feat: initialize proxy-core repository with management scripts, documentation, and licensing

install-advanced.sh

@@ -0,0 +1,622 @@
+#!/bin/bash
+
+# Proxy-Core - Advanced VPN & Proxy Panel Auto-Installer
+# Version: 2.0.0
+# Author: houseassassin
+# GitHub: https://github.com/houseassassin/proxy-core
+# Supports: WireGuard, 3x-ui, Remnawave, Hysteria2
+# Based on: 3dp-manager, remnawave-reverse-proxy, remnawave-scripts, RemnaSetup
+
+set -euo pipefail
+
+SCRIPT_VERSION="2.0.0"
+PROJECT_DIR="/opt/proxy-core"
+LANG_FILE="${PROJECT_DIR}/.selected_language"
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+MAGENTA='\033[0;35m'
+CYAN='\033[0;36m'
+GRAY='\033[0;90m'
+NC='\033[0m'
+
+# Logging
+LOGFILE="${PROJECT_DIR}/installer.log"
+
+log() { echo -e "${GREEN}[INFO]${NC} $1" | tee -a "$LOGFILE"; }
+warn() { echo -e "${YELLOW}[WARN]${NC} $1" | tee -a "$LOGFILE"; }
+error() { echo -e "${RED}[ERROR]${NC} $1" | tee -a "$LOGFILE"; exit 1; }
+success() { echo -e "${GREEN}[SUCCESS]${NC} $1" | tee -a "$LOGFILE"; }
+
+# Spinner animation
+spinner() {
+    local pid=$1
+    local text=$2
+    local spinstr='⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏'
+
+    while kill -0 "$pid" 2>/dev/null; do
+        for (( i=0; i<${#spinstr}; i++ )); do
+            printf "\r${GREEN}[%s]${NC} %s" "${spinstr:$i:1}" "$text"
+            sleep 0.1
+        done
+    done
+    printf "\r\033[K"
+}
+
+# Language support
+declare -A LANG_EN=(
+    [MENU_TITLE]="VPN Panel Installer"
+    [MENU_INSTALL]="Install Panel"
+    [MENU_MANAGE]="Manage Services"
+    [MENU_BACKUP]="Backup & Restore"
+    [MENU_UPDATE]="Update Components"
+    [MENU_UNINSTALL]="Uninstall"
+    [MENU_EXIT]="Exit"
+    [SELECT_PANEL]="Select panel to install"
+    [WIREGUARD]="WireGuard VPN"
+    [3XUI]="3x-ui Panel"
+    [REMNAWAVE]="Remnawave Panel"
+    [HYSTERIA2]="Hysteria2 Proxy"
+    [ALL]="Install All"
+)
+
+declare -A LANG_RU=(
+    [MENU_TITLE]="Установщик VPN панелей"
+    [MENU_INSTALL]="Установить панель"
+    [MENU_MANAGE]="Управление сервисами"
+    [MENU_BACKUP]="Резервное копирование"
+    [MENU_UPDATE]="Обновить компоненты"
+    [MENU_UNINSTALL]="Удалить"
+    [MENU_EXIT]="Выход"
+    [SELECT_PANEL]="Выберите панель для установки"
+    [WIREGUARD]="WireGuard VPN"
+    [3XUI]="Панель 3x-ui"
+    [REMNAWAVE]="Панель Remnawave"
+    [HYSTERIA2]="Прокси Hysteria2"
+    [ALL]="Установить всё"
+)
+
+MENU_LANG="en"
+
+load_language() {
+    if [ -f "$LANG_FILE" ]; then
+        MENU_LANG=$(cat "$LANG_FILE" 2>/dev/null | tr -d '[:space:]')
+    fi
+}
+
+save_language() {
+    mkdir -p "$(dirname "$LANG_FILE")"
+    echo "$1" > "$LANG_FILE"
+    MENU_LANG="$1"
+}
+
+L() {
+    local key="$1"
+    local var_name="LANG_${MENU_LANG^^}_${key}"
+    echo "${!var_name:-$key}"
+}
+
+# System checks
+check_root() {
+    if [[ $EUID -ne 0 ]]; then
+        error "Этот скрипт должен быть запущен с правами root"
+    fi
+}
+
+detect_os() {
+    if [ -f /etc/os-release ]; then
+        . /etc/os-release
+        OS=$ID
+        VER=$VERSION_ID
+    else
+        error "Не удалось определить операционную систему"
+    fi
+    log "Обнаружена ОС: $OS $VER"
+}
+
+check_memory() {
+    local mem_mb=$(free -m | grep Mem: | awk '{print $2}')
+    if [ $mem_mb -lt 2000 ]; then
+        local swap_mb=$(free -m | grep Swap: | awk '{print $2}')
+        if [ $swap_mb -eq 0 ]; then
+            warn "Мало RAM ($mem_mb MB), создаём swap 2GB..."
