release: 1.4.7 — failover на Keenetic, cron, таймаут pull

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
phobos-health: переключение сервера больше не убивает туннель
2026-11-01 16:41:40 +03:00 · 2026-11-01 16:41:24 +03:00 · 2026-11-01 16:41:24 +03:00 · 2026-11-01 16:41:24 +03:00 · 2026-11-01 15:18:23 +03:00 · 2026-11-01 04:43:06 +03:00
47 changed files with 1292 additions and 195 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,27 @@ phobos-update beta      # или: phobos-update dev

 ---

+## 1.4.7 — роутеры Keenetic сами переключаются между серверами
+- Исправлено: после переключения на другой сервер туннель на роутере переставал работать — пир прописывался на порт обфускатора 13255, а он мог слушать другой. Порт теперь берётся из `wg-obfuscator.conf`.
+- Исправлено: проверка и обновление конфига по расписанию на Keenetic не запускались — задачи писались в `/opt/etc/crontab`, который демон не читает. Теперь busybox `crond` и crontab пользователя root.
+- Исправлено: `phobos-pull` навсегда зависал на `wget`, если туннель не работает (таймаут 8 с).
+- Роутерам: переустановить клиента или обновить скрипты из панели; серверу — `phobos-update stable`.
+
+## 1.4.6 — роутеры снова получают смену адреса
+- Исправлено: роутер получал 403 при pull конфига, если клиент создан через API/бота (`/api/client/ensure`) — смена адреса/сервера до него не доходила. Теперь принимается и общий ключ из пакета, и личный токен клиента. Роутеры переустанавливать не нужно — достаточно обновить панель.
+
+## 1.4.5 — подсеть при установке, beta/dev по токену
+
+- **feat:** beta и dev теперь берутся из приватного репозитория на Gitea (GitHub заблокирован): `phobos-update beta|dev` с токеном подписчика — в панели «Настройки → Версия и обновления → токен подписчика» или `GH_TOKEN=… phobos-update beta`. Без токена updater сообщает, что канал закрыт, и ничего не трогает.
+- **fix:** при переустановке на сервер с готовым `wg0.conf` подсеть берётся из него.
+
+- **feat:** подсеть VPN-клиентов задаётся при установке: `install.sh` и `secondary-setup.sh` спрашивают её в терминале (Enter = `10.25.0.0/16`) или берут `SERVER_WG_IPV4_NETWORK=10.25.1.0/24`. Неверная или публичная сеть — установка останавливается с ошибкой.
+
+## 1.4.4 — канал «Облако» (через KeenDNS своего Keenetic)
+- **Канал «Облако»** в Android PCA Phobos VPN 1.4.4 и iPhone (TestFlight 1.0 (6)): телефон → облако KeenDNS → ваш Keenetic → сервер. Помогает, когда сам сервер заблокирован, а сайты Keenetic открываются; белый IP роутеру не нужен.
+- **wsgw** — шлюз WebSocket → UDP для Keenetic (Entware: aarch64, mipsel, mips) и Linux. Инструкция с картинками — [docs/cloud.md](docs/cloud.md).
+- Панель: ссылки на приложения ведут на v1.4.4. Остальной сервер не менялся.
+
 ## 1.4.2 — настройка обфускатора сервера

 - **feat:** в панели «Настройки» → «Обфускатор сервера»: masking (AUTO/STUN/NONE), max-dummy, idle — записываются во все порты сервера, обфускатор перезапускается (клиенты переподключаются за секунды).
--- a/README.md
+++ b/README.md
@@ -39,6 +39,7 @@
 - **Домен панели** — `https://ваш-домен/` с бесплатным сертификатом Let's Encrypt; старый адрес `http://IP:порт` продолжает работать.
 - **Адрес для клиентов и каскад** — клиенты подключаются по домену или через входной сервер (например, в РФ) → ваш сервер; роутеры получают адрес сами.
 - **Резервный TCP-канал** — если провайдер режет UDP, клиент сам переходит на TCP (порт 443), обфускация сохраняется.
+- **Канал «Облако»** — если сервер заблокирован целиком: телефон идёт через облако KeenDNS своего Keenetic. [Инструкция](docs/cloud.md).
 - **Сторож** — блокировка зондов и сканеров РКН (nftables, список обновляется раз в сутки).
 - **WARP / WARP+** — выпуск клиентов в интернет через Cloudflare WARP (всем или выборочно), relay-режим.
 - **Бэкап и восстановление** сервера из панели; **терминал роутера в браузере** (ttyd/RCI) за NAT.
@@ -98,6 +99,7 @@ bash <(curl -fsSL https://git.bobyrev.com/PCA/PCA_Phobos/raw/branch/main/install
 |-------------------|-----------------|----------|
 | `PANEL_PASS`      | `OcAdmin2026!`  | Пароль панели (логин `admin`) |
 | `PANEL_PORT`      | случайный       | Порт веб-панели |
+| `SERVER_WG_IPV4_NETWORK` | `10.25.0.0/16` | Подсеть VPN-клиентов (например `10.25.1.0/24`). Без переменной установщик спросит в терминале. Сервер получает первый адрес (`10.25.1.1`). Задаётся только при установке |
 | `API_KEY`         | случайный       | Общий ключ (агенты + pull-токен роутеров) |
 | `OBF_PORTS`       | `2083,5443,993` | Порты обфускатора |
 | `TG_TOKEN`/`TG_CHAT` | пусто        | Telegram-уведомления |
@@ -137,8 +139,8 @@ bash <(curl -fsSL https://git.bobyrev.com/PCA/PCA_Phobos/raw/branch/main/server/

 ## Приложения для Android

- **PCA Phobos VPN** — клиент: включает VPN одной кнопкой, импорт `phobos://` из панели, встроенный обфускатор, **раздельный трафик** (весь / только выбранные приложения / все кроме выбранных), **российские сайты напрямую** (по умолчанию), **канал Авто/UDP/TCP** (при блокировке UDP — сам на TCP), журнал, проверка скорости. [Скачать APK](https://git.bobyrev.com/PCA/PCA_Phobos/releases/download/v1.4.2/PCA-Phobos-VPN.apk) · исходники `android-client/`.
- **PCA Phobos** (админ) — список ваших панелей, открываются в приложении. [Скачать APK](https://git.bobyrev.com/PCA/PCA_Phobos/releases/download/v1.4.2/PCA-Phobos.apk) · исходники `android/`.
+- **PCA Phobos VPN** — клиент: включает VPN одной кнопкой, импорт `phobos://` из панели, встроенный обфускатор, **раздельный трафик** (весь / только выбранные приложения / все кроме выбранных), **российские сайты напрямую** (по умолчанию), **канал Авто/UDP/TCP/Облако** (при блокировке UDP — сам на TCP), журнал, проверка скорости. [Скачать APK](https://git.bobyrev.com/PCA/PCA_Phobos/releases/download/v1.4.4/PCA-Phobos-VPN.apk) · исходники `android-client/`.
+- **PCA Phobos** (админ) — список ваших панелей, открываются в приложении. [Скачать APK](https://git.bobyrev.com/PCA/PCA_Phobos/releases/download/v1.4.4/PCA-Phobos.apk) · исходники `android/`.

 ## Клиенты для телефона

--- a/2
+++ b/2
@@ -1 +1 @@
-1.4.2
+1.4.7
--- a/android-client/AndroidManifest.xml
+++ b/android-client/AndroidManifest.xml
@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.pca.phobos.vpn"
-    android:versionCode="143"
-    android:versionName="1.4.3">
+    android:versionCode="144"
+    android:versionName="1.4.4">

    <uses-sdk android:minSdkVersion="24" android:targetSdkVersion="35" />
    <uses-permission android:name="android.permission.INTERNET" />
--- a/android-client/src/com/pca/phobos/vpn/MainActivity.java
+++ b/android-client/src/com/pca/phobos/vpn/MainActivity.java
@@ -61,7 +61,8 @@ public class MainActivity extends Activity {
    static GoBackend backend;
    static Process obfuscator, relay;
    static final int TCP_LPORT = 13256;
-    static volatile String transport = "";      // "UDP" | "TCP" while up
+    static volatile String transport = "";      // "UDP" | "TCP" | "Облако" while up
+    static WsRelay wsRelay;
    static final Tunnel TUNNEL = new Tunnel() {
        public String getName() { return "phobos"; }
        public void onStateChange(Tunnel.State s) { }
@@ -220,14 +221,14 @@ public class MainActivity extends Activity {
    private static final java.util.Set<String> OBF_KEYS = new java.util.HashSet<>(java.util.Arrays.asList(
            "target", "key", "masking", "idle-timeout", "max-dummy", "static-bindings", "max-clients", "target-if", "allow-clean", "in-timeout", "resolve-interval"));

-    private String obfPart(String conf, boolean viaTcp) {
+    private String obfPart(String conf, boolean viaRelay) {
        StringBuilder sb = new StringBuilder("[instance]\nsource-if = 127.0.0.1\nsource-lport = " + LPORT + "\n");
        for (String ln : section(conf, "[instance]")) {
            String k = key(ln);
            if (k.equals("source-if") || k.equals("source-lport") || k.equals("verbose")) continue;
            // configs from other Phobos builds carry keys our wg-obfuscator v1.6 rejects (obfuscate-bytes…)
            if (!OBF_KEYS.contains(k)) continue;
-            if (viaTcp && k.equals("target")) ln = "target = 127.0.0.1:" + TCP_LPORT;
+            if (viaRelay && k.equals("target")) ln = "target = 127.0.0.1:" + TCP_LPORT;
            sb.append(ln).append('\n');
        }
        sb.append("verbose = INFO\n");
@@ -243,6 +244,17 @@ public class MainActivity extends Activity {
        return "";
    }

+    /** wss:// of the user's Keenetic (KeenDNS cloud subdomain -> wsgw): set in the app, or "# pca-ws = wss://…" in the link. */
+    private String wsUrl(String conf) {
+        String u = prefs.getString("ws_url", "");
+        if (!u.isEmpty()) return u;
+        for (String ln : conf.split("\n")) {
+            String t = ln.trim();
+            if (t.startsWith("#") && t.contains("pca-ws") && t.contains("=")) return val(t);
+        }
+        return "";
+    }
+
    private String target(String conf) {
        for (String ln : section(conf, "[instance]")) if (key(ln).equals("target")) return val(ln);
        return "?";
@@ -267,24 +279,30 @@ public class MainActivity extends Activity {
        else if (req == 7) toast("Без разрешения на VPN подключиться нельзя");
    }

-    /** Start (or restart) obfuscator; via TCP it dials the local udptcp relay. */
-    private void startTransport(String conf, boolean viaTcp) throws Exception {
+    /** Start (or restart) obfuscator; via TCP / cloud it dials the local relay on TCP_LPORT. */
+    private void startTransport(String conf, String via) throws Exception {
        stopObfuscator();
        String lib = getApplicationInfo().nativeLibraryDir;
+        boolean viaTcp = "tcp".equals(via), viaWs = "cloud".equals(via);
+        if (viaWs) {
+            if (wsUrl(conf).isEmpty()) throw new IllegalStateException("не задан адрес роутера (wss://…) для канала «Облако»");
+            wsRelay = new WsRelay(TCP_LPORT, wsUrl(conf), this::log);
+            wsRelay.start();
+        }
        if (viaTcp) {
            String host = target(conf).replaceAll(":\\d+$", "");
            relay = new ProcessBuilder(lib + "/libudptcp.so", "-c", "127.0.0.1:" + TCP_LPORT, host + ":" + tcpPort(conf))
                    .redirectErrorStream(true).redirectOutput(new File(getFilesDir(), "tcp.log")).start();
        }
        File cfg = new File(getFilesDir(), "obf.conf");
-        try (FileOutputStream o = new FileOutputStream(cfg)) { o.write(obfPart(conf, viaTcp).getBytes(StandardCharsets.UTF_8)); }
+        try (FileOutputStream o = new FileOutputStream(cfg)) { o.write(obfPart(conf, viaTcp || viaWs).getBytes(StandardCharsets.UTF_8)); }
        obfuscator = new ProcessBuilder(lib + "/libwgobfuscator.so", "-c", cfg.getAbsolutePath())
                .redirectErrorStream(true).redirectOutput(new File(getFilesDir(), "obf.log")).start();
        Thread.sleep(600);
        if (!obfuscator.isAlive()) throw new IllegalStateException("обфускатор завершился, код " + obfuscator.exitValue() + " — см. «Журнал»");
        if (relay != null && !relay.isAlive()) throw new IllegalStateException("TCP-канал не запустился — см. «Журнал»");
-        transport = viaTcp ? "TCP" : "UDP";
-        log("transport " + transport + " -> " + target(conf) + (viaTcp ? " tcp:" + tcpPort(conf) : ""));
+        transport = viaWs ? "Облако" : viaTcp ? "TCP" : "UDP";
+        log("transport " + transport + " -> " + (viaWs ? wsUrl(conf) : target(conf) + (viaTcp ? " tcp:" + tcpPort(conf) : "")));
    }

    private void up() {
@@ -293,7 +311,7 @@ public class MainActivity extends Activity {
            String mode = prefs.getString("transport", "auto");
            boolean tcpAvail = !tcpPort(conf).isEmpty();
            if ("tcp".equals(mode) && !tcpAvail) throw new IllegalStateException("на сервере нет TCP-канала — обновите панель и заново импортируйте ссылку");
-            startTransport(conf, "tcp".equals(mode));
+            startTransport(conf, "auto".equals(mode) ? "udp" : mode);
            Config c = Config.parse(new BufferedReader(new StringReader(
                    wgPart(conf, prefs.getString("mode", MODE_ALL), prefs.getString("apps", "")))));
            backend.setState(TUNNEL, Tunnel.State.UP, c);
@@ -315,7 +333,7 @@ public class MainActivity extends Activity {
                if (!isUp() || !"UDP".equals(transport)) return;
                if (backend.getStatistics(TUNNEL).totalRx() > 0) return;
                log("UDP: no answer in 15 s -> switching to TCP");
-                startTransport(conf, true);
+                startTransport(conf, "tcp");
                post("UDP не отвечает — переключился на TCP");
            } catch (Throwable e) { log("watchUdp: " + e); }
        }).start();
@@ -331,6 +349,7 @@ public class MainActivity extends Activity {
    private static void stopObfuscator() {
        if (obfuscator != null) { obfuscator.destroy(); obfuscator = null; }
        if (relay != null) { relay.destroy(); relay = null; }
+        if (wsRelay != null) { wsRelay.stop(); wsRelay = null; }
    }

    private void post(String msg) { ui.post(() -> { toast(msg); refresh(); }); }
@@ -416,13 +435,16 @@ public class MainActivity extends Activity {
        RadioGroup tg = new RadioGroup(this);
        tg.setOrientation(RadioGroup.HORIZONTAL);
        String tmode = prefs.getString("transport", "auto");
-        for (String[] m : new String[][]{{"auto", "Авто"}, {"udp", "UDP"}, {"tcp", "TCP"}}) {
+        for (String[] m : new String[][]{{"auto", "Авто"}, {"udp", "UDP"}, {"tcp", "TCP"}, {"cloud", "Облако"}}) {
            RadioButton r = new RadioButton(this);
            r.setText(m[1]);
            r.setTextColor(text());
            r.setId(View.generateViewId());
            r.setChecked(m[0].equals(tmode));
-            r.setOnClickListener(v -> { prefs.edit().putString("transport", m[0]).apply(); applyIfUp(); });
+            r.setOnClickListener(v -> {
+                prefs.edit().putString("transport", m[0]).apply();
+                if ("cloud".equals(m[0])) wsDialog(); else applyIfUp();
+            });
            tg.addView(r);
        }
        split.addView(tg);
@@ -478,6 +500,22 @@ public class MainActivity extends Activity {
                .setNegativeButton("Отмена", null).show();
    }

