update version

Add HWID device limit support for sub page

.gitignore

@@ -10,6 +10,7 @@
 /sftp-config.json
 /tg.pyr
 /config/wg0.conf
+/config/hwid.json
 /todo.todo
 /app/zapretlists/*
 !/app/zapretlists/.gitkeep
@@ -26,3 +27,8 @@ docker-compose.override.yml
 backup.json
 app/webapp/override/
 .rest
+
+subscription.php
+location.conf
+override.conf
+i18n.override.php

app/i18n.php

@@ -30,7 +30,7 @@ $i = [
         'ru' => 'PAC',
     ],
     'chat'                 => [
-        'en' => 'discussion group',
+        'en' => 'chat',
         'ru' => 'чат поддержки',
     ],
     'back'                 => [
@@ -193,6 +193,30 @@ $i = [
         'en' => 'delete internal dns',
         'ru' => 'удалить внутренний dns',
     ],
+    'hwid limit' => [
+        'en' => 'HWID limit',
+        'ru' => 'HWID лимит',
+    ],
+    'hwid devices' => [
+        'en' => 'HWID devices',
+        'ru' => 'Устройства HWID',
+    ],
+    'set hwid devices count' => [
+        'en' => 'set HWID devices count',
+        'ru' => 'установить количество HWID устройств',
+    ],
+    'use default hwid limit' => [
+        'en' => 'use default limit',
+        'ru' => 'использовать лимит по умолчанию',
+    ],
+    'no devices' => [
+        'en' => 'no devices',
+        'ru' => 'нет устройств',
+    ],
+    'hwid notice' => [
+        'en' => 'HWID limit works only when subscription is refreshed or added',
+        'ru' => 'HWID лимит срабатывает только в момент обновления и добавления подписки',
+    ],
     'on'  => [
         'en' => '🟢',
         'ru' => '🟢',
@@ -378,3 +402,7 @@ $i = [
         'ru' => 'перезагрузка',
     ],
 ];
+
+if (file_exists(__DIR__ . '/i18n.override.php')) {
+    include __DIR__ . '/i18n.override.php';
+}

app/index.php

@@ -38,10 +38,14 @@ switch (true) {
 
     // adguard cookie
     case preg_match('~^' . preg_quote("/webapp$hash/check") . '~', $_SERVER['REQUEST_URI']) && $webapp:
-        setcookie('c', substr(hash('sha256', $c['key']), 0, 8), 0, '/');
+        setcookie('c', $hash, 0, '/');
         echo "/adguard$hash/";
         break;
 
+    case preg_match('~^' . preg_quote("/pac$hash/sub") . '~', $_SERVER['REQUEST_URI']) && file_exists(__DIR__ . '/subscription.php'):
+        $bot->sub();
+        exit;
+
     // subs & pac
     case preg_match('~^' . preg_quote("/pac$hash") . '~', $_SERVER['REQUEST_URI']):
         if (!empty($t = unserialize(base64_decode(explode('/', $_SERVER['REQUEST_URI'])[2])))) { // fix sing-box import

app/iplimit.php

@@ -0,0 +1,10 @@
+<?php
+
+require __DIR__ . '/timezone.php';
+
+// require __DIR__ . '/debug.php';
+require __DIR__ . '/bot.php';
+require __DIR__ . '/config.php';
+require __DIR__ . '/i18n.php';
+
+(new Bot($c['key'], $i))->analyzeXray();

app/service.php

@@ -13,6 +13,7 @@ if ($c['debug']) {
 $bot = new Bot($c['key'], $i);
 
 $bot->selfUpdate();
+$bot->ssPswdCheck();
 $bot->restartTG();
 if (!empty($bot->selfupdate)) {
     $bot->offWarp();
@@ -23,3 +24,9 @@ $bot->adguardSync();
 $bot->cloakNginx();
 $bot->syncDeny();
 $bot->cleanDocker();
+$bot->dnsttStart();
+$bot->restartHysteria();
+$c = $bot->getPacConf();
+$bot->setUpstreamDomain($c['transport'] != 'Reality' ? 't' : $c['reality']['domain']);
+$bot->setUpstreamDomainNaive($c['domain']);
+$bot->setUpstreamDomainOcserv($c['domain']);

config/clash.json

@@ -8,7 +8,7 @@
     "mode": "rule",
     "log-level": "info",
     "ipv6": false,
-    "keep-alive-interval": 30,
+    "keep-alive-interval": 60,
     "unified-delay": false,
     "profile": {
         "store-selected": true,
@@ -72,6 +72,7 @@
             "uuid": "~uid~",
             "network": "tcp",
             "flow": "xtls-rprx-vision",
+            "udp": true,
             "tls": true,
             "reality-opts": {
                 "public-key": "~public_key~",
@@ -97,7 +98,7 @@
             "type": "RULE-SET",
             "list": "~block~",
             "action": "REJECT",
-            "interval": 30,
+            "interval": 60,
             "behavior": "domain",
             "name": "block"
         },
@@ -105,7 +106,7 @@
             "type": "RULE-SET",
             "list": "~process~",
             "action": "PROXY",
-            "interval": 30,
+            "interval": 60,
             "behavior": "classical",
             "name": "process"
         },
@@ -113,7 +114,7 @@
             "type": "RULE-SET",
             "list": "~package~",
             "action": "PROXY",
-            "interval": 30,
+            "interval": 60,
             "behavior": "classical",
             "name": "package"
         },
@@ -121,18 +122,26 @@
             "type": "RULE-SET",
             "list": "~warp~",
             "action": "PROXY",
-            "interval": 30,
-            "behavior": "domain",
+            "interval": 60,
+            "behavior": "classical",
             "name": "warp"
         },
         {
             "type": "RULE-SET",
             "list": "~pac~",
             "action": "PROXY",
-            "interval": 30,
+            "interval": 60,
             "behavior": "domain",
             "name": "pac"
         },
+        {
+            "type": "RULE-SET",
+            "list": "~subnet~",
+            "action": "PROXY",
+            "interval": 60,
+            "behavior": "ipcidr",
+            "name": "subnet"
+        },
         {
             "type": "MATCH",
             "action": "DIRECT"

config/hwid.json

@@ -0,0 +1 @@
+{}

config/hysteria.yaml

@@ -0,0 +1,9 @@
+listen: :443
+proxy_protocol: true
+
+tls:
+    cert: /certs/cert_public
+    key: /certs/cert_private
+auth:
+    type: password
+    password:

config/nginx.conf

@@ -11,7 +11,7 @@ events {
 http {
     server_names_hash_bucket_size 64;
     server_tokens off;
-    include include.conf;
+    include override.conf;
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
 
@@ -48,6 +48,11 @@ http {
             try_files $uri /override.html @auth;
         }
 
