local ttl="${EXTRA_ARG:-$TOKEN_TTL}"
|
||||
|
||||
if ! command -v jq >/dev/null; then die "jq не установлен. Установите: apt-get install jq"; fi
|
||||
|
||||
local token=$(head -c 16 /dev/urandom | md5sum | cut -d' ' -f1)
|
||||
local exp=$(($(date +%s) + ttl))
|
||||
|
||||
if [[ ! -f "$TOKENS_FILE" ]]; then
|
||||
echo "[]" > "$TOKENS_FILE"
|
||||
fi
|
||||
|
||||
local clean_json=$(jq "map(select(.client != \"$id\"))" "$TOKENS_FILE")
|
||||
echo "$clean_json" | jq ". + [{\"client\": \"$id\", \"token\": \"$token\", \"expires\": $exp}]" > "$TOKENS_FILE.tmp" && mv "$TOKENS_FILE.tmp" "$TOKENS_FILE"
|
||||
|
||||
local link_dir="$WWW_DIR/packages/$token"
|
||||
rm -rf "$link_dir"
|
||||
mkdir -p "$link_dir"
|
||||
ln -s "$PACKAGES_DIR/phobos-$id.tar.gz" "$link_dir/phobos-$id.tar.gz"
|
||||
|
||||
mkdir -p "$WWW_DIR/init"
|
||||
local script_url="http://${SERVER_PUBLIC_IP_V4}:${HTTP_PORT:-80}/packages/$token/phobos-$id.tar.gz"
|
||||
|
||||
cat > "$WWW_DIR/init/$token.sh" <<EOF
|
||||
#!/bin/sh
|
||||
url="$script_url"
|
||||
dir="/tmp/phobos_install_\$\$"
|
||||
mkdir -p "\$dir"
|
||||
echo "Downloading..."
|
||||
if command -v curl >/dev/null; then
|
||||
curl -L -s -o "\$dir/package.tar.gz" "\$url"
|
||||
else
|
||||
wget -q -O "\$dir/package.tar.gz" "\$url"
|
||||
fi
|
||||
if [ ! -f "\$dir/package.tar.gz" ]; then echo "Download failed"; exit 1; fi
|
||||
cd "\$dir"
|
||||
tar xzf package.tar.gz
|
||||
cd "phobos-$id"
|
||||
chmod +x install-router.sh
|
||||
./install-router.sh
|
||||
EOF
|
||||
|
||||
# nginx (www-data) must read these; the builder runs with a strict root umask
|
||||
# (files 600 / dirs 700) which makes the install URL return 403. Fix perms.
|
||||
chmod 755 "$WWW_DIR" "$WWW_DIR/init" "$WWW_DIR/packages" "$link_dir" 2>/dev/null
|
||||
chmod 644 "$WWW_DIR/init/$token.sh" 2>/dev/null
|
||||
chmod 755 "$PACKAGES_DIR" 2>/dev/null
|
||||
chmod 644 "$PACKAGES_DIR/phobos-$id.tar.gz" 2>/dev/null
|
||||
|
||||
local cmd="curl -s http://${SERVER_PUBLIC_IP_V4}:${HTTP_PORT:-80}/init/$token.sh | sh"
|
||||
|
||||
echo ""
|
||||
echo "=================================================="
|
||||
echo "КОМАНДА ДЛЯ УСТАНОВКИ (Действительна $(($ttl / 3600))ч)"
|
||||
echo "=================================================="
|
||||
echo "$cmd"
|
||||
echo "=================================================="
|
||||
echo ""
|
||||
}
|
||||
|
||||
action_list() {
|
||||
printf "% -20s % -20s % -20s\n" "CLIENT ID" "IPv4" "CREATED"
|
||||
echo "------------------------------------------------------------"
|
||||
for d in "$CLIENTS_DIR"/*; do
|
||||
if [[ -d "$d" ]]; then
|
||||
local id=$(basename "$d")
|
||||
local ip="N/A"
|
||||
local date="N/A"
|
||||
if [[ -f "$d/metadata.json" ]]; then
|
||||
ip=$(jq -r '.tunnel_ip_v4 // "N/A"' "$d/metadata.json")
|
||||
date=$(jq -r '.created_at // "N/A"' "$d/metadata.json" | cut -d'T' -f1)
|
||||
fi
|
||||
printf "% -20s % -20s % -20s\n" "$id" "$ip" "$date"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
case "$CMD" in
|
||||
add) action_add ;;
|
||||
remove) action_remove ;;
|
||||
package) action_package ;;
|
||||
link) action_link ;;
|
||||
check) action_check ;;
|
||||
list) action_list ;;
|
||||
rebuild)
|
||||
action_remove
|
||||
action_add
|
||||
;;
|
||||
*)
|
||||
echo "Usage: $0 {add|remove|list|package|link|check|rebuild}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
93
overlay/phobos-pull.sh
Executable file
93
overlay/phobos-pull.sh
Executable file
@@ -0,0 +1,93 @@
|
||||
#!/bin/sh
|
||||
# ============================================================
|
||||
# Phobos Config Pull — NAT-friendly management channel.
|
||||
# Runs ON the router via cron (every 2 min). OUTBOUND ONLY:
|
||||
# fetches this client's failover.conf from the panel over
|
||||
# HTTPS/HTTP and applies it. No inbound SSH needed, so it works
|
||||
# behind any NAT and regardless of which Phobos server is active.
|
||||
#
|
||||
# Why pull (not panel->router SSH):
|
||||
# - routers sit behind NAT with no public IP (KeenDNS is HTTP-
|
||||
# only, no port 22),
|
||||
# - WG3 must be security-level PUBLIC for LAN client routing,
|
||||
# which blocks inbound SSH on the tunnel,
|
||||
# - on failover the router's 10.25.0.2 moves to another server's
|
||||
# wg0, so a fixed panel host cannot reach it.
|
||||
# Pulling sidesteps all three.
|
||||
#
|
||||
# Files (written by installer / bootstrap):
|
||||
# /opt/etc/Phobos/client_id -> this router's client id (e.g. home)
|
||||
# /opt/etc/Phobos/pull_token -> shared secret for the panel endpoint
|
||||
# PANEL env or default below -> panel base URL
|
||||
# ============================================================
|
||||
PHOBOS_DIR="/opt/etc/Phobos"
|
||||
CONF="$PHOBOS_DIR/failover.conf"
|
||||
HEALTH="$PHOBOS_DIR/phobos-health.sh"
|
||||
LOG="$PHOBOS_DIR/health.log"
|
||||
# Config sources, tried in order. TUNNEL FIRST: 10.25.0.1 is the wg0 of whatever
|
||||
# server the tunnel currently terminates on, so management rides the same
|
||||
# obfuscated channel as data — survives a public-IP ban and follows failover.
|
||||
# - 10.25.0.1:8444 -> secondary server agent (phobos-api)
|
||||
# - 10.25.0.1:10514 -> primary server panel
|
||||
# - public panel IP -> bootstrap / if tunnel is down
|
||||
PANEL="${PANEL:-http://212.118.52.193:10514}"
|
||||
PANEL_URLS="${PANEL_URLS:-http://10.25.0.1:8444 http://10.25.0.1:10514 $PANEL}"
|
||||
CLIENT_ID=$(cat "$PHOBOS_DIR/client_id" 2>/dev/null || echo "home")
|
||||
TOKEN=$(cat "$PHOBOS_DIR/pull_token" 2>/dev/null)
|
||||
TMP="/tmp/failover.conf.pull"
|
||||
LOCK="/tmp/phobos-pull.lock"
|
||||
|
||||
log() { echo "$(date '+%H:%M:%S') $1" >> "$LOG"; }
|
||||
|
||||
# single instance
|
||||
if [ -f "$LOCK" ]; then
|
||||
pid=$(cat "$LOCK" 2>/dev/null)
|
||||
kill -0 "$pid" 2>/dev/null && exit 0
|
||||
fi
|
||||
echo $$ > "$LOCK"
