fix default password for shadowsocks

Update readme.md

.gitignore

@@ -22,4 +22,7 @@ update/*
 override.env
 override.html
 override.php
-docker-compose.override.yml
+docker-compose.override.yml
+backup.json
+app/webapp/override/
+.rest

app/backup.php

@@ -0,0 +1,13 @@
+<?php
+
+require __DIR__ . '/timezone.php';
+
+require __DIR__ . '/bot.php';
+require __DIR__ . '/config.php';
+require __DIR__ . '/i18n.php';
+if ($c['debug']) {
+    require __DIR__ . '/debug.php';
+}
+
+$bot = new Bot($c['key'], $i);
+echo $bot->export();

app/i18n.php

@@ -262,8 +262,12 @@ $i = [
         'ru' => 'очистить',
     ],
     'xray'  => [
-        'en' => 'Xray',
+        'en' => 'Vless',
-        'ru' => 'Xray',
+        'ru' => 'Vless',
+    ],
+    'clash'  => [
+        'en' => 'mihomo',
+        'ru' => 'mihomo',
     ],
     'geodb'  => [
         'en' => 'GeoIp/GeoSite',

app/index.php

@@ -37,6 +37,7 @@ if ($hash == substr(md5($c['key']), 0, 8)) {
             break;
         case 's':
         case 'si':
+        case 'cl':
             $bot->subscription();
             exit;
 

app/service.php

@@ -18,7 +18,7 @@ if (!empty($bot->selfupdate)) {
     $bot->offWarp();
 }
 $bot->dontshowcron = 1;
-$bot->adguardSync();
 $bot->sslip();
+$bot->adguardSync();
 $bot->syncDeny();
 $bot->cleanDocker();

config/clash.json

@@ -0,0 +1,141 @@
+{
+    "mixed-port": 2080,
+    "allow-lan": true,
+    "tcp-concurrent": true,
+    "enable-process": true,
+    "find-process-mode": "strict",
+    "global-client-fingerprint": "chrome",
+    "mode": "rule",
+    "log-level": "info",
+    "ipv6": false,
+    "keep-alive-interval": 30,
+    "unified-delay": false,
+    "profile": {
+        "store-selected": true,
+        "store-fake-ip": true
+    },
+    "sniffer": {
+        "enable": true,
+        "sniff": {
+            "HTTP": {
+                "ports": [
+                    80,
+                    "8080-8880"
+                ],
+                "override-destination": true
+            },
+            "TLS": {
+                "ports": [
+                    443,
+                    8443
+                ]
+            },
+            "QUIC": {
+                "ports": [
+                    443,
+                    8443
+                ]
+            }
+        }
+    },
+    "tun": {
+        "enable": true,
+        "stack": "mixed",
+        "dns-hijack": [
+            "any:53"
+        ],
+        "auto-route": true,
+        "auto-detect-interface": true,
+        "strict-route": true
+    },
+    "dns": {
+        "enable": true,
+        "listen": ":1053",
+        "prefer-h3": false,
+        "ipv6": false,
+        "enhanced-mode": "fake-ip",
+        "fake-ip-filter": [
+            "~domain~",
+            "+.lan",
+            "+.local"
+        ],
+        "nameserver": [
+            "~dns~"
+        ]
+    },
+    "proxies": [
+        {
+            "name": "~outbound~",
+            "type": "vless",
+            "server": "~domain~",
+            "port": 443,
+            "uuid": "~uid~",
+            "network": "tcp",
+            "flow": "xtls-rprx-vision",
+            "tls": true,
+            "reality-opts": {
+                "public-key": "~public_key~",
+                "short-id": "~short_id~"
+            },
+            "servername": "~server_name~",
+            "client-fingerprint": "chrome"
+        }
+    ],
+    "proxy-groups": [
+        {
+            "name": "PROXY",
+            "type": "select",
+            "proxies": [
+                "~outbound~"
+            ]
+        }
+    ],
+    "add-rule-providers": true,
+    "rule-providers": {},
+    "rules": [
+        {
+            "type": "RULE-SET",
+            "list": "~block~",
+            "action": "REJECT",
+            "interval": 30,
+            "behavior": "domain",
+            "name": "block"
+        },
+        {
+            "type": "RULE-SET",
+            "list": "~process~",
+            "action": "PROXY",
+            "interval": 30,
+            "behavior": "classical",
+            "name": "process"
+        },
+        {
+            "type": "RULE-SET",
+            "list": "~package~",
+            "action": "PROXY",
+            "interval": 30,
+            "behavior": "classical",
+            "name": "package"
+        },
+        {
+            "type": "RULE-SET",
+            "list": "~warp~",
+            "action": "PROXY",
+            "interval": 30,
+            "behavior": "domain",
+            "name": "warp"
+        },
+        {
+            "type": "RULE-SET",
+            "list": "~pac~",
+            "action": "PROXY",
+            "interval": 30,
+            "behavior": "domain",
+            "name": "pac"
+        },
+        {
+            "type": "MATCH",
+            "action": "DIRECT"
+        }
+    ]
+}

