deploy: one-command installer, systemd units, mbs CLI
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
parent
23bb0da6c0
commit
b7792421dd
4 changed files with 468 additions and 0 deletions
377
install.sh
Normal file
377
install.sh
Normal file
|
|
@ -0,0 +1,377 @@
|
|||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
REPO_URL="https://github.com/ImSavsis/mbs-panel.git"
|
||||
APP_DIR="/opt/mbs-panel"
|
||||
WEBROOT="/var/www/certbot"
|
||||
|
||||
if [ "$(id -u)" != "0" ]; then
|
||||
echo "запусти от root: sudo bash install.sh"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -t 0 ]; then
|
||||
READ_TTY="/dev/tty"
|
||||
else
|
||||
READ_TTY="/dev/stdin"
|
||||
fi
|
||||
|
||||
ask() {
|
||||
local prompt="$1" default="$2" var
|
||||
read -r -p "$prompt${default:+ [$default]}: " var < "$READ_TTY"
|
||||
echo "${var:-$default}"
|
||||
}
|
||||
|
||||
echo "== MBS Panel — установка =="
|
||||
echo
|
||||
|
||||
. /etc/os-release
|
||||
case "$ID" in
|
||||
ubuntu) [ "${VERSION_ID%%.*}" -lt 22 ] && echo "поддерживается Ubuntu 22.04+, но пробуем всё равно" ;;
|
||||
debian) [ "${VERSION_ID%%.*}" -lt 11 ] && echo "поддерживается Debian 11+, но пробуем всё равно" ;;
|
||||
*) echo "тестировалось на Ubuntu 22/24 и Debian 11/12, но пробуем всё равно на $PRETTY_NAME" ;;
|
||||
esac
|
||||
|
||||
PANEL_DOMAIN=$(ask "Домен панели (админка)" "")
|
||||
SUB_DOMAIN=$(ask "Домен подписок" "")
|
||||
SITE_DOMAIN=$(ask "Домен сайта (для CORS и ссылок в боте)" "$PANEL_DOMAIN")
|
||||
DE1_ADDRESS=$(ask "Домен этой же ноды (для VPN-клиентов, отдельный A-record)" "de1.$SITE_DOMAIN")
|
||||
BOT_TOKEN=$(ask "Токен бота (от @BotFather)" "")
|
||||
BOT_USERNAME=$(ask "Юзернейм бота (без @, с окончанием _bot/_robot)" "")
|
||||
ADMIN_IDS=$(ask "Telegram ID админов через запятую" "")
|
||||
REALITY_SNI=$(ask "SNI-маскировка для Reality (любой крупный сайт с TLS1.3)" "www.microsoft.com")
|
||||
|
||||
if [ -z "$PANEL_DOMAIN" ] || [ -z "$SUB_DOMAIN" ] || [ -z "$BOT_TOKEN" ] || [ -z "$ADMIN_IDS" ]; then
|
||||
echo "домен панели, домен подписок, токен бота и ID админов — обязательны"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
ADMIN_PANEL_PASSWORD=$(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 14)
|
||||
|
||||
echo
|
||||
echo "ставим пакеты..."
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
apt-get update -qq
|
||||
apt-get install -y -qq curl wget git openssl ufw fail2ban \
|
||||
python3 python3-venv python3-pip \
|
||||
nginx-full certbot > /dev/null
|
||||
|
||||
if [ ! -f /usr/local/bin/xray ]; then
|
||||
echo "ставим Xray-core..."
|
||||
bash -c "$(curl -Ls https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
|
||||
fi
|
||||
|
||||
echo "клонируем репозиторий в $APP_DIR..."
|
||||
if [ -d "$APP_DIR/.git" ]; then
|
||||
git -C "$APP_DIR" pull --quiet
|
||||
else
|
||||
git clone --quiet "$REPO_URL" "$APP_DIR"
|
||||
fi
|
||||
|
||||
cd "$APP_DIR"
|
||||
python3 -m venv venv
|
||||
venv/bin/pip install --quiet --upgrade pip
|
||||
venv/bin/pip install --quiet -r requirements.txt
|
||||
|
||||
echo "генерируем Reality-ключи..."
