#!/usr/bin/env bash # ACERO SCRIPT v16 # V2Ray (VMess + VLESS, WebSocket) + SSH accounts (direct + SSH-over-WebSocket) # + Nginx + lightweight web panel. # Debian/Ubuntu, run as root. # # Usage: # bash install-v2ray-panel.sh # port 80, random panel password # bash install-v2ray-panel.sh 8080 # custom port # bash install-v2ray-panel.sh 80 MyPassword # custom panel password # # The panel is served over HTTPS on its own random port (port 443 stays free for V2Ray). # The script asks Let's Encrypt for a free, trusted certificate for your server IP # (needs Nginx on port 80 reachable from the internet). If that fails it falls back to a # self-signed certificate (browser warning). Renews itself (6-day certificates). # Open the HTTPS port in your VPS provider firewall too (it is shown at the end). # # Already installed? Run it again: it upgrades the panel and keeps your # users, password, secret path and port (arguments are ignored on upgrade). # Upgrading from v9 adds the HTTPS panel port and certificate automatically. # Upgrading from v7 or older removes OpenVPN (service, NAT rules, OpenVPN users). # A backup of the old users.json is saved first. # # Reset panel password later: # PW='newpass' python3 /opt/v2panel/panel.py --setpw set -euo pipefail PORT="${1:-80}" PANEL_PW="${2:-$(head -c 12 /dev/urandom | base64 | tr -dc 'A-Za-z0-9' | head -c 12)}" SECRET="$(head -c 8 /dev/urandom | od -An -tx1 | tr -d ' \n')" PANEL_LOCAL=2053 SSHWS_LOCAL=10022 V2RAY_VERSION="v4.45.2" APP=/opt/v2panel if [[ $EUID -ne 0 ]]; then echo "Run as root (sudo -i)." >&2 exit 1 fi echo "[1/7] Installing dependencies..." export DEBIAN_FRONTEND=noninteractive apt-get update -y apt-get install -y curl nginx python3 ca-certificates openssh-server openssl UPGRADE=0 if [[ -f ${APP}/settings.json && -f ${APP}/secret_path ]]; then UPGRADE=1 PORT="$(python3 -c 'import json;print(json.load(open("/opt/v2panel/settings.json"))["port"])')" SECRET="$(cat ${APP}/secret_path)" echo "Existing install found: upgrading (keeping users, password, port ${PORT})." fi # ---- v8: OpenVPN is no longer part of ACERO SCRIPT. Remove it if an older version installed it. if [[ -f /etc/openvpn/server/acero.conf || -f /etc/systemd/system/acero-ovpn-nat.service ]]; then echo "Old OpenVPN setup found: removing it (V2Ray and SSH only from v8)." systemctl disable --now openvpn-server@acero 2>/dev/null || true systemctl disable --now acero-ovpn-nat 2>/dev/null || true while iptables -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j MASQUERADE 2>/dev/null; do :; done while iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT 2>/dev/null; do :; done while iptables -D FORWARD -d 10.8.0.0/24 -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null; do :; done rm -f /etc/systemd/system/acero-ovpn-nat.service /usr/local/sbin/acero-ovpn-nat.sh /etc/sysctl.d/99-acero-ovpn.conf rm -f /etc/openvpn/server/acero.conf /etc/openvpn/server/acero-* systemctl daemon-reload fi SSH_PORT="$( (sshd -T 2>/dev/null || true) | awk '/^port /{print $2; exit}')" SSH_PORT="${SSH_PORT:-22}" echo "[2/7] Installing V2Ray ${V2RAY_VERSION}..." if [[ -x /usr/local/bin/v2ray ]]; then echo "V2Ray already installed, skipping." else bash <(curl -fsSL https://raw.githubusercontent.com/v2fly/fhs-install-v2ray/master/install-release.sh) --version "${V2RAY_VERSION}" fi echo "[3/7] Setting up SSH accounts..." groupadd -f acerossh mkdir -p /etc/ssh/sshd_config.d if ! grep -qE '^[[:space:]]*Include[[:space:]]+/etc/ssh/sshd_config\.d/' /etc/ssh/sshd_config; then sed -i '1i Include /etc/ssh/sshd_config.d/*.conf' /etc/ssh/sshd_config fi cat > /etc/ssh/sshd_config.d/acero-ssh.conf <<'SSHEOF' # ACERO panel SSH accounts: tunnel only (no shell, no tty), password login allowed. Match Group acerossh PasswordAuthentication yes AllowTcpForwarding yes PermitTTY no X11Forwarding no AllowAgentForwarding no PermitTunnel no ClientAliveInterval 30 ClientAliveCountMax 4 SSHEOF if sshd -t 2>/dev/null; then systemctl reload ssh 2>/dev/null || systemctl reload sshd 2>/dev/null || true else echo "WARNING: sshd config test failed, removing ACERO SSH drop-in (SSH accounts will not log in)." >&2 rm -f /etc/ssh/sshd_config.d/acero-ssh.conf fi echo "[4/7] Installing panel and SSH-WebSocket bridge..." mkdir -p ${APP} cat > ${APP}/panel.py <<'PYEOF' #!/usr/bin/env python3 # ACERO SCRIPT panel: VMess WS + VLESS WS + SSH accounts import base64, grp, hashlib, hmac, html, json, os, pwd, re, secrets, shutil, signal, socket, subprocess, sys, threading, time, uuid from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer from urllib.parse import parse_qs, quote, urlsplit PANEL_VER = "v16" BASE = os.environ.get("V2PANEL_BASE", "/opt/v2panel") V2CONF = os.environ.get("V2PANEL_CONF", "/usr/local/etc/v2ray/config.json") USERS_F = os.path.join(BASE, "users.json") SETTINGS_F = os.path.join(BASE, "settings.json") TEST = bool(os.environ.get("V2PANEL_TEST")) CALLS = [] # recorded system commands (test mode only) MANAGED_TEST = set() # accounts "created" during a test run SSH_GROUP = "acerossh" LOCK = threading.RLock() SESSIONS = {} FAILS = {} V2_PROTOS = ("vmess", "vless") PROTOS = ("vmess", "vless", "ssh") SYS_PROTOS = ("ssh",) # accounts with a username + password LABEL = {"vmess": "VMess WS", "vless": "VLESS WS", "ssh": "SSH"} NAME_RE = re.compile(r"^[A-Za-z0-9_-]{3,32}$") SSH_RE = re.compile(r"^[a-z][a-z0-9_-]{2,31}$") SSHPW_RE = re.compile(r"^[A-Za-z0-9@#%+=_.-]{4,32}$") # ---------------------------------------------------------------- storage def load(path, default): try: with open(path) as f: return json.load(f) except Exception: return default def save(path, data): tmp = path + ".tmp" with open(tmp, "w") as f: json.dump(data, f, indent=2) os.chmod(tmp, 0o600) os.replace(tmp, path) def hash_pw(pw, salt): return hashlib.pbkdf2_hmac("sha256", pw.encode(), bytes.fromhex(salt), 120000).hex() def gen_pw(n=10): a = "abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789" return "".join(secrets.choice(a) for _ in range(n)) # ---------------------------------------------------------------- system helpers def run(cmd, inp=None): """Run a system command. In test mode it is only recorded.""" if TEST: CALLS.append(cmd) if cmd[0] == "useradd": MANAGED_TEST.add(cmd[-1]) return 0, "" try: r = subprocess.run(cmd, input=inp, capture_output=True, text=True, timeout=30) return r.returncode, (r.stderr or r.stdout or "").strip() except Exception as e: return 1, str(e) def is_managed(name): """True only for system accounts this panel created (in the acerossh group, nologin shell).""" if TEST: return name in MANAGED_TEST try: p = pwd.getpwnam(name) return p.pw_gid == grp.getgrnam(SSH_GROUP).gr_gid and p.pw_shell.endswith("nologin") except KeyError: return False def sys_user_exists(name): try: pwd.getpwnam(name) return True except KeyError: return False def exp_date(u): return time.strftime("%Y-%m-%d", time.gmtime(u["expires"])) if u.get("expires") else "" def ssh_expiry(u): return run(["usermod", "-e", exp_date(u), u["name"]]) def ssh_kill(name): run(["pkill", "-KILL", "-u", name]) def ssh_create(u): name = u["name"] run(["groupadd", "-f", SSH_GROUP]) if not sys_user_exists(name): rc, err = run(["useradd", "-M", "-N", "-g", SSH_GROUP, "-s", "/usr/sbin/nologin", "-c", "acero-ssh", name]) if rc != 0: return False, "useradd: " + err elif not is_managed(name): return False, "May system account na may ganyang name." rc, err = run(["chpasswd"], f"{name}:{u['pw']}\n") if rc != 0: return False, "chpasswd: " + err ssh_expiry(u) run(["usermod", "-L" if u.get("disabled") else "-U", name]) return True, "" def ssh_delete(name): if not is_managed(name): return ssh_kill(name) run(["userdel", name]) def ssh_state(u): if u.get("disabled"): run(["usermod", "-L", u["name"]]) ssh_kill(u["name"]) else: run(["usermod", "-U", u["name"]]) def ssh_sessions(): """{username: [pid, ...]