config/ocserv.conf

@@ -505,7 +505,7 @@ ipv4-netmask = 255.255.255.0
 
 # Whether to tunnel all DNS queries via the VPN. This is the default
 # when a default route is set.
-#tunnel-all-dns = true
+tunnel-all-dns = true
 
 # The advertised DNS server. Use multiple lines for
 # multiple servers.

config/sing.json

@@ -111,10 +111,11 @@
                 "outbound": "dns-out"
             },
             {
+                "addruleset": true,
                 "createruleset": [
                     {
                         "name": "pac",
-                        "interval": "15s",
+                        "interval": "30s",
                         "rules": [
                             {
                                 "domain_suffix": "~pac~"
@@ -122,13 +123,14 @@
                         ]
                     }
                 ],
-                "outbound": "~domains_outbound~"
+                "outbound": "~outbound~"
             },
             {
+                "addruleset": true,
                 "createruleset": [
                     {
                         "name": "package",
-                        "interval": "15s",
+                        "interval": "30s",
                         "rules": [
                             {
                                 "package_name": "~package~"
@@ -136,13 +138,14 @@
                         ]
                     }
                 ],
-                "outbound": "~app_outbound~"
+                "outbound": "~outbound~"
             },
             {
+                "addruleset": true,
                 "createruleset": [
                     {
                         "name": "process",
-                        "interval": "15s",
+                        "interval": "30s",
                         "rules": [
                             {
                                 "process_name": "~process~"
@@ -150,13 +153,14 @@
                         ]
                     }
                 ],
-                "outbound": "~process_outbound~"
+                "outbound": "~outbound~"
             },
             {
+                "addruleset": true,
                 "createruleset": [
                     {
                         "name": "block",
-                        "interval": "15s",
+                        "interval": "30s",
                         "rules": [
                             {
                                 "domain_suffix": "~block~"
@@ -167,10 +171,11 @@
                 "outbound": "block"
             },
             {
+                "addruleset": true,
                 "createruleset": [
                     {
                         "name": "warp",
-                        "interval": "15s",
+                        "interval": "30s",
                         "rules": [
                             {
                                 "domain_suffix": "~warp~"
@@ -179,11 +184,8 @@
                     }
                 ],
                 "outbound": "~outbound~"
-            },
-            {
-                "outbound": "direct"
             }
         ],
-        "final": "~final_outbound~"
+        "final": "direct"
     }
 }

config/sslocal.json

@@ -3,7 +3,7 @@
     "server_port": 8388,
     "local_address": "0.0.0.0",
     "local_port": 1080,
-    "password": "test",
+    "password": "",
     "timeout": 120,
     "method": "chacha20-ietf-poly1305",
     "no_delay": true,

config/ssserver.json

@@ -1,7 +1,7 @@
 {
     "server": "0.0.0.0",
     "server_port": 8388,
-    "password": "test",
+    "password": "",
     "timeout": 120,
     "method": "chacha20-ietf-poly1305",
     "no_delay": true,