+        location /override/ {
+            alias /app/override/;
+            try_files $uri =404;
+        }
+
         location / {
             root /app;
             auth_basic "Restricted Content";
@@ -97,6 +102,18 @@ http {
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_read_timeout 5d;
         }
+
+        location /v2ray {
+            access_log /logs/nginx_v2ray_access;
+            proxy_redirect off;
+            proxy_buffering off;
+            proxy_http_version 1.1;
+            proxy_pass http://ss:8388/;
+            proxy_set_header Host $http_host;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+        }
+
         location /dns-query {
             access_log /logs/nginx_doh_access;
             proxy_http_version 1.1;
@@ -110,6 +127,7 @@ http {
             proxy_cache_key $scheme$proxy_host$uri$is_args$args$request_body;
             proxy_pass https://ad/dns-query;
         }
+        include location.conf;
     }
 
     #~
@@ -129,6 +147,11 @@ http {
     #         try_files $uri /override.html @auth;
     #     }
 
+    #     location /override/ {
+    #         alias /app/override/;
+    #         try_files $uri =404;
+    #     }
+
     #     location / {
     #         root /app;
     #         auth_basic "Restricted Content";
@@ -162,6 +185,17 @@ http {
     #         proxy_pass http://php;
     #     }
 
+    #     location /v2ray {
+    #         access_log /logs/nginx_v2ray_access;
+    #         proxy_redirect off;
+    #         proxy_buffering off;
+    #         proxy_http_version 1.1;
+    #         proxy_pass http://ss:8388/;
+    #         proxy_set_header Host $http_host;
+    #         proxy_set_header Upgrade $http_upgrade;
+    #         proxy_set_header Connection "upgrade";
+    #     }
+
     #     location /ws {
     #         proxy_pass http://xr:443;
     #         proxy_redirect off;
@@ -173,6 +207,7 @@ http {
     #         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     #         proxy_read_timeout 5d;
     #     }
+
     #     location /dns-query {
     #         access_log /logs/nginx_doh_access;
     #         proxy_http_version 1.1;
@@ -186,6 +221,8 @@ http {
     #         proxy_cache_key $scheme$proxy_host$uri$is_args$args$request_body;
     #         proxy_pass https://ad/dns-query;
     #     }
+
+    #     include location.conf;
     # }
     #-domain
 }

config/nginx_default.conf

@@ -11,7 +11,7 @@ events {
 http {
     server_names_hash_bucket_size 64;
     server_tokens off;
-    include include.conf;
+    include override.conf;
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
 
@@ -48,6 +48,11 @@ http {
             try_files $uri /override.html @auth;
         }
 
+        location /override/ {
+            alias /app/override/;
+            try_files $uri =404;
+        }
+
         location / {
             root /app;
             auth_basic "Restricted Content";
@@ -97,6 +102,18 @@ http {
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_read_timeout 5d;
         }
+
+        location /v2ray {
+            access_log /logs/nginx_v2ray_access;
+            proxy_redirect off;
+            proxy_buffering off;
+            proxy_http_version 1.1;
+            proxy_pass http://ss:8388/;
+            proxy_set_header Host $http_host;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+        }
+
         location /dns-query {
             access_log /logs/nginx_doh_access;
             proxy_http_version 1.1;
@@ -110,6 +127,7 @@ http {
             proxy_cache_key $scheme$proxy_host$uri$is_args$args$request_body;
             proxy_pass https://ad/dns-query;
         }
+        include location.conf;
     }
 
     #~
@@ -129,6 +147,11 @@ http {
     #         try_files $uri /override.html @auth;
     #     }
 
+    #     location /override/ {
+    #         alias /app/override/;
+    #         try_files $uri =404;
+    #     }
+
     #     location / {
     #         root /app;
     #         auth_basic "Restricted Content";
@@ -162,6 +185,17 @@ http {
     #         proxy_pass http://php;
     #     }
 
+    #     location /v2ray {
+    #         access_log /logs/nginx_v2ray_access;
+    #         proxy_redirect off;
+    #         proxy_buffering off;
+    #         proxy_http_version 1.1;
+    #         proxy_pass http://ss:8388/;
+    #         proxy_set_header Host $http_host;
+    #         proxy_set_header Upgrade $http_upgrade;
+    #         proxy_set_header Connection "upgrade";
+    #     }
+
     #     location /ws {
     #         proxy_pass http://xr:443;
     #         proxy_redirect off;
@@ -173,6 +207,7 @@ http {
     #         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     #         proxy_read_timeout 5d;
     #     }
+
     #     location /dns-query {
     #         access_log /logs/nginx_doh_access;
     #         proxy_http_version 1.1;
@@ -186,6 +221,8 @@ http {
     #         proxy_cache_key $scheme$proxy_host$uri$is_args$args$request_body;
     #         proxy_pass https://ad/dns-query;
     #     }
+
+    #     include location.conf;
     # }
     #-domain
 }

config/sing.json

@@ -9,12 +9,12 @@
             "tag": "tun-in",
             "domain_strategy": "prefer_ipv4",
             "interface_name": "sing-tun",
-            "address": ["172.19.0.1\/30"],
+            "address": [
+                "172.19.0.1\/30"
+            ],
             "mtu": 1400,
-            "gso": true,
             "auto_route": true,
             "strict_route": true,
-            "sniff": true,
             "endpoint_independent_nat": false,
             "stack": "mixed",
             "platform": {
@@ -27,14 +27,9 @@
         },
         {
             "type": "mixed",
-            "tag": "mixed-in",
-            "domain_strategy": "prefer_ipv4",
+            "tag": "in",
             "listen": "127.0.0.1",
-            "listen_port": 2080,
-            "tcp_fast_open": true,
-            "sniff": true,
-            "sniff_override_destination": false,
-            "users": []
+            "listen_port": 2080
         }
     ],
     "dns": {
@@ -92,23 +87,28 @@
         {
             "type": "direct",
             "tag": "direct"
-        },
-        {
-            "type": "block",
-            "tag": "block"
-        },
-        {
-            "type": "dns",
-            "tag": "dns-out"
         }
     ],
     "route": {
         "auto_detect_interface": true,
         "override_android_vpn": true,
         "rules": [
+            {
+                "action": "sniff"
+            },
             {
                 "protocol": "dns",
-                "outbound": "dns-out"
+                "action": "hijack-dns"
+            },
+            {
+                "inbound": "in",
+                "action": "resolve",
+                "strategy": "prefer_ipv4"
+            },
+            {
+                "inbound": "in",
+                "action": "sniff",
+                "timeout": "1s"
             },
             {
                 "addruleset": true,
@@ -119,7 +119,7 @@
                 "createruleset": [
                     {
                         "name": "pac",
-                        "interval": "30s",
+                        "interval": "60s",
                         "rules": [
                             {
                                 "domain_suffix": "~pac~"
@@ -129,12 +129,27 @@
                 ],
                 "outbound": "~outbound~"
             },
+            {
+                "addruleset": true,
+                "createruleset": [
+                    {
+                        "name": "subnet",
+                        "interval": "60s",
+                        "rules": [
+                            {
+                                "ip_cidr": "~subnet~"
+                            }
+                        ]
+                    }
+                ],
+                "outbound": "~outbound~"
+            },
             {
                 "addruleset": true,
                 "createruleset": [
                     {
                         "name": "package",
-                        "interval": "30s",
+                        "interval": "60s",
                         "rules": [
                             {
                                 "package_name": "~package~"
@@ -149,7 +164,7 @@
                 "createruleset": [
                     {
                         "name": "process",
-                        "interval": "30s",
+                        "interval": "60s",
                         "rules": [
                             {
                                 "process_name": "~process~"
@@ -164,7 +179,7 @@
                 "createruleset": [
                     {
                         "name": "block",
-                        "interval": "30s",
+                        "interval": "60s",
                         "rules": [
                             {
                                 "domain_suffix": "~block~"
@@ -172,14 +187,14 @@
                         ]
                     }
                 ],
-                "outbound": "block"
+                "action": "reject"
             },
             {
                 "addruleset": true,
                 "createruleset": [
                     {
                         "name": "warp",
-                        "interval": "30s",
+                        "interval": "60s",
                         "rules": [
                             {
                                 "domain_suffix": "~warp~"
@@ -192,4 +207,4 @@
         ],
         "final": "direct"
     }
-}
+}

