#!/usr/bin/env python3
import base64
import ipaddress
import json
import os
import re
import shlex
import shutil
import socket
import subprocess
import time
from collections import deque
from datetime import datetime, timezone
from http.server import BaseHTTPRequestHandler, HTTPServer
import logging
from logging.handlers import RotatingFileHandler

USER = os.environ.get("WARP_WEBUI_USER", "admin")
PASS = os.environ.get("WARP_WEBUI_PASS", "")
if not PASS:
    raise SystemExit("WARP_WEBUI_PASS is not set. Configure /etc/default/warp-webui or run install.sh.")
HOST = os.environ.get("WARP_WEBUI_HOST", "0.0.0.0")
PORT = int(os.environ.get("WARP_WEBUI_PORT", "3030"))
ENV_FILE = os.environ.get("WARP_WEBUI_ENV_FILE", "/etc/default/warp-webui")

LOG_DIR = os.environ.get("WARP_WEBUI_LOG_DIR", "/var/log/warp-webui")
LOG_FILE = os.environ.get("WARP_WEBUI_LOG_FILE", os.path.join(LOG_DIR, "warp-webui.log"))
LOG_MAX_BYTES = int(os.environ.get("WARP_WEBUI_LOG_MAX_BYTES", str(2 * 1024 * 1024)))
LOG_BACKUPS = int(os.environ.get("WARP_WEBUI_LOG_BACKUPS", "3"))

BACKUP_DIR = os.environ.get("WARP_WEBUI_BACKUP_DIR", "/var/backups/warp-webui")
INSTALL_SCRIPT = os.environ.get("WARP_INSTALL_SCRIPT", "/opt/warp-webui/scripts/warp-install-cf.sh")
UNINSTALL_SCRIPT = os.environ.get("WARP_UNINSTALL_SCRIPT", "/opt/warp-webui/scripts/warp-uninstall-cf.sh")
XUI_CONFIG = os.environ.get("XUI_CONFIG", "/usr/local/x-ui/bin/config.json")
AMNEZIA_CONTAINER = os.environ.get("AMNEZIA_XRAY_CONTAINER", "amnezia-xray")
AMNEZIA_CONFIG = os.environ.get("AMNEZIA_XRAY_CONFIG", "/opt/amnezia/xray/server.json")
CLIENT_ALIASES_PATH = os.environ.get("WARP_CLIENT_ALIASES", "/etc/warp-webui/client-aliases.json")
BRIDGE_HOST = os.environ.get("WARP_SOCKS_BRIDGE_HOST", "172.17.0.1")
BRIDGE_PORT = int(os.environ.get("WARP_SOCKS_BRIDGE_PORT", "11025"))
SOCKS_OUTBOUND_TAG = "warp-socks"
RELAY_RULE_TAG = os.environ.get("WARP_RELAY_RULE_TAG", "WR_WEBUI_RELAY")
RELAY_STATE_PATH = os.environ.get("WARP_RELAY_STATE", "/etc/warp-webui/relay-state.json")
RELAY_DEFAULT_ENDPOINT = os.environ.get("WARP_RELAY_DEFAULT_ENDPOINT", "engage.cloudflareclient.com")
NFT_CONF = os.environ.get("WARP_RELAY_NFT_CONF", "/etc/nftables.conf")
RELAY_MULTI_PORTS = [
    500, 854, 859, 864, 878, 880, 890, 891, 894, 903, 908, 928, 934, 939, 942,
    943, 945, 946, 955, 968, 987, 988, 1002, 1010, 1014, 1018, 1070, 1074,
    1180, 1387, 1701, 1843, 2371, 2408, 2506, 3138, 3476, 3581, 3854, 4177,
    4198, 4233, 4500, 5279, 5956, 7103, 7152, 7156, 7281, 7559, 8319, 8742,
    8854, 8886,
]

LOG_BUFFER = deque(maxlen=250)


def _utc_now_iso():
    return datetime.now(timezone.utc).isoformat(timespec="seconds")


def setup_logging():
    os.makedirs(LOG_DIR, exist_ok=True)
    logger = logging.getLogger("warp-webui")
    logger.setLevel(logging.INFO)
    if not any(isinstance(h, RotatingFileHandler) for h in logger.handlers):
        fh = RotatingFileHandler(LOG_FILE, maxBytes=LOG_MAX_BYTES, backupCount=LOG_BACKUPS)
        fh.setLevel(logging.INFO)
        fh.setFormatter(logging.Formatter("%(asctime)sZ %(levelname)s %(message)s"))
        logger.addHandler(fh)
    return logger


LOGGER = setup_logging()


def log_event(level: str, message: str, **fields):
    entry = {"ts": _utc_now_iso(), "level": level, "message": message, **fields}
    LOG_BUFFER.append(entry)
    try:
        LOGGER.info(json.dumps(entry, ensure_ascii=True))
    except Exception:
        pass


def run_cmd(cmd, timeout=120):
    start = time.time()
    try:
        proc = subprocess.run(cmd, shell=False, capture_output=True, text=True, timeout=timeout)
    except FileNotFoundError as e:
        dur_ms = int((time.time() - start) * 1000)
        msg = f"command not found: {e.filename or cmd[0]}"
        log_event("error", "command_not_found", cmd=cmd, duration_ms=dur_ms, stderr=msg)
        return 127, "", msg
    except subprocess.TimeoutExpired as e:
        dur_ms = int((time.time() - start) * 1000)
        log_event("error", "command_timeout", cmd=cmd, duration_ms=dur_ms)
        return 124, "", "timeout"
    dur_ms = int((time.time() - start) * 1000)
    out = (proc.stdout or "").strip()
    err = (proc.stderr or "").strip()
    log_event(
        "info",
        "command_executed",
        cmd=cmd,
        returncode=proc.returncode,
        duration_ms=dur_ms,
        stdout_tail=out[-2000:],
        stderr_tail=err[-2000:],
    )
    return proc.returncode, out, err


def backup_file(path: str, label: str):
    os.makedirs(BACKUP_DIR, exist_ok=True)
    ts = datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S")
    base = os.path.basename(path)
    dest = os.path.join(BACKUP_DIR, f"{label}-{base}.{ts}")
    shutil.copy2(path, dest)
    return dest


def auth_config():
    return {"user": USER, "env_file": ENV_FILE}


def _env_quote(value: str) -> str:
    return shlex.quote(value)


def _write_env_values(path: str, updates: dict):
    lines = []
    seen = set()
    if os.path.isfile(path):
        with open(path, "r", encoding="utf-8") as f:
            lines = f.read().splitlines()
    new_lines = []
    for line in lines:
        stripped = line.strip()
        if not stripped or stripped.startswith("#") or "=" not in line:
            new_lines.append(line)
            continue
        key = line.split("=", 1)[0].strip()
        if key in updates:
            new_lines.append(f"{key}={_env_quote(updates[key])}")
            seen.add(key)
        else:
            new_lines.append(line)
    for key, value in updates.items():
        if key not in seen:
            new_lines.append(f"{key}={_env_quote(value)}")
    os.makedirs(os.path.dirname(path) or ".", exist_ok=True)
    tmp = path + ".tmp"
    with open(tmp, "w", encoding="utf-8") as f:
        f.write("\n".join(new_lines))
        f.write("\n")
    os.chmod(tmp, 0o600)
    os.replace(tmp, path)


def update_webui_credentials(user: str, password):
    user = (user or "").strip()
    if not re.fullmatch(r"[A-Za-z0-9_.@-]{3,64}", user):
        return 400, {"error": "Логин: 3-64 символа, латиница/цифры/._@-"}
    updates = {"WARP_WEBUI_USER": user}
    if password is not None and password != "":
        if len(password) < 8 or len(password) > 128:
            return 400, {"error": "Пароль должен быть от 8 до 128 символов"}
        if "\n" in password or "\r" in password or "\x00" in password:
            return 400, {"error": "Пароль не должен содержать перенос строки"}
        updates["WARP_WEBUI_PASS"] = password
    backup = backup_file(ENV_FILE, "env") if os.path.isfile(ENV_FILE) else None
    _write_env_values(ENV_FILE, updates)
    log_event("info", "auth_config_updated", user=user, backup=backup)
    if shutil.which("systemctl"):
        subprocess.Popen(
            ["/bin/sh", "-c", "sleep 0.6; systemctl restart warp-webui.service"],
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,
            close_fds=True,
        )
    return 200, {
        "ok": True,
        "user": user,
        "backup": backup,
        "env_file": ENV_FILE,
        "restart": "scheduled",
        "note": "Сервис перезапустится. Войдите заново с новым логином/паролем.",
    }


def parse_warp_status_text(stdout: str, stderr: str, code: int):
    connected = None
    health = None
    account = None
    device = None
    text = stdout or ""
    low = text.lower()
    if "connected" in low and "disconnected" not in low:
        connected = True
    if "disconnected" in low:
        connected = False
    for line in text.splitlines():
        l = line.strip()
        ll = l.lower()
        if ll.startswith("status") and ":" in l:
            val = l.split(":", 1)[1].strip().lower()
            if "connected" in val:
                connected = True
            if "disconnected" in val:
                connected = False
        if ll.startswith("health") and ":" in l:
            health = l.split(":", 1)[1].strip()
        if ll.startswith("account") and ":" in l:
            account = l.split(":", 1)[1].strip()
        if ll.startswith("device") and ":" in l:
            device = l.split(":", 1)[1].strip()
    return {
        "connected": connected,
        "health": health,
        "account": account,
        "device": device,
        "code": code,
        "stdout": stdout,
        "stderr": stderr,
    }


