test2/Amnezia-Web-Panel-main
Template
1
2
Fork 1
Code Issues Pull Requests Packages Projects Releases 18 Wiki Activity

Add Amnezia Web Panel source with PostgreSQL 17 storage.

Browse Source 
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
orohi
2026-07-26 00:02:18 +03:00
co-authored by Cursor
parent ead1c64dd1
commit 8b70d51c87
50 changed files with 21713 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+13
View File
@@ -0,0 +1,13 @@
# Panel
APP_PORT=5000
SECRET_KEY=change-me-to-a-long-random-string
# PostgreSQL 17
POSTGRES_USER=amnezia
POSTGRES_PASSWORD=amnezia
POSTGRES_DB=amnezia_panel
POSTGRES_PORT=5432
# Used by the panel process (local run or Docker)
# Docker Compose sets this automatically to point at the db service.
DATABASE_URL=postgresql://amnezia:amnezia@localhost:5432/amnezia_panel
.github/workflows/build.yml
+102
View File
@@ -0,0 +1,102 @@
name: Build Binaries
on:
push:
branches: [ "main" ]
tags:
- 'v*'
workflow_dispatch:
permissions:
contents: write
jobs:
build:
runs-on: ${{ matrix.os }}
strategy:
matrix:
os: [ubuntu-latest, windows-latest, macos-latest]
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install pyinstaller
pip install -r requirements.txt
- name: Build Linux
if: runner.os == 'Linux'
run: |
pyinstaller --name Amnezia-Web-Panel-Linux \
--add-data "static:static" \
--add-data "templates:templates" \
--add-data "translations:translations" \
--hidden-import uvicorn \
--hidden-import fastapi \
--clean \
-y \
-F app.py
- name: Build Windows
if: runner.os == 'Windows'
run: |
pyinstaller --name Amnezia-Web-Panel-Windows `
--add-data "static;static" `
--add-data "templates;templates" `
--add-data "translations;translations" `
--hidden-import uvicorn `
--hidden-import fastapi `
--clean `
-y `
-F app.py
- name: Build macOS
if: runner.os == 'macOS'
run: |
pyinstaller --name Amnezia-Web-Panel-macOS \
--add-data "static:static" \
--add-data "templates:templates" \
--add-data "translations:translations" \
--hidden-import uvicorn \
--hidden-import fastapi \
--clean \
-y \
-F app.py
- name: Upload artifacts
uses: actions/upload-artifact@v4
with:
name: binaries-${{ runner.os }}
path: dist/*
release:
needs: build
if: startsWith(github.ref, 'refs/tags/')
runs-on: ubuntu-latest
steps:
- name: Download artifacts
uses: actions/download-artifact@v4
with:
path: artifacts
- name: Display structure
run: ls -R artifacts
- name: Publish Release
uses: softprops/action-gh-release@v2
with:
generate_release_notes: true
files: |
artifacts/**/*
.gitignore
+40
View File
@@ -0,0 +1,40 @@
# Virtual Environment
venv/
env/
.venv/
# PyInstaller folders
build/
dist/
*.spec
# Python
__pycache__/
*.pyc
*.pyo
*.pyd
.Python
env/
pip-log.txt
pip-delete-this-directory.txt
.tox/
.coverage
.coverage.*
.cache
nosetests.xml
coverage.xml
*.cover
*.log
.pytest_cache/
.mypy_cache/
# User data
data.json
data.json.migrated.*.bak
tunnels_state.json
.env
.DS_Store
# IDEs
.vscode/
.idea/
Dockerfile
+16
View File
@@ -0,0 +1,16 @@
# syntax=docker/dockerfile:1
FROM python:3.14-slim
WORKDIR /app
# Копируем requirements.txt и устанавливаем зависимости
COPY requirements.txt requirements.txt
RUN pip3 install --no-cache-dir -r requirements.txt
# Копируем остальные файлы проекта
COPY . .