config/sshd_config

@@ -83,9 +83,9 @@ AuthorizedKeysFile	.ssh/authorized_keys
 
 #AllowAgentForwarding yes
 # Feel free to re-enable these if your use case requires them.
-AllowTcpForwarding no
-GatewayPorts no
-X11Forwarding no
+# AllowTcpForwarding no
+# GatewayPorts no
+# X11Forwarding no
 #X11DisplayOffset 10
 #X11UseLocalhost yes
 #PermitTTY yes
@@ -117,4 +117,9 @@ Subsystem	sftp	internal-sftp
 #	ForceCommand cvs server
 HostKeyAlgorithms +ssh-rsa
 PubkeyAcceptedKeyTypes +ssh-rsa
-PasswordAuthentication no
+PasswordAuthentication yes
+AllowTcpForwarding yes
+PermitTunnel yes
+GatewayPorts yes
+X11Forwarding yes
+LogLevel QUIET

config/v2ray.json

@@ -4,92 +4,122 @@
         "error": "",
         "loglevel": "warning"
     },
-    "inbounds": [{
-        "tag": "socks",
-        "port": 10808,
-        "listen": "127.0.0.1",
-        "protocol": "socks",
-        "sniffing": {
-            "enabled": true,
-            "destOverride": ["http", "tls"],
-            "routeOnly": false
-        },
-        "settings": {
-            "auth": "noauth",
-            "udp": true,
-            "allowTransparent": false
-        }
-    }, {
-        "tag": "http",
-        "port": 10809,
-        "listen": "127.0.0.1",
-        "protocol": "http",
-        "sniffing": {
-            "enabled": true,
-            "destOverride": ["http", "tls"],
-            "routeOnly": false
-        },
-        "settings": {
-            "auth": "noauth",
-            "udp": true,
-            "allowTransparent": false
-        }
-    }],
-    "outbounds": [{
-        "tag": "~outbound~",
-        "protocol": "vless",
-        "settings": {
-            "vnext": [{
-                "address": "~domain~",
-                "port": 443,
-                "users": [{
-                    "id": "~uid~",
-                    "alterId": 0,
-                    "email": "t@t.tt",
-                    "security": "auto",
-                    "encryption": "none",
-                    "flow": "xtls-rprx-vision"
-                }]
-            }]
-        },
-        "streamSettings": {
-            "network": "tcp",
-            "security": "reality",
-            "realitySettings": {
-                "serverName": "~server_name~",
-                "fingerprint": "chrome",
-                "show": false,
-                "publicKey": "~public_key~",
-                "shortId": "~short_id~",
-                "spiderX": ""
+    "inbounds": [
+        {
+            "tag": "socks",
+            "port": 10808,
+            "listen": "127.0.0.1",
+            "protocol": "socks",
+            "sniffing": {
+                "enabled": true,
+                "destOverride": [
+                    "http",
+                    "tls"
+                ],
+                "routeOnly": false
+            },
+            "settings": {
+                "auth": "noauth",
+                "udp": true,
+                "allowTransparent": false
             }
         },
-        "mux": {
-            "enabled": false,
-            "concurrency": -1
-        }
-    }, {
-        "tag": "direct",
-        "protocol": "freedom"
-    }, {
-        "tag": "block",
-        "protocol": "blackhole",
-        "settings": {
-            "response": {
-                "type": "http"
+        {
+            "tag": "http",
+            "port": 10809,
+            "listen": "127.0.0.1",
+            "protocol": "http",
+            "sniffing": {
+                "enabled": true,
+                "destOverride": [
+                    "http",
+                    "tls"
+                ],
+                "routeOnly": false
+            },
+            "settings": {
+                "auth": "noauth",
+                "udp": true,
+                "allowTransparent": false
             }
         }
-    }],
+    ],
+    "outbounds": [
+        {
+            "tag": "direct",
+            "protocol": "freedom"
+        },
+        {
+            "tag": "~outbound~",
+            "protocol": "vless",
+            "settings": {
+                "vnext": [
+                    {
+                        "address": "~domain~",
+                        "port": 443,
+                        "users": [
+                            {
+                                "id": "~uid~",
+                                "alterId": 0,
+                                "email": "t@t.tt",
+                                "security": "auto",
+                                "encryption": "none",
+                                "flow": "xtls-rprx-vision"
+                            }
+                        ]
+                    }
+                ]
+            },
+            "streamSettings": {
+                "network": "tcp",
+                "security": "reality",
+                "realitySettings": {
+                    "serverName": "~server_name~",
+                    "fingerprint": "chrome",
+                    "show": false,
+                    "publicKey": "~public_key~",
+                    "shortId": "~short_id~",
+                    "spiderX": ""
+                }
+            },
+            "mux": {
+                "enabled": false,
+                "concurrency": -1
+            }
+        },
+        {
+            "tag": "block",
+            "protocol": "blackhole",
+            "settings": {
+                "response": {
+                    "type": "http"
+                }
+            }
+        }
+    ],
     "routing": {
         "domainStrategy": "AsIs",
-        "rules": [{
-            "type": "field",
-            "outboundTag": "~outbound~",
-            "domain": "~pac~"
-        }, {
-            "type": "field",
-            "port": "0-65535",
-            "outboundTag": "direct"
-        }]
+        "rules": [
+            {
+                "type": "field",
+                "outboundTag": "block",
+                "domain": "~block~"
+            },
+            {
+                "type": "field",
+                "outboundTag": "~outbound~",
+                "domain": "~pac~"
+            },
+            {
+                "type": "field",
+                "outboundTag": "~outbound~",
+                "ip": "~subnet~"
+            },
+            {
+                "type": "field",
+                "outboundTag": "~outbound~",
+                "domain": "~warp~"
+            }
+        ]
     }
 }