+    /** Channel "Облако": address of the user's Keenetic web app (KeenDNS cloud) with wsgw behind it. */
+    private void wsDialog() {
+        final EditText e = new EditText(this);
+        e.setHint("wss://phobos.имя.keenetic.pro/");
+        e.setText(wsUrl(prefs.getString("conf", "")));
+        new AlertDialog.Builder(this).setTitle("Адрес роутера (KeenDNS)").setView(e)
+                .setMessage("Канал через облако Keenetic: телефон → облако KeenDNS → ваш роутер → сервер.")
+                .setPositiveButton("Сохранить", (d, w) -> {
+                    String u = e.getText().toString().trim();
+                    if (!u.isEmpty() && !u.startsWith("wss://")) u = "wss://" + u.replaceFirst("^\\w+://", "");
+                    prefs.edit().putString("ws_url", u).apply();
+                    applyIfUp();
+                })
+                .setNegativeButton("Отмена", null).show();
+    }
+
    private void pickApps() {
        PackageManager pm = getPackageManager();
        Intent main = new Intent(Intent.ACTION_MAIN).addCategory(Intent.CATEGORY_LAUNCHER);
--- a/android-client/src/com/pca/phobos/vpn/WsRelay.java
+++ b/android-client/src/com/pca/phobos/vpn/WsRelay.java
@@ -0,0 +1,157 @@
+package com.pca.phobos.vpn;
+
+import java.io.DataInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.DatagramPacket;
+import java.net.DatagramSocket;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.net.SocketAddress;
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.security.SecureRandom;
+
+import javax.net.ssl.SSLSocket;
+import javax.net.ssl.SSLSocketFactory;
+
+/**
+ * Transport "Keenetic cloud": local UDP (obfuscator) <-> wss://<keendns-subdomain>/ -> wsgw on the router -> server UDP.
+ * One binary WS message = one obfuscated packet. Reconnects on drop; the tunnel itself is not restarted.
+ */
+final class WsRelay {
+    interface Log { void log(String s); }
+
+    private final int lport;
+    private final URI uri;
+    private final Log log;
+    private final SecureRandom rnd = new SecureRandom();
+    private volatile boolean stop;
+    private volatile SSLSocket ws;
+    private volatile OutputStream out;
+    private volatile SocketAddress peer;
+    private DatagramSocket udp;
+
+    WsRelay(int lport, String url, Log log) {
+        this.lport = lport;
+        this.uri = URI.create(url.trim());
+        this.log = log;
+    }
+
+    void start() throws IOException {
+        udp = new DatagramSocket(new InetSocketAddress(InetAddress.getByName("127.0.0.1"), lport));
+        new Thread(this::upLoop, "ws-up").start();
+        new Thread(this::downLoop, "ws-down").start();
+    }
+
+    void stop() {
+        stop = true;
+        closeWs();
+        if (udp != null) udp.close();
+    }
+
+    private synchronized void closeWs() {
+        try { if (ws != null) ws.close(); } catch (IOException ignored) { }
+        ws = null;
+        out = null;
+    }
+
+    private synchronized OutputStream connect() throws IOException {
+        if (out != null) return out;
+        String host = uri.getHost();
+        int port = uri.getPort() > 0 ? uri.getPort() : 443;
+        SSLSocket s = (SSLSocket) SSLSocketFactory.getDefault().createSocket(host, port);
+        s.setTcpNoDelay(true);
+        s.setKeepAlive(true);
+        s.startHandshake();
+        byte[] k = new byte[16];
+        rnd.nextBytes(k);
+        String path = uri.getRawPath() == null || uri.getRawPath().isEmpty() ? "/" : uri.getRawPath();
+        String req = "GET " + path + " HTTP/1.1\r\nHost: " + host + "\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n"
+                + "Sec-WebSocket-Version: 13\r\nSec-WebSocket-Key: " + android.util.Base64.encodeToString(k, android.util.Base64.NO_WRAP) + "\r\n\r\n";
+        OutputStream o = s.getOutputStream();
+        o.write(req.getBytes(StandardCharsets.US_ASCII));
+        o.flush();
+        InputStream in = s.getInputStream();
+        StringBuilder head = new StringBuilder();
+        while (!head.toString().endsWith("\r\n\r\n")) {
+            int c = in.read();
+            if (c < 0 || head.length() > 8192) throw new IOException("ws: no handshake");
+            head.append((char) c);
+        }
+        if (!head.toString().startsWith("HTTP/1.1 101")) {
+            s.close();
+            throw new IOException("ws: " + head.toString().split("\r\n")[0]);
+        }
+        ws = s;
+        out = o;
+        log.log("ws: connected " + uri);
+        return o;
+    }
+
+    /** obfuscator -> server */
+    private void upLoop() {
+        byte[] buf = new byte[65535];
+        DatagramPacket p = new DatagramPacket(buf, buf.length);
+        while (!stop) {
+            try {
+                udp.receive(p);
+                peer = p.getSocketAddress();
+                OutputStream o = connect();
+                writeFrame(o, buf, p.getLength());
+            } catch (IOException e) {
+                if (stop) return;
+                log.log("ws up: " + e.getMessage());
+                closeWs();
+                sleep(1000);
+            }
+        }
+    }
+
+    /** server -> obfuscator */
+    private void downLoop() {
+        while (!stop) {
+            SSLSocket s = ws;
+            if (s == null) { sleep(200); continue; }
+            try {
+                DataInputStream in = new DataInputStream(s.getInputStream());
+                while (!stop) {
+                    int b0 = in.readUnsignedByte(), b1 = in.readUnsignedByte();
+                    long n = b1 & 0x7f;
+                    if (n == 126) n = in.readUnsignedShort();
+                    else if (n == 127) n = in.readLong();
+                    if (n > 65535) throw new IOException("ws: frame too big");
+                    byte[] p = new byte[(int) n];
+                    in.readFully(p);
+                    int op = b0 & 0x0f;
+                    if (op == 8) throw new IOException("ws: closed by server");
+                    if ((op == 2 || op == 0) && peer != null) udp.send(new DatagramPacket(p, p.length, peer));
+                }
+            } catch (IOException e) {
+                if (stop) return;
+                if (s == ws) { log.log("ws down: " + e.getMessage()); closeWs(); }
+            }
+        }
+    }
+
+    /** Client frames are masked (RFC 6455). */
+    private synchronized void writeFrame(OutputStream o, byte[] p, int n) throws IOException {
+        byte[] f = new byte[n + 14];
+        int i = 0;
+        f[i++] = (byte) 0x82;
+        if (n < 126) f[i++] = (byte) (0x80 | n);
+        else { f[i++] = (byte) (0x80 | 126); f[i++] = (byte) (n >> 8); f[i++] = (byte) n; }
+        byte[] m = new byte[4];
+        rnd.nextBytes(m);
+        System.arraycopy(m, 0, f, i, 4);
+        i += 4;
+        for (int j = 0; j < n; j++) f[i + j] = (byte) (p[j] ^ m[j & 3]);
+        o.write(f, 0, i + n);
+        o.flush();
+    }
+
+    private static void sleep(long ms) {
+        try { Thread.sleep(ms); } catch (InterruptedException ignored) { }
+    }
+}
--- a/app.py
+++ b/app.py
@@ -37,7 +37,7 @@ WG_CONFIG = "/etc/wireguard/wg0.conf"
 # Distribution: Gitea first (GitHub account is unavailable since 23.10.2026), GitHub fallback
 PCA_GIT = "https://git.bobyrev.com/PCA/PCA_Phobos"
 PCA_GH_RAW = "https://raw.githubusercontent.com/andrey271192/PCA_Phobos"
-APK_TAG = "v1.4.2"
+APK_TAG = "v1.4.4"
 WARP_DIR = f"{PHOBOS_DIR}/server/warp"
 WARP_CUSTOM_PROFILE_FILE = f"{WARP_DIR}/custom-profile.conf"
 WARP_LICENSE_FILE = f"{WARP_DIR}/license.key"
@@ -3449,8 +3449,9 @@ def router_config(client_id):
    st = load_settings()
    token = request.args.get("token", "")
    acc = st.get("router_access", {}).get(client_id, {})
-    expected = acc.get("pull_token", "") or st.get("server_api_key", "")
-    if not expected or token != expected:
+    # packages ship server_api_key as pull_token (phobos-client.sh), so accept both
+    expected = {t for t in (acc.get("pull_token", ""), st.get("server_api_key", "")) if t}
+    if not token or token not in expected:
        return ("forbidden", 403)
    conf = generate_failover_conf_for_client(client_id)
    return (conf, 200, {"Content-Type": "text/plain; charset=utf-8"})
--- a/client/phobos-health.sh
+++ b/client/phobos-health.sh
@@ -1,28 +1,41 @@
 #!/bin/sh
 # ============================================================
-#  Phobos Health Monitor — Auto-heal + Failover for routers
-#  Runs via cron every 60 seconds on Keenetic/Entware
-#
-#  Install: crontab -e → */1 * * * * /opt/etc/Phobos/phobos-health.sh
+#  Phobos Health Monitor v2 — Keenetic Edition
+#  Uses ndmc/RCI instead of wg-tools. Connectivity-based failover.
+#  Runs via cron every 60 seconds
 # ============================================================

 PHOBOS_DIR="/opt/etc/Phobos"
 CONF="$PHOBOS_DIR/failover.conf"
 STATE="$PHOBOS_DIR/state"
 LOG="$PHOBOS_DIR/health.log"
-WG_CONF="$PHOBOS_DIR/wg0.conf"
 OBF_CONF="$PHOBOS_DIR/wg-obfuscator.conf"
 LOCKFILE="/tmp/phobos-health.lock"
+WG_IF="Wireguard3"

 MAX_LOG_LINES=200
-HANDSHAKE_WARN=180
-HANDSHAKE_RESTART_OBF=300
-HANDSHAKE_RESTART_WG=600
-HANDSHAKE_FAILOVER=900
+# Thresholds (seconds)
+HANDSHAKE_WARN=150
+HANDSHAKE_PORT_HOP=300
+HANDSHAKE_SERVER_SWITCH=600
+PRIMARY_CHECK_INTERVAL=300
+# Primary-alive probe: servers block ICMP and busybox `nc -z` is unreliable,
+# so reachability is tested with curl against the panel's obfuscator-health
+# endpoint on the primary VPS. It returns http 200 ONLY when all
+# wg-obfuscator-* services are active — the bare panel port stays up even
+# when the tunnel path is dead, so we must NOT switch back on panel liveness
+# alone (that caused premature switchback to a dead primary).
+PRIMARY_PROBE_SCHEME="${PRIMARY_PROBE_SCHEME:-$(cat "$PHOBOS_DIR/panel_scheme" 2>/dev/null)}"
+PRIMARY_PROBE_SCHEME="${PRIMARY_PROBE_SCHEME:-http}"
+PRIMARY_PROBE_PORT="${PRIMARY_PROBE_PORT:-$(cat "$PHOBOS_DIR/panel_port" 2>/dev/null)}"
+PRIMARY_PROBE_PORT="${PRIMARY_PROBE_PORT:-8443}"
+PRIMARY_PROBE_PATH="/api/obf-health"
+# Connectivity check targets (logged for context only)
+CHECK_HOST_1="8.8.8.8"
+CHECK_HOST_2="1.1.1.1"

 log() {
    echo "$(date '+%H:%M:%S') $1" >> "$LOG"
-    # Trim log
    if [ "$(wc -l < "$LOG" 2>/dev/null)" -gt "$MAX_LOG_LINES" ]; then
        tail -n 100 "$LOG" > "$LOG.tmp" && mv "$LOG.tmp" "$LOG"
    fi
@@ -38,33 +51,35 @@ fi
 echo $$ > "$LOCKFILE"
 trap 'rm -f "$LOCKFILE"' EXIT

-# Create state dir
 mkdir -p "$STATE"

+# ── Detect WG interface ──
+detect_wg_interface() {
+    for i in 0 1 2 3 4 5 6 7 8 9; do
+        desc=$(ndmc -c "show interface Wireguard${i}" 2>/dev/null | grep description | head -1)
+        if echo "$desc" | grep -qi phobos; then
+            WG_IF="Wireguard${i}"
+            return 0
+        fi
+    done
+    return 1
+}
+
 # ── Read failover config ──
 if [ ! -f "$CONF" ]; then
    log "ERROR: no failover.conf"
    exit 1
 fi

-# Parse servers: SERVER_1=ip:port1,port2,port3
-# Parse current state
-CURRENT_SERVER=$(cat "$STATE/current_server" 2>/dev/null || echo "1")
-CURRENT_PORT_IDX=$(cat "$STATE/current_port_idx" 2>/dev/null || echo "0")
-RESTART_COUNT=$(cat "$STATE/restart_count" 2>/dev/null || echo "0")
-PRIMARY_CHECK_TS=$(cat "$STATE/primary_check_ts" 2>/dev/null || echo "0")
-
-# Load server list
 SERVER_COUNT=0
 idx=1
 while true; do
    val=$(grep "^SERVER_${idx}=" "$CONF" 2>/dev/null | cut -d= -f2-)
-    if [ -z "$val" ]; then
-        break
-    fi
+    [ -z "$val" ] && break
    eval "SERVER_${idx}_HOST=$(echo "$val" | cut -d: -f1)"
    eval "SERVER_${idx}_PORTS=$(echo "$val" | cut -d: -f2-)"
    eval "SERVER_${idx}_KEY=$(grep "^KEY_${idx}=" "$CONF" 2>/dev/null | cut -d= -f2-)"
+    eval "SERVER_${idx}_WGKEY=$(grep "^WGKEY_${idx}=" "$CONF" 2>/dev/null | cut -d= -f2-)"
    SERVER_COUNT=$idx
    idx=$((idx + 1))
 done
@@ -74,22 +89,43 @@ if [ "$SERVER_COUNT" -eq 0 ]; then
    exit 1
 fi

-# ── Get current handshake age ──
-get_handshake_age() {
-    hs=$(wg show wg0 latest-handshakes 2>/dev/null | awk '{print $2}')
-    if [ -z "$hs" ] || [ "$hs" = "0" ]; then
-        echo "9999"
-        return
-    fi
-    now=$(date +%s)
-    age=$((now - hs))
-    echo "$age"
+# Read state
+CURRENT_SERVER=$(cat "$STATE/current_server" 2>/dev/null || echo "1")
+CURRENT_PORT_IDX=$(cat "$STATE/current_port_idx" 2>/dev/null || echo "0")
+FAIL_COUNT=$(cat "$STATE/fail_count" 2>/dev/null || echo "0")
+PRIMARY_CHECK_TS=$(cat "$STATE/primary_check_ts" 2>/dev/null || echo "0")
+
+# ── Detect Phobos WG interface (non-fatal, fallback to Wireguard3) ──
+detect_wg_interface || {
+    log "WARN: detect failed, using default $WG_IF"
 }

-# ── Get port by index from comma-separated list ──
+# ── Get handshake age via ndmc ──
+# A peer switch can leave the removed peer's stale handshake listed in ndmc
+# output (often a huge sentinel like 2147483647). Take the FRESHEST (minimum
+# positive, sane) handshake across all peers — that is the live tunnel.
+get_handshake_age() {
+    hs=$(ndmc -c "show interface $WG_IF" 2>/dev/null \
+        | grep "last-handshake" \
+        | awk '{v=$2} v>0 && v<86400 {print v}' \
+        | sort -n | head -1)
+    if [ -z "$hs" ]; then
+        echo "9999"
+    else
+        echo "$hs"
+    fi
+}
+
+# ── Check real connectivity ──
+check_connectivity() {
+    ping -c 1 -W 3 "$CHECK_HOST_1" >/dev/null 2>&1 && return 0
+    ping -c 1 -W 3 "$CHECK_HOST_2" >/dev/null 2>&1 && return 0
+    return 1
+}
+
+# ── Get port by index ──
 get_port() {
-    server_idx=$1
-    port_idx=$2
+    server_idx=$1; port_idx=$2
    eval "ports=\$SERVER_${server_idx}_PORTS"
    echo "$ports" | tr ',' '\n' | sed -n "$((port_idx + 1))p"
 }
@@ -100,6 +136,78 @@ get_port_count() {
    echo "$ports" | tr ',' '\n' | wc -l
 }