docker-compose.yml

@@ -96,7 +96,7 @@ services:
                 ipv4_address: 10.10.1.2
         logging: *default-logging
     php:
-        image: mercurykd/vpnbot-php:1.6
+        image: mercurykd/vpnbot-php:1.7
         build:
             dockerfile: dockerfile/php.dockerfile
             args:
@@ -160,7 +160,9 @@ services:
             - ./ssh:/ssh
             - ./app:/app
             - ./logs/:/logs/
+            - ./version:/version
             - ./update:/update
+            - ./.git:/.git
             - ./scripts/start_service.sh:/start_service.sh
             - /var/run/docker.sock:/var/run/docker.sock:ro
         environment:
@@ -305,7 +307,7 @@ services:
                 ipv4_address: 10.10.0.14
         logging: *default-logging
     ad:
-        image: mercurykd/vpnbot-ad:1.2
+        image: mercurykd/vpnbot-ad:1.3
         build:
             dockerfile: dockerfile/adguard.dockerfile
             args:
@@ -403,7 +405,7 @@ services:
                 ipv4_address: 10.10.0.8
         logging: *default-logging
     xr:
-        image: mercurykd/vpnbot-xr:1.3
+        image: mercurykd/vpnbot-xr:1.4
         build:
             dockerfile: dockerfile/xray.dockerfile
             args:

dockerfile/php.dockerfile

@@ -22,16 +22,17 @@ RUN apk add --no-cache --update php81 \
     curl \
     git \
     py3-qt5 \
-    && wget https://github.com/ameshkov/dnslookup/releases/download/v1.9.1/dnslookup-linux-amd64-v1.9.1.tar.gz \
+    && mkdir /root/.ssh \
-    && tar -xf dnslookup-linux-amd64-v1.9.1.tar.gz \
+    && wget https://github.com/ameshkov/dnslookup/releases/download/v1.11.1/dnslookup-linux-amd64-v1.11.1.tar.gz \
+    && tar -xf dnslookup-linux-amd64-v1.11.1.tar.gz \
     && mv linux-amd64/dnslookup /usr/bin \
-    && rm dnslookup-linux-amd64-v1.9.1.tar.gz \
+    && rm dnslookup-linux-amd64-v1.11.1.tar.gz \
     && rm -rf /linux-amd64 \
-    && wget https://github.com/SagerNet/sing-box/releases/download/v1.8.11/sing-box-1.8.11-linux-amd64.tar.gz \
+    && wget https://github.com/SagerNet/sing-box/releases/download/v1.10.3/sing-box-1.10.3-linux-amd64.tar.gz \
-    && tar -xf sing-box-1.8.11-linux-amd64.tar.gz \
+    && tar -xf sing-box-1.10.3-linux-amd64.tar.gz \
-    && mv sing-box-1.8.11-linux-amd64/sing-box /usr/bin \
+    && mv sing-box-1.10.3-linux-amd64/sing-box /usr/bin \
-    && rm sing-box-1.8.11-linux-amd64.tar.gz \
+    && rm sing-box-1.10.3-linux-amd64.tar.gz \
-    && rm -rf /sing-box-1.8.11-linux-amd64
+    && rm -rf /sing-box-1.10.3-linux-amd64 \
-RUN apk add openssh \
+    && wget https://github.com/MetaCubeX/mihomo/releases/download/v1.18.10/mihomo-linux-amd64-v1.18.10.gz \
-    && mkdir /root/.ssh
+    && gunzip mihomo-linux-amd64-v1.18.10.gz \
-    ENV ENV="/root/.ashrc"
+    && mv mihomo-linux-amd64-v1.18.10 /usr/bin/mihomo

makefile

@@ -59,4 +59,12 @@ c:
 	git checkout .
 	git reset
 webhook:
-	docker compose exec php php checkwebhook.php
+	docker compose exec php php checkwebhook.php
+reset:
+	make d
+	git reset --hard
+	git clean -fd
+	docker volume rm vpnbot_adguard vpnbot_warp
+	make u
+backup:
+	docker compose exec php php backup.php > backup.json

readme.md

@@ -1,28 +1,37 @@
 telegram bot to manage servers (inside the bot)
 