def warp_status():
    code, out, err = run_cmd(["warp-cli", "--accept-tos", "status"])
    return parse_warp_status_text(out, err, code)


def parse_registration(stdout: str):
    info = {"raw": stdout, "account_type": None, "account_id": None, "device_id": None, "license_masked": None}
    for line in (stdout or "").splitlines():
        l = line.strip()
        if l.lower().startswith("account type:"):
            info["account_type"] = l.split(":", 1)[1].strip()
        elif l.lower().startswith("account id:"):
            info["account_id"] = l.split(":", 1)[1].strip()
        elif l.lower().startswith("device id:"):
            info["device_id"] = l.split(":", 1)[1].strip()
        elif l.lower().startswith("license:"):
            lic = l.split(":", 1)[1].strip()
            if lic:
                info["license_masked"] = lic[:4] + "…" + lic[-4:] if len(lic) > 10 else lic
    return info


def warp_registration():
    code, out, err = run_cmd(["warp-cli", "--accept-tos", "registration", "show"])
    data = parse_registration(out)
    data.update({"code": code, "stderr": err})
    return data


def get_proxy_port():
    code, out, err = run_cmd(["warp-cli", "--accept-tos", "settings"])
    m = re.search(r"WarpProxy on port (\d+)", out or "")
    if m:
        return {"port": int(m.group(1)), "source": "settings", "code": code}
    code2, out2, err2 = run_cmd(["ss", "-lnt"])
    for line in (out2 or "").splitlines():
        if "127.0.0.1:" in line:
            mm = re.search(r"127\.0\.0\.1:(\d+).*warp-svc", line)
            if mm:
                return {"port": int(mm.group(1)), "source": "ss", "code": code2}
    return {"port": None, "source": "unknown", "code": code, "stderr": err}


def set_proxy_port(port: int):
    if port < 1 or port > 65535:
        return 400, {"error": "invalid port"}
    c1, o1, e1 = run_cmd(["warp-cli", "--accept-tos", "mode", "proxy"])
    c2, o2, e2 = run_cmd(["warp-cli", "--accept-tos", "proxy", "port", str(port)])
    ok = c1 == 0 and c2 == 0
    return (200 if ok else 500), {
        "port": port,
        "mode_code": c1,
        "port_code": c2,
        "stdout": "\n".join(filter(None, [o1, o2])),
        "stderr": "\n".join(filter(None, [e1, e2])),
        "proxy": get_proxy_port(),
    }


def apply_license_key(key: str):
    key = (key or "").strip()
    if not re.fullmatch(r"[A-Za-z0-9-]{8,64}", key):
        return 400, {"error": "invalid license key format"}
    code, out, err = run_cmd(["warp-cli", "--accept-tos", "registration", "license", key])
    return (200 if code == 0 else 500), {
        "result_code": code,
        "stdout": out,
        "stderr": err,
        "registration": warp_registration(),
    }


def run_script(path: str, extra_env=None):
    if not os.path.isfile(path) or not os.access(path, os.X_OK):
        return 500, {"error": "script missing", "path": path}
    env = os.environ.copy()
    if extra_env:
        env.update(extra_env)
    start = time.time()
    proc = subprocess.run([path], shell=False, capture_output=True, text=True, timeout=600, env=env)
    dur_ms = int((time.time() - start) * 1000)
    log_event(
        "info",
        "script_executed",
        path=path,
        returncode=proc.returncode,
        duration_ms=dur_ms,
        stdout_tail=(proc.stdout or "")[-2000:],
        stderr_tail=(proc.stderr or "")[-2000:],
    )
    return (
        200 if proc.returncode == 0 else 500,
        {
            "path": path,
            "result_code": proc.returncode,
            "stdout": (proc.stdout or "").strip(),
            "stderr": (proc.stderr or "").strip(),
            "duration_ms": dur_ms,
        },
    )


def ensure_socks_bridge(target_port: int):
    unit_path = "/etc/systemd/system/warp-socks-bridge.service"
    unit = f"""[Unit]
Description=WARP SOCKS bridge for Docker ({BRIDGE_HOST}:{BRIDGE_PORT})
After=network-online.target warp-svc.service
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/bin/socat TCP-LISTEN:{BRIDGE_PORT},bind={BRIDGE_HOST},reuseaddr,fork TCP:127.0.0.1:{target_port}
Restart=always
RestartSec=2

[Install]
WantedBy=multi-user.target
"""
    with open(unit_path, "w", encoding="utf-8") as f:
        f.write(unit)
    run_cmd(["systemctl", "daemon-reload"])
    c1, _, _ = run_cmd(["systemctl", "enable", "--now", "warp-socks-bridge.service"])
    c2, out, err = run_cmd(["systemctl", "is-active", "warp-socks-bridge.service"])
    return {
        "unit": unit_path,
        "bridge": f"{BRIDGE_HOST}:{BRIDGE_PORT}",
        "target": f"127.0.0.1:{target_port}",
        "enable_code": c1,
        "active": out.strip() if c2 == 0 else "unknown",
        "stderr": err,
    }


def _merge_xui_config(cfg: dict, socks_port: int):
    outbounds = cfg.setdefault("outbounds", [])
    socks = {
        "tag": SOCKS_OUTBOUND_TAG,
        "protocol": "socks",
        "settings": {
            "servers": [
                {
                    "address": "127.0.0.1",
                    "port": socks_port,
                    "users": [],
                }
            ]
        },
    }
    replaced = False
    for i, ob in enumerate(outbounds):
        if ob.get("tag") == SOCKS_OUTBOUND_TAG:
            outbounds[i] = socks
            replaced = True
            break
    if not replaced:
        outbounds.append(socks)
    routing = cfg.setdefault("routing", {})
    rules = routing.setdefault("rules", [])
    rule = {
        "type": "field",
        "domain": ["geosite:google"],
        "outboundTag": SOCKS_OUTBOUND_TAG,
    }
    if not any(r.get("outboundTag") == SOCKS_OUTBOUND_TAG and "geosite:google" in str(r.get("domain")) for r in rules):
        rules.append(rule)
    return cfg


def apply_xui_preset(socks_port: int):
    if not os.path.isfile(XUI_CONFIG):
        return 500, {"error": "x-ui config not found", "path": XUI_CONFIG}
    backup = backup_file(XUI_CONFIG, "x-ui")
    with open(XUI_CONFIG, "r", encoding="utf-8") as f:
        cfg = json.load(f)
    cfg = _merge_xui_config(cfg, socks_port)
    with open(XUI_CONFIG, "w", encoding="utf-8") as f:
        json.dump(cfg, f, ensure_ascii=False, indent=2)
    rc, out, err = run_cmd(["systemctl", "restart", "x-ui"])
    return (200 if rc == 0 else 500), {
        "backup": backup,
        "config": XUI_CONFIG,
        "socks": f"127.0.0.1:{socks_port}",
        "restart_code": rc,
        "stderr": err,
    }


def _read_amnezia_config():
    code, out, err = run_cmd(["docker", "exec", AMNEZIA_CONTAINER, "cat", AMNEZIA_CONFIG])
    if code != 0:
        return None, err or out
    return json.loads(out), ""


def _write_amnezia_config(cfg: dict):
    tmp = os.path.join(BACKUP_DIR, "amnezia-server.json.tmp")
    os.makedirs(BACKUP_DIR, exist_ok=True)
    with open(tmp, "w", encoding="utf-8") as f:
        json.dump(cfg, f, ensure_ascii=False, indent=2)
    dest = f"{AMNEZIA_CONTAINER}:{AMNEZIA_CONFIG}"
    rc, out, err = run_cmd(["docker", "cp", tmp, dest])
    if rc != 0:
        return rc, err or out
    rc2, out2, err2 = run_cmd(["docker", "restart", AMNEZIA_CONTAINER])
    return rc2, err2 or out2


def _merge_amnezia_config(cfg: dict, bridge_port: int):
    outbounds = cfg.setdefault("outbounds", [])
    socks = {
        "tag": SOCKS_OUTBOUND_TAG,
        "protocol": "socks",
        "settings": {
            "servers": [
                {
                    "address": BRIDGE_HOST,
                    "port": bridge_port,
                }
            ]
        },
    }
    replaced = False
    for i, ob in enumerate(outbounds):
        if ob.get("tag") == SOCKS_OUTBOUND_TAG:
            outbounds[i] = socks
            replaced = True
            break
    if not replaced:
        outbounds.insert(0, socks)
    routing = cfg.setdefault("routing", {})
    rules = routing.setdefault("rules", [])
    rule = {
        "type": "field",
        "domain": ["geosite:google"],
        "outboundTag": SOCKS_OUTBOUND_TAG,
    }
    if not any(r.get("outboundTag") == SOCKS_OUTBOUND_TAG and "geosite:google" in str(r.get("domain")) for r in rules):
        rules.append(rule)
    return cfg


def apply_amnezia_preset(socks_port: int):
    bridge_info = ensure_socks_bridge(socks_port)
    cfg, err = _read_amnezia_config()
    if cfg is None:
        return 500, {"error": "read amnezia config failed", "detail": err, "bridge": bridge_info}
    ts = datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S")
    snap = os.path.join(BACKUP_DIR, f"amnezia-server.json.{ts}")
    with open(snap, "w", encoding="utf-8") as f:
        json.dump(cfg, f, ensure_ascii=False, indent=2)
    cfg = _merge_amnezia_config(cfg, BRIDGE_PORT)
    rc, detail = _write_amnezia_config(cfg)
    client_rows = list_amnezia_clients_from_cfg(cfg)
    log_event(
        "info",
        "amnezia_preset_applied",
        clients=format_clients_for_log(client_rows),
    )
    return (200 if rc == 0 else 500), {
        "backup": snap,
        "bridge": bridge_info,
        "socks_via": f"{BRIDGE_HOST}:{BRIDGE_PORT} -> 127.0.0.1:{socks_port}",
        "restart_code": rc,
        "detail": detail,
        "clients": client_rows,
        "clients_display": format_clients_for_log(client_rows),
        "ok": rc == 0,
    }





