xhttp from legiz

app/service.php

@@ -24,4 +24,9 @@ $bot->adguardSync();
 $bot->cloakNginx();
 $bot->syncDeny();
 $bot->cleanDocker();
-$bot->iodineRestart();
+$bot->dnsttStart();
+$c = $bot->getPacConf();
+$bot->setUpstreamDomain($c['pac']['transport'] != 'Reality' ? 't' : ($c['pac']['reality']['domain'] ?: $c['xray']['inbounds'][0]['streamSettings']['realitySettings']['serverNames'][0]));
+$bot->setUpstreamDomainNaive($c['domain']);
+$bot->setUpstreamDomainOcserv($c['domain']);
+$bot->setUpstreamDomainHysteria($c['domain']);

config/clash.json

@@ -8,7 +8,7 @@
     "mode": "rule",
     "log-level": "info",
     "ipv6": false,
-    "keep-alive-interval": 30,
+    "keep-alive-interval": 60,
     "unified-delay": false,
     "profile": {
         "store-selected": true,
@@ -98,7 +98,7 @@
             "type": "RULE-SET",
             "list": "~block~",
             "action": "REJECT",
-            "interval": 30,
+            "interval": 60,
             "behavior": "domain",
             "name": "block"
         },
@@ -106,7 +106,7 @@
             "type": "RULE-SET",
             "list": "~process~",
             "action": "PROXY",
-            "interval": 30,
+            "interval": 60,
             "behavior": "classical",
             "name": "process"
         },
@@ -114,7 +114,7 @@
             "type": "RULE-SET",
             "list": "~package~",
             "action": "PROXY",
-            "interval": 30,
+            "interval": 60,
             "behavior": "classical",
             "name": "package"
         },
@@ -122,15 +122,15 @@
             "type": "RULE-SET",
             "list": "~warp~",
             "action": "PROXY",
-            "interval": 30,
+            "interval": 60,
-            "behavior": "domain",
+            "behavior": "classical",
             "name": "warp"
         },
         {
             "type": "RULE-SET",
             "list": "~pac~",
             "action": "PROXY",
-            "interval": 30,
+            "interval": 60,
             "behavior": "domain",
             "name": "pac"
         },
@@ -138,7 +138,7 @@
             "type": "RULE-SET",
             "list": "~subnet~",
             "action": "PROXY",
-            "interval": 30,
+            "interval": 60,
             "behavior": "ipcidr",
             "name": "subnet"
         },

config/hysteria.yaml

@@ -0,0 +1,9 @@
+listen: :443
+proxy_protocol: true
+
+tls:
+    cert: /certs/cert_public
+    key: /certs/cert_private
+auth:
+    type: password
+    password:

config/nginx.conf

@@ -48,6 +48,11 @@ http {
             try_files $uri /override.html @auth;
         }
 
+        location /override/ {
+            alias /app/override/;
+            try_files $uri =404;
+        }
+
         location / {
             root /app;
             auth_basic "Restricted Content";
@@ -142,6 +147,11 @@ http {
     #         try_files $uri /override.html @auth;
     #     }
 
+    #     location /override/ {
+    #         alias /app/override/;
+    #         try_files $uri =404;
+    #     }
+
     #     location / {
     #         root /app;
     #         auth_basic "Restricted Content";

config/nginx_default.conf

@@ -48,6 +48,11 @@ http {
             try_files $uri /override.html @auth;
         }
 
+        location /override/ {
+            alias /app/override/;
+            try_files $uri =404;
+        }
+
         location / {
             root /app;
             auth_basic "Restricted Content";
@@ -142,6 +147,11 @@ http {
     #         try_files $uri /override.html @auth;
     #     }
 
+    #     location /override/ {
+    #         alias /app/override/;
+    #         try_files $uri =404;
+    #     }
+
     #     location / {
     #         root /app;
     #         auth_basic "Restricted Content";

config/sing.json

@@ -119,7 +119,7 @@
                 "createruleset": [
                     {
                         "name": "pac",
-                        "interval": "30s",
+                        "interval": "60s",
                         "rules": [
                             {
                                 "domain_suffix": "~pac~"
@@ -134,7 +134,7 @@
                 "createruleset": [
                     {
                         "name": "subnet",
-                        "interval": "30s",
+                        "interval": "60s",
                         "rules": [
                             {
                                 "ip_cidr": "~subnet~"
@@ -149,7 +149,7 @@
                 "createruleset": [
                     {
                         "name": "package",
-                        "interval": "30s",
+                        "interval": "60s",
                         "rules": [
                             {
                                 "package_name": "~package~"
@@ -164,7 +164,7 @@
                 "createruleset": [
                     {
                         "name": "process",
-                        "interval": "30s",
+                        "interval": "60s",
                         "rules": [
                             {
                                 "process_name": "~process~"
@@ -179,7 +179,7 @@
                 "createruleset": [
                     {
                         "name": "block",
-                        "interval": "30s",
+                        "interval": "60s",
                         "rules": [
                             {
                                 "domain_suffix": "~block~"
@@ -194,7 +194,7 @@
                 "createruleset": [
                     {
                         "name": "warp",
-                        "interval": "30s",
+                        "interval": "60s",
                         "rules": [
                             {
                                 "domain_suffix": "~warp~"