-<img src="https://github.com/mercurykd/vpnbot/assets/30900414/d5a81237-5215-41db-87e5-20734120cc9c" width="200">
+<img src="https://github.com/user-attachments/assets/ec5faa51-987c-461a-a973-d94c7edf7115" width="300">
 
-### XTLS-Reality
+### VLESS (Reality OR Websocket)
 - change secret
 - qr/config
 - change fake domain
 - multiple users
-- subscriptions with routing
+- subscriptions with routing (xray, sing-box, mihomo)
 - routing templates per user
+- routing via rulesets (sing-box, mihomo)
 - steal from yourself
-<img src="https://github.com/mercurykd/vpnbot/assets/30900414/39bdf4e0-96a6-4257-b61e-30a14122e236" width="200">
+- add domains to warp
+
+### Main menu VLESS:
+<img src="https://github.com/user-attachments/assets/80d2f671-fade-4819-a96a-efa253741ffd" width="300">
+
+### User menu VLESS:
+<img src="https://github.com/user-attachments/assets/5c3c5b5e-1931-4e98-a472-d303bac61a4e" width="300">
 
 ### NaiveProxy
 - change login
 - change password
-<img src="https://github.com/mercurykd/vpnbot/assets/30900414/2127a4af-0436-452c-bfe2-c750dd5dbc06" width="200">
+<img src="https://github.com/mercurykd/vpnbot/assets/30900414/2127a4af-0436-452c-bfe2-c750dd5dbc06" width="300">
 
 ### OpenConnect
 - change secret
 - change password
 - change dns
 - add user
-<img src="https://github.com/mercurykd/vpnbot/assets/30900414/a4ffc04f-965a-439b-862b-210b98e1f87d" width="200">
+- add ip subnet
+- expose-iroutes (lan between users)
+<img src="https://github.com/user-attachments/assets/c3a8a78e-fe99-423c-a626-610b333a2a56" width="300">
 
 ### Wireguard / Amnezia
 - create
@@ -31,31 +40,38 @@ telegram bot to manage servers (inside the bot)
 - timer
 - torrent blocking
 - qr/config
+- AmneziaVPN vpn:// link
 - statistics
-<img src="https://github.com/mercurykd/vpnbot/assets/30900414/51a79c93-8083-40ba-a14b-a6ef19f00531" width="200">
+<img src="https://github.com/mercurykd/vpnbot/assets/30900414/51a79c93-8083-40ba-a14b-a6ef19f00531" width="300">
-<img src="https://github.com/mercurykd/vpnbot/assets/30900414/fd6ffd9f-bd75-479c-8dca-ea6c0b938b6c" width="200">
+<img src="https://github.com/mercurykd/vpnbot/assets/30900414/fd6ffd9f-bd75-479c-8dca-ea6c0b938b6c" width="300">
 
 ### Shadowsocks + v2ray
 - change password
 - on/off v2ray
 - qr
 - short link
-<img src="https://github.com/mercurykd/vpnbot/assets/30900414/fbe39617-63ae-4536-8ab0-e4269ed8784a" width="200">
+<img src="https://github.com/mercurykd/vpnbot/assets/30900414/fbe39617-63ae-4536-8ab0-e4269ed8784a" width="300">
 
 ### AdguardHome
 - change password
 - change upstream dns
 - check dns
-<img src="https://github.com/mercurykd/vpnbot/assets/30900414/a7d4ba52-494b-429f-a3e2-08c68c8353c4" width="200">
+- check safesearch
+- add custom clientID for DNSoverTLS (DOT)
+- fill allowed clients (WG/AWG + OpenConnect + VLESS)
+- custom ID for each user VLESS
+<img src="https://github.com/user-attachments/assets/1dcdd9f9-f781-4ec2-8e32-01ce6095e0a3" width="300">
 
 ### PAC
 - the ability to create your own PAC available by url with the ability to substitute the final ip and port
-<img src="https://github.com/mercurykd/vpnbot/assets/30900414/5343e009-1b21-450f-918d-b811b98a0549" width="200">
+- Shadowsocks Android PAC
+- add [antifilter-community](https://community.antifilter.download/) or [ru-bundle](https://github.com/legiz-ru/sb-rule-sets/blob/main/ru-bundle.lst) domain lists
+<img src="https://github.com/user-attachments/assets/8d039dbb-6478-43a8-811a-4279e766c884" width="300">
 
