fix: harden relay service deploy

app.py

@@ -694,6 +694,9 @@ def get_public_ipv4() -> str:
 
 def detect_relay_firewall():
     if shutil.which("nft"):
+        code, _, err = run_cmd(["nft", "list", "ruleset"], timeout=5)
+        if code == 0 and "managed by iptables-nft" in (err or "") and shutil.which("iptables"):
+            return "iptables"
         return "nftables"
     if shutil.which("iptables"):
         return "iptables"

install.sh

@@ -10,6 +10,7 @@ SERVICE_NAME="warp-webui"
 UNIT_DST="/etc/systemd/system/${SERVICE_NAME}.service"
 ALIASES_DIR="/etc/warp-webui"
 LOG_DIR="/var/log/warp-webui"
+BACKUP_DIR="/var/backups/warp-webui"
 RAW_BASE="${WARP_WEBUI_REPO_RAW:-https://raw.githubusercontent.com/andrey271192/WARP-Web-UI-Relay-Beta/main}"
 
 if [[ "${EUID:-0}" -ne 0 ]]; then
@@ -96,7 +97,8 @@ fi
 
 echo
 echo "Установка в ${INSTALL_DIR} ..."
-mkdir -p "${INSTALL_DIR}/scripts" "${ALIASES_DIR}" "${LOG_DIR}"
+mkdir -p "${INSTALL_DIR}/scripts" "${ALIASES_DIR}" "${LOG_DIR}" "${BACKUP_DIR}" /etc/sysctl.d /etc/iptables
+touch /etc/nftables.conf
 install -m 0755 "${REPO_DIR}/app.py" "${INSTALL_DIR}/app.py"
 install -m 0755 "${REPO_DIR}/scripts/warp-install-cf.sh" "${INSTALL_DIR}/scripts/warp-install-cf.sh"
 install -m 0755 "${REPO_DIR}/scripts/warp-uninstall-cf.sh" "${INSTALL_DIR}/scripts/warp-uninstall-cf.sh"

systemd/warp-webui.service

@@ -14,7 +14,7 @@ NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=full
 ProtectHome=true
-ReadWritePaths=/run /var/log /etc/default/warp-webui /etc/warp-webui /var/backups/warp-webui
+ReadWritePaths=/run /var/log /etc/default/warp-webui /etc/warp-webui /var/backups/warp-webui /etc/sysctl.d /etc/nftables.conf /etc/iptables
 
 [Install]
 WantedBy=multi-user.target