226 lines
No EOL
7.6 KiB
Bash
226 lines
No EOL
7.6 KiB
Bash
#!/usr/bin/env bash
|
||
#
|
||
# Автоустановка: VLESS+XHTTP+Reality (443) + VLESS+TCP+Vision+Reality (8443) + Hysteria2 (443/udp)
|
||
# Ubuntu 22.04/24.04, запускать от root: sudo bash install.sh
|
||
#
|
||
set -euo pipefail
|
||
|
||
# ========================= НАСТРОЙКИ (отредактируйте перед запуском) =========================
|
||
DOMAIN="" # ваш домен, нужен для сертификата (letsencrypt), напр. example.com
|
||
DEST_XHTTP="addons.mozilla.org" # dest-домен для XHTTP-Reality инбаунда
|
||
DEST_TCP="www.lovelive-anime.jp" # dest-домен для TCP-Vision-Reality инбаунда (должен ОТЛИЧАТЬСЯ от первого)
|
||
HYSTERIA_MASQ_URL="https://www.bing.com" # сайт-прикрытие для Hysteria2 masquerade
|
||
TELEGRAM_BOT_TOKEN="" # опционально: для алертов мониторинга
|
||
TELEGRAM_CHAT_ID="" # опционально
|
||
# ==============================================================================================
|
||
|
||
if [[ $EUID -ne 0 ]]; then
|
||
echo "Запускать от root: sudo bash install.sh"
|
||
exit 1
|
||
fi
|
||
|
||
if [[ -z "$DOMAIN" ]]; then
|
||
echo "Укажите DOMAIN в начале скрипта (нужен для TLS-сертификата Hysteria2/Trojan)."
|
||
exit 1
|
||
fi
|
||
|
||
WORKDIR="/opt/vpn-setup"
|
||
mkdir -p "$WORKDIR"
|
||
cd "$WORKDIR"
|
||
|
||
echo "== 1/9: Обновление системы и зависимости =="
|
||
apt-get update -y
|
||
apt-get install -y curl wget unzip jq openssl uuid-runtime certbot socat cron
|
||
|
||
echo "== 2/9: Установка Xray-core =="
|
||
bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
|
||
XRAY_BIN="/usr/local/bin/xray"
|
||
|
||
echo "== 3/9: Установка Hysteria2 =="
|
||
bash <(curl -fsSL https://get.hy2.sh/)
|
||
|
||
echo "== 4/9: Получение TLS-сертификата (для Hysteria2) =="
|
||
systemctl stop nginx 2>/dev/null || true
|
||
if [[ ! -f "/etc/letsencrypt/live/${DOMAIN}/fullchain.pem" ]]; then
|
||
certbot certonly --standalone --non-interactive --agree-tos -m "admin@${DOMAIN}" -d "${DOMAIN}"
|
||
fi
|
||
CERT_PATH="/etc/letsencrypt/live/${DOMAIN}/fullchain.pem"
|
||
KEY_PATH="/etc/letsencrypt/live/${DOMAIN}/privkey.pem"
|
||
|
||
echo "== 5/9: Генерация ключей, UUID, паролей =="
|
||
UUID1=$(uuidgen)
|
||
UUID2=$(uuidgen)
|
||
REALITY_KEYS=$($XRAY_BIN x25519)
|
||
PRIVATE_KEY=$(echo "$REALITY_KEYS" | grep -i "Private" | awk '{print $NF}')
|
||
PUBLIC_KEY=$(echo "$REALITY_KEYS" | grep -i "Public" | awk '{print $NF}')
|
||
SHORT_ID1=$(openssl rand -hex 8)
|
||
SHORT_ID2=$(openssl rand -hex 8)
|
||
XHTTP_PATH="/$(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 16)/"