_UUID_RE = re.compile(
    r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
    re.I,
)


def _short_uuid(uid: str) -> str:
    uid = (uid or "").strip()
    if len(uid) > 20:
        return uid[:8] + "…" + uid[-8:]
    return uid


def _is_uuid_like(s: str) -> bool:
    return bool(_UUID_RE.fullmatch((s or "").strip()))


def load_client_aliases() -> dict:
    try:
        if os.path.isfile(CLIENT_ALIASES_PATH):
            with open(CLIENT_ALIASES_PATH, "r", encoding="utf-8") as f:
                data = json.load(f)
            if isinstance(data, dict):
                return {str(k).lower(): str(v).strip() for k, v in data.items() if str(v).strip()}
    except Exception as e:
        log_event("warning", "aliases_load_failed", path=CLIENT_ALIASES_PATH, error=str(e))
    return {}


def save_client_aliases(aliases: dict) -> dict:
    os.makedirs(os.path.dirname(CLIENT_ALIASES_PATH) or "/etc/warp-webui", exist_ok=True)
    normalized = {}
    for k, v in (aliases or {}).items():
        key = str(k).strip().lower()
        val = str(v).strip()
        if key and val:
            normalized[key] = val
    tmp = CLIENT_ALIASES_PATH + ".tmp"
    with open(tmp, "w", encoding="utf-8") as f:
        json.dump(normalized, f, ensure_ascii=False, indent=2)
        f.write("\n")
    os.replace(tmp, CLIENT_ALIASES_PATH)
    return normalized


def resolve_client_display_name(client_id, email=None, comment=None, aliases=None):
    cid = (client_id or "").strip()
    cid_lower = cid.lower()
    aliases = aliases if aliases is not None else load_client_aliases()
    if cid_lower in aliases:
        return aliases[cid_lower], "alias"
    comment = (comment or "").strip()
    if comment and not _is_uuid_like(comment):
        return comment, "comment"
    em = (email or "").strip()
    if em and not _is_uuid_like(em) and em.lower() != cid_lower:
        return em, "email"
    return cid, "uuid"


def enrich_amnezia_client_row(c: dict, aliases=None):
    cid = (c.get("id") or "").strip()
    email = (c.get("email") or cid).strip()
    comment = (c.get("comment") or "").strip()
    display, source = resolve_client_display_name(cid, email=email, comment=comment, aliases=aliases)
    routing_user = email or cid
    return {
        "uuid": cid,
        "id": cid,
        "email": email,
        "flow": c.get("flow", ""),
        "comment": comment,
        "displayName": display,
        "shortUuid": _short_uuid(cid),
        "source": source,
        "routingUser": routing_user,
    }


def format_clients_for_log(clients):
    labels = []
    for c in clients or []:
        if isinstance(c, dict):
            name = c.get("displayName") or c.get("email") or c.get("uuid") or c.get("id")
            uid = c.get("uuid") or c.get("id") or ""
            labels.append(f"{name} ({_short_uuid(uid)})")
        else:
            labels.append(str(c))
    return labels


def users_to_display_summary(users, cfg=None):
    if cfg is None:
        cfg, _ = _read_amnezia_config()
    by_routing = {}
    if cfg:
        for row in list_amnezia_clients_from_cfg(cfg):
            by_routing[row["routingUser"]] = row
    names = []
    for u in users or []:
        row = by_routing.get(u)
        if row:
            names.append(f"{row['displayName']} ({row['shortUuid']})")
        elif _is_uuid_like(u):
            names.append(_short_uuid(u))
        else:
            names.append(u)
    return names

def list_amnezia_clients_from_cfg(cfg: dict):
    aliases = load_client_aliases()
    clients = []
    for inbound in cfg.get("inbounds", []):
        if inbound.get("protocol") != "vless":
            continue
        for c in inbound.get("settings", {}).get("clients", []):
            clients.append(enrich_amnezia_client_row(c, aliases=aliases))
    return clients


def list_amnezia_clients():
    cfg, err = _read_amnezia_config()
    if cfg is None:
        return None, err
    return list_amnezia_clients_from_cfg(cfg), ""


def _strip_managed_warp_rules(rules):
    kept = []
    for r in rules:
        if r.get("outboundTag") != SOCKS_OUTBOUND_TAG:
            kept.append(r)
            continue
        if r.get("user"):
            continue
        if "geosite:google" in str(r.get("domain", "")):
            continue
        kept.append(r)
    return kept


def _append_warp_routing_rules(cfg: dict, users, domains):
    routing = cfg.setdefault("routing", {})
    rules = routing.setdefault("rules", [])
    rules = _strip_managed_warp_rules(rules)
    domains = [d for d in (domains or ["geosite:google"]) if d]
    users = [u for u in (users or []) if u]
    if users:
        for u in users:
            rules.append({
                "type": "field",
                "user": [u],
                "domain": domains,
                "outboundTag": SOCKS_OUTBOUND_TAG,
            })
    else:
        rules.append({
            "type": "field",
            "domain": domains,
            "outboundTag": SOCKS_OUTBOUND_TAG,
        })
    routing["rules"] = rules
    return cfg


def apply_amnezia_routing(socks_port: int, users=None, domains=None):
    bridge_info = ensure_socks_bridge(socks_port)
    cfg, err = _read_amnezia_config()
    if cfg is None:
        return 500, {"error": "read amnezia config failed", "detail": err, "bridge": bridge_info}
    ts = datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S")
    snap = os.path.join(BACKUP_DIR, f"amnezia-server.json.{ts}")
    os.makedirs(BACKUP_DIR, exist_ok=True)
    with open(snap, "w", encoding="utf-8") as f:
        json.dump(cfg, f, ensure_ascii=False, indent=2)
    cfg = _merge_amnezia_config(cfg, BRIDGE_PORT)
    cfg = _append_warp_routing_rules(cfg, users, domains)
    rc, detail = _write_amnezia_config(cfg)
    client_rows = list_amnezia_clients_from_cfg(cfg)
    users_display = users_to_display_summary(users, cfg=cfg)
    log_event(
        "info",
        "amnezia_routing_applied",
        users=users or [],
        users_display=users_display,
        domains=domains or ["geosite:google"],
    )
    return (200 if rc == 0 else 500), {
        "backup": snap,
        "bridge": bridge_info,
        "users": users or [],
        "users_display": users_display,
        "domains": domains or ["geosite:google"],
        "clients": client_rows,
        "routing_rules": cfg.get("routing", {}).get("rules", []),
        "restart_code": rc,
        "detail": detail,
        "ok": rc == 0,
    }

def client_presets(socks_port: int):
    host_public = os.environ.get("WARP_PUBLIC_HOST", "")
    bridge = f"{BRIDGE_HOST}:{BRIDGE_PORT}"
    local = f"127.0.0.1:{socks_port}"
    return {
        "socks_port": socks_port,
        "local_socks": local,
        "docker_bridge_socks": bridge,
        "xray_outbound": {
            "tag": SOCKS_OUTBOUND_TAG,
            "protocol": "socks",
            "settings": {
                "servers": [{"address": "127.0.0.1", "port": socks_port}]
            },
        },
        "amnezia_outbound": {
            "tag": SOCKS_OUTBOUND_TAG,
            "protocol": "socks",
            "settings": {
                "servers": [{"address": BRIDGE_HOST, "port": BRIDGE_PORT}]
            },
        },
        "curl_example": f"curl -s --socks5-hostname {local} https://api.ipify.org",
        "v2rayN_socks": {"protocol": "socks", "server": "127.0.0.1", "port": socks_port},
        "note": f"On server use {local}; from Amnezia container use {bridge} (socat bridge).",
        "public_host_hint": host_public,
    }


def _valid_port(value) -> int:
    port = int(value)
    if port < 1 or port > 65535:
        raise ValueError("invalid port")
    return port


def _valid_ipv4(value: str) -> str:
    ip = ipaddress.ip_address((value or "").strip())
    if ip.version != 4:
        raise ValueError("IPv4 required")
    return str(ip)