} of live SSH connections (one entry per connection).""" if TEST: return {} rc, out = 0, "" try: out = subprocess.run(["ps", "-eo", "pid=,args="], capture_output=True, text=True, timeout=10).stdout except Exception: return {} res = {} for line in out.splitlines(): m = re.match(r"\s*(\d+)\s+sshd: ([a-z][a-z0-9_-]*)@", line) if m: res.setdefault(m.group(2), []).append(int(m.group(1))) return res def ssh_enforce(users): """Kick the newest connections of SSH users that went over their device limit.""" limits = {u["name"]: u.get("maxdev", 0) for u in users if u["proto"] == "ssh" and u.get("maxdev", 0) > 0} if not limits: return for name, pids in ssh_sessions().items(): lim = limits.get(name) if lim and len(pids) > lim: for pid in sorted(pids)[lim:]: try: os.kill(pid, signal.SIGTERM) except Exception: pass def ssh_ensure_all(): """After a restore/reinstall, recreate missing SSH system accounts from users.json.""" for u in load(USERS_F, []): if u["proto"] == "ssh" and not sys_user_exists(u["name"]): ssh_create(u) # ---------------------------------------------------------------- v2ray def build_config(users, st): live = [u for u in users if not u.get("disabled")] vm = [{"id": u["uuid"], "alterId": 0, "email": u["name"]} for u in live if u["proto"] == "vmess"] vl = [{"id": u["uuid"], "email": u["name"]} for u in live if u["proto"] == "vless"] # placeholder clients keep the inbound valid when no real users exist vm.append({"id": st["ph_vmess"], "alterId": 0, "email": "_placeholder"}) vl.append({"id": st["ph_vless"], "email": "_placeholder"}) return { "log": {"loglevel": "warning"}, "inbounds": [ {"tag": "vmess-ws", "listen": "127.0.0.1", "port": 10001, "protocol": "vmess", "settings": {"clients": vm}, "streamSettings": {"network": "ws", "wsSettings": {"path": "/vmess"}}}, {"tag": "vless-ws", "listen": "127.0.0.1", "port": 10002, "protocol": "vless", "settings": {"clients": vl, "decryption": "none"}, "streamSettings": {"network": "ws", "wsSettings": {"path": "/vless"}}}, ], "outbounds": [{"protocol": "freedom", "tag": "direct"}, {"protocol": "blackhole", "tag": "blocked"}], } def apply_config(): with LOCK: st = load(SETTINGS_F, {}) users = load(USERS_F, []) os.makedirs(os.path.dirname(V2CONF), exist_ok=True) save(V2CONF, build_config(users, st)) os.chmod(V2CONF, 0o644) if not TEST: subprocess.run(["systemctl", "restart", "v2ray"], check=False) def make_link(u, st): ip, port, host = st["ip"], st["port"], st.get("host", "") if u["proto"] == "vmess": j = {"v": "2", "ps": u["name"], "add": ip, "port": str(port), "id": u["uuid"], "aid": "0", "scy": "auto", "net": "ws", "type": "none", "host": host, "path": "/vmess", "tls": ""} return "vmess://" + base64.b64encode(json.dumps(j).encode()).decode() link = f"vless://{u['uuid']}@{ip}:{port}?encryption=none&security=none&type=ws&path=%2Fvless" if host: link += "&host=" + quote(host) return link + "#" + quote(u["name"]) def ssh_cred(u, st): return f"{st['ip']}:{st.get('ssh_port', 22)}@{u['name']}:{u['pw']}" def ssh_payload(st): host = st.get("host") or st["ip"] return f"GET /ssh HTTP/1.1[crlf]Host: {host}[crlf]Upgrade: websocket[crlf][crlf]" def reaper(): while True: time.sleep(30) try: with LOCK: users = load(USERS_F, []) now = int(time.time()) keep = [u for u in users if not u.get("expires") or u["expires"] > now] if len(keep) != len(users): gone = [u for u in users if u not in keep] for u in gone: if u["proto"] == "ssh": ssh_delete(u["name"]) save(USERS_F, keep) if any(u["proto"] in V2_PROTOS for u in gone): apply_config() users = keep ssh_enforce(users) except Exception as e: print("reaper error:", e, flush=True) # ---------------------------------------------------------------- live stats (Server tab) HIST_N = 120 # samples kept (120 x 5s = 10 minutes) HIST_STEP = 5 # seconds between samples HIST = {k: [] for k in ("cpu", "ram", "swap", "tx", "rx", "conn")} MON = {"cpu_prev": None, "net_prev": None, "net": {"tx": 0.0, "rx": 0.0}, "slow": None, "slow_t": 0, "v2ver": None} MON_LOCK = threading.Lock() def _read(path): with open(path) as f: return f.read() def cpu_pct(): try: v = [int(x) for x in _read("/proc/stat").split("\n", 1)[0].split()[1:9]] except Exception: return None idle, tot = v[3] + v[4], sum(v) prev, MON["cpu_prev"] = MON["cpu_prev"], (idle, tot) if not prev or tot <= prev[1]: return None return max(0.0, min(100.0, 100.0 * (1 - (idle - prev[0]) / (tot - prev[1])))) def mem_info(): m = {} for line in _read("/proc/meminfo").splitlines(): k, _, v = line.partition(":") try: m[k] = int(v.split()[0]) * 1024 except Exception: pass tot = m.get("MemTotal", 0) st = m.get("SwapTotal", 0) return tot, tot - m.get("MemAvailable", 0), st, st - m.get("SwapFree", 0) def net_bytes(): rx = tx = 0 for line in _read("/proc/net/dev").splitlines()[2:]: name, _, rest = line.partition(":") name = name.strip() if not rest or name == "lo" or name.startswith(("docker", "veth", "br-")): continue f = rest.split() rx += int(f[0]) tx += int(f[8]) return rx, tx def sock_counts(): tcp = udp = 0 for fn, is_tcp in (("tcp", 1), ("tcp6", 1), ("udp", 0), ("udp6", 0)): try: lines = _read("/proc/net/" + fn).splitlines()[1:] except Exception: continue for ln in lines: f = ln.split() if len(f) < 4: continue if is_tcp and f[3] != "0A": # 0A = LISTEN tcp += 1 elif not is_tcp and f[3] != "07": # 07 = unconnected UDP udp += 1 return tcp, udp def slow_info(): """Things that need a subprocess: service state, V2Ray uptime/version, IP addresses.""" out = {"svc": {}, "v2up": None, "ips": []} for svc in ("v2ray", "v2sshws", "nginx"): out["svc"][svc] = run(["systemctl", "is-active", "--quiet", svc])[0] == 0 try: os_up = float(_read("/proc/uptime").split()[0]) rc, txt = run(["systemctl", "show", "v2ray", "-p", "ActiveEnterTimestampMonotonic", "--value"]) if rc == 0 and txt.strip().isdigit() and int(txt) > 0: out["v2up"] = max(0, int(os_up - int(txt) / 1e6)) except Exception: pass if MON["v2ver"] is None: rc, txt = run(["/usr/local/bin/v2ray", "version"]) mm = re.search(r"(\d+\.\d+\.\d+)", txt or "") MON["v2ver"] = mm.group(1) if (rc == 0 and mm) else "" ips = [] st = load(SETTINGS_F, {}) if st.get("ip"): ips.append(st["ip"]) rc, txt = run(["ip", "-o", "addr", "show", "scope", "global"]) if rc == 0: for ln in txt.splitlines(): f = ln.split() if len(f) > 3 and f[1] not in ("lo",) and not f[1].startswith(("docker", "veth", "br-")) and f[2] in ("inet", "inet6"): a = f[3].split("/")[0] if a not in ips: ips.append(a) out["ips"] = ips return out # ---------------------------------------------------------------- optimize (BBR tuning + swap) ETC = os.path.join(BASE, "etc-test") if TEST else "" TUNE_F = ETC + "/etc/sysctl.d/99-acero-tune.conf" MODS_F = ETC + "/etc/modules-load.d/acero-bbr.conf" LIM_D = ETC + "/etc/systemd/system/v2ray.service.d" LIM_F = LIM_D + "/acero-limits.conf" SWAP_F = ETC + "/acero.swap" FSTAB = ETC + "/etc/fstab" TUNE = ( ("net.core.default_qdisc", "fq"), ("net.ipv4.tcp_congestion_control", "bbr"), ("net.ipv4.tcp_fastopen", "3"), ("net.ipv4.tcp_slow_start_after_idle", "0"), ("net.ipv4.tcp_mtu_probing", "1"), ("net.ipv4.tcp_keepalive_time", "300"), ("net.ipv4.tcp_keepalive_intvl", "30"), ("net.ipv4.tcp_keepalive_probes", "5"), ("net.core.somaxconn", "4096"), ("net.core.netdev_max_backlog", "16384"), ("net.ipv4.tcp_max_syn_backlog", "8192"), ("net.core.rmem_max", "16777216"), ("net.core.wmem_max", "16777216"), ("net.ipv4.tcp_rmem", "4096 131072 16777216"), ("net.ipv4.tcp_wmem", "4096 65536 16777216"), ("fs.file-max", "1048576"), ) def sysctl_get(key): try: return _read("/proc/sys/" + key.replace(".", "/")).strip() except Exception: return "" def default_iface(): try: for ln in _read("/proc/net/route").splitlines()[1:]: f = ln.split() if len(f) > 3 and f[1] == "00000000" and int(f[3], 16) & 2: return f[0] except Exception: pass return "" def swap_info(): total = 0 try: for ln in _read("/proc/meminfo").splitlines(): if ln.startswith("SwapTotal:"): total = int(ln.split()[1]) // 1024 except Exception: pass ours = False try: ours = any(ln.split()[0] == "/acero.swap" for ln in _read("/proc/swaps").splitlines()[1:] if ln.strip()) except Exception: pass return total, ours or os.path.exists(SWAP_F) def bbr_module(): """True if tcp_bbr exists as a loadable kernel module (it is not listed as available until loaded).""" import glob return bool(glob.glob(f"/lib/modules/{os.uname().release}/kernel/net/ipv4/tcp_bbr.ko*")) def opt_status(): avail = sysctl_get("net.ipv4.tcp_available_congestion_control") cc = sysctl_get("net.ipv4.tcp_congestion_control") return { "kernel": os.uname().release, "cc": cc or "?", "qdisc": sysctl_get("net.core.default_qdisc") or "?", "avail": avail, "mod": bbr_module(), "tuned": os.path.exists(TUNE_F) and (cc == "bbr" or TEST), "ram": mem_info()[0] // 1048576, } def tune_on(): """Apply BBR + TCP tuning. Returns (ok, message). Nothing stays if BBR cannot be enabled.""" with LOCK: st = load(SETTINGS_F, {}) if not TEST and "bbr" not in sysctl_get("net.ipv4.tcp_available_congestion_control").split(): run(["modprobe", "tcp_bbr"]) if not TEST and "bbr" not in sysctl_get("net.ipv4.tcp_available_congestion_control").split(): return False, "Walang BBR ang kernel ng VPS na ito (o hindi pinapayagan ng provider; karaniwan sa OpenVZ/LXC)." prev = st.get("opt_prev") or {k: sysctl_get(k) for k, _ in TUNE} applied = [] for k, v in TUNE: rc, _ = run(["sysctl", "-w", f"{k}={v}"]) if rc == 0: applied.append((k, v)) if not TEST and sysctl_get("net.ipv4.tcp_congestion_control") != "bbr": for k, v in prev.items(): if v: run(["sysctl", "-w", f"{k}={v}"]) return False, "Hindi na-enable ang BBR. Walang ibinago." os.makedirs(os.path.dirname(TUNE_F), exist_ok=True) os.makedirs(os.path.dirname(MODS_F), exist_ok=True) with open(TUNE_F, "w") as f: f.write("# ACERO SCRIPT tuning (galing sa panel: Server > Optimize)\n") for k, v in applied: f.write(f"{k} = {v}\n") with open(MODS_F, "w") as f: f.write("tcp_bbr\n") os.makedirs(LIM_D, exist_ok=True) with open(LIM_F, "w") as f: f.write("[Service]\nLimitNOFILE=1048576\n") run(["systemctl", "daemon-reload"]) dev = default_iface() if dev: run(["tc", "qdisc", "replace", "dev", dev, "root", "fq"]) st["opt_prev"] = prev save(SETTINGS_F, st) return True, "" def tune_off(): with LOCK: st = load(SETTINGS_F, {}) prev = st.get("opt_prev") or {} for k, v in prev.items(): if v: run(["sysctl", "-w", f"{k}={v}"]) for f in (TUNE_F, MODS_F, LIM_F): try: os.remove(f) except OSError: pass run(["systemctl", "daemon-reload"]) dev = default_iface() if dev: run(["tc", "qdisc", "replace", "dev", dev, "root", prev.get("net.core.default_qdisc") or "fq_codel"]) st.pop("opt_prev", None) save(SETTINGS_F, st) return True, "" def swap_on(mb): with LOCK: total, ours = swap_info() if ours or total > 0: return False, "May swap na ang VPS na ito." if mb not in (512, 1024, 2048): return False, "Invalid na laki." if not TEST: try: free = shutil.disk_usage("/").free // (1024 * 1024) except Exception: free = 0 if free < mb + 1024: return False, "Kulang ang libreng disk para sa swap." os.makedirs(os.path.dirname(SWAP_F) or "/", exist_ok=True) rc, err = run(["fallocate", "-l", f"{mb}M", SWAP_F]) if rc != 0: rc, err = run(["dd", "if=/dev/zero", f"of={SWAP_F}", "bs=1M", f"count={mb}"]) if rc != 0: return False, "Hindi nagawa ang swap file: " + err[:80] run(["chmod", "600", SWAP_F]) rc, err = run(["mkswap", SWAP_F]) if rc == 0: rc, err = run(["swapon", SWAP_F]) if rc != 0: try: os.remove(SWAP_F) except OSError: pass return False, "Hindi ma-enable ang swap dito (baka hindi pinapayagan ng provider): " + err[:80] try: os.makedirs(os.path.dirname(FSTAB), exist_ok=True) cur = open(FSTAB).read() if os.path.exists(FSTAB) else "" if "/acero.swap" not in cur: with open(FSTAB, "a") as f: f.write(("" if cur.endswith("\n") or not cur else "\n") + "/acero.swap none swap sw 0 0\n") except OSError: pass run(["sysctl", "-w", "vm.swappiness=10"]) return True, "" def swap_off(): with LOCK: run(["swapoff", SWAP_F]) try: os.remove(SWAP_F) except OSError: pass try: if os.path.exists(FSTAB): keep = [ln for ln in open(FSTAB).read().splitlines() if "/acero.swap" not in ln] with open(FSTAB, "w") as f: f.write("\n".join(keep) + ("\n" if keep else "")) except OSError: pass return True, "" def sample_once(): now = time.time() c = cpu_pct() tot, used, st, su = mem_info() rx, tx = net_bytes() tcp, udp = sock_counts() with MON_LOCK: prev, MON["net_prev"] = MON["net_prev"], (now, rx, tx) if prev and now > prev[0]: MON["net"] = {"rx": max(0, rx - prev[1]) / (now - prev[0]), "tx": max(0, tx - prev[2]) / (now - prev[0])} row = {"cpu": c, "ram": used * 100.0 / tot if tot else 0.0, "swap": su * 100.0 / st if st else 0.0, "tx": MON["net"]["tx"], "rx": MON["net"]["rx"], "conn": tcp + udp} for k, v in row.items(): if v is None: continue HIST[k].append(round(v, 2)) del HIST[k][:-HIST_N] def sampler(): n = 0 while True: try: sample_once() if n % 3 == 0 or MON["slow"] is None: MON["slow"] = slow_info() except Exception as e: print("sampler error:", e, flush=True) n += 1 time.sleep(HIST_STEP) def stats_snapshot(): if not HIST["ram"]: sample_once() if MON["slow"] is None: MON["slow"] = slow_info() tot, used, st, su = mem_info() d = shutil.disk_usage("/") tcp, udp = sock_counts() rx, tx = net_bytes() mhz = 0 try: for line in _read("/proc/cpuinfo").splitlines(): if line.lower().startswith("cpu mhz"): mhz = float(line.split(":")[1]) break except Exception: pass try: load_1 = _read("/proc/loadavg").split()[0] os_up = int(float(_read("/proc/uptime").split()[0])) except Exception: load_1, os_up = "-", None rss = thr = 0 try: for line in _read("/proc/self/status").splitlines(): if line.startswith("VmRSS:"): rss = int(line.split()[1]) * 1024 elif line.startswith("Threads:"): thr = int(line.split()[1]) except Exception: pass slow = MON["slow"] or {} with MON_LOCK: hist = {k: list(v) for k, v in HIST.items()} cur = dict(MON["net"]) last_cpu = hist["cpu"][-1] if hist["cpu"] else None return { "ver": PANEL_VER, "step": HIST_STEP, "cpu": {"pct": last_cpu, "cores": os.cpu_count() or 1, "mhz": mhz, "load": load_1}, "ram": {"used": used, "total": tot, "pct": used * 100.0 / tot if tot else 0}, "swap": {"used": su, "total": st, "pct": su * 100.0 / st if st else 0}, "disk": {"used": d.used, "total": d.total, "free": d.free, "pct": d.used * 100.0 / d.total}, "net": {"sent": tx, "recv": rx, "tx": cur["tx"], "rx": cur["rx"]}, "conn": {"tcp": tcp, "udp": udp}, "up": {"os": os_up, "v2ray": slow.get("v2up")}, "panel": {"ram": rss, "threads": thr}, "svc": slow.get("svc", {}), "v2ver": MON["v2ver"] or "", "ips": slow.get("ips", []), "hist": hist, } # ---------------------------------------------------------------- html CSS = r""" :root{color-scheme:dark;--bg:#0b1120;--card:#141c32;--card2:#1b2540;--line:#25304d;--tx:#eaeef8;--mu:#97a3c2;--ac:#ffc83d;--acx:#1a1400;--ok:#4cd6a0;--wn:#ff9d5c;--er:#ff7a8a;--nav:62px} *{box-sizing:border-box} html{-webkit-text-size-adjust:100%} body{margin:0;background:var(--bg);background-image:radial-gradient(700px 320px at 50% -100px,#1b2750,transparent 70%);background-repeat:no-repeat;color:var(--tx);font:15px/1.5 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif} .w{max-width:720px;margin:0 auto;padding:0 14px calc(var(--nav) + 90px + env(safe-area-inset-bottom,0px))} :focus-visible{outline:2px solid var(--ac);outline-offset:2px} h1{font-size:24px;line-height:1.2;letter-spacing:-.02em;margin:0} h2{font-size:16px;margin:0 0 10px} .m{color:var(--mu);font-size:13px} .hide{display:none!important} /* top bar */ .bar{position:sticky;top:0;z-index:10;display:flex;align-items:center;justify-content:space-between;gap:10px;margin:0 -14px 14px;padding:calc(10px + env(safe-area-inset-top,0px)) 14px 10px;background:rgba(11,17,32,.92);backdrop-filter:blur(8px);-webkit-backdrop-filter:blur(8px);border-bottom:1px solid var(--line)} .brand{display:flex;align-items:center;gap:10px;font-weight:800;font-size:17px;letter-spacing:-.01em;line-height:1.1} .brand small{display:block;font-size:10px;font-weight:700;letter-spacing:.18em;color:var(--ac)} .bt{display:flex;align-items:center;gap:10px}.bt form{margin:0} .live{display:inline-flex;align-items:center;gap:6px;font-size:13px;color:#7ee7a0;background:#123a22;padding:4px 10px;border-radius:99px;white-space:nowrap} .live i{width:7px;height:7px;border-radius:50%;background:#4cd6a0;box-shadow:0 0 0 0 rgba(76,214,160,.6);animation:pl 2s infinite} @keyframes pl{70%{box-shadow:0 0 0 6px rgba(76,214,160,0)}100%{box-shadow:0 0 0 0 rgba(76,214,160,0)}} /* form controls */ label{display:block;font-size:13px;color:var(--mu);margin-top:10px} input,select{font:inherit;width:100%;min-height:44px;padding:0 12px;margin:4px 0 6px;border-radius:12px;border:1px solid var(--line);background:#0a0f1d;color:var(--tx)} input:focus{border-color:var(--ac);outline:0} button{font:inherit;font-weight:700;min-height:44px;padding:0 16px;border-radius:12px;border:1px solid var(--ac);background:var(--ac);color:var(--acx);cursor:pointer;white-space:nowrap} button:disabled{opacity:.45;cursor:not-allowed} button.g{background:var(--card2);border-color:var(--line);color:var(--tx);font-weight:600} button.d{background:#3a1620;border-color:#7a2332;color:#ffb4bd;font-weight:600} button.sm{min-height:36px;padding:0 12px;font-size:14px} button.w100{width:100%} button.okc{background:var(--ok)!important;border-color:var(--ok)!important;color:#06251a!important} .row{display:flex;gap:10px}.row>*{flex:1;min-width:0} .hint{font-size:12px;color:var(--mu);min-height:18px}.hint.good{color:var(--ok)}.hint.bad{color:var(--er)} .err{color:var(--er);background:#2a1118;border:1px solid #5b1e2b;padding:10px 12px;border-radius:12px;margin-bottom:12px} /* tabs */ .tab{display:none}.tab.on{display:block} .nav{position:fixed;left:0;right:0;bottom:0;z-index:20;background:rgba(11,17,32,.94);backdrop-filter:blur(10px);-webkit-backdrop-filter:blur(10px);border-top:1px solid var(--line);padding-bottom:env(safe-area-inset-bottom,0px)} .nav div{max-width:720px;margin:0 auto;display:grid;grid-template-columns:repeat(3,1fr)} .nav button{background:none;border:0;border-radius:0;color:var(--mu);font-weight:600;font-size:12px;min-height:var(--nav);display:flex;flex-direction:column;align-items:center;justify-content:center;gap:3px} .nav button svg{width:22px;height:22px} .nav button.on{color:var(--ac)} .fabw{position:fixed;left:0;right:0;z-index:15;bottom:calc(var(--nav) + 14px + env(safe-area-inset-bottom,0px));pointer-events:none} .fabw div{max-width:720px;margin:0 auto;padding:0 14px;display:flex;justify-content:flex-end} .fab{pointer-events:auto;min-height:52px;padding:0 20px;border-radius:99px;font-size:16px;box-shadow:0 8px 24px rgba(0,0,0,.55)} /* stats */ .stats{display:grid;grid-template-columns:repeat(4,1fr);gap:8px;margin-bottom:14px} .st{background:var(--card);border:1px solid var(--line);border-radius:14px;padding:10px 6px;text-align:center} .st b{display:block;font-size:24px;line-height:1.1;letter-spacing:-.02em} .st span{font-size:12px;color:var(--mu)} .st.hot b{color:var(--wn)}.st.live2 b{color:var(--ok)}.st.bad b{color:var(--er)} /* search + chips */ .tools input{margin:0 0 10px} .chips{display:flex;gap:6px;overflow-x:auto;margin:0 -14px 12px;padding:0 14px 2px;scrollbar-width:none} .chips::-webkit-scrollbar{display:none} .chip{min-height:36px;padding:0 13px;border-radius:99px;background:var(--card2);border-color:var(--line);color:var(--tx);font-weight:600;font-size:14px;flex:none} .chip em{font-style:normal;color:var(--mu);font-weight:500;margin-left:4px} .chip.on{background:var(--ac);border-color:var(--ac);color:var(--acx)}.chip.on em{color:#5a4600} /* users */ .list{display:grid;grid-template-columns:minmax(0,1fr);gap:10px;margin-bottom:14px} .u{min-width:0;background:var(--card);border:1px solid var(--line);border-radius:16px;padding:14px} .u.new{border-color:var(--ac);animation:glow 2.2s ease-out} @keyframes glow{0%{box-shadow:0 0 0 0 rgba(255,200,61,.55)}100%{box-shadow:0 0 0 14px rgba(255,200,61,0)}} .uh{display:flex;align-items:center;gap:10px} .un{flex:1;min-width:0}.un b{display:block;font-size:16px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap} .un .m{display:block;overflow:hidden;text-overflow:ellipsis;white-space:nowrap} .dot{flex:none;width:10px;height:10px;border-radius:50%;background:var(--ok)}.dot.soon{background:var(--wn)}.dot.off{background:var(--er)} .tag{font-size:12px;font-weight:600;padding:2px 9px;border-radius:99px;background:var(--card2);color:var(--mu);white-space:nowrap} .tag.vmess{background:#1b2a52;color:#9bb8ff}.tag.vless{background:#173b3a;color:#7ee7d9}.tag.ssh{background:#3a2a14;color:#ffcf8a} .tag.off{background:#3a1620;color:#ffb4bd}.tag.soon{background:#3a2e10;color:#ffd77a} .tags{display:flex;flex-wrap:wrap;gap:6px;margin-top:8px} .pb{height:4px;border-radius:99px;background:var(--card2);margin:10px 0 0;overflow:hidden}.pb i{display:block;height:100%;background:var(--ok)} .pb.soon i{background:var(--wn)}.pb.off i{background:var(--er)} .ua{display:flex;flex-wrap:wrap;gap:8px;margin-top:12px} .ua>button{flex:1} .mg{flex:1} .mg summary{list-style:none;cursor:pointer;min-height:44px;display:flex;align-items:center;justify-content:center;border-radius:12px;border:1px solid var(--line);background:var(--card2);font-weight:600} .mg summary::-webkit-details-marker{display:none} .mg[open]{flex:1 1 100%;order:3} .mg[open] summary{background:#0a0f1d} .mgb{padding-top:12px;display:grid;gap:12px} .cr{display:flex;gap:8px;align-items:center}.cr input{margin:0;font-size:13px} .blk>.m{margin-bottom:4px;display:block} .acts{display:flex;flex-wrap:wrap;gap:8px} .acts form{display:flex;gap:6px;margin:0} .acts input{width:92px;margin:0} .ext{display:flex;gap:6px;flex-wrap:wrap;align-items:center}.ext form{margin:0} .none{text-align:center;padding:28px 14px;background:var(--card);border:1px dashed var(--line);border-radius:16px} /* server + settings */ .card{background:var(--card);border:1px solid var(--line);border-radius:16px;padding:14px;margin-bottom:14px} .ir{display:flex;align-items:center;gap:10px;padding:10px 0;border-top:1px solid var(--line)}.ir:first-of-type{border-top:0} .ir>div{flex:1;min-width:0}.ir .m{display:block}.ir b{display:block;font-weight:600;overflow-wrap:anywhere;font-size:14px} .meter{height:8px;border-radius:99px;background:var(--card2);overflow:hidden;margin-top:6px}.meter i{display:block;height:100%;background:var(--ok)} .meter.hi i{background:var(--wn)} /* server dashboard */ .sub{display:flex;flex-wrap:wrap;align-items:center;gap:8px;margin-bottom:12px}.sub .chip{padding:0 11px}.sub .live{margin-left:auto;cursor:pointer} .live.off{color:#ffb4bd;background:#3a1620}.live.off i{background:var(--er);animation:none} .svc{display:flex;flex-wrap:wrap;gap:8px;margin-bottom:12px} .pill{display:inline-flex;align-items:center;gap:7px;padding:6px 12px;border-radius:99px;background:var(--card);border:1px solid var(--line);font-size:13px;font-weight:600} .pill i{width:8px;height:8px;border-radius:50%;background:var(--mu)}.pill.ok i{background:var(--ok)}.pill.bad i{background:var(--er)} .pill em{font-style:normal;color:var(--mu);font-weight:500}.pill em:empty{display:none} .gr{display:grid;grid-template-columns:minmax(0,1fr);gap:12px;margin-bottom:14px} @media(min-width:600px){.gr{grid-template-columns:repeat(2,minmax(0,1fr))}.gr .wide{grid-column:1/-1}} .mc{background:var(--card);border:1px solid var(--line);border-radius:18px;padding:14px 14px 10px;overflow:hidden;min-width:0} .mh{display:flex;align-items:center;gap:8px;color:var(--mu);font-size:12px;font-weight:700;letter-spacing:.12em;text-transform:uppercase} .mh svg{width:18px;height:18px;color:#5b9bff;flex:none}.mhr{display:flex;align-items:center;justify-content:space-between;gap:10px} .big{margin-top:6px;line-height:1.05;display:flex;align-items:baseline;gap:5px}.big b{font-size:38px;letter-spacing:-.03em}.big small{font-size:16px;color:var(--mu)} .mc.hi .big b{color:var(--wn)} .sb{color:var(--mu);font-size:13px;margin-top:6px;min-height:20px} .ag{display:flex;justify-content:space-between;color:var(--mu);font-size:11px;font-weight:700;letter-spacing:.1em;margin:10px 0 2px}.ag b{color:var(--tx)} .sp{display:block;width:100%;height:64px;margin-top:4px}.sp path,.sp line{vector-effect:non-scaling-stroke} .lb{display:block;font-size:11px;font-weight:700;letter-spacing:.12em;color:var(--mu);text-transform:uppercase} .dual{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin-top:8px}.dual b{display:block;font-size:22px;letter-spacing:-.02em;margin-top:2px;overflow-wrap:anywhere} .kv{padding-top:10px}.kv b{display:block;font-size:17px;margin-top:2px} .leg{display:flex;gap:18px;margin:10px 0 0;font-size:14px;font-weight:600}.leg i{display:inline-block;width:18px;height:3px;border-radius:2px;margin-right:7px;vertical-align:middle} .ipx{padding:6px 0;font-size:14px;overflow-wrap:anywhere;transition:filter .15s}.ips.blur .ipx{filter:blur(6px);user-select:none;-webkit-user-select:none} /* dialogs */ dialog{width:min(480px,calc(100% - 24px));max-height:calc(100dvh - 24px);overflow:auto;border:1px solid var(--line);border-radius:20px;background:var(--card);color:var(--tx);padding:18px} dialog::backdrop{background:rgba(5,8,16,.74)} .dh{display:flex;align-items:center;justify-content:space-between;margin-bottom:2px}.dh h2{font-size:19px;margin:0} .dlgb{display:flex;gap:10px;margin-top:12px}.dlgb button{flex:1} .seg{display:grid;grid-template-columns:repeat(3,1fr);gap:8px;margin:6px 0 2px} .seg label{position:relative;margin:0;color:inherit;font-size:inherit} .seg input{position:absolute;opacity:0;pointer-events:none;width:1px;min-height:0} .seg span{display:flex;flex-direction:column;align-items:center;gap:1px;min-height:58px;justify-content:center;border:1px solid var(--line);border-radius:12px;background:var(--card2);cursor:pointer} .seg span i{font-style:normal;font-size:11px;color:var(--mu)} .seg input:checked+span{border-color:var(--ac);background:#2a2410;box-shadow:inset 0 0 0 1px var(--ac)} .seg input:focus-visible+span{outline:2px solid var(--ac);outline-offset:2px} .presets{display:flex;gap:6px;flex-wrap:wrap;margin-bottom:4px} .pwrow{display:flex;gap:8px}.pwrow input{flex:1}.pwrow button{margin-top:4px} .toast{position:fixed;left:50%;top:calc(12px + env(safe-area-inset-top,0px));transform:translateX(-50%);z-index:40;max-width:calc(100% - 28px);background:#0f2a1b;color:#9af0b8;border:1px solid #1f5a38;padding:10px 18px;border-radius:99px;font-size:14px;box-shadow:0 6px 24px rgba(0,0,0,.5);animation:tin .25s ease-out} @keyframes tin{from{opacity:0;transform:translate(-50%,-10px)}} /* login */ .lg{min-height:100vh;min-height:100dvh;display:grid;place-items:center;padding:24px 0} .lgc{width:100%;max-width:380px;background:var(--card);border:1px solid var(--line);border-radius:22px;padding:24px 20px;box-shadow:0 20px 60px rgba(0,0,0,.45)} .lgc .brand{margin-bottom:18px;font-size:20px}.lgc .m{margin:6px 0 14px} .w.lw{padding-bottom:24px} @media(max-width:520px){ dialog{margin:auto auto 0;width:100%;max-width:none;border-radius:20px 20px 0 0;padding-bottom:calc(18px + env(safe-area-inset-bottom,0px))} .st b{font-size:21px}.live{font-size:12px;padding:3px 8px} } @media(prefers-reduced-motion:reduce){*{animation:none!important}} """ JS = r""" (function(){ var $=function(s,r){return(r||document).querySelector(s)},$$=function(s,r){return[].slice.call((r||document).querySelectorAll(s))}; function openD(d){if(d.showModal)d.showModal();else d.setAttribute('open','')} function closeD(d){if(d.close)d.close();else d.removeAttribute('open')} /* copy */ function copy(t,b){ var done=function(){var o=b.getAttribute('data-l')||b.textContent;b.setAttribute('data-l',o);b.textContent='Nakopya \u2713';b.classList.add('okc');clearTimeout(b._t);b._t=setTimeout(function(){b.textContent=o;b.classList.remove('okc')},1300)}; var fb=function(){var a=document.createElement('textarea');a.value=t;a.style.cssText='position:fixed;opacity:0';document.body.appendChild(a);a.select();try{document.execCommand('copy')}catch(x){}document.body.removeChild(a);done()}; if(navigator.clipboard&&navigator.clipboard.writeText)navigator.clipboard.writeText(t).then(done,fb);else fb() } document.addEventListener('click',function(e){var b=e.target.closest('[data-copy]');if(b)copy(b.getAttribute('data-copy'),b)}); /* login: show/hide password */ var sp=$('[data-pw]'); if(sp)sp.addEventListener('click',function(){var i=$('#pw'),s=i.type==='password';i.type=s?'text':'password';sp.textContent=s?'Hide':'Show'}); var w=$('.w');if(!w||!