openconnect: expose-iroutes on/off

.gitignore

@@ -19,4 +19,5 @@ mirror/.env
 update/*
 !update/update.sh
 
-override.env
+override.env
+override.html

app/bot.php

@@ -145,6 +145,12 @@ class Bot
             case preg_match('~^/appOutbound$~', $this->input['callback'], $m):
                 $this->appOutbound();
                 break;
+            case preg_match('~^/processOutbound$~', $this->input['callback'], $m):
+                $this->processOutbound();
+                break;
+            case preg_match('~^/offWarp$~', $this->input['callback'], $m):
+                $this->offWarp();
+                break;
             case preg_match('~^/addSubdomain$~', $this->input['callback'], $m):
                 $this->addSubdomain();
                 break;
@@ -265,6 +271,9 @@ class Bot
             case preg_match('~^/addOcUser$~', $this->input['callback'], $m):
                 $this->addOcUser();
                 break;
+            case preg_match('~^/changeOcExpose$~', $this->input['callback'], $m):
+                $this->changeOcExpose();
+                break;
             case preg_match('~^/addXrUser$~', $this->input['callback'], $m):
                 $this->addXrUser();
                 break;
@@ -343,6 +352,9 @@ class Bot
             case preg_match('~^/switchTorrent (\d+)$~', $this->input['callback'], $m):
                 $this->switchTorrent($m[1]);
                 break;
+            case preg_match('~^/switchEndpoint (\d+)$~', $this->input['callback'], $m):
+                $this->switchEndpoint($m[1]);
+                break;
             case preg_match('~^/switchAmnezia (-?\d+)$~', $this->input['callback'], $m):
                 $this->switchAmnezia($m[1]);
                 break;
@@ -425,6 +437,9 @@ class Bot
             case preg_match('~^/xtlsapp(?: (\d+))?$~', $this->input['callback'], $m):
                 $this->xtlsapp($m[1] ?: 0);
                 break;
+            case preg_match('~^/xtlsprocess(?: (\d+))?$~', $this->input['callback'], $m):
+                $this->xtlsprocess($m[1] ?: 0);
+                break;
             case preg_match('~^/xtlsrulesset(?: (\d+))?$~', $this->input['callback'], $m):
                 $this->xtlsrulesset($m[1] ?: 0);
                 break;
@@ -476,8 +491,8 @@ class Bot
             case preg_match('~^/proxy$~', $this->input['callback'], $m):
                 $this->proxy();
                 break;
-            case preg_match('~^/showpac$~', $this->input['callback'], $m):
-                $this->showpac();
+            case preg_match('~^/addOverrideHtml$~', $this->input['callback'], $m):
+                $this->addOverrideHtml();
                 break;
             case preg_match('~^/export$~', $this->input['callback'], $m):
                 $this->exportManual();
@@ -803,6 +818,30 @@ class Bot
         ];
     }
 
+    public function addOverrideHtml()
+    {
+        $r = $this->send(
+            $this->input['chat'],
+            "@{$this->input['username']} attach html",
+            $this->input['message_id'],
+            reply: 'attach html',
+        );
+        $_SESSION['reply'][$r['result']['message_id']] = [
+            'start_message'  => $this->input['message_id'],
+            'start_callback' => $this->input['callback_id'],
+            'callback'       => 'setOverrideHtml',
+            'args'           => [],
+        ];
+    }
+
+    public function setOverrideHtml()
+    {
+        $r = $this->request('getFile', ['file_id' => $this->input['file_id']]);
+        if (!empty($f = file_get_contents($this->file . $r['result']['file_path']))) {
+            file_put_contents('/app/webapp/override.html', $f);
+        }
+    }
+
     public function restartOcserv($conf)
     {
         file_put_contents('/config/ocserv.conf', $conf);
@@ -1410,9 +1449,7 @@ class Bot
             $this->language = $this->getPacConf()['language'] ?: 'en';
             $this->limit    = $this->getPacConf()['limitpage'] ?: 5;
             sleep(3);
-            if (empty($file)) {
-                $this->menu();
-            }
+            $this->menu();
         }
     }
 
@@ -1537,6 +1574,14 @@ class Bot
         $this->menu('wg', $page);
     }
 
+    public function switchEndpoint($page = 0)
+    {
+        $c = $this->getPacConf();
+        $c[$this->getInstanceWG(1) . 'endpoint'] = $c[$this->getInstanceWG(1) . 'endpoint'] ? 0 : 1;
+        $this->setPacConf($c);
+        $this->menu('wg', $page);
+    }
+
     public function iptablesWG()
     {
         $c = $this->getPacConf();
@@ -1716,10 +1761,14 @@ class Bot
             $this->adguardProtect();
             $u = $this->ssh("nginx -t 2>&1", 'ng');
             $out[] = $u;
-            $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
+            if (empty($nomenu)) {
+                $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
+            }
             if (preg_match('~test is successful~', $u)) {
                 $out[] = $this->ssh("nginx -s reload 2>&1", 'ng');
-                $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
+                if (empty($nomenu)) {
+                    $this->update($this->input['chat'], $this->input['message_id'], implode("\n", $out));
+                }
                 $this->setPacConf($conf);
                 $this->chocdomain($domain);
                 $this->setUpstreamDomainOcserv($domain);
@@ -1738,10 +1787,8 @@ class Bot
     {
         $c = $this->getPacConf();
         if (empty($c['domain'])) {
-            $this->addDomain(str_replace('.', '-', $this->ip) . '.sslip.io', 1);
+            $this->addDomain(str_replace('.', '-', $this->ip) . '.nip.io', 1);
             $this->setSSL('letsencrypt');
-        } else {
-            $this->menu();
         }
     }
 
@@ -2112,7 +2159,7 @@ class Bot
             $c['linkdomain'] = trim($text);
         }
         $this->setPacConf($c);
-        $this->menu('config');
+        $this->xray();
     }
 
     public function setSubdomain($text)
@@ -2384,7 +2431,7 @@ DNS-over-HTTPS with IP:
         if (!empty($domains)) {
             $conf = $this->getPacConf();
             foreach ($domains as $k => $v) {
-                $conf[$type][$type == 'rulessetlist' ? trim($v) : idn_to_ascii(trim($v))] = true;
+                $conf[$type][in_array($type, ['rulessetlist', 'packagelist', 'processlist']) ? trim($v) : idn_to_ascii(trim($v))] = true;
             }
             ksort($conf[$type]);
             $this->setPacConf($conf);
@@ -2408,6 +2455,10 @@ DNS-over-HTTPS with IP:
                 $this->xrayUpdateRules();
                 $this->xtlswarp();
                 break;
+            case 'processlist':
+                $this->xrayUpdateRules();
+                $this->xtlsprocess();
+                break;
             case 'packagelist':
                 $this->xrayUpdateRules();
                 $this->xtlsapp();
@@ -2675,6 +2726,7 @@ DNS-over-HTTPS with IP:
         $dns     = $c[$this->getInstanceWG(1) . 'dns'];
         $mtu     = $c[$this->getInstanceWG(1) . 'mtu'] ?: $this->mtu;
         $am      = $c[$this->getInstanceWG(1) . 'amnezia'];
+        $end     = $c[$this->getInstanceWG(1) . 'endpoint'];
         $data    = [
             [
                 [
@@ -2706,6 +2758,12 @@ DNS-over-HTTPS with IP:
                     'callback_data' => "/defaultMTU $page",
                 ],
             ],
+            [
+                [
+                    'text'          => $this->i18n('endpoint') . ': ' . ($end ? $this->ip : $this->getDomain()),
+                    'callback_data' => "/switchEndpoint $page",
+                ],
+            ],
             [
                 [
                     'text'          =>  $this->i18n('add peer'),
@@ -3380,6 +3438,9 @@ DNS-over-HTTPS with IP:
             case 'packagelist':
                 $this->xtlsapp();
                 break;
+            case 'processlist':
+                $this->xtlsprocess();
+                break;
             case 'rulessetlist':
                 $this->xtlsrulesset();
                 break;
@@ -3525,6 +3586,14 @@ DNS-over-HTTPS with IP:
         $this->xtlsapp();
     }
 