|
||||
trap 'rm -f "$LOCK"' EXIT
|
||||
|
||||
[ -z "$TOKEN" ] && exit 0
|
||||
|
||||
# One fetch + compare + apply pass. Returns 0 always (best-effort).
|
||||
do_pull() {
|
||||
# Try each source (tunnel first); accept first that returns a valid conf.
|
||||
got=0
|
||||
for base in $PANEL_URLS; do
|
||||
curl -s -m 8 -o "$TMP" "${base}/api/router-config/${CLIENT_ID}?token=${TOKEN}" 2>/dev/null || continue
|
||||
if grep -q "^SERVER_1=" "$TMP" 2>/dev/null; then got=1; break; fi
|
||||
done
|
||||
[ "$got" = 1 ] || { rm -f "$TMP"; return 0; }
|
||||
|
||||
new=$(md5sum "$TMP" 2>/dev/null | cut -d' ' -f1)
|
||||
old=$(md5sum "$CONF" 2>/dev/null | cut -d' ' -f1)
|
||||
if [ "$new" = "$old" ]; then
|
||||
rm -f "$TMP"
|
||||
return 0
|
||||
fi
|
||||
|
||||
old_s1=$(grep "^SERVER_1=" "$CONF" 2>/dev/null | cut -d= -f2- | cut -d: -f1)
|
||||
new_s1=$(grep "^SERVER_1=" "$TMP" 2>/dev/null | cut -d= -f2- | cut -d: -f1)
|
||||
|
||||
cp "$CONF" "$CONF.prev" 2>/dev/null
|
||||
mv "$TMP" "$CONF"
|
||||
log "PULL: failover.conf updated (SERVER_1 ${old_s1:-?} -> ${new_s1:-?})"
|
||||
|
||||
# apply the new primary now (only if it actually changed)
|
||||
if [ "$old_s1" != "$new_s1" ] && [ -f "$HEALTH" ]; then
|
||||
sh "$HEALTH" apply-server 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Inner loop: cron fires this every 60s, but we poll ~4x per minute so a
|
||||
# panel "Set" applies within ~12-15s instead of up to a full minute. The
|
||||
# loop stays UNDER 60s and exits so the next cron tick takes over cleanly
|
||||
# (the lockfile blocks any overlap). POLL_INTERVAL/POLL_PASSES overridable.
|
||||
POLL_INTERVAL="${POLL_INTERVAL:-12}"
|
||||
POLL_PASSES="${POLL_PASSES:-4}"
|
||||
i=1
|
||||
while [ "$i" -le "$POLL_PASSES" ]; do
|
||||
do_pull
|
||||
[ "$i" -lt "$POLL_PASSES" ] && sleep "$POLL_INTERVAL"
|
||||
i=$((i + 1))
|
||||
done
|
||||
429
overlay/router-configure-wireguard.sh
Executable file
429
overlay/router-configure-wireguard.sh
Executable file
@@ -0,0 +1,429 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
RCI_URL="http://localhost:79/rci/"
|
||||
MAX_INTERFACE_NUM=9
|
||||
|
||||
check_dependencies() {
|
||||
local missing=""
|
||||
|
||||
for cmd in curl jq date; do
|
||||
if ! command -v "$cmd" >/dev/null 2>&1; then
|
||||
missing="$missing $cmd"
|
||||
fi
|
||||
done
|
||||
|
||||
if [ -n "$missing" ]; then
|
||||
echo "ERROR: Missing required utilities:$missing" >&2
|
||||
echo "Please install them using: opkg update && opkg install$missing" >&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
CLIENT_NAME=""
|
||||
CLIENT_PRIVATE_KEY=""
|
||||
CLIENT_IP=""
|
||||
CLIENT_IPV6=""
|
||||
SERVER_PUBLIC_KEY=""
|
||||
ENDPOINT_PORT=13255
|
||||
KEEPALIVE=25
|
||||
MTU=1420
|
||||
FALLBACK_CONFIG=""
|
||||
|
||||
log() {
|
||||
echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"
|
||||
}
|
||||
|
||||
error() {
|
||||
echo "[ERROR] $*" >&2
|
||||
log "ERROR: $*"
|
||||
}
|
||||
|
||||
usage() {
|
||||
cat <<EOF
|
||||
Usage: $0 [OPTIONS]
|
||||
|
||||
Options:
|
||||
--client-name NAME Client name (required)
|
||||
--client-private-key KEY WireGuard private key (required)
|
||||
--client-ip IP Client tunnel IPv4 address (required)
|
||||
--client-ipv6 IP Client tunnel IPv6 address (required)
|
||||
--server-public-key KEY Server WireGuard public key (required)
|
||||
--endpoint-port PORT Local obfuscator port (default: 13255)
|
||||
--keepalive SECONDS Keepalive interval (default: 25)
|
||||
--mtu MTU Interface MTU (default: 1420)
|
||||
--fallback-config PATH Path to fallback .conf file
|
||||
--help Show this help
|
||||
|
||||
Example:
|
||||
$0 --client-name Pegacomp \\
|
||||
--client-private-key "ABCD..." \\
|
||||
--client-ip 10.25.0.4 \\
|
||||
--client-ipv6 fd00:10:25::4 \\
|
||||
--server-public-key "EFGH..." \\
|
||||
--endpoint-port 13255 \\
|
||||
--fallback-config /opt/etc/Phobos/Pegacomp.conf
|
||||
|
||||
EOF
|
||||
exit 1
|
||||
}
|
||||
|
||||
parse_args() {
|
||||
while [ $# -gt 0 ]; do
|
||||
case "$1" in
|
||||
--client-name)
|
||||
CLIENT_NAME="$2"
|
||||
shift 2
|
||||
;;
|
||||
--client-private-key)
|
||||
CLIENT_PRIVATE_KEY="$2"
|
||||
shift 2
|
||||
;;
|
||||
--client-ip)
|
||||
CLIENT_IP="$2"
|
||||
shift 2
|
||||
;;
|
||||
--client-ipv6)
|
||||
CLIENT_IPV6="$2"
|
||||
shift 2
|
||||
;;
|
||||
--server-public-key)
|
||||
SERVER_PUBLIC_KEY="$2"
|
||||
shift 2
|
||||
;;
|
||||
--endpoint-port)
|
||||
ENDPOINT_PORT="$2"
|
||||
shift 2
|
||||
;;
|
||||
--keepalive)
|
||||
KEEPALIVE="$2"
|
||||
shift 2
|
||||
;;
|
||||
--mtu)
|
||||
MTU="$2"
|
||||
shift 2
|
||||
;;
|
||||
--fallback-config)
|
||||
FALLBACK_CONFIG="$2"
|
||||
shift 2
|
||||
;;
|
||||
--help)
|
||||
usage
|
||||
;;
|
||||
*)
|
||||
error "Unknown option: $1"
|
||||
usage
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [ -z "${CLIENT_NAME}" ] || [ -z "${CLIENT_PRIVATE_KEY}" ] || \
|
||||
[ -z "${CLIENT_IP}" ] || [ -z "${CLIENT_IPV6}" ] || \
|
||||
[ -z "${SERVER_PUBLIC_KEY}" ]; then
|
||||
error "Missing required parameters"
|
||||
usage
|
||||
fi
|
||||
}
|
||||
|
||||
find_phobos_interface() {
|
||||
local client_name="$1"
|
||||
local target_desc="Phobos-${client_name}"
|
||||
|
||||
log "Поиск существующего интерфейса Phobos для клиента: ${client_name}..." >&2
|
||||
|
||||
local i
|
||||
for i in 0 1 2 3 4 5 6 7 8 9; do
|
||||
local interface_json=$(curl -s "${RCI_URL}show/rc/interface/Wireguard${i}" 2>/dev/null)
|
||||
|
||||
if [ -n "${interface_json}" ] && echo "${interface_json}" | jq -e . >/dev/null 2>&1; then
|
||||
local desc=$(echo "${interface_json}" | jq -r '.description // empty' 2>/dev/null)
|
||||
if [ "${desc}" = "${target_desc}" ]; then
|
||||
log "Найден существующий интерфейс: Wireguard${i}" >&2
|
||||
echo "Wireguard${i}"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
log "Существующий интерфейс Phobos не найден" >&2
|
||||
echo ""
|
||||
return 0
|
||||
}
|
||||
|
||||
find_free_wireguard_interface() {
|
||||
log "Поиск свободного интерфейса WireGuard..." >&2
|
||||
|
||||
local i
|
||||
for i in 0 1 2 3 4 5 6 7 8 9; do
|
||||
local interface_json=$(curl -s "${RCI_URL}show/interface/Wireguard${i}" 2>/dev/null)
|
||||
|
||||
if [ -z "${interface_json}" ] || ! echo "${interface_json}" | jq -e '.id' >/dev/null 2>&1; then
|
||||
log "Найден свободный интерфейс: Wireguard${i}" >&2
|
||||
echo "Wireguard${i}"
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
|
||||
error "Нет свободных интерфейсов WireGuard (0-${MAX_INTERFACE_NUM})"
|
||||
return 1
|
||||
}
|
||||
|
||||
remove_wireguard_interface() {
|
||||
local interface_name="$1"
|
||||
|
||||
log "Удаление существующего интерфейса: ${interface_name}..."
|
||||
|
||||
if command -v ndmc >/dev/null 2>&1; then
|
||||
if ndmc -c "no interface ${interface_name}" >/dev/null 2>&1; then
|
||||
log "Интерфейс ${interface_name} успешно удален ✓"
|
||||
return 0
|
||||
else
|
||||
log "Предупреждение: не удалось удалить интерфейс через ndmc"
|
||||
return 1
|
||||
fi
|
||||
else
|
||||
log "Предупреждение: команда ndmc не найдена"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
configure_wireguard_interface() {
|
||||
local interface_name="$1"
|
||||
|
||||
local description="Phobos-${CLIENT_NAME}"
|
||||
local client_ip_addr=$(echo "${CLIENT_IP}" | cut -d'/' -f1)
|
||||
local client_ipv6_block="${CLIENT_IPV6}"
|
||||
|
||||
log "Настройка интерфейса ${interface_name}..."