$('.nav'))return; /* server dashboard (live stats) */ var BL='#5b9bff',GR='#9aa4bd',pt=null,busy=false,subv=(document.querySelector('[data-sub].on')||{getAttribute:function(){return 'dash'}}).getAttribute('data-sub'),inSrv=false; function fb(n){n=n||0;var u=['B','KB','MB','GB','TB'],i=0;while(n>=1024&&i<4){n/=1024;i++}return(i<2?n.toFixed(i):n.toFixed(2))+' '+u[i]} function fup(s){if(s==null)return'-';var d=Math.floor(s/86400),h=Math.floor(s%86400/3600),m=Math.floor(s%3600/60);return d?d+'d '+h+'h':h?h+'h '+m+'m':m+'m'} function avg(a){var t=0;a.forEach(function(v){t+=v});return a.length?t/a.length:0} function pk(a){var m=0;a.forEach(function(v){if(v>m)m=v});return m} function pc(v){return v==null?'-':v.toFixed(1)} function setv(k,v){$$('[data-v="'+k+'"]').forEach(function(e){e.textContent=v})} function spark(c,ser,max){ var svg=$('[data-sp="'+c+'"]');if(!svg)return; var W=300,H=64,n=30,mx=max||0,out=''; ser.forEach(function(s){n=Math.max(n,s.d.length);if(!max)s.d.forEach(function(v){if(v>mx)mx=v})}); if(!max)mx=Math.max(mx*1.25,1); function Y(v){return(H-2-Math.min(v,mx)/mx*(H-6)).toFixed(1)} ser.forEach(function(s,k){ var d=s.d;if(d.length<2)return; var p=d.map(function(v,i){return((n-d.length+i)*W/(n-1)).toFixed(1)+' '+Y(v)}), x0=((n-d.length)*W/(n-1)).toFixed(1); var l='M'+p.join(' L'); if(k===0)out+=''; out+='' }); if(ser[0]&&ser[0].d.length>1){var y=Y(avg(ser[0].d));out=''+out} svg.innerHTML=out } function setLive(ok){var l=$('#lv');if(!l)return;l.classList.toggle('off',!ok);$('span',l).textContent=ok?'Live':'Offline'} function hot(id,p){var c=$('#c-'+id);if(c)c.classList.toggle('hi',p>=85)} function render(d){ var h=d.hist||{}; setv('cpu',pc(d.cpu.pct)); setv('cpu-sub',d.cpu.cores+' Core'+(d.cpu.cores>1?'s':'')+(d.cpu.mhz?' \u00b7 '+(d.cpu.mhz/1000).toFixed(2)+' GHz':'')+' \u00b7 Load '+d.cpu.load); setv('cpu-avg',avg(h.cpu||[]).toFixed(0)+'%');setv('cpu-pk',pk(h.cpu||[]).toFixed(0)+'%'); setv('ram',pc(d.ram.pct));setv('ram-sub',fb(d.ram.used)+' / '+fb(d.ram.total)); setv('ram-avg',avg(h.ram||[]).toFixed(0)+'%');setv('ram-pk',pk(h.ram||[]).toFixed(0)+'%'); setv('swap',pc(d.swap.pct));setv('swap-sub',d.swap.total?fb(d.swap.used)+' / '+fb(d.swap.total):'Walang swap'); setv('swap-avg',avg(h.swap||[]).toFixed(1)+'%');setv('swap-pk',pk(h.swap||[]).toFixed(1)+'%'); setv('disk',pc(d.disk.pct));setv('disk-sub',fb(d.disk.used)+' / '+fb(d.disk.total)); setv('disk-free',fb(d.disk.free));setv('disk-total',fb(d.disk.total)); var bar=$('[data-bar="disk"]');if(bar){bar.style.width=Math.min(100,d.disk.pct)+'%';bar.parentNode.classList.toggle('hi',d.disk.pct>=85)} hot('cpu',d.cpu.pct||0);hot('ram',d.ram.pct);hot('swap',d.swap.total?d.swap.pct:0);hot('disk',d.disk.pct); setv('tx',fb(d.net.tx)+'/s');setv('rx',fb(d.net.rx)+'/s');setv('sent',fb(d.net.sent));setv('recv',fb(d.net.recv)); setv('netavg','\u2191 '+fb(avg(h.tx||[]))+'/s \u2193 '+fb(avg(h.rx||[]))+'/s'); setv('sock',String(d.conn.tcp+d.conn.udp));setv('tcp',String(d.conn.tcp));setv('udp',String(d.conn.udp)); setv('upv',fup(d.up.v2ray));setv('upos',fup(d.up.os)); setv('pram',fb(d.panel.ram));setv('pthr',String(d.panel.threads)); setv('v2ver',d.v2ver?'v'+d.v2ver:''); $$('[data-svc]').forEach(function(e){var k=e.getAttribute('data-svc'),on=d.svc&&d.svc[k];e.classList.toggle('ok',!!on);e.classList.toggle('bad',d.svc&&k in d.svc&&!on)}); var ips=$('#ips');if(ips){ips.innerHTML='';(d.ips.length?d.ips:['-']).forEach(function(a){var x=document.createElement('div');x.className='ipx';x.textContent=a;ips.appendChild(x)})} spark('cpu',[{d:h.cpu||[],c:BL}]);spark('ram',[{d:h.ram||[],c:BL}],100);spark('swap',[{d:h.swap||[],c:BL}],100); spark('net',[{d:h.tx||[],c:BL},{d:h.rx||[],c:GR}]);spark('conn',[{d:h.conn||[],c:BL}]) } function poll(){ if(busy||document.hidden)return;busy=true; fetch('stats',{credentials:'same-origin',cache:'no-store'}).then(function(r){if(r.status===401){location.reload();throw 0}return r.json()}) .then(function(d){busy=false;render(d);setLive(true)}).catch(function(){busy=false;setLive(false)}) } function stopPoll(){if(pt){clearInterval(pt);pt=null}} function sync(){stopPoll();if(inSrv&&subv==='dash'&&!document.hidden){poll();pt=setInterval(poll,5000)}} function svcTab(n){inSrv=(n==='server');sync()} document.addEventListener('visibilitychange',sync); $$('[data-sub]').forEach(function(b){b.addEventListener('click',function(){ subv=b.getAttribute('data-sub'); $$('[data-sub]').forEach(function(x){x.classList.toggle('on',x===b)}); $('#sv-dash').classList.toggle('hide',subv!=='dash');$('#sv-conn').classList.toggle('hide',subv!=='conn');$('#sv-opt').classList.toggle('hide',subv!=='opt'); $('#lv').classList.toggle('hide',subv!=='dash');sync()})}); var eye=$('#eye');if(eye)eye.addEventListener('click',function(){var b=$('#ips').classList.toggle('blur');eye.textContent=b?'Show':'Hide'}); var lvb=$('#lv');if(lvb)lvb.addEventListener('click',function(){poll()}); /* tabs */ var tabs=['users','server','settings']; function show(n,top){ if(tabs.indexOf(n)<0)n='users'; $$('.tab').forEach(function(t){t.classList.toggle('on',t.id==='t-'+n)}); $$('.nav button').forEach(function(b){var on=b.getAttribute('data-tab')===n;b.classList.toggle('on',on);b.setAttribute('aria-current',on?'page':'false')}); var f=$('#fabw');if(f)f.classList.toggle('hide',n!=='users'); svcTab(n); try{history.replaceState(null,'',location.pathname+'#'+n)}catch(x){} if(top)window.scrollTo(0,0) } $$('.nav button').forEach(function(b){b.addEventListener('click',function(){show(b.getAttribute('data-tab'),true)})}); show((location.hash||'').slice(1)||w.getAttribute('data-tab0')||'users',false); /* search + filter */ var q=$('#q'),mode='all'; function filt(){ var t=(q&&q.value||'').toLowerCase().trim(),n=0,all=$$('.u'); all.forEach(function(u){ var m=mode==='all'||(mode==='soon'||mode==='off'?u.getAttribute('data-state')===mode:u.getAttribute('data-proto')===mode); var ok=m&&(!t||u.getAttribute('data-q').indexOf(t)>-1);u.classList.toggle('hide',!ok);if(ok)n++}); var e=$('#empty');if(e)e.classList.toggle('hide',n>0||!all.length) } if(q)q.addEventListener('input',filt); $$('.chip[data-f]').forEach(function(c){c.addEventListener('click',function(){mode=c.getAttribute('data-f');$$('.chip[data-f]').forEach(function(x){x.classList.toggle('on',x===c)});filt()})}); /* add-user sheet */ var dlg=$('#dlg'),nm=$('#nm'),hint=$('#nmh'),go=$('#go'),days=$('#days'),npw=$('#npw'); var RX={ssh:/^[a-z][a-z0-9_-]{2,31}$/,v2:/^[A-Za-z0-9_-]{3,32}$/}; function check(){ var r=$('input[name=proto]:checked',dlg),ssh=!!r&&r.value==='ssh'; $$('.sshonly',dlg).forEach(function(x){x.classList.toggle('hide',!ssh)}); if(ssh&&nm.value!==nm.value.toLowerCase())nm.value=nm.value.toLowerCase(); var v=nm.value,ok=(ssh?RX.ssh:RX.v2).test(v); hint.textContent=ok?'Ayos \u2713':(ssh?'Lowercase lang, simula sa letra, 3-32 (a-z 0-9 _ -)':'3-32 na letra, numero, _ o -'); hint.className='hint '+(!v?'':(ok?'good':'bad')); go.disabled=!ok } function presets(){$$('[data-days]',dlg).forEach(function(b){b.classList.toggle('on',b.getAttribute('data-days')===String(days.value))})} if(dlg){ $('#addBtn').addEventListener('click',function(){openD(dlg);check();presets();nm.focus()}); $$('[data-close]',dlg).forEach(function(b){b.addEventListener('click',function(){closeD(dlg)})}); dlg.addEventListener('click',function(e){if(e.target===dlg)closeD(dlg)}); $$('input[name=proto]',dlg).forEach(function(r){r.addEventListener('change',check)}); nm.addEventListener('input',check); days.addEventListener('input',presets); $$('[data-days]',dlg).forEach(function(b){b.addEventListener('click',function(){days.value=b.getAttribute('data-days');presets()})}); $('#genpw').addEventListener('click',function(){ var a='abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789',r=new Uint32Array(10),s=''; (window.crypto||window.msCrypto).getRandomValues(r);for(var i=0;i<10;i++)s+=a.charAt(r[i]%a.length);npw.value=s}); check();presets() } /* confirm dialog for delete */ var cfm=$('#cfm'),pend=null; document.addEventListener('submit',function(e){ var f=e.target,m=f.getAttribute&&f.getAttribute('data-confirm');if(!m||f._ok)return; e.preventDefault(); if(!cfm||!cfm.showModal){if(window.confirm(m)){f._ok=1;f.submit()}return} pend=f;$('#cfmm').textContent=m;openD(cfm) },true); if(cfm){ $('#cfmy').addEventListener('click',function(){closeD(cfm);if(pend){pend._ok=1;pend.submit()}}); $('#cfmn').addEventListener('click',function(){pend=null;closeD(cfm)}); cfm.addEventListener('click',function(e){if(e.target===cfm){pend=null;closeD(cfm)}}) } /* highlight the user that was just added, then clean the URL */ var m=/[?&]ok=added&n=([^&]*)/.exec(location.search); if(m){ var who=decodeURIComponent(m[1].replace(/\+/g,' ')); var c=$$('.u').filter(function(x){return x.getAttribute('data-name')===who})[0]; if(c){c.classList.add('new');var d=$('details',c);if(d)d.open=true;setTimeout(function(){c.scrollIntoView({block:'center'})},60)} } if(location.search){try{history.replaceState(null,'',location.pathname+location.hash)}catch(x){}} var t=$('#toast');if(t){setTimeout(function(){t.classList.add('hide')},3500);t.addEventListener('click',function(){t.classList.add('hide')})} })(); """ LOGO = ("") ICON = { "users": "", "server": "", "settings": "", } def page(body, nav=False, tab0="users"): cls = "w" if nav else "w lw" return ("" "" "ACERO Panel" f"
{body}
") def login_page(err=""): e = f"" if err else "" return page(f"
{LOGO}
ACEROSCRIPT
" "