def resolve_relay_endpoint(endpoint: str) -> dict:
    endpoint = (endpoint or RELAY_DEFAULT_ENDPOINT).strip()
    if not endpoint:
        raise ValueError("endpoint required")
    try:
        return {"endpoint": endpoint, "ip": _valid_ipv4(endpoint), "source": "ip"}
    except ValueError:
        pass
    if not re.fullmatch(r"[A-Za-z0-9.-]{1,253}", endpoint) or ".." in endpoint:
        raise ValueError("invalid endpoint")
    infos = socket.getaddrinfo(endpoint, None, socket.AF_INET, socket.SOCK_DGRAM)
    if not infos:
        raise ValueError("endpoint has no IPv4 address")
    return {"endpoint": endpoint, "ip": infos[0][4][0], "source": "dns"}


def get_public_ipv4() -> str:
    for url in ("https://api.ipify.org", "https://icanhazip.com", "https://ifconfig.me"):
        code, out, _ = run_cmd(["curl", "-4fsS", "--max-time", "3", url], timeout=5)
        if code == 0:
            try:
                return _valid_ipv4((out or "").strip().splitlines()[0])
            except Exception:
                continue
    raise ValueError("Не удалось определить публичный IPv4; укажите sourceIp вручную")


def detect_relay_firewall():
    if shutil.which("nft"):
        code, _, err = run_cmd(["nft", "list", "ruleset"], timeout=5)
        if code == 0 and "managed by iptables-nft" in (err or "") and shutil.which("iptables"):
            return "iptables"
        return "nftables"
    if shutil.which("iptables"):
        return "iptables"
    return None


def load_relay_state() -> dict:
    try:
        if os.path.isfile(RELAY_STATE_PATH):
            with open(RELAY_STATE_PATH, "r", encoding="utf-8") as f:
                data = json.load(f)
            if isinstance(data, dict):
                return data
    except Exception as e:
        log_event("warning", "relay_state_load_failed", path=RELAY_STATE_PATH, error=str(e))
    return {
        "enabled": False,
        "mode": "single",
        "endpoint": RELAY_DEFAULT_ENDPOINT,
        "sourceIp": "",
        "relayPort": 4500,
        "targetPort": 4500,
    }


def save_relay_state(state: dict) -> dict:
    os.makedirs(os.path.dirname(RELAY_STATE_PATH) or "/etc/warp-webui", exist_ok=True)
    state = dict(state or {})
    state["updatedAt"] = _utc_now_iso()
    tmp = RELAY_STATE_PATH + ".tmp"
    with open(tmp, "w", encoding="utf-8") as f:
        json.dump(state, f, ensure_ascii=False, indent=2)
        f.write("\n")
    os.replace(tmp, RELAY_STATE_PATH)
    return state


def enable_relay_forwarding():
    with open("/etc/sysctl.d/ipv4-forwarding.conf", "w", encoding="utf-8") as f:
        f.write("net.ipv4.ip_forward=1\n")
    return run_cmd(["sysctl", "-w", "net.ipv4.ip_forward=1"])


def _relay_nft(args, timeout=30):
    return run_cmd(["nft", *args], timeout=timeout)


def _relay_clean_nft_rules():
    code, out, err = _relay_nft(["-a", "list", "ruleset"])
    deleted = []
    if code == 0:
        family = table = chain = None
        for line in (out or "").splitlines():
            stripped = line.strip()
            mt = re.match(r"table\s+(\S+)\s+(\S+)\s+\{", stripped)
            if mt:
                family, table, chain = mt.group(1), mt.group(2), None
                continue
            mc = re.match(r"chain\s+(\S+)\s+\{", stripped)
            if mc:
                chain = mc.group(1)
                continue
            mh = re.search(r"# handle (\d+)", stripped)
            if f'comment "{RELAY_RULE_TAG}"' in stripped and mh and family and table and chain:
                rc, _, detail = _relay_nft(["delete", "rule", family, table, chain, "handle", mh.group(1)])
                deleted.append({"table": f"{family} {table}", "chain": chain, "handle": mh.group(1), "code": rc, "detail": detail})
    for table in ("nat", "filter"):
        _relay_nft(["delete", "set", "ip", table, "wr_webui_relay_ports"])
    return {"deleted": deleted, "list_code": code, "list_error": err}


def _relay_clean_iptables_rules():
    deleted = []
    for table_args in (["-t", "nat"], []):
        code, out, err = run_cmd(["iptables", *table_args, "-S"])
        if code != 0:
            deleted.append({"table": table_args or ["filter"], "code": code, "detail": err})
            continue
        for line in (out or "").splitlines():
            if RELAY_RULE_TAG not in line or not line.startswith("-A "):
                continue
            delete_args = shlex.split(line.replace("-A", "-D", 1))
            rc, _, detail = run_cmd(["iptables", *table_args, *delete_args])
            deleted.append({"table": table_args or ["filter"], "rule": line, "code": rc, "detail": detail})
    return {"deleted": deleted}


def clean_relay_rules(firewall=None) -> dict:
    firewall = firewall or detect_relay_firewall()
    if firewall == "nftables":
        return _relay_clean_nft_rules()
    if firewall == "iptables":
        return _relay_clean_iptables_rules()
    return {"error": "nftables or iptables not found"}


def _save_relay_firewall(firewall: str):
    if firewall == "nftables":
        code, out, err = _relay_nft(["list", "ruleset"])
        if code == 0:
            with open(NFT_CONF, "w", encoding="utf-8") as f:
                f.write(out)
                f.write("\n")
        if shutil.which("systemctl"):
            run_cmd(["systemctl", "enable", "nftables"])
            run_cmd(["systemctl", "restart", "nftables"])
        return {"code": code, "path": NFT_CONF, "stderr": err}
    if shutil.which("netfilter-persistent"):
        code, out, err = run_cmd(["netfilter-persistent", "save"])
        return {"code": code, "stdout": out, "stderr": err}
    return {"code": 0, "note": "iptables rules active until reboot; install netfilter-persistent to persist"}


def _apply_relay_nft(src_ip: str, dst_ip: str, relay_port: int, target_port: int, mode: str):
    cmds = [
        ["add", "table", "ip", "nat"],
        ["add", "table", "ip", "filter"],
        ["add", "chain", "ip", "nat", "prerouting", "{", "type", "nat", "hook", "prerouting", "priority", "-100", ";", "}"],
        ["add", "chain", "ip", "nat", "postrouting", "{", "type", "nat", "hook", "postrouting", "priority", "100", ";", "}"],
        ["add", "chain", "ip", "filter", "forward", "{", "type", "filter", "hook", "forward", "priority", "filter", ";", "}"],
    ]
    results = []
    critical = []
    for args in cmds:
        rc, out, err = _relay_nft(args)
        results.append({"cmd": ["nft", *args], "code": rc, "stderr": err, "stdout": out})
    if mode == "multiport":
        for table in ("nat", "filter"):
            res = _nft_result(["add", "set", "ip", table, "wr_webui_relay_ports", "{", "type", "inet_service", ";", "flags", "interval", ";", "}"])
            results.append(res)
            critical.append(res)
            for port in RELAY_MULTI_PORTS:
                res = _nft_result(["add", "element", "ip", table, "wr_webui_relay_ports", "{", str(port), "}"])
                results.append(res)
                critical.append(res)
        rule_cmds = [
            ["add", "rule", "ip", "nat", "prerouting", "ip", "daddr", src_ip, "udp", "dport", "@wr_webui_relay_ports", "dnat", "to", dst_ip, "comment", RELAY_RULE_TAG],
            ["add", "rule", "ip", "nat", "postrouting", "ip", "daddr", dst_ip, "udp", "dport", "@wr_webui_relay_ports", "masquerade", "comment", RELAY_RULE_TAG],
            ["add", "rule", "ip", "filter", "forward", "ip", "daddr", dst_ip, "udp", "dport", "@wr_webui_relay_ports", "accept", "comment", RELAY_RULE_TAG],
            ["add", "rule", "ip", "filter", "forward", "ip", "saddr", dst_ip, "udp", "sport", "@wr_webui_relay_ports", "accept", "comment", RELAY_RULE_TAG],
        ]
    else:
        rule_cmds = [
            ["add", "rule", "ip", "nat", "prerouting", "ip", "daddr", src_ip, "udp", "dport", str(relay_port), "dnat", "to", f"{dst_ip}:{target_port}", "comment", RELAY_RULE_TAG],
            ["add", "rule", "ip", "nat", "postrouting", "ip", "daddr", dst_ip, "udp", "dport", str(target_port), "masquerade", "comment", RELAY_RULE_TAG],
            ["add", "rule", "ip", "filter", "forward", "ip", "daddr", dst_ip, "udp", "dport", str(target_port), "accept", "comment", RELAY_RULE_TAG],
            ["add", "rule", "ip", "filter", "forward", "ip", "saddr", dst_ip, "udp", "sport", str(target_port), "accept", "comment", RELAY_RULE_TAG],
        ]
    for args in rule_cmds:
        res = _nft_result(args)
        results.append(res)
        critical.append(res)
    failures = [r for r in critical if r.get("code") not in (0,)]
    return failures, results


def _nft_result(args):
    rc, out, err = _relay_nft(args)
    return {"cmd": ["nft", *args], "code": rc, "stdout": out, "stderr": err}