|
||||
|
||||
local config_json=$(cat <<EOF
|
||||
{
|
||||
"interface": {
|
||||
"${interface_name}": {
|
||||
"description": "${description}",
|
||||
"security-level": {
|
||||
"public": true
|
||||
},
|
||||
"ip": {
|
||||
"address": {
|
||||
"address": "${client_ip_addr}",
|
||||
"mask": "255.255.255.255"
|
||||
},
|
||||
"mtu": ${MTU},
|
||||
"global": true,
|
||||
"defaultgw": false,
|
||||
"priority": 26622,
|
||||
"tcp": {
|
||||
"adjust-mss": {
|
||||
"pmtu": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"ipv6": {
|
||||
"address": [
|
||||
{"auto": false},
|
||||
{"block": "${client_ipv6_block}"}
|
||||
],
|
||||
"prefix": [
|
||||
{"auto": false}
|
||||
]
|
||||
},
|
||||
"wireguard": {
|
||||
"private-key": "${CLIENT_PRIVATE_KEY}",
|
||||
"peer": [
|
||||
{
|
||||
"key": "${SERVER_PUBLIC_KEY}",
|
||||
"comment": "Phobos VPS Server",
|
||||
"endpoint": {
|
||||
"address": "127.0.0.1:${ENDPOINT_PORT}"
|
||||
},
|
||||
"keepalive-interval": {
|
||||
"interval": ${KEEPALIVE}
|
||||
},
|
||||
"allow-ips": [
|
||||
{
|
||||
"address": "0.0.0.0",
|
||||
"mask": "0.0.0.0"
|
||||
},
|
||||
{
|
||||
"address": "::",
|
||||
"mask": "0"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"up": true
|
||||
}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
)
|
||||
|
||||
local result=$(echo "${config_json}" | curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-d @- \
|
||||
"${RCI_URL}" 2>/dev/null)
|
||||
|
||||
if echo "${result}" | jq -e '.status == "error"' >/dev/null 2>&1; then
|
||||
local error_msg=$(echo "${result}" | jq -r '.message // "Unknown error"' 2>/dev/null)
|
||||
error "RCI API отклонил конфигурацию: ${error_msg}"
|
||||
log "JSON запрос:"
|
||||
log "${config_json}"
|
||||
return 1
|
||||
fi
|
||||
|
||||
log "Интерфейс ${interface_name} создан ✓"
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
save_configuration() {
|
||||
log "Сохранение конфигурации..."
|
||||
|
||||
local result=$(curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"system":{"configuration":{"save":{}}}}' \
|
||||
"${RCI_URL}" 2>/dev/null)
|
||||
|
||||
if echo "${result}" | grep -q '"status"[[:space:]]*:[[:space:]]*"message"'; then
|
||||
log "Конфигурация сохранена ✓"
|
||||
return 0
|
||||
else
|
||||
error "Ошибка сохранения конфигурации"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
verify_interface_created() {
|
||||
local client_name="$1"
|
||||
local interface_description="Phobos-${client_name}"
|
||||
|
||||
log "Проверка создания интерфейса WireGuard..."
|
||||
|
||||
local interfaces=$(curl -s "http://127.0.0.1:79/rci/show/interface" 2>/dev/null || echo "")
|
||||
|
||||
if [ -z "$interfaces" ]; then
|
||||
error "Не удалось получить список интерфейсов через RCI API"
|
||||
return 1
|
||||
fi
|
||||
|
||||
if ! echo "$interfaces" | jq -e . >/dev/null 2>&1; then
|
||||
error "Некорректный JSON ответ от RCI API"
|
||||
return 1
|
||||
fi
|
||||
|
||||
local found=$(echo "$interfaces" | jq -r "to_entries[] | select(.value.description == \"$interface_description\") | .key" 2>/dev/null)
|
||||
|
||||
if [ -n "$found" ]; then
|
||||
log "✓ Интерфейс $found (Phobos-${client_name}) успешно создан"
|
||||
return 0
|
||||
else
|
||||
error "Интерфейс с description '$interface_description' не найден"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
show_fallback_instructions() {
|
||||
cat <<EOF
|
||||
|
||||
╔════════════════════════════════════════════════════════════╗
|
||||
║ RCI API недоступен - требуется ручная настройка ║
|
||||
╚════════════════════════════════════════════════════════════╝
|
||||
|
||||
Конфигурация сохранена в: ${FALLBACK_CONFIG}
|
||||
|
||||
Инструкция по ручному импорту:
|
||||
1. Откройте веб-панель Keenetic (http://192.168.1.1 или http://my.keenetic.net)
|
||||
2. Перейдите: Интернет → WireGuard
|
||||
3. Нажмите: 'Добавить подключение'
|
||||
4. Выберите: 'Загрузить конфигурацию из файла'
|
||||
5. Укажите путь: ${FALLBACK_CONFIG}
|
||||
6. Активируйте подключение
|
||||
|
||||
EOF
|
||||
}
|
||||
|
||||
main() {
|
||||
parse_args "$@"
|
||||
|
||||
if ! check_dependencies; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p /opt/etc/Phobos
|
||||
log "=== Phobos WireGuard RCI Configuration ==="
|
||||
log "Клиент: ${CLIENT_NAME}"
|
||||
|
||||
EXISTING_INTERFACE=$(find_phobos_interface "${CLIENT_NAME}") || true
|
||||
|
||||
if [ -n "${EXISTING_INTERFACE}" ]; then
|
||||
log "Обнаружен существующий интерфейс: ${EXISTING_INTERFACE}"
|
||||
if remove_wireguard_interface "${EXISTING_INTERFACE}"; then
|
||||
log "Интерфейс ${EXISTING_INTERFACE} удален, будет создан заново"
|
||||
else
|
||||
log "Не удалось удалить интерфейс ${EXISTING_INTERFACE}, попытка пересоздать"
|
||||
fi
|
||||
fi
|
||||
|
||||
INTERFACE_NAME=$(find_free_wireguard_interface) || true
|
||||
if [ -z "${INTERFACE_NAME}" ]; then
|
||||
show_fallback_instructions
|
||||
exit 1
|
||||
fi
|
||||
log "Создание нового интерфейса: ${INTERFACE_NAME}"
|
||||
|
||||
if ! configure_wireguard_interface "${INTERFACE_NAME}"; then
|
||||
error "Не удалось настроить WireGuard через RCI API"
|
||||
show_fallback_instructions
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! save_configuration; then
|
||||
error "Не удалось сохранить конфигурацию"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
log "Настройка WireGuard завершена успешно! ✓"
|
||||
log "Интерфейс: ${INTERFACE_NAME}"
|
||||
log "Description: Phobos-${CLIENT_NAME}"
|
||||
|
||||
log ""
|
||||
log "Проверка статуса wg-obfuscator..."
|
||||
if [ -f /opt/etc/init.d/S49wg-obfuscator ]; then
|
||||
local obf_status=$(/opt/etc/init.d/S49wg-obfuscator status 2>&1)
|
||||
if echo "${obf_status}" | grep -q "dead"; then
|
||||
log "⚠ wg-obfuscator остановлен, перезапускаем..."
|
||||
/opt/etc/init.d/S49wg-obfuscator start
|
||||
sleep 2
|
||||
log "✓ wg-obfuscator перезапущен"
|
||||
else
|
||||
log "✓ wg-obfuscator работает"
|
||||
fi
|
||||
fi
|
||||
|
||||
log ""
|
||||
log "Ожидание применения конфигурации..."
|
||||
sleep 5
|
||||
|
||||
if verify_interface_created "${CLIENT_NAME}"; then
|
||||
log ""
|
||||
log "╔════════════════════════════════════════════════════════════╗"
|
||||
log "║ WireGuard успешно настроен! ║"
|
||||
log "╚════════════════════════════════════════════════════════════╝"
|
||||
log ""
|
||||
exit 0
|
||||
else
|
||||
log ""
|
||||
log "⚠ Не удалось подтвердить создание интерфейса WireGuard"
|
||||
log ""
|
||||
log "Проверьте вручную в веб-панели Keenetic:"
|
||||
log " Интернет → WireGuard"
|
||||
log ""
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
main "$@"
|
||||
147
server/api.py
Normal file
147
server/api.py
Normal file
@@ -0,0 +1,147 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Phobos Secondary Server API — peer management + health."""
|
||||
import json, os, subprocess
|
||||
from flask import Flask, request, jsonify
|
||||
|
||||
app = Flask(__name__)
|
||||
|
||||
def load_env():
|
||||
env = {}
|
||||
with open("/opt/Phobos/server/server.env") as f:
|
||||
for line in f:
|
||||
if "=" in line and not line.startswith("#"):
|
||||
k, v = line.strip().split("=", 1)
|
||||
env[k] = v
|
||||
return env
|
||||
|
||||
def check_api_key():
|
||||
env = load_env()
|
||||
key = request.headers.get("X-API-Key", "")
|
||||
return key == env.get("MAIN_API_KEY", "")
|
||||
|
||||
@app.route("/api/health")
|
||||
def health():
|
||||
try:
|
||||
out = subprocess.check_output(["wg", "show", "wg0", "dump"], text=True, timeout=5)
|
||||
peer_keys = []
|
||||
handshakes = {}
|
||||
for line in out.strip().split("\n")[1:]:
|
||||
parts = line.split("\t")
|
||||
if len(parts) >= 4:
|
||||
pub = parts[0]
|
||||
peer_keys.append(pub)
|
||||
try:
|
||||
handshakes[pub] = int(parts[4])
|
||||
except Exception:
|
||||
handshakes[pub] = 0
|
||||
peers = len(peer_keys)
|
||||
except Exception:
|
||||
peers = 0
|
||||
peer_keys = []
|
||||
handshakes = {}
|
||||
try:
|
||||
out = subprocess.check_output("top -bn1 | grep Cpu", shell=True, text=True, timeout=5)
|
||||
idle = float([x for x in out.split(",") if "id" in x][0].split()[0])
|
||||
cpu = f"{round(100 - idle, 1)}%"
|
||||
except Exception:
|
||||
cpu = "?"