config/sshd_config

@@ -83,9 +83,9 @@ AuthorizedKeysFile	.ssh/authorized_keys
 
 #AllowAgentForwarding yes
 # Feel free to re-enable these if your use case requires them.
-AllowTcpForwarding no
+# AllowTcpForwarding no
-GatewayPorts no
+# GatewayPorts no
-X11Forwarding no
+# X11Forwarding no
 #X11DisplayOffset 10
 #X11UseLocalhost yes
 #PermitTTY yes
@@ -117,4 +117,8 @@ Subsystem	sftp	internal-sftp
 #	ForceCommand cvs server
 HostKeyAlgorithms +ssh-rsa
 PubkeyAcceptedKeyTypes +ssh-rsa
-PasswordAuthentication no
+PasswordAuthentication yes
+AllowTcpForwarding yes
+PermitTunnel yes
+GatewayPorts yes
+X11Forwarding yes

config/upstream.conf

@@ -32,6 +32,10 @@ stream {
         server np:443;
     }
 
+    upstream hysteria {
+        server hy:443;
+    }
+
     map_hash_bucket_size 128;
     map $ssl_preread_server_name $sni_name {
         #domain
@@ -45,6 +49,10 @@ stream {
         #naive
         #np.domain naive;
         #naive
+
+        #hysteria
+        #hy.domain hysteria;
+        #hysteria
         default other;
     }
 

config/xray.json

@@ -11,7 +11,8 @@
             "sniffing": {
                 "destOverride": [
                     "http",
-                    "tls"
+                    "tls",
+                    "quic"
                 ],
                 "enabled": true
             },

docker-compose.yml

@@ -43,7 +43,7 @@ services:
             php:
                 condition: service_healthy
             ng:
-                condition: service_started
+                condition: service_healthy
             ad:
                 condition: service_started
             ss:
@@ -54,6 +54,8 @@ services:
                 condition: service_started
             np:
                 condition: service_started
+            hy:
+                condition: service_started
         env_file:
             - path: ./.env
               required: true # default
@@ -104,6 +106,11 @@ services:
         depends_on:
             php:
                 condition: service_healthy
+        healthcheck:
+            test: ["CMD", "nginx", "-t"]
+            interval: 10s
+            timeout: 5s
+            retries: 3
     php:
         image: mercurykd/vpnbot-php:1.7
         build:
@@ -206,6 +213,8 @@ services:
             - np
             - proxy
             - ss
+            - dnstt
+            - hy
     wg:
         image: mercurykd/vpnbot-wg:1.1
         build:
@@ -318,7 +327,7 @@ services:
         entrypoint: ["/bin/sh", "/start_ad.sh"]
         logging: *default-logging
     tg:
-        image: mercurykd/vpnbot-tg:1.1
+        image: mercurykd/vpnbot-tg:1.2
         build:
             dockerfile: dockerfile/telegram.dockerfile
         volumes:
@@ -410,7 +419,7 @@ services:
                 ipv4_address: 10.10.0.11
         logging: *default-logging
     np:
-        image: mercurykd/vpnbot-np:1.1
+        image: mercurykd/vpnbot-np:1.2
         build:
             dockerfile: dockerfile/naive.dockerfile
             args:
@@ -441,7 +450,7 @@ services:
                 ipv4_address: 10.10.0.12
         logging: *default-logging
     wp:
-        image: mercurykd/vpnbot-wp:1.3
+        image: mercurykd/vpnbot-wp:1.4
         build:
             dockerfile: dockerfile/warp.dockerfile
             args:
@@ -532,21 +541,20 @@ services:
             default:
                 ipv4_address: 10.10.0.6
         logging: *default-logging
-    io:
+    dnstt:
-        image: mercurykd/vpnbot-io:1.0
+        image: mercurykd/vpnbot-dnstt:1.0
         build:
-            dockerfile: dockerfile/iodine.dockerfile
+            dockerfile: dockerfile/dnstt.dockerfile
+            args:
+                image: ${IMAGE}
         volumes:
             - ./config/.profile:/root/.ashrc:ro
             - ./ssh:/ssh
             - ./config/sshd_config:/etc/ssh/sshd_config
-            - ./scripts/start_io.sh:/start_io.sh
+            - ./config/dnstt:/dnstt
-        hostname: iodine
+            - ./scripts/start_dnstt.sh:/start_dnstt.sh
-        cap_add:
+        hostname: dnstt
-            - NET_ADMIN
+        container_name: dnstt-${VER}
-        devices:
-            - /dev/net/tun:/dev/net/tun
-        container_name: iodine-${VER}
         depends_on:
             php:
                 condition: service_healthy
@@ -556,8 +564,37 @@ services:
             - path: ./override.env
               required: false
         stop_grace_period: 1s
-        command: ["/bin/sh", "/start_io.sh"]
+        command: ["/bin/sh", "/start_dnstt.sh"]
         networks:
             default:
                 ipv4_address: 10.10.0.16
         logging: *default-logging
+    hy:
+        image: mercurykd/vpnbot-hysteria:1.0
+        build:
+            dockerfile: dockerfile/hysteria.dockerfile
+            args:
+                image: ${IMAGE}
+        volumes:
+            - ./config/.profile:/root/.ashrc:ro
+            - ./ssh:/ssh
+            - ./config/sshd_config:/etc/ssh/sshd_config
+            - ./certs:/certs
+            - ./config:/config
+            - ./scripts/start_hysteria.sh:/start_hysteria.sh
+        hostname: hysteria
+        container_name: hysteria-${VER}
+        depends_on:
+            php:
+                condition: service_healthy
+        env_file:
+            - path: ./.env
+              required: true # default
+            - path: ./override.env
+              required: false
+        stop_grace_period: 1s
+        command: ["/bin/sh", "/start_hysteria.sh"]
+        networks:
+            default:
+                ipv4_address: 10.10.0.17
+        logging: *default-logging