|
||
HYSTERIA_PASSWORD=$(openssl rand -hex 16)
|
||
HYSTERIA_OBFS_PASSWORD=$(openssl rand -hex 16)
|
||
|
||
echo "== 6/9: Конфигурация Xray (2 инбаунда) =="
|
||
mkdir -p /usr/local/etc/xray
|
||
cat > /usr/local/etc/xray/config.json <<EOF
|
||
{
|
||
"log": { "loglevel": "warning" },
|
||
"inbounds": [
|
||
{
|
||
"tag": "vless-xhttp-reality",
|
||
"listen": "0.0.0.0",
|
||
"port": 443,
|
||
"protocol": "vless",
|
||
"settings": {
|
||
"clients": [{"id": "${UUID1}", "flow": "", "email": "primary"}],
|
||
"decryption": "none"
|
||
},
|
||
"streamSettings": {
|
||
"network": "xhttp",
|
||
"security": "reality",
|
||
"xhttpSettings": {
|
||
"host": "${DEST_XHTTP}",
|
||
"path": "${XHTTP_PATH}",
|
||
"mode": "stream-up",
|
||
"scMaxEachPostBytes": "500000-1000000",
|
||
"scMinPostsIntervalMs": "30-100",
|
||
"scMaxBufferedPosts": 30,
|
||
"extra": {
|
||
"xPaddingBytes": "100-1000",
|
||
"xmux": {
|
||
"maxConcurrency": "16-32",
|
||
"hMaxRequestTimes": "600-900",
|
||
"hMaxReusableSecs": "1800-3600"
|
||
}
|
||
}
|
||
},
|
||
"realitySettings": {
|
||
"show": false,
|
||
"dest": "${DEST_XHTTP}:443",
|
||
"serverNames": ["${DEST_XHTTP}"],
|
||
"privateKey": "${PRIVATE_KEY}",
|
||
"shortIds": ["${SHORT_ID1}"],
|
||
"fingerprint": "chrome",
|
||
"alpn": ["h2"],
|
||
"spiderX": "/"
|
||
}
|
||
},
|
||
"sniffing": { "enabled": true, "destOverride": ["http", "tls"] }
|
||
},
|
||
{
|
||
"tag": "vless-tcp-vision-reality",
|
||
"listen": "0.0.0.0",
|
||
"port": 8443,
|
||
"protocol": "vless",
|
||
"settings": {
|
||
"clients": [{"id": "${UUID2}", "flow": "xtls-rprx-vision", "email": "backup"}],
|
||
"decryption": "none"
|
||
},
|
||
"streamSettings": {
|
||
"network": "tcp",
|
||
"security": "reality",
|
||
"realitySettings": {
|
||
"show": false,
|
||
"dest": "${DEST_TCP}:443",
|
||
"serverNames": ["${DEST_TCP}"],
|
||
"privateKey": "${PRIVATE_KEY}",
|
||
"shortIds": ["${SHORT_ID2}"],
|
||
"fingerprint": "chrome",
|
||
"spiderX": "/"
|
||
}
|
||
},
|
||
"sniffing": { "enabled": true, "destOverride": ["http", "tls"] }
|
||
}
|
||
],
|
||
"outbounds": [
|
||
{ "protocol": "freedom", "tag": "direct" },
|
||
{ "protocol": "blackhole", "tag": "block" }
|
||
]
|
||
}
|
||
EOF
|
||
|
||
echo "== 7/9: Конфигурация Hysteria2 (443/udp) =="
|
||
mkdir -p /etc/hysteria
|
||
cat > /etc/hysteria/config.yaml <<EOF
|
||
listen: :443
|
||
|
||
tls:
|
||
cert: ${CERT_PATH}
|
||
key: ${KEY_PATH}
|
||
alpn:
|
||
- h3
|
||
|
||
obfs:
|
||
type: salamander
|
||
salamander:
|
||
password: ${HYSTERIA_OBFS_PASSWORD}
|
||
|
||
auth:
|
||
type: password
|
||
password: ${HYSTERIA_PASSWORD}
|
||
|
||
masquerade:
|
||
type: proxy
|
||
proxy:
|
||
url: ${HYSTERIA_MASQ_URL}
|
||
rewriteHost: true
|
||
listenHTTP: :80
|
||
listenHTTPS: :443
|
||
forceHTTPS: true
|
||
|
||
bandwidth:
|
||
up: 50 mbps
|
||
down: 100 mbps
|
||
|
||
udpIdleTimeout: 60s
|
||
EOF
|
||
|
||
echo "== 8/9: Запуск сервисов =="
|
||
systemctl enable xray hysteria-server
|
||
systemctl restart xray
|
||
systemctl restart hysteria-server
|
||
|
||
echo "== 9/9: Открытие портов (ufw, если установлен) =="
|
||
if command -v ufw &> /dev/null; then
|
||
ufw allow 443/tcp
|
||
ufw allow 443/udp
|
||
ufw allow 8443/tcp
|
||
ufw allow 22/tcp
|
||
fi
|
||
|
||
# Сохраняем все параметры для монитора и вывода клиенту
|
||
cat > "$WORKDIR/params.env" <<EOF
|
||
DOMAIN=${DOMAIN}
|
||
SERVER_IP=$(curl -s https://api.ipify.org)
|
||
UUID1=${UUID1}
|
||
UUID2=${UUID2}
|
||
PUBLIC_KEY=${PUBLIC_KEY}
|
||
SHORT_ID1=${SHORT_ID1}
|
||
SHORT_ID2=${SHORT_ID2}
|
||
XHTTP_PATH=${XHTTP_PATH}
|
||
DEST_XHTTP=${DEST_XHTTP}
|
||
DEST_TCP=${DEST_TCP}
|
||
HYSTERIA_PASSWORD=${HYSTERIA_PASSWORD}
|
||
HYSTERIA_OBFS_PASSWORD=${HYSTERIA_OBFS_PASSWORD}
|
||
TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
|
||
TELEGRAM_CHAT_ID=${TELEGRAM_CHAT_ID}
|
||
EOF
|
||
chmod 600 "$WORKDIR/params.env"
|
||
|
||
SERVER_IP=$(curl -s https://api.ipify.org)
|
||
|
||
echo ""
|
||
echo "=================================================================================="
|
||
echo " УСТАНОВКА ЗАВЕРШЕНА"
|
||
echo "=================================================================================="
|
||
echo ""
|
||
echo "--- 1) VLESS + XHTTP + Reality (основной, порт 443) ---"
|
||
echo "vless://${UUID1}@${SERVER_IP}:443?type=xhttp&path=${XHTTP_PATH}&host=${DEST_XHTTP}&security=reality&pbk=${PUBLIC_KEY}&fp=chrome&sni=${DEST_XHTTP}&sid=${SHORT_ID1}&mode=stream-up#VLESS-XHTTP-Primary"
|
||
echo ""
|
||
echo "--- 2) VLESS + TCP + Vision + Reality (резерв, порт 8443) ---"
|
||
echo "vless://${UUID2}@${SERVER_IP}:8443?type=tcp&security=reality&pbk=${PUBLIC_KEY}&fp=chrome&sni=${DEST_TCP}&sid=${SHORT_ID2}&flow=xtls-rprx-vision#VLESS-TCP-Backup"
|
||
echo ""
|
||
echo "--- 3) Hysteria2 (резерв, порт 443/udp) ---"
|
||
echo "hysteria2://${HYSTERIA_PASSWORD}@${SERVER_IP}:443?obfs=salamander&obfs-password=${HYSTERIA_OBFS_PASSWORD}&sni=${DOMAIN}&insecure=0#Hysteria2-Backup"
|
||
echo ""
|
||
echo "Все параметры сохранены в: $WORKDIR/params.env"
|
||
echo "==================================================================================" |