config/xray.json

@@ -11,7 +11,8 @@
             "sniffing": {
                 "destOverride": [
                     "http",
-                    "tls"
+                    "tls",
+                    "quic"
                 ],
                 "enabled": true
             },
@@ -22,6 +23,15 @@
                 }
             },
             "tag": "vless_tls"
+        },
+        {
+            "listen": "127.0.0.1",
+            "port": 8080,
+            "protocol": "dokodemo-door",
+            "settings": {
+                "address": "127.0.0.1"
+            },
+            "tag": "api"
         }
     ],
     "log": {
@@ -39,7 +49,36 @@
         }
     ],
     "routing": {
-        "domainStrategy": "AsIs",
-        "rules": []
+        "domainStrategy": "IPIfNonMatch",
+        "rules": [
+            {
+                "inboundTag": [
+                    "api"
+                ],
+                "outboundTag": "api",
+                "type": "field"
+            }
+        ]
+    },
+    "stats": {},
+    "api": {
+        "services": [
+            "StatsService"
+        ],
+        "tag": "api"
+    },
+    "policy": {
+        "levels": {
+            "0": {
+                "statsUserUplink": true,
+                "statsUserDownlink": true
+            }
+        },
+        "system": {
+            "statsInboundUplink": true,
+            "statsInboundDownlink": true,
+            "statsOutboundUplink": true,
+            "statsOutboundDownlink": true
+        }
     }
 }

docker-compose.yml

@@ -40,9 +40,13 @@ services:
         hostname: upstream
         container_name: upstream-${VER}
         depends_on:
-            php:
+            ng:
                 condition: service_healthy
-            ad:
+            xr:
+                condition: service_started
+            oc:
+                condition: service_started
+            np:
                 condition: service_started
         env_file:
             - path: ./.env
@@ -65,7 +69,8 @@ services:
         volumes:
             - ./config/.profile:/root/.ashrc:ro
             - ./config/nginx.conf:/etc/nginx/nginx.conf
-            - ./config/include.conf:/etc/nginx/include.conf
+            - ./config/override.conf:/etc/nginx/override.conf
+            - ./config/location.conf:/etc/nginx/location.conf
             - ./config/nginx_default.conf:/nginx_default.conf
             - ./scripts/start_ng.sh:/start_ng.sh
             - ./certs/:/certs/
@@ -77,9 +82,6 @@ services:
             - 80:80
         hostname: nginx
         container_name: nginx-${VER}
-        depends_on:
-            up:
-                condition: service_started
         env_file:
             - path: ./.env
               required: true # default
@@ -93,6 +95,20 @@ services:
             xray:
                 ipv4_address: 10.10.1.2
         logging: *default-logging
+        depends_on:
+            php:
+                condition: service_healthy
+            ad:
+                condition: service_started
+            ss:
+                condition: service_started
+            xr:
+                condition: service_started
+        healthcheck:
+            test: ["CMD", "nginx", "-t"]
+            interval: 10s
+            timeout: 5s
+            retries: 3
     php:
         image: mercurykd/vpnbot-php:1.7
         build:
@@ -145,7 +161,7 @@ services:
             timeout: 5s
             retries: 5
     service:
-        image: mercurykd/vpnbot-php:1.6
+        image: mercurykd/vpnbot-php:1.7
         build:
             dockerfile: dockerfile/php.dockerfile
             args:
@@ -162,6 +178,7 @@ services:
             - ./update:/update
             - ./.git:/.git
             - ./scripts/start_service.sh:/start_service.sh
+            - ./docker-compose.override.yml:/docker/compose
             - /var/run/docker.sock:/var/run/docker.sock:ro
         environment:
             IP: ${IP}
@@ -192,6 +209,10 @@ services:
             - xr
             - oc
             - np
+            - proxy
+            - ss
+            - dnstt
+            - hy
     wg:
         image: mercurykd/vpnbot-wg:1.1
         build:
@@ -269,7 +290,7 @@ services:
                 ipv4_address: 10.10.0.14
         logging: *default-logging
     ad:
-        image: mercurykd/vpnbot-ad:1.3
+        image: mercurykd/vpnbot-ad:1.4
         build:
             dockerfile: dockerfile/adguard.dockerfile
             args:
@@ -304,15 +325,16 @@ services:
         entrypoint: ["/bin/sh", "/start_ad.sh"]
         logging: *default-logging
     tg:
-        image: mercurykd/vpnbot-tg:1.1
+        image: mercurykd/vpnbot-tg:1.3
         build:
             dockerfile: dockerfile/telegram.dockerfile
         volumes:
-            - ./config/.profile:/root/.ashrc:ro
+            - ./config/.profile:/root/.bashrc:ro
             - ./ssh:/ssh
             - ./config/sshd_config:/etc/ssh/sshd_config
             - ./scripts/start_tg.sh:/start_tg.sh
             - ./config/mtprotosecret:/mtprotosecret
+            - ./logs/:/logs/
         hostname: telegram
         container_name: mtproto-${VER}
         depends_on:
@@ -332,7 +354,7 @@ services:
                 ipv4_address: 10.10.0.8
         logging: *default-logging
     xr:
-        image: mercurykd/vpnbot-xr:1.4
+        image: mercurykd/vpnbot-xr:1.5
         build:
             dockerfile: dockerfile/xray.dockerfile
             args:
@@ -396,7 +418,7 @@ services:
                 ipv4_address: 10.10.0.11
         logging: *default-logging
     np:
-        image: mercurykd/vpnbot-np:1.1
+        image: mercurykd/vpnbot-np:1.2
         build:
             dockerfile: dockerfile/naive.dockerfile
             args:
@@ -427,7 +449,7 @@ services:
                 ipv4_address: 10.10.0.12
         logging: *default-logging
     wp:
-        image: mercurykd/vpnbot-wp:1.2
+        image: mercurykd/vpnbot-wp:1.5
         build:
             dockerfile: dockerfile/warp.dockerfile
             args:
@@ -437,7 +459,7 @@ services:
         devices:
             - /dev/net/tun:/dev/net/tun
         volumes:
-            - ./config/.profile:/root/.ashrc:ro
+            - ./config/.profile:/root/.bashrc:ro
             - ./ssh:/ssh
             - ./config/sshd_config:/etc/ssh/sshd_config
             - ./config:/config
@@ -460,3 +482,120 @@ services:
             default:
                 ipv4_address: 10.10.0.13
         logging: *default-logging
+    proxy:
+        image: mercurykd/vpnbot-ss:1.2
+        build:
+            dockerfile: dockerfile/shadowsocks.dockerfile
+            args:
+                image: ${IMAGE}
+        volumes:
+            - ./config/.profile:/root/.ashrc:ro
+            - ./config/sslocal.json:/config.json
+            - ./ssh:/ssh
+            - ./config/sshd_config:/etc/ssh/sshd_config
+            - ./scripts/start_proxy.sh:/start_proxy.sh
+        hostname: proxy
+        container_name: proxy-${VER}
+        depends_on:
+            php:
+                condition: service_healthy
+        networks:
+            default:
+                ipv4_address: 10.10.0.3
+        environment:
+            TZ: ${TZ}
+        env_file:
+            - path: ./.env
+              required: true # default
+            - path: ./override.env
+              required: false
+        stop_grace_period: 1s
+        command: ["/bin/sh", "/start_proxy.sh"]
+        logging: *default-logging
+    ss:
+        image: mercurykd/vpnbot-ss:1.2
+        build:
+            dockerfile: dockerfile/shadowsocks.dockerfile
+            args:
+                image: ${IMAGE}
+        volumes:
+            - ./config/.profile:/root/.ashrc:ro
+            - ./config/ssserver.json:/config.json
+            - ./ssh:/ssh
+            - ./config/sshd_config:/etc/ssh/sshd_config
+            - ./scripts/start_ss.sh:/start_ss.sh
+        hostname: shadowsocks
+        container_name: shadowsocks-${VER}
+        depends_on:
+            php:
+                condition: service_healthy
+        env_file:
+            - path: ./.env
+              required: true # default
+            - path: ./override.env
+              required: false
+        stop_grace_period: 1s
+        command: ["/bin/sh", "/start_ss.sh"]
+        networks:
+            default:
+                ipv4_address: 10.10.0.6
+        logging: *default-logging
+    dnstt:
+        image: mercurykd/vpnbot-dnstt:1.0
+        build:
+            dockerfile: dockerfile/dnstt.dockerfile
+            args:
+                image: ${IMAGE}
+        volumes:
+            - ./config/.profile:/root/.ashrc:ro
+            - ./ssh:/ssh
+            - ./logs:/logs
+            - ./config/sshd_config:/etc/ssh/sshd_config
+            - ./config/dnstt:/dnstt
+            - ./scripts/start_dnstt.sh:/start_dnstt.sh
+        hostname: dnstt
+        container_name: dnstt-${VER}
+        depends_on:
+            php:
+                condition: service_healthy
+        env_file:
+            - path: ./.env
+              required: true # default
+            - path: ./override.env
+              required: false
+        stop_grace_period: 1s
+        command: ["/bin/sh", "/start_dnstt.sh"]
+        networks:
+            default:
+                ipv4_address: 10.10.0.16
+        logging: *default-logging
+    hy:
+        image: mercurykd/vpnbot-hysteria:1.0
+        build:
+            dockerfile: dockerfile/hysteria.dockerfile
+            args:
+                image: ${IMAGE}
+        volumes:
+            - ./config/.profile:/root/.ashrc:ro
+            - ./ssh:/ssh
+            - ./config/sshd_config:/etc/ssh/sshd_config
+            - ./certs:/certs
+            - ./logs:/logs
+            - ./config:/config
+            - ./scripts/start_hysteria.sh:/start_hysteria.sh
+        hostname: hysteria
+        container_name: hysteria-${VER}
+        depends_on:
+            php:
+                condition: service_healthy
+        env_file:
+            - path: ./.env
+              required: true # default
+            - path: ./override.env
+              required: false
+        stop_grace_period: 1s
+        command: ["/bin/sh", "/start_hysteria.sh"]
+        networks:
+            default:
+                ipv4_address: 10.10.0.17
+        logging: *default-logging