+# ── Keys currently on the interface (includes the interface's OWN key) ──
+# WG public keys are 43 base64 chars + '='. The interface's own public-key is
+# also matched here — callers must only act on KNOWN server WGKEYs so the
+# local key is never touched.
+list_iface_keys() {
+    ndmc -c "show interface $WG_IF" 2>/dev/null \
+        | grep -oE '[A-Za-z0-9+/]{43}=' | sort -u
+}
+
+# Count how many KNOWN server WGKEYs are currently attached as peers.
+count_server_peers() {
+    present=$(list_iface_keys)
+    n=0
+    i=1
+    while [ "$i" -le "$SERVER_COUNT" ]; do
+        eval "wk=\$SERVER_${i}_WGKEY"
+        if [ -n "$wk" ] && echo "$present" | grep -q "^${wk}$"; then
+            n=$((n + 1))
+        fi
+        i=$((i + 1))
+    done
+    echo "$n"
+}
+
+# ── Switch WG peer so EXACTLY ONE server peer (new_key) remains ──
+# Failover adds a new peer; the RCI "remove" is unreliable on Keenetic and
+# leaves dead peers behind. Multiple peers each with allow-ips 0.0.0.0/0 make
+# egress routing ambiguous. We hard-purge every OTHER known server key via the
+# ndmc CLI (reliable) — never the interface's own key — then ensure new_key.
+switch_wg_peer() {
+    new_key=$1
+
+    if [ -z "$new_key" ]; then
+        log "WARN: no WGKEY for target server, skip peer switch"
+        return 1
+    fi
+
+    present=$(list_iface_keys)
+
+    # Purge any OTHER known server key that is attached
+    i=1
+    while [ "$i" -le "$SERVER_COUNT" ]; do
+        eval "wk=\$SERVER_${i}_WGKEY"
+        if [ -n "$wk" ] && [ "$wk" != "$new_key" ] && echo "$present" | grep -q "^${wk}$"; then
+            log "WG PEER purge: $wk"
+            ndmc -c "interface $WG_IF no wireguard peer $wk" >/dev/null 2>&1
+        fi
+        i=$((i + 1))
+    done
+
+    # Add the target peer if it is not already present
+    if ! echo "$present" | grep -q "^${new_key}$"; then
+        log "WG PEER add: $new_key"
+        # 01.11.2026: порт — из конфига обфускатора (было зашито 13255, а установщик
+        # берёт свободный, на части роутеров 51820 → после переключения туннель мёртв).
+        # Через ndmc по шагам: JSON-RCI с allow-ips "::"/0 молча не ставил allow-ips.
+        lport=$(grep 'source-lport' "$PHOBOS_DIR/wg-obfuscator.conf" 2>/dev/null | tr -d ' ' | cut -d'=' -f2)
+        lport=${lport:-13255}
+        ndmc -c "interface $WG_IF wireguard peer $new_key" >/dev/null 2>&1
+        ndmc -c "interface $WG_IF wireguard peer $new_key endpoint 127.0.0.1:$lport" >/dev/null 2>&1
+        ndmc -c "interface $WG_IF wireguard peer $new_key keepalive-interval 25" >/dev/null 2>&1
+        ndmc -c "interface $WG_IF wireguard peer $new_key allow-ips 0.0.0.0 0.0.0.0" >/dev/null 2>&1
+        # ядро не всегда подхватывает allow-ips нового пира без перезапуска интерфейса
+        ndmc -c "interface $WG_IF down" >/dev/null 2>&1; sleep 1
+        ndmc -c "interface $WG_IF up" >/dev/null 2>&1
+    fi
+
+    # Persist config
+    ndmc -c "system configuration save" >/dev/null 2>&1
+    return 0
+}
+
 # ── Switch to specific server:port ──
 switch_endpoint() {
    server_idx=$1
@@ -107,6 +215,7 @@ switch_endpoint() {

    eval "host=\$SERVER_${server_idx}_HOST"
    eval "obf_key=\$SERVER_${server_idx}_KEY"
+    eval "wg_key=\$SERVER_${server_idx}_WGKEY"
    port=$(get_port "$server_idx" "$port_idx")

    if [ -z "$host" ] || [ -z "$port" ]; then
@@ -116,7 +225,10 @@ switch_endpoint() {

    log "SWITCH → server $server_idx ($host:$port)"

-    # Update obfuscator config target
+    # 1. Switch WG peer key if different server
+    switch_wg_peer "$wg_key"
+
+    # 2. Update obfuscator config
    if [ -f "$OBF_CONF" ]; then
        sed -i "s|^target = .*|target = ${host}:${port}|" "$OBF_CONF"
        if [ -n "$obf_key" ]; then
@@ -124,25 +236,26 @@ switch_endpoint() {
        fi
    fi

-    # Restart obfuscator
-    killall wg-obfuscator 2>/dev/null
-    sleep 1
-    wg-obfuscator --config "$OBF_CONF" &
+    # 3. Restart obfuscator
+    if [ -f /opt/etc/init.d/S49wg-obfuscator ]; then
+        /opt/etc/init.d/S49wg-obfuscator restart >/dev/null 2>&1
+    else
+        killall wg-obfuscator 2>/dev/null
+        sleep 1
+        wg-obfuscator --config "$OBF_CONF" &
+    fi

-    # Save state
+    # 4. Save state (fail_count is managed by the caller, NOT reset here —
+    #    resetting on a port-hop would prevent escalation to server failover)
    echo "$server_idx" > "$STATE/current_server"
    echo "$port_idx" > "$STATE/current_port_idx"
-    echo "0" > "$STATE/restart_count"
 }

 # ── Try next port on current server ──
 try_next_port() {
    port_count=$(get_port_count "$CURRENT_SERVER")
    next_idx=$(( (CURRENT_PORT_IDX + 1) % port_count ))
-
-    if [ "$next_idx" -eq 0 ]; then
-        return 1
-    fi
+    [ "$next_idx" -eq 0 ] && return 1

    log "PORT HOP → port idx $next_idx on server $CURRENT_SERVER"
    switch_endpoint "$CURRENT_SERVER" "$next_idx"
@@ -152,96 +265,203 @@ try_next_port() {
 # ── Try next server ──
 try_next_server() {
    next=$((CURRENT_SERVER + 1))
-    if [ "$next" -gt "$SERVER_COUNT" ]; then
-        next=1
-    fi
-
-    if [ "$next" -eq "$CURRENT_SERVER" ]; then
-        log "WARN: only one server, can't failover"
-        return 1
-    fi
+    [ "$next" -gt "$SERVER_COUNT" ] && next=1
+    [ "$next" -eq "$CURRENT_SERVER" ] && return 1

    log "FAILOVER → server $next"
    switch_endpoint "$next" "0"
    return 0
 }

-# ── Check if primary is back (every 5 min when on secondary) ──
+# ── Check if primary is back ──
 check_primary() {
-    if [ "$CURRENT_SERVER" -eq 1 ]; then
-        return
-    fi
+    [ "$CURRENT_SERVER" -eq 1 ] && return

    now=$(date +%s)
    elapsed=$((now - PRIMARY_CHECK_TS))
-    if [ "$elapsed" -lt 300 ]; then
-        return
-    fi
+    [ "$elapsed" -lt "$PRIMARY_CHECK_INTERVAL" ] && return
    echo "$now" > "$STATE/primary_check_ts"

    eval "host=\$SERVER_1_HOST"
-    port=$(get_port 1 0)
-
-    # Quick UDP probe — send a byte, see if port responds
-    if ping -c 1 -W 2 "$host" >/dev/null 2>&1; then
-        log "PRIMARY alive, switching back"
+    # Probe the obfuscator-health endpoint: http 200 ONLY when the primary's
+    # obfuscator path is actually up. Anything else (000 no-response, 503
+    # obf-down, redirects) means the tunnel path is NOT viable → stay put.
+    ok_url=""
+    last_code=""
+    for url in "${PRIMARY_PROBE_SCHEME}://${host}:${PRIMARY_PROBE_PORT}${PRIMARY_PROBE_PATH}" "http://${host}:8444${PRIMARY_PROBE_PATH}"; do
+        code=$(curl -k -s -m 4 -o /dev/null -w '%{http_code}' "$url" 2>/dev/null)
+        last_code="$code"
+        if [ "$code" = "200" ]; then
+            ok_url="$url"
+            break
+        fi
+    done
+    if [ -n "$ok_url" ]; then
+        log "PRIMARY ($ok_url http=200) alive, switching back"
        switch_endpoint 1 0
+        echo "0" > "$STATE/fail_count"
+    else
+        log "PRIMARY still down (obf-health http=${last_code:-none}), staying on server $CURRENT_SERVER"
    fi
 }

-# ── Main logic ──
-AGE=$(get_handshake_age)
+# ── LAN routing self-heal ──────────────────────
+# A router REBOOT silently drops the per-device `ip hotspot host <mac> policy`
+# binding and can reset the WG interface security-level, so LAN clients leak to
+# WAN (no VPN). This:
+#   1) ensures WG_IF security-level = public (needed for masquerade),
+#   2) LEARNS current host->policy bindings into state/lan-hosts (append-only),
+#   3) RE-APPLIES any learned binding that is currently missing.
+# Append-only learning means a reboot (which clears live bindings) never erases
+# the record, so the next run restores them. ndmc show running-config is heavy,
+# so the caller gates this to run only every few minutes.
+heal_lan_routing() {
+    LANHOSTS="$STATE/lan-hosts"
+    rc=$(ndmc -c "show running-config" 2>/dev/null)
+    [ -z "$rc" ] && return 0

+    # 1) WG interface must be public
+    sl=$(echo "$rc" | awk -v ifc="interface $WG_IF" '$0~ifc{f=1} f&&/security-level/{print $2; exit}')
+    if [ -n "$sl" ] && [ "$sl" != "public" ]; then
+        ndmc -c "interface $WG_IF security-level public" >/dev/null 2>&1
+        ndmc -c "system configuration save" >/dev/null 2>&1
+        log "HEAL: $WG_IF security-level -> public"
+    fi
+
+    # 2) learn live bindings (append-only) into lan-hosts
+    touch "$LANHOSTS"
+    echo "$rc" | grep -oE "host [0-9a-f:]+ policy [A-Za-z0-9_]+" | while read -r _h mac _p pol; do
+        grep -q "^$mac " "$LANHOSTS" 2>/dev/null || echo "$mac $pol" >> "$LANHOSTS"
+    done
+
+    # 3) re-apply any learned binding that is missing live
+    changed=0
+    while read -r mac pol; do
+        [ -z "$mac" ] && continue
+        case "$mac" in \#*) continue;; esac
+        if ! echo "$rc" | grep -q "host $mac policy $pol"; then
+            ndmc -c "ip hotspot host $mac policy $pol" >/dev/null 2>&1
+            log "HEAL: re-bound host $mac -> $pol"
+            changed=1
+        fi
+    done < "$LANHOSTS"
+    [ "$changed" = 1 ] && ndmc -c "system configuration save" >/dev/null 2>&1
+}
+
+# ══════════════════════════════════════════════
+#  Explicit apply hook (used by phobos-pull.sh after a config change).
+#  `phobos-health.sh apply-server N` re-points the tunnel to SERVER_N
+#  immediately, skipping the failure-escalation logic. Reuses
+#  switch_endpoint so the WG-peer/obfuscator/state changes stay identical
+#  to a normal failover. Resets fail_count so the new server starts clean.
+# ══════════════════════════════════════════════
+if [ "$1" = "apply-server" ]; then
+    idx="${2:-1}"
+    eval "ahost=\$SERVER_${idx}_HOST"
+    if [ -z "$ahost" ]; then
+        log "APPLY: server $idx not in conf, ignore"
+        exit 1
+    fi
+    log "APPLY: pull requested server $idx ($ahost)"
+    switch_endpoint "$idx" "0"
+    echo "0" > "$STATE/fail_count"
+    echo "$idx" > "$STATE/current_server"
+    exit 0
+fi
+
+# ══════════════════════════════════════════════
+#  Pre-check: fix desync (obfuscator targeting wrong server)
+# ══════════════════════════════════════════════
+if [ -f "$OBF_CONF" ]; then
+    cur_target=$(grep "^target = " "$OBF_CONF" 2>/dev/null | sed 's/target = //')
+    eval "expected_host=\$SERVER_${CURRENT_SERVER}_HOST"
+    if [ -n "$cur_target" ] && [ -n "$expected_host" ]; then
+        echo "$cur_target" | grep -q "$expected_host" || {
+            log "DESYNC: obf=$cur_target state=server${CURRENT_SERVER}($expected_host). Resync."
+            switch_endpoint "$CURRENT_SERVER" "$CURRENT_PORT_IDX"
+            sleep 5
+        }
+    fi
+fi
+
+# ── LAN routing self-heal (gated ~5 min; a reboot drops host->policy bindings) ──
+HEAL_TS=$(cat "$STATE/heal_ts" 2>/dev/null || echo 0)
+now_heal=$(date +%s)
+if [ $((now_heal - HEAL_TS)) -ge 300 ]; then
+    echo "$now_heal" > "$STATE/heal_ts"
+    heal_lan_routing
+fi
+
+# ── Peer hygiene: keep exactly ONE WG peer = current server's key ──
+# Failovers can leave dead/duplicate peers; multiple 0.0.0.0/0 peers cause
+# ambiguous egress routing. Self-heal here every run (cheap when already clean).
+eval "cur_wgkey=\$SERVER_${CURRENT_SERVER}_WGKEY"
+if [ -n "$cur_wgkey" ]; then
+    peer_n=$(count_server_peers)
+    if [ "$peer_n" -gt 1 ]; then
+        log "HYGIENE: $peer_n server peers present, purging to server${CURRENT_SERVER}"
+        switch_wg_peer "$cur_wgkey"
+    fi
+fi
+
+# ══════════════════════════════════════════════
+#  Main logic
+#  Tunnel health = WireGuard handshake age (authoritative: a fresh
+#  handshake only happens through the full obfuscator→server→WG path).
+#  WAN ping is logged for context ONLY — it does NOT gate decisions,
+#  because the router's default route is not the tunnel, so WAN can be
+#  up while the tunnel is dead (and a WAN blip must not cause failover).
+# ══════════════════════════════════════════════
+AGE=$(get_handshake_age)
+WAN=$(check_connectivity && echo "yes" || echo "no")
+
+# Tunnel healthy = fresh handshake
 if [ "$AGE" -lt "$HANDSHAKE_WARN" ]; then
-    # All good, reset counters
-    if [ "$RESTART_COUNT" -gt 0 ]; then
-        log "OK: connection restored (age=${AGE}s)"
-        echo "0" > "$STATE/restart_count"
+    if [ "$FAIL_COUNT" -gt 0 ]; then
+        log "OK: tunnel up (handshake=${AGE}s, server=$CURRENT_SERVER, wan=$WAN)"
+        echo "0" > "$STATE/fail_count"
    fi
    check_primary
    exit 0
 fi

-log "STALE handshake: ${AGE}s (server=$CURRENT_SERVER port_idx=$CURRENT_PORT_IDX restarts=$RESTART_COUNT)"
+# Stale handshake = tunnel down → escalate.
+# fail_count is MONOTONIC: it climbs across stages and is only reset by the
+# OK branch (real recovery) or after a successful failover to a NEW server
+# (so the new server gets a fresh restart→port-hop→failover cycle).
+FAIL_COUNT=$((FAIL_COUNT + 1))
+echo "$FAIL_COUNT" > "$STATE/fail_count"
+log "STALE: handshake=${AGE}s wan=${WAN} server=$CURRENT_SERVER port=$CURRENT_PORT_IDX fails=$FAIL_COUNT"