+            fallocate -l 2G /swapfile || dd if=/dev/zero of=/swapfile bs=1M count=2048
+            chmod 600 /swapfile
+            mkswap /swapfile
+            swapon /swapfile
+            echo '/swapfile none swap sw 0 0' >> /etc/fstab
+            success "Swap создан"
+        fi
+    fi
+}
+
+# Network utilities
+get_server_ip() {
+    curl -s -4 ifconfig.me || curl -s -4 api.ipify.org || curl -s -4 ipinfo.io/ip
+}
+
+get_random_port() {
+    local MIN=${1:-3000}
+    local MAX=${2:-6999}
+
+    while :; do
+        PORT=$(shuf -i "$MIN-$MAX" -n 1)
+        if ! ss -ltun | awk '{print $4}' | grep -q ":$PORT\$"; then
+            echo "$PORT"
+            return
+        fi
+    done
+}
+
+check_domain() {
+    local domain="$1"
+    local domain_ip=$(dig +short A "$domain" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' | head -n 1)
+    local server_ip=$(get_server_ip)
+
+    if [ -z "$domain_ip" ] || [ -z "$server_ip" ]; then
+        warn "Не удалось проверить DNS домена $domain"
+        return 1
+    fi
+
+    if [ "$domain_ip" = "$server_ip" ]; then
+        return 0
+    fi
+
+    warn "IP домена ($domain_ip) не совпадает с IP сервера ($server_ip)"
+    return 1
+}
+
+# Docker management
+resolve_compose_cmd() {
+    if docker compose version >/dev/null 2>&1; then
+        COMPOSE_CMD=("docker" "compose")
+        return 0
+    fi
+
+    if command -v docker-compose >/dev/null 2>&1; then
+        COMPOSE_CMD=("docker-compose")
+        return 0
+    fi
+
+    warn "Docker Compose не найден, устанавливаем..."
+    apt-get update
+    apt-get install -y docker-compose-plugin || apt-get install -y docker-compose
+
+    if docker compose version >/dev/null 2>&1; then
+        COMPOSE_CMD=("docker" "compose")
+        return 0
+    fi
+
+    error "Не удалось установить Docker Compose"
+}
+
+install_docker() {
+    if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
+        log "Docker уже установлен"
+        resolve_compose_cmd
+        return 0
+    fi
+
+    log "Установка Docker..."
+    curl -fsSL https://get.docker.com -o /tmp/get-docker.sh
+    sh /tmp/get-docker.sh
+    rm /tmp/get-docker.sh
+
+    systemctl enable docker
+    systemctl start docker
+
+    resolve_compose_cmd
+    success "Docker установлен"
+}
+
+# System packages
+install_packages() {
+    log "Установка системных пакетов..."