|
||||
KEYS=$(/usr/local/bin/xray x25519)
|
||||
XRAY_PRIVATE_KEY=$(echo "$KEYS" | grep -i "Private" | awk '{print $NF}')
|
||||
XRAY_PUBLIC_KEY=$(echo "$KEYS" | grep -i "Password\|Public" | awk '{print $NF}')
|
||||
XRAY_SHORT_ID_TCP=$(openssl rand -hex 8)
|
||||
XRAY_SHORT_ID_GRPC=$(openssl rand -hex 8)
|
||||
XRAY_SHORT_ID_XHTTP=$(openssl rand -hex 8)
|
||||
|
||||
cat > "$APP_DIR/.env" << ENVEOF
|
||||
BOT_TOKEN=$BOT_TOKEN
|
||||
BOT_USERNAME=$BOT_USERNAME
|
||||
ADMIN_IDS=$ADMIN_IDS
|
||||
ADMIN_PANEL_PASSWORD=$ADMIN_PANEL_PASSWORD
|
||||
PANEL_DOMAIN=$PANEL_DOMAIN
|
||||
SUB_DOMAIN=$SUB_DOMAIN
|
||||
SITE_DOMAIN=$SITE_DOMAIN
|
||||
XRAY_PUBLIC_KEY=$XRAY_PUBLIC_KEY
|
||||
REALITY_SNI=$REALITY_SNI
|
||||
XRAY_SHORT_ID_TCP=$XRAY_SHORT_ID_TCP
|
||||
XRAY_SHORT_ID_GRPC=$XRAY_SHORT_ID_GRPC
|
||||
XRAY_SHORT_ID_XHTTP=$XRAY_SHORT_ID_XHTTP
|
||||
DE1_ADDRESS=$DE1_ADDRESS
|
||||
ENVEOF
|
||||
chmod 600 "$APP_DIR/.env"
|
||||
|
||||
echo "открываем порт 80 для выпуска сертификатов..."
|
||||
mkdir -p "$WEBROOT"
|
||||
mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled
|
||||
rm -f /etc/nginx/sites-enabled/default
|
||||
|
||||
cat > /etc/nginx/sites-available/mbs-http80.conf << NGINXEOF
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name $PANEL_DOMAIN $SUB_DOMAIN $DE1_ADDRESS;
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
root $WEBROOT;
|
||||
}
|
||||
location / {
|
||||
return 301 https://\$host\$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
server_name _;
|
||||
location /.well-known/acme-challenge/ {
|
||||
root $WEBROOT;
|
||||
}
|
||||
location / {
|
||||
return 404;
|
||||
}
|
||||
}
|
||||
NGINXEOF
|
||||
ln -sf /etc/nginx/sites-available/mbs-http80.conf /etc/nginx/sites-enabled/mbs-http80.conf
|
||||
|
||||
nginx -t && systemctl enable --now nginx && systemctl reload nginx
|
||||
|
||||
echo "выпускаем сертификаты..."
|
||||
certbot certonly --webroot -w "$WEBROOT" --non-interactive --agree-tos \
|
||||
--register-unsafely-without-email -d "$PANEL_DOMAIN" -d "$SUB_DOMAIN"
|
||||
certbot certonly --webroot -w "$WEBROOT" --non-interactive --agree-tos \
|
||||
--register-unsafely-without-email -d "$DE1_ADDRESS"
|
||||
|
||||
mkdir -p /etc/letsencrypt/renewal-hooks/deploy
|
||||
cat > /etc/letsencrypt/renewal-hooks/deploy/mbs-reload.sh << 'HOOKEOF'
|
||||
#!/bin/bash
|
||||
systemctl reload nginx || true
|
||||
systemctl restart xray || true
|
||||
HOOKEOF
|
||||
chmod +x /etc/letsencrypt/renewal-hooks/deploy/mbs-reload.sh
|
||||
|
||||
echo "настраиваем nginx (SNI-роутер + бэкенды)..."
