mirror of
https://github.com/andrey271192/kaskad.git
synced 2026-09-21 13:51:57 +00:00
209caa81a8
Каскадная маршрутизация русских сайтов через свой набор RU-серверов с failover, Telegram-ботом и веб-интерфейсом. - bin/ — failover-script, route/domain helpers, ams/ru bootstrap - bot/ — Telegram-бот (Python, long-poll) - webui/ — Flask single-page dashboard - docs/ — установка, архитектура, API бота и WebUI - examples/ — шаблоны конфигов
67 lines
2.3 KiB
Bash
Executable File
67 lines
2.3 KiB
Bash
Executable File
#!/bin/bash
|
|
# add-ru-helper.sh <bot_pubkey_b64> <listen_port> <peer_pk> <peer_ip> ...
|
|
set -e
|
|
exec 2>&1
|
|
|
|
BOT_KEY_B64=$1; shift
|
|
LISTEN_PORT=$1; shift
|
|
declare -a PEERS_PK PEERS_IP
|
|
while [ $# -ge 2 ]; do
|
|
PEERS_PK+=("$1"); shift
|
|
PEERS_IP+=("$1"); shift
|
|
done
|
|
|
|
DEBIAN_FRONTEND=noninteractive apt-get update -qq >/dev/null 2>&1 || true
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y wireguard iptables-persistent curl >/dev/null 2>&1
|
|
|
|
mkdir -p /etc/wireguard
|
|
cd /etc/wireguard
|
|
if [ ! -f ru_private.key ]; then
|
|
umask 077
|
|
wg genkey | tee ru_private.key | wg pubkey > ru_public.key
|
|
fi
|
|
PRIVKEY=$(cat ru_private.key)
|
|
PUBKEY=$(cat ru_public.key)
|
|
IFACE=$(ip route | awk '/^default/{print $5; exit}')
|
|
PUBLIC_IP=$(curl -s --max-time 5 ifconfig.me 2>/dev/null || echo unknown)
|
|
|
|
CONF=/etc/wireguard/wg_ru.conf
|
|
{
|
|
echo "[Interface]"
|
|
echo "Address = 10.0.0.1/24"
|
|
echo "PrivateKey = $PRIVKEY"
|
|
echo "ListenPort = $LISTEN_PORT"
|
|
echo "PostUp = iptables -t nat -A POSTROUTING -o $IFACE -j MASQUERADE; iptables -I FORWARD 1 -i wg_ru -j ACCEPT; iptables -I FORWARD 1 -o wg_ru -j ACCEPT; iptables -I INPUT -i wg_ru -j ACCEPT"
|
|
echo "PostDown = iptables -t nat -D POSTROUTING -o $IFACE -j MASQUERADE; iptables -D FORWARD -i wg_ru -j ACCEPT; iptables -D FORWARD -o wg_ru -j ACCEPT; iptables -D INPUT -i wg_ru -j ACCEPT"
|
|
for i in "${!PEERS_PK[@]}"; do
|
|
echo
|
|
echo "[Peer]"
|
|
echo "PublicKey = ${PEERS_PK[$i]}"
|
|
echo "AllowedIPs = ${PEERS_IP[$i]}/32"
|
|
done
|
|
} > "$CONF"
|
|
chmod 600 "$CONF"
|
|
|
|
sysctl -w net.ipv4.ip_forward=1 >/dev/null
|
|
grep -q '^net.ipv4.ip_forward=1' /etc/sysctl.conf || echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf
|
|
|
|
iptables -C INPUT -p udp --dport "$LISTEN_PORT" -j ACCEPT 2>/dev/null \
|
|
|| iptables -I INPUT -p udp --dport "$LISTEN_PORT" -j ACCEPT
|
|
netfilter-persistent save >/dev/null 2>&1 || iptables-save > /etc/iptables/rules.v4 2>/dev/null
|
|
|
|
wg-quick down wg_ru 2>/dev/null || true
|
|
wg-quick up wg_ru
|
|
systemctl enable wg-quick@wg_ru >/dev/null 2>&1
|
|
|
|
# bot pubkey в root authorized_keys для будущего управления
|
|
mkdir -p /root/.ssh && chmod 700 /root/.ssh
|
|
BOT_KEY=$(echo "$BOT_KEY_B64" | base64 -d)
|
|
grep -qF "$BOT_KEY" /root/.ssh/authorized_keys 2>/dev/null || echo "$BOT_KEY" >> /root/.ssh/authorized_keys
|
|
chmod 600 /root/.ssh/authorized_keys
|
|
|
|
echo "----RESULT----"
|
|
echo "PUBKEY=$PUBKEY"
|
|
echo "IFACE=$IFACE"
|
|
echo "PUBLIC_IP=$PUBLIC_IP"
|
|
echo "----END----"
|