+    public function processOutbound()
+    {
+        $p = $this->getPacConf();
+        $p['process_outbound'] = !$p['process_outbound'];
+        $p = $this->setPacConf($p);
+        $this->xtlsprocess();
+    }
+
     public function xtlsapp($page = 0)
     {
         $text[] = "Menu -> " . $this->i18n('xray') . ' -> ' . $this->i18n('routes') . ' -> package list';
@@ -3551,6 +3620,32 @@ DNS-over-HTTPS with IP:
         );
     }
 
+    public function xtlsprocess($page = 0)
+    {
+        $text[] = "Menu -> " . $this->i18n('xray') . ' -> ' . $this->i18n('routes') . ' -> process list';
+
+        $data   = $this->listPac('processlist', $page, 'xtlsprocess');
+        $p      = $this->getPacConf();
+        $data[] = [
+            [
+                'text'          => 'set to ' . ($p['process_outbound'] ? 'proxy' : 'direct'),
+                'callback_data' => "/processOutbound",
+            ],
+        ];
+        $data[] = [
+            [
+                'text'          => $this->i18n('back'),
+                'callback_data' => "/routes",
+            ],
+        ];
+        $this->update(
+            $this->input['chat'],
+            $this->input['message_id'],
+            implode("\n", $text ?: ['...']),
+            $data ?: false,
+        );
+    }
+
     public function xtlsrulesset($page = 0)
     {
         $text[] = "Menu -> " . $this->i18n('xray') . ' -> ' . $this->i18n('routes') . ' -> rulesset list';
@@ -3588,7 +3683,7 @@ DNS-over-HTTPS with IP:
             foreach ($domains as $k => $v) {
                 $data[] = [
                     [
-                        'text'          => $this->i18n($v ? 'on' : 'off') . ' ' . ($basename ? basename($k) . ' ' : '') . idn_to_utf8($k),
+                        'text'          => $this->i18n($v ? 'on' : 'off') . ' ' . ($basename ? basename($k) . ' ' : '') . (in_array($type, ['rulessetlist', 'packagelist', 'processlist']) ? $k : idn_to_utf8($k)),
                         'callback_data' => "/change$type " . ($i + $page * $this->limit),
                     ],
                     [
@@ -3864,7 +3959,7 @@ DNS-over-HTTPS with IP:
     {
         $c      = $this->getXray();
         $pac    = $this->getPacConf();
-        $domain = $this->getDomain();
+        $domain = $this->getDomain($pac['transport'] == 'Websocket');
         $scheme = empty($this->nginxGetTypeCert()) ? 'http' : 'https';
         $hash   = substr(md5($this->key), 0, 8);
         $si     = "$scheme://{$domain}/pac/" . base64_encode(serialize([
@@ -4037,7 +4132,9 @@ DNS-over-HTTPS with IP:
         preg_match('~^camouflage_secret[^\n]+?"([^"]+)*"~sm', $ocserv, $m);
         $cs = $m[1];
         preg_match('~^dns = ([^\n]+)~sm', $ocserv, $m);
-        $dns    = $m[1];
+        $dns = $m[1];
+        preg_match('~^expose-iroutes = (true)~sm', $ocserv, $m);
+        $expose = $m[1];
         $pass   = htmlspecialchars($pac['ocserv']);
         $text[] = "Menu -> OpenConnect";
         if (!empty($m[1])) {
@@ -4058,6 +4155,12 @@ DNS-over-HTTPS with IP:
                 'callback_data' => "/changeOcDns",
             ],
         ];
+        $data[] = [
+            [
+                'text'          => $this->i18n('expose-iroutes') . ' ' . $this->i18n($expose ? 'on' : 'off'),
+                'callback_data' => "/changeOcExpose",
+            ],
+        ];
         $data[] = [
             [
                 'text'          => $this->i18n('add peer'),
@@ -4085,6 +4188,15 @@ DNS-over-HTTPS with IP:
         ];
     }
 
+    public function changeOcExpose()
+    {
+        $c = file_get_contents('/config/ocserv.conf');
+        preg_match('~^expose-iroutes = ([^\n]+)~sm', $c, $m);
+        $t = preg_replace('~^expose-iroutes[^\n]+~sm', "expose-iroutes = " . ($m[1] == 'true' ? 'false' : 'true'), $c);
+        $this->restartOcserv($t);
+        $this->menu('oc');
+    }
+
     public function deloc($i)
     {
         $clients = $this->getClientsOc();
@@ -4329,6 +4441,12 @@ DNS-over-HTTPS with IP:
             $text[] = "fake domain: <code>$fake</code>";
         }
         $text[] = 'transport: ' . ($p['transport'] ?: 'Reality');
+        $data[] = [
+            [
+                'text'          => $p['linkdomain'] ?: $this->i18n('cdn'),
+                'callback_data' => '/addLinkDomain',
+            ],
+        ];
         $data[] = [
             [
                 'text'          => $this->i18n('Reality') . ' ' . ($p['transport'] != 'Websocket' ? $this->i18n('on') : $this->i18n('off')),
@@ -4445,6 +4563,10 @@ DNS-over-HTTPS with IP:
                 'text'          => $this->i18n('warp'),
                 'callback_data' => "/xtlswarp",
             ]],
+            [[
+                'text'          => $this->i18n('process'),
+                'callback_data' => "/xtlsprocess",
+            ]],
             [[
                 'text'          => $this->i18n('package'),
                 'callback_data' => "/xtlsapp",
@@ -4486,33 +4608,67 @@ DNS-over-HTTPS with IP:
 
     public function addWarpPlus($key)
     {
-        $c         = $this->getPacConf();
-        $c['warp'] = $key;
+        $c = $this->getPacConf();
+        if (!empty($key)) {
+            $c['warp'] = $key;
+            $this->send($this->input['chat'], 'Warp registration license: ' . $this->ssh("warp-cli --accept-tos registration license $key 2>&1", 'wp'));
+        } else {
+            unset($c['warp']);
+        }
         $this->setPacConf($c);
-        $this->send($this->input['chat'], 'Warp registration license: ' . $this->ssh("warp-cli --accept-tos registration license $key", 'wp'));
         sleep(1);
         $this->warp();
     }
 