Mag-login

Ilagay ang password ng panel para makapasok.

" f"{e}
" "
" "
" "
") def fmt_exp(u): if not u.get("expires"): return "walang expiry" left = u["expires"] - int(time.time()) if left <= 0: return "expired" d, h = left // 86400, (left % 86400) // 3600 return f"{d}d {h}h na lang" FLASH = {"added": "Naidagdag si {n}.", "deleted": "Nabura si {n}.", "renewed": "Na-extend si {n}.", "on": "Na-enable si {n}.", "off": "Na-disable si {n}.", "host": "Na-save ang host.", "pw": "Napalitan ang password. Mag-login ulit.", "tune_on": "Naka-on na ang BBR + tuning.", "tune_off": "Naibalik na ang dating network settings.", "swap_on": "Nagawa at na-enable ang swap.", "swap_off": "Natanggal na ang swap."} def user_state(u, now): exp = u.get("expires") or 0 if u.get("disabled") or (exp and exp <= now): return "off" return "soon" if exp and exp - now <= 3 * 86400 else "ok" def user_card(u, st, online): e = html.escape name, proto = u["name"], u["proto"] now = int(time.time()) exp = u.get("expires") or 0 state = user_state(u, now) tags = f"{LABEL[proto]}" if u.get("disabled"): tags += "DISABLED" elif exp and exp <= now: tags += "EXPIRED" elif state == "soon": tags += "malapit nang mag-expire" meta = fmt_exp(u) if proto in SYS_PROTOS: n = len(online.get(name, [])) lim = u.get("maxdev", 0) meta += f" · online: {n}" + (f"/{lim}" if lim else "") cred = ssh_cred(u, st) else: cred = make_link(u, st) if u.get("note"): meta += " · " + u["note"] cp_label = "Copy login" if proto == "ssh" else "Copy link" extra = "" if proto == "ssh": payload = ssh_payload(st) extra = ("
SSH-over-WebSocket payload · " f"WS port {e(str(st['port']))} · path /ssh" f"
" f"
" f"
User: {e(name)} · Password: {e(u['pw'])}
") nm = e(name) hid = f"" tog = "Enable" if u.get("disabled") else "Disable" bar = "" if exp and exp > now and u.get("created"): pct = max(0, min(100, int((exp - now) * 100 / max(exp - u["created"], 1)))) bar = f"
" q = e((name + " " + u.get("note", "")).lower()) dot = "" if state == "ok" else state return (f"
" f"
{nm}{e(meta)}
" f"
{tags}
{bar}" f"
" "
Manage
" f"
{'Login' if proto == 'ssh' else 'Link'}" f"
" f"
" f"{extra}" "
I-extend ang account
" f"
{hid}
" f"
{hid}
" f"
{hid}
" f"
{hid}" "
" "
" f"
{hid}
" f"
{hid}" "
" "
") def info_row(label, value, copy=True): e = html.escape btn = f"" if copy and value else "" return f"
{e(label)}{e(value) or '-'}
{btn}
" def _ic(p): return ("") DI = { "cpu": _ic(""), "ram": _ic(""), "swap": _ic(""), "disk": _ic(""), "net": _ic(""), "conn": _ic(""), "up": _ic(""), "panel": _ic(""), "ip": _ic(""), } def dash_html(): def spark(c): return f"" def ag(c): return f"
AVG -PEAK -
" def pct_card(c, title): return (f"
{DI[c]}{title}
" f"
-%
 
" f"{ag(c)}{spark(c)}
") pills = ("
" "V2Ray" "SSH-WS" "Nginx" f"Panel{PANEL_VER}
") disk = (f"
{DI['disk']}Storage
" "
-%
 