|
||||
mkdir -p /etc/nginx/stream.d
|
||||
if ! grep -q "^stream {" /etc/nginx/nginx.conf; then
|
||||
cat >> /etc/nginx/nginx.conf << 'STREAMEOF'
|
||||
|
||||
stream {
|
||||
include /etc/nginx/stream.d/*.conf;
|
||||
}
|
||||
STREAMEOF
|
||||
fi
|
||||
|
||||
cat > /etc/nginx/stream.d/mbs.conf << STREAMCONFEOF
|
||||
map \$ssl_preread_server_name \$mbs_backend {
|
||||
$PANEL_DOMAIN web_backend;
|
||||
$SUB_DOMAIN web_backend;
|
||||
$DE1_ADDRESS web_backend;
|
||||
default xray_reality;
|
||||
}
|
||||
upstream xray_reality { server 127.0.0.1:10443; }
|
||||
upstream web_backend { server 127.0.0.1:8443; }
|
||||
|
||||
server {
|
||||
listen 443 reuseport;
|
||||
listen [::]:443 reuseport;
|
||||
proxy_pass \$mbs_backend;
|
||||
proxy_protocol on;
|
||||
ssl_preread on;
|
||||
}
|
||||
STREAMCONFEOF
|
||||
|
||||
cat > /etc/nginx/conf.d/mbs-ratelimit.conf << 'RLEOF'
|
||||
limit_req_zone $binary_remote_addr zone=mbs_login:10m rate=5r/m;
|
||||
RLEOF
|
||||
|
||||
cat > /etc/nginx/sites-available/mbs-https.conf << HTTPSEOF
|
||||
server {
|
||||
listen 127.0.0.1:8443 ssl proxy_protocol;
|
||||
server_name $PANEL_DOMAIN;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/$PANEL_DOMAIN/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/$PANEL_DOMAIN/privkey.pem;
|
||||
set_real_ip_from 127.0.0.1;
|
||||
real_ip_header proxy_protocol;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000" always;
|
||||
add_header X-Frame-Options "DENY" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header Referrer-Policy "same-origin" always;
|
||||
|
||||
location /admin/api/login {
|
||||
limit_req zone=mbs_login burst=3 nodelay;
|
||||
proxy_pass http://127.0.0.1:8001;
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
}
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8001;
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 127.0.0.1:8443 ssl proxy_protocol;
|
||||
server_name $SUB_DOMAIN;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/$PANEL_DOMAIN/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/$PANEL_DOMAIN/privkey.pem;
|
||||
set_real_ip_from 127.0.0.1;
|
||||
real_ip_header proxy_protocol;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000" always;
|
||||
add_header X-Frame-Options "DENY" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header Referrer-Policy "same-origin" always;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8001;
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 127.0.0.1:8443 ssl proxy_protocol;
|
||||
server_name $DE1_ADDRESS;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/$DE1_ADDRESS/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/$DE1_ADDRESS/privkey.pem;
|
||||
set_real_ip_from 127.0.0.1;
|
||||
real_ip_header proxy_protocol;
|
||||
|
||||
location / {
|
||||
return 204;
|
||||
}
|
||||
}
|
||||
HTTPSEOF
|
||||
ln -sf /etc/nginx/sites-available/mbs-https.conf /etc/nginx/sites-enabled/mbs-https.conf
|
||||
|
||||
echo "пишем конфиг Xray..."
|
||||
mkdir -p /usr/local/etc/xray
|
||||
cat > /usr/local/etc/xray/config.json << XRAYEOF
|
||||
{
|
||||
"log": { "loglevel": "warning" },
|
||||
"api": { "tag": "api", "services": ["HandlerService", "LoggerService", "StatsService"] },
|
||||
"stats": {},
|
||||
"policy": {
|
||||
"levels": { "0": { "statsUserUplink": true, "statsUserDownlink": true } },
|
||||
"system": {
|
||||