     public function warpStatus()
     {
-        $st = $this->ssh('curl -m 1 -x socks5://127.0.0.1:40000 https://cloudflare.com/cdn-cgi/trace', 'wp');
-        preg_match('~warp=(\w+)~', $st, $m);
-        return $m[1];
+        if (!empty($this->ssh('pgrep warp-svc', 'wp'))) {
+            $st = $this->ssh('curl -m 1 -x socks5://127.0.0.1:40000 https://cloudflare.com/cdn-cgi/trace', 'wp');
+            preg_match('~warp=(\w+)~', $st, $m);
+            return $m[1];
+        }
+        return 'off';
+    }
+
+    public function offWarp()
+    {
+        $p = $this->getPacConf();
+        if (empty($p['warpoff'])) {
+            $this->ssh('pkill warp-svc', 'wp');
+            $p['warpoff'] = 1;
+        } else {
+            $this->ssh('warp-svc > /dev/null 2>&1 &', 'wp');
+            sleep(3);
+            $this->send($this->input['chat'], 'Registration: ' . $this->ssh('warp-cli --accept-tos registration new 2>&1', 'wp'));
+            if (!empty($p['warp'])) {
+                $this->send($this->input['chat'], 'License: ' . $this->ssh("warp-cli --accept-tos registration license {$p['warp']} 2>&1", 'wp'));
+            }
+            $this->send($this->input['chat'], 'Proxy mode: ' . $this->ssh('warp-cli --accept-tos mode proxy 2>&1', 'wp'));
+            $this->send($this->input['chat'], 'Connect: ' . $this->ssh('warp-cli --accept-tos connect 2>&1', 'wp'));
+            unset($p['warpoff']);
+        }
+        $this->setPacConf($p);
+        $this->warp();
     }
 
     public function warp()
     {
+        $p      = $this->getPacConf();
         $text[] = "Menu -> " . $this->i18n('warp');
         $text[] = "status: " . $this->warpStatus();
         $text[] = "key: " . $this->getPacConf()['warp'];
+        $data[] = [
+            [
+                'text'          => $this->i18n($p['warpoff'] ? 'off' : 'on'),
+                'callback_data' => "/offWarp",
+            ],
+        ];
         $data[] = [
             [
                 'text'          => $this->i18n('set key'),
                 'callback_data' => "/warpPlus",
             ],
         ];
-
         $data[] = [
             [
                 'text'          => $this->i18n('back'),
@@ -4584,7 +4740,7 @@ DNS-over-HTTPS with IP:
     {
         $c      = $this->getXray()['inbounds'][0]['settings']['clients'][$i];
         $pac    = $this->getPacConf();
-        $domain = $this->getDomain();
+        $domain = $this->getDomain($pac['transport'] == 'Websocket');
         $scheme = empty($this->nginxGetTypeCert()) ? 'http' : 'https';
         $hash   = substr(md5($this->key), 0, 8);
 
@@ -4596,14 +4752,27 @@ DNS-over-HTTPS with IP:
         $text[] = "<a href='$scheme://{$domain}/pac?h=$hash&t=si&r=si&s={$c['id']}#{$c['email']}'>sing-box</a>";
         $text[] = "<a href='$scheme://{$domain}/pac?h=$hash&t=s&r=st&s={$c['id']}#{$c['email']}'>streisand</a>";
         $text[] = "<a href='$scheme://{$domain}/pac?h=$hash&t=si&r=h&s={$c['id']}#{$c['email']}'>hiddify</a>";
+        $text[] = "<a href='$scheme://{$domain}/pac?h=$hash&t=si&r=k&s={$c['id']}#{$c['email']}'>karing</a>";
+
+        $si = "$scheme://{$domain}/pac/" . base64_encode(serialize([
+            'h' => $hash,
+            't' => 'si',
+            's' => $c['id'],
+        ]));
+        $xr = "$scheme://{$domain}/pac/" . base64_encode(serialize([
+            'h' => $hash,
+            't' => 's',
+            's' => $c['id'],
+        ]));
+
+        $text[] = "\nxray config: <pre><code>$xr</code></pre>";
+        $text[] = "sing-box config: <pre><code>$si</code></pre>";
 
-        $text[] = "\nv2ray config: <pre><code>$scheme://{$domain}/pac?h=$hash&t=s&s={$c['id']}</code></pre>";
-        $text[] = "sing-box config: <pre><code>$scheme://{$domain}/pac?h=$hash&t=si&s={$c['id']}</code></pre>";
         $text[] = "sing-box windows: <a href='$scheme://{$domain}/pac?h=$hash&t=si&r=w&s={$c['id']}'>windows service</a>";
 
         $data[] = [
             [
-                'text'    => 'v2ray',
+                'text'    => 'xray',
                 'web_app' => ['url' => "https://{$domain}/pac?h=$hash&t=s&s={$c['id']}"],
             ],
             [
@@ -4671,56 +4840,20 @@ DNS-over-HTTPS with IP:
         );
     }
 
-    public function getDomain()
+    public function getDomain($cdn = false)
     {
         $c = $this->getPacConf();
-        return $c['linkdomain'] ?: ($c['domain'] ?: $this->ip);
-    }
-
-    public function v2raySubscription($key, $fs = 0)
-    {
-        $pac    = $this->getPacConf();
-        $domain = $this->getDomain();
-        $xr     = $this->getXray();
-
-        $flag = true;
-        foreach ($xr['inbounds'][0]['settings']['clients'] as $k => $v) {
-            if ($v['id'] == $key) {
-                if (!empty($fs)) {
-                    return $this->userXr($k, 0, 1);
-                }
-                if (empty($v['off'])) {
-                    $flag = false;
-                }
-                break;
-            }
+        if ($cdn && $c['linkdomain']) {
+            return $c['linkdomain'];
         }
-        if ($flag) {
-            return;
-        }
-
-        $c = json_decode(file_get_contents('/config/v2ray.json'), true);
-
-        $c['outbounds'][0]['settings']['vnext'][0]['address']                 = $domain;
-        $c['outbounds'][0]['settings']['vnext'][0]['users'][0]['id']          = $key;
-        $c['outbounds'][0]['streamSettings']['realitySettings']['serverName'] = $xr['inbounds'][0]['streamSettings']['realitySettings']['serverNames'][0];
-        $c['outbounds'][0]['streamSettings']['realitySettings']['publicKey']  = $pac['xray'];
-        $c['outbounds'][0]['streamSettings']['realitySettings']['shortId']    = $xr['inbounds'][0]['streamSettings']['realitySettings']['shortIds'][0];
-        $c['routing']['rules'][0]['domain']                                   = array_keys(array_filter($pac['includelist']));
-
-        if (empty($c['routing']['rules'][0]['domain'])) {
-            unset($c['routing']['rules'][0]);
-            $c['routing']['rules'] = array_values($c['routing']['rules']);
-
-        }
-        echo json_encode($c);
+        return $c['domain'] ?: $this->ip;
     }
 