|
||||
try:
|
||||
mem = subprocess.check_output("free -m", shell=True, text=True).split("\n")[1].split()
|
||||
mem_str = f"{mem[2]}/{mem[1]}MB"
|
||||
except Exception:
|
||||
mem_str = "?"
|
||||
return jsonify({"status": "ok", "peers": peers, "peer_keys": peer_keys, "handshakes": handshakes, "cpu": cpu, "mem": mem_str})
|
||||
|
||||
@app.route("/api/peers", methods=["GET"])
|
||||
def list_peers():
|
||||
if not check_api_key():
|
||||
return jsonify({"error": "unauthorized"}), 401
|
||||
try:
|
||||
out = subprocess.check_output(["wg", "show", "wg0", "allowed-ips"], text=True, timeout=5)
|
||||
peers = {}
|
||||
for line in out.strip().split("\n"):
|
||||
if "\t" in line:
|
||||
pub, ips = line.split("\t", 1)
|
||||
peers[pub.strip()] = ips.strip()
|
||||
return jsonify({"peers": peers})
|
||||
except Exception as e:
|
||||
return jsonify({"error": str(e)}), 500
|
||||
|
||||
@app.route("/api/peers/add", methods=["POST"])
|
||||
def add_peer():
|
||||
if not check_api_key():
|
||||
return jsonify({"error": "unauthorized"}), 401
|
||||
data = request.json
|
||||
pub_key = data.get("public_key", "")
|
||||
allowed_ips = data.get("allowed_ips", "")
|
||||
if not pub_key or not allowed_ips:
|
||||
return jsonify({"error": "missing public_key or allowed_ips"}), 400
|
||||
try:
|
||||
subprocess.run(["wg", "set", "wg0", "peer", pub_key, "allowed-ips", allowed_ips], check=True, timeout=5)
|
||||
subprocess.run(["wg-quick", "save", "wg0"], timeout=5)
|
||||
return jsonify({"status": "ok"})
|
||||
except Exception as e:
|
||||
return jsonify({"error": str(e)}), 500
|
||||
|
||||
@app.route("/api/peers/remove", methods=["POST"])
|
||||
def remove_peer():
|
||||
if not check_api_key():
|
||||
return jsonify({"error": "unauthorized"}), 401
|
||||
pub_key = request.json.get("public_key", "")
|
||||
if not pub_key:
|
||||
return jsonify({"error": "missing public_key"}), 400
|
||||
try:
|
||||
subprocess.run(["wg", "set", "wg0", "peer", pub_key, "remove"], check=True, timeout=5)
|
||||
subprocess.run(["wg-quick", "save", "wg0"], timeout=5)
|
||||
return jsonify({"status": "ok"})
|
||||
except Exception as e:
|
||||
return jsonify({"error": str(e)}), 500
|
||||
|
||||
@app.route("/api/info")
|
||||
def info():
|
||||
if not check_api_key():
|
||||
return jsonify({"error": "unauthorized"}), 401
|
||||
env = load_env()
|
||||
return jsonify({
|
||||
"ip": env.get("SERVER_PUBLIC_IP_V4"),
|
||||
"wg_public_key": env.get("SERVER_WG_PUBLIC_KEY"),
|
||||
"obfuscator_key": env.get("OBFUSCATOR_KEY"),
|
||||
"ports": env.get("OBFUSCATOR_PORTS", "2083").split(","),
|
||||
"role": "secondary"
|
||||
})
|
||||
|
||||
ROUTER_CONFIGS_DIR = "/opt/Phobos/server/router-configs"
|
||||
|
||||
|
||||
@app.route("/api/router-config/<client_id>")
|
||||
def router_config(client_id):
|
||||
"""Serve a client's failover.conf so routers can PULL via the tunnel
|
||||
(http://10.25.0.1:8444/...). Token via ?token= or X-API-Key."""
|
||||
token = request.args.get("token", "") or request.headers.get("X-API-Key", "")
|
||||
if token != load_env().get("MAIN_API_KEY", ""):
|
||||
return ("forbidden", 403)
|
||||
path = os.path.join(ROUTER_CONFIGS_DIR, client_id + ".conf")
|
||||
if not os.path.exists(path):
|
||||
return ("not found", 404)
|
||||
with open(path) as fh:
|
||||
return (fh.read(), 200, {"Content-Type": "text/plain; charset=utf-8"})
|
||||
|
||||
|
||||
@app.route("/api/router-config-set", methods=["POST"])
|
||||
def router_config_set():
|
||||
"""Panel fan-out: store a client's failover.conf on this server."""
|
||||
if not check_api_key():
|
||||
return jsonify({"status": "error", "msg": "unauthorized"}), 403
|
||||
data = request.get_json(force=True, silent=True) or {}
|
||||
cid = data.get("client_id", "")
|
||||
conf = data.get("conf", "")
|
||||
if not cid or "SERVER_1=" not in conf:
|
||||
return jsonify({"status": "error", "msg": "bad payload"}), 400
|
||||
os.makedirs(ROUTER_CONFIGS_DIR, exist_ok=True)
|
||||
with open(os.path.join(ROUTER_CONFIGS_DIR, cid + ".conf"), "w") as fh:
|
||||
fh.write(conf)
|
||||
return jsonify({"status": "ok"})
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
app.run(host="0.0.0.0", port=8444)
|
||||
446
server/phobos-health.sh
Executable file
446
server/phobos-health.sh
Executable file
@@ -0,0 +1,446 @@
|
||||
#!/bin/sh
|
||||
# ============================================================
|
||||
# Phobos Health Monitor v2 — Keenetic Edition
|
||||
# Uses ndmc/RCI instead of wg-tools. Connectivity-based failover.
|
||||
# Runs via cron every 60 seconds
|
||||
# ============================================================
|
||||
|
||||
PHOBOS_DIR="/opt/etc/Phobos"
|
||||
CONF="$PHOBOS_DIR/failover.conf"
|
||||
STATE="$PHOBOS_DIR/state"
|
||||
LOG="$PHOBOS_DIR/health.log"
|
||||
OBF_CONF="$PHOBOS_DIR/wg-obfuscator.conf"
|
||||
LOCKFILE="/tmp/phobos-health.lock"
|
||||
WG_IF="Wireguard3"
