From 10016c4fa4da9a3da245a935be814f16ec0b08e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=90=D0=BD=D0=B4=D1=80=D0=B5=D0=B9=20=D0=91=D0=BE=D0=B1?=
 =?UTF-8?q?=D1=8B=D1=80=D0=B5=D0=B2?= <andrejbobyrev@MacBook-Pro.local>
Date: Fri, 5 Jun 2026 18:03:41 +0300
Subject: [PATCH] fix: harden relay service deploy

---
 app.py                     | 3 +++
 install.sh                 | 4 +++-
 systemd/warp-webui.service | 2 +-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/app.py b/app.py
index dc23279..d907619 100755
--- a/app.py
+++ b/app.py
@@ -694,6 +694,9 @@ def get_public_ipv4() -> str:
 
 def detect_relay_firewall():
     if shutil.which("nft"):
+        code, _, err = run_cmd(["nft", "list", "ruleset"], timeout=5)
+        if code == 0 and "managed by iptables-nft" in (err or "") and shutil.which("iptables"):
+            return "iptables"
         return "nftables"
     if shutil.which("iptables"):
         return "iptables"
diff --git a/install.sh b/install.sh
index bd3860c..78c9c95 100755
--- a/install.sh
+++ b/install.sh
@@ -10,6 +10,7 @@ SERVICE_NAME="warp-webui"
 UNIT_DST="/etc/systemd/system/${SERVICE_NAME}.service"
 ALIASES_DIR="/etc/warp-webui"
 LOG_DIR="/var/log/warp-webui"
+BACKUP_DIR="/var/backups/warp-webui"
 RAW_BASE="${WARP_WEBUI_REPO_RAW:-https://raw.githubusercontent.com/andrey271192/WARP-Web-UI-Relay-Beta/main}"
 
 if [[ "${EUID:-0}" -ne 0 ]]; then
@@ -96,7 +97,8 @@ fi
 
 echo
 echo "Установка в ${INSTALL_DIR} ..."
-mkdir -p "${INSTALL_DIR}/scripts" "${ALIASES_DIR}" "${LOG_DIR}"
+mkdir -p "${INSTALL_DIR}/scripts" "${ALIASES_DIR}" "${LOG_DIR}" "${BACKUP_DIR}" /etc/sysctl.d /etc/iptables
+touch /etc/nftables.conf
 install -m 0755 "${REPO_DIR}/app.py" "${INSTALL_DIR}/app.py"
 install -m 0755 "${REPO_DIR}/scripts/warp-install-cf.sh" "${INSTALL_DIR}/scripts/warp-install-cf.sh"
 install -m 0755 "${REPO_DIR}/scripts/warp-uninstall-cf.sh" "${INSTALL_DIR}/scripts/warp-uninstall-cf.sh"
diff --git a/systemd/warp-webui.service b/systemd/warp-webui.service
index aba663e..03f7ac2 100644
--- a/systemd/warp-webui.service
+++ b/systemd/warp-webui.service
@@ -14,7 +14,7 @@ NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=full
 ProtectHome=true
-ReadWritePaths=/run /var/log /etc/default/warp-webui /etc/warp-webui /var/backups/warp-webui
+ReadWritePaths=/run /var/log /etc/default/warp-webui /etc/warp-webui /var/backups/warp-webui /etc/sysctl.d /etc/nftables.conf /etc/iptables
 
 [Install]
 WantedBy=multi-user.target