+
+    case $OS in
+        ubuntu|debian)
+            apt-get update -y
+            apt-get install -y curl wget git sudo ufw certbot \
+                ca-certificates jq openssl tar net-tools \
+                qrencode python3-certbot-dns-cloudflare \
+                unattended-upgrades locales dnsutils coreutils \
+                grep gawk python3-pip cron
+            ;;
+        centos|rhel|fedora)
+            yum update -y
+            yum install -y curl wget git sudo firewalld certbot \
+                ca-certificates jq openssl tar net-tools qrencode
+            ;;
+        *)
+            error "Неподдерживаемая ОС: $OS"
+            ;;
+    esac
+
+    # BBR
+    if ! grep -q "net.core.default_qdisc = fq" /etc/sysctl.conf; then
+        echo "net.core.default_qdisc = fq" >> /etc/sysctl.conf
+    fi
+    if ! grep -q "net.ipv4.tcp_congestion_control = bbr" /etc/sysctl.conf; then
+        echo "net.ipv4.tcp_congestion_control = bbr" >> /etc/sysctl.conf
+    fi
+    sysctl -p >/dev/null
+
+    # UFW
+    if command -v ufw >/dev/null 2>&1; then
+        ufw allow 22/tcp comment 'SSH' >/dev/null 2>&1
+        ufw allow 443/tcp comment 'HTTPS' >/dev/null 2>&1
+        ufw --force enable >/dev/null 2>&1
+    fi
+
+    success "Системные пакеты установлены"
+}
+
+# SSL Certificates
+get_ssl_certificate() {
+    local domain="$1"
+    local email="$2"
+    local method="${3:-standalone}"
+
+    log "Получение SSL сертификата для $domain..."
+
+    case $method in
+        standalone)
+            ufw allow 80/tcp >/dev/null 2>&1
+            certbot certonly --standalone \
+                -d "$domain" \
+                --email "$email" \
+                --agree-tos \
+                --non-interactive \
+                --http-01-port 80 \
+                --key-type ecdsa \
+                --elliptic-curve secp384r1
+            ufw delete allow 80/tcp >/dev/null 2>&1
+            ;;
+        cloudflare)
+            if [ -z "$CLOUDFLARE_API_KEY" ]; then
+                read -p "Введите Cloudflare API Token: " CLOUDFLARE_API_KEY
+            fi
+
+            mkdir -p ~/.secrets/certbot
+            cat > ~/.secrets/certbot/cloudflare.ini <<EOL
+dns_cloudflare_api_token = $CLOUDFLARE_API_KEY
+EOL
+            chmod 600 ~/.secrets/certbot/cloudflare.ini
+
+            certbot certonly \
+                --dns-cloudflare \
+                --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini \
+                --dns-cloudflare-propagation-seconds 60 \
+                -d "$domain" \
+                -d "*.$domain" \
+                --email "$email" \
+                --agree-tos \
+                --non-interactive \
+                --key-type ecdsa \
+                --elliptic-curve secp384r1
+            ;;
+    esac
+
+    if [ -d "/etc/letsencrypt/live/$domain" ]; then
+        success "SSL сертификат получен для $domain"
+        return 0
+    else
+        error "Не удалось получить SSL сертификат"
+    fi
+}
+
+# WireGuard installation
+install_wireguard() {
+    log "Установка WireGuard..."
+
+    case $OS in
+        ubuntu|debian)
+            apt-get install -y wireguard wireguard-tools qrencode
+            ;;
+        centos|rhel|fedora)
+            yum install -y epel-release
+            yum install -y wireguard-tools qrencode
+            ;;
+    esac
+
+    mkdir -p /etc/wireguard
+    cd /etc/wireguard
+
+    if [ ! -f server_private.key ]; then
+        wg genkey | tee server_private.key | wg pubkey > server_public.key
+        chmod 600 server_private.key
+    fi
+
+    read -p "Введите порт WireGuard (по умолчанию 51820): " WG_PORT
+    WG_PORT=${WG_PORT:-51820}
+
+    SERVER_PRIVATE_KEY=$(cat server_private.key)
+    SERVER_IP=$(get_server_ip)
+
+    cat > /etc/wireguard/wg0.conf <<EOF
+[Interface]
+Address = 10.0.0.1/24
+ListenPort = $WG_PORT
+PrivateKey = $SERVER_PRIVATE_KEY
+PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+EOF
+
+    echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
+    sysctl -p
+
+    systemctl enable wg-quick@wg0
+    systemctl start wg-quick@wg0
+
+    ufw allow $WG_PORT/udp 2>/dev/null || firewall-cmd --permanent --add-port=$WG_PORT/udp 2>/dev/null
+
+    success "WireGuard установлен на порту $WG_PORT"
+    log "Конфигурация: /etc/wireguard/wg0.conf"
+}
+
+# 3x-ui installation
+install_3xui() {
+    log "Установка 3x-ui..."
