diff --git a/autoXRAY-ip.sh b/autoXRAY-ip.sh new file mode 100644 index 0000000..0b4842a --- /dev/null +++ b/autoXRAY-ip.sh @@ -0,0 +1,818 @@ +#!/bin/bash + +# Цвета для вывода +GRN='\033[1;32m' +RED='\033[1;31m' +YEL='\033[1;33m' +NC='\033[0m' # No Color + +[[ $EUID -eq 0 ]] || { echo -e "${RED}❌ скрипту нужны root права ${NC}"; exit 1; } + +# --- Определяем SERVER_IP (аргумент или автоопределение) --- +SERVER_IP="${1:-$(hostname -I | awk '{print $1}')}" + +if ! echo "$SERVER_IP" | grep -qE '^([0-9]{1,3}\.){3}[0-9]{1,3}$'; then + echo -e "${RED}❌ Некорректный IP-адрес: $SERVER_IP${NC}" + echo -e "${YEL}Использование: $0 [IP-адрес]${NC}" + exit 1 +fi + +if [[ "$SERVER_IP" == "127.0.0.1" || "$SERVER_IP" == "127."* ]]; then + echo -e "${RED}❌ Нельзя использовать loopback-адрес. Укажите внешний IP сервера.${NC}" + exit 1 +fi + +MASQUERADE_HOST="www.googletagmanager.com" + +echo -e "${YEL}⚙️ IP-адрес: ${GRN}$SERVER_IP${YEL} | Маскировка: ${GRN}$MASQUERADE_HOST${NC}" + +# --- Проверка ОС --- +OS_ID=$(grep '^ID=' /etc/os-release 2>/dev/null | cut -d= -f2 | tr -d '"') +if [[ "$OS_ID" != "ubuntu" && "$OS_ID" != "debian" ]]; then + echo -e "${YEL}⚠️ Обнаружена ОС: $OS_ID. Скрипт тестировался на Ubuntu/Debian.${NC}" + read -p "Продолжить? (y/N): " choice + [[ "$choice" =~ ^[Yy]$ ]] || { echo -e "${RED}Прервано.${NC}"; exit 1; } +fi + +# --- Проверка порта 443 --- +if ss -tnlp | grep -q ':443 '; then + echo -e "${YEL}⚠️ Порт 443 уже занят:${NC}" + ss -tnlp | grep ':443 ' + read -p "Продолжить на ваш страх и риск? (y/N): " choice + [[ "$choice" =~ ^[Yy]$ ]] || { echo -e "${RED}Прервано.${NC}"; exit 1; } +fi + +echo -e "${YEL}Обновление и установка необходимых пакетов...${NC}" +apt-get update && apt-get install curl jq dnsutils openssl nginx -y +systemctl enable --now nginx + +# Включаем BBR +bbr=$(sysctl -a 2>/dev/null | grep net.ipv4.tcp_congestion_control) +if [ "$bbr" = "net.ipv4.tcp_congestion_control = bbr" ]; then + echo -e "${GRN}BBR уже запущен${NC}" +else + echo "net.core.default_qdisc=fq" > /etc/sysctl.d/999-autoXRAY.conf + echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.d/999-autoXRAY.conf + sysctl --system + echo -e "${GRN}BBR активирован${NC}" +fi + +cat < /etc/security/limits.d/99-autoXRAY.conf +* soft nofile 65535 +* hard nofile 65535 +root soft nofile 65535 +root hard nofile 65535 +EOF +ulimit -n 65535 +echo -e "${GRN}Лимиты применены. Текущий ulimit -n: $(ulimit -n) ${NC}" + +# Создание директории сайта +WEB_PATH="/var/www/$SERVER_IP" +mkdir -p "$WEB_PATH" +# Очищаем папку от старых конфигов и страниц +find "$WEB_PATH" -mindepth 1 -not -name '.gitkeep' -delete +echo -e "${GRN}✅ Папка $WEB_PATH очищена.${NC}" + +# Генерируем сайт маскировку +bash -c "$(curl -L https://github.com/xVRVx/autoXRAY/raw/refs/heads/main/test/gen_page2.sh)" -- "$WEB_PATH" + +# Установка Xray +bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install + +# Конфиг nginx + +path_xhttp=$(openssl rand -base64 15 | tr -dc 'a-z0-9' | head -c 6) +path_subpage=$(openssl rand -base64 15 | tr -dc 'A-Za-z0-9' | head -c 20) +configPageUser=$(cat /dev/urandom | tr -dc 'A-Za-z0-9' | head -c 12) +configPagePass=$(cat /dev/urandom | tr -dc 'A-Za-z0-9!