-if [ "$AGE" -lt "$HANDSHAKE_RESTART_OBF" ]; then
-    # Restart obfuscator only
-    RESTART_COUNT=$((RESTART_COUNT + 1))
-    echo "$RESTART_COUNT" > "$STATE/restart_count"
-    log "ACTION: restart obfuscator (attempt $RESTART_COUNT)"
-    killall wg-obfuscator 2>/dev/null
-    sleep 1
-    wg-obfuscator --config "$OBF_CONF" &
-    exit 0
-fi
-
-if [ "$AGE" -lt "$HANDSHAKE_RESTART_WG" ]; then
-    # Restart WireGuard + obfuscator
-    RESTART_COUNT=$((RESTART_COUNT + 1))
-    echo "$RESTART_COUNT" > "$STATE/restart_count"
-    log "ACTION: restart WG + obfuscator (attempt $RESTART_COUNT)"
-    wg-quick down wg0 2>/dev/null
-    killall wg-obfuscator 2>/dev/null
-    sleep 2
-    wg-quick up wg0 2>/dev/null
-    sleep 1
-    wg-obfuscator --config "$OBF_CONF" &
-    exit 0
-fi
-
-if [ "$AGE" -lt "$HANDSHAKE_FAILOVER" ]; then
-    # Try next port
-    log "ACTION: try port hop"
-    if ! try_next_port; then
-        log "ACTION: all ports exhausted, try next server"
-        try_next_server
+# Stage 1 (fail 1): Restart obfuscator
+if [ "$FAIL_COUNT" -eq 1 ]; then
+    log "ACTION: restart obfuscator"
+    if [ -f /opt/etc/init.d/S49wg-obfuscator ]; then
+        /opt/etc/init.d/S49wg-obfuscator restart >/dev/null 2>&1
+    else
+        killall wg-obfuscator 2>/dev/null
+        sleep 1
+        wg-obfuscator --config "$OBF_CONF" &
    fi
    exit 0
 fi

-# Full failover
-log "ACTION: failover (handshake ${AGE}s)"
-if ! try_next_server; then
-    # Only one server, cycle ports
-    try_next_port
+# Stage 2 (fail 2): Port hop to an alternate port on the SAME server
+if [ "$FAIL_COUNT" -eq 2 ]; then
+    if try_next_port; then
+        exit 0
+    fi
+    # only one port → fall through to server failover
+    log "single port, escalate to failover"
+fi
+
+# Stage 3 (fail 3+): Server failover. Reset fail_count so the new server
+# gets its own restart→port-hop→failover cycle next ticks.
+log "ACTION: server failover (fail $FAIL_COUNT)"
+if try_next_server; then
+    echo "0" > "$STATE/fail_count"
+else
+    # Only one server — cycle back to port 0 and restart escalation
+    echo "0" > "$STATE/fail_count"
+    switch_endpoint "$CURRENT_SERVER" "0"
 fi
--- a/docs/cloud.md
+++ b/docs/cloud.md
@@ -0,0 +1,139 @@
+# Канал «Облако» — VPN через облако своего Keenetic (PCA Phobos 1.4.4)
+
+![Схема канала «Облако»](img/cloud/skhema.png)
+
+## Что это и зачем
+Обычно телефон ходит к серверу Phobos напрямую по UDP (или по резервному TCP). Если оператор или сеть
+режет сам сервер, а сайты Keenetic открываются, можно пойти **через свой домашний Keenetic**:
+
+1. телефон открывает защищённый WebSocket `wss://phobos.<имя>.<домен>/` — для оператора это обычный HTTPS к облаку Keenetic;
+2. облако KeenDNS (серверы Keenetic в РФ) по имени пересылает соединение в ваш роутер — белый IP роутеру не нужен;
+3. на роутере шлюз **wsgw** разворачивает WebSocket обратно в UDP и шлёт на обфускатор сервера Phobos;
+4. дальше всё как обычно: WireGuard → интернет с IP сервера.
+
+Это **дополнение** к UDP/TCP, не замена. Шифрование то же (WireGuard), облако Keenetic видит только зашифрованный поток.
+
+**Адрес вида `wss://phobos.vasya.keenetic.pro/`** = `wss://` (WebSocket через HTTPS, порт 443) +
+`phobos` (поддомен веб-приложения на роутере) + `vasya.keenetic.pro` (KeenDNS-имя роутера).
+
+Скорость в нашем тесте (Keenetic → сервер в Польше): ↓11 / ↑15 Мбит/с, задержка ~80 мс, потерь 0 %.
+
+---
+
+## Часть 1. Роутер Keenetic (один раз)
+
+**Что нужно:** Keenetic с KeenDNS-именем (Интернет → Доменное имя), установленный Entware (OPKG) и SSH.
+Команды ниже — в SSH роутера (`ssh root@192.168.1.1 -p 222` или как у вас настроено).
+
+### Шаг 1. Веб-интерфейс на порт 80
+Роутер выпускает сертификат Let's Encrypt для поддомена, только если его веб-интерфейс на порту 80.
+```sh
+ndmc -c 'ip http port 80'
+```
+Если раньше был другой порт (81, 8080…) — поправьте закладки и скрипты, которые туда ходили.
+Снаружи порт 80 пробрасывать не нужно.
+
+### Шаг 2. Шлюз wsgw
+Узнать архитектуру:
+```sh
+uname -m        # aarch64 → wsgw-aarch64;  mips → wsgw-mipsel (или wsgw-mips, если не запустится)
+```
+Скачать прямо на роутер (замените `aarch64` на свою архитектуру):
+```sh
+curl -fsSL -o /opt/sbin/wsgw https://git.bobyrev.com/PCA/PCA_Phobos/raw/branch/main/wsgw/bin/wsgw-aarch64
+curl -fsSL -o /opt/etc/init.d/S80wsgw https://git.bobyrev.com/PCA/PCA_Phobos/raw/branch/main/wsgw/router/S80wsgw
+chmod +x /opt/sbin/wsgw /opt/etc/init.d/S80wsgw
+```
+Настройка — файл `/opt/etc/wsgw.conf`:
+```sh
+cat > /opt/etc/wsgw.conf <<'EOF'
+WSGW_LISTEN=192.168.1.1:18090
+WSGW_TARGET=147.45.126.83:2083
+EOF
+/opt/etc/init.d/S80wsgw start
+```
+- `WSGW_LISTEN` — LAN-адрес **вашего** роутера (Главная → Домашняя сеть) и порт 18090.
+- `WSGW_TARGET` — адрес обфускатора сервера: строка `target = …` из ссылки клиента
+  (в панели клиента → 📱 → «показать конфиг»). Для сервера Польша — `147.45.126.83:2083`.
+
+Проверка: `netstat -ltn | grep 18090` — должна быть строка LISTEN.
+
+### Шаг 3. Поддомен и облачный режим KeenDNS
+Подставьте своё имя: для `vasya.keenetic.pro` — `<имя>` = `vasya`, `<домен>` = `keenetic.pro`.
+```sh
+ndmc -c 'ip http proxy phobos'
+ndmc -c 'ip http proxy phobos upstream http 192.168.1.1 18090'
+ndmc -c 'ip http proxy phobos domain ndns'
+ndmc -c 'ip http proxy phobos security-level public'
+ndmc -c 'ndns book-name <имя> <домен> cloud'
+ndmc -c 'ip http ssl acme get phobos.<имя>.<домен>'
+ndmc -c 'system configuration save'
+```
+То же в веб-интерфейсе: **Сетевые правила → Переадресация → Веб-приложения** (или «Доменное имя → Веб-приложения»):
+имя `phobos`, адрес `192.168.1.1`, порт `18090`, доступ **без авторизации**; режим доменного имени — **через облако**.
+
+Сертификат выпускается за 10–60 секунд. Проверить:
+```sh
+ndmc -c 'ip http ssl acme list' | grep domain      # в списке должен быть phobos.<имя>.<домен>
+```
+Если его нет, а `ndmc -c 'show acme' | grep get-pending` показывает `yes` — **перезагрузите роутер** и повторите `acme get`.
+
+### Шаг 4. Проверка с любого компьютера
+```bash
+curl -s -o /dev/null -w '%{http_code}\n' https://phobos.<имя>.<домен>/
+```
+`426` — всё работает (шлюз ответил «нужен WebSocket»). Ошибка TLS (`internal error`) — см. «Если не работает».
+
+---
+
+## Часть 2. Телефон
+
+### Android (PCA Phobos VPN 1.4.4+)
+1. Импортируйте ссылку `phobos://` как обычно.
+2. «Канал до сервера» → **Облако**.
+3. В окне «Адрес роутера (KeenDNS)» введите `wss://phobos.<имя>.<домен>/` → **Сохранить**.
+4. **Подключить**. Статус: «🟢 VPN включён · Облако».
+
+![Главный экран, канал «Облако»](img/cloud/android-1-glavnyj.png)
+![Окно адреса роутера](img/cloud/android-2-adres.png)
+
+### iPhone (PCA Phobos, TestFlight 1.0 (6) и новее)
+1. Импортируйте ссылку `phobos://`.
+2. «Канал до сервера» → сегмент **Облако**.
+3. В появившемся поле — `wss://phobos.<имя>.<домен>/`.
+4. **Подключить** → «VPN включён · Облако».
+
+### Проверка
+Откройте speed.cloudflare.com: «Your IP address» должен быть IP сервера Phobos (Польша — 147.45.126.83).
+
+![Speedtest через канал «Облако»](img/cloud/android-3-skorost.png)
+
+Адрес можно не вводить руками: если в ссылке клиента есть строка `# pca-ws = wss://…`, приложение возьмёт её само
+(пока строку добавляет только администратор вручную).
+
+---
+
+## Если не работает
+
+| Что видно | Причина | Что делать |
+|---|---|---|
+| `acme`: «available only when HTTP port is set to 80» | веб-интерфейс не на 80 | Шаг 1 |
+| сертификата нет, `get-pending: yes` | задание ACME зависло | перезагрузить роутер, повторить `acme get` |
+| curl: TLS `internal error` | у роутера нет сертификата **или** WAN:443 проброшен на другой компьютер (облако шлёт поддомены на WAN:443) | проверить `acme list`; убрать проброс 443 или настроить на том компьютере прокси поддомена на `роутер:18090` (например, Caddy: `phobos.<имя>.<домен> { reverse_proxy 192.168.1.1:18090 }`) |
+| curl: `403` | поддомен не `public` / облачный режим выключен | `security-level public`, `ndns … cloud` |
+| curl: `502` | шлюз не запущен | `/opt/etc/init.d/S80wsgw start`, проверить `wsgw.conf` |
+| VPN «включён · Облако», но сайты не открываются | неверный `WSGW_TARGET` или профиль от другого сервера | `target` в ссылке клиента = `WSGW_TARGET` |
+
+Журнал приложения (Android → «Журнал»): строки `ws: connected …` / `ws up: …` / `ws down: …`.
+
+## Как выключить
+```sh
+/opt/etc/init.d/S80wsgw stop
+ndmc -c 'no ip http proxy phobos'
+ndmc -c 'ndns book-name <имя> <домен> direct'
+ndmc -c 'system configuration save'
+```
+
+## Для разработчика
+Код: `wsgw/` (шлюз, Go), `android-client/src/com/pca/phobos/vpn/WsRelay.java`,
+`ios/Tunnel/WsLink.swift` + режим 2 в `pcarelay.c`. Протокол: одно бинарное WS-сообщение = один обфусцированный UDP-пакет.
--- a/docs/img/cloud/android-1-glavnyj.png
+++ b/docs/img/cloud/android-1-glavnyj.png
--- a/docs/img/cloud/android-2-adres.png
+++ b/docs/img/cloud/android-2-adres.png
--- a/docs/img/cloud/android-3-skorost.png
+++ b/docs/img/cloud/android-3-skorost.png
--- a/docs/img/cloud/skhema.png
+++ b/docs/img/cloud/skhema.png
--- a/docs/img/cloud/skhema.svg
+++ b/docs/img/cloud/skhema.svg
@@ -0,0 +1,37 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="430" viewBox="0 0 1200 430" font-family="Helvetica, Arial, sans-serif">
+<rect width="1200" height="430" fill="#ffffff"/>
+<text x="600" y="38" text-anchor="middle" font-size="24" font-weight="bold" fill="#0f172a">Канал «Облако»: телефон → облако KeenDNS → свой Keenetic → сервер Phobos</text>
+<defs><marker id="a" markerWidth="10" markerHeight="10" refX="9" refY="5" orient="auto"><path d="M0,0 L10,5 L0,10 z" fill="#475569"/></marker></defs>
+<g font-size="17">
+<rect x="20" y="90" width="200" height="130" rx="14" fill="#eef2ff" stroke="#4f46e5" stroke-width="2"/>
+<text x="120" y="125" text-anchor="middle" font-weight="bold" fill="#1e1b4b">Телефон</text>
+<text x="120" y="152" text-anchor="middle" fill="#334155">PCA Phobos VPN</text>
+<text x="120" y="176" text-anchor="middle" fill="#334155">канал «Облако»</text>
+<text x="120" y="200" text-anchor="middle" fill="#334155">WireGuard+обфускатор</text>
+<rect x="320" y="90" width="210" height="130" rx="14" fill="#f0f9ff" stroke="#0ea5e9" stroke-width="2"/>
+<text x="425" y="125" text-anchor="middle" font-weight="bold" fill="#0c4a6e">Облако KeenDNS</text>
+<text x="425" y="152" text-anchor="middle" fill="#334155">серверы Keenetic в РФ</text>
+<text x="425" y="176" text-anchor="middle" fill="#334155">пересылает HTTPS</text>
+<text x="425" y="200" text-anchor="middle" fill="#334155">по имени (SNI)</text>
+<rect x="630" y="90" width="250" height="130" rx="14" fill="#f0fdf4" stroke="#16a34a" stroke-width="2"/>
+<text x="755" y="125" text-anchor="middle" font-weight="bold" fill="#14532d">Ваш Keenetic</text>
+<text x="755" y="152" text-anchor="middle" fill="#334155">поддомен phobos.* (TLS)</text>
+<text x="755" y="176" text-anchor="middle" fill="#334155">→ шлюз wsgw :18090</text>
+<text x="755" y="200" text-anchor="middle" fill="#334155">WebSocket → UDP</text>
+<rect x="980" y="90" width="200" height="130" rx="14" fill="#fff7ed" stroke="#ea580c" stroke-width="2"/>
+<text x="1080" y="125" text-anchor="middle" font-weight="bold" fill="#7c2d12">Сервер Phobos</text>
+<text x="1080" y="152" text-anchor="middle" fill="#334155">обфускатор UDP</text>
+<text x="1080" y="176" text-anchor="middle" fill="#334155">→ WireGuard</text>
+<text x="1080" y="200" text-anchor="middle" fill="#334155">→ интернет</text>
+</g>
+<g stroke="#475569" stroke-width="3" marker-end="url(#a)"><line x1="222" y1="155" x2="316" y2="155"/><line x1="532" y1="155" x2="626" y2="155"/><line x1="882" y1="155" x2="976" y2="155"/></g>
+<g font-size="15" fill="#475569" text-anchor="middle">
+<text x="270" y="140">wss:// 443</text><text x="580" y="140">туннель</text><text x="580" y="178">Keenetic</text><text x="930" y="140">UDP</text></g>
+<rect x="20" y="260" width="1160" height="150" rx="14" fill="#f8fafc" stroke="#cbd5e1"/>
+<g font-size="17" fill="#0f172a">
+<text x="44" y="295" font-weight="bold">Когда нужно</text>
+<text x="44" y="322">• у оператора/в сети заблокирован сервер Phobos (UDP и TCP), а сайты Keenetic открываются;</text>
+<text x="44" y="348">• у роутера нет белого IP — облако KeenDNS достаёт его всё равно.</text>
+<text x="44" y="380" font-weight="bold">Проверено 31.10.2026: </text><text x="250" y="380">планшет → облако → домашний Keenetic → Польша, ↓11 / ↑15 Мбит/с, потерь 0 %.</text>
+</g>
+</svg>
--- a/install.sh
+++ b/install.sh
@@ -29,7 +29,34 @@ PANEL_SCHEME="${PANEL_SCHEME:-http}"
 TG_TOKEN="${TG_TOKEN:-}"
 TG_CHAT="${TG_CHAT:-}"
 OBF_PORTS="${OBF_PORTS:-2083,5443,993}"
+# Уже есть wg0.conf (переустановка) — подсеть берём из него, иначе server.env разойдётся с интерфейсом
+if [ -z "${SERVER_WG_IPV4_NETWORK:-}" ] && [ -f /etc/wireguard/wg0.conf ]; then
+    SERVER_WG_IPV4_NETWORK="$(python3 - <<'PY' 2>/dev/null
+import ipaddress, re
+for ln in open("/etc/wireguard/wg0.conf"):
+    m = re.match(r"\s*Address\s*=\s*([^,\s]+)", ln)
+    if m:
+        print(ipaddress.ip_interface(m.group(1)).network); break
+PY
+)" || SERVER_WG_IPV4_NETWORK=""
+fi
+# Подсеть клиентов: env SERVER_WG_IPV4_NETWORK или вопрос в терминале (Enter = 10.25.0.0/16)
+if [ -z "${SERVER_WG_IPV4_NETWORK:-}" ] && [ -r /dev/tty ] && [ -t 1 ]; then
+    printf 'Подсеть VPN-клиентов [10.25.0.0/16]: ' > /dev/tty
+    read -r -t 60 SERVER_WG_IPV4_NETWORK < /dev/tty || true
+fi
 SERVER_WG_IPV4_NETWORK="${SERVER_WG_IPV4_NETWORK:-10.25.0.0/16}"
+SERVER_WG_IPV4_NETWORK="$(python3 - "$SERVER_WG_IPV4_NETWORK" <<'PY'
+import ipaddress, sys
+try:
+    net = ipaddress.ip_network(sys.argv[1].strip(), strict=False)
+except ValueError:
+    sys.exit("ERROR: bad subnet " + sys.argv[1])
+if net.version != 4 or not net.is_private or net.prefixlen > 29:
+    sys.exit("ERROR: subnet must be private IPv4, /8../29 (e.g. 10.25.1.0/24)")
+print(net)
+PY
+)" || exit 1
 # Источник: Gitea git.bobyrev.com (основной), GitHub — запасной.
 # Каналы stable/beta/dev — ветки main/beta/dev одного публичного репозитория.
 PCA_GIT="${PCA_GIT:-https://git.bobyrev.com/PCA/PCA_Phobos}"
--- a/ios/App/ContentView.swift
+++ b/ios/App/ContentView.swift
@@ -11,6 +11,7 @@ struct ContentView: View {
            ScrollView {
                VStack(spacing: 18) {
                    profileCard
+                    if vpn.servers.count > 1 { serversCard }
                    powerButton
                    statusLine
                    optionsCard
@@ -57,6 +58,30 @@ struct ContentView: View {
        .padding().background(.thinMaterial, in: RoundedRectangle(cornerRadius: 16))
    }

