tun exclude/include lists

fix: mihomo config

.env

@@ -8,4 +8,5 @@ TGPORT=4443
 IMAGE=alpine:3.18.2
 IP=
 VER=
+TELEGRAM_API=api.telegram.org
 ENV=/root/.ashrc

app/debug.php

@@ -1,8 +1,6 @@
 <?php
 
-// ini_set('display_errors', 'On');
+error_reporting(E_ALL | E_NOTICE);
-// ini_set("log_errors", 1);
-// ini_set("error_log", '/logs/php_error');
 
 $debug = [
     'raw'  => file_get_contents('php://input'),

app/i18n.php

@@ -261,6 +261,10 @@ $i = [
         'en' => 'setSecret',
         'ru' => 'установить свой ключ',
     ],
+    'setAdTag'  => [
+        'en' => 'set adtag',
+        'ru' => 'установить adtag',
+    ],
     'defaultDNS'  => [
         'en' => 'defaultDNS',
         'ru' => 'дефолтный днс',

app/init.php

@@ -1,5 +1,7 @@
 <?php
 
+ini_set('session.use_cookies', 0);
+
 require __DIR__ . '/timezone.php';
 
 require __DIR__ . '/bot.php';
@@ -11,6 +13,6 @@ if ($c['debug']) {
 
 $bot = new Bot($c['key'], $i);
 $bot->cleanQueue();
-$bot->setwebhook();
 $bot->syncPortClients();
 $bot->setcommands();
+$bot->polling();

app/service.php

@@ -25,8 +25,9 @@ $bot->cloakNginx();
 $bot->syncDeny();
 $bot->cleanDocker();
 $bot->dnsttStart();
+$bot->restartHysteria();
 $c = $bot->getPacConf();
-$bot->setUpstreamDomain($c['pac']['transport'] != 'Reality' ? 't' : ($c['pac']['reality']['domain'] ?: $c['xray']['inbounds'][0]['streamSettings']['realitySettings']['serverNames'][0]));
+$bot->setUpstreamDomain($c['transport'] != 'Reality' ? 't' : $c['reality']['domain']);
 $bot->setUpstreamDomainNaive($c['domain']);
 $bot->setUpstreamDomainOcserv($c['domain']);
-$bot->setUpstreamDomainHysteria($c['domain']);
+$bot->restartXray($bot->getXray());

config/clash.json

@@ -1,6 +1,4 @@
 {
-    "mixed-port": 2080,
-    "allow-lan": true,
     "tcp-concurrent": true,
     "enable-process": true,
     "find-process-mode": "strict",
@@ -50,7 +48,6 @@
     },
     "dns": {
         "enable": true,
-        "listen": ":1053",
         "prefer-h3": false,
         "ipv6": false,
         "enhanced-mode": "fake-ip",
@@ -99,7 +96,7 @@
             "list": "~block~",
             "action": "REJECT",
             "interval": 60,
-            "behavior": "domain",
+            "behavior": "classical",
             "name": "block"
         },
         {
@@ -131,7 +128,7 @@
             "list": "~pac~",
             "action": "PROXY",
             "interval": 60,
-            "behavior": "domain",
+            "behavior": "classical",
             "name": "pac"
         },
         {
@@ -139,7 +136,7 @@
             "list": "~subnet~",
             "action": "PROXY",
             "interval": 60,
-            "behavior": "ipcidr",
+            "behavior": "classical",
             "name": "subnet"
         },
         {

config/sshd_config

@@ -122,3 +122,4 @@ AllowTcpForwarding yes
 PermitTunnel yes
 GatewayPorts yes
 X11Forwarding yes
+LogLevel QUIET

config/upstream.conf

@@ -32,10 +32,6 @@ stream {
         server np:443;
     }
 
-    upstream hysteria {
-        server hy:443;
-    }
-
     map_hash_bucket_size 128;
     map $ssl_preread_server_name $sni_name {
         #domain
@@ -49,10 +45,6 @@ stream {
         #naive
         #np.domain naive;
         #naive
-
-        #hysteria
-        #hy.domain hysteria;
-        #hysteria
         default other;
     }
 

config/xray.json

@@ -49,7 +49,7 @@
         }
     ],
     "routing": {
-        "domainStrategy": "AsIs",
+        "domainStrategy": "IPIfNonMatch",
         "rules": [
             {
                 "inboundTag": [