@#$%^&*_-' | head -c 20) +configPort=$(shuf -i 10100-59999 -n 1) + +# Определяем путь к конфигу nginx +if [ -f /etc/nginx/sites-available/default ]; then + CONFIG_PATH="/etc/nginx/sites-available/default" + echo -e "${GRN}Обнаружена стандартная сборка nginx.${NC}" +elif [ -f /etc/nginx/conf.d/default.conf ]; then + CONFIG_PATH="/etc/nginx/conf.d/default.conf" + echo -e "${YEL}Обнаружена нестандартная сборка nginx.${NC}" +else + echo -e "${RED}Не найден ни один default конфиг nginx${NC}" + exit 1 +fi + +mkdir -p /etc/nginx/conf.d +cat > /etc/nginx/conf.d/autoXRAY-security.conf <<'SECEOF' +limit_req_zone $binary_remote_addr zone=axray_proxy:10m rate=20r/m; + +map $http_user_agent $axray_bad_bot { + default 0; + ~*(masscan|zgrab|nmap|nikto|sqlmap|nuclei) 1; +} +SECEOF + +echo "${configPageUser}:$(openssl passwd -apr1 "${configPagePass}")" > /etc/nginx/conf.d/autoXRAY-htpasswd +NGINX_USER=$(ps -eo user,comm | awk '$2=="nginx" && $1!="root" {print $1; exit}') +NGINX_USER=${NGINX_USER:-www-data} +chown root:"$NGINX_USER" /etc/nginx/conf.d/autoXRAY-htpasswd +chmod 640 /etc/nginx/conf.d/autoXRAY-htpasswd + +# Генерируем самоподписанный SSL-сертификат для IP (7 дней) +openssl req -x509 -newkey rsa:2048 -nodes \ + -keyout /etc/nginx/conf.d/autoXRAY-ip.key \ + -out /etc/nginx/conf.d/autoXRAY-ip.crt \ + -days 7 \ + -subj "/CN=$SERVER_IP" \ + -addext "subjectAltName=IP:$SERVER_IP" 2>/dev/null +chmod 600 /etc/nginx/conf.d/autoXRAY-ip.key +chmod 644 /etc/nginx/conf.d/autoXRAY-ip.crt +echo -e "${GRN}✅ Самоподписанный SSL-сертификат создан (действителен 7 дней).${NC}" + +# Скрипт автоперевыпуска сертификата (запускается systemd-таймером каждые 6 дней) +cat > /usr/local/bin/autoXRAY-ip-renew.sh </dev/null +chmod 600 /etc/nginx/conf.d/autoXRAY-ip.key +chmod 644 /etc/nginx/conf.d/autoXRAY-ip.crt +nginx -t 2>/dev/null && systemctl reload nginx +RENEWEOF +chmod 755 /usr/local/bin/autoXRAY-ip-renew.sh + +# systemd-сервис +cat > /etc/systemd/system/autoXRAY-ip-renew.service <<'SVCEOF' +[Unit] +Description=autoXRAY self-signed IP certificate renewal +After=network.target + +[Service] +Type=oneshot +ExecStart=/usr/local/bin/autoXRAY-ip-renew.sh +SVCEOF + +# systemd-таймер: запускать каждые 6 дней (сертификат на 7 дней) +cat > /etc/systemd/system/autoXRAY-ip-renew.timer <<'TMREOF' +[Unit] +Description=autoXRAY self-signed IP certificate renewal timer + +[Timer] +OnCalendar=*-*-1/6 +Persistent=true + +[Install] +WantedBy=timers.target +TMREOF + +systemctl daemon-reload +systemctl enable --now autoXRAY-ip-renew.timer +echo -e "${GRN}✅ Таймер автоперевыпуска сертификата включён (каждые 6 дней).${NC}" + +bash -c "cat > $CONFIG_PATH" </dev/null; then + systemctl restart nginx + echo -e "${GRN}✅ Конфигурация nginx обновлена.