|
||||
|
||||
MAX_LOG_LINES=200
|
||||
# Thresholds (seconds)
|
||||
HANDSHAKE_WARN=150
|
||||
HANDSHAKE_PORT_HOP=300
|
||||
HANDSHAKE_SERVER_SWITCH=600
|
||||
PRIMARY_CHECK_INTERVAL=300
|
||||
# Primary-alive probe: servers block ICMP and busybox `nc -z` is unreliable,
|
||||
# so reachability is tested with curl against the panel's obfuscator-health
|
||||
# endpoint on the primary VPS. It returns http 200 ONLY when all
|
||||
# wg-obfuscator-* services are active — the bare panel port stays up even
|
||||
# when the tunnel path is dead, so we must NOT switch back on panel liveness
|
||||
# alone (that caused premature switchback to a dead primary).
|
||||
PRIMARY_PROBE_PORT=10514
|
||||
PRIMARY_PROBE_PATH="/api/obf-health"
|
||||
# Connectivity check targets (logged for context only)
|
||||
CHECK_HOST_1="8.8.8.8"
|
||||
CHECK_HOST_2="1.1.1.1"
|
||||
|
||||
log() {
|
||||
echo "$(date '+%H:%M:%S') $1" >> "$LOG"
|
||||
if [ "$(wc -l < "$LOG" 2>/dev/null)" -gt "$MAX_LOG_LINES" ]; then
|
||||
tail -n 100 "$LOG" > "$LOG.tmp" && mv "$LOG.tmp" "$LOG"
|
||||
fi
|
||||
}
|
||||
|
||||
# Prevent concurrent runs
|
||||
if [ -f "$LOCKFILE" ]; then
|
||||
pid=$(cat "$LOCKFILE" 2>/dev/null)
|
||||
if kill -0 "$pid" 2>/dev/null; then
|
||||
exit 0
|
||||
fi
|
||||
fi
|
||||
echo $$ > "$LOCKFILE"
|
||||
trap 'rm -f "$LOCKFILE"' EXIT
|
||||
|
||||
mkdir -p "$STATE"
|
||||
|
||||
# ── Detect WG interface ──
|
||||
detect_wg_interface() {
|
||||
for i in 0 1 2 3 4 5 6 7 8 9; do
|
||||
desc=$(ndmc -c "show interface Wireguard${i}" 2>/dev/null | grep description | head -1)
|
||||
if echo "$desc" | grep -qi phobos; then
|
||||
WG_IF="Wireguard${i}"
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
# ── Read failover config ──
|
||||
if [ ! -f "$CONF" ]; then
|
||||
log "ERROR: no failover.conf"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
SERVER_COUNT=0
|
||||
idx=1
|
||||
while true; do
|
||||
val=$(grep "^SERVER_${idx}=" "$CONF" 2>/dev/null | cut -d= -f2-)
|
||||
[ -z "$val" ] && break
|
||||
eval "SERVER_${idx}_HOST=$(echo "$val" | cut -d: -f1)"
|
||||
eval "SERVER_${idx}_PORTS=$(echo "$val" | cut -d: -f2-)"
|
||||
eval "SERVER_${idx}_KEY=$(grep "^KEY_${idx}=" "$CONF" 2>/dev/null | cut -d= -f2-)"
|
||||
eval "SERVER_${idx}_WGKEY=$(grep "^WGKEY_${idx}=" "$CONF" 2>/dev/null | cut -d= -f2-)"
|
||||
SERVER_COUNT=$idx
|
||||
idx=$((idx + 1))
|
||||
done
|
||||
|
||||
if [ "$SERVER_COUNT" -eq 0 ]; then
|
||||
log "ERROR: no servers in failover.conf"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Read state
|
||||
CURRENT_SERVER=$(cat "$STATE/current_server" 2>/dev/null || echo "1")
|
||||
CURRENT_PORT_IDX=$(cat "$STATE/current_port_idx" 2>/dev/null || echo "0")
|
||||
FAIL_COUNT=$(cat "$STATE/fail_count" 2>/dev/null || echo "0")
|
||||
PRIMARY_CHECK_TS=$(cat "$STATE/primary_check_ts" 2>/dev/null || echo "0")
|
||||
|
||||
# ── Detect Phobos WG interface (non-fatal, fallback to Wireguard3) ──
|
||||
detect_wg_interface || {
|
||||
log "WARN: detect failed, using default $WG_IF"
|
||||
}
|
||||
|
||||
# ── Get handshake age via ndmc ──
|
||||
# A peer switch can leave the removed peer's stale handshake listed in ndmc
|
||||
# output (often a huge sentinel like 2147483647). Take the FRESHEST (minimum
|
||||
# positive, sane) handshake across all peers — that is the live tunnel.
|
||||
get_handshake_age() {
|
||||
hs=$(ndmc -c "show interface $WG_IF" 2>/dev/null \
|
||||
| grep "last-handshake" \
|
||||
| awk '{v=$2} v>0 && v<86400 {print v}' \
|
||||
| sort -n | head -1)
|
||||
if [ -z "$hs" ]; then
|
||||
echo "9999"
|
||||
else
|
||||
echo "$hs"
|
||||
fi
|
||||
}
|
||||
|
||||
# ── Check real connectivity ──
|
||||
check_connectivity() {
|
||||
ping -c 1 -W 3 "$CHECK_HOST_1" >/dev/null 2>&1 && return 0
|
||||
ping -c 1 -W 3 "$CHECK_HOST_2" >/dev/null 2>&1 && return 0
|
||||
return 1
|
||||
}
|
||||
|
||||
# ── Get port by index ──
|
||||
get_port() {
|
||||
server_idx=$1; port_idx=$2
|
||||
eval "ports=\$SERVER_${server_idx}_PORTS"
|
||||
echo "$ports" | tr ',' '\n' | sed -n "$((port_idx + 1))p"
|
||||
}
|
||||
|
||||
get_port_count() {
|
||||
server_idx=$1
|
||||
eval "ports=\$SERVER_${server_idx}_PORTS"
|
||||
echo "$ports" | tr ',' '\n' | wc -l
|
||||
}
|
||||
|
||||
# ── Keys currently on the interface (includes the interface's OWN key) ──
|
||||
# WG public keys are 43 base64 chars + '='. The interface's own public-key is
|
||||
# also matched here — callers must only act on KNOWN server WGKEYs so the
|
||||
# local key is never touched.
|
||||
list_iface_keys() {
|
||||
ndmc -c "show interface $WG_IF" 2>/dev/null \
|
||||
| grep -oE '[A-Za-z0-9+/]{43}=' | sort -u
|
||||
}
|
||||
|
||||
# Count how many KNOWN server WGKEYs are currently attached as peers.
|
||||
count_server_peers() {
|
||||
present=$(list_iface_keys)
|
||||
n=0
|
||||
i=1
|
||||
while [ "$i" -le "$SERVER_COUNT" ]; do
|
||||
eval "wk=\$SERVER_${i}_WGKEY"
|
||||
if [ -n "$wk" ] && echo "$present" | grep -q "^${wk}$"; then
|
||||
n=$((n + 1))
|
||||
fi
|
||||
i=$((i + 1))
|
||||
done
|
||||
echo "$n"
|
||||
}
|
||||
|
||||
# ── Switch WG peer so EXACTLY ONE server peer (new_key) remains ──
|
||||
# Failover adds a new peer; the RCI "remove" is unreliable on Keenetic and
|
||||
# leaves dead peers behind. Multiple peers each with allow-ips 0.0.0.0/0 make
|
||||
# egress routing ambiguous. We hard-purge every OTHER known server key via the
|
||||
# ndmc CLI (reliable) — never the interface's own key — then ensure new_key.
|
||||
switch_wg_peer() {
|
||||
new_key=$1
|
||||
|
||||
if [ -z "$new_key" ]; then
|
||||
log "WARN: no WGKEY for target server, skip peer switch"
|
||||
return 1
|
||||
fi
|
||||
|
||||
present=$(list_iface_keys)
|
||||
|
||||
# Purge any OTHER known server key that is attached
|
||||
i=1
|
||||
while [ "$i" -le "$SERVER_COUNT" ]; do
|
||||
eval "wk=\$SERVER_${i}_WGKEY"
|
||||
if [ -n "$wk" ] && [ "$wk" != "$new_key" ] && echo "$present" | grep -q "^${wk}$"; then
|
||||
log "WG PEER purge: $wk"
|
||||
ndmc -c "interface $WG_IF no wireguard peer $wk" >/dev/null 2>&1
|
||||
fi
|
||||
i=$((i + 1))
|
||||
done
|
||||
|
||||
# Add the target peer if it is not already present
|
||||
if ! echo "$present" | grep -q "^${new_key}$"; then
|
||||
log "WG PEER add: $new_key"
|
||||
curl -s -X POST "http://localhost:79/rci/" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"interface\":{\"${WG_IF}\":{\"wireguard\":{\"peer\":{\"key\":\"${new_key}\",\"comment\":\"Phobos VPS Server\",\"endpoint\":{\"address\":\"127.0.0.1:13255\"},\"keepalive-interval\":{\"interval\":25},\"allow-ips\":[{\"address\":\"0.0.0.0\",\"mask\":\"0.0.0.0\"},{\"address\":\"::\",\"mask\":\"0\"}]}}}}}" >/dev/null 2>&1
|
||||
fi
|
||||
|
||||
# Persist config
|
||||
ndmc -c "system configuration save" >/dev/null 2>&1
|
||||
return 0
|
||||
}
|
||||
|
||||
# ── Switch to specific server:port ──
|
||||
switch_endpoint() {
|
||||
server_idx=$1
|
||||
port_idx=$2
|
||||
|
||||
eval "host=\$SERVER_${server_idx}_HOST"
|
||||
eval "obf_key=\$SERVER_${server_idx}_KEY"
|
||||
eval "wg_key=\$SERVER_${server_idx}_WGKEY"
|
||||
port=$(get_port "$server_idx" "$port_idx")
|
||||
|
||||
if [ -z "$host" ] || [ -z "$port" ]; then
|
||||
log "ERROR: invalid server $server_idx port_idx $port_idx"
|
||||
return 1
|
||||
fi
|
||||
|
||||
log "SWITCH → server $server_idx ($host:$port)"
|
||||
|
||||
# 1. Switch WG peer key if different server
|
||||
switch_wg_peer "$wg_key"
|
||||
|
||||
# 2. Update obfuscator config
|
||||
if [ -f "$OBF_CONF" ]; then
|
||||
sed -i "s|^target = .*|target = ${host}:${port}|" "$OBF_CONF"
|
||||
if [ -n "$obf_key" ]; then
|
||||
sed -i "s|^key = .*|key = ${obf_key}|" "$OBF_CONF"
|
||||
fi
|
||||
fi
|
||||
|
||||
# 3. Restart obfuscator
|
||||
if [ -f /opt/etc/init.d/S49wg-obfuscator ]; then
|
||||
/opt/etc/init.d/S49wg-obfuscator restart >/dev/null 2>&1
|
||||
else
|
||||
killall wg-obfuscator 2>/dev/null
|
||||
sleep 1
|
||||
wg-obfuscator --config "$OBF_CONF" &
|
||||
fi
|
||||
|
||||
# 4. Save state (fail_count is managed by the caller, NOT reset here —
|
||||
# resetting on a port-hop would prevent escalation to server failover)
|
||||
echo "$server_idx" > "$STATE/current_server"
|
||||
echo "$port_idx" > "$STATE/current_port_idx"
|
||||
}
|
||||
|
||||
# ── Try next port on current server ──
|
||||
try_next_port() {
|
||||
port_count=$(get_port_count "$CURRENT_SERVER")
|
||||
next_idx=$(( (CURRENT_PORT_IDX + 1) % port_count ))
|
||||
[ "$next_idx" -eq 0 ] && return 1
|
||||
|
||||
log "PORT HOP → port idx $next_idx on server $CURRENT_SERVER"
|
||||
switch_endpoint "$CURRENT_SERVER" "$next_idx"
|
||||
return 0
|
||||
}
|
||||
|
||||
# ── Try next server ──
|
||||
try_next_server() {
|
||||
next=$((CURRENT_SERVER + 1))
|
||||
[ "$next" -gt "$SERVER_COUNT" ] && next=1
|
||||
[ "$next" -eq "$CURRENT_SERVER" ] && return 1
|
||||
|
||||
log "FAILOVER → server $next"
|
||||
switch_endpoint "$next" "0"
|
||||
return 0
|
||||
}
|
||||
|
||||
# ── Check if primary is back ──
|
||||
check_primary() {
|
||||
[ "$CURRENT_SERVER" -eq 1 ] && return
|
||||
|
||||
now=$(date +%s)
|
||||
elapsed=$((now - PRIMARY_CHECK_TS))
|
||||
[ "$elapsed" -lt "$PRIMARY_CHECK_INTERVAL" ] && return
|
||||
echo "$now" > "$STATE/primary_check_ts"
|
||||
|
||||
eval "host=\$SERVER_1_HOST"