docker-compose.yml

@@ -40,22 +40,14 @@ services:
         hostname: upstream
         container_name: upstream-${VER}
         depends_on:
-            php:
-                condition: service_healthy
             ng:
                 condition: service_healthy
-            ad:
-                condition: service_started
-            ss:
-                condition: service_started
             xr:
                 condition: service_started
             oc:
                 condition: service_started
             np:
                 condition: service_started
-            hy:
-                condition: service_started
         env_file:
             - path: ./.env
               required: true # default
@@ -106,6 +98,12 @@ services:
         depends_on:
             php:
                 condition: service_healthy
+            ad:
+                condition: service_started
+            ss:
+                condition: service_started
+            xr:
+                condition: service_started
         healthcheck:
             test: ["CMD", "nginx", "-t"]
             interval: 10s
@@ -216,7 +214,7 @@ services:
             - dnstt
             - hy
     wg:
-        image: mercurykd/vpnbot-wg:1.1
+        image: mercurykd/vpnbot-wg:1.3
         build:
             dockerfile: dockerfile/wireguard.dockerfile
             args:
@@ -254,7 +252,7 @@ services:
                 ipv4_address: 10.10.0.4
         logging: *default-logging
     wg1:
-        image: mercurykd/vpnbot-wg:1.1
+        image: mercurykd/vpnbot-wg:1.3
         build:
             dockerfile: dockerfile/wireguard.dockerfile
             args:
@@ -327,15 +325,16 @@ services:
         entrypoint: ["/bin/sh", "/start_ad.sh"]
         logging: *default-logging
     tg:
-        image: mercurykd/vpnbot-tg:1.2
+        image: mercurykd/vpnbot-tg:1.3
         build:
             dockerfile: dockerfile/telegram.dockerfile
         volumes:
-            - ./config/.profile:/root/.ashrc:ro
+            - ./config/.profile:/root/.bashrc:ro
             - ./ssh:/ssh
             - ./config/sshd_config:/etc/ssh/sshd_config
             - ./scripts/start_tg.sh:/start_tg.sh
             - ./config/mtprotosecret:/mtprotosecret
+            - ./logs/:/logs/
         hostname: telegram
         container_name: mtproto-${VER}
         depends_on:
@@ -355,7 +354,7 @@ services:
                 ipv4_address: 10.10.0.8
         logging: *default-logging
     xr:
-        image: mercurykd/vpnbot-xr:1.5
+        image: mercurykd/vpnbot-xr:1.6
         build:
             dockerfile: dockerfile/xray.dockerfile
             args:
@@ -419,7 +418,7 @@ services:
                 ipv4_address: 10.10.0.11
         logging: *default-logging
     np:
-        image: mercurykd/vpnbot-np:1.2
+        image: mercurykd/vpnbot-np:1.3
         build:
             dockerfile: dockerfile/naive.dockerfile
             args:
@@ -450,7 +449,7 @@ services:
                 ipv4_address: 10.10.0.12
         logging: *default-logging
     wp:
-        image: mercurykd/vpnbot-wp:1.4
+        image: mercurykd/vpnbot-wp:1.5
         build:
             dockerfile: dockerfile/warp.dockerfile
             args:
@@ -550,6 +549,7 @@ services:
         volumes:
             - ./config/.profile:/root/.ashrc:ro
             - ./ssh:/ssh
+            - ./logs:/logs
             - ./config/sshd_config:/etc/ssh/sshd_config
             - ./config/dnstt:/dnstt
             - ./scripts/start_dnstt.sh:/start_dnstt.sh
@@ -580,6 +580,7 @@ services:
             - ./ssh:/ssh
             - ./config/sshd_config:/etc/ssh/sshd_config
             - ./certs:/certs
+            - ./logs:/logs
             - ./config:/config
             - ./scripts/start_hysteria.sh:/start_hysteria.sh
         hostname: hysteria

dockerfile/naive.dockerfile

@@ -1,7 +1,7 @@
 ARG image
 FROM golang:alpine as go
 RUN go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest \
-    && /go/bin/xcaddy build --with github.com/caddyserver/forwardproxy@caddy2=github.com/klzgrad/forwardproxy@naive
+    && /go/bin/xcaddy build --with github.com/caddyserver/forwardproxy=github.com/klzgrad/forwardproxy@naive
 FROM $image
 COPY --from=go /go/caddy /usr/local/bin/
 RUN apk add openssh \