+    private var serversCard: some View {
+        VStack(alignment: .leading, spacing: 0) {
+            Text("Серверы").font(.subheadline.bold()).padding(.bottom, 6)
+            ForEach(vpn.servers, id: \.self) { s in
+                let n = s["name"] ?? ""
+                HStack {
+                    Image(systemName: n == vpn.name ? "checkmark.circle.fill" : "circle")
+                        .foregroundStyle(n == vpn.name ? .green : .secondary)
+                    Text(n)
+                    Spacer()
+                    if n != vpn.name {
+                        Button(role: .destructive) { vpn.remove(n) } label: { Image(systemName: "trash") }
+                            .buttonStyle(.borderless)
+                    }
+                }
+                .padding(.vertical, 8)
+                .contentShape(Rectangle())
+                .onTapGesture { vpn.select(n) }
+            }
+        }
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .padding().background(.thinMaterial, in: RoundedRectangle(cornerRadius: 16))
+    }
+
    private var powerButton: some View {
        Button(action: vpn.toggle) {
            Text(vpn.isOn ? "Отключить" : "Подключить")
@@ -85,9 +110,16 @@ struct ContentView: View {
            VStack(alignment: .leading, spacing: 6) {
                Text("Канал до сервера").font(.subheadline.bold())
                Picker("Канал", selection: $vpn.transportMode) {
-                    Text("Авто").tag("auto"); Text("UDP").tag("udp"); Text("TCP").tag("tcp")
+                    Text("Авто").tag("auto"); Text("UDP").tag("udp"); Text("TCP").tag("tcp"); Text("Облако").tag("cloud")
                }
                .pickerStyle(.segmented)
+                if vpn.transportMode == "cloud" {
+                    TextField("wss://phobos.имя.keenetic.pro/", text: $vpn.wsURL)
+                        .textInputAutocapitalization(.never).autocorrectionDisabled().keyboardType(.URL)
+                        .textFieldStyle(.roundedBorder).onSubmit { vpn.wsURL = vpn.wsURL.trimmingCharacters(in: .whitespaces) }
+                    Text("Облако: телефон → облако KeenDNS → ваш Keenetic → сервер. Работает, когда до сервера напрямую не достучаться.")
+                        .font(.caption).foregroundStyle(.secondary)
+                }
                Text("Авто: если UDP режут, через 15 секунд переходит на TCP. Изменения применяются сразу.")
                    .font(.caption).foregroundStyle(.secondary)
            }
--- a/ios/App/Info.plist
+++ b/ios/App/Info.plist
@@ -17,7 +17,7 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>1.0</string>
+	<string>$(MARKETING_VERSION)</string>
 	<key>CFBundleURLTypes</key>
 	<array>
 		<dict>
@@ -30,9 +30,13 @@
 		</dict>
 	</array>
 	<key>CFBundleVersion</key>
-	<string>1</string>
+	<string>$(CURRENT_PROJECT_VERSION)</string>
+	<key>ITSAppUsesNonExemptEncryption</key>
+	<false/>
 	<key>UILaunchScreen</key>
 	<dict/>
+	<key>UIRequiresFullScreen</key>
+	<true/>
 	<key>UISupportedInterfaceOrientations</key>
 	<array>
 		<string>UIInterfaceOrientationPortrait</string>
--- a/ios/App/PCAPhobosApp.swift
+++ b/ios/App/PCAPhobosApp.swift
@@ -21,6 +21,10 @@ final class VPNController: ObservableObject {
    @Published var conf = UserDefaults.standard.string(forKey: "conf") ?? ""
    @Published var ruDirect = UserDefaults.standard.object(forKey: "ruDirect") as? Bool ?? true { didSet { saveOptions() } }
    @Published var transportMode = UserDefaults.standard.string(forKey: "transport") ?? "auto" { didSet { saveOptions() } }
+    /// Channel «Облако»: wss:// of the user's Keenetic (empty -> "# pca-ws" from the link).
+    @Published var wsURL = UserDefaults.standard.string(forKey: "wsURL") ?? "" { didSet { saveOptions() } }
+    /// Imported servers: [["name": …, "conf": …]]; name/conf above mirror the selected one.
+    @Published var servers = UserDefaults.standard.array(forKey: "servers") as? [[String: String]] ?? []
    @Published var status: NEVPNStatus = .invalid
    @Published var transport = ""
    @Published var message = ""
@@ -29,6 +33,7 @@ final class VPNController: ObservableObject {
    private var timer: Timer?

    init() {
+        if servers.isEmpty && !conf.isEmpty { servers = [["name": name, "conf": conf]] }   // pre-list single profile
        Task { await load() }
        NotificationCenter.default.addObserver(forName: .NEVPNStatusDidChange, object: nil, queue: .main) { [weak self] _ in
            Task { @MainActor in self?.status = self?.manager?.connection.status ?? .invalid }
@@ -49,17 +54,40 @@ final class VPNController: ObservableObject {

    func importLink(_ link: String) {
        guard let parsed = PhobosProfile.fromLink(link) else { message = "Это не ссылка phobos:// из панели"; return }
-        conf = parsed.profile.raw
-        name = parsed.name
+        servers.removeAll { $0["name"] == parsed.name }   // same name = updated link
+        servers.append(["name": parsed.name, "conf": parsed.profile.raw])
+        select(parsed.name)
+        message = "Профиль «\(name)» импортирован"
+    }
+
+    func select(_ server: String) {
+        guard let s = servers.first(where: { $0["name"] == server }) else { return }
+        name = server
+        conf = s["conf"] ?? ""
+        persist()
+        Task { await save(reconnect: isOn) }
+    }
+
+    func remove(_ server: String) {
+        servers.removeAll { $0["name"] == server }
+        if server == name {
+            if let next = servers.first?["name"] { select(next); return }
+            if isOn { manager?.connection.stopVPNTunnel() }
+            name = ""; conf = ""
+        }
+        persist()
+    }
+
+    private func persist() {
+        UserDefaults.standard.set(servers, forKey: "servers")
        UserDefaults.standard.set(conf, forKey: "conf")
        UserDefaults.standard.set(name, forKey: "name")
-        message = "Профиль «\(name)» импортирован"
-        Task { await save(reconnect: isOn) }
    }

    private func saveOptions() {
        UserDefaults.standard.set(ruDirect, forKey: "ruDirect")
        UserDefaults.standard.set(transportMode, forKey: "transport")
+        UserDefaults.standard.set(wsURL, forKey: "wsURL")
        Task { await save(reconnect: isOn) }
    }

@@ -70,7 +98,7 @@ final class VPNController: ObservableObject {
        let proto = NETunnelProviderProtocol()
        proto.providerBundleIdentifier = "com.bobyrev.pcaphobos.tunnel"
        proto.serverAddress = profile.targetHost ?? "Phobos"
-        proto.providerConfiguration = ["conf": conf, "ruDirect": ruDirect, "transport": transportMode]
+        proto.providerConfiguration = ["conf": conf, "ruDirect": ruDirect, "transport": transportMode, "wsURL": wsURL]
        m.protocolConfiguration = proto
        m.localizedDescription = "PCA Phobos"
        m.isEnabled = true
--- a/ios/PCAPhobos.xcodeproj/project.pbxproj
+++ b/ios/PCAPhobos.xcodeproj/project.pbxproj
@@ -14,6 +14,7 @@
 		38870650A7C2B1F0927A1230 /* wg-obfuscator.c in Sources */ = {isa = PBXBuildFile; fileRef = 1FADBB2A65AF77D4ECCAFE78 /* wg-obfuscator.c */; settings = {COMPILER_FLAGS = "-Dmain=wgobf_main -w"; }; };
 		4E4255B9E0F8626F6E209B0F /* String+ArrayConversion.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7500F0B31797D49B5BBEC5CC /* String+ArrayConversion.swift */; };
 		56F35C68C6A387E499703CFF /* masking.c in Sources */ = {isa = PBXBuildFile; fileRef = CCE5C98CD905BDE16A8D83D4 /* masking.c */; settings = {COMPILER_FLAGS = "-Dmain=wgobf_main -w"; }; };
+		599057D9048B5FF1EA0E6000 /* WsLink.swift in Sources */ = {isa = PBXBuildFile; fileRef = EC83AB79BE0E361F4EE90875 /* WsLink.swift */; };
 		5F5D376513C0B27C45A3E7B6 /* ru_bypass.txt in Resources */ = {isa = PBXBuildFile; fileRef = 2572D9A6F822B038D0652619 /* ru_bypass.txt */; };
 		78B74F81E0042D9AD94B7A6B /* config.c in Sources */ = {isa = PBXBuildFile; fileRef = 0E5C1673464AAC3EF81DD2FE /* config.c */; settings = {COMPILER_FLAGS = "-Dmain=wgobf_main -w"; }; };
 		7D8AB66421409CBFCCF2769A /* PhobosProfile.swift in Sources */ = {isa = PBXBuildFile; fileRef = 98DC1765DEC5F326E2B5F9C4 /* PhobosProfile.swift */; };
@@ -70,6 +71,7 @@
 		B3E470E13EF603CB26991683 /* PCAPhobosApp.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PCAPhobosApp.swift; sourceTree = "<group>"; };
 		CA6480536DA633DB94B6930F /* WireGuardKit */ = {isa = PBXFileReference; lastKnownFileType = folder; name = WireGuardKit; path = WireGuardKit; sourceTree = SOURCE_ROOT; };
 		CCE5C98CD905BDE16A8D83D4 /* masking.c */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.c; path = masking.c; sourceTree = "<group>"; };
+		EC83AB79BE0E361F4EE90875 /* WsLink.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WsLink.swift; sourceTree = "<group>"; };
 		EF9115CA0D5EC52C8679A12A /* obfuscation.c */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.c; path = obfuscation.c; sourceTree = "<group>"; };
 		FF14952A4263FF0E004A3F04 /* ContentView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ContentView.swift; sourceTree = "<group>"; };
 /* End PBXFileReference section */
@@ -103,6 +105,7 @@
 				2572D9A6F822B038D0652619 /* ru_bypass.txt */,
 				7500F0B31797D49B5BBEC5CC /* String+ArrayConversion.swift */,
 				2C1AA6DED9B45949864A9B7D /* TunnelConfiguration+WgQuickConfig.swift */,
+				EC83AB79BE0E361F4EE90875 /* WsLink.swift */,
 			);
 			path = Tunnel;
 			sourceTree = "<group>";
@@ -214,11 +217,11 @@
 				LastUpgradeCheck = 1430;
 				TargetAttributes = {
 					0FD066BC2C51A1E092914FE8 = {
-						DevelopmentTeam = "";
+						DevelopmentTeam = Q5FKU39TUA;
 						ProvisioningStyle = Automatic;
 					};
 					E1F7E69029753CF102C6CE2E = {
-						DevelopmentTeam = "";
+						DevelopmentTeam = Q5FKU39TUA;
 						ProvisioningStyle = Automatic;
 					};
 				};
@@ -274,6 +277,7 @@
 				7D8AB66421409CBFCCF2769A /* PhobosProfile.swift in Sources */,
 				4E4255B9E0F8626F6E209B0F /* String+ArrayConversion.swift in Sources */,
 				11F2A6A8D281AB36B45D4603 /* TunnelConfiguration+WgQuickConfig.swift in Sources */,
+				599057D9048B5FF1EA0E6000 /* WsLink.swift in Sources */,
 				78B74F81E0042D9AD94B7A6B /* config.c in Sources */,
 				1C05D29ACA95548374AD6FD9 /* logging.c in Sources */,
 				56F35C68C6A387E499703CFF /* masking.c in Sources */,
@@ -385,9 +389,9 @@
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				CODE_SIGN_STYLE = Automatic;
 				COPY_PHASE_STRIP = NO;
-				CURRENT_PROJECT_VERSION = 141;
+				CURRENT_PROJECT_VERSION = 6;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
-				DEVELOPMENT_TEAM = "";
+				DEVELOPMENT_TEAM = Q5FKU39TUA;
 				ENABLE_NS_ASSERTIONS = NO;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu11;
@@ -399,7 +403,7 @@
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				IPHONEOS_DEPLOYMENT_TARGET = 16.0;
-				MARKETING_VERSION = 1.4.1;
+				MARKETING_VERSION = 1.0;
 				MTL_ENABLE_DEBUG_INFO = NO;
 				MTL_FAST_MATH = YES;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -445,9 +449,9 @@
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				CODE_SIGN_STYLE = Automatic;
 				COPY_PHASE_STRIP = NO;
-				CURRENT_PROJECT_VERSION = 141;
+				CURRENT_PROJECT_VERSION = 6;
 				DEBUG_INFORMATION_FORMAT = dwarf;
-				DEVELOPMENT_TEAM = "";
+				DEVELOPMENT_TEAM = Q5FKU39TUA;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu11;
@@ -465,7 +469,7 @@
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				IPHONEOS_DEPLOYMENT_TARGET = 16.0;
-				MARKETING_VERSION = 1.4.1;
+				MARKETING_VERSION = 1.0;
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
 				ONLY_ACTIVE_ARCH = YES;
--- a/ios/README.md
+++ b/ios/README.md
@@ -1,17 +1,18 @@
 # PCA Phobos VPN — iPhone

 То же, что Android-клиент: импорт `phobos://` из панели, обфускация (wg-obfuscator внутри
-расширения), **российские сайты напрямую**, канал **Авто/UDP/TCP** (при блокировке UDP — сам на TCP).
+расширения), **российские сайты напрямую**, канал **Авто/UDP/TCP/Облако** (при блокировке UDP — сам на TCP; «Облако» — через KeenDNS своего Keenetic, см. `../wsgw/README.md`).
 Выбор отдельных приложений на iOS невозможен (Apple даёт это только через MDM) — делим по адресам.