"statsInboundUplink": true, "statsInboundDownlink": true,
|
||||
"statsOutboundUplink": true, "statsOutboundDownlink": true
|
||||
}
|
||||
},
|
||||
"routing": {
|
||||
"rules": [ { "type": "field", "inboundTag": ["api"], "outboundTag": "api" } ]
|
||||
},
|
||||
"inbounds": [
|
||||
{
|
||||
"tag": "api", "listen": "127.0.0.1", "port": 10085,
|
||||
"protocol": "dokodemo-door", "settings": { "address": "127.0.0.1" }
|
||||
},
|
||||
{
|
||||
"tag": "vless-tcp-reality", "listen": "127.0.0.1", "port": 10443,
|
||||
"protocol": "vless",
|
||||
"settings": { "clients": [], "decryption": "none" },
|
||||
"sniffing": { "enabled": true, "destOverride": ["http", "tls"] },
|
||||
"streamSettings": {
|
||||
"network": "tcp", "security": "reality",
|
||||
"realitySettings": {
|
||||
"show": false, "dest": "$REALITY_SNI:443", "xver": 1,
|
||||
"serverNames": ["$REALITY_SNI"],
|
||||
"privateKey": "$XRAY_PRIVATE_KEY",
|
||||
"shortIds": ["$XRAY_SHORT_ID_TCP"]
|
||||
},
|
||||
"sockopt": { "acceptProxyProtocol": true }
|
||||
}
|
||||
},
|
||||
{
|
||||
"tag": "vless-grpc-reality", "listen": "0.0.0.0", "port": 2053,
|
||||
"protocol": "vless",
|
||||
"settings": { "clients": [], "decryption": "none" },
|
||||
"sniffing": { "enabled": true, "destOverride": ["http", "tls"] },
|
||||
"streamSettings": {
|
||||
"network": "grpc", "security": "reality",
|
||||
"realitySettings": {
|
||||
"show": false, "dest": "$REALITY_SNI:443", "xver": 0,
|
||||
"serverNames": ["$REALITY_SNI"],
|
||||
"privateKey": "$XRAY_PRIVATE_KEY",
|
||||
"shortIds": ["$XRAY_SHORT_ID_GRPC"]
|
||||
},
|
||||
"grpcSettings": { "serviceName": "mbs-grpc" }
|
||||
}
|
||||
},
|
||||
{
|
||||
"tag": "vless-xhttp-reality", "listen": "0.0.0.0", "port": 2087,
|
||||
"protocol": "vless",
|
||||
"settings": { "clients": [], "decryption": "none" },
|
||||
"sniffing": { "enabled": true, "destOverride": ["http", "tls"] },
|
||||
"streamSettings": {
|
||||
"network": "xhttp", "security": "reality",
|
||||
"realitySettings": {
|
||||
"show": false, "dest": "$REALITY_SNI:443", "xver": 0,
|
||||
"serverNames": ["$REALITY_SNI"],
|
||||
"privateKey": "$XRAY_PRIVATE_KEY",
|
||||
"shortIds": ["$XRAY_SHORT_ID_XHTTP"]
|
||||
},
|
||||
"xhttpSettings": { "path": "/mbs-xh", "mode": "auto" }
|
||||
}
|
||||
},
|
||||
{
|
||||
"tag": "vless-ws-tls", "listen": "0.0.0.0", "port": 8880,
|
||||
"protocol": "vless",
|
||||
"settings": { "clients": [], "decryption": "none" },
|
||||
"sniffing": { "enabled": true, "destOverride": ["http", "tls"] },
|
||||
"streamSettings": {
|
||||
"network": "ws", "security": "tls",
|
||||
"wsSettings": { "path": "/mbs-ws" },
|
||||
"tlsSettings": {
|
||||
"certificates": [{
|
||||
"certificateFile": "/etc/letsencrypt/live/$DE1_ADDRESS/fullchain.pem",
|
||||
"keyFile": "/etc/letsencrypt/live/$DE1_ADDRESS/privkey.pem"
|
||||
}]
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"outbounds": [
|
||||
{ "protocol": "freedom", "tag": "direct" },
|
||||
{ "protocol": "blackhole", "tag": "block" }
|
||||
]
|
||||
}
|
||||
XRAYEOF
|
||||
|
||||
echo "systemd-юниты..."
|
||||
cp "$APP_DIR/systemd/mbs-bot.service" /etc/systemd/system/mbs-bot.service
|
||||
cp "$APP_DIR/systemd/mbs-api.service" /etc/systemd/system/mbs-api.service
|
||||
systemctl daemon-reload
|
||||
|
||||
echo "ставим CLI mbs..."
|
||||
cp "$APP_DIR/mbs" /usr/local/bin/mbs
|
||||
chmod +x /usr/local/bin/mbs
|
||||
|
||||
echo "фаервол..."