 ### MTProto
 - change secret
 - qr/config
-<img src="https://github.com/mercurykd/vpnbot/assets/30900414/411696d8-172a-4dac-b6b7-4a6da3adfab2" width="200">
+<img src="https://github.com/user-attachments/assets/d37b2e1c-f991-4e1c-8060-1b547eea8fe2" width="300">
 
 ### Settings
 - add/change admin
@@ -63,10 +79,12 @@ telegram bot to manage servers (inside the bot)
 - import/export all settings
 - domain binding
 - obtain ssl for domain
-<img src="https://github.com/mercurykd/vpnbot/assets/30900414/431ec09d-9c14-4c74-b8f6-e49c142132e8" width="200">
+- fake html for domain
+- ports block
+<img src="https://github.com/user-attachments/assets/82b78014-eaa2-4b4c-bc90-77f58d03d57c" width="300">
 
 ---
-environment: ubuntu 18.04/20.04/22.04, debian 11/12
+environment: ubuntu 22.04/24.04, debian 11/12
 
 ### Install:
 

scripts/dns_close_53_port.sh

@@ -1,5 +0,0 @@
-make d
-rm /etc/systemd/resolved.conf.d/adguardhome.conf
-mv /etc/resolv.conf.backup /etc/resolv.conf
-systemctl reload-or-restart systemd-resolved
-make u

scripts/dns_open_53_port.sh

@@ -1,8 +0,0 @@
-mkdir /etc/systemd/resolved.conf.d
-echo "[Resolve]
-DNS=127.0.0.1
-DNSStubListener=no" > /etc/systemd/resolved.conf.d/adguardhome.conf
-mv /etc/resolv.conf /etc/resolv.conf.backup
-ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf
-systemctl reload-or-restart systemd-resolved
-make d u

update/update.sh

@@ -10,23 +10,23 @@ do
     if [[ -n "$cmd" ]]
     then
         key=$(cat $pwd/update/key)
-        curl -H "Content-Type: application/json" -X POST https://api.telegram.org/bot$key/editMessageText -d "$(cat $pwd/update/curl | sed 's/"text":"~t~"/"text": "останавливаю бота"/')"
+        curl -H "Content-Type: application/json" -X POST https://api.telegram.org/bot$key/editMessageText -d "$(cat $pwd/update/curl | sed 's/"text":"~t~"/"text": "stopping the bot"/')"
         docker compose down --remove-orphans
         if [[ "$cmd" == "1" ]]
         then
-            curl -H "Content-Type: application/json" -X POST https://api.telegram.org/bot$key/editMessageText -d "$(cat $pwd/update/curl | sed 's/"text":"~t~"/"text": "очищаю директорию"/')"
+            curl -H "Content-Type: application/json" -X POST https://api.telegram.org/bot$key/editMessageText -d "$(cat $pwd/update/curl | sed 's/"text":"~t~"/"text": "clearing the directory"/')"
             git reset --hard && git clean -fd
-            curl -H "Content-Type: application/json" -X POST https://api.telegram.org/bot$key/editMessageText -d "$(cat $pwd/update/curl | sed 's/"text":"~t~"/"text": "скачиваю обновление"/')"
+            curl -H "Content-Type: application/json" -X POST https://api.telegram.org/bot$key/editMessageText -d "$(cat $pwd/update/curl | sed 's/"text":"~t~"/"text": "downloading the update"/')"
             git fetch
             if [[ -n "$branch" ]]
             then
-                curl -H "Content-Type: application/json" -X POST https://api.telegram.org/bot$key/editMessageText -d "$(cat $pwd/update/curl | sed 's/"text":"~t~"/"text": "меняю ветку"/')"
+                curl -H "Content-Type: application/json" -X POST https://api.telegram.org/bot$key/editMessageText -d "$(cat $pwd/update/curl | sed 's/"text":"~t~"/"text": "changing branch"/')"
                 git checkout -t origin/$branch || git checkout $branch
             fi
-            curl -H "Content-Type: application/json" -X POST https://api.telegram.org/bot$key/editMessageText -d "$(cat $pwd/update/curl | sed 's/"text":"~t~"/"text": "применяю обновления"/')"
+            curl -H "Content-Type: application/json" -X POST https://api.telegram.org/bot$key/editMessageText -d "$(cat $pwd/update/curl | sed 's/"text":"~t~"/"text": "applying updates"/')"
             git pull > ./update/message
         fi
-        curl -H "Content-Type: application/json" -X POST https://api.telegram.org/bot$key/editMessageText -d "$(cat $pwd/update/curl | sed 's/"text":"~t~"/"text": "запускаю бота"/')"
+        curl -H "Content-Type: application/json" -X POST https://api.telegram.org/bot$key/editMessageText -d "$(cat $pwd/update/curl | sed 's/"text":"~t~"/"text": "launching the bot"/')"
         IP=$(curl ipinfo.io/ip) VER=$(git describe --tags) docker compose --env-file ./.env --env-file ./override.env up -d --force-recreate
         bash $pwd/update/update.sh &
         > $pwd/update/key