+
+    bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)
+
+    success "3x-ui установлен"
+    log "Панель доступна: http://$(get_server_ip):2053"
+    log "Логин: admin | Пароль: admin (СМЕНИТЕ!)"
+}
+
+# Hysteria2 installation
+install_hysteria2() {
+    log "Установка Hysteria2..."
+
+    if systemctl cat hysteria-server.service &> /dev/null; then
+        log "Hysteria2 уже установлен"
+        return 0
+    fi
+
+    bash <(curl -fsSL https://get.hy2.sh/)
+
+    local HY2_PORT=$(get_random_port 10000 20000)
+    local HY2_PASSWORD=$(openssl rand -base64 16 | tr -dc 'A-Za-z0-9' | cut -c1-16)
+    local HY2_OBFS=$(openssl rand -base64 16 | tr -dc 'A-Za-z0-9' | cut -c1-16)
+
+    read -p "Введите домен для Hysteria2: " HY2_DOMAIN
+    read -p "Введите email для Let's Encrypt: " HY2_EMAIL
+
+    cat > /etc/hysteria/config.yaml <<EOF
+listen: :$HY2_PORT
+
+acme:
+  domains:
+    - $HY2_DOMAIN
+  email: $HY2_EMAIL
+
+auth:
+  type: password
+  password: $HY2_PASSWORD
+
+obfs:
+  type: salamander
+  salamander:
+    password: $HY2_OBFS
+
+masquerade:
+  type: proxy
+  proxy:
+    url: https://www.google.com/
+    rewriteHost: true
+EOF
+
+    systemctl daemon-reload
+    systemctl enable --now hysteria-server.service
+    systemctl restart hysteria-server.service
+
+    success "Hysteria2 установлен на порту $HY2_PORT"
+    log "Пароль: $HY2_PASSWORD"
+    log "Obfs: $HY2_OBFS"
+}
+
+# Remnawave installation
+install_remnawave() {
+    log "Установка Remnawave..."
+
+    install_docker
+
+    mkdir -p /opt/remnawave
+    cd /opt/remnawave
+
+    read -p "Введите домен для Remnawave: " REMNA_DOMAIN
+    read -p "Введите email для SSL: " REMNA_EMAIL
+
+    local DB_PASS=$(openssl rand -base64 12)
+    local JWT_SECRET=$(openssl rand -base64 32)
+    local ADMIN_USER=$(openssl rand -base64 8)
+    local ADMIN_PASS=$(openssl rand -base64 12)
+
+    cat > .env <<EOF
+DB_HOST=postgres
+DB_PORT=5432
+DB_USERNAME=admin
+DB_PASSWORD=${DB_PASS}
+DB_NAME=remnawave
+JWT_SECRET=${JWT_SECRET}
+ADMIN_LOGIN=${ADMIN_USER}
+ADMIN_PASSWORD=${ADMIN_PASS}
+PORT=3100
+EOF
+
+    get_ssl_certificate "$REMNA_DOMAIN" "$REMNA_EMAIL" "standalone"
+
+    cat > docker-compose.yml <<EOF
+version: '3.8'
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    container_name: remnawave-postgres
+    restart: always
+    environment:
+      POSTGRES_USER: admin
+      POSTGRES_PASSWORD: ${DB_PASS}
+      POSTGRES_DB: remnawave
+    volumes:
+      - pg_data:/var/lib/postgresql/data
+    networks:
+      - remnawave-network
+
+  backend:
+    image: ghcr.io/remnawave/backend:latest
+    container_name: remnawave-backend
+    restart: always
+    depends_on:
+      - postgres
+    env_file:
+      - .env
+    networks:
+      - remnawave-network
+
+  frontend:
+    image: nginx:alpine
+    container_name: remnawave-frontend
+    restart: always
+    depends_on:
+      - backend
+    ports:
+      - "443:443"
+    volumes:
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+      - /etc/letsencrypt/live/${REMNA_DOMAIN}/fullchain.pem:/etc/nginx/ssl/fullchain.pem:ro
+      - /etc/letsencrypt/live/${REMNA_DOMAIN}/privkey.pem:/etc/nginx/ssl/privkey.pem:ro
+    networks:
+      - remnawave-network
+
+volumes:
+  pg_data:
+
+networks:
+  remnawave-network:
+    driver: bridge
+EOF
+
+    cat > nginx.conf <<EOF
+events {
+    worker_connections 1024;