${NC}" +else + echo -e "${RED}❌ Ошибка в конфигурации nginx:${NC}" + nginx -t + exit 1 +fi + +# Проверяем, что nginx запустился и отвечает +sleep 1 +NGINX_HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 "http://$SERVER_IP/" 2>/dev/null || echo "000") +if [[ "$NGINX_HTTP_CODE" == "200" ]]; then + echo -e "${GRN}✅ Nginx отвечает корректно (HTTP $NGINX_HTTP_CODE).${NC}" +elif [[ "$NGINX_HTTP_CODE" == "000" ]]; then + echo -e "${YEL}⚠️ Nginx не ответил на HTTP-запрос (возможно, порт 80 закрыт фаерволом).${NC}" +else + echo -e "${RED}❌ Nginx вернул HTTP $NGINX_HTTP_CODE. Диагностика:${NC}" + nginx -t + echo -e "${RED}--- Последние ошибки nginx: ---${NC}" + journalctl -u nginx --no-pager -n 20 + exit 1 +fi + +SCRIPT_DIR=/usr/local/etc/xray + +# Генерируем переменные +xray_uuid_vrv=$(xray uuid) + +key_output=$(xray x25519) +xray_privateKey_vrv=$(echo "$key_output" | awk '/[Pp]rivate/ {print $NF}') +xray_publicKey_vrv=$(echo "$key_output" | awk '/[Pp]ublic/ {print $NF}') + +xray_shortIds_vrv=$(openssl rand -hex 8) +xray_shortIds_vrv2=$(openssl rand -hex 4) +xray_shortIds_vrv3=$(openssl rand -hex 6) + +xray_fp="chrome" +xray_spiderX="/$(openssl rand -base64 9 | tr -dc 'a-z' | head -c 6)/" + +socksUser=$(openssl rand -base64 16 | tr -dc 'A-Za-z0-9' | head -c 6) +socksPasw=$(openssl rand -base64 32 | tr -dc 'A-Za-z0-9' | head -c 16) + +# Установка WARP-cli +# Посмотреть порт(2408): grep -r "Endpoint" /etc/wireguard/ +if ss -tuln | grep -q ":40000 "; then + echo -e "${GRN}WARP-cli (Socks5 на порту 40000) уже работает. Пропускаем.${NC}" +else + echo -e "${GRN}Установка WARP-cli (автоматически)...${NC}" + echo -e "1\n1\n40000" | bash <(curl -fsSL https://gitlab.com/fscarmen/warp/-/raw/main/menu.sh) w +fi + +# Экспортируем переменные для envsubst +export xray_uuid_vrv xray_privateKey_vrv xray_publicKey_vrv xray_shortIds_vrv xray_shortIds_vrv2 xray_shortIds_vrv3 xray_fp xray_spiderX SERVER_IP MASQUERADE_HOST path_subpage path_xhttp WEB_PATH socksUser socksPasw + +# Создаем JSON конфигурацию сервера +# Reality target — внешний хост (www.googletagmanager.com:443), xver=0 (без proxy protocol к внешнему серверу) +# Fallback на порт 3333 (XHTTP) — для VLESS-соединений без flow xtls-rprx-vision +cat << 'EOF' | envsubst > "$SCRIPT_DIR/config.json" +{ + "log": { + "dnsLog": false, + "access": "/var/log/xray/access.log", + "error": "/var/log/xray/error.log", + "loglevel": "none" + }, + "dns": { + "servers": [ + "https+local://8.8.4.4/dns-query", + "https+local://8.8.8.8/dns-query", + "https+local://1.1.1.1/dns-query", + "localhost" + ], + "queryStrategy": "UseIPv4" + }, + "inbounds": [ + { + "tag": "vsRAWrtyVISION", + "port": 443, + "listen": "0.0.0.0", + "protocol": "vless", + "settings": { + "clients": [ + { + "flow": "xtls-rprx-vision", + "id": "${xray_uuid_vrv}" + } + ], + "decryption": "none", + "fallbacks": [ + { + "dest": "3333", + "xver": 2 + } + ] + }, + "sniffing": { + "enabled": true, + "destOverride": [ + "http", + "tls", + "quic" + ] + }, + "streamSettings": { + "network": "raw", + "security": "reality", + "sockopt": { + "tcpFastOpen": true, + "tcpNoDelay": true + }, + "realitySettings": { + "show": false, + "xver": 0, + "target": "${MASQUERADE_HOST}:443", + "spiderX": "${xray_spiderX}", + "shortIds": [ + "${xray_shortIds_vrv}", + "${xray_shortIds_vrv2}", + "${xray_shortIds_vrv3}" + ], + "privateKey": "${xray_privateKey_vrv}", + "serverNames": [ + "${MASQUERADE_HOST}", + "tagmanager.google.com", + "googletagmanager.com" + ] + } + } + }, + { + "tag": "vsXHTTPrty", + "port": 3333, + "listen": "127.0.0.1", + "protocol": "vless", + "settings": { + "clients": [ + { + "id": "${xray_uuid_vrv}" + } + ], + "decryption": "none" + }, + "sniffing": { + "enabled": true, + "destOverride": [ + "http", + "tls", + "quic" + ] + }, + "streamSettings": { + "network": "xhttp", + "xhttpSettings": { + "mode": "stream-one", + "path": "/${path_xhttp}" + }, + "security": "none", + "sockopt": { + "acceptProxyProtocol": true + } + } + }, + { + "tag": "socks5", + "port": 10443, + "listen": "0.0.0.0", + "protocol": "mixed", + "settings": { + "ip": "0.0.0.0", + "udp": true, + "auth": "password", + "accounts": [ + { + "user": "${socksUser}", + "pass": "${socksPasw}" + } + ] + } + } + ], + "outbounds": [ + { + "tag": "direct", + "protocol": "freedom", + "settings": { + "domainStrategy": "ForceIPv4" + } + }, + { + "tag": "block", + "protocol": "blackhole" + }, + { + "tag": "warp", + "protocol": "socks", + "settings": { + "servers": [ + { + "address": "127.0.0.1", + "port": 40000 + } + ] + } + } + ], + "routing": { + "rules": [ + { + "ip": [ + "geoip:private" + ], + "outboundTag": "block" + }, + { + "port": "25", + "outboundTag": "block" + }, + { + "protocol": [ + "bittorrent" + ], + "outboundTag": "block" + }, + { + "domain": [ + "geosite:category-ads", + "geosite:win-spy", + "geosite:private" + ], + "outboundTag": "block" + }, + { + "outboundTag": "warp", + "domain": ["ifconfig.me","checkip.amazonaws.com","pify.org","2ip.io","habr.com","geosite:category-ip-geo-detect","geosite:google-gemini","geosite:canva","geosite:openai","geosite:whatsapp","geosite:category-ru"] + } + ], + "domainStrategy": "IPIfNonMatch" + } +} + +EOF + +# Создаем JSON конфигурацию клиента +print_config() { + local PROXY_OUTBOUND="$1" + local REMARK="$2" + + cat << TPL +{ + "log": { + "loglevel": "warning" + }, + "dns": { + "servers": [ + "https://8.8.4.4/dns-query", + "https://8.8.8.8/dns-query", + "https://1.1.1.1/dns-query" + ], + "queryStrategy": "UseIPv4" + }, + "routing": { + "domainStrategy": "IPIfNonMatch", + "rules": [ + { + "domain": [ + "geosite:category-ads", + "geosite:win-spy" + ], + "outboundTag": "block" + }, + { + "protocol": [ + "bittorrent" + ], + "outboundTag": "direct" + }, + { + "domain": [ + "habr.com", "apkmirror.com" + ], + "outboundTag": "proxy" + }, + { + "domain": [ + "geosite:private", + "ifconfig.me", + "checkip.amazonaws.com", + "pify.org", + "geosite:category-ip-geo-detect", + "geosite:apple", + "geosite:apple-pki", + "geosite:huawei", + "geosite:xiaomi", + "geosite:category-android-app-download", + "geosite:f-droid", + "geosite:yandex", + "geosite:vk", + "geosite:microsoft", + "geosite:win-update", + "geosite:win-extra", + "geosite:google-play", + "geosite:steam", + "geosite:category-ru" + ], + "outboundTag": "direct" + }, + { + "ip": [ + "geoip:private" + ], + "outboundTag": "direct" + } + ] + }, + "inbounds": [ + { + "tag": "socks-in", + "protocol": "socks", + "listen": "127.0.0.1", + "port": 10808, + "settings": { + "udp": true + }, + "sniffing": { + "enabled": true, + "destOverride": [ + "http", + "tls", + "quic" + ] + } + }, + { + "tag": "socks-sb", + "protocol": "socks", + "listen": "127.0.0.1", + "port": 2080, + "settings": { + "udp": true + }, + "sniffing": { + "enabled": true, + "destOverride": [ + "http", + "tls", + "quic" + ] + } + }, + { + "tag": "http-in", + "protocol": "http", + "listen": "127.0.0.1", + "port": 10809, + "sniffing": { + "enabled": true, + "destOverride": [ + "http", + "tls", + "quic" + ] + } + } + ], + "outbounds": [ + $PROXY_OUTBOUND, + { + "tag": "direct", + "protocol": "freedom" + }, + { + "tag": "block", + "protocol": "blackhole" + } + ], + "remarks": "$REMARK" +} +TPL +} + +# --- Config 1: VLESS RAW REALITY VISION +OUT_REALITY_VISION='{ + "mux": { "concurrency": -1, "enabled": false }, + "tag": "proxy", + "protocol": "vless", + "settings": { + "vnext": [{ + "address": "${SERVER_IP}", + "port": 443, + "users": [{ "id": "${xray_uuid_vrv}", "flow": "xtls-rprx-vision", "encryption": "none" }] + }] + }, + "streamSettings": { + "network": "raw", + "security": "reality", + "realitySettings": { + "show": false, "fingerprint": "${xray_fp}", "serverName": "${MASQUERADE_HOST}", + "password": "${xray_publicKey_vrv}", "shortId": "${xray_shortIds_vrv}", "spiderX": "${xray_spiderX}" + } + } +}' + +# --- Config 2: VLESS XHTTP REALITY EXTRA +OUT_REALITY_XHTTP='{ + "mux": { "concurrency": -1, "enabled": false }, + "tag": "proxy", + "protocol": "vless", + "settings": { + "vnext": [{ + "address": "${SERVER_IP}", + "port": 443, + "users": [{ "id": "${xray_uuid_vrv}", "encryption": "none" }] + }] + }, + "streamSettings": { + "network": "xhttp", + "security": "reality", + "xhttpSettings": { + "mode": "stream-one", + "path": "/${path_xhttp}", + "extra": { + "noGRPCHeader": true, + "scMaxEachPostBytes": 1500000, + "scMinPostsIntervalMs": 20, + "scStreamUpServerSecs": "60-240", + "xPaddingBytes": "100-1500", + "xmux": { + "cMaxReuseTimes": "1000-3000", + "hKeepAlivePeriod": 300, + "hMaxRequestTimes": "400-700", + "hMaxReusableSecs": "1200-1800", + "maxConcurrency": "3-5", + "maxConnections": 0 + } + } + }, + "realitySettings": { + "show": false, "fingerprint": "${xray_fp}", "serverName": "${MASQUERADE_HOST}", + "password": "${xray_publicKey_vrv}", "shortId": "${xray_shortIds_vrv}", "spiderX": "${xray_spiderX}" + } + } +}' + +( + echo "[" + print_config "$OUT_REALITY_XHTTP" "🌐 VLESS XHTTP REALITY EXTRA" + echo "," + print_config "$OUT_REALITY_VISION" "🌐 VLESS RAW REALITY VISION" + echo "]" +) | envsubst > "$WEB_PATH/$path_subpage.json" + +systemctl restart xray +echo -e "Перезапуск XRAY" + +# Формирование ссылок +subPageLink="https://$SERVER_IP:$configPort/$path_subpage.json" + +linkRTY1="vless://${xray_uuid_vrv}@${SERVER_IP}:443?security=reality&type=tcp&headerType=&path=&host=&flow=xtls-rprx-vision&sni=${MASQUERADE_HOST}&fp=${xray_fp}&pbk=${xray_publicKey_vrv}&sid=${xray_shortIds_vrv}&spx=%2F#vlessRAWrealityVISION-autoXRAY-ip" + +linkRTY2="vless://${xray_uuid_vrv}@${SERVER_IP}:443?security=reality&type=xhttp&headerType=&path=%2F${path_xhttp}&host=&mode=stream-one&extra=%7B%22xmux%22%3A%7B%22cMaxReuseTimes%22%3A%221000-3000%22%2C%22maxConcurrency%22%3A%223-5%22%2C%22maxConnections%22%3A0%2C%22hKeepAlivePeriod%22%3A300%2C%22hMaxRequestTimes%22%3A%22400-700%22%2C%22hMaxReusableSecs%22%3A%221200-1800%22%7D%2C%22headers%22%3A%7B%7D%2C%22noGRPCHeader%22%3Atrue%2C%22xPaddingBytes%22%3A%22100-1500%22%2C%22scMaxEachPostBytes%22%3A1500000%2C%22scMinPostsIntervalMs%22%3A20%2C%22scStreamUpServerSecs%22%3A%2260-240%22%7D&sni=${MASQUERADE_HOST}&fp=${xray_fp}&pbk=${xray_publicKey_vrv}&sid=${xray_shortIds_vrv}&spx=%2F#vlessXHTTPrealityEXTRA-autoXRAY-ip" + +configListLink="https://$SERVER_IP:$configPort/$path_subpage.html" + +CONFIGS_ARRAY=( + "VLESS XHTTP REALITY EXTRA|$linkRTY2" + "VLESS RAW REALITY VISION|$linkRTY1" +) + +# --- ЗАПИСЬ HTML-СТРАНИЦЫ (HEAD + СТАТИЧЕСКИЙ JS/CSS) --- +cat > "$WEB_PATH/$path_subpage.html" <<'HTMLEOF' + + +autoXRAY + + + + +
+

autoXRAY

Конфигурации прокси-клиента

+HTMLEOF + +# --- ДИНАМИЧЕСКИЕ КАРТОЧКИ КОНФИГОВ --- +idx=1 +for item in "${CONFIGS_ARRAY[@]}"; do + title="${item%%|*}" + link="${item#*|}" + cat >> "$WEB_PATH/$path_subpage.html" < +
+ $title +
+ + + +
+
+
$link
+
+CARDEOF + ((idx++)) +done + +# --- ПОДВАЛ И МОДАЛКА --- +cat >> "$WEB_PATH/$path_subpage.html" <<'HTMLEOF' + + + + +HTMLEOF + +# --- ФИНАЛЬНАЯ ПРОВЕРКА --- +echo -e "\n${YEL}=== Финальная проверка статусов ===${NC}" + +# Проверка WARP-cli (Socks5 порт 40000) +if ss -nlt | grep -q ":40000\b"; then + echo -e "WARP-cli: ${GRN}LISTENING${NC}" +else + echo -e "WARP-cli: ${RED}NOT LISTENING${NC}" + echo "Возникла ошибка! Возможные пути решения проблемы смотрите здесь:" + echo "https://github.com/xVRVx/autoXRAY/blob/main/test/warp-readme.md" +fi + +# Проверка Nginx +if systemctl is-active --quiet nginx; then + echo -e "Nginx: ${GRN}RUNNING${NC}" +else + echo -e "Nginx: ${RED}STOPPED/ERROR${NC}" +fi + +# Проверка XRAY +if systemctl is-active --quiet xray; then + echo -e "XRAY: ${GRN}RUNNING${NC}" +else + echo -e "XRAY: ${RED}STOPPED/ERROR${NC}" +fi + +echo -e " +${YEL}Ссылка на сохраненные конфиги ${NC} +${GRN}$configListLink ${NC} + +${YEL}Страница конфигов — Basic Auth:${NC} +Логин: ${GRN}$configPageUser${NC} +Пароль: ${GRN}$configPagePass${NC} + +${YEL}⚠️ Браузер покажет предупреждение о самоподписанном сертификате — это нормально (сертификат для IP).${NC} +${YEL} Нажмите «Дополнительно» → «Всё равно перейти». Сертификат действителен 7 дней.${NC} +"