# Команда запуска приложения
CMD ["python3", "app.py"]
Dockerfile.warp
+38
View File
@@ -0,0 +1,38 @@
# syntax=docker/dockerfile:1
# Optional image variant with Cloudflare WARP installed inside the container.
# Use with:
# docker compose -f docker-compose.yml -f docker-compose.warp.yml up -d --build
FROM python:3.14-slim-bookworm
WORKDIR /app
ARG CLOUDFLARE_WARP_REPO_CODENAME=bookworm
RUN apt-get update \
&& apt-get install -y --no-install-recommends \
ca-certificates \
curl \
gnupg \
iproute2 \
iputils-ping \
procps \
&& mkdir -p /usr/share/keyrings \
&& curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg \
| gpg --dearmor -o /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg \
&& echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${CLOUDFLARE_WARP_REPO_CODENAME} main" \
> /etc/apt/sources.list.d/cloudflare-client.list \
&& apt-get update \
&& apt-get install -y --no-install-recommends cloudflare-warp \
&& rm -rf /var/lib/apt/lists/*
COPY requirements.txt requirements.txt
RUN pip3 install --no-cache-dir -r requirements.txt
COPY . .
COPY docker-entrypoint-warp.sh /usr/local/bin/docker-entrypoint-warp.sh
RUN chmod +x /usr/local/bin/docker-entrypoint-warp.sh
ENTRYPOINT ["docker-entrypoint-warp.sh"]
CMD ["python3", "app.py"]
LICENSE
+674
View File
@@ -0,0 +1,674 @@
GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The GNU General Public License is a free, copyleft license for
software and other kinds of works.
The licenses for most software and other practical works are designed
to take away your freedom to share and change the works. By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users. We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors. You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.
To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights. Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received. You must make sure that they, too, receive
or can get the source code. And you must show them these terms so they
know their rights.
Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.
For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software. For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.
Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so. This is fundamentally incompatible with the aim of
protecting users' freedom to change the software. The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable. Therefore, we
have designed this version of the GPL to prohibit the practice for those
products. If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.
Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary. To prevent this, the GPL assures that
patents cannot be used to render the program non-free.
The precise terms and conditions for copying, distribution and
modification follow.
TERMS AND CONDITIONS
0. Definitions.
"This License" refers to version 3 of the GNU General Public License.
"Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.
"The Program" refers to any copyrightable work licensed under this
License. Each licensee is addressed as "you". "Licensees" and
"recipients" may be individuals or organizations.
To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy. The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.
A "covered work" means either the unmodified Program or a work based
on the Program.
To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy. Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.
To "convey" a work means any kind of propagation that enables other
parties to make or receive copies. Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.
An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License. If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.
1. Source Code.
The "source code" for a work means the preferred form of the work
for making modifications to it. "Object code" means any non-source
form of a work.
A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.
The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form. A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.
The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities. However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work. For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.
The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.
The Corresponding Source for a work in source code form is that
same work.
2. Basic Permissions.
All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met. This License explicitly affirms your unlimited
permission to run the unmodified Program. The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work. This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.
You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force. You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright. Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.
Conveying under any other circumstances is permitted solely under
the conditions stated below. Sublicensing is not allowed; section 10
makes it unnecessary.
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.
When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified
it, and giving a relevant date.
b) The work must carry prominent notices stating that it is
released under this License and any conditions added under section
7. This requirement modifies the requirement in section 4 to
"keep intact all notices".
c) You must license the entire work, as a whole, under this
License to anyone who comes into possession of a copy. This
License will therefore apply, along with any applicable section 7
additional terms, to the whole of the work, and all its parts,
regardless of how they are packaged. This License gives no
permission to license the work in any other way, but it does not
invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display
Appropriate Legal Notices; however, if the Program has interactive
interfaces that do not display Appropriate Legal Notices, your
work need not make them do so.
A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit. Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.