dockerfile/dnstt.dockerfile

@@ -0,0 +1,13 @@
+ARG image
+FROM golang:alpine AS go
+RUN apk add --no-cache git \
+    && git clone https://www.bamsoftware.com/git/dnstt.git \
+    && cd /go/dnstt/dnstt-server \
+    && go build -ldflags="-s -w" -trimpath \
+    && rm -rf /go/dnstt/.git \
+    && apk del git
+FROM $image
+COPY --from=go /go/dnstt/dnstt-server/dnstt-server /usr/local/bin/
+RUN apk add --no-cache openssh \
+    && mkdir -p /root/.ssh
+ENV ENV="/root/.ashrc"

dockerfile/hysteria.dockerfile

@@ -0,0 +1,5 @@
+FROM tobyxdd/hysteria
+RUN apk add --no-cache openssh \
+    && mkdir -p /root/.ssh
+ENV ENV="/root/.ashrc"
+ENTRYPOINT []

dockerfile/telegram.dockerfile

@@ -1,13 +1,33 @@
-FROM alpine:3.6
-RUN apk add --no-cache --virtual .build-deps alpine-sdk linux-headers openssl-dev \
-    && git clone --single-branch --depth 1 https://github.com/TelegramMessenger/MTProxy.git /mtproxy/sources \
-    && mkdir /mtproxy/patches && wget -P /mtproxy/patches https://raw.githubusercontent.com/alexdoesh/mtproxy/master/patches/randr_compat.patch \
-    && cd /mtproxy/sources && patch -p0 -i /mtproxy/patches/randr_compat.patch \
-    && make \
-    && mkdir /root/.ssh \
-    && cp /mtproxy/sources/objs/bin/mtproto-proxy /usr/bin \
-    && rm -rf /mtproxy \
-    && apk del .build-deps\
-    && apk add --no-cache --update curl openssh \
-    && ln -s /usr/lib/libcrypto.so.41 /usr/lib/libcrypto.so.1.0.0
-ENV ENV="/root/.ashrc"
+# Build stage
+FROM ubuntu:22.04 AS builder
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        git \
+        build-essential \
+        libssl-dev \
+        zlib1g-dev \
+        ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /src
+RUN git clone --single-branch --depth 1 https://github.com/GetPageSpeed/MTProxy . \
+    && make -j$(nproc) \
+    && strip objs/bin/mtproto-proxy
+
+# Runtime stage - minimal Ubuntu
+FROM ubuntu:22.04
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        libssl3 \
+        zlib1g \
+        curl \
+        openssh-client \
+        openssh-server \
+        ca-certificates \
+        vim-common \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -p /root/.ssh /var/run/sshd
+
+COPY --from=builder /src/objs/bin/mtproto-proxy /usr/local/bin/mtproto-proxy
+
+ENV PATH="/usr/local/bin:$PATH"

dockerfile/warp.dockerfile

@@ -1,16 +1,16 @@
-FROM ubuntu:22.04 AS build
-RUN apt update && apt install -y curl gpg lsb-release \
-    && curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg \
-    && echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/cloudflare-client.list \
-    && apt update && apt install -y cloudflare-warp
+FROM ubuntu:22.04
 