+}
+
+http {
+    upstream backend {
+        server backend:3100;
+    }
+
+    server {
+        listen 443 ssl http2;
+        server_name ${REMNA_DOMAIN};
+
+        ssl_certificate /etc/nginx/ssl/fullchain.pem;
+        ssl_certificate_key /etc/nginx/ssl/privkey.pem;
+
+        location / {
+            proxy_pass http://backend;
+            proxy_set_header Host \$host;
+            proxy_set_header X-Real-IP \$remote_addr;
+            proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto \$scheme;
+        }
+    }
+}
+EOF
+
+    "${COMPOSE_CMD[@]}" up -d
+
+    success "Remnawave установлен"
+    log "Панель: https://${REMNA_DOMAIN}"
+    log "Логин: ${ADMIN_USER}"
+    log "Пароль: ${ADMIN_PASS}"
+}
+
+# Main menu
+show_main_menu() {
+    clear
+    echo -e "${MAGENTA}╔════════════════════════════════════════╗${NC}"
+    echo -e "${MAGENTA}║   $(L MENU_TITLE)                    ║${NC}"
+    echo -e "${MAGENTA}║   Version: ${SCRIPT_VERSION}                      ║${NC}"
+    echo -e "${MAGENTA}╚════════════════════════════════════════╝${NC}"
+    echo ""
+    echo -e "${YELLOW}1.${NC} $(L MENU_INSTALL)"
+    echo -e "${YELLOW}2.${NC} $(L MENU_MANAGE)"
+    echo -e "${YELLOW}3.${NC} $(L MENU_BACKUP)"
+    echo -e "${YELLOW}4.${NC} $(L MENU_UPDATE)"
+    echo -e "${YELLOW}5.${NC} $(L MENU_UNINSTALL)"
+    echo -e "${YELLOW}9.${NC} Сменить язык / Change language"
+    echo -e "${YELLOW}0.${NC} $(L MENU_EXIT)"
+    echo ""
+}
+
+show_install_menu() {
+    clear
+    echo -e "${GREEN}$(L SELECT_PANEL)${NC}"
+    echo ""
+    echo -e "${YELLOW}1.${NC} $(L WIREGUARD)"
+    echo -e "${YELLOW}2.${NC} $(L 3XUI)"
+    echo -e "${YELLOW}3.${NC} $(L REMNAWAVE)"
+    echo -e "${YELLOW}4.${NC} $(L HYSTERIA2)"
+    echo -e "${YELLOW}5.${NC} $(L ALL)"
+    echo -e "${YELLOW}0.${NC} Назад / Back"
+    echo ""
+}
+
+main() {
+    check_root
+    detect_os
+    check_memory
+
+    mkdir -p "$PROJECT_DIR"
+    load_language
+
+    while true; do
+        show_main_menu
+        read -p "Выберите опцию / Select option: " choice
+
+        case $choice in
+            1)
+                show_install_menu
+                read -p "Выберите / Select: " install_choice
+                case $install_choice in
+                    1) install_packages; install_wireguard ;;
+                    2) install_packages; install_3xui ;;
+                    3) install_packages; install_remnawave ;;
+                    4) install_packages; install_hysteria2 ;;
+                    5)
+                        install_packages
+                        install_wireguard
+                        install_3xui
+                        install_hysteria2
+                        ;;
+                    0) continue ;;
+                    *) warn "Неверный выбор / Invalid choice" ;;
+                esac
+                read -p "Нажмите Enter / Press Enter..."
+                ;;
+            9)
+                if [ "$MENU_LANG" = "en" ]; then
+                    save_language "ru"
+                else
+                    save_language "en"
+                fi
+                ;;
+            0)
+                log "Выход / Exit"
+                exit 0
+                ;;
+            *)
+                warn "Неверный выбор / Invalid choice"
+                sleep 1
+                ;;
+        esac
+    done
+}
+
+main