def _apply_relay_iptables(src_ip: str, dst_ip: str, relay_port: int, target_port: int, mode: str):
    results = []
    if mode == "multiport":
        for i in range(0, len(RELAY_MULTI_PORTS), 15):
            ports_csv = ",".join(str(p) for p in RELAY_MULTI_PORTS[i:i + 15])
            cmd_groups = [
                ["iptables", "-t", "nat", "-A", "PREROUTING", "-d", src_ip, "-p", "udp", "-m", "multiport", "--dports", ports_csv, "-j", "DNAT", "--to-destination", dst_ip, "-m", "comment", "--comment", RELAY_RULE_TAG],
                ["iptables", "-t", "nat", "-A", "POSTROUTING", "-p", "udp", "-d", dst_ip, "-m", "multiport", "--dports", ports_csv, "-j", "MASQUERADE", "-m", "comment", "--comment", RELAY_RULE_TAG],
                ["iptables", "-A", "FORWARD", "-p", "udp", "-d", dst_ip, "-m", "multiport", "--dports", ports_csv, "-j", "ACCEPT", "-m", "comment", "--comment", RELAY_RULE_TAG],
                ["iptables", "-A", "FORWARD", "-p", "udp", "-s", dst_ip, "-m", "multiport", "--sports", ports_csv, "-j", "ACCEPT", "-m", "comment", "--comment", RELAY_RULE_TAG],
            ]
            for cmd in cmd_groups:
                rc, out, err = run_cmd(cmd)
                results.append({"cmd": cmd, "code": rc, "stdout": out, "stderr": err})
    else:
        cmd_groups = [
            ["iptables", "-t", "nat", "-A", "PREROUTING", "-d", src_ip, "-p", "udp", "--dport", str(relay_port), "-j", "DNAT", "--to-destination", f"{dst_ip}:{target_port}", "-m", "comment", "--comment", RELAY_RULE_TAG],
            ["iptables", "-t", "nat", "-A", "POSTROUTING", "-p", "udp", "-d", dst_ip, "--dport", str(target_port), "-j", "MASQUERADE", "-m", "comment", "--comment", RELAY_RULE_TAG],
            ["iptables", "-A", "FORWARD", "-p", "udp", "-d", dst_ip, "--dport", str(target_port), "-j", "ACCEPT", "-m", "comment", "--comment", RELAY_RULE_TAG],
            ["iptables", "-A", "FORWARD", "-p", "udp", "-s", dst_ip, "--sport", str(target_port), "-j", "ACCEPT", "-m", "comment", "--comment", RELAY_RULE_TAG],
        ]
        for cmd in cmd_groups:
            rc, out, err = run_cmd(cmd)
            results.append({"cmd": cmd, "code": rc, "stdout": out, "stderr": err})
    failures = [r for r in results if r.get("code") != 0]
    return failures, results


def relay_rules_status() -> dict:
    firewall = detect_relay_firewall()
    state = load_relay_state()
    if firewall == "nftables":
        code, out, err = _relay_nft(["list", "ruleset"])
        lines = [l.strip() for l in (out or "").splitlines() if RELAY_RULE_TAG in l or "wr_webui_relay_ports" in l]
        return {"firewall": firewall, "tag": RELAY_RULE_TAG, "state": state, "enabled": bool(lines), "rules": lines, "code": code, "stderr": err}
    if firewall == "iptables":
        lines = []
        for table_args in (["-t", "nat"], []):
            code, out, err = run_cmd(["iptables", *table_args, "-S"])
            if code == 0:
                lines.extend([l for l in (out or "").splitlines() if RELAY_RULE_TAG in l])
        return {"firewall": firewall, "tag": RELAY_RULE_TAG, "state": state, "enabled": bool(lines), "rules": lines}
    return {"firewall": None, "tag": RELAY_RULE_TAG, "state": state, "enabled": False, "rules": [], "error": "nftables or iptables not found"}


def apply_relay_config(body: dict):
    try:
        mode = (body.get("mode") or "single").strip()
        if mode not in ("single", "multiport"):
            return 400, {"error": "mode must be single or multiport"}
        endpoint_info = resolve_relay_endpoint(body.get("endpoint") or RELAY_DEFAULT_ENDPOINT)
        src_ip = _valid_ipv4(body.get("sourceIp") or get_public_ipv4())
        relay_port = _valid_port(body.get("relayPort") or 4500)
        target_port = _valid_port(body.get("targetPort") or relay_port)
    except Exception as e:
        return 400, {"error": str(e)}

    firewall = detect_relay_firewall()
    if not firewall:
        return 500, {"error": "nftables or iptables not found"}

    clean = clean_relay_rules(firewall)
    fwd_code, fwd_out, fwd_err = enable_relay_forwarding()
    if firewall == "nftables":
        failures, results = _apply_relay_nft(src_ip, endpoint_info["ip"], relay_port, target_port, mode)
    else:
        failures, results = _apply_relay_iptables(src_ip, endpoint_info["ip"], relay_port, target_port, mode)
    save = _save_relay_firewall(firewall)
    state = save_relay_state({
        "enabled": not failures,
        "mode": mode,
        "endpoint": endpoint_info["endpoint"],
        "endpointIp": endpoint_info["ip"],
        "endpointSource": endpoint_info["source"],
        "sourceIp": src_ip,
        "relayPort": relay_port,
        "targetPort": target_port,
        "ports": RELAY_MULTI_PORTS if mode == "multiport" else [relay_port],
        "tag": RELAY_RULE_TAG,
    })
    payload = {
        "ok": not failures,
        "firewall": firewall,
        "clean": clean,
        "forwarding": {"code": fwd_code, "stdout": fwd_out, "stderr": fwd_err},
        "save": save,
        "state": state,
        "failures": failures[:8],
        "result_count": len(results),
        "status": relay_rules_status(),
    }
    log_event("info" if not failures else "error", "relay_apply", firewall=firewall, state=state, failures=len(failures))
    return (200 if not failures else 500), payload


def remove_relay_config():
    firewall = detect_relay_firewall()
    clean = clean_relay_rules(firewall)
    save = _save_relay_firewall(firewall) if firewall else {"code": 0}
    state = load_relay_state()
    state["enabled"] = False
    state = save_relay_state(state)
    log_event("info", "relay_removed", firewall=firewall)
    return 200, {"ok": True, "firewall": firewall, "clean": clean, "save": save, "state": state, "status": relay_rules_status()}


def read_json_body(handler, max_bytes=16384):
    try:
        length = int(handler.headers.get("Content-Length", "0"))
    except ValueError:
        length = 0
    if length > max_bytes:
        raise ValueError("body too large")
    raw = handler.rfile.read(length) if length else b""
    if not raw:
        return {}
    return json.loads(raw.decode("utf-8"))



INDEX_HTML = r"""<!doctype html>
<html lang="ru">
<head>
  <meta charset="utf-8"/>
  <meta name="viewport" content="width=device-width, initial-scale=1"/>
  <title>WARP Web UI</title>
  <style>
    body { font-family: ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, Arial; margin: 24px; background:#0b1020; color:#e7e9ee; }
    h2,h3 { margin: 0 0 10px 0; }
    .row { display:flex; gap:10px; flex-wrap:wrap; align-items:center; }
    input, textarea, select { padding:8px 10px; border-radius:8px; border:1px solid #2a355a; background:#0b1020; color:#e7e9ee; min-width: 220px; }
    textarea { width: 100%; min-height: 110px; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 12px; }
    button { padding:10px 14px; border-radius:10px; border:1px solid #2a355a; background:#121a34; color:#e7e9ee; cursor:pointer; }
    button:hover { background:#172145; }
    button.secondary { background:#1a2448; }
    button.danger { border-color:#7f1d1d; background:#3f1212; }
    button:disabled { opacity:.55; cursor:not-allowed; }
    .card { border:1px solid #2a355a; background:#0f1630; border-radius:14px; padding:14px; margin-top:14px; }
    .kv { display:grid; grid-template-columns: 170px 1fr; gap:8px 12px; }
    .k { color:#9aa7c7; }
    pre { white-space:pre-wrap; word-break:break-word; margin:0; }
    .muted { color:#9aa7c7; font-size: 12px; }
    .ok { color:#6ee7b7; }
    .bad { color:#fca5a5; }
    .msg { margin-top:8px; font-size: 13px; }
    .hint { color:#9aa7c7; font-size:12px; line-height:1.45; margin:8px 0 0 0; }
  </style>
</head>
<body>
  <h2>WARP Web UI</h2>
  <div class="muted">Панель управления Cloudflare WARP. Авторизация Basic Auth. Автообновление каждые 4 секунды.</div>

  <div class="card">
    <div class="row">
      <button id="btnConnect" title="Подключить WARP через warp-cli connect">Подключить WARP</button>
      <button id="btnDisconnect" title="Отключить WARP через warp-cli disconnect">Отключить WARP</button>
      <button id="btnRestart" title="Перезапустить системный сервис warp-svc">Перезапустить warp-svc</button>
      <button id="btnRefresh" title="Обновить данные сейчас">Обновить</button>
      <span id="statusBadge" class="muted"></span>
    </div>
  </div>