dockerfile/telegram.dockerfile

@@ -1,13 +1,33 @@
-FROM alpine:3.6
+# Build stage
-RUN apk add --no-cache --virtual .build-deps alpine-sdk linux-headers openssl-dev \
+FROM ubuntu:22.04 AS builder
-    && git clone --single-branch --depth 1 https://github.com/TelegramMessenger/MTProxy.git /mtproxy/sources \
+
-    && mkdir /mtproxy/patches && wget -P /mtproxy/patches https://raw.githubusercontent.com/alexdoesh/mtproxy/master/patches/randr_compat.patch \
+RUN apt-get update && apt-get install -y --no-install-recommends \
-    && cd /mtproxy/sources && patch -p0 -i /mtproxy/patches/randr_compat.patch \
+        git \
-    && make \
+        build-essential \
-    && mkdir /root/.ssh \
+        libssl-dev \
-    && cp /mtproxy/sources/objs/bin/mtproto-proxy /usr/bin \
+        zlib1g-dev \
-    && rm -rf /mtproxy \
+        ca-certificates \
-    && apk del .build-deps\
+    && rm -rf /var/lib/apt/lists/*
-    && apk add --no-cache --update curl openssh \
+
-    && ln -s /usr/lib/libcrypto.so.41 /usr/lib/libcrypto.so.1.0.0
+WORKDIR /src
-ENV ENV="/root/.ashrc"
+RUN git clone --single-branch --depth 1 https://github.com/GetPageSpeed/MTProxy . \
+    && make -j$(nproc) \
+    && strip objs/bin/mtproto-proxy
+
+# Runtime stage - minimal Ubuntu
+FROM ubuntu:22.04
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        libssl3 \
+        zlib1g \
+        curl \
+        openssh-client \
+        openssh-server \
+        ca-certificates \
+        vim-common \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -p /root/.ssh /var/run/sshd
+
+COPY --from=builder /src/objs/bin/mtproto-proxy /usr/local/bin/mtproto-proxy
+
+ENV PATH="/usr/local/bin:$PATH"

dockerfile/warp.dockerfile

@@ -1,6 +1,16 @@
 FROM ubuntu:22.04
-RUN apt update && apt install -y curl gpg socat jq lsb-release openssh-server \
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        curl \
+        gpg \
+        socat \
+        jq \
+        lsb-release \
+        openssh-server \
+        ca-certificates \
     && curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg \
-    && echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/cloudflare-client.list \
+    && echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" > /etc/apt/sources.list.d/cloudflare-client.list \
-    && apt update && apt install -y cloudflare-warp \
+    && apt-get update && apt-get install -y --no-install-recommends cloudflare-warp \
-    && mkdir /root/.ssh
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
+    && mkdir -p /root/.ssh /var/run/sshd

dockerfile/wireguard.dockerfile

@@ -13,4 +13,9 @@ RUN apk add --no-cache --virtual .build-deps alpine-sdk git \
     && apk del .build-deps \
     && rm -rf /amneziawg-go \
     && rm -rf /amneziawg-tools \
-    && mkdir /root/.ssh
+    && mkdir /root/.ssh \
+    && cd /tmp \
+    && wget -O tun2socks.zip https://github.com/xjasonlyu/tun2socks/releases/download/v2.6.0/tun2socks-linux-amd64.zip \
+    && unzip tun2socks.zip \
+    && mv tun2socks-linux-amd64 /usr/bin/tun2socks \
+    && chmod +x /usr/bin/tun2socks

makefile

@@ -1,7 +1,11 @@
+-include .env
+export
+
+IP := $(or $(IP),$(shell hostname -I | awk '{print $$1}'))
+
 b:
 	docker compose build
 u: # запуск контейнеров
-	$(eval IP := $(shell hostname -I | awk '{print $$1}'))
 	bash ./update/update.sh &
 	touch ./override.env ./docker-compose.override.yml ./config/location.conf ./config/override.conf
 	IP=$(IP) VER=$(shell git describe --tags) docker compose --env-file ./.env --env-file ./override.env up -d --force-recreate
@@ -47,15 +51,11 @@ oc: # консоль сервиса
 	docker compose exec oc /bin/sh
 service: # консоль сервиса
 	docker compose exec service /bin/sh
-clean:
+delete:
-	docker image prune
+	make d
-	docker builder prune
+	docker system prune -f -a
-cleanf:
+	docker volume prune -f -a
-	docker image prune -f > /dev/null
+	rm -rf /root/vpnbot
-	docker builder prune -f > /dev/null
-cleanall:
-	docker image prune -a -f
-	docker builder prune -a -f
 push:
 	docker compose push
 s:

scripts/start_hysteria.sh

@@ -1,5 +1,4 @@
 cat /ssh/key.pub > /root/.ssh/authorized_keys
 ssh-keygen -A
 exec /usr/sbin/sshd -D -e "$@" &
-hysteria server -c /config/hysteria.yaml &
 tail -f /dev/null