     public function subscription()
     {
         $type   = $_GET['t'] == 's' ? 'v2ray' : 'sing';
         $pac    = $this->getPacConf();
-        $domain = $this->getDomain();
+        $domain = $_GET['cdn'] ?: ($_SERVER['SERVER_NAME'] ?: $this->getDomain($pac['transport'] == 'Websocket'));
         $xr     = $this->getXray();
         $scheme = empty($this->nginxGetTypeCert()) ? 'http' : 'https';
         $hash   = substr(md5($this->key), 0, 8);
@@ -4762,20 +4895,19 @@ DNS-over-HTTPS with IP:
                 case 'v':
                     header("Location: v2rayng://install-config?url=$v2");
                     exit;
+                case 'k':
+                    header("Location: karing://install-config?url=$si");
+                    exit;
                 case 'h':
                     header("Location: hiddify://install-config/?url=$si");
                     exit;
                 case 'w':
                     $link = htmlspecialchars($si, ENT_XML1, 'UTF-8');
-                    file_put_contents('/singbox/winsw3.xml', preg_replace('#~url~#', $link, file_get_contents('/singbox/winsw3.xml')));
+                    $n    = "singbox_$uid.zip";
+                    copy('/singbox/singbox.zip', $n);
                     $zip = new ZipArchive();
-                    $n   = "singbox_$uid.zip";
-                    $zip->open($n, ZipArchive::CREATE | ZipArchive::OVERWRITE);
-                    foreach (scandir('/singbox') as $k => $v) {
-                        if (!empty(!in_array($v, ['.', '..']))) {
-                            $zip->addFile("/singbox/$v", $v);
-                        }
-                    }
+                    $zip->open($n, ZipArchive::CREATE);
+                    $zip->addFromString('winsw3.xml', preg_replace('#~url~#', $link, file_get_contents('/singbox/winsw3.xml')));
                     $zip->close();
                     header('Content-Disposition: attachment; filename="singbox.zip"');
                     echo file_get_contents($n);
@@ -4801,9 +4933,9 @@ DNS-over-HTTPS with IP:
 
         switch ($_GET['t']) {
             case 's':
-                $c['outbounds'][0]['settings']['vnext'][0]['address']  = $_GET['cdn'] ?: $domain;
+                $c['outbounds'][0]['settings']['vnext'][0]['address']  = '~domain~';
                 $c['outbounds'][0]['settings']['vnext'][0]['users'][0] = [
-                    'id'         => $uid,
+                    'id'         => '~uid~',
                     'encryption' => 'none',
                 ];
                 if ($pac['transport'] == 'Websocket') {
@@ -4815,7 +4947,7 @@ DNS-over-HTTPS with IP:
                         ],
                         "tlsSettings" => [
                             "allowInsecure" => false,
-                            "serverName"    => $_GET['cdn'] ?: $domain,
+                            "serverName"    => '~domain~',
                             "fingerprint"   => "chrome"
                         ]
                     ];
@@ -4826,10 +4958,10 @@ DNS-over-HTTPS with IP:
                         "network"         => "tcp",
                         "security"        => "reality",
                         "realitySettings" => [
-                            "serverName"  => $xr['inbounds'][0]['streamSettings']['realitySettings']['serverNames'][0],
+                            "serverName"  => '~server_name~',
                             "fingerprint" => "chrome",
-                            "publicKey"   => $pac['xray'],
-                            "shortId"     => $xr['inbounds'][0]['streamSettings']['realitySettings']['shortIds'][0],
+                            "publicKey"   => '~public_key~',
+                            "shortId"     => '~short_id~',
                         ]
                     ];
                     $c['outbounds'][0]['mux'] = [
@@ -4837,24 +4969,10 @@ DNS-over-HTTPS with IP:
                         "concurrency" => -1
                     ];
                 }
-
-                foreach ($c['routing']['rules'] as $k => $v) {
-                    if (array_key_exists('domain', $v) && $v['domain'] == '~pac~') {
-                        $c['routing']['rules'][$k]['domain'] = array_keys(array_filter($pac['includelist'] ?: []));
-                        if (empty($c['routing']['rules'][$k]['domain'])) {
-                            unset($c['routing']['rules'][$k]);
-                        }
-                    }
-                }
-                $c['routing']['rules'] = array_values($c['routing']['rules']);
                 break;
             case 'si':
-                if ($c['dns']['servers'][0]['address'] == '~dns~') {
-                    $c['dns']['servers'][0]['address'] = "https://$domain/dns-query/$uid";
-                }
-
-                $c['outbounds'][0]['server'] = $_GET['cdn'] ?: $domain;
-                $c['outbounds'][0]['uuid']   = $uid;
+                $c['outbounds'][0]['server'] = '~domain~';
+                $c['outbounds'][0]['uuid']   = '~uid~';
                 if ($pac['transport'] == 'Websocket') {
                     unset($c['outbounds'][0]['tls']['reality']);
                     unset($c['outbounds'][0]['flow']);
@@ -4862,56 +4980,52 @@ DNS-over-HTTPS with IP:
                         "type" => "ws",
                         "path" => "/ws"
                     ];
-                    $c['outbounds'][0]['tls']['server_name'] = $_GET['cdn'] ?: $domain;
+                    $c['outbounds'][0]['tls']['server_name'] = '~domain~';
                 } else {
                     unset($c['outbounds'][0]["transport"]);
                     $c['outbounds'][0]['flow']                         = 'xtls-rprx-vision';
-                    $c['outbounds'][0]['tls']['reality']['public_key'] = $pac['xray'];
-                    $c['outbounds'][0]['tls']['server_name']           = $xr['inbounds'][0]['streamSettings']['realitySettings']['serverNames'][0];
-                    $c['outbounds'][0]['tls']['reality']['short_id']   = $xr['inbounds'][0]['streamSettings']['realitySettings']['shortIds'][0];
+                    $c['outbounds'][0]['tls']['reality']['public_key'] = '~public_key~';
+                    $c['outbounds'][0]['tls']['server_name']           = '~server_name~';
+                    $c['outbounds'][0]['tls']['reality']['short_id']   = '~short_id~';
                 }
 
-                foreach ($c['route']['rules'] as $k => $v) {
-                    if (array_key_exists('domain_suffix', $v) && $v['domain_suffix'] == '~pac~') {
-                        $c['route']['rules'][$k]['domain_suffix'] = array_keys(array_filter($pac['includelist'] ?: []));
-                        if (empty($c['route']['rules'][$k]['domain_suffix'])) {
-                            unset($c['route']['rules'][$k]);
-                        }
-                    }
-                }
-                $c['route']['rules'] = array_values($c['route']['rules']);
-                $c['route']          = $this->addRuleSet($c['route']);
-                $c['route']          = $this->addPackageRule($c['route']);
-                $c['route']          = $this->createRuleSet($c['route'], $uid);
-                $c['route']          = $this->clearEmptyRules($c['route']);
+                $c['route'] = $this->addRuleSet($c['route']);
+                $c['route'] = $this->createRuleSet($c['route'], $uid, $domain);
                 break;
         }
 
+        $json = $this->replaceTags(json_encode($c), [
+            '"~pac~"'         => json_encode(array_keys(array_filter($pac['includelist'] ?: []))),
+            '~dns~'         => "https://$domain/dns-query/$uid",
+            '~uid~'         => $uid,
+            '~domain~'      => $domain,
+            '~short_id~'    => $xr['inbounds'][0]['streamSettings']['realitySettings']['shortIds'][0],
+            '~public_key~'  => $pac['xray'],
+            '~server_name~' => $xr['inbounds'][0]['streamSettings']['realitySettings']['serverNames'][0],
+        ]);
+        $json = $this->clearEmptyRules($json);
+
         header('Content-type: application/json');
-        echo json_encode($c);
+        echo $json;
     }
 