|
||||
ufw allow 22/tcp > /dev/null || true
|
||||
ufw allow 80/tcp > /dev/null || true
|
||||
ufw allow 443/tcp > /dev/null || true
|
||||
ufw allow 2053/tcp > /dev/null || true
|
||||
ufw allow 2087/tcp > /dev/null || true
|
||||
ufw allow 8880/tcp > /dev/null || true
|
||||
ufw --force enable > /dev/null || true
|
||||
systemctl enable --now fail2ban > /dev/null
|
||||
|
||||
nginx -t
|
||||
systemctl reload nginx
|
||||
systemctl enable --now xray
|
||||
systemctl enable --now mbs-bot
|
||||
systemctl enable --now mbs-api
|
||||
|
||||
sleep 2
|
||||
echo
|
||||
echo "== готово =="
|
||||
echo "Панель: https://$PANEL_DOMAIN"
|
||||
echo "Пароль: $ADMIN_PANEL_PASSWORD (сменить: mbs pass)"
|
||||
echo "Подписки: https://$SUB_DOMAIN"
|
||||
echo "Нода: $DE1_ADDRESS"
|
||||
echo
|
||||
echo "статус сервисов:"
|
||||
mbs status || true
|
||||
63
mbs
Normal file
63
mbs
Normal file
|
|
@ -0,0 +1,63 @@
|
|||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
APP_DIR="/opt/mbs-panel"
|
||||
ENV_FILE="$APP_DIR/.env"
|
||||
|
||||
usage() {
|
||||
cat << 'EOF'
|
||||
mbs — управление MBS Panel
|
||||
|
||||
mbs pass [новый_пароль] сменить пароль админ-панели (без аргумента — сгенерировать случайный)
|
||||
mbs status статус всех сервисов (bot, api, xray, nginx)
|
||||
mbs restart перезапустить bot + api
|
||||
mbs logs [bot|api|xray] последние строки лога (по умолчанию api)
|
||||
mbs domain показать текущий домен панели
|
||||
EOF
|
||||
}
|
||||
|
||||
cmd_pass() {
|
||||
local new_pass="$1"
|
||||
if [ -z "$new_pass" ]; then
|
||||
new_pass=$(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 14)
|
||||
fi
|
||||
if grep -q "^ADMIN_PANEL_PASSWORD=" "$ENV_FILE"; then
|
||||
sed -i "s#^ADMIN_PANEL_PASSWORD=.*#ADMIN_PANEL_PASSWORD=$new_pass#" "$ENV_FILE"
|
||||
else
|
||||
echo "ADMIN_PANEL_PASSWORD=$new_pass" >> "$ENV_FILE"
|
||||
fi
|
||||
systemctl restart mbs-api
|
||||
echo "Новый пароль панели: $new_pass"
|
||||
}
|
||||
|
||||
cmd_status() {
|
||||
systemctl --no-pager status mbs-bot mbs-api xray nginx 2>&1 | grep -E "●|Active:"
|
||||
}
|
||||
|
||||
cmd_restart() {
|
||||
systemctl restart mbs-bot mbs-api
|
||||
echo "Перезапущено."
|
||||
}
|
||||
|
||||
cmd_logs() {
|
||||
local svc="${1:-api}"
|
||||
case "$svc" in
|
||||
bot) journalctl -u mbs-bot -n 60 --no-pager ;;
|
||||
api) journalctl -u mbs-api -n 60 --no-pager ;;
|
||||
xray) journalctl -u xray -n 60 --no-pager ;;
|
||||
*) echo "неизвестный сервис: $svc (bot|api|xray)"; exit 1 ;;
|
||||
esac
|
||||
}
|
||||
|
||||
cmd_domain() {
|
||||
grep "^PANEL_DOMAIN=" "$ENV_FILE"
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
pass) cmd_pass "$2" ;;
|
||||
status) cmd_status ;;
|
||||
restart) cmd_restart ;;
|
||||
logs) cmd_logs "$2" ;;
|
||||
domain) cmd_domain ;;
|
||||
*) usage ;;
|
||||
esac
|
||||
14
systemd/mbs-api.service
Normal file
14
systemd/mbs-api.service
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
[Unit]
|
||||
Description=MBS Panel — API + admin panel
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
WorkingDirectory=/opt/mbs-panel
|
||||
ExecStart=/opt/mbs-panel/venv/bin/uvicorn api:app --host 127.0.0.1 --port 8001
|
||||
Restart=on-failure
|
||||
RestartSec=3
|
||||
User=root
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
14
systemd/mbs-bot.service
Normal file
14
systemd/mbs-bot.service
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
[Unit]
|
||||
Description=MBS Panel — Telegram bot
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
WorkingDirectory=/opt/mbs-panel
|
||||
ExecStart=/opt/mbs-panel/venv/bin/python bot.py
|
||||
Restart=on-failure
|
||||
RestartSec=3
|
||||
User=root
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
Loading…
Add table
Add a link
Reference in a new issue