 Устройство:
 - `App/` — SwiftUI-приложение (профиль, кнопка, настройки), `Shared/PhobosProfile.swift` — разбор ссылки.
 - `Tunnel/` — Packet Tunnel: WireGuardKit → 127.0.0.1:13255 wg-obfuscator (`-Dmain=wgobf_main`, один
-  экземпляр: iOS запрещает fork) → 127.0.0.1:13258 `pcarelay.c` → сервер по UDP или TCP (формат udptcp).
+  экземпляр: iOS запрещает fork) → 127.0.0.1:13258 `pcarelay.c` → сервер по UDP или TCP (формат udptcp),
+  либо «Облако»: пакеты из pcarelay в `WsLink.swift` (URLSessionWebSocketTask) → wss://поддомен роутера → wsgw → сервер.
 - `WireGuardKit/` — wireguard-apple (MIT), `WireGuardGo/<sdk>/libwg-go.a` — собран `make` (iphoneos) и
  `go build -buildmode c-archive` с `-target arm64-apple-ios15.0-simulator` (симулятор).

-Сборка: `xcodegen generate` → `PCAPhobos.xcodeproj`. Проверка без телефона: `Tests/ProfileCheck`.
+Сборка: `xcodegen generate` → `PCAPhobos.xcodeproj`. Проверка без телефона: `Tests/ProfileCheck`, режим «Облако» релея — `Tests/RelayCheck/main.c`.

 ## Установка на iPhone (нужен ПЛАТНЫЙ Apple Developer, $99/год)
 Network Extension (packet-tunnel-provider) Apple выдаёт только платным аккаунтам — с бесплатным
--- a/ios/Shared/PhobosProfile.swift
+++ b/ios/Shared/PhobosProfile.swift
@@ -60,6 +60,17 @@ struct PhobosProfile {
        return nil
    }

+    /// "# pca-ws = wss://…" — the user's Keenetic (KeenDNS cloud subdomain -> wsgw), channel «Облако».
+    var wsURL: String? {
+        for rawLine in raw.split(separator: "\n") {
+            let line = rawLine.trimmingCharacters(in: .whitespaces)
+            if line.hasPrefix("#"), line.contains("pca-ws"), let eq = line.firstIndex(of: "=") {
+                return line[line.index(after: eq)...].trimmingCharacters(in: .whitespaces)
+            }
+        }
+        return nil
+    }
+
    func obfuscatorConfig(listen: Int, target: String) -> String {
        var out = "[instance]\nsource-if = 127.0.0.1\nsource-lport = \(listen)\ntarget = \(target)\n"
        for item in lines("[instance]") where !["source-if", "source-lport", "target", "verbose"].contains(item.key) {
@@ -70,7 +81,13 @@ struct PhobosProfile {

    func wireGuardConfig(endpoint: String, allowedIPs: String?) -> String {
        var out = "[Interface]\n"
-        for item in lines("[Interface]") where !item.key.hasSuffix("applications") { out += item.line + "\n" }
+        for item in lines("[Interface]") where !item.key.hasSuffix("applications") && item.key != "mtu" { out += item.line + "\n" }
+        // ponytail: obfuscator masking adds bytes; the panel's default 1420 stalls on mobile networks,
+        // so 1420/missing -> 1280, any other MTU in the link wins (set per client in the panel)
+        let linkMTU = lines("[Interface]").first { $0.key == "mtu" }
+            .flatMap { Int($0.line.split(separator: "=").last?.trimmingCharacters(in: .whitespaces) ?? "") }
+        let mtu = (linkMTU == nil || linkMTU == 1420) ? 1280 : linkMTU!
+        out += "MTU = \(mtu)\n"
        out += "\n[Peer]\n"
        for item in lines("[Peer]") {
            switch item.key {
--- a/ios/Tests/ProfileCheck/main.swift
+++ b/ios/Tests/ProfileCheck/main.swift
@@ -35,4 +35,7 @@ let obf = p.obfuscatorConfig(listen: 13255, target: "127.0.0.1:13258")
 precondition(obf.contains("target = 127.0.0.1:13258") && obf.contains("key = testkey") && !obf.contains("203.0.113.10"))
 let wg = p.wireGuardConfig(endpoint: "127.0.0.1:13255", allowedIPs: "1.0.0.0/8")
 precondition(wg.contains("Endpoint = 127.0.0.1:13255") && wg.contains("AllowedIPs = 1.0.0.0/8") && !wg.contains("= none"))
+precondition(wg.contains("MTU = 1280") && !wg.contains("1420"))  // panel default -> 1280
+let custom = PhobosProfile.fromLink("phobos://" + Data(conf.replacingOccurrences(of: "MTU = 1420", with: "MTU = 1300").utf8).base64EncodedString())!.0
+precondition(custom.wireGuardConfig(endpoint: "e", allowedIPs: nil).contains("MTU = 1300"))  // link MTU wins
 print("profile_check ok")
--- a/ios/Tests/RelayCheck/main.c
+++ b/ios/Tests/RelayCheck/main.c
@@ -0,0 +1,22 @@
+/* Mode «Облако» of pcarelay without a phone: cc -I Tunnel -o /tmp/rc Tests/RelayCheck/main.c Tunnel/pcarelay.c && /tmp/rc */
+#include "pcarelay.h"
+#include <arpa/inet.h>
+#include <assert.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+int wgobf_main(int c, char **v) { return 0; }
+static void out(const unsigned char *p, int n) { unsigned char r[64]; memcpy(r, p, n); r[0] = 'R'; pcarelay_ws_in(r, n); }
+int main(void) {
+    pcarelay_start(13299, "127.0.0.1", 9, 0);
+    pcarelay_use_ws(out);
+    usleep(200000);
+    assert(pcarelay_is_ws() && !pcarelay_is_tcp());
+    int s = socket(AF_INET, SOCK_DGRAM, 0);
+    struct sockaddr_in a = {.sin_family = AF_INET, .sin_port = htons(13299), .sin_addr.s_addr = htonl(INADDR_LOOPBACK)};
+    struct timeval tv = {2, 0}; setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof tv);
+    sendto(s, "ping", 4, 0, (struct sockaddr *)&a, sizeof a);
+    char b[16] = {0}; int n = recv(s, b, sizeof b, 0);
+    assert(n == 4 && !memcmp(b, "Ring", 4) && pcarelay_rx_bytes() == 4);
+    puts("pcarelay ws: ok");
+}
--- a/ios/Tunnel/Info.plist
+++ b/ios/Tunnel/Info.plist
@@ -17,9 +17,9 @@
 	<key>CFBundlePackageType</key>
 	<string>XPC!</string>
 	<key>CFBundleShortVersionString</key>
-	<string>1.0</string>
+	<string>$(MARKETING_VERSION)</string>
 	<key>CFBundleVersion</key>
-	<string>1</string>
+	<string>$(CURRENT_PROJECT_VERSION)</string>
 	<key>NSExtension</key>
 	<dict>
 		<key>NSExtensionPointIdentifier</key>
--- a/ios/Tunnel/PacketTunnelProvider.swift
+++ b/ios/Tunnel/PacketTunnelProvider.swift
@@ -4,7 +4,8 @@ import WireGuardKit

 /// PCA Phobos packet tunnel:
 /// WireGuard (userspace) -> 127.0.0.1:13255 wg-obfuscator -> 127.0.0.1:13258 pcarelay -> server (UDP or TCP).
-/// providerConfiguration: "conf" (phobos:// payload), "ruDirect" (Bool), "transport" ("auto"|"udp"|"tcp").
+/// providerConfiguration: "conf" (phobos:// payload), "ruDirect" (Bool), "transport" ("auto"|"udp"|"tcp"|"cloud"), "wsURL".
+/// "cloud": pcarelay hands packets to WsLink -> wss://<Keenetic KeenDNS subdomain>/ -> wsgw on the router -> server UDP.
 final class PacketTunnelProvider: NEPacketTunnelProvider {
    private static let wgPort = 13255, relayPort = 13258
    private static var obfuscatorStarted = false   // one wg-obfuscator per process (it forks for more)
@@ -31,7 +32,17 @@ final class PacketTunnelProvider: NEPacketTunnelProvider {
            return
        }

-        pcarelay_use_tcp(transport == "tcp" ? 1 : 0)
+        let wsURL = (pc["wsURL"] as? String).flatMap { $0.isEmpty ? nil : $0 } ?? profile.wsURL
+        if transport == "cloud" {
+            guard let s = wsURL, let url = URL(string: s) else {
+                completionHandler(NSError(domain: "PCAPhobos", code: 4, userInfo: [NSLocalizedDescriptionKey: "не задан адрес роутера (wss://…) для канала «Облако»"]))
+                return
+            }
+            WsLink.shared.start(url)
+            pcarelay_use_ws { p, n in WsLink.shared.send(p, n) }
+        } else {
+            pcarelay_use_tcp(transport == "tcp" ? 1 : 0)
+        }
        if !Self.obfuscatorStarted {
            Self.obfuscatorStarted = true
            pcarelay_start(Int32(Self.relayPort), host, Int32(udpPort), Int32(tcpPort))
@@ -44,8 +55,9 @@ final class PacketTunnelProvider: NEPacketTunnelProvider {
            }
        }

-        let allowed = ruDirect ? Self.ruBypassAllowedIPs() : nil
-        let wgText = profile.wireGuardConfig(endpoint: "127.0.0.1:\(Self.wgPort)", allowedIPs: allowed)
+        // full tunnel; Russian networks (all sizes, incl. CDN /24s) are excluded routes when ruDirect
+        PhobosRoutes.excludedIPv4 = ruDirect ? Self.ruNetworks() : []
+        let wgText = profile.wireGuardConfig(endpoint: "127.0.0.1:\(Self.wgPort)", allowedIPs: nil)
        let tunnelConfig: TunnelConfiguration
        do {
            tunnelConfig = try TunnelConfiguration(fromWgQuickConfig: wgText, called: "phobos")
@@ -79,14 +91,17 @@ final class PacketTunnelProvider: NEPacketTunnelProvider {

    /// App asks for status: {"transport": "UDP"|"TCP", "rx": bytes}
    override func handleAppMessage(_ messageData: Data, completionHandler: ((Data?) -> Void)?) {
-        let status: [String: Any] = ["transport": pcarelay_is_tcp() != 0 ? "TCP" : "UDP",
+        let status: [String: Any] = ["transport": pcarelay_is_ws() != 0 ? "Облако" : pcarelay_is_tcp() != 0 ? "TCP" : "UDP",
                                     "rx": pcarelay_rx_bytes()]
        completionHandler?(try? JSONSerialization.data(withJSONObject: status))
    }

-    private static func ruBypassAllowedIPs() -> String? {
+    /// ru_bypass.txt: Russian IPv4 networks (comma-separated). IPv6 stays fully in the tunnel,
+    /// otherwise blocked sites leak over carrier IPv6.
+    private static func ruNetworks() -> [String] {
        guard let url = Bundle.main.url(forResource: "ru_bypass", withExtension: "txt"),
-              let text = try? String(contentsOf: url, encoding: .utf8) else { return nil }
-        return text.split(separator: "\n").first { !$0.hasPrefix("#") && $0.contains("/") }.map(String.init)
+              let text = try? String(contentsOf: url, encoding: .utf8),
+              let line = text.split(separator: "\n").first(where: { !$0.hasPrefix("#") && $0.contains("/") }) else { return [] }
+        return line.split(separator: ",").map { $0.trimmingCharacters(in: .whitespaces) }
    }
 }
--- a/ios/Tunnel/WsLink.swift
+++ b/ios/Tunnel/WsLink.swift
@@ -0,0 +1,59 @@
+import Foundation
+
+/// Channel «Облако»: one binary WebSocket message = one obfuscated packet, both ways.
+/// pcarelay (C) calls send() for every packet from the obfuscator; received messages go back via pcarelay_ws_in().
+final class WsLink {
+    static let shared = WsLink()
+
+    private let q = DispatchQueue(label: "pca.ws")
+    private let session = URLSession(configuration: .ephemeral)
+    private var url: URL?
+    private var task: URLSessionWebSocketTask?
+
+    func start(_ url: URL) {
+        q.async { self.url = url; self.connect() }
+    }
+
+    func send(_ p: UnsafePointer<UInt8>?, _ n: Int32) {
+        guard let p, n > 0 else { return }
+        let data = Data(bytes: p, count: Int(n))
+        q.async {
+            if self.task == nil { self.connect() }
+            guard let t = self.task else { return }
+            t.send(.data(data)) { [weak self] err in
+                if let err { self?.q.async { if self?.task === t { self?.drop("send: \(err.localizedDescription)") } } }
+            }
+        }
+    }
+
+    private func connect() {
+        guard let url, task == nil else { return }
+        let t = session.webSocketTask(with: url)
+        t.maximumMessageSize = 1 << 20
+        task = t
+        t.resume()
+        NSLog("PCAPhobos ws: connect %@", url.absoluteString)
+        receive(t)
+    }
+
+    private func receive(_ t: URLSessionWebSocketTask) {
+        t.receive { [weak self] result in
+            switch result {
+            case .success(.data(let d)):
+                d.withUnsafeBytes { pcarelay_ws_in($0.bindMemory(to: UInt8.self).baseAddress, Int32(d.count)) }
+                self?.receive(t)
+            case .success:
+                self?.receive(t)
+            case .failure(let err):
+                self?.q.async { if self?.task === t { self?.drop("recv: \(err.localizedDescription)") } }
+            }
+        }
+    }
+
+    /// Next packet from the obfuscator reconnects (WireGuard keepalives make that quick).
+    private func drop(_ why: String) {
+        NSLog("PCAPhobos ws: %@", why)
+        task?.cancel(with: .goingAway, reason: nil)
+        task = nil
+    }
+}
--- a/ios/Tunnel/pcarelay.c
+++ b/ios/Tunnel/pcarelay.c
@@ -3,6 +3,7 @@
 * wg-obfuscator (one instance, iOS forbids fork) sends to 127.0.0.1:<local>;
 * we forward either over UDP to the server's obfuscator port or over TCP to
 * the server's udptcp (frames: 2-byte length + packet). Switch with pcarelay_use_tcp().
+ * Mode 2 ("Облако"): packets go to a Swift callback (WebSocket to the user's Keenetic), answers come back via pcarelay_ws_in().
 */
 #include "pcarelay.h"
 #include <arpa/inet.h>
@@ -18,7 +19,12 @@
 #include <time.h>
 #include <unistd.h>