-    public function clearEmptyRules($route)
+    public function replaceTags($subject, $tags)
     {
-        foreach ($route['rules'] as $k => $v) {
-            if (count($v) == 1) {
-                unset($route['rules'][$k]);
+        return str_replace(array_keys($tags), array_values($tags), $subject);
+    }
+
+    public function clearEmptyRules($json)
+    {
+        $json = json_decode($json, 1);
+        if (!empty($json['routing']['rules'])) {
+            foreach ($json['routing']['rules'] as $k => $v) {
+                if (array_key_exists('domain', $v) && empty($v['domain'])) {
+                    unset($json['routing']['rules'][$k]);
+                }
             }
+            $json['routing']['rules'] = array_values($json['routing']['rules']);
         }
-        $route['rules'] = array_values($route['rules']);
-        return $route;
-    }
-
-    public function addPackageRule($route)
-    {
-        $p = $this->getPacConf();
-        if (!empty($t = array_filter($p['packagelist'] ?: []))) {
-            $route['rules'][] = [
-                'package_name' => array_keys($t),
-                'outbound'     => $p['app_outbound'] ? 'direct' : 'proxy',
-            ];
-        }
-        return $route;
+        return json_encode($json);
     }
 
     public function addRuleSet($route)
@@ -4939,34 +5053,46 @@ DNS-over-HTTPS with IP:
         return $route;
     }
 
-    public function createRuleSet($route, $uid)
+    public function createRuleSet($route, $uid, $domain)
     {
         $pac    = $this->getPacConf();
-        $domain = $this->getDomain();
         $scheme = empty($this->nginxGetTypeCert()) ? 'http' : 'https';
         $hash   = substr(md5($this->key), 0, 8);
 
         foreach ($route['rules'] as $k => $v) {
             if (!empty($v['createruleset'])) {
-                foreach ($v['createruleset'] as $i => $r) {
+                foreach ($v['createruleset'] as $r) {
                     foreach ($r['rules'] as $l => $n) {
-                        if (array_key_exists('domain_suffix', $n) && $n['domain_suffix'] == '~pac~') {
-                            $r['rules'][$l]['domain_suffix'] = array_keys(array_filter($pac['includelist'] ?: []));
-                            if (empty($r['rules'][$l]['domain_suffix'])) {
-                                unset($r['rules'][$l]);
-                            }
-                        }
-                        if (array_key_exists('domain_suffix', $n) && $n['domain_suffix'] == '~warp~') {
-                            $r['rules'][$l]['domain_suffix'] = array_keys(array_filter($pac['warplist'] ?: []));
-                            if (empty($r['rules'][$l]['domain_suffix'])) {
-                                unset($r['rules'][$l]);
-                            }
-                        }
-                        if (array_key_exists('domain_suffix', $n) && $n['domain_suffix'] == '~block~') {
-                            $r['rules'][$l]['domain_suffix'] = array_keys(array_filter($pac['blocklist'] ?: []));
-                            if (empty($r['rules'][$l]['domain_suffix'])) {
-                                unset($r['rules'][$l]);
-                            }
+                        switch (true) {
+                            case array_key_exists('domain_suffix', $n):
+                                switch ($n['domain_suffix']) {
+                                    case '~pac~':
+                                        $t = 'includelist';
+                                        break;
+                                    case '~warp~':
+                                        $t = 'warplist';
+                                        break;
+                                    case '~block~':
+                                        $t = 'blocklist';
+                                        break;
+                                }
+                                $r['rules'][$l]['domain_suffix'] = array_keys(array_filter($pac[$t] ?: []));
+                                if (empty($r['rules'][$l]['domain_suffix'])) {
+                                    unset($r['rules'][$l]);
+                                }
+                                break;
+                            case array_key_exists('package_name', $n):
+                                $r['rules'][$l]['package_name'] = array_keys(array_filter($pac['packagelist'] ?: []));
+                                if (empty($r['rules'][$l]['package_name'])) {
+                                    unset($r['rules'][$l]);
+                                }
+                                break;
+                            case array_key_exists('process_name', $n):
+                                $r['rules'][$l]['process_name'] = array_keys(array_filter($pac['processlist'] ?: []));
+                                if (empty($r['rules'][$l]['process_name'])) {
+                                    unset($r['rules'][$l]);
+                                }
+                                break;
                         }
                     }
                     if (!empty($_GET['r']) && $r['name'] == $_GET['r']) {
@@ -4985,18 +5111,23 @@ DNS-over-HTTPS with IP:
                     }
                     $ruleset[] = [
                         "tag"             => $r['name'],
-                        "url"             => "$scheme://{$domain}/pac?" . http_build_query([
+                        "url"             => "$scheme://{$domain}/pac/" . base64_encode(serialize([
                             'h' => $hash,
                             't' => 'si',
                             's' => $uid,
                             'r' => $r['name'],
-                        ]),
+                        ])),
                         "update_interval" => $r['interval'],
                         "type"            => "remote",
                         "format"          => "binary",
                         "download_detour" => "direct",
                     ];
                     $route['rules'][$k]['rule_set'][] = $r['name'];
+                    switch (true) {
+                        case preg_match('#~(.+)~#', $route['rules'][$k]['outbound'], $m):
+                            $route['rules'][$k]['outbound'] = $pac[$m[1]] ? 'direct' : 'proxy';
+                            break;
+                    }
                 }
                 unset($route['rules'][$k]['createruleset']);
                 if (empty($route['rules'][$k]['rule_set'])) {
@@ -5263,6 +5394,15 @@ DNS-over-HTTPS with IP:
         return openssl_x509_parse($c)["validTo_time_t"] ?: false;
     }
 
+    public function domainsCert()
+    {
+        $domains = openssl_x509_parse(openssl_x509_read(file_get_contents("/certs/cert_public")))['extensions']["subjectAltName"];
+        if (empty($domains)) {
+            return false;
+        }
+        return implode("\n", array_map(fn($e) => trim($e), explode(',', str_replace('DNS:', '', $domains))));
+    }
+
     public function updatebot()
     {
         $b = exec('git -C / rev-parse --abbrev-ref HEAD');
@@ -5325,11 +5465,7 @@ DNS-over-HTTPS with IP:
         }
         $text[] = $conf['domain'] ? "Domains:\n{$conf['domain']}\nnp.{$conf['domain']} (for naiveproxy)\noc.{$conf['domain']} (for openconnect)" . ($conf['adguardkey'] ? "\n{$conf['adguardkey']}.{$conf['domain']} (for adguard DoT)" : '') . $custom : $this->i18n('domain explain');
         $ssl    = $this->expireCert();
-        $text[] = $conf['domain'] ? "\nSSL: " . ($ssl ? date('Y-m-d H:i:s', $this->expireCert()) : 'none') : '';
-
-        if (!empty($conf['linkdomain'])) {
-            $text[] = "\nDomain for link: {$conf['linkdomain']}";
-        }
+        $text[] = $conf['domain'] ? "\nSSL: " . ($ssl ? date('Y-m-d H:i:s', $this->expireCert()) . "\n" . $this->domainsCert() : 'none') : '';
 