scripts/start_php.sh

@@ -1,12 +1,10 @@
 rm /ssh/key*
 ssh-keygen -m PEM -t rsa -f /ssh/key -N ''
 openssl req -newkey rsa:2048 -sha256 -nodes -x509 -days 365 -keyout /certs/self_private -out /certs/self_public  -subj "/C=NN/ST=N/L=N/O=N/CN=$IP"
-php init.php
+if [[ -f "/ssh/key.pub" && -s "/ssh/key.pub" ]]; then
-if [[ -f "/start" && -f "/ssh/key.pub" && -s "/ssh/key.pub" ]]; then
+    unitd --control 0.0.0.0:8080 --log /logs/unit_error
-    unitd --log /logs/unit_error
+    curl -X PUT --data-binary @/config/unit.json http://127.0.0.1:8080/config
-    curl -X PUT --data-binary @/config/unit.json --unix-socket /var/run/control.unit.sock http://localhost/config
+    php init.php
-    pkill unitd
-    unitd --no-daemon --control 0.0.0.0:8080 --log /logs/unit_error
 else
     exit 1;
 fi

scripts/start_tg.sh

@@ -1,4 +1,3 @@
-echo 'root:dummy_passwd'|chpasswd
 cat /ssh/key.pub > /root/.ssh/authorized_keys
 ssh-keygen -A
 exec /usr/sbin/sshd -D -e "$@" &

scripts/start_wg.sh

@@ -1,3 +1,7 @@
+#!/bin/bash
+INTERFACE_VPN="tun0"
+TABLE_ID=100
+
 cat /ssh/key.pub > /root/.ssh/authorized_keys
 ssh-keygen -A
 exec /usr/sbin/sshd -D -e "$@" &
@@ -14,7 +18,8 @@ then
         echo "ListenPort = $WG1PORT" >> /etc/wireguard/wg0.conf
     else
         sed "s/ListenPort = [0-9]\+/ListenPort = $WG1PORT/" /etc/wireguard/wg0.conf > change_port
-        cat change_port > /etc/wireguard/wg0.conf
+        sed "s|Address = [0-9\.\/ ]\+|Address = $ADDRESS|" change_port > change_address
+        cat change_address > /etc/wireguard/wg0.conf
     fi
 else
     if [ $(cat /etc/wireguard/wg0.conf | wc -c) -eq 0 ]
@@ -26,7 +31,8 @@ else
         echo "ListenPort = $WGPORT" >> /etc/wireguard/wg0.conf
     else
         sed "s/ListenPort = [0-9]\+/ListenPort = $WGPORT/" /etc/wireguard/wg0.conf > change_port
-        cat change_port > /etc/wireguard/wg0.conf
+        sed "s|Address = [0-9\.\/ ]\+|Address = $ADDRESS|" change_port > change_address
+        cat change_address > /etc/wireguard/wg0.conf
     fi
 fi
 iptables -t nat -A POSTROUTING --destination 10.10.0.5 -j ACCEPT
@@ -64,4 +70,15 @@ else
         sh /block_exchange.sh
     fi
 fi
+
+ip tuntap add mode tun dev $INTERFACE_VPN || true
+ip addr add 10.255.0.1/24 dev $INTERFACE_VPN || true
+ip link set up dev $INTERFACE_VPN
+ip rule add from $ADDRESS table $TABLE_ID || true
+ip route add default dev $INTERFACE_VPN table $TABLE_ID || true
+iptables -A FORWARD -i $INTERFACE_VPN -j ACCEPT
+iptables -A FORWARD -o $INTERFACE_VPN -j ACCEPT
+iptables -t nat -I POSTROUTING 1 -s $ADDRESS -j RETURN
+tun2socks -device $INTERFACE_VPN -proxy socks5://xr:10808 &
+
 tail -f /dev/null

version

@@ -1,3 +1,26 @@
+27.03.2026 v2.30
+- возможность понижать амнезию до 1
+10.03.2026 v2.29
+- amnezia 2.0
+16.12.2025 v2.28.1
+- фикс шаблона mihomo
+15.12.2025 v2.28
+- новый MTProto
+- hysteria
+- dnstt (вместо iodine)
+- xhttp-vless by legiz
+- возможность отключать поддомены для naive и openconnect (через установку поддомена в 0)
+- возможность отключать  naive и openconnect (через установку пароля в 0)
+- возможность указывать айпишники в списках block, warp
+- быстрая команда для добавления бота в крон: make cron
+- увиличены тайминги пула рулсетов
+- увиличен тайминг сбора статы с xray-ядра
+- улучшено логирование: ssh не срет в контейнер, а основной процесс пишет в /logs
+- улучшены кроны autobackup, autoscan, autoreset
+- фикс старта upstream
+- фикс шорт-ссылки для амнезии
+- фикс папки override для своих заглушек
+- фикс сброса страницы в списках route
 09.11.2025 v2.27
 - фикс reality
 08.11.2025 v2.26