-FROM alpine:3.17
-ARG GLIBC_VERSION=2.34-r0
-COPY --from=build /usr/bin/warp-cli /usr/bin/warp-svc /usr/local/bin/
-RUN apk add --no-cache dbus-libs wget socat openssh-server jq curl \
-    && mkdir /tmp/glibc-pkgs \
-    && for PKG in glibc-$GLIBC_VERSION.apk glibc-bin-$GLIBC_VERSION.apk; do wget -q --directory-prefix /tmp/glibc-pkgs https://github.com/sgerrand/alpine-pkg-glibc/releases/download/$GLIBC_VERSION/$PKG; done \
-    && apk add --no-cache --allow-untrusted --force-overwrite /tmp/glibc-pkgs/* \
-    && rm -rf /tmp/glibc-pkgs \
-    && /usr/glibc-compat/sbin/ldconfig /lib /usr/glibc-compat/lib \
-    && mkdir /root/.ssh
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        curl \
+        gpg \
+        socat \
+        jq \
+        lsb-release \
+        openssh-server \
+        ca-certificates \
+    && curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg \
+    && echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" > /etc/apt/sources.list.d/cloudflare-client.list \
+    && apt-get update && apt-get install -y --no-install-recommends cloudflare-warp \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
+    && mkdir -p /root/.ssh /var/run/sshd

makefile

@@ -1,9 +1,9 @@
 b:
 	docker compose build
 u: # запуск контейнеров
-	$(eval IP := $(shell curl -s -t 1 2ip.io || curl -s -t 1 ipinfo.io/ip || curl -s -t 1 ifconfig.me))
+	$(eval IP := $(shell hostname -I | awk '{print $$1}'))
 	bash ./update/update.sh &
-	touch ./override.env ./docker-compose.override.yml
+	touch ./override.env ./docker-compose.override.yml ./config/location.conf ./config/override.conf
 	IP=$(IP) VER=$(shell git describe --tags) docker compose --env-file ./.env --env-file ./override.env up -d --force-recreate
 d: # остановка контейнеров
 	-kill -9 $(shell cat ./update/update_pid) > /dev/null
@@ -32,24 +32,26 @@ up: # консоль сервиса
 ad: # консоль сервиса
 	docker compose exec ad /bin/sh
 wp: # консоль сервиса
-	docker compose exec wp /bin/sh
+	docker compose exec wp bash
 proxy: # консоль сервиса
 	docker compose exec proxy /bin/sh
 tg: # консоль сервиса
 	docker compose exec tg /bin/sh
+dnstt: # консоль сервиса
+	docker compose exec dnstt /bin/sh
+hy: # консоль сервиса
+	docker compose exec hy /bin/sh
 xr: # консоль сервиса
 	docker compose exec xr /bin/sh
 oc: # консоль сервиса
 	docker compose exec oc /bin/sh
-clean:
-	docker image prune
-	docker builder prune
-cleanf:
-	docker image prune -f > /dev/null
-	docker builder prune -f > /dev/null
-cleanall:
-	docker image prune -a -f
-	docker builder prune -a -f
+service: # консоль сервиса
+	docker compose exec service /bin/sh
+delete:
+	make d
+	docker system prune -f -a
+	docker volume prune -f -a
+	rm -rf /root/vpnbot
 push:
 	docker compose push
 s:
@@ -67,4 +69,8 @@ reset:
 	docker volume rm vpnbot_adguard vpnbot_warp
 	make u
 backup:
-	docker compose exec php php backup.php > backup.json
+	docker compose exec php php backup.php > backup.json
+cron: # установка задачи в cron для автозапуска при перезагрузке
+	@(crontab -l 2>/dev/null | grep -v "cd /root/vpnbot && make r"; echo "@reboot cd /root/vpnbot && make r") | crontab -
+uncron: # удаление задачи из cron
+	@crontab -l 2>/dev/null | grep -v "cd /root/vpnbot && make r" | crontab -

mirror/docker-compose.yml

@@ -1,18 +0,0 @@
-version: "3"
-
-services:
-  socat:
-    build:
-        dockerfile: ./dockerfile
-    ports:
-      - 80:80
-      - 443:443
-      - 853:853
-      - ${TGPORT}:${TGPORT}
-      - ${SSPORT}:${SSPORT}
-      - ${SSPORT}:${SSPORT}/udp
-      - ${WGPORT}:${WGPORT}/udp
-    volumes:
-      - ./start_socat.sh:/start_socat.sh
-    command: /bin/sh /start_socat.sh
-    stop_grace_period: 1s

mirror/dockerfile

@@ -1,2 +0,0 @@
-FROM alpine:3.18
-RUN apk add socat htop net-tools

mirror/makefile

@@ -1,11 +0,0 @@
-b:
-	docker compose build --no-cache
-u:
-	docker compose up -d --build
-d:
-	docker compose down
-ps:
-	docker compose ps
-e:
-	docker compose exec socat sh
-r: d u

mirror/start_socat.sh

@@ -1,8 +1,53 @@
-socat TCP-LISTEN:80,fork TCP:{ip}:80 &
-socat TCP-LISTEN:443,fork TCP:{ip}:443 &
-socat TCP-LISTEN:853,fork TCP:{ip}:853 &
-socat TCP-LISTEN:{tg},fork TCP:{ip}:{tg} &
-socat TCP-LISTEN:{ss},fork TCP:{ip}:{ss} &
-socat UDP-LISTEN:{ss},fork UDP:{ip}:{ss} &
-socat UDP-LISTEN:{wg},fork UDP:{ip}:{wg} &
-tail -f /dev/null
+#!/bin/bash
+
+# Параметры (можно менять)
+PORTS=(80 443 853 ~tg~ ~ss~ ~wg1~ ~wg2~)          # Прослушиваемые порты
+TARGET="~ip~"               # Куда перенаправляем трафик
+TCP_CMD="socat TCP-LISTEN:{PORT},fork,reuseaddr TCP:$TARGET:{PORT}"
+UDP_CMD="socat UDP-LISTEN:{PORT},fork,reuseaddr UDP:$TARGET:{PORT}"
+
+# Проверяем, установлен ли socat
+if ! command -v socat &> /dev/null; then
+    echo "socat не установлен. Устанавливаем..."
+    if [[ -f /etc/debian_version ]]; then
+        sudo apt update && sudo apt install -y socat
+    elif [[ -f /etc/redhat-release ]]; then
+        sudo yum install -y socat
+    else
+        echo "Ошибка: Неизвестный дистрибутив. Установите socat вручную."
+        exit 1
+    fi
+fi
+
+# Проверяем, заняты ли порты (TCP и UDP)
+for PORT in "${PORTS[@]}"; do
+    # Проверка TCP
+    if ss -tulnp | grep -q ":$PORT "; then
+        PROCESS=$(ss -tulnp | grep ":$PORT " | awk '{print $7}')
+        echo "Ошибка: Порт $PORT (TCP) занят процессом: $PROCESS"
+        exit 1
+    fi
+    # Проверка UDP
+    if ss -ulnp | grep -q ":$PORT "; then
+        PROCESS=$(ss -ulnp | grep ":$PORT " | awk '{print $6}')
+        echo "Ошибка: Порт $PORT (UDP) занят процессом: $PROCESS"
+        exit 1
+    fi
+done
+
+# Запускаем socat для каждого порта (TCP и UDP)
+for PORT in "${PORTS[@]}"; do
+    # TCP
+    CMD_TCP=$(echo "$TCP_CMD" | sed "s/{PORT}/$PORT/g")
+    echo "Запуск (TCP): $CMD_TCP"
+    eval "$CMD_TCP &"  # Запускаем в фоне
+
+    # UDP
+    CMD_UDP=$(echo "$UDP_CMD" | sed "s/{PORT}/$PORT/g")
+    echo "Запуск (UDP): $CMD_UDP"
+    eval "$CMD_UDP &"  # Запускаем в фоне
+done
+
+echo "socat запущен для портов: ${PORTS[*]} (TCP и UDP)"
+echo "Трафик перенаправляется на: $TARGET"
+echo "Для остановки выполните: pkill socat"

readme.md

@@ -1,100 +1,29 @@
 telegram bot to manage servers (inside the bot)
 