6. Conveying Non-Source Forms.
You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:
a) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by the
Corresponding Source fixed on a durable physical medium
customarily used for software interchange.
b) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by a
written offer, valid for at least three years and valid for as
long as you offer spare parts or customer support for that product
model, to give anyone who possesses the object code either (1) a
copy of the Corresponding Source for all the software in the
product that is covered by this License, on a durable physical
medium customarily used for software interchange, for a price no
more than your reasonable cost of physically performing this
conveying of source, or (2) access to copy the
Corresponding Source from a network server at no charge.
c) Convey individual copies of the object code with a copy of the
written offer to provide the Corresponding Source. This
alternative is allowed only occasionally and noncommercially, and
only if you received the object code with such an offer, in accord
with subsection 6b.
d) Convey the object code by offering access from a designated
place (gratis or for a charge), and offer equivalent access to the
Corresponding Source in the same way through the same place at no
further charge. You need not require recipients to copy the
Corresponding Source along with the object code. If the place to
copy the object code is a network server, the Corresponding Source
may be on a different server (operated by you or a third party)
that supports equivalent copying facilities, provided you maintain
clear directions next to the object code saying where to find the
Corresponding Source. Regardless of what server hosts the
Corresponding Source, you remain obligated to ensure that it is
available for as long as needed to satisfy these requirements.
e) Convey the object code using peer-to-peer transmission, provided
you inform other peers where the object code and Corresponding
Source of the work are being offered to the general public at no
charge under subsection 6d.
A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.
A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling. In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage. For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product. A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.
"Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source. The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.
If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information. But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).
The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed. Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.
Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.
7. Additional Terms.
"Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law. If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.
When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it. (Additional permissions may be written to require their own
removal in certain cases when you modify the work.) You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.
Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the
terms of sections 15 and 16 of this License; or
b) Requiring preservation of specified reasonable legal notices or
author attributions in that material or in the Appropriate Legal
Notices displayed by works containing it; or
c) Prohibiting misrepresentation of the origin of that material, or
requiring that modified versions of such material be marked in
reasonable ways as different from the original version; or
d) Limiting the use for publicity purposes of names of licensors or
authors of the material; or
e) Declining to grant rights under trademark law for use of some
trade names, trademarks, or service marks; or
f) Requiring indemnification of licensors and authors of that
material by anyone who conveys the material (or modified versions of
it) with contractual assumptions of liability to the recipient, for
any liability that these contractual assumptions directly impose on
those licensors and authors.
All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10. If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term. If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.
If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.
Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.
8. Termination.
You may not propagate or modify a covered work except as expressly
provided under this License. Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).
However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.
Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License. If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.
9. Acceptance Not Required for Having Copies.
You are not required to accept this License in order to receive or
run a copy of the Program. Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance. However,
nothing other than this License grants you permission to propagate or
modify any covered work. These actions infringe copyright if you do
not accept this License. Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.
10. Automatic Licensing of Downstream Recipients.
Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License. You are not responsible
for enforcing compliance by third parties with this License.
An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations. If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.
You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License. For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based. The
work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version. For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.
In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement). To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.
If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients. "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.
If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.
A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License. You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.
Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.
12. No Surrender of Others' Freedom.
If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all. For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.
13. Use with the GNU Affero General Public License.
Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work. The terms of this
License will continue to apply to the part which is the covered work,
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.
14. Revised Versions of this License.
The Free Software Foundation may publish revised and/or new versions of
the GNU General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation. If the Program does not specify a version number of the
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.
If the Program specifies that a proxy can decide which future
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.
Later license versions may give you additional or different
permissions. However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.
15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.
17. Interpretation of Sections 15 and 16.
If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
state the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
Also add information on how to contact you by electronic and paper mail.
If the program does terminal interaction, make it output a short
notice like this when it starts in an interactive mode:
<program> Copyright (C) <year> <name of author>
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, your program's commands
might be different; for a GUI interface, you would use an "about box".
You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU GPL, see
<https://www.gnu.org/licenses/>.