  <div class="card">
    <h3>Доступ к панели</h3>
    <p class="hint">Здесь можно сменить логин и пароль веб-панели. Настройки сохраняются в <code>/etc/default/warp-webui</code>, затем сервис перезапускается. После сохранения браузер попросит войти заново.</p>
    <div class="kv">
      <div class="k">Текущий логин</div><div id="authUser">-</div>
      <div class="k">Файл настроек</div><div id="authEnvFile">-</div>
    </div>
    <div class="row" style="margin-top:12px">
      <input id="authUserInput" placeholder="Новый логин, например warpadmin" autocomplete="username"/>
      <input id="authPassInput" type="password" placeholder="Новый пароль, минимум 8 символов" autocomplete="new-password"/>
      <button id="btnAuthSave" class="secondary" title="Сохранить логин/пароль и перезапустить панель">Сохранить доступ</button>
    </div>
    <div id="authMsg" class="msg muted"></div>
  </div>

  <div class="card">
    <h3>Аккаунт WARP</h3>
    <p class="hint">Информация из <code>warp-cli registration show</code>. Если WARP ещё не установлен, здесь будет ошибка <code>command not found: warp-cli</code>.</p>
    <div class="kv">
      <div class="k">Тип аккаунта</div><div id="rType">-</div>
      <div class="k">ID аккаунта</div><div id="rAccountId">-</div>
      <div class="k">ID устройства</div><div id="rDeviceId">-</div>
      <div class="k">Лицензия</div><div id="rLicense">-</div>
    </div>
    <div class="row" style="margin-top:12px">
      <input id="licenseKey" placeholder="Ключ лицензии WARP+" autocomplete="off"/>
      <button id="btnLicense" class="secondary" title="Применить ключ WARP+ через warp-cli">Применить лицензию</button>
    </div>
    <div id="accountMsg" class="msg muted"></div>
  </div>

  <div class="card">
    <h3>Пакет Cloudflare WARP</h3>
    <p class="hint">Установка ставит официальный пакет <code>cloudflare-warp</code> для Debian/Ubuntu. После установки можно подключить WARP и включить SOCKS proxy.</p>
    <div class="row">
      <button id="btnInstall" title="Установить официальный пакет cloudflare-warp">Установить WARP</button>
      <button id="btnUninstall" class="danger" title="Удалить пакет cloudflare-warp">Удалить WARP</button>
    </div>
    <div id="installMsg" class="msg muted"></div>
  </div>

  <div class="card">
    <h3>SOCKS proxy порт</h3>
    <p class="hint">Режим <code>warp-cli mode proxy</code> поднимает локальный SOCKS на <code>127.0.0.1:порт</code>. Его используют 3x-ui, Amnezia и другие клиенты на этом сервере.</p>
    <div class="kv">
      <div class="k">Текущий порт</div><div id="proxyPort">-</div>
      <div class="k">Локальный адрес</div><div id="proxyEndpoint">-</div>
    </div>
    <div class="row" style="margin-top:12px">
      <input id="proxyPortInput" type="number" min="1" max="65535" placeholder="например 40000"/>
      <button id="btnSetPort" class="secondary" title="Сменить порт SOCKS proxy">Сохранить порт</button>
      <button id="btnPort40000" class="secondary" title="Быстро поставить порт 40000">Поставить 40000</button>
    </div>
    <div id="proxyMsg" class="msg muted"></div>
  </div>

  <div class="card">
    <h3>WARP Relay (beta)</h3>
    <p class="hint">Relay перенаправляет UDP WireGuard/WARP трафик через firewall rules. Это не гарантирует конкретную страну Cloudflare, но позволяет выбрать endpoint/IP, к которому будет идти подключение.</p>
    <div class="kv">
      <div class="k">Firewall</div><div id="relayFirewall">-</div>
      <div class="k">Активен</div><div id="relayEnabled">-</div>
      <div class="k">IP endpoint</div><div id="relayEndpointIp">-</div>
      <div class="k">Правил</div><div id="relayRuleCount">-</div>
    </div>
    <div class="row" style="margin-top:12px">
      <input id="relayEndpoint" placeholder="engage.cloudflareclient.com или IPv4" title="Целевой WARP/WireGuard endpoint"/>
      <input id="relaySourceIp" placeholder="публичный IPv4, пусто = авто" title="IP этого сервера, на который приходит UDP трафик"/>
      <select id="relayMode">
        <option value="single">Один UDP порт</option>
        <option value="multiport">Cloudflare WARP multiport</option>
      </select>
      <input id="relayPort" type="number" min="1" max="65535" placeholder="порт relay"/>
      <input id="relayTargetPort" type="number" min="1" max="65535" placeholder="порт endpoint"/>
    </div>
    <div class="row" style="margin-top:12px">
      <button id="btnRelayApply" class="secondary" title="Создать firewall rules только с тегом WR_WEBUI_RELAY">Включить relay</button>
      <button id="btnRelayRemove" class="danger" title="Удалить только managed rules с тегом WR_WEBUI_RELAY">Удалить relay rules</button>
    </div>
    <div id="relayMsg" class="msg muted"></div>
    <pre id="relayRules" style="margin-top:10px"></pre>
  </div>

  <div class="card">
    <h3>3x-ui / Xray</h3>
    <p class="hint">Добавляет outbound <code>warp-socks</code> на <code>127.0.0.1:PORT</code> и правило маршрутизации <code>geosite:google</code>. Перед изменением создаётся backup конфига.</p>
    <button id="btnXui" class="secondary">Применить preset к x-ui</button>
    <div id="xuiMsg" class="msg muted"></div>
  </div>

  <div class="card">
    <h3>Amnezia Xray (Docker)</h3>
    <p class="muted">Мост <code>172.17.0.1:11025</code> → SOCKS на хосте. В маршрутизации Xray по-прежнему UUID/email; в UI — понятные имена (алиасы: <code>/etc/warp-webui/client-aliases.json</code>).</p>
    <button id="btnAmnezia" class="secondary">Применить preset к Amnezia (все клиенты, geosite:google)</button>
    <div id="amneziaMsg" class="msg muted"></div>
    <h4 style="margin-top:16px">WARP только для выбранных клиентов</h4>
    <p class="muted">Отметьте клиентов по имени. Ничего не выбрано → общее правило geosite. Имя можно сохранить — переживёт перезапуск UI.</p>
    <div id="amneziaClientList" class="muted">Загрузка клиентов...</div>
    <div class="row" style="margin-top:8px">
      <input id="amneziaDomains" placeholder="домены через запятую, по умолчанию geosite:google" style="flex:1"/>
    </div>
    <button id="btnAmneziaRouting" class="secondary" style="margin-top:8px">Применить WARP-маршрутизацию для выбранных</button>
    <div id="amneziaRoutingMsg" class="msg muted"></div>
  </div>

  <div class="card">
    <h3>Готовые пресеты для клиентов (JSON)</h3>
    <p class="hint">Можно скопировать JSON и использовать как подсказку при настройке Xray/v2rayN/Amnezia.</p>
    <textarea id="presetsJson" readonly></textarea>
    <button id="btnCopyPresets" class="secondary" style="margin-top:8px">Скопировать JSON</button>
  </div>

  <div class="card">
    <h3>Статус WARP</h3>
    <div class="kv">
      <div class="k">Подключен</div><div id="sConnected">-</div>
      <div class="k">Health</div><div id="sHealth">-</div>
      <div class="k">Аккаунт</div><div id="sAccount">-</div>
      <div class="k">Устройство</div><div id="sDevice">-</div>
      <div class="k">Последний stderr</div><div><pre id="sStderr"></pre></div>
      <div class="k">Последний stdout</div><div><pre id="sStdout"></pre></div>
    </div>
  </div>

  <div class="card">
    <h3>Последние события</h3>
    <div class="muted" id="logMeta"></div>
    <pre id="logText" style="margin-top:10px"></pre>
  </div>