" "
" "
FREE -TOTAL -
") net = (f"
{DI['net']}Network
" "
Upload-
" "
Download-
" f"{spark('net')}" "
Sent-
" "
Received-
" "
Avg over window-
") conn = (f"
{DI['conn']}Connection stats
" "
-open sockets
" "
TCP -" "UDP -
" f"{spark('conn')}
") up = (f"
{DI['up']}Uptime
" "
V2Ray-
" "
OS-
" f"
{DI['panel']}Panel
" "
RAM-
" "
Threads-
") ips = (f"
{DI['ip']}IP addresses
" "
" "
-
") return pills + "
" + pct_card("cpu", "CPU") + pct_card("ram", "RAM") + pct_card("swap", "Swap") + disk + net + conn + up + ips + "
" def opt_html(): e = html.escape o = opt_status() swap_mb, swap_ours = swap_info() on = o["tuned"] built = "bbr" in o["avail"].split() or TEST if built: bbr_txt = "Oo" elif o["mod"]: bbr_txt = "Oo (module; ilo-load ng panel pag-enable)" else: bbr_txt = "Hindi sigurado; susubukan, at walang ibabago kung hindi kaya" def row(label, value): return f"
{e(label)}{e(str(value)) or '-'}
" tag = ("ON" if on else "OFF") tune = (f"

Network tuning (BBR) {tag}

" "

BBR + fq at TCP tuning para mas stable at mas mabilis ang koneksyon, lalo na sa mobile data na may " "packet loss. Hindi nito tinataasan ang bandwidth ng VPS o ng linya mo, at walang limit na inilalagay sa users. " "Instant at hindi pinuputol ang mga nakakonekta.

" + row("Kernel", o["kernel"]) + row("Congestion control ngayon", o["cc"]) + row("Qdisc ngayon", o["qdisc"]) + row("Suportado ang BBR", bbr_txt) + ("
" "
" if on else "
" "
") + "

Kasama ang mas mataas na open-files limit ng V2Ray (epektibo sa susunod na restart ng V2Ray).

") if swap_ours: swform = ("
" "
") elif swap_mb > 0: swform = "

May swap na ang VPS na ito, kaya walang idadagdag.

" else: swform = ("
" "" "
") swap = ("

Swap

" "

Pang-safety sa maliliit na VPS (1 GB RAM pababa) para hindi ma-kill ang V2Ray kapag napuno ang RAM. " "Gumagamit ng disk space.

" + row("RAM", f"{o['ram']} MB") + row("Swap ngayon", f"{swap_mb} MB" if swap_mb else "Wala") + swform + "
") return f"
{tune}{swap}
" def main_page(flash="", err="", tab="users", sub="dash"): e = html.escape st = load(SETTINGS_F, {}) users = [u for u in load(USERS_F, []) if u.get("proto") in PROTOS] online = ssh_sessions() now = int(time.time()) states = [user_state(u, now) for u in users] cnt = {p: sum(1 for u in users if u["proto"] == p) for p in PROTOS} n_soon, n_off = states.count("soon"), states.count("off") on_total = sum(len(v) for k, v in online.items() if any(u["name"] == k for u in users)) errb = f"" if err else "" toast = f"
{e(flash)}
" if flash else "" rows = "".join(user_card(u, st, online) for u in users) none = ("
Wala pang user.
Pindutin ang + Add user para magsimula.
" if not users else "") empty = "
Walang tugma sa hinahanap mo.
" chips = ("
" f"" f"" f"" f"" f"" f"
") ip, port = st.get("ip", ""), str(st.get("port", "")) ssh_port = str(st.get("ssh_port", 22)) host = st.get("host", "") tabs = ("users", "server", "settings") cls = {t: "tab on" if t == tab else "tab" for t in tabs} nav = "".join(f"" for t, lbl in (("users", "Users"), ("server", "Server"), ("settings", "Settings"))) body = ( f"
{LOGO}
ACEROSCRIPT
" f"
{on_total} online" "
" f"{errb}" # ---- users tab f"
" "
" f"
{len(users)}Users
" f"
{on_total}Online
" f"
{n_soon}Expiring
" f"
{n_off}Off
" "
" f"{chips}
{rows}
{none}{empty}
" # ---- server tab f"
" "
" f"" f"" f"" f"Live
" f"
{dash_html()}
" + opt_html().replace("id=sv-opt class=hide", "id=sv-opt" + ("" if sub == "opt" else " class=hide")) + f"

Koneksyon

" + info_row("Server IP", ip) + info_row("Port (V2Ray + SSH-WS)", port) + info_row("SSH port (direct)", ssh_port) + info_row("VMess WS path", "/vmess") + info_row("VLESS WS path", "/vless") + info_row("SSH WS path", "/ssh") + (info_row("Host header", host) if host else "") + info_row("SSH-WS payload", ssh_payload(st)) + "
" # ---- settings tab f"

Host header

" "

Opsyonal. Para sa bug host / SNI. Isasama sa mga bagong link at payload.

" "
" f"" "
" "

Palitan ang password ng panel

" "" "
" "
" "
" "

Ang pag-add/delete ng VMess o VLESS ay nagre-restart ng V2Ray (saglit na maputol ang V2Ray users). " "Hindi naaapektuhan ng restart ang SSH accounts.

" # ---- floating add + nav "
" f"" # ---- add sheet "
" "

Add user

" "
" "" "" "
" "" "
" "" "" "
" "" "
" "
" "
" "
" "" "
" "

Sigurado ka ba?