version

@@ -1,3 +1,56 @@
+14.12.2024 v1.114
+- убран дефолтный пароль у shadowsocks
+13.12.2024 v1.113
+- обновлен adguardHome
+- фикс краша adg при удалении dns-upstream из бота
+10.12.2024 v1.112
+- mihomo: встроенные списки теперь отдаются через rule-providers(т.е подгружаются ядром без обновления конфига)
+- обновлены ядра
+09.12.2024 v1.111
+- mihomo: фикс rule-providers format
+06.12.2024 v1.110
+- ruleset для mihomo
+28.11.2024 v1.109
+- фикс автоскана
+- добавление clash-шаблонов
+21.11.2024 v1.108
+- xray: addruleset для direct
+- openconnect:ограничение формата при добавлении подсети
+- новый механизм сверки ip для анализатора айпи
+- мелкие фиксы меню и текста
+21.11.2024 v1.107
+- xray: добавлены теги ~cdndomain~, ~directdomain~
+- xray: возможность менять имя главного аутбаунда(тот аутбаунд который заполняет бот, в шаблонах идет как ~outbound~) для клиентских конфигов
+- xray: в шаблонах теперь надо явно указывать ключ addruleset в route -> rules, чтобы бот заполнил их правилами из списка ruleset (см origin шаблон)
+- openconnect: добавлена маршрутизация (список подсетей общий с wireguard)
+- ip ban: фикс обработки подсетей в белом/черном списках
+- ip ban: в белый список можно импортировать адреса от telegram, gcore, cloudflare
+- добавлена в игнор папка app/webapp/override. она не будет перезатираться после обновления, туда можно положить ваши ресурсы к override.html
+- <code>make backup</code> - сохранит в корень backup.json
+- <code>make reset</code> - обнуляет все настройки
+18.11.2024 v1.106
+- фикс отвала бота при пустых логах телеги
+17.11.2024 v1.105
+- фикс установки домена при первом запуске
+16.11.2024 v1.104
+- единая механика закрепления бэкапа
+- фикс текста уведомления о новой версии
+16.11.2024 v1.103
+- фикс уведомления о новой версии
+16.11.2024 v1.102
+- переделан раздел списка ip под управление кнопками
+- возможность добавить свои айпи в blocklist/whitelist
+15.11.2024 v1.101
+- кнопка добавления https://github.com/legiz-ru/sb-rule-sets/raw/main/ru-bundle.lst
+- переделан раздел списка ip для читаемости
+15.11.2024 v1.100
+- несколько режимов silence для сканера
+- анализ сканера скидывает файл всех найденных айпи
+- команда /searchLogs (пока только для айпи)
+- логи переехали в меню сканера
+- обновление текстов и подсказок
+14.11.2024 v1.99.1
+- анализ логов и бан айпишников, фиксы
 14.11.2024 v1.99
 - анализ логов и бан айпишников
 11.11.2024 v1.98