<script>
const el = (id) => document.getElementById(id);
function badge(text, ok=null) {
  const b = el('statusBadge');
  b.textContent = text;
  b.className = ok === true ? 'ok' : ok === false ? 'bad' : 'muted';
}
function setText(id, v) {
  el(id).textContent = (v === null || v === undefined || v === '') ? '-' : String(v);
}
function setMsg(id, text, ok=null) {
  const n = el(id);
  n.textContent = text || '';
  n.className = 'msg ' + (ok === true ? 'ok' : ok === false ? 'bad' : 'muted');
}
async function api(path, opts={}) {
  const url = new URL(path, window.location.origin);
  const res = await fetch(url, { cache: 'no-store', ...opts });
  const ct = res.headers.get('content-type') || '';
  const body = ct.includes('application/json') ? await res.json() : await res.text();
  if (!res.ok) throw new Error(typeof body === 'string' ? body : JSON.stringify(body));
  return body;
}
async function apiPost(path, payload) {
  return api(path, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload || {}) });
}
async function refreshAuthConfig() {
  try {
    const cfg = await api('/auth-config');
    setText('authUser', cfg.user);
    setText('authEnvFile', cfg.env_file);
    if (!el('authUserInput').value) el('authUserInput').value = cfg.user || '';
  } catch (e) { setMsg('authMsg', 'Не удалось загрузить настройки доступа: ' + (e.message || e), false); }
}
async function refreshStatus() {
  try {
    const data = await api('/status');
    setText('sConnected', data.connected);
    setText('sHealth', data.health);
    setText('sAccount', data.account);
    setText('sDevice', data.device);
    setText('sStdout', (data.stdout || '').slice(-4000));
    setText('sStderr', (data.stderr || '').slice(-4000));
    if (data.connected === true) badge('WARP подключен', true);
    else if (data.connected === false) badge('WARP отключен', false);
    else badge('Статус неизвестен');
    el('btnConnect').disabled = data.connected === true;
    el('btnDisconnect').disabled = data.connected === false;
  } catch (e) { badge('Ошибка /status', false); }
}
async function refreshRegistration() {
  try {
    const r = await api('/registration');
    setText('rType', r.account_type);
    setText('rAccountId', r.account_id);
    setText('rDeviceId', r.device_id);
    setText('rLicense', r.license_masked);
  } catch (e) { setMsg('accountMsg', 'Не удалось загрузить регистрацию WARP', false); }
}
async function refreshProxy() {
  try {
    const p = await api('/proxy');
    setText('proxyPort', p.port);
    setText('proxyEndpoint', p.port ? ('127.0.0.1:' + p.port) : '-');
    if (p.port && !el('proxyPortInput').value) el('proxyPortInput').value = p.port;
  } catch (e) { setMsg('proxyMsg', 'Не удалось загрузить SOCKS порт', false); }
}
async function refreshPresets() {
  try {
    const p = await api('/presets');
    el('presetsJson').value = JSON.stringify(p, null, 2);
  } catch (e) { el('presetsJson').value = 'Не удалось загрузить пресеты'; }
}
async function refreshRelay() {
  try {
    const r = await api('/relay');
    const st = r.state || {};
    setText('relayFirewall', r.firewall);
    setText('relayEnabled', r.enabled);
    setText('relayEndpointIp', st.endpointIp);
    setText('relayRuleCount', (r.rules || []).length);
    if (!el('relayEndpoint').value) el('relayEndpoint').value = st.endpoint || 'engage.cloudflareclient.com';
    if (!el('relaySourceIp').value) el('relaySourceIp').value = st.sourceIp || '';
    if (!el('relayPort').value) el('relayPort').value = st.relayPort || 4500;
    if (!el('relayTargetPort').value) el('relayTargetPort').value = st.targetPort || 4500;
    el('relayMode').value = st.mode || 'single';
    el('relayRules').textContent = (r.rules || []).join('\n');
  } catch (e) { setMsg('relayMsg', 'Не удалось загрузить статус relay: ' + (e.message || e), false); }
}
async function refreshLogs() {
  try {
    const data = await api('/logs');
    const lines = (data.entries || []).map(e => {
      const ts = e.ts || '';
      const lvl = e.level || '';
      const msg = e.message || '';
      const action = e.action ? ` action=${e.action}` : '';
      const rc = (e.returncode !== undefined) ? ` rc=${e.returncode}` : '';
      return `${ts} ${lvl} ${msg}${action}${rc}`;
    });
    el('logMeta').textContent = `событий: ${lines.length}`;
    el('logText').textContent = lines.join('\n');
  } catch (e) { el('logMeta').textContent = 'не удалось загрузить события'; }
}
async function refreshAll() {
  await Promise.all([refreshAuthConfig(), refreshStatus(), refreshRegistration(), refreshProxy(), refreshPresets(), refreshRelay(), refreshLogs(), refreshAmneziaClients()]);
}
async function doAction(path) {
  badge('Выполняю...', null);
  try { await api(path, { method: 'POST' }); badge('OK ' + path, true); }
  catch (e) { badge('Ошибка ' + path, false); }
  await refreshAll();
}
el('btnConnect').onclick = () => doAction('/connect');
el('btnDisconnect').onclick = () => doAction('/disconnect');
el('btnRestart').onclick = () => doAction('/restart');
el('btnRefresh').onclick = () => refreshAll();
el('btnAuthSave').onclick = async () => {
  const user = el('authUserInput').value.trim();
  const password = el('authPassInput').value;
  if (!user) return setMsg('authMsg', 'Введите новый логин', false);
  if (password && password.length < 8) return setMsg('authMsg', 'Пароль должен быть минимум 8 символов', false);
  if (!confirm('Сохранить новый доступ и перезапустить панель? После этого нужно войти заново.')) return;
  setMsg('authMsg', 'Сохраняю доступ и перезапускаю сервис...', null);
  try {
    const payload = { user };
    if (password) payload.password = password;
    const r = await apiPost('/auth-config', payload);
    el('authPassInput').value = '';
    setMsg('authMsg', r.note || 'Сохранено. Войдите заново.', true);
  } catch (e) { setMsg('authMsg', String(e.message || e), false); }
};
el('btnLicense').onclick = async () => {
  const key = el('licenseKey').value.trim();
  setMsg('accountMsg', 'Применяю лицензию...', null);
  try {
    const r = await apiPost('/license', { key });
    setMsg('accountMsg', (r.stderr || r.stdout || 'Лицензия применена').slice(0, 500), true);
    el('licenseKey').value = '';
    await refreshRegistration();
  } catch (e) { setMsg('accountMsg', String(e.message || e), false); }
};
el('btnInstall').onclick = async () => {
  if (!confirm('Установить пакет Cloudflare WARP на этот сервер?')) return;
  setMsg('installMsg', 'Запускаю установку WARP...', null);
  try {
    const r = await apiPost('/warp-install', {});
    setMsg('installMsg', (r.stdout || r.stderr || 'Готово').slice(0, 800), r.result_code === 0);
    await refreshAll();
  } catch (e) { setMsg('installMsg', String(e.message || e), false); }
};
el('btnUninstall').onclick = async () => {
  if (!confirm('Удалить пакет cloudflare-warp?')) return;
  setMsg('installMsg', 'Запускаю удаление WARP...', null);
  try {
    const r = await apiPost('/warp-uninstall', {});
    setMsg('installMsg', (r.stdout || r.stderr || 'Готово').slice(0, 800), r.result_code === 0);
  } catch (e) { setMsg('installMsg', String(e.message || e), false); }
};
async function setPort(port) {
  setMsg('proxyMsg', 'Сохраняю порт ' + port + '...', null);
  try {
    const r = await apiPost('/proxy-port', { port });
    setMsg('proxyMsg', 'Порт обновлен: ' + (r.proxy && r.proxy.port), true);
    await refreshProxy();
    await refreshPresets();
  } catch (e) { setMsg('proxyMsg', String(e.message || e), false); }
}
el('btnSetPort').onclick = () => {
  const p = parseInt(el('proxyPortInput').value, 10);
  if (!p) return setMsg('proxyMsg', 'Введите корректный порт', false);
  setPort(p);
};
el('btnPort40000').onclick = () => { el('proxyPortInput').value = 40000; setPort(40000); };
el('btnRelayApply').onclick = async () => {
  if (!confirm('Включить WARP Relay и применить firewall rules на сервере?')) return;
  const payload = {
    endpoint: el('relayEndpoint').value.trim() || 'engage.cloudflareclient.com',
    sourceIp: el('relaySourceIp').value.trim(),
    mode: el('relayMode').value,
    relayPort: parseInt(el('relayPort').value || '4500', 10),
    targetPort: parseInt(el('relayTargetPort').value || el('relayPort').value || '4500', 10),
  };
  setMsg('relayMsg', 'Применяю relay rules...', null);
  try {
    const r = await apiPost('/relay-apply', payload);
    const st = r.state || {};
    setMsg('relayMsg', 'Готово: ' + st.sourceIp + ':' + st.relayPort + ' -> ' + st.endpointIp + ':' + st.targetPort, true);
    await refreshRelay();
  } catch (e) { setMsg('relayMsg', String(e.message || e), false); }
};
el('btnRelayRemove').onclick = async () => {
  if (!confirm('Удалить только WARP Web UI relay rules?')) return;
  setMsg('relayMsg', 'Удаляю relay rules...', null);
  try {
    await apiPost('/relay-remove', {});
    setMsg('relayMsg', 'Relay rules удалены', true);
    await refreshRelay();
  } catch (e) { setMsg('relayMsg', String(e.message || e), false); }
};
el('btnXui').onclick = async () => {
  setMsg('xuiMsg', 'Применяю preset x-ui...', null);
  try {
    const r = await apiPost('/xui-preset', {});
    setMsg('xuiMsg', 'Backup: ' + (r.backup || '-') + '; код перезапуска=' + r.restart_code, r.restart_code === 0);
  } catch (e) { setMsg('xuiMsg', String(e.message || e), false); }
};