-static atomic_int use_tcp = 0;
+static atomic_int use_tcp = 0;   /* 0 udp, 1 tcp, 2 ws */
+static pcarelay_ws_out_fn ws_out;
+static int g_local = -1;
+static pthread_mutex_t peer_mu = PTHREAD_MUTEX_INITIALIZER;
+static struct sockaddr_storage g_peer;
+static socklen_t g_pl;
 static atomic_ullong rx_bytes = 0;
 static char g_host[256], g_udp_port[8], g_tcp_port[8];
 static int g_local_port;
@@ -59,15 +65,17 @@ static void *loop(void *arg) {
    la.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
    int local = socket(AF_INET, SOCK_DGRAM, 0);
    if (local < 0 || bind(local, (struct sockaddr *)&la, sizeof la) < 0) return NULL;
+    g_local = local;
    int udp = -1, tcp = -1;
    struct sockaddr_storage peer; socklen_t pl = 0;
    unsigned char buf[65537];
    time_t last_dial = 0;
    for (;;) {
-        int want_tcp = atomic_load(&use_tcp);
+        int mode = atomic_load(&use_tcp), want_tcp = mode == 1;
+        if (mode == 2) { if (udp >= 0) { close(udp); udp = -1; } if (tcp >= 0) { close(tcp); tcp = -1; } }
        if (!want_tcp && tcp >= 0) { close(tcp); tcp = -1; }
        if (want_tcp && udp >= 0) { close(udp); udp = -1; }
-        if (!want_tcp && udp < 0 && time(NULL) != last_dial) { last_dial = time(NULL); udp = dial(SOCK_DGRAM, g_udp_port); }
+        if (mode == 0 && udp < 0 && time(NULL) != last_dial) { last_dial = time(NULL); udp = dial(SOCK_DGRAM, g_udp_port); }
        int up = want_tcp ? tcp : udp;
        struct pollfd p[2] = {{local, POLLIN, 0}, {up, POLLIN, 0}};
        poll(p, up >= 0 ? 2 : 1, 1000);
@@ -75,7 +83,10 @@ static void *loop(void *arg) {
            pl = sizeof peer;
            ssize_t n = recvfrom(local, buf, 65535, 0, (struct sockaddr *)&peer, &pl);
            if (n <= 0) continue;
-            if (want_tcp) {
+            pthread_mutex_lock(&peer_mu); g_peer = peer; g_pl = pl; pthread_mutex_unlock(&peer_mu);
+            if (mode == 2) {
+                if (ws_out) ws_out(buf, (int)n);
+            } else if (want_tcp) {
                if (tcp < 0 && time(NULL) != last_dial) { last_dial = time(NULL); tcp = dial(SOCK_STREAM, g_tcp_port); }
                if (tcp >= 0) {
                    unsigned char h[2] = {(unsigned char)(n >> 8), (unsigned char)n};
@@ -114,5 +125,17 @@ int pcarelay_start(int local_port, const char *host, int udp_port, int tcp_port)
 }

 void pcarelay_use_tcp(int on) { atomic_store(&use_tcp, on ? 1 : 0); }
-int pcarelay_is_tcp(void) { return atomic_load(&use_tcp); }
+int pcarelay_is_tcp(void) { return atomic_load(&use_tcp) == 1; }
+
+void pcarelay_use_ws(pcarelay_ws_out_fn out) { ws_out = out; atomic_store(&use_tcp, 2); }
+int pcarelay_is_ws(void) { return atomic_load(&use_tcp) == 2; }
+
+void pcarelay_ws_in(const unsigned char *p, int n) {
+    if (g_local < 0 || n <= 0) return;
+    atomic_fetch_add(&rx_bytes, (unsigned long long)n);
+    pthread_mutex_lock(&peer_mu);
+    struct sockaddr_storage peer = g_peer; socklen_t pl = g_pl;
+    pthread_mutex_unlock(&peer_mu);
+    if (pl) sendto(g_local, p, (size_t)n, 0, (struct sockaddr *)&peer, pl);
+}
 unsigned long long pcarelay_rx_bytes(void) { return atomic_load(&rx_bytes); }
--- a/ios/Tunnel/pcarelay.h
+++ b/ios/Tunnel/pcarelay.h
@@ -8,6 +8,13 @@ int pcarelay_is_tcp(void);
 /* Bytes received back from the server on any path (auto-detects a dead UDP). */
 unsigned long long pcarelay_rx_bytes(void);

+/* Mode "Облако": each packet from the obfuscator goes to out() (Swift sends it over WebSocket);
+   packets from the WebSocket are handed back with pcarelay_ws_in(). */
+typedef void (*pcarelay_ws_out_fn)(const unsigned char *p, int n);
+void pcarelay_use_ws(pcarelay_ws_out_fn out);
+int pcarelay_is_ws(void);
+void pcarelay_ws_in(const unsigned char *p, int n);
+
 /* wg-obfuscator compiled in with -Dmain=wgobf_main (one instance per process). */
 int wgobf_main(int argc, char **argv);

--- a/ios/Tunnel/ru_bypass.txt
+++ b/ios/Tunnel/ru_bypass.txt
--- a/ios/WireGuardKit/Sources/WireGuardKit/PacketTunnelSettingsGenerator.swift
+++ b/ios/WireGuardKit/Sources/WireGuardKit/PacketTunnelSettingsGenerator.swift
@@ -12,6 +12,11 @@ import WireGuardKitC
 /// A type alias for `Result` type that holds a tuple with source and resolved endpoint.
 typealias EndpointResolutionResult = Result<(Endpoint, Endpoint), DNSResolutionError>

+/// PCA Phobos: IPv4 CIDRs that must not go into the tunnel (set before adapter.start).
+public enum PhobosRoutes {
+    public static var excludedIPv4: [String] = []
+}
+
 class PacketTunnelSettingsGenerator {
    let tunnelConfiguration: TunnelConfiguration
    let resolvedEndpoints: [Endpoint?]
@@ -118,6 +123,11 @@ class PacketTunnelSettingsGenerator {

        let ipv4Settings = NEIPv4Settings(addresses: ipv4Addresses.map { $0.destinationAddress }, subnetMasks: ipv4Addresses.map { $0.destinationSubnetMask })
        ipv4Settings.includedRoutes = ipv4IncludedRoutes
+        // PCA Phobos: "Russian sites direct" = these networks bypass the tunnel
+        ipv4Settings.excludedRoutes = PhobosRoutes.excludedIPv4.compactMap { cidr in
+            guard let range = IPAddressRange(from: cidr) else { return nil }
+            return NEIPv4Route(destinationAddress: "\(range.address)", subnetMask: "\(range.subnetMask())")
+        }
        networkSettings.ipv4Settings = ipv4Settings

        let ipv6Settings = NEIPv6Settings(addresses: ipv6Addresses.map { $0.destinationAddress }, networkPrefixLengths: ipv6Addresses.map { $0.destinationNetworkPrefixLength })
--- a/ios/project.yml
+++ b/ios/project.yml
@@ -10,9 +10,9 @@ packages:
    path: WireGuardKit
 settings:
  base:
-    MARKETING_VERSION: "1.4.1"
-    CURRENT_PROJECT_VERSION: "141"
-    DEVELOPMENT_TEAM: ""
+    MARKETING_VERSION: "1.0"
+    CURRENT_PROJECT_VERSION: "6"
+    DEVELOPMENT_TEAM: Q5FKU39TUA
    CODE_SIGN_STYLE: Automatic
 targets:
  PCAPhobos:
@@ -33,8 +33,12 @@ targets:
      path: App/Info.plist
      properties:
        CFBundleDisplayName: PCA Phobos
+        ITSAppUsesNonExemptEncryption: false
+        CFBundleShortVersionString: $(MARKETING_VERSION)
+        CFBundleVersion: $(CURRENT_PROJECT_VERSION)
        UILaunchScreen: {}
        UISupportedInterfaceOrientations: [UIInterfaceOrientationPortrait]
+        UIRequiresFullScreen: true
        CFBundleURLTypes:
          - CFBundleURLName: com.bobyrev.pcaphobos.link
            CFBundleURLSchemes: [phobos]
@@ -50,6 +54,7 @@ targets:
      - Tunnel/TunnelConfiguration+WgQuickConfig.swift
      - Tunnel/String+ArrayConversion.swift
      - Tunnel/pcarelay.c
+      - Tunnel/WsLink.swift
      - Shared
      - path: Tunnel/ru_bypass.txt
        buildPhase: resources
@@ -66,6 +71,8 @@ targets:
      path: Tunnel/Info.plist
      properties:
        CFBundleDisplayName: PhobosTunnel
+        CFBundleShortVersionString: $(MARKETING_VERSION)
+        CFBundleVersion: $(CURRENT_PROJECT_VERSION)
        NSExtension:
          NSExtensionPointIdentifier: com.apple.networkextension.packet-tunnel
          NSExtensionPrincipalClass: $(PRODUCT_MODULE_NAME).PacketTunnelProvider
--- a/overlay/install-router.sh.template
+++ b/overlay/install-router.sh.template
@@ -456,27 +456,20 @@ deploy_health_monitor() {
  [ -f "$PHOBOS_DIR/phobos-pull.sh" ] || pull_line=""

  if [ "$ROUTER_PLATFORM" = "keenetic" ]; then
-    # Install cron if not present (Entware)
-    if ! command -v crontab >/dev/null 2>&1 && command -v opkg >/dev/null 2>&1; then
-      log "  Установка cron через opkg..."
-      opkg update >/dev/null 2>&1
-      opkg install cron >/dev/null 2>&1
-      /opt/etc/init.d/S10cron start >/dev/null 2>&1 || true
-    fi
-    local cron_file="/opt/etc/crontab"
-    # Create crontab file if missing
-    if [ ! -f "$cron_file" ]; then
-      mkdir -p /opt/etc
-      touch "$cron_file"
-    fi
-    if ! grep -q "phobos-health" "$cron_file" 2>/dev/null; then
-      echo "$cron_line" >> "$cron_file"
-      log "  Cron (health) добавлен в $cron_file"
-    fi
-    if [ -n "$pull_line" ] && ! grep -q "phobos-pull" "$cron_file" 2>/dev/null; then
-      echo "$pull_line" >> "$cron_file"
-      log "  Cron (pull) добавлен в $cron_file"
+    # Демон — busybox crond (есть в Entware как /opt/sbin/crond). Entware-пакет cron
+    # (vixie, PROCS=cron) на Keenetic задачи не выполнял — заменяем (01.11.2026)
+    local I=/opt/etc/init.d/S10cron
+    if [ ! -x $I ] || grep -q "^PROCS=cron$" $I; then
+      $I stop >/dev/null 2>&1
+      printf '#!/bin/sh\n\nENABLED=yes\nPROCS=crond\nARGS="-c /opt/var/spool/cron/crontabs -b"\nPREARGS=""\nDESC=$PROCS\nPATH=/opt/sbin:/opt/bin:/usr/sbin:/usr/bin:/sbin:/bin\n\n. /opt/etc/init.d/rc.func\n' > $I
+      chmod +x $I
    fi
+    mkdir -p /opt/var/spool/cron/crontabs
+    # 01.11.2026: демоны cron на Keenetic (busybox crond, Entware cron) читают crontab
+    # пользователя root, а не /opt/etc/crontab — туда писать бесполезно
+    sed -i "/phobos-health\|phobos-pull/d" /opt/etc/crontab 2>/dev/null
+    (crontab -l 2>/dev/null | grep -v "phobos-health" | grep -v "phobos-pull"; echo "$cron_line"; [ -n "$pull_line" ] && echo "$pull_line") | crontab -
+    log "  Cron добавлен через crontab (health + pull)"
    /opt/etc/init.d/S10cron restart >/dev/null 2>&1 || true
  elif [ "$ROUTER_PLATFORM" = "openwrt" ]; then
    (crontab -l 2>/dev/null | grep -v "phobos-health" | grep -v "phobos-pull"; echo "$cron_line"; [ -n "$pull_line" ] && echo "$pull_line") | crontab -
--- a/overlay/phobos-client.sh
+++ b/overlay/phobos-client.sh
@@ -220,7 +220,7 @@ action_package() {
  cp "$dir/wg-obfuscator.conf" "$pkg_root/wg-obfuscator.conf"

  # Fetch missing router-arch binaries from ClusterM on-demand
-  local _tag; _tag=$(curl -fsSL -m10 https://api.github.com/repos/ClusterM/wg-obfuscator/releases/latest 2>/dev/null | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"\(.*\)".*/\1/')
+  local _tag; _tag=$(curl -fsSL -m10 https://api.github.com/repos/ClusterM/wg-obfuscator/releases/latest 2>/dev/null | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"\(.*\)".*/\1/') || _tag=""  # ponytail: GitHub API rate limit/недоступность не должны ронять сборку пакета — берём уже скачанные бинарники
  local _cb="https://github.com/ClusterM/wg-obfuscator/releases/download/${_tag}"
  declare -A _am=([aarch64]="linux-arm64" [mipsel]="linux-mipsel-mips32" [mips]="linux-mips-mips32" [armv7]="linux-armv7-hf" [x86_64]="linux-x64")
  for _arch in aarch64 mipsel mips armv7 x86_64; do
--- a/overlay/phobos-pull.sh
+++ b/overlay/phobos-pull.sh
@@ -71,7 +71,7 @@ fetch_config() {
    if command -v curl >/dev/null; then
        curl -k -s -m 8 -o "$TMP" "$url" 2>/dev/null && return 0
    fi
-    wget --no-check-certificate -q -O "$TMP" "$url" 2>/dev/null || wget -q -O "$TMP" "$url" 2>/dev/null
+    wget -T 8 --no-check-certificate -q -O "$TMP" "$url" 2>/dev/null || wget -T 8 -q -O "$TMP" "$url" 2>/dev/null
 }

 # One fetch + compare + apply pass. Returns 0 always (best-effort).
--- a/server/phobos-health.sh
+++ b/server/phobos-health.sh
@@ -189,9 +189,18 @@ switch_wg_peer() {
    # Add the target peer if it is not already present
    if ! echo "$present" | grep -q "^${new_key}$"; then
        log "WG PEER add: $new_key"
-        curl -s -X POST "http://localhost:79/rci/" \
-            -H "Content-Type: application/json" \
-            -d "{\"interface\":{\"${WG_IF}\":{\"wireguard\":{\"peer\":{\"key\":\"${new_key}\",\"comment\":\"Phobos VPS Server\",\"endpoint\":{\"address\":\"127.0.0.1:13255\"},\"keepalive-interval\":{\"interval\":25},\"allow-ips\":[{\"address\":\"0.0.0.0\",\"mask\":\"0.0.0.0\"},{\"address\":\"::\",\"mask\":\"0\"}]}}}}}" >/dev/null 2>&1
+        # 01.11.2026: порт — из конфига обфускатора (было зашито 13255, а установщик
+        # берёт свободный, на части роутеров 51820 → после переключения туннель мёртв).
+        # Через ndmc по шагам: JSON-RCI с allow-ips "::"/0 молча не ставил allow-ips.
+        lport=$(grep 'source-lport' "$PHOBOS_DIR/wg-obfuscator.conf" 2>/dev/null | tr -d ' ' | cut -d'=' -f2)
+        lport=${lport:-13255}
+        ndmc -c "interface $WG_IF wireguard peer $new_key" >/dev/null 2>&1
+        ndmc -c "interface $WG_IF wireguard peer $new_key endpoint 127.0.0.1:$lport" >/dev/null 2>&1
+        ndmc -c "interface $WG_IF wireguard peer $new_key keepalive-interval 25" >/dev/null 2>&1
+        ndmc -c "interface $WG_IF wireguard peer $new_key allow-ips 0.0.0.0 0.0.0.0" >/dev/null 2>&1
+        # ядро не всегда подхватывает allow-ips нового пира без перезапуска интерфейса
+        ndmc -c "interface $WG_IF down" >/dev/null 2>&1; sleep 1
+        ndmc -c "interface $WG_IF up" >/dev/null 2>&1
    fi