|
||||
# Probe the obfuscator-health endpoint: http 200 ONLY when the primary's
|
||||
# obfuscator path is actually up. Anything else (000 no-response, 503
|
||||
# obf-down, redirects) means the tunnel path is NOT viable → stay put.
|
||||
code=$(curl -s -m 4 -o /dev/null -w '%{http_code}' "http://${host}:${PRIMARY_PROBE_PORT}${PRIMARY_PROBE_PATH}" 2>/dev/null)
|
||||
if [ "$code" = "200" ]; then
|
||||
log "PRIMARY ($host obf-health http=200) alive, switching back"
|
||||
switch_endpoint 1 0
|
||||
echo "0" > "$STATE/fail_count"
|
||||
else
|
||||
log "PRIMARY still down (obf-health http=${code:-none}), staying on server $CURRENT_SERVER"
|
||||
fi
|
||||
}
|
||||
|
||||
# ── LAN routing self-heal ──────────────────────
|
||||
# A router REBOOT silently drops the per-device `ip hotspot host <mac> policy`
|
||||
# binding and can reset the WG interface security-level, so LAN clients leak to
|
||||
# WAN (no VPN). This:
|
||||
# 1) ensures WG_IF security-level = public (needed for masquerade),
|
||||
# 2) LEARNS current host->policy bindings into state/lan-hosts (append-only),
|
||||
# 3) RE-APPLIES any learned binding that is currently missing.
|
||||
# Append-only learning means a reboot (which clears live bindings) never erases
|
||||
# the record, so the next run restores them. ndmc show running-config is heavy,
|
||||
# so the caller gates this to run only every few minutes.
|
||||
heal_lan_routing() {
|
||||
LANHOSTS="$STATE/lan-hosts"
|
||||
rc=$(ndmc -c "show running-config" 2>/dev/null)
|
||||
[ -z "$rc" ] && return 0
|
||||
|
||||
# 1) WG interface must be public
|
||||
sl=$(echo "$rc" | awk -v ifc="interface $WG_IF" '$0~ifc{f=1} f&&/security-level/{print $2; exit}')
|
||||
if [ -n "$sl" ] && [ "$sl" != "public" ]; then
|
||||
ndmc -c "interface $WG_IF security-level public" >/dev/null 2>&1
|
||||
ndmc -c "system configuration save" >/dev/null 2>&1
|
||||
log "HEAL: $WG_IF security-level -> public"
|
||||
fi
|
||||
|
||||
# 2) learn live bindings (append-only) into lan-hosts
|
||||
touch "$LANHOSTS"
|
||||
echo "$rc" | grep -oE "host [0-9a-f:]+ policy [A-Za-z0-9_]+" | while read -r _h mac _p pol; do
|
||||
grep -q "^$mac " "$LANHOSTS" 2>/dev/null || echo "$mac $pol" >> "$LANHOSTS"
|
||||
done
|
||||
|
||||
# 3) re-apply any learned binding that is missing live
|
||||
changed=0
|
||||
while read -r mac pol; do
|
||||
[ -z "$mac" ] && continue
|
||||
case "$mac" in \#*) continue;; esac
|
||||
if ! echo "$rc" | grep -q "host $mac policy $pol"; then
|
||||
ndmc -c "ip hotspot host $mac policy $pol" >/dev/null 2>&1
|
||||
log "HEAL: re-bound host $mac -> $pol"
|
||||
changed=1
|
||||
fi
|
||||
done < "$LANHOSTS"
|
||||
[ "$changed" = 1 ] && ndmc -c "system configuration save" >/dev/null 2>&1
|
||||
}
|
||||
|
||||
# ══════════════════════════════════════════════
|
||||
# Explicit apply hook (used by phobos-pull.sh after a config change).
|
||||
# `phobos-health.sh apply-server N` re-points the tunnel to SERVER_N
|
||||
# immediately, skipping the failure-escalation logic. Reuses
|
||||
# switch_endpoint so the WG-peer/obfuscator/state changes stay identical
|
||||
# to a normal failover. Resets fail_count so the new server starts clean.
|
||||
# ══════════════════════════════════════════════
|
||||
if [ "$1" = "apply-server" ]; then
|
||||
idx="${2:-1}"
|
||||
eval "ahost=\$SERVER_${idx}_HOST"
|
||||
if [ -z "$ahost" ]; then
|
||||
log "APPLY: server $idx not in conf, ignore"
|
||||
exit 1
|
||||
fi
|
||||
log "APPLY: pull requested server $idx ($ahost)"
|
||||
switch_endpoint "$idx" "0"
|
||||
echo "0" > "$STATE/fail_count"
|
||||
echo "$idx" > "$STATE/current_server"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# ══════════════════════════════════════════════
|
||||
# Pre-check: fix desync (obfuscator targeting wrong server)
|
||||
# ══════════════════════════════════════════════
|
||||
if [ -f "$OBF_CONF" ]; then
|
||||
cur_target=$(grep "^target = " "$OBF_CONF" 2>/dev/null | sed 's/target = //')
|
||||
eval "expected_host=\$SERVER_${CURRENT_SERVER}_HOST"
|
||||
if [ -n "$cur_target" ] && [ -n "$expected_host" ]; then
|
||||
echo "$cur_target" | grep -q "$expected_host" || {
|
||||
log "DESYNC: obf=$cur_target state=server${CURRENT_SERVER}($expected_host). Resync."
|
||||
switch_endpoint "$CURRENT_SERVER" "$CURRENT_PORT_IDX"
|
||||
sleep 5
|
||||
}
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── LAN routing self-heal (gated ~5 min; a reboot drops host->policy bindings) ──
|
||||
HEAL_TS=$(cat "$STATE/heal_ts" 2>/dev/null || echo 0)
|
||||
now_heal=$(date +%s)
|
||||
if [ $((now_heal - HEAL_TS)) -ge 300 ]; then
|
||||
echo "$now_heal" > "$STATE/heal_ts"
|
||||
heal_lan_routing
|
||||
fi
|
||||
|
||||
# ── Peer hygiene: keep exactly ONE WG peer = current server's key ──
|
||||
# Failovers can leave dead/duplicate peers; multiple 0.0.0.0/0 peers cause
|
||||
# ambiguous egress routing. Self-heal here every run (cheap when already clean).
|
||||
eval "cur_wgkey=\$SERVER_${CURRENT_SERVER}_WGKEY"
|
||||
if [ -n "$cur_wgkey" ]; then
|
||||
peer_n=$(count_server_peers)
|
||||
if [ "$peer_n" -gt 1 ]; then
|
||||
log "HYGIENE: $peer_n server peers present, purging to server${CURRENT_SERVER}"
|
||||
switch_wg_peer "$cur_wgkey"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ══════════════════════════════════════════════
|
||||
# Main logic
|
||||
# Tunnel health = WireGuard handshake age (authoritative: a fresh
|
||||
# handshake only happens through the full obfuscator→server→WG path).
|
||||
# WAN ping is logged for context ONLY — it does NOT gate decisions,
|
||||
# because the router's default route is not the tunnel, so WAN can be
|
||||
# up while the tunnel is dead (and a WAN blip must not cause failover).
|
||||
# ══════════════════════════════════════════════
|
||||
AGE=$(get_handshake_age)
|
||||
WAN=$(check_connectivity && echo "yes" || echo "no")
|
||||
|
||||
# Tunnel healthy = fresh handshake
|
||||
if [ "$AGE" -lt "$HANDSHAKE_WARN" ]; then
|
||||
if [ "$FAIL_COUNT" -gt 0 ]; then
|
||||
log "OK: tunnel up (handshake=${AGE}s, server=$CURRENT_SERVER, wan=$WAN)"
|
||||
echo "0" > "$STATE/fail_count"
|
||||
fi
|
||||
check_primary
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Stale handshake = tunnel down → escalate.