The GNU General Public License does not permit incorporating your program
into proprietary programs. If your program is a subroutine library, you
may consider it more useful to permit linking proprietary applications with
the library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License. But first, please read
<https://www.gnu.org/licenses/why-not-lgpl.html>.
app.py
+3968
View File
File diff suppressed because it is too large Load Diff
db/__init__.py
+29
View File
@@ -0,0 +1,29 @@
"""Database package for Amnezia Web Panel (PostgreSQL 17)."""
from .connection import close_pool, get_database_url, init_schema
from .store import (
clear_tunnel_state,
ensure_db_ready,
export_data_dict,
import_from_json_file,
load_data,
load_tunnel_state,
save_data,
save_tunnel_state,
update_tunnel_state,
)
__all__ = [
'clear_tunnel_state',
'close_pool',
'ensure_db_ready',
'export_data_dict',
'get_database_url',
'import_from_json_file',
'init_schema',
'load_data',
'load_tunnel_state',
'save_data',
'save_tunnel_state',
'update_tunnel_state',
]
db/connection.py
+82
View File
@@ -0,0 +1,82 @@
"""PostgreSQL connection pool for Amnezia Web Panel."""
from __future__ import annotations
import logging
import os
import threading
from pathlib import Path
from dotenv import load_dotenv
load_dotenv()
logger = logging.getLogger(__name__)
DEFAULT_DATABASE_URL = 'postgresql://amnezia:amnezia@localhost:5432/amnezia_panel'
_pool = None
_pool_lock = threading.Lock()
_schema_ready = False
def get_database_url() -> str:
return os.environ.get('DATABASE_URL', DEFAULT_DATABASE_URL).strip()
def get_pool():
global _pool
if _pool is not None:
return _pool
with _pool_lock:
if _pool is not None:
return _pool
from psycopg.rows import dict_row
from psycopg_pool import ConnectionPool
url = get_database_url()
logger.info('Connecting to PostgreSQL…')
_pool = ConnectionPool(
conninfo=url,
min_size=1,
max_size=10,
kwargs={
'autocommit': False,
'row_factory': dict_row,
},
open=True,
)
return _pool
def close_pool():
global _pool, _schema_ready
with _pool_lock:
if _pool is not None:
_pool.close()
_pool = None
_schema_ready = False
def init_schema():
"""Create tables if they do not exist."""
global _schema_ready
if _schema_ready:
return
schema_path = Path(__file__).with_name('schema.sql')
sql = schema_path.read_text(encoding='utf-8')
pool = get_pool()
with pool.connection() as conn:
with conn.cursor() as cur:
# psycopg3 executes one statement per execute()
for raw in sql.split(';'):
lines = [
ln for ln in raw.splitlines()
if ln.strip() and not ln.strip().startswith('--')
]
stmt = '\n'.join(lines).strip()
if stmt:
cur.execute(stmt)
conn.commit()
_schema_ready = True
logger.info('PostgreSQL schema ready')
db/migrate_json.py
+58
View File
@@ -0,0 +1,58 @@
"""One-shot CLI: import legacy data.json into PostgreSQL.
Usage:
python -m db.migrate_json [path/to/data.json]
"""
from __future__ import annotations
import logging
import os
import sys
from dotenv import load_dotenv
load_dotenv()
logging.basicConfig(level=logging.INFO, format='%(levelname)s: %(message)s')
logger = logging.getLogger('migrate_json')
def main(argv: list[str] | None = None) -> int:
argv = list(argv if argv is not None else sys.argv[1:])
force = '--force' in argv
paths = [a for a in argv if not a.startswith('-')]
if getattr(sys, 'frozen', False):
app_path = os.path.dirname(sys.executable)
else:
app_path = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
data_file = paths[0] if paths else os.path.join(app_path, 'data.json')
from db.store import import_from_json_file, is_database_empty, load_data
if not os.path.exists(data_file):
logger.error('File not found: %s', data_file)
return 1
if not is_database_empty():
logger.warning('Database is not empty — import will overwrite panel tables.')