    # Persist config
--- a/server/phobos-pull.sh
+++ b/server/phobos-pull.sh
@@ -71,7 +71,7 @@ fetch_config() {
    if command -v curl >/dev/null; then
        curl -k -s -m 8 -o "$TMP" "$url" 2>/dev/null && return 0
    fi
-    wget --no-check-certificate -q -O "$TMP" "$url" 2>/dev/null || wget -q -O "$TMP" "$url" 2>/dev/null
+    wget -T 8 --no-check-certificate -q -O "$TMP" "$url" 2>/dev/null || wget -T 8 -q -O "$TMP" "$url" 2>/dev/null
 }

 # One fetch + compare + apply pass. Returns 0 always (best-effort).
--- a/server/secondary-setup.sh
+++ b/server/secondary-setup.sh
@@ -18,7 +18,23 @@ MAIN_API_KEY="${MAIN_API_KEY:?Set MAIN_API_KEY=your_api_key}"
 MAIN_PROTO="${MAIN_PROTO:-http}"
 MAIN_PORT="${MAIN_PORT:-8443}"
 OBF_PORTS="${OBF_PORTS:-2083,5443,993}"
+# Подсеть клиентов: env SERVER_WG_IPV4_NETWORK или вопрос в терминале (Enter = 10.25.0.0/16)
+if [ -z "${SERVER_WG_IPV4_NETWORK:-}" ] && [ -r /dev/tty ] && [ -t 1 ]; then
+    printf 'Подсеть VPN-клиентов [10.25.0.0/16]: ' > /dev/tty
+    read -r -t 60 SERVER_WG_IPV4_NETWORK < /dev/tty || true
+fi
 SERVER_WG_IPV4_NETWORK="${SERVER_WG_IPV4_NETWORK:-10.25.0.0/16}"
+SERVER_WG_IPV4_NETWORK="$(python3 - "$SERVER_WG_IPV4_NETWORK" <<'PY'
+import ipaddress, sys
+try:
+    net = ipaddress.ip_network(sys.argv[1].strip(), strict=False)
+except ValueError:
+    sys.exit("ERROR: bad subnet " + sys.argv[1])
+if net.version != 4 or not net.is_private or net.prefixlen > 29:
+    sys.exit("ERROR: subnet must be private IPv4, /8../29 (e.g. 10.25.1.0/24)")
+print(net)
+PY
+)" || exit 1
 PHOBOS_DIR="/opt/Phobos"
 WG_SERVER_IPV4="$(python3 - "$SERVER_WG_IPV4_NETWORK" <<'PY'
 import ipaddress, sys
--- a/update.sh
+++ b/update.sh
@@ -42,9 +42,17 @@ restart_panel_service() {
 # since 1.4.0 all channels are branches of one public repo (no subscriber token)
 is_private() { return 1; }

+PCA_GIT_DEV="${PCA_GIT_DEV:-https://git.bobyrev.com/PCA/PCA_Phobos-dev}"
+
 fetch_repo_file() {  # $1=ref $2=repo_path $3=output ; Gitea first, GitHub fallback
    local ref="$1" rp="$2" out="$3" kind=branch
    case "$ref" in v[0-9]*) kind=tag;; esac
+    # beta/dev live in the private Gitea repo PCA_Phobos-dev: read-only Gitea token in $PANEL_DIR/.gh_token or GH_TOKEN
+    case "$ref" in beta|dev)
+        if [ -n "$GH_TOKEN" ]; then
+            curl -fsSL -m25 -H "Authorization: token $GH_TOKEN" "$PCA_GIT_DEV/raw/branch/$ref/$rp?cb=$(date +%s)" -o "$out" 2>/dev/null && return 0
+        fi;;
+    esac
    curl -fsSL -m25 "$PCA_GIT/raw/$kind/$ref/$rp?cb=$(date +%s)" -o "$out" 2>/dev/null && return 0
    curl -fsSL -m25 "$GH_RAW/$ref/$rp?cb=$(date +%s)" -o "$out"
 }
@@ -241,6 +249,15 @@ case "${1:-}" in
        echo "Токен — по подписке: https://boosty.to/andrey27 . Стабильная (без токена): phobos-update stable"
        exit 1
    fi
+    case "$ref" in beta|dev)
+        if [ -z "$GH_TOKEN" ]; then
+            echo "Каналы beta и dev — по токену подписчика (read-only токен Gitea)."
+            echo "Вставь токен в панели: Настройки → Версия и обновления → «токен подписчика», или:"
+            echo "  GH_TOKEN=ваш_токен phobos-update $ref"
+            echo "Стабильная (без токена): phobos-update stable"
+            exit 1
+        fi;;
+    esac
    if ! ref_exists "$ref"; then
        echo "Версия/ветка '$ref' не найдена (или токен неверный). Обновление отменено (текущая $CUR не тронута)."
        echo "Доступные: phobos-update --versions  ·  стабильная: $(latest_version)"
--- a/wsgw/README.md
+++ b/wsgw/README.md
@@ -0,0 +1,21 @@
+# wsgw — шлюз WebSocket → UDP (транспорт «Облако» / Keenetic-облако)
+
+Телефон без доступа к серверу → облако KeenDNS (HTTPS по SNI) → свой Keenetic → `wsgw` → UDP обфускатора сервера.
+Одно бинарное WS-сообщение = один обфусцированный пакет; на каждое WS-соединение — свой UDP-сокет к `-t`.
+
+Роутер (Entware):
+```sh
+cp bin/wsgw-aarch64 /opt/sbin/wsgw          # mipsel/mips — по uname -m
+cp router/S80wsgw /opt/etc/init.d/ && chmod +x /opt/sbin/wsgw /opt/etc/init.d/S80wsgw
+printf 'WSGW_LISTEN=192.168.1.1:18090\nWSGW_TARGET=<сервер>:<порт обфускатора>\n' > /opt/etc/wsgw.conf
+/opt/etc/init.d/S80wsgw start
+ndmc -c 'ip http proxy phobos'; ndmc -c 'ip http proxy phobos upstream http 192.168.1.1 18090'
+ndmc -c 'ip http proxy phobos domain ndns'; ndmc -c 'ip http proxy phobos security-level public'
+ndmc -c 'ndns book-name <имя> <домен> cloud'; ndmc -c 'ip http ssl acme get phobos.<имя>.<домен>'
+ndmc -c 'system configuration save'
+```
+Требования: `ip http port 80` (иначе ACME не выпустит сертификат), WAN:443 не проброшен на другой хост
+(облако шлёт TLS поддоменов на WAN:443). Если `acme get` висит в `get-pending` — перезагрузка роутера и команда ещё раз.
+
+Клиент Android 1.4.4: канал «Облако», адрес `wss://phobos.<имя>.<домен>/` (или `# pca-ws = wss://…` в ссылке).
+Сборка: `./build.sh` (Go, статические linux arm64/mipsle/mips/amd64).
--- a/wsgw/bin/wsgw-aarch64
+++ b/wsgw/bin/wsgw-aarch64
--- a/wsgw/bin/wsgw-mips
+++ b/wsgw/bin/wsgw-mips
--- a/wsgw/bin/wsgw-mipsel
+++ b/wsgw/bin/wsgw-mipsel
--- a/wsgw/bin/wsgw-x86_64
+++ b/wsgw/bin/wsgw-x86_64
--- a/wsgw/build.sh
+++ b/wsgw/build.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+# Static builds for Keenetic (Entware) and Linux servers.
+cd "$(dirname "$0")"; mkdir -p bin
+for a in arm64:aarch64 mipsle:mipsel mips:mips amd64:x86_64; do
+  GOOS=linux GOARCH=${a%%:*} GOMIPS=softfloat CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o bin/wsgw-${a##*:} . || exit 1
+done
+ls -l bin
--- a/wsgw/go.mod
+++ b/wsgw/go.mod
@@ -0,0 +1,3 @@
+module wsgw
+
+go 1.22
--- a/wsgw/main.go
+++ b/wsgw/main.go
@@ -0,0 +1,147 @@
+// wsgw: WebSocket -> UDP gateway for the PCA Phobos "Keenetic cloud" transport.
+// Keenetic `ip http proxy` (KeenDNS cloud, TLS on the router) forwards wss://<sub>/ here as plain ws.
+// One binary WS message = one obfuscated UDP packet; each WS connection gets its own UDP socket to -t.
+package main
+
+import (
+	"bufio"
+	"crypto/sha1"
+	"encoding/base64"
+	"encoding/binary"
+	"flag"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"strings"
+	"time"
+)
+
+const wsGUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"
+
+func main() {
+	listen := flag.String("l", "0.0.0.0:18090", "listen addr (http)")
+	target := flag.String("t", "", "UDP target host:port (server obfuscator)")
+	flag.Parse()
+	if *target == "" {
+		log.Fatal("-t host:port required")
+	}
+	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		if !strings.EqualFold(r.Header.Get("Upgrade"), "websocket") {
+			http.Error(w, "ok", http.StatusUpgradeRequired)
+			return
+		}
+		h, ok := w.(http.Hijacker)
+		if !ok {
+			return
+		}
+		conn, rw, err := h.Hijack()
+		if err != nil {
+			return
+		}
+		sum := sha1.Sum([]byte(r.Header.Get("Sec-WebSocket-Key") + wsGUID))
+		rw.WriteString("HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Accept: " +
+			base64.StdEncoding.EncodeToString(sum[:]) + "\r\n\r\n")
+		rw.Flush()
+		go serve(conn, rw.Reader, *target)
+	})
+	log.Printf("wsgw %s -> udp %s", *listen, *target)
+	log.Fatal(http.ListenAndServe(*listen, nil))
+}
+
+func serve(c net.Conn, br *bufio.Reader, target string) {
+	defer c.Close()
+	u, err := net.Dial("udp", target)
+	if err != nil {
+		log.Printf("udp %s: %v", target, err)
+		return
+	}
+	defer u.Close()
+	go func() { // udp -> ws
+		buf := make([]byte, 65535)
+		for {
+			u.SetReadDeadline(time.Now().Add(5 * time.Minute))
+			n, err := u.Read(buf)
+			if err != nil {
+				c.Close()
+				return
+			}
+			if writeFrame(c, 2, buf[:n]) != nil {
+				return
+			}
+		}
+	}()
+	for { // ws -> udp
+		op, p, err := readFrame(br)
+		if err != nil {
+			return
+		}
+		switch op {
+		case 2, 0:
+			u.Write(p)
+		case 8:
+			return
+		case 9:
+			writeFrame(c, 10, p)
+		}
+	}
+}
+
+// readFrame reads one client frame (masked). Fragmented messages are not used by our clients.
+func readFrame(r *bufio.Reader) (byte, []byte, error) {
+	var h [2]byte
+	if _, err := io.ReadFull(r, h[:]); err != nil {
+		return 0, nil, err
+	}
+	n := uint64(h[1] & 0x7f)
+	switch n {
+	case 126:
+		var e [2]byte
+		if _, err := io.ReadFull(r, e[:]); err != nil {
+			return 0, nil, err
+		}
+		n = uint64(binary.BigEndian.Uint16(e[:]))
+	case 127:
+		var e [8]byte
+		if _, err := io.ReadFull(r, e[:]); err != nil {
+			return 0, nil, err
+		}
+		n = binary.BigEndian.Uint64(e[:])
+	}
+	if n > 65535 {
+		return 0, nil, io.ErrUnexpectedEOF
+	}
+	var mask [4]byte
+	masked := h[1]&0x80 != 0
+	if masked {
+		if _, err := io.ReadFull(r, mask[:]); err != nil {
+			return 0, nil, err
+		}
+	}
+	p := make([]byte, n)
+	if _, err := io.ReadFull(r, p); err != nil {
+		return 0, nil, err
+	}
+	if masked {
+		for i := range p {
+			p[i] ^= mask[i&3]
+		}
+	}
+	return h[0] & 0x0f, p, nil
+}
+
+func writeFrame(w io.Writer, op byte, p []byte) error {
+	hdr := []byte{0x80 | op, 0}
+	switch n := len(p); {
+	case n < 126:
+		hdr[1] = byte(n)
+	case n < 65536:
+		hdr[1] = 126
+		hdr = binary.BigEndian.AppendUint16(hdr, uint16(n))
+	default:
+		hdr[1] = 127
+		hdr = binary.BigEndian.AppendUint64(hdr, uint64(n))
+	}
+	_, err := w.Write(append(hdr, p...))
+	return err
+}
--- a/wsgw/router/S80wsgw
+++ b/wsgw/router/S80wsgw
@@ -0,0 +1,10 @@
+#!/bin/sh
+# PCA Phobos: WebSocket -> UDP gateway (transport "Keenetic cloud"). Config: /opt/etc/wsgw.conf
+[ -f /opt/etc/wsgw.conf ] && . /opt/etc/wsgw.conf
+ENABLED=yes
+PROCS=wsgw
+ARGS="-l ${WSGW_LISTEN:-127.0.0.1:18090} -t $WSGW_TARGET"
+PREARGS=""
+DESC=$PROCS
+PATH=/opt/sbin:/opt/bin:/usr/sbin:/usr/bin:/sbin:/bin
+. /opt/etc/init.d/rc.func
Author	SHA1	Message	Date
Бобырев Андрей	8dc9fda65b	release: 1.4.7 — failover на Keenetic, cron, таймаут pull Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-01 16:41:40 +03:00
Бобырев Андрей	8bfc84f315	phobos-health: переключение сервера больше не убивает туннель Пир добавлялся с зашитым 127.0.0.1:13255, а обфускатор на части роутеров слушает другой порт (51820) — после любого failover туннель был мёртв. Порт теперь из wg-obfuscator.conf; пир через ndmc по шагам, allow-ips 0.0.0.0/0 и перезапуск интерфейса (ядро иначе не берёт allow-ips). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit f934c5b3b0344264586a65b97b2b80b315c2e0c1)	2026-11-01 16:41:24 +03:00
Бобырев Андрей	381e97a564	Keenetic: health/pull по cron реально запускаются Задачи писались в /opt/etc/crontab, который демоны cron на Keenetic не читают, а Entware-пакет cron (vixie) задачи не выполнял. Теперь busybox crond и crontab пользователя root; cron ставится, если нет S10cron. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit cbc1bd712f4ac0854d00b18d349d0a9a7d41cc8b)	2026-11-01 16:41:24 +03:00
Бобырев Андрей	eefe3fc2af	phobos-pull: таймаут wget 8 с — мёртвый туннель вешал pull навсегда Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit c2d367ad527c3b14ba9b5ba421e74ae7a0cb7d33)	2026-11-01 16:41:24 +03:00
Бобырев Андрей	15011c2756	phobos-client.sh: лимит GitHub API не валит сборку пакета	2026-11-01 15:18:23 +03:00
Бобырев Андрей	29790aaf4d	release: 1.4.6 — router-config accepts server_api_key as pull token Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-01 04:43:06 +03:00
Бобырев Андрей	884df15f42	release: 1.4.5 — subnet at install, beta/dev from private Gitea repo by token Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-01 03:48:28 +03:00
Бобырев Андрей	eb2b2768cd	install: take subnet from existing wg0.conf on reinstall Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-01 03:00:20 +03:00
Бобырев Андрей	147ef3a42d	feat: ask VPN client subnet at install (SERVER_WG_IPV4_NETWORK) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-01 02:46:49 +03:00
Бобырев Андрей	dde6403cea	release: 1.4.4 — channel «Облако» (WebSocket via KeenDNS cloud to own Keenetic): wsgw gateway, Android 1.4.4, iOS, docs/cloud.md Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-31 05:16:31 +03:00
@@ -1 +1 @@
 .4.2
 .4.7