|
||||
# fail_count is MONOTONIC: it climbs across stages and is only reset by the
|
||||
# OK branch (real recovery) or after a successful failover to a NEW server
|
||||
# (so the new server gets a fresh restart→port-hop→failover cycle).
|
||||
FAIL_COUNT=$((FAIL_COUNT + 1))
|
||||
echo "$FAIL_COUNT" > "$STATE/fail_count"
|
||||
log "STALE: handshake=${AGE}s wan=${WAN} server=$CURRENT_SERVER port=$CURRENT_PORT_IDX fails=$FAIL_COUNT"
|
||||
|
||||
# Stage 1 (fail 1): Restart obfuscator
|
||||
if [ "$FAIL_COUNT" -eq 1 ]; then
|
||||
log "ACTION: restart obfuscator"
|
||||
if [ -f /opt/etc/init.d/S49wg-obfuscator ]; then
|
||||
/opt/etc/init.d/S49wg-obfuscator restart >/dev/null 2>&1
|
||||
else
|
||||
killall wg-obfuscator 2>/dev/null
|
||||
sleep 1
|
||||
wg-obfuscator --config "$OBF_CONF" &
|
||||
fi
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Stage 2 (fail 2): Port hop to an alternate port on the SAME server
|
||||
if [ "$FAIL_COUNT" -eq 2 ]; then
|
||||
if try_next_port; then
|
||||
exit 0
|
||||
fi
|
||||
# only one port → fall through to server failover
|
||||
log "single port, escalate to failover"
|
||||
fi
|
||||
|
||||
# Stage 3 (fail 3+): Server failover. Reset fail_count so the new server
|
||||
# gets its own restart→port-hop→failover cycle next ticks.
|
||||
log "ACTION: server failover (fail $FAIL_COUNT)"
|
||||
if try_next_server; then
|
||||
echo "0" > "$STATE/fail_count"
|
||||
else
|
||||
# Only one server — cycle back to port 0 and restart escalation
|
||||
echo "0" > "$STATE/fail_count"
|
||||
switch_endpoint "$CURRENT_SERVER" "0"
|
||||
fi
|
||||
93
server/phobos-pull.sh
Executable file
93
server/phobos-pull.sh
Executable file
@@ -0,0 +1,93 @@
|
||||
#!/bin/sh
|
||||
# ============================================================
|
||||
# Phobos Config Pull — NAT-friendly management channel.
|
||||
# Runs ON the router via cron (every 2 min). OUTBOUND ONLY:
|
||||
# fetches this client's failover.conf from the panel over
|
||||
# HTTPS/HTTP and applies it. No inbound SSH needed, so it works
|
||||
# behind any NAT and regardless of which Phobos server is active.
|
||||
#
|
||||
# Why pull (not panel->router SSH):
|
||||
# - routers sit behind NAT with no public IP (KeenDNS is HTTP-
|
||||
# only, no port 22),
|
||||
# - WG3 must be security-level PUBLIC for LAN client routing,
|
||||
# which blocks inbound SSH on the tunnel,
|
||||
# - on failover the router's 10.25.0.2 moves to another server's
|
||||
# wg0, so a fixed panel host cannot reach it.
|
||||
# Pulling sidesteps all three.
|
||||
#
|
||||
# Files (written by installer / bootstrap):
|
||||
# /opt/etc/Phobos/client_id -> this router's client id (e.g. home)
|
||||
# /opt/etc/Phobos/pull_token -> shared secret for the panel endpoint
|
||||
# PANEL env or default below -> panel base URL
|
||||
# ============================================================
|
||||
PHOBOS_DIR="/opt/etc/Phobos"
|
||||
CONF="$PHOBOS_DIR/failover.conf"
|
||||
HEALTH="$PHOBOS_DIR/phobos-health.sh"
|
||||
LOG="$PHOBOS_DIR/health.log"
|
||||
# Config sources, tried in order. TUNNEL FIRST: 10.25.0.1 is the wg0 of whatever
|
||||
# server the tunnel currently terminates on, so management rides the same
|
||||
# obfuscated channel as data — survives a public-IP ban and follows failover.
|
||||
# - 10.25.0.1:8444 -> secondary server agent (phobos-api)
|
||||
# - 10.25.0.1:10514 -> primary server panel
|
||||
# - public panel IP -> bootstrap / if tunnel is down
|
||||
PANEL="${PANEL:-http://212.118.52.193:10514}"
|
||||
PANEL_URLS="${PANEL_URLS:-http://10.25.0.1:8444 http://10.25.0.1:10514 $PANEL}"
|
||||
CLIENT_ID=$(cat "$PHOBOS_DIR/client_id" 2>/dev/null || echo "home")
|
||||
TOKEN=$(cat "$PHOBOS_DIR/pull_token" 2>/dev/null)
|
||||
TMP="/tmp/failover.conf.pull"
|
||||
LOCK="/tmp/phobos-pull.lock"
|
||||
|
||||
log() { echo "$(date '+%H:%M:%S') $1" >> "$LOG"; }
|
||||
|
||||
# single instance
|
||||
if [ -f "$LOCK" ]; then
|
||||
pid=$(cat "$LOCK" 2>/dev/null)
|
||||
kill -0 "$pid" 2>/dev/null && exit 0
|
||||
fi
|
||||
echo $$ > "$LOCK"
|
||||
trap 'rm -f "$LOCK"' EXIT
|
||||
|
||||
[ -z "$TOKEN" ] && exit 0
|
||||
|
||||
# One fetch + compare + apply pass. Returns 0 always (best-effort).
|
||||
do_pull() {
|
||||
# Try each source (tunnel first); accept first that returns a valid conf.
|
||||
got=0
|
||||
for base in $PANEL_URLS; do
|
||||
curl -s -m 8 -o "$TMP" "${base}/api/router-config/${CLIENT_ID}?token=${TOKEN}" 2>/dev/null || continue
|
||||
if grep -q "^SERVER_1=" "$TMP" 2>/dev/null; then got=1; break; fi
|
||||
done
|
||||
[ "$got" = 1 ] || { rm -f "$TMP"; return 0; }
|
||||
|
||||
new=$(md5sum "$TMP" 2>/dev/null | cut -d' ' -f1)
|
||||
old=$(md5sum "$CONF" 2>/dev/null | cut -d' ' -f1)
|
||||
if [ "$new" = "$old" ]; then
|
||||
rm -f "$TMP"
|
||||
return 0
|
||||
fi
|
||||
|
||||
old_s1=$(grep "^SERVER_1=" "$CONF" 2>/dev/null | cut -d= -f2- | cut -d: -f1)
|
||||
new_s1=$(grep "^SERVER_1=" "$TMP" 2>/dev/null | cut -d= -f2- | cut -d: -f1)
|
||||
|
||||
cp "$CONF" "$CONF.prev" 2>/dev/null
|
||||
mv "$TMP" "$CONF"
|
||||
log "PULL: failover.conf updated (SERVER_1 ${old_s1:-?} -> ${new_s1:-?})"
|
||||
|
||||
# apply the new primary now (only if it actually changed)
|
||||
if [ "$old_s1" != "$new_s1" ] && [ -f "$HEALTH" ]; then
|
||||
sh "$HEALTH" apply-server 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Inner loop: cron fires this every 60s, but we poll ~4x per minute so a
|
||||
# panel "Set" applies within ~12-15s instead of up to a full minute. The
|
||||
# loop stays UNDER 60s and exits so the next cron tick takes over cleanly
|
||||
# (the lockfile blocks any overlap). POLL_INTERVAL/POLL_PASSES overridable.
|
||||
POLL_INTERVAL="${POLL_INTERVAL:-12}"
|
||||
POLL_PASSES="${POLL_PASSES:-4}"
|
||||
i=1
|
||||
while [ "$i" -le "$POLL_PASSES" ]; do
|
||||
do_pull
|
||||
[ "$i" -lt "$POLL_PASSES" ] && sleep "$POLL_INTERVAL"
|
||||
i=$((i + 1))
|
||||
done
|
||||
203
server/phobos-router-watchdog.py
Normal file
203
server/phobos-router-watchdog.py
Normal file
@@ -0,0 +1,203 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Phobos Router Watchdog (server-side).
|
||||
|
||||
Problem it solves: on some Keenetic firmware (seen on 5.1 Beta), after a reboot
|
||||
the Entware /opt disk mounts but the init hook (rc.unslung) does NOT run, so the
|
||||
obfuscator + cron + dropbear never start and the router's Phobos tunnel stays
|
||||
down. Because cron itself didn't start, the on-router self-heal can't help.