         $data = [
             [
@@ -5341,10 +5477,6 @@ DNS-over-HTTPS with IP:
                     'text'          => $this->i18n('+ subdomain'),
                     'callback_data' => '/addSubdomain',
                 ],
-                [
-                    'text'          => $conf['linkdomain'] ? "{$conf['linkdomain']}" :$this->i18n('domain for link'),
-                    'callback_data' => '/addLinkDomain',
-                ],
             ],
         ];
         if ($conf['domain']) {
@@ -5441,6 +5573,12 @@ DNS-over-HTTPS with IP:
                 'callback_data' => "/backup",
             ],
         ];
+        $data[] = [
+            [
+                'text'          => $this->i18n('fake html'),
+                'callback_data' => "/addOverrideHtml",
+            ],
+        ];
         $data[] = [
             [
                 'text'          => $this->i18n('logs'),
@@ -5572,13 +5710,46 @@ DNS-over-HTTPS with IP:
         $this->logs();
     }
 
+    public function selfUpdate()
+    {
+        require __DIR__ . '/config.php';
+        if (!empty($c['admin'])) {
+            $ip = getenv('IP');
+            $rm = explode(':', trim(file_get_contents('/update/reload_message')));
+            $m  = file_get_contents('/update/message');
+            foreach ($c['admin'] as $k => $v) {
+                $r = $this->send($v, "start $ip");
+                $this->input['chat']        = $v;
+                $this->input['message_id']  = $r['result']['message_id'];
+                if (file_exists($this->update)) {
+                    if (!empty($m)) {
+                        $this->send($v, "<pre>$m</pre>", $v == $rm[0] ? $rm[1] : 0);
+                    }
+                    $r = $this->send($v, "import settings");
+                    $this->input['chat']        = $v;
+                    $this->input['message_id']  = $r['result']['message_id'];
+                    $this->input['callback_id'] = $r['result']['message_id'];
+                    if (empty($flag)) {
+                        $this->importFile($this->update);
+                        unlink($this->update);
+                        $flag = true;
+                    }
+                } else {
+                    $this->menu();
+                }
+            }
+        }
+        file_put_contents('/update/message', '');
+        file_put_contents('/update/reload_message', '');
+    }
+
     public function backup()
     {
         $r = $this->send(
             $this->input['chat'],
-            "@{$this->input['username']} enter like start / period",
+            "@{$this->input['username']} enter like: start / period",
             $this->input['message_id'],
-            reply: 'enter like now / 12:00',
+            reply: 'enter like: now / 12 hours',
         );
         $_SESSION['reply'][$r['result']['message_id']] = [
             'start_message'  => $this->input['message_id'],
@@ -5840,7 +6011,7 @@ DNS-over-HTTPS with IP:
                 $conf[] = '';
                 $conf[] = $peer['# PublicKey'] ? '# [Peer]' : '[Peer]';
                 if (!empty($peer['Endpoint'])) {
-                    $peer['Endpoint'] = $this->getDomain() . ":" . getenv($this->getInstanceWG(1) ? 'WG1PORT' : 'WGPORT');
+                    $peer['Endpoint'] = ($this->getPacConf()[$this->getInstanceWG(1) . 'endpoint'] ? $this->ip : $this->getDomain()) . ":" . getenv($this->getInstanceWG(1) ? 'WG1PORT' : 'WGPORT');
                 }
                 foreach ($peer as $k => $v) {
                     $conf[] = "$k = $v";

app/cron.php

@@ -7,5 +7,4 @@ require __DIR__ . '/bot.php';
 require __DIR__ . '/config.php';
 require __DIR__ . '/i18n.php';
 
-$bot = new Bot($c['key'], $i);
-$bot->cron();
+(new Bot($c['key'], $i))->cron();

app/i18n.php

@@ -337,4 +337,12 @@ $i = [
         'en' => '🟢 have updates',
         'ru' => '🟢 есть обновления',
     ],
+    'fake html'  => [
+        'en' => 'fake html',
+        'ru' => 'фейк заглушка',
+    ],
+    'expose-iroutes'  => [
+        'en' => 'expose-iroutes',
+        'ru' => 'изоляция клиентов',
+    ],
 ];

app/init.php

@@ -10,8 +10,9 @@ if ($c['debug']) {
 }
 
 $bot = new Bot($c['key'], $i);
-$bot->adguardProtect();
-$bot->adguardCheckPswd();
-$bot->setcommands();
-$bot->syncPortClients();
 $bot->setwebhook();
+$bot->selfUpdate();
+$bot->adguardCheckPswd();
+$bot->adguardProtect();
+$bot->syncPortClients();
+$bot->setcommands();

app/service.php

@@ -12,32 +12,6 @@ if ($c['debug']) {
 
 $bot = new Bot($c['key'], $i);
 
-if (!empty($c['admin'])) {
-    $ip = getenv('IP');
-    $rm = explode(':', trim(file_get_contents('/update/reload_message')));
-    $m  = file_get_contents('/update/message');
-    foreach ($c['admin'] as $k => $v) {
-        $r = $bot->send($v, "start $ip");
-        $bot->input['chat']        = $v;
-        $bot->input['message_id']  = $r['result']['message_id'];
-        if (file_exists($bot->update)) {
-            if (!empty($m)) {
-                $bot->send($v, "<pre>$m</pre>", $v == $rm[0] ? $rm[1] : 0);
-            }
-            $r = $bot->send($v, "import settings");
-            $bot->input['chat']        = $v;
-            $bot->input['message_id']  = $r['result']['message_id'];
-            $bot->input['callback_id'] = $r['result']['message_id'];
-            if (empty($flag)) {
-                $bot->importFile($bot->update);
-                unlink($bot->update);
-                $flag = true;
-            }
-        }
-    }
-}
-file_put_contents('/update/message', '');
-file_put_contents('/update/reload_message', '');
 $bot->restartTG();
 $bot->sslip();
 $bot->cleanDocker();

config/nginx.conf

@@ -31,7 +31,7 @@ http {
 
     location / {
       root /app;
-      index login.html;
+      index override.html login.html;
       try_files $uri $uri/ =404;
     }
     location /adguard/ {
@@ -48,6 +48,7 @@ http {
     }
     location /pac {
       access_log /logs/nginx_pac_access;
+      proxy_set_header Host $http_host;
       proxy_pass http://php;
     }
     location /tlgrm {
@@ -75,6 +76,27 @@ http {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_read_timeout 5d;
     }
+#-ssl
+#   # The DoH server block
+#   location /dns-query {
+#     access_log /logs/nginx_doh_access;
+#     # Proxy HTTP/1.1, clear the connection header to enable Keep-Alive
+#     proxy_http_version 1.1;
+#     proxy_set_header Connection "";
+#     proxy_set_header  Host $host;
+#     proxy_set_header  X-Real-IP $remote_addr;
+#     proxy_set_header  X-Forwarded-Proto https;
+#     proxy_set_header  X-Forwarded-For $remote_addr;
+#     proxy_set_header  X-Forwarded-Host $remote_addr;
+
+#     # Enable Cache, and set the cache_key to include the request_body
+#     proxy_cache doh_cache;
+#     proxy_cache_key $scheme$proxy_host$uri$is_args$args$request_body;
+
+#     # proxy pass to the dohloop upstream
+#     proxy_pass https://ad/dns-query;
+#   }
+#-ssl
     location ~\.well-known {
       access_log /logs/nginx_certbot_access;
       root /certs/;
@@ -101,7 +123,7 @@ http {
 