if not force:
logger.error('Re-run with --force to overwrite existing data.')
return 2
import_from_json_file(data_file, backup=True)
data = load_data()
logger.info(
'Done. servers=%s users=%s connections=%s tokens=%s',
len(data['servers']),
len(data['users']),
len(data['user_connections']),
len(data['api_tokens']),
)
return 0
if __name__ == '__main__':
raise SystemExit(main())
db/schema.sql
+75
View File
@@ -0,0 +1,75 @@
-- Amnezia Web Panel — PostgreSQL 17 schema
CREATE TABLE IF NOT EXISTS servers (
position INTEGER PRIMARY KEY,
name TEXT NOT NULL DEFAULT '',
host TEXT NOT NULL DEFAULT '',
ssh_port INTEGER NOT NULL DEFAULT 22,
username TEXT NOT NULL DEFAULT '',
password TEXT,
private_key TEXT,
server_info JSONB NOT NULL DEFAULT '{}'::jsonb,
protocols JSONB NOT NULL DEFAULT '{}'::jsonb
);
CREATE TABLE IF NOT EXISTS users (
id UUID PRIMARY KEY,
username TEXT NOT NULL UNIQUE,
password_hash TEXT NOT NULL DEFAULT '',
role TEXT NOT NULL DEFAULT 'user',
enabled BOOLEAN NOT NULL DEFAULT TRUE,
created_at TIMESTAMPTZ,
telegram_id TEXT,
email TEXT,
description TEXT,
traffic_limit BIGINT NOT NULL DEFAULT 0,
traffic_used BIGINT NOT NULL DEFAULT 0,
traffic_total BIGINT NOT NULL DEFAULT 0,
traffic_reset_strategy TEXT NOT NULL DEFAULT 'never',
last_reset_at TIMESTAMPTZ,
expiration_date TIMESTAMPTZ,
remnawave_uuid TEXT,
share_enabled BOOLEAN NOT NULL DEFAULT FALSE,
share_token TEXT,
share_password_hash TEXT
);
CREATE TABLE IF NOT EXISTS user_connections (
id UUID PRIMARY KEY,
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
server_id INTEGER NOT NULL DEFAULT 0,
protocol TEXT NOT NULL DEFAULT '',
client_id TEXT NOT NULL DEFAULT '',
name TEXT NOT NULL DEFAULT '',
created_at TIMESTAMPTZ,
last_bytes BIGINT NOT NULL DEFAULT 0
);
CREATE INDEX IF NOT EXISTS idx_user_connections_user_id ON user_connections(user_id);
CREATE INDEX IF NOT EXISTS idx_user_connections_server_id ON user_connections(server_id);
CREATE TABLE IF NOT EXISTS api_tokens (
id UUID PRIMARY KEY,
name TEXT NOT NULL DEFAULT '',
token_hash TEXT NOT NULL UNIQUE,
token_prefix TEXT NOT NULL DEFAULT '',
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
created_at TIMESTAMPTZ,
last_used_at TIMESTAMPTZ
);
CREATE INDEX IF NOT EXISTS idx_api_tokens_user_id ON api_tokens(user_id);
CREATE INDEX IF NOT EXISTS idx_api_tokens_hash ON api_tokens(token_hash);
CREATE TABLE IF NOT EXISTS settings (
id SMALLINT PRIMARY KEY DEFAULT 1 CHECK (id = 1),
data JSONB NOT NULL DEFAULT '{}'::jsonb
);
CREATE TABLE IF NOT EXISTS tunnel_state (
provider TEXT PRIMARY KEY,
data JSONB NOT NULL DEFAULT '{}'::jsonb
);
INSERT INTO settings (id, data) VALUES (1, '{}'::jsonb)
ON CONFLICT (id) DO NOTHING;
db/store.py
+413
View File
@@ -0,0 +1,413 @@
"""Panel data store backed by PostgreSQL 17.