dockerfile/dnstt.dockerfile

@@ -0,0 +1,13 @@
+ARG image
+FROM golang:alpine AS go
+RUN apk add --no-cache git \
+    && git clone https://www.bamsoftware.com/git/dnstt.git \
+    && cd /go/dnstt/dnstt-server \
+    && go build -ldflags="-s -w" -trimpath \
+    && rm -rf /go/dnstt/.git \
+    && apk del git
+FROM $image
+COPY --from=go /go/dnstt/dnstt-server/dnstt-server /usr/local/bin/
+RUN apk add --no-cache openssh \
+    && mkdir -p /root/.ssh
+ENV ENV="/root/.ashrc"

dockerfile/hysteria.dockerfile

@@ -0,0 +1,5 @@
+FROM tobyxdd/hysteria
+RUN apk add --no-cache openssh \
+    && mkdir -p /root/.ssh
+ENV ENV="/root/.ashrc"
+ENTRYPOINT []

dockerfile/iodine.dockerfile

@@ -1,4 +0,0 @@
-FROM alpine:3.22
-RUN apk add iodine openssh iptables\
-    && mkdir /root/.ssh
-ENV ENV="/root/.ashrc"

makefile

@@ -37,8 +37,10 @@ proxy: # консоль сервиса
 	docker compose exec proxy /bin/sh
 tg: # консоль сервиса
 	docker compose exec tg /bin/sh
-io: # консоль сервиса
+dnstt: # консоль сервиса
-	docker compose exec io /bin/sh
+	docker compose exec dnstt /bin/sh
+hy: # консоль сервиса
+	docker compose exec hy /bin/sh
 xr: # консоль сервиса
 	docker compose exec xr /bin/sh
 oc: # консоль сервиса
@@ -71,4 +73,8 @@ reset:
 	docker volume rm vpnbot_adguard vpnbot_warp
 	make u
 backup:
-	docker compose exec php php backup.php > backup.json
+	docker compose exec php php backup.php > backup.json
+cron: # установка задачи в cron для автозапуска при перезагрузке
+	@(crontab -l 2>/dev/null | grep -v "cd /root/vpnbot && make r"; echo "@reboot cd /root/vpnbot && make r") | crontab -
+uncron: # удаление задачи из cron
+	@crontab -l 2>/dev/null | grep -v "cd /root/vpnbot && make r" | crontab -

scripts/start_dnstt.sh

@@ -0,0 +1,4 @@
+cat /ssh/key.pub > /root/.ssh/authorized_keys
+ssh-keygen -A
+exec /usr/sbin/sshd -D -e "$@" &
+tail -f /dev/null

scripts/start_hysteria.sh

@@ -0,0 +1,5 @@
+cat /ssh/key.pub > /root/.ssh/authorized_keys
+ssh-keygen -A
+exec /usr/sbin/sshd -D -e "$@" &
+hysteria server -c /config/hysteria.yaml &
+tail -f /dev/null

scripts/start_io.sh

@@ -1,7 +0,0 @@
-cat /ssh/key.pub > /root/.ssh/authorized_keys
-ssh-keygen -A
-exec /usr/sbin/sshd -D -e "$@" &
-iptables -A FORWARD -i dns0 -o eth0 -j ACCEPT
-iptables -A FORWARD -i eth0 -o dns0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
-tail -f /dev/null

scripts/start_wp.sh

@@ -1,6 +1,4 @@
 cat /ssh/key.pub > /root/.ssh/authorized_keys
-echo 'HostKeyAlgorithms +ssh-rsa' >> /etc/ssh/sshd_config
-echo 'PubkeyAcceptedKeyTypes +ssh-rsa' >> /etc/ssh/sshd_config
 service ssh start
 off=$(cat /config/pac.json | jq -r .warpoff)
 key=$(cat /config/pac.json | jq -r .warp)