   #   location / {
   #     root /app;
-  #     index login.html;
+  #     index override.html login.html;
   #     try_files $uri $uri/ =404;
   #   }
   #   location /adguard/ {
@@ -118,6 +140,7 @@ http {
   #   }
   #   location /pac {
   #     access_log /logs/nginx_pac_access;
+  #     proxy_set_header Host $http_host;
   #     proxy_pass http://php;
   #   }
   #   location ~\.well-known {

config/nginx_default.conf

@@ -31,7 +31,7 @@ http {
 
     location / {
       root /app;
-      index login.html;
+      index override.html login.html;
       try_files $uri $uri/ =404;
     }
     location /adguard/ {
@@ -48,6 +48,7 @@ http {
     }
     location /pac {
       access_log /logs/nginx_pac_access;
+      proxy_set_header Host $http_host;
       proxy_pass http://php;
     }
     location /tlgrm {
@@ -75,6 +76,27 @@ http {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_read_timeout 5d;
     }
+#-ssl
+#   # The DoH server block
+#   location /dns-query {
+#     access_log /logs/nginx_doh_access;
+#     # Proxy HTTP/1.1, clear the connection header to enable Keep-Alive
+#     proxy_http_version 1.1;
+#     proxy_set_header Connection "";
+#     proxy_set_header  Host $host;
+#     proxy_set_header  X-Real-IP $remote_addr;
+#     proxy_set_header  X-Forwarded-Proto https;
+#     proxy_set_header  X-Forwarded-For $remote_addr;
+#     proxy_set_header  X-Forwarded-Host $remote_addr;
+
+#     # Enable Cache, and set the cache_key to include the request_body
+#     proxy_cache doh_cache;
+#     proxy_cache_key $scheme$proxy_host$uri$is_args$args$request_body;
+
+#     # proxy pass to the dohloop upstream
+#     proxy_pass https://ad/dns-query;
+#   }
+#-ssl
     location ~\.well-known {
       access_log /logs/nginx_certbot_access;
       root /certs/;
@@ -101,7 +123,7 @@ http {
 
   #   location / {
   #     root /app;
-  #     index login.html;
+  #     index override.html login.html;
   #     try_files $uri $uri/ =404;
   #   }
   #   location /adguard/ {
@@ -118,6 +140,7 @@ http {
   #   }
   #   location /pac {
   #     access_log /logs/nginx_pac_access;
+  #     proxy_set_header Host $http_host;
   #     proxy_pass http://php;
   #   }
   #   location ~\.well-known {

config/ocserv.conf

@@ -584,7 +584,7 @@ route = default
 # When set to true, all client's iroutes are made visible to all
 # connecting clients except for the ones offering them. This option
 # only makes sense if config-per-user is set.
-#expose-iroutes = true
+expose-iroutes = false
 
 # Groups that a client is allowed to select from.
 # A client may belong in multiple groups, and in certain use-cases

config/pac.json

@@ -1,99 +1 @@
-{
-    "zapret": false,
-    "excludelist": {
-        "(?:v|w)ul(?:c|k)an": true,
-        "^\\d": true,
-        "^a\\w-": true,
-        "^admiral": true,
-        "^avtomaty": true,
-        "^azart": true,
-        "^azimob": true,
-        "^baltplay": true,
-        "a(?:s|z)ino": true,
-        "adrenalin": true,
-        "alco": true,
-        "bet": true,
-        "prostitut": true,
-        "zenit": true,
-        "zerkalo": true,
-        "777": true
-    },
-    "includelist": {},
-    "reverselist": {},
-    "subzoneslist": {
-        "3dn": false,
-        "3nx": true,
-        "akadns": true,
-        "appspot": true,
-        "azurewebsites": true,
-        "beget": true,
-        "berlogovo": true,
-        "biz": true,
-        "brightcove": true,
-        "cc": true,
-        "cloudfront": true,
-        "co": true,
-        "com": true,
-        "cu": true,
-        "ddns": true,
-        "deviantart": true,
-        "dn": true,
-        "dp": true,
-        "dyndns": true,
-        "edgecastcdn": true,
-        "edu": true,
-        "eu": true,
-        "fastly": true,
-        "force": true,
-        "github": true,
-        "google": true,
-        "googleusercontent": true,
-        "gov": true,
-        "herokuapp": true,
-        "hldns": true,
-        "ho": true,
-        "hopto": true,
-        "hwcdn": true,
-        "i": true,
-        "iboards": true,
-        "in": true,
-        "info": true,
-        "int": true,
-        "itch": true,
-        "keenetic": true,
-        "kiev": true,
-        "kirov": true,
-        "linode": true,
-        "livejournal": true,
-        "maryno": true,
-        "mil": true,
-        "msk": true,
-        "my1": true,
-        "mybb2": true,
-        "ne": true,
-        "net": true,
-        "netdna-ssl": true,
-        "nnov": true,
-        "notion": true,
-        "nov": true,
-        "od": true,
-        "org": true,
-        "pp": true,
-        "pximg": true,
-        "pythonanywhere": true,
-        "ru": true,
-        "scaleway": true,
-        "sl": true,
-        "sl-reverse": true,
-        "spb": true,
-        "tilda": true,
-        "trafficmanager": true,
-        "tut": true,
-        "u-stream": true,
-        "ucoz": true,
-        "v": true,
-        "vercel": true,
-        "wix": true,
-        "wixmp": true
-    }
-}
+{}

config/sing.json

@@ -110,6 +110,48 @@
                 "protocol": "dns",
                 "outbound": "dns-out"
             },
+            {
+                "createruleset": [
+                    {
+                        "name": "package",
+                        "interval": "15s",
+                        "rules": [
+                            {
+                                "package_name": "~package~"
+                            }
+                        ]
+                    }
+                ],
+                "outbound": "~app_outbound~"
+            },
+            {
+                "createruleset": [
+                    {
+                        "name": "process",
+                        "interval": "15s",
+                        "rules": [
+                            {
+                                "process_name": "~process~"
+                            }
+                        ]
+                    }
+                ],
+                "outbound": "~process_outbound~"
+            },
+            {
+                "createruleset": [
+                    {
+                        "name": "block",
+                        "interval": "15s",
+                        "rules": [
+                            {
+                                "domain_suffix": "~block~"
+                            }
+                        ]
+                    }
+                ],
+                "outbound": "block"
+            },
             {
                 "createruleset": [
                     {
@@ -133,20 +175,6 @@
                 ],
                 "outbound": "proxy"
             },
-            {
-                "createruleset": [
-                    {
-                        "name": "block",
-                        "interval": "15s",
-                        "rules": [
-                            {
-                                "domain_suffix": "~block~"
-                            }
-                        ]
-                    }
-                ],
-                "outbound": "block"
-            },
             {
                 "outbound": "direct"
             }