|
||||
|
||||
This watchdog runs on the primary server (cron, every few minutes). For each
|
||||
router that has KeenDNS web access configured, it checks whether the client has
|
||||
a fresh WG handshake on ANY server. If a router has been offline past a grace
|
||||
period, it logs into the router's web UI over KeenDNS (ndm challenge auth) and
|
||||
re-triggers the opkg init (which runs rc.unslung -> starts everything). Sends a
|
||||
Telegram note on down / recovery / action.
|
||||
|
||||
Per-router config lives in /opt/phobos-panel/settings.json under
|
||||
router_access[<client_id>]:
|
||||
keendns_host : e.g. "homesmart.netcraze.pro"
|
||||
web_login : Keenetic web user
|
||||
web_pass : Keenetic web password
|
||||
opkg_disk : opkg disk id, e.g. "EXT4-XXXX:/" (default below)
|
||||
Routers without these fields are skipped (watchdog is opt-in per router).
|
||||
"""
|
||||
import json, os, time, ssl, hashlib, http.cookiejar, urllib.request, urllib.error, subprocess
|
||||
|
||||
SETTINGS = "/opt/phobos-panel/settings.json"
|
||||
SERVERS_FILE = "/opt/phobos-panel/servers.json"
|
||||
CLIENTS_DIR = "/opt/Phobos/clients"
|
||||
STATE_FILE = "/opt/Phobos/server/watchdog-state.json"
|
||||
LOG = "/opt/Phobos/server/watchdog.log"
|
||||
|
||||
OFFLINE_SECS = int(os.environ.get("WD_OFFLINE_SECS", "300")) # offline if newest handshake older than this
|
||||
COOLDOWN = int(os.environ.get("WD_COOLDOWN", "600")) # min seconds between recovery attempts per router
|
||||
DEFAULT_DISK = "EXT4-V88axM0d:/"
|
||||
|
||||
|
||||
def log(msg):
|
||||
try:
|
||||
with open(LOG, "a") as f:
|
||||
f.write(time.strftime("%Y-%m-%d %H:%M:%S ") + msg + "\n")
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
|
||||
def load(path, default):
|
||||
try:
|
||||
with open(path) as f:
|
||||
return json.load(f)
|
||||
except Exception:
|
||||
return default
|
||||
|
||||
|
||||
def tg(token, chat, text):
|
||||
if not token or not chat:
|
||||
return
|
||||
try:
|
||||
url = f"https://api.telegram.org/bot{token}/sendMessage"
|
||||
data = json.dumps({"chat_id": chat, "text": text}).encode()
|
||||
urllib.request.urlopen(urllib.request.Request(
|
||||
url, data=data, headers={"Content-Type": "application/json"}), timeout=8)
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
|
||||
def client_pub(cid):
|
||||
try:
|
||||
return json.load(open(f"{CLIENTS_DIR}/{cid}/metadata.json")).get("public_key", "")
|
||||
except Exception:
|
||||
return ""
|
||||
|
||||
|
||||
def newest_handshake_age(pub, servers):
|
||||
"""Smallest handshake age (s) for pub across local wg0 + secondary agents."""
|
||||
best = 99999
|
||||
try:
|
||||
out = subprocess.check_output(["wg", "show", "wg0", "dump"], text=True, timeout=5)
|
||||
for ln in out.strip().split("\n")[1:]:
|
||||
f = ln.split("\t")
|
||||
if f and f[0] == pub and len(f) >= 5 and f[4].isdigit() and int(f[4]) > 0:
|
||||
best = min(best, int(time.time()) - int(f[4]))
|
||||
except Exception:
|
||||
pass
|
||||
for srv in servers:
|
||||
try:
|
||||
req = urllib.request.Request(f"http://{srv['ip']}:8444/api/health",
|
||||
headers={"X-API-Key": srv.get("api_key", "")})
|
||||
d = json.loads(urllib.request.urlopen(req, timeout=5).read())
|
||||
ts = d.get("handshakes", {}).get(pub, 0)
|
||||
if ts:
|
||||
best = min(best, int(time.time()) - int(ts))
|
||||
except Exception:
|
||||
pass
|
||||
return best
|
||||
|
||||
|
||||
def rci_session(host, login, pw):
|
||||
"""Keenetic ndm challenge auth over KeenDNS. Returns (opener, base) or (None, None)."""
|
||||
ctx = ssl.create_default_context()
|
||||
ctx.check_hostname = False
|
||||
ctx.verify_mode = ssl.CERT_NONE
|
||||
cj = http.cookiejar.CookieJar()
|
||||
op = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj),
|
||||
urllib.request.HTTPSHandler(context=ctx))
|
||||
base = f"https://{host}"
|
||||
realm = chal = None
|
||||
try:
|
||||
op.open(base + "/auth", timeout=10)
|
||||
except urllib.error.HTTPError as e:
|
||||
realm = e.headers.get("X-NDM-Realm")
|
||||
chal = e.headers.get("X-NDM-Challenge")
|
||||
except Exception:
|
||||
return None, None
|
||||
if not realm or not chal:
|
||||
return None, None
|
||||
md5 = hashlib.md5(f"{login}:{realm}:{pw}".encode()).hexdigest()
|
||||
sha = hashlib.sha256((chal + md5).encode()).hexdigest()
|
||||
body = json.dumps({"login": login, "password": sha}).encode()
|
||||
try:
|
||||
op.open(urllib.request.Request(base + "/auth", data=body,
|
||||
headers={"Content-Type": "application/json"}, method="POST"), timeout=10)
|
||||
except Exception:
|
||||
return None, None
|
||||
return op, base
|
||||
|
||||
|
||||
def retrigger_opkg(op, base, disk):
|
||||
"""Force opkg 'disk changed' so Keenetic re-runs initrc (rc.unslung)."""
|
||||
cur = ""
|
||||
try:
|
||||
cur = json.loads(op.open(base + "/rci/show/rc/opkg", timeout=8).read()).get("disk", {}).get("disk", "")
|
||||
except Exception:
|
||||
pass
|
||||
newdisk = disk
|
||||
if cur.strip() == disk.strip():
|
||||
newdisk = disk.rstrip("/") if disk.endswith("/") else disk + "/"
|
||||
body = json.dumps([{"opkg": {"disk": newdisk}},
|
||||
{"system": {"configuration": {"save": {}}}}]).encode()
|
||||
try:
|
||||
op.open(urllib.request.Request(base + "/rci/", data=body,
|
||||
headers={"Content-Type": "application/json"}, method="POST"), timeout=20)
|
||||
return True
|
||||
except Exception:
|
||||
return False
|
||||
|
||||
|
||||
def main():
|
||||
s = load(SETTINGS, {})
|
||||
st = load(STATE_FILE, {})
|
||||
token = s.get("tg_bot_token")
|
||||
chat = s.get("tg_chat_id")
|
||||
servers = load(SERVERS_FILE, [])
|
||||
ra = s.get("router_access", {})
|
||||
now = int(time.time())
|
||||
changed = False
|
||||
|
||||
for cid, acc in ra.items():
|
||||
host = acc.get("keendns_host")
|
||||
login = acc.get("web_login")
|
||||
pw = acc.get("web_pass")
|
||||
disk = acc.get("opkg_disk", DEFAULT_DISK)
|
||||
if not (host and login and pw):
|
||||
continue
|
||||
pub = client_pub(cid)
|
||||
if not pub:
|
||||
continue
|
||||
age = newest_handshake_age(pub, servers)
|
||||
rec = st.get(cid, {})
|
||||
|
||||
if age <= OFFLINE_SECS:
|
||||
if rec.get("offline"):
|
||||
log(f"{cid}: recovered (handshake {age}s)")
|
||||
tg(token, chat, f"✅ Router {cid} recovered (handshake {age}s).")
|
||||
st[cid] = {"offline": False, "last_recover": rec.get("last_recover", 0)}
|
||||
changed = True
|
||||
continue
|
||||
|
||||
# offline
|
||||
if now - rec.get("last_recover", 0) < COOLDOWN:
|
||||
continue
|
||||
op, base = rci_session(host, login, pw)
|
||||
if not op:
|
||||
if not rec.get("offline"):
|
||||
log(f"{cid}: offline, web unreachable")
|
||||
tg(token, chat, f"\U0001F534 Router {cid} OFFLINE, web unreachable (powered off / no internet?).")
|
||||
st[cid] = {"offline": True, "last_recover": rec.get("last_recover", 0)}
|
||||
changed = True
|
||||
continue
|
||||
ok = retrigger_opkg(op, base, disk)
|
||||
log(f"{cid}: offline ({age}s), re-triggered opkg via RCI -> {'ok' if ok else 'FAIL'}")
|
||||
tg(token, chat, f"\U0001F6E0 Router {cid} Entware down (reboot didn't autostart) — re-triggered via RCI ({'ok' if ok else 'FAILED'}).")
|
||||
st[cid] = {"offline": True, "last_recover": now}
|
||||
changed = True
|
||||
|
||||
if changed:
|
||||
try:
|
||||
json.dump(st, open(STATE_FILE, "w"))
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
0
server/secondary-setup.sh
Normal file → Executable file
0
server/secondary-setup.sh
Normal file → Executable file
Reference in New Issue
Block a user