v2.5.5: fix 404 after panel update

app.py

@@ -102,7 +102,7 @@ else:
     application_path = os.path.dirname(__file__)
 
 DATA_FILE = os.path.join(application_path, 'data.json')  # legacy JSON; used only for one-shot import / export
-CURRENT_VERSION = "v2.5.4"
+CURRENT_VERSION = "v2.5.5"
 RELEASES_REPO_URL = repo_url()
 RELEASES_API_LATEST = api_latest_url()
 BIN_DIR = os.environ.get('TUNNEL_BIN_DIR', os.path.join(application_path, 'bin'))
@@ -224,12 +224,46 @@ def tpl(request, template, **kwargs):
     return templates.TemplateResponse(template, ctx)
 
 
+def get_panel_listen_port(data: Optional[dict] = None) -> int:
+    try:
+        env_port = int(os.environ.get('APP_PORT', '0') or '0')
+    except ValueError:
+        env_port = 0
+    if env_port:
+        return env_port
+    if data is None:
+        data = load_data()
+    ssl_conf = data.get('settings', {}).get('ssl', {}) or {}
+    try:
+        return int(ssl_conf.get('panel_port', 5000) or 5000)
+    except (TypeError, ValueError):
+        return 5000
+
+
+def panel_ssl_active(data: Optional[dict] = None) -> bool:
+    if data is None:
+        data = load_data()
+    ssl_conf = data.get('settings', {}).get('ssl', {}) or {}
+    if not ssl_conf.get('enabled'):
+        return False
+    # Docker/compose usually terminates TLS outside the app and serves plain HTTP inside.
+    if os.environ.get('APP_PORT'):
+        return False
+    cert_path = ssl_conf.get('cert_path')
+    key_path = ssl_conf.get('key_path')
+    if ssl_conf.get('cert_text') or ssl_conf.get('key_text'):
+        return True
+    return bool(
+        cert_path and key_path
+        and os.path.exists(cert_path) and os.path.exists(key_path)
+    )
+
+
 def get_panel_local_url(request: Optional[Request] = None):
     data = load_data()
-    ssl_conf = data.get('settings', {}).get('ssl', {})
-    scheme = 'https' if ssl_conf.get('enabled') else 'http'
+    scheme = 'https' if panel_ssl_active(data) else 'http'
     host = '127.0.0.1'
-    port = ssl_conf.get('panel_port', 5000) or 5000
+    port = get_panel_listen_port(data)
     if request:
         scheme = request.url.scheme or scheme
         host = request.url.hostname or host
@@ -239,12 +273,17 @@ def get_panel_local_url(request: Optional[Request] = None):
 
 def get_panel_tunnel_target_url():
     data = load_data()
-    ssl_conf = data.get('settings', {}).get('ssl', {})
-    scheme = 'https' if ssl_conf.get('enabled') else 'http'
-    port = ssl_conf.get('panel_port', 5000) or 5000
+    scheme = 'https' if panel_ssl_active(data) else 'http'
+    port = get_panel_listen_port(data)
     return f"{scheme}://127.0.0.1:{port}"
 
 
+@app.get('/health', include_in_schema=False)
+@app.get('/api/health', include_in_schema=False)
+async def health_check():
+    return {'status': 'ok', 'version': CURRENT_VERSION}
+
+
 def get_warp_cli_binary():
     found = shutil.which(WARP_CLI_COMMAND)
     if found:
@@ -2436,6 +2475,24 @@ async def startup():
         logger.info("Starting Telegram bot from saved settings...")
         tg_bot.launch_bot(tg_cfg['token'], load_data, generate_vpn_link, save_data)
 
+    # Reattach quick tunnels after panel restart so public URLs keep working.
+    try:
+        tunnel_state = await asyncio.to_thread(load_tunnel_state)
+        local_url = get_panel_tunnel_target_url()
+        for provider in ('cloudflare', 'ngrok'):
+            state = tunnel_state.get(provider) or {}
+            if not (state.get('public_url') or state.get('pid') or state.get('started_at')):
+                continue
+            if state.get('pid') and pid_is_running(state.get('pid')):
+                continue
+            try:
+                await asyncio.to_thread(start_tunnel, provider, local_url)
+                logger.info('Restarted %s tunnel after panel boot -> %s', provider, local_url)
+            except Exception as exc:
+                logger.warning('Could not restart %s tunnel after panel boot: %s', provider, exc)
+    except Exception as exc:
+        logger.warning('Tunnel auto-restart skipped: %s', exc)
+
 
 def _scrape_server_traffic(server, sid, my_conns):
     server_updates = []
@@ -5843,11 +5900,11 @@ async def api_my_connection_config(request: Request, connection_id: str):
         return JSONResponse({'error': str(e)}, status_code=500)
 
 
-@app.get('/settings', tags=["System Templates"])
+@app.get('/settings', response_class=HTMLResponse, tags=["System Templates"])
 async def settings_page(request: Request):
     user = _check_admin(request)
     if not user:
-        return RedirectResponse('/login')
+        return RedirectResponse('/login', status_code=302)
     data = load_data()
     from managers.xui_servers import list_xui_servers, public_server_view, ensure_xui_servers
     settings = data.setdefault('settings', {})
@@ -5951,7 +6008,7 @@ async def api_apply_update(request: Request, req: ApplyUpdateRequest):
         return JSONResponse({'error': result.get('message') or 'Update failed', **result}, status_code=status_code)
 
     if result.get('restart'):
-        UpdateManager.schedule_restart(1.5)
+        UpdateManager.schedule_restart(application_path, 1.5)
     return result
 
 
@@ -5989,7 +6046,7 @@ async def api_upgrade_panel(request: Request):
     if result.get('status') != 'success':
         return JSONResponse({'error': result.get('message') or 'Update failed', **result}, status_code=500)
     if result.get('restart'):
-        UpdateManager.schedule_restart(1.5)
+        UpdateManager.schedule_restart(application_path, 1.5)
     result['up_to_date'] = False
     result['previous_version'] = CURRENT_VERSION
     return result
@@ -6564,10 +6621,10 @@ if __name__ == '__main__':
     uvicorn_kwargs = {
         "app": app,
         "host": "0.0.0.0",
-        "port": env_port or ssl_conf.get('panel_port', 5000) or 5000,
+        "port": env_port or get_panel_listen_port(data),
     }
     
-    if ssl_conf.get('enabled') and cert_file and key_file:
+    if panel_ssl_active(data) and cert_file and key_file:
         if os.path.exists(cert_file) and os.path.exists(key_file):
             logger.info(f"Starting panel with HTTPS enabled on domain: {ssl_conf.get('domain')} at port {uvicorn_kwargs['port']}")
             uvicorn_kwargs["ssl_certfile"] = cert_file