docker-compose.yml

@@ -33,7 +33,8 @@ services:
             - ./config/sshd_config:/etc/ssh/sshd_config
             - ./logs/:/logs/
         ports:
-            - 443:443
+            - 443:443/tcp
+            - 443:443/udp
         hostname: upstream
         container_name: upstream-${VER}
         depends_on:
@@ -127,7 +128,7 @@ services:
               required: false
         hostname: php
         container_name: php-${VER}
-        restart: unless-stopped
+        # restart: unless-stopped
         stop_grace_period: 1s
         command: ["/bin/sh", "/start_php.sh"]
         working_dir: /app
@@ -461,6 +462,11 @@ services:
             default:
                 ipv4_address: 10.10.0.11
         logging: *default-logging
+        deploy:
+            resources:
+                limits:
+                    cpus: '0.50'
+                    memory: 200M
     np:
         image: mercurykd/vpnbot-np:1.1
         build:

scripts/init.sh

@@ -16,7 +16,11 @@ echo \
   "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/$(lsb_release -is | tr '[:upper:]' '[:lower:]') \
   $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
 apt update
-apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
+apt install -y docker-ce docker-ce-cli containerd.io
+DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
+mkdir -p $DOCKER_CONFIG/cli-plugins
+curl -SL https://github.com/docker/compose/releases/download/v2.29.6/docker-compose-linux-x86_64 -o $DOCKER_CONFIG/cli-plugins/docker-compose
+chmod +x $DOCKER_CONFIG/cli-plugins/docker-compose
 git clone https://github.com/mercurykd/vpnbot.git
 cd ./vpnbot
 echo "<?php

scripts/start_php.sh

@@ -2,8 +2,12 @@ rm /ssh/key*
 ssh-keygen -m PEM -t rsa -f /ssh/key -N ''
 openssl req -newkey rsa:2048 -sha256 -nodes -x509 -days 365 -keyout /certs/self_private -out /certs/self_public  -subj "/C=NN/ST=N/L=N/O=N/CN=$IP"
 php init.php
-php cron.php &
-unitd --log /logs/unit_error
-curl -X PUT --data-binary @/config/unit.json --unix-socket /var/run/control.unit.sock http://localhost/config
-pkill unitd
-unitd --no-daemon --control 0.0.0.0:8080 --log /logs/unit_error
+if [[ -f "/start" && -f "/ssh/key.pub" && -s "/ssh/key.pub" ]]; then
+    php cron.php &
+    unitd --log /logs/unit_error
+    curl -X PUT --data-binary @/config/unit.json --unix-socket /var/run/control.unit.sock http://localhost/config
+    pkill unitd
+    unitd --no-daemon --control 0.0.0.0:8080 --log /logs/unit_error
+else
+    exit 1;
+fi

scripts/start_wp.sh

@@ -1,14 +1,18 @@
 cat /ssh/key.pub > /root/.ssh/authorized_keys
 ssh-keygen -A
 exec /usr/sbin/sshd -D -e "$@" &
-warp-svc > /dev/null &
-sleep 3
-warp-cli --accept-tos registration new
+off=$(cat /config/pac.json | jq -r .warpoff)
 key=$(cat /config/pac.json | jq -r .warp)
-if [ ! -z "$key" ]
+if [ "$off" == 'null' ]
 then
-    warp-cli --accept-tos registration license $key
+    warp-svc > /dev/null &
+    sleep 3
+    warp-cli --accept-tos registration new
+    if [ ! -z "$key" ]
+    then
+        warp-cli --accept-tos registration license $key
+    fi
+    warp-cli --accept-tos mode proxy
+    warp-cli --accept-tos connect
 fi
-warp-cli --accept-tos mode proxy
-warp-cli --accept-tos connect
 socat TCP-LISTEN:4000,fork TCP:127.0.0.1:40000

singbox_windows/install.cmd

@@ -1,2 +0,0 @@
-winsw3.exe install
-pause

singbox_windows/restart.cmd

@@ -1,2 +0,0 @@
-winsw3.exe stop
-winsw3.exe start

singbox_windows/start.cmd

@@ -1 +0,0 @@
-winsw3.exe start

singbox_windows/status.cmd

@@ -1,2 +0,0 @@
-winsw3.exe status
-pause

singbox_windows/stop.cmd

@@ -1 +0,0 @@
-winsw3.exe stop

singbox_windows/uninstall.cmd

@@ -1,2 +0,0 @@
-winsw3.exe uninstall
-pause

update/update.sh

@@ -24,7 +24,7 @@ do
         curl -H "Content-Type: application/json" -X POST https://api.telegram.org/bot$key/editMessageText -d "$(cat $pwd/update/curl | sed 's/"text":"~t~"/"text": "применяю обновления"/')"
         git pull > ./update/message
         curl -H "Content-Type: application/json" -X POST https://api.telegram.org/bot$key/editMessageText -d "$(cat $pwd/update/curl | sed 's/"text":"~t~"/"text": "запускаю бота"/')"
-        IP=$(curl https://ipinfo.io/ip) VER=$(git describe --tags) docker compose up -d --force-recreate
+        IP=$(curl ipinfo.io/ip) VER=$(git describe --tags) docker compose --env-file ./.env --env-file ./override.env up -d --force-recreate
         bash $pwd/update/update.sh &
         > $pwd/update/key
         > $pwd/update/curl

version

@@ -1,3 +1,50 @@
+21.10.2024 v1.74
+- openconnect: expose-iroutes on/off
+21.10.2024 v1.73
+- openconnect: ограничение контейнера по цпу и памяти
+21.10.2024 v1.72
+- xray: теги в кастомных шаблонах
+21.10.2024 v1.71
+- фикс установки nip.io  при первом запуске
+- фикс инициализации вебпанели adguardHome при первом запуске
+14.10.2024 v1.70
+- xray route: учет регистра в process_name, package_name
+14.10.2024 v1.69
+- xray route: добавлен список process_name
+14.10.2024 v1.68
+- singbox template: package_name -> ruleset
+13.10.2024 v1.67
+- sslip.io -> nip.io
+13.10.2024 v1.66
+- singbox template: изменен порядок правил маршрутизации для package_name
+10.10.2024 v1.65.1
+- фикс создания архива windows service singbox 2
+09.10.2024 v1.65
+- фикс создания архива windows service singbox
+06.10.2024 v1.64.1
+- добавление html заглушки через меню
+06.10.2024 v1.64
+- возможность установить свою html-заглушку
+06.10.2024 v1.63
+- приоритет правила block над остальными в стандартном шаблоне sing-box
+30.09.2024 v1.62
+- импорт профиля xray в karing
+30.09.2024 v1.61.1
+- фикс удаления ключа варпа через ноль
+29.09.2024 v1.61
+- включение/отключение процесса warp
+29.09.2024 v1.60
+- ускорение сборки архива sing-box windows
+23.09.2024 v1.59
+- docker compose v2.29.6 (при установке бота)
+22.09.2024 v1.58
+- фикс запуска бота с правильными параметрами после обновления
+22.09.2024 v1.57
+- выбор типа endpoint для wireguard/amnezia
+22.09.2024 v1.56.2
+- фикс разных доменов при указании cdn для xray
+19.09.2024 v1.56.1
+- cdn для xray
 17.09.2024 v1.55
 - возможность подменить домен в ссылках на конфиги
 16.09.2024 v1.54.2