Preserves the same dict shape that used to live in data.json so existing
FastAPI handlers keep working without a full rewrite.
"""
from __future__ import annotations
import json
import logging
import os
import shutil
from datetime import datetime, timezone
from pathlib import Path
from typing import Any, Optional
from uuid import UUID
from psycopg.types.json import Jsonb
from .connection import get_pool, init_schema
logger = logging.getLogger(__name__)
DEFAULT_SETTINGS = {
'appearance': {
'title': 'Amnezia',
'logo': '❤️',
'subtitle': 'Web Panel',
},
'sync': {
'remnawave_url': '',
'remnawave_api_key': '',
'remnawave_sync': False,
'remnawave_sync_users': False,
'remnawave_create_conns': False,
'remnawave_server_id': 0,
'remnawave_protocol': 'awg',
},
}
def _parse_ts(value: Any) -> Optional[datetime]:
if value is None or value == '':
return None
if isinstance(value, datetime):
return value
text = str(value).strip()
if not text:
return None
if text.endswith('Z'):
text = text[:-1] + '+00:00'
try:
return datetime.fromisoformat(text)
except ValueError:
return None
def _ts_iso(value: Any) -> Optional[str]:
if value is None:
return None
if isinstance(value, datetime):
return value.isoformat()
return str(value)
def _as_uuid(value: Any) -> UUID:
return UUID(str(value))
def _merge_settings(raw: Optional[dict]) -> dict:
settings = json.loads(json.dumps(DEFAULT_SETTINGS))
if not isinstance(raw, dict):
return settings
for section, defaults in DEFAULT_SETTINGS.items():
incoming = raw.get(section)
if isinstance(incoming, dict) and isinstance(defaults, dict):
merged = dict(defaults)
merged.update(incoming)
settings[section] = merged
elif section in raw:
settings[section] = raw[section]
for key, value in raw.items():
if key not in settings:
settings[key] = value
return settings
def _row_to_server(row) -> dict:
return {
'name': row['name'] or '',
'host': row['host'] or '',
'ssh_port': int(row['ssh_port'] or 22),
'username': row['username'] or '',
'password': row['password'],
'private_key': row['private_key'],
'server_info': dict(row['server_info'] or {}),
'protocols': dict(row['protocols'] or {}),
}
def _row_to_user(row) -> dict:
return {
'id': str(row['id']),
'username': row['username'],
'password_hash': row['password_hash'] or '',
'role': row['role'] or 'user',
'enabled': bool(row['enabled']),
'created_at': _ts_iso(row['created_at']),
'telegramId': row['telegram_id'],
'email': row['email'],
'description': row['description'],
'traffic_limit': int(row['traffic_limit'] or 0),
'traffic_used': int(row['traffic_used'] or 0),
'traffic_total': int(row['traffic_total'] or 0),
'traffic_reset_strategy': row['traffic_reset_strategy'] or 'never',
'last_reset_at': _ts_iso(row['last_reset_at']),
'expiration_date': _ts_iso(row['expiration_date']),
'remnawave_uuid': row['remnawave_uuid'],
'share_enabled': bool(row['share_enabled']),
'share_token': row['share_token'],
'share_password_hash': row['share_password_hash'],
}
def _row_to_connection(row) -> dict:
return {
'id': str(row['id']),
'user_id': str(row['user_id']),
'server_id': int(row['server_id'] or 0),
'protocol': row['protocol'] or '',
'client_id': row['client_id'] or '',
'name': row['name'] or '',
'created_at': _ts_iso(row['created_at']),
'last_bytes': int(row['last_bytes'] or 0),
}
def _row_to_token(row) -> dict:
return {
'id': str(row['id']),
'name': row['name'] or '',
'token_hash': row['token_hash'] or '',
'token_prefix': row['token_prefix'] or '',
'user_id': str(row['user_id']),
'created_at': _ts_iso(row['created_at']),
'last_used_at': _