-<img src="https://github.com/user-attachments/assets/ec5faa51-987c-461a-a973-d94c7edf7115" width="300">
-
-### VLESS (Reality OR Websocket)
-- change secret
-- qr/config
-- change fake domain
-- multiple users
-- subscriptions with routing (xray, sing-box, mihomo)
-- routing templates per user
-- routing via rulesets (sing-box, mihomo)
-- steal from yourself
-- add domains to warp
-
-### Main menu VLESS:
-<img src="https://github.com/user-attachments/assets/80d2f671-fade-4819-a96a-efa253741ffd" width="300">
-
-### User menu VLESS:
-<img src="https://github.com/user-attachments/assets/5c3c5b5e-1931-4e98-a472-d303bac61a4e" width="300">
-
-### NaiveProxy
-- change login
-- change password
-<img src="https://github.com/mercurykd/vpnbot/assets/30900414/2127a4af-0436-452c-bfe2-c750dd5dbc06" width="300">
-
-### OpenConnect
-- change secret
-- change password
-- change dns
-- add user
-- add ip subnet
-- expose-iroutes (lan between users)
-<img src="https://github.com/user-attachments/assets/c3a8a78e-fe99-423c-a626-610b333a2a56" width="300">
-
-### Wireguard / Amnezia
-- create
-- delete
-- rename
-- timer
-- torrent blocking
-- qr/config
-- AmneziaVPN vpn:// link
-- statistics
-<img src="https://github.com/mercurykd/vpnbot/assets/30900414/51a79c93-8083-40ba-a14b-a6ef19f00531" width="300">
-<img src="https://github.com/mercurykd/vpnbot/assets/30900414/fd6ffd9f-bd75-479c-8dca-ea6c0b938b6c" width="300">
-
-### Shadowsocks + v2ray
-- change password
-- on/off v2ray
-- qr
-- short link
-<img src="https://github.com/mercurykd/vpnbot/assets/30900414/fbe39617-63ae-4536-8ab0-e4269ed8784a" width="300">
-
-### AdguardHome
-- change password
-- change upstream dns
-- check dns
-- check safesearch
-- add custom clientID for DNSoverTLS (DOT)
-- fill allowed clients (WG/AWG + OpenConnect + VLESS)
-- custom ID for each user VLESS
-<img src="https://github.com/user-attachments/assets/1dcdd9f9-f781-4ec2-8e32-01ce6095e0a3" width="300">
-
-### PAC
-- the ability to create your own PAC available by url with the ability to substitute the final ip and port
-- Shadowsocks Android PAC
-- add [antifilter-community](https://community.antifilter.download/) or [ru-bundle](https://github.com/legiz-ru/sb-rule-sets/blob/main/ru-bundle.lst) domain lists
-<img src="https://github.com/user-attachments/assets/8d039dbb-6478-43a8-811a-4279e766c884" width="300">
-
-### MTProto
-- change secret
-- qr/config
-<img src="https://github.com/user-attachments/assets/d37b2e1c-f991-4e1c-8060-1b547eea8fe2" width="300">
-
-### Settings
-- add/change admin
-- change language (en/ru)
-- import/export all settings
-- domain binding
-- obtain ssl for domain
-- fake html for domain
-- ports block
-<img src="https://github.com/user-attachments/assets/82b78014-eaa2-4b4c-bc90-77f58d03d57c" width="300">
+- VLESS (Reality OR Websocket)
+- NaiveProxy
+- OpenConnect
+- Wireguard
+- Amnezia
+- AdguardHome
+- MTProto
+- PAC
+- automatic ssl
 
 ---
 environment: ubuntu 22.04/24.04, debian 11/12
 
-### Install:
+## Install:
 
 ```shell
-wget -O- https://raw.githubusercontent.com/mercurykd/vpnbot/master/scripts/init.sh | sh -s YOUR_TELEGRAM_BOT_KEY
+wget -O- https://raw.githubusercontent.com/mercurykd/vpnbot/master/scripts/init.sh | sh -s YOUR_TELEGRAM_BOT_KEY master
 ```
-
-### Install as service (autoload on start):
-
+#### Restart:
 ```shell
-cd /root/vpnbot
-bash scripts/install_as_service.sh
+make r
 ```
+#### autoload:
+```shell
+crontab -e
+```
+add `@reboot cd /root/vpnbot && make r` and save

scripts/init.sh

@@ -1,3 +1,4 @@
+TAG="${2:-master}"
 apt update
 apt install -y \
     ca-certificates \
@@ -13,6 +14,7 @@ apt install -y \
 curl -fsSL https://get.docker.com -o get-docker.sh && sh get-docker.sh
 git clone https://github.com/mercurykd/vpnbot.git
 cd ./vpnbot
+git checkout $TAG
 echo "<?php
 
 \$c = ['key' => '$1'];" > ./app/config.php

scripts/start_dnstt.sh

@@ -0,0 +1,4 @@
+cat /ssh/key.pub > /root/.ssh/authorized_keys
+ssh-keygen -A
+exec /usr/sbin/sshd -D -e "$@" &
+tail -f /dev/null

scripts/start_hysteria.sh

@@ -0,0 +1,4 @@
+cat /ssh/key.pub > /root/.ssh/authorized_keys
+ssh-keygen -A
+exec /usr/sbin/sshd -D -e "$@" &
+tail -f /dev/null

scripts/start_service.sh

@@ -2,4 +2,5 @@ cat /ssh/key.pub > /root/.ssh/authorized_keys
 ssh-keygen -A
 exec /usr/sbin/sshd -D -e "$@" &
 php service.php
+php iplimit.php &
 php cron.php

scripts/start_tg.sh

@@ -1,4 +1,3 @@
-echo 'root:dummy_passwd'|chpasswd
 cat /ssh/key.pub > /root/.ssh/authorized_keys
 ssh-keygen -A
 exec /usr/sbin/sshd -D -e "$@" &