async function refreshAmneziaClients() {
  const box = el('amneziaClientList');
  try {
    const data = await api('/amnezia-clients');
    const clients = data.clients || [];
    if (!clients.length) {
      box.innerHTML = '<span class="muted">Нет VLESS-клиентов в server.json</span>';
      return;
    }
    box.innerHTML = clients.map((c) => {
      const routing = c.routingUser || c.email || c.uuid || c.id;
      const name = c.displayName || routing;
      const short = c.shortUuid || routing;
      const src = c.source === 'alias' ? 'алиас' : (c.source === 'email' ? 'email' : (c.source === 'comment' ? 'comment' : 'uuid'));
      const escRoute = String(routing).replace(/"/g, '&quot;');
      const escUuid = String(c.uuid || c.id).replace(/"/g, '&quot;');
      const escName = String(name).replace(/"/g, '&quot;');
      return '<div style="margin:8px 0;padding:6px 0;border-bottom:1px solid #2a2a2a">' +
        '<label><input type="checkbox" class="amz-client" value="' + escRoute + '"/> ' +
        '<strong>' + escName + '</strong> <span class="muted">(' + short + ', ' + src + ')</span></label>' +
        '<div class="row" style="margin-top:4px;gap:6px">' +
        '<input class="amz-alias" data-uuid="' + escUuid + '" value="' + escName + '" style="flex:1" placeholder="Имя в интерфейсе"/>' +
        '<button type="button" class="secondary amz-save-alias" data-uuid="' + escUuid + '">Сохранить имя</button>' +
        '</div></div>';
    }).join('');
    box.querySelectorAll('.amz-save-alias').forEach((btn) => {
      btn.onclick = async () => {
        const uuid = btn.getAttribute('data-uuid');
        const inp = box.querySelector('.amz-alias[data-uuid="' + uuid + '"]');
        const displayName = inp ? inp.value.trim() : '';
        if (!displayName) return setMsg('amneziaRoutingMsg', 'Введите имя', false);
        try {
          await apiPost('/amnezia-client-alias', { uuid, displayName });
          setMsg('amneziaRoutingMsg', 'Имя сохранено', true);
          await refreshAmneziaClients();
        } catch (e) { setMsg('amneziaRoutingMsg', String(e.message || e), false); }
      };
    });
  } catch (e) {
    box.textContent = 'Не удалось загрузить клиентов: ' + (e.message || e);
  }
}
el('btnAmnezia').onclick = async () => {
  setMsg('amneziaMsg', 'Применяю preset Amnezia...', null);
  try {
    const r = await apiPost('/amnezia-preset', {});
    const names = (r.clients_display || []).join(', ');
    setMsg('amneziaMsg', (names ? ('Клиенты: ' + names + '. ') : '') + 'restart rc=' + r.restart_code, r.restart_code === 0);
  } catch (e) { setMsg('amneziaMsg', String(e.message || e), false); }
};

el('btnAmneziaRouting').onclick = async () => {
  const users = Array.from(document.querySelectorAll('.amz-client:checked')).map((n) => n.value);
  const domRaw = (el('amneziaDomains').value || '').trim();
  const domains = domRaw ? domRaw.split(',').map((s) => s.trim()).filter(Boolean) : ['geosite:google'];
  setMsg('amneziaRoutingMsg', users.length ? ('Применяю для ' + users.length + ' клиент(ов)...') : 'Применяю общее правило geosite...', null);
  try {
    const r = await apiPost('/amnezia-routing', { users, domains });
    const who = (r.users_display && r.users_display.length) ? r.users_display.join(', ') : 'все (geosite)';
    setMsg('amneziaRoutingMsg', 'OK: ' + who + '; rules=' + ((r.routing_rules && r.routing_rules.length) || 0), r.ok);
    await refreshAmneziaClients();
  } catch (e) { setMsg('amneziaRoutingMsg', String(e.message || e), false); }
};

el('btnCopyPresets').onclick = async () => {
  try { await navigator.clipboard.writeText(el('presetsJson').value); setMsg('accountMsg', 'Presets copied', true); }
  catch (e) { setMsg('accountMsg', 'Не удалось скопировать', false); }
};
refreshAll();
setInterval(refreshAll, 4000);
</script>
</body>
</html>"""


class Handler(BaseHTTPRequestHandler):
    def _auth_ok(self):
        header = self.headers.get("Authorization", "")
        if not header.startswith("Basic "):
            return False
        token = header.split(" ", 1)[1].strip()
        creds = USER + ":" + PASS
        expected = base64.b64encode(creds.encode()).decode()
        return token == expected

    def _unauthorized(self, content_type="application/json"):
        self.send_response(401)
        self.send_header("WWW-Authenticate", 'Basic realm="warp-webui"')
        self.send_header("Content-Type", content_type)
        self.end_headers()
        if content_type == "application/json":
            self.wfile.write(json.dumps({"error": "unauthorized"}).encode())
        else:
            self.wfile.write(b"unauthorized")

    def _json(self, code, payload):
        self.send_response(code)
        self.send_header("Content-Type", "application/json")
        self.end_headers()
        self.wfile.write(json.dumps(payload, ensure_ascii=True).encode())

    def _html(self, code, html: str):
        self.send_response(code)
        self.send_header("Content-Type", "text/html; charset=utf-8")
        self.end_headers()
        self.wfile.write(html.encode("utf-8"))

    def do_GET(self):
        if not self._auth_ok():
            return self._unauthorized(content_type="text/plain")
        if self.path == "/":
            log_event("info", "ui_loaded", client=self.client_address[0])
            return self._html(200, INDEX_HTML)
        if self.path == "/status":
            return self._json(200, warp_status())
        if self.path == "/registration":
            return self._json(200, warp_registration())
        if self.path == "/proxy":
            return self._json(200, get_proxy_port())
        if self.path == "/auth-config":
            return self._json(200, auth_config())
        if self.path == "/relay":
            return self._json(200, relay_rules_status())
        if self.path == "/amnezia-clients":
            clients, err = list_amnezia_clients()
            if clients is None:
                return self._json(500, {"error": "read failed", "detail": err})
            warp_rules = []
            cfg, _ = _read_amnezia_config()
            if cfg:
                warp_rules = [r for r in cfg.get("routing", {}).get("rules", []) if r.get("outboundTag") == SOCKS_OUTBOUND_TAG]
            return self._json(200, {
                "clients": clients,
                "warp_rules": warp_rules,
                "aliases_path": CLIENT_ALIASES_PATH,
            })
        if self.path == "/presets":
            p = get_proxy_port().get("port") or 1024
            return self._json(200, client_presets(int(p)))
        if self.path == "/logs":
            return self._json(200, {"entries": list(LOG_BUFFER)})
        return self._json(404, {"error": "not found"})

    def do_POST(self):
        if not self._auth_ok():
            return self._unauthorized()
        log_event("info", "action_requested", action=self.path, client=self.client_address[0])

        action_map = {
            "/connect": ["warp-cli", "--accept-tos", "connect"],
            "/disconnect": ["warp-cli", "--accept-tos", "disconnect"],
            "/restart": ["systemctl", "restart", "warp-svc"],
        }
        if self.path in action_map:
            code, out, err = run_cmd(action_map[self.path])
            if self.path == "/restart":
                time.sleep(1.0)
            payload = {
                "action": self.path,
                "result_code": code,
                "stdout": out,
                "stderr": err,
                "status": warp_status(),
            }
            return self._json(200 if code == 0 else 500, payload)

        try:
            body = read_json_body(self)
        except Exception as e:
            return self._json(400, {"error": str(e)})

        if self.path == "/license":
            code, payload = apply_license_key(body.get("key", ""))
            return self._json(code, payload)

        if self.path == "/auth-config":
            code, payload = update_webui_credentials(
                body.get("user", ""),
                body.get("password") if "password" in body else None,
            )
            return self._json(code, payload)

        if self.path == "/proxy-port":
            try:
                port = int(body.get("port"))
            except (TypeError, ValueError):
                return self._json(400, {"error": "port required"})
            code, payload = set_proxy_port(port)
            return self._json(code, payload)

        if self.path == "/warp-install":
            port = int(os.environ.get("WARP_PROXY_PORT") or 0) or get_proxy_port().get("port") or 1024
            code, payload = run_script(INSTALL_SCRIPT, {"WARP_PROXY_PORT": str(port)})
            payload["status"] = warp_status()
            return self._json(code, payload)

        if self.path == "/warp-uninstall":
            code, payload = run_script(UNINSTALL_SCRIPT)
            return self._json(code, payload)

        if self.path == "/relay-apply":
            code, payload = apply_relay_config(body)
            return self._json(code, payload)

        if self.path == "/relay-remove":
            code, payload = remove_relay_config()
            return self._json(code, payload)

        if self.path == "/xui-preset":
            port = get_proxy_port().get("port") or 1024
            code, payload = apply_xui_preset(int(port))
            return self._json(code, payload)

        if self.path == "/amnezia-routing":
            port = get_proxy_port().get("port") or 1024
            users = body.get("users")
            if users is not None and not isinstance(users, list):
                users = [users]
            domains = body.get("domains")
            if domains is not None and not isinstance(domains, list):
                domains = [domains]
            code, payload = apply_amnezia_routing(int(port), users=users, domains=domains)
            return self._json(code, payload)

        if self.path == "/amnezia-preset":
            port = get_proxy_port().get("port") or 1024
            code, payload = apply_amnezia_preset(int(port))
            return self._json(code, payload)

        if self.path == "/amnezia-client-alias":
            uuid_val = (body.get("uuid") or body.get("id") or "").strip()
            display = (body.get("displayName") or body.get("name") or "").strip()
            if not _is_uuid_like(uuid_val):
                return self._json(400, {"error": "valid uuid required"})
            if not display:
                return self._json(400, {"error": "displayName required"})
            aliases = load_client_aliases()
            aliases[uuid_val.lower()] = display
            saved = save_client_aliases(aliases)
            log_event("info", "client_alias_saved", uuid=uuid_val, displayName=display)
            return self._json(200, {"uuid": uuid_val, "displayName": display, "aliases": saved})

        return self._json(404, {"error": "not found"})

    def log_message(self, _format, *args):
        return


if __name__ == "__main__":
    log_event("info", "service_start", host=HOST, port=PORT)
    HTTPServer((HOST, PORT), Handler).serve_forever()