" "
" f"{toast}") return page(body, nav=True, tab0=tab) # ---------------------------------------------------------------- http class H(BaseHTTPRequestHandler): server_version = "v2panel" def log_message(self, *a): pass def ip(self): return self.headers.get("X-Real-IP") or self.client_address[0] def authed(self): c = self.headers.get("Cookie", "") for part in c.split(";"): k, _, v = part.strip().partition("=") if k == "sid" and SESSIONS.get(v, 0) > time.time(): return True return False def send(self, code, body="", headers=None): b = body.encode() self.send_response(code) hdr = {"Content-Type": "text/html; charset=utf-8", "Content-Length": str(len(b)), "Cache-Control": "no-store", "X-Frame-Options": "DENY", "Referrer-Policy": "no-referrer"} hdr.update(headers or {}) for k, v in hdr.items(): self.send_header(k, v) self.end_headers() self.wfile.write(b) def redirect(self, extra=None, ok=None, n="", to="./"): loc = to if ok: loc += ("&" if "?" in loc else "?") + "ok=" + ok + "&n=" + quote(n) h = {"Location": loc} h.update(extra or {}) self.send(303, "", h) def fail(self, msg, code=400, tab="users", sub="dash"): self.send(code, main_page(err=msg, tab=tab, sub=sub)) def do_GET(self): u = urlsplit(self.path) if u.path in ("", "/", "/panel"): return self.redirect(to="panel/") # old /SECRET/ links keep working if u.path == "/panel/stats": if not self.authed(): return self.send(401, "{}", {"Content-Type": "application/json"}) try: return self.send(200, json.dumps(stats_snapshot()), {"Content-Type": "application/json"}) except Exception as e: return self.send(500, json.dumps({"error": str(e)}), {"Content-Type": "application/json"}) if u.path != "/panel/": return self.send(404, "not found") if not self.authed(): return self.send(200, login_page()) q = parse_qs(u.query) flash = "" code = q.get("ok", [""])[0] if code in FLASH: flash = FLASH[code].format(n=q.get("n", [""])[0][:40]) tab = q.get("tab", ["users"])[0] sub = q.get("sub", ["dash"])[0] self.send(200, main_page(flash, tab=tab if tab in ("users", "server", "settings") else "users", sub=sub if sub in ("dash", "conn", "opt") else "dash")) def do_POST(self): n = int(self.headers.get("Content-Length", 0) or 0) form = {k: v[0] for k, v in parse_qs(self.rfile.read(min(n, 8192)).decode()).items()} path = self.path.split("?")[0] if path.startswith("/panel/"): path = path[6:] # /panel/login -> /login if path == "/login": ip = self.ip() cnt, until = FAILS.get(ip, (0, 0)) if until > time.time(): return self.send(429, login_page("Masyadong maraming mali. Subukan ulit mamaya.")) st = load(SETTINGS_F, {}) ok = hmac.compare_digest(hash_pw(form.get("pw", ""), st["salt"]), st["pw_hash"]) if not ok: cnt += 1 FAILS[ip] = (cnt, time.time() + 300 if cnt >= 5 else 0) time.sleep(1) return self.send(401, login_page("Maling password.")) FAILS.pop(ip, None) sid = secrets.token_hex(24) SESSIONS[sid] = time.time() + 12 * 3600 return self.redirect({"Set-Cookie": f"sid={sid}; Path=/; HttpOnly; SameSite=Strict; Max-Age=43200"}) if not self.authed(): return self.redirect() if path == "/logout": return self.redirect({"Set-Cookie": "sid=; Path=/; Max-Age=0"}) if path == "/add": name, proto = form.get("name", "").strip(), form.get("proto", "") note = re.sub(r"[^\w .,@#()+-]", "", form.get("note", "")).strip()[:60] try: days = int(form.get("days", "0")) except ValueError: days = -1 try: maxdev = int(form.get("maxdev", "0") or 0) except ValueError: maxdev = -1 if proto not in PROTOS or not 0 <= days <= 3650: return self.fail("Invalid input.") if not (SSH_RE if proto in SYS_PROTOS else NAME_RE).match(name): return self.fail("Invalid name. SSH: lowercase lang, simula sa letra (3-32). V2Ray: a-z, 0-9, _ -.") u = {"name": name, "proto": proto, "created": int(time.time()), "note": note, "expires": int(time.time()) + days * 86400 if days else 0} if proto in SYS_PROTOS: pw = form.get("pw", "").strip() or gen_pw() if not SSHPW_RE.match(pw): return self.fail("Password: 4-32 na character, letra/numero at @ # % + = _ . - lang.") if not 0 <= maxdev <= 20: return self.fail("Max device: 0 hanggang 20.") u.update({"pw": pw, "maxdev": maxdev}) else: u["uuid"] = str(uuid.uuid4()) with LOCK: users = load(USERS_F, []) if any(x["name"].lower() == name.lower() for x in users): return self.fail("Existing na ang name na iyon.") if proto == "ssh": if sys_user_exists(name) and not is_managed(name): return self.fail("May system account na may ganyang name. Pumili ng iba.") ok, err = ssh_create(u) if not ok: return self.fail("Hindi nagawa ang SSH account: " + err, 500) users.append(u) save(USERS_F, users) if proto in V2_PROTOS: apply_config() return self.redirect(ok="added", n=name) if path in ("/delete", "/toggle", "/renew"): name = form.get("name", "") with LOCK: users = load(USERS_F, []) u = next((x for x in users if x["name"] == name), None) if not u: return self.fail("Hindi nahanap ang user.", 404) v2 = u["proto"] in V2_PROTOS if path == "/delete": if not v2: ssh_delete(name) users = [x for x in users if x is not u] code = "deleted" elif path == "/toggle": u["disabled"] = not u.get("disabled", False) if not v2: ssh_state(u) code = "off" if u["disabled"] else "on" else: try: days = int(form.get("days", "0")) except ValueError: days = 0 if not 1 <= days <= 3650: return self.fail("Days: 1 hanggang 3650.") now = int(time.time()) u["expires"] = max(now, u.get("expires", 0)) + days * 86400 if not v2: ssh_expiry(u) code = "renewed" save(USERS_F, users) if v2: apply_config() return self.redirect(ok=code, n=name) if path == "/opt": act = form.get("do", "") if act == "tune_on": ok, msg = tune_on() elif act == "tune_off": ok, msg = tune_off() elif act == "swap_on": try: mb = int(form.get("size", "1024")) except ValueError: mb = 0 ok, msg = swap_on(mb) elif act == "swap_off": ok, msg = swap_off() else: return self.fail("Invalid na aksyon.", tab="server", sub="opt") if not ok: return self.fail(msg, 500, tab="server", sub="opt") return self.redirect(ok=act, to="./?tab=server&sub=opt") if path == "/settings": with LOCK: st = load(SETTINGS_F, {}) host = form.get("host", "").strip()[:100] if not re.match(r"^[A-Za-z0-9.\-]*$", host): return self.fail("Invalid host header.", tab="settings") st["host"] = host save(SETTINGS_F, st) return self.redirect(ok="host") if path == "/password": with LOCK: st = load(SETTINGS_F, {}) if not hmac.compare_digest(hash_pw(form.get("old", ""), st["salt"]), st["pw_hash"]): return self.fail("Mali ang kasalukuyang password.", tab="settings") new1 = form.get("new1", "") if len(new1) < 8 or new1 != form.get("new2", ""): return self.fail("Dapat 8+ na character at magkapareho ang dalawang bagong password.", tab="settings") st["salt"] = secrets.token_hex(16) st["pw_hash"] = hash_pw(new1, st["salt"]) save(SETTINGS_F, st) SESSIONS.clear() return self.redirect({"Set-Cookie": "sid=; Path=/; Max-Age=0"}) self.send(404, "not found") if __name__ == "__main__": if "--setpw" in sys.argv: st = load(SETTINGS_F, {}) st["salt"] = secrets.token_hex(16) st["pw_hash"] = hash_pw(os.environ["PW"], st["salt"]) save(SETTINGS_F, st) print("Password updated.") elif "--apply" in sys.argv: apply_config() else: st = load(SETTINGS_F, {}) ssh_ensure_all() threading.Thread(target=reaper, daemon=True).start() threading.Thread(target=sampler, daemon=True).start() ThreadingHTTPServer(("127.0.0.1", int(st.get("panel_port", 2053))), H).serve_forever() PYEOF chmod 700 ${APP}/panel.py cat > ${APP}/sshws.py <<'PYEOF' #!/usr/bin/env python3 # SSH-over-WebSocket bridge: answers "101 Switching Protocols", then relays raw bytes to local sshd. # Listens on 127.0.0.1 only; Nginx forwards /ssh (and "/" with an Upgrade header) to it. import asyncio, os, socket LISTEN = ("127.0.0.1", int(os.environ.get("SSHWS_PORT", "10022"))) TARGET = ("127.0.0.1", int(os.environ.get("SSH_PORT", "22"))) OK = b"HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\r\n" BAD = b"HTTP/1.1 502 Bad Gateway\r\nContent-Length: 0\r\nConnection: close\r\n\r\n" def nodelay(w): s = w.get_extra_info("socket") if s is not None: try: s.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1) except OSError: pass async def pipe(r, w): try: while True: d = await r.read(65536) if not d: break w.write(d) await w.drain() except Exception: pass finally: try: w.close() except Exception: pass async def handle(cr, cw): try: await asyncio.wait_for(cr.readuntil(b"\r\n\r\n"), 15) # HTTP request head; extra bytes stay buffered except Exception: cw.close() return try: sr, sw = await asyncio.open_connection(*TARGET) except Exception: try: cw.write(BAD) await cw.drain() finally: cw.close() return nodelay(cw) nodelay(sw) cw.write(OK) await cw.drain() await asyncio.gather(pipe(cr, sw), pipe(sr, cw)) async def main(): srv = await asyncio.start_server(handle, *LISTEN, limit=65536) async with srv: await srv.serve_forever() if __name__ == "__main__": asyncio.run(main()) PYEOF chmod 755 ${APP}/sshws.py if [[ $UPGRADE -eq 1 ]]; then python3 - < ${APP}/users.json cat > ${APP}/settings.json < ${APP}/secret_path fi cat > /etc/systemd/system/v2panel.service < /etc/systemd/system/v2sshws.service < sshd :${SSH_PORT}) After=network.target [Service] Environment=SSHWS_PORT=${SSHWS_LOCAL} Environment=SSH_PORT=${SSH_PORT} ExecStart=/usr/bin/python3 ${APP}/sshws.py Restart=always User=nobody NoNewPrivileges=true [Install] WantedBy=multi-user.target SVCEOF echo "[5/7] Configuring Nginx on port ${PORT} + HTTPS panel..." mkdir -p /var/www/acero-acme chmod 755 /var/www/acero-acme IP="$(python3 -c 'import json;print(json.load(open("/opt/v2panel/settings.json"))["ip"])')" CERT_DIR=${APP}/cert if [[ ! -s ${CERT_DIR}/panel.crt || ! -s ${CERT_DIR}/panel.key ]]; then mkdir -p ${CERT_DIR} openssl req -x509 -nodes -newkey rsa:2048 -days 3650 \ -keyout ${CERT_DIR}/panel.key -out ${CERT_DIR}/panel.crt \ -subj "/CN=${IP}" -addext "subjectAltName=IP:${IP}" 2>/dev/null chmod 600 ${CERT_DIR}/panel.key fi HTTPS_PORT="" [[ -f ${APP}/https_port ]] && HTTPS_PORT="$(cat ${APP}/https_port)" if ! [[ "${HTTPS_PORT}" =~ ^[0-9]+$ ]]; then for _ in $(seq 1 50); do cand=$(( RANDOM % 40000 + 20000 )) if [[ $cand -ne $PORT && $cand -ne $SSH_PORT ]] && ! ss -ltn 2>/dev/null | awk '{print $4}' | grep -q ":${cand}$"; then HTTPS_PORT=$cand break fi done HTTPS_PORT="${HTTPS_PORT:-27443}" echo "${HTTPS_PORT}" > ${APP}/https_port fi rm -f /etc/nginx/sites-enabled/default cat > /etc/nginx/conf.d/v2ray-ws.conf </dev/null 2>&1 && ufw status | grep -q "Status: active"; then ufw allow "${PORT}/tcp" || true ufw allow "${HTTPS_PORT}/tcp" || true ufw allow "${SSH_PORT}/tcp" || true fi # ---- Trusted HTTPS certificate: Let's Encrypt IP certificate (free, 6-day, auto-renewed). # Falls back to the self-signed certificate if anything fails; never stops the install. CERT_NOTE="Self-signed cert: the browser shows a warning, accept it once." ACME_HOME=${APP}/acme issue_ip_cert() { [[ "${PORT}" == "80" ]] || { echo "Nginx is not on port 80: skipping Let's Encrypt (needs port 80)."; return 1; } [[ "${IP}" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] || return 1 mkdir -p ${ACME_HOME} if [[ ! -x ${ACME_HOME}/acme.sh ]]; then curl -fsSL https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh -o ${ACME_HOME}/acme.sh || return 1 chmod 700 ${ACME_HOME}/acme.sh fi ${ACME_HOME}/acme.sh --home ${ACME_HOME} --issue --server letsencrypt -d "${IP}" \ -w /var/www/acero-acme --certificate-profile shortlived --days 3 || return 1 ${ACME_HOME}/acme.sh --home ${ACME_HOME} --install-cert -d "${IP}" \ --fullchain-file ${CERT_DIR}/panel.crt --key-file ${CERT_DIR}/panel.key \ --reloadcmd "systemctl reload nginx" || return 1 chmod 600 ${CERT_DIR}/panel.key touch ${CERT_DIR}/letsencrypt return 0 } if [[ -f ${CERT_DIR}/letsencrypt && -x ${ACME_HOME}/acme.sh ]]; then CERT_NOTE="Trusted Let's Encrypt certificate (auto-renews)." elif issue_ip_cert; then CERT_NOTE="Trusted Let's Encrypt certificate (auto-renews)." else echo "Could not get a Let's Encrypt certificate (port 80 must be open to the internet). Using the self-signed certificate." fi if [[ -f ${CERT_DIR}/letsencrypt ]]; then cat > /etc/systemd/system/acero-cert-renew.service < /etc/systemd/system/acero-cert-renew.timer </dev/null || cat >> "$OUT" < "$OUT" <