scripts/start_wg.sh

@@ -14,7 +14,8 @@ then
         echo "ListenPort = $WG1PORT" >> /etc/wireguard/wg0.conf
     else
         sed "s/ListenPort = [0-9]\+/ListenPort = $WG1PORT/" /etc/wireguard/wg0.conf > change_port
-        cat change_port > /etc/wireguard/wg0.conf
+        sed "s|Address = [0-9\.\/ ]\+|Address = $ADDRESS|" change_port > change_address
+        cat change_address > /etc/wireguard/wg0.conf
     fi
 else
     if [ $(cat /etc/wireguard/wg0.conf | wc -c) -eq 0 ]
@@ -26,7 +27,8 @@ else
         echo "ListenPort = $WGPORT" >> /etc/wireguard/wg0.conf
     else
         sed "s/ListenPort = [0-9]\+/ListenPort = $WGPORT/" /etc/wireguard/wg0.conf > change_port
-        cat change_port > /etc/wireguard/wg0.conf
+        sed "s|Address = [0-9\.\/ ]\+|Address = $ADDRESS|" change_port > change_address
+        cat change_address > /etc/wireguard/wg0.conf
     fi
 fi
 iptables -t nat -A POSTROUTING --destination 10.10.0.5 -j ACCEPT

scripts/start_wp.sh

@@ -1,9 +1,8 @@
 cat /ssh/key.pub > /root/.ssh/authorized_keys
-ssh-keygen -A
-exec /usr/sbin/sshd -D -e "$@" &
+service ssh start
 off=$(cat /config/pac.json | jq -r .warpoff)
 key=$(cat /config/pac.json | jq -r .warp)
-if [ "$off" == 'null' ]
+if [ "$off" = 'null' ]
 then
     warp-svc > /dev/null &
     sleep 3

scripts/start_xray.sh

@@ -1,8 +1,8 @@
 cat /ssh/key.pub > /root/.ssh/authorized_keys
 ssh-keygen -A
 exec /usr/sbin/sshd -D -e "$@" &
-if [ $(cat /xray.json | jq -r '.inbounds[0].settings.clients[0].id' | wc -c) -gt 1 ]
-then
-    xray run -config /xray.json > /dev/null &
+uuid=$(cat /xray.json | jq -r '.inbounds[0].settings.clients[0].id // empty')
+if [ -n "$uuid" ]; then
+    xray run -config /xray.json > /dev/null 2>&1 &
 fi
 tail -f /dev/null

update/update.sh

@@ -38,7 +38,7 @@ do
         curl -H "Content-Type: application/json" -X POST https://api.telegram.org/bot$key/editMessageText -d "$(cat $pwd/update/curl | sed 's/"text":"~t~"/"text": "launching the bot"/')"
         > $pwd/update/key
         > $pwd/update/curl
-        IP=$(curl -s -t 1 2ip.io || curl -s -t 1 ipinfo.io/ip || curl -s -t 1 ifconfig.me) VER=$(git describe --tags) docker compose --env-file ./.env --env-file ./override.env up -d --force-recreate
+        IP=$(hostname -I | awk '{print $1}') VER=$(git describe --tags) docker compose --env-file ./.env --env-file ./override.env up -d --force-recreate
         bash $pwd/update/update.sh &
         exit 0
     fi

version

@@ -1,3 +1,102 @@
+15.12.2025 v2.28
+- новый MTProto
+- hysteria
+- dnstt (вместо iodine)
+- xhttp-vless by legiz
+- возможность отключать поддомены для naive и openconnect (через установку поддомена в 0)
+- возможность отключать  naive и openconnect (через установку пароля в 0)
+- возможность указывать айпишники в списках block, warp
+- быстрая команда для добавления бота в крон: make cron
+- увиличены тайминги пула рулсетов
+- увиличен тайминг сбора статы с xray-ядра
+- улучшено логирование: ssh не срет в контейнер, а основной процесс пишет в /logs
+- улучшены кроны autobackup, autoscan, autoreset
+- фикс старта upstream
+- фикс шорт-ссылки для амнезии
+- фикс папки override для своих заглушек
+- фикс сброса страницы в списках route
+09.11.2025 v2.27
+- фикс reality
+08.11.2025 v2.26
+- обновлено ядро xray
+- обновлен adguardHome
+- добавлен iodine(dnstt)
+- добавлены кнопки скачивания vless-конфига
+- hwid для подписки orion от legiz
+19.07.2025 v2.25
+- перед запуском обязательно запустить:
+<pre>touch ./override.env ./docker-compose.override.yml ./config/location.conf ./config/override.conf</pre>
+- для nginx вместо include.conf теперь override.conf, не затирается
+- location.conf (by legiz), не затирается
+- app/i18n.override.php для собственных названий кнопок, не затирается
+16.07.2025 v2.24
+- фикс зависания бота из-за пустого статуса warp
+- скрипт socat.sh для мостов /mirror
+04.07.2025 v2.23
+- фикс двойного /id
+- фикс отображения статы vless на мобилке
+- страница подписок app/subscription.php
+18.06.2025 v2.22
+- фикс определения айпи при запуске
+11.06.2025 v2.21
+- пагинация в списках
+20.05.2025 v2.20
+- коррекция главного меню
+- vless: опция обнуления статы ежемесячно
+17.05.2025 v2.19
+- фикс падения vless при одинаковом имени пользователей
+- фикс падения vless при установке таймера для выключенного пользователя
+- подсветка в меню работы процесса контейнера
+- overwrite=no для импорта клеш подписки (legiz)
+18.04.2025 v2.18
+- фикс отсутствия ssl при первом старте
+- iplimit уведомляет без отключения пользователя
+- включение udp в mihomo-шаблоне
+- удаление лишнего образа пхп
+07.04.2025 v2.17
+- фикс циклической перезагрузки панели adguardHome
+07.04.2025 v2.16
+- фикс warp
+07.04.2025 v2.15
+- миграция поддоменов np/oc вместе в с бэкапом
+02.03.2025 v2.14
+- vless ip limit: фикс выключения юзера
+22.02.2025 v2.13
+- vless: улучшение сбора статы
+- vless: фикс добавления правил srs для block outbound
+11.02.2025 v2.12
+- vless: хранение статы в отдельном файле
+- vless ip limit: возможность указать кол-во айпи
+08.02.2025 v2.11
+- vless: singbox 1.11
+07.02.2025 v2.10
+- vless: ip limit
+- vless: общая стата
+- vless: пакетное добавление профилей
+- vless: при добавлении можно указывать свой uuid (name:uuid, name:uuid, ...)
+- автоудаление логов
+- хэш бота сохраняется в настройках и восстанавливается с бэкапом. можно накатывать бэкап на нового бота
+02.02.2025 v2.9
+- откат sing-box 1.11
+02.02.2025 v2.8
+- vless: корректировка статы юзера
+- sing-box 1.11
+29.01.2025 v2.7
+- vless: сброс статистики юзера
+24.01.2025 v2.6
+- правки меню
+- vless:добавлена возможность маршрутизировать список ip-сетей
+18.01.2025 v2.5
+- фикс скачивания шаблона михомо
+- обновлен singbox.exe
+- вывод статистики vless пользователей
+- смягчил паттерн поиска reality degenerate в логах
+07.01.2025 v2.4
+- вернул shadowsocks (спасибо за донат)
+04.01.2025
+- возможность установить нужную версию с нуля
+- корректировка автосканера под новую версию
+- улучшение основного меню
 26.12.2024 v2.2
 - возможность менять поддомен для naive/openconnect
 26.12.2024 v2.1