From e41c1359d4884986512dc7f723f10161787e0e53 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=90=D0=BD=D0=B4=D1=80=D0=B5=D0=B9=20=D0=91=D0=BE=D0=B1?=
 =?UTF-8?q?=D1=8B=D1=80=D0=B5=D0=B2?= <andrejbobyrev@MacBook-Pro.local>
Date: Tue, 28 Apr 2026 20:37:03 +0300
Subject: [PATCH] =?UTF-8?q?fix:=20RCI=20auth=20=E2=80=94=20=D0=BF=D0=B5?=
 =?UTF-8?q?=D1=80=D0=B5=D0=B1=D0=B8=D1=80=D0=B0=D0=B5=D0=BC=20127.0.0.1/lo?=
 =?UTF-8?q?calhost/192.168.1.1/br0=20IP?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Keenetic слушает на LAN IP, а не на localhost из SSH-контекста.
Теперь пробуем каждый адрес с таймаутом 2с, используем первый
что вернёт JSON с realm.
---
 server/main.py | 36 ++++++++++++++++++++++++++----------
 1 file changed, 26 insertions(+), 10 deletions(-)

diff --git a/server/main.py b/server/main.py
index f3118d3..4ddc939 100644
--- a/server/main.py
+++ b/server/main.py
@@ -753,24 +753,40 @@ echo '[3/3] Настройка WireGuard через Keenetic RCI...'
 DONE=0
 
 # === Keenetic RCI API (нативная интеграция, интерфейс виден в UI) ===
-AUTH=$(curl -s http://localhost/auth 2>/dev/null)
-echo "Auth response: $AUTH"
+# Keenetic слушает на LAN IP, не на localhost — перебираем варианты
+RCI_BASE=""
+for _url in "http://127.0.0.1" "http://localhost" "http://192.168.1.1"; do
+  _auth=$(curl -s --connect-timeout 2 "$_url/auth" 2>/dev/null)
+  if printf '%s' "$_auth" | grep -q '"realm"'; then
+    RCI_BASE="$_url"
+    AUTH="$_auth"
+    break
+  fi
+done
+# Если стандартные IP не помогли — пробуем адрес br0 (LAN-интерфейс роутера)
+if [ -z "$RCI_BASE" ]; then
+  _lanip=$(ip addr show br0 2>/dev/null | grep 'inet ' | awk '{{print $2}}' | cut -d/ -f1 | head -1)
+  if [ -n "$_lanip" ]; then
+    _auth=$(curl -s --connect-timeout 2 "http://$_lanip/auth" 2>/dev/null)
+    if printf '%s' "$_auth" | grep -q '"realm"'; then
+      RCI_BASE="http://$_lanip"
+      AUTH="$_auth"
+    fi
+  fi
+fi
+echo "RCI base: [$RCI_BASE]  Auth: $AUTH"
 REALM=$(printf '%s' "$AUTH" | grep -o '"realm":"[^"]*"' | cut -d'"' -f4)
 CHAL=$(printf '%s' "$AUTH" | grep -o '"challenge":"[^"]*"' | cut -d'"' -f4)
 echo "Realm=[$REALM] Challenge=[$CHAL]"
 
-if [ -n "$REALM" ] && [ -n "$CHAL" ]; then
+if [ -n "$REALM" ] && [ -n "$CHAL" ] && [ -n "$RCI_BASE" ]; then
   HASH=$(printf 'admin:%s:{router_pass}' "$REALM" | md5sum | cut -c1-32)
   RESP=$(printf '%s%s' "$HASH" "$CHAL" | md5sum | cut -c1-32)
-  LOGIN=$(curl -s -c /tmp/rci.jar http://localhost/auth \\
+  LOGIN=$(curl -s -c /tmp/rci.jar "$RCI_BASE/auth" \\
     -H 'Content-Type: application/json' \\
     -d '{{"login":"admin","password":"'"$RESP"'"}}')
   echo "Login: $LOGIN"
 
-  echo "=== Существующий Wireguard0 (для проверки формата) ==="
-  curl -s -b /tmp/rci.jar 'http://localhost/rci/interface/Wireguard0' 2>/dev/null | head -c 800
-  echo ""
-
   # Найти следующий свободный последовательный индекс WireGuard
   MAX_WG=-1
   for i in $(seq 0 20); do
@@ -785,12 +801,12 @@ if [ -n "$REALM" ] && [ -n "$CHAL" ]; then
 RCIEOF
   echo "RCI JSON: $(cat /tmp/wg_rci.json)"
 
-  CFG=$(curl -s -b /tmp/rci.jar -X POST http://localhost/rci/ \\
+  CFG=$(curl -s -b /tmp/rci.jar -X POST "$RCI_BASE/rci/" \\
     -H 'Content-Type: application/json' \\
     --data-binary @/tmp/wg_rci.json)
   echo "RCI response: $CFG"
 
-  curl -s -b /tmp/rci.jar -X POST http://localhost/rci/ \\
+  curl -s -b /tmp/rci.jar -X POST "$RCI_BASE/rci/" \\
     -H 'Content-Type: application/json' \\
     -d '{{"system":{{"configuration":{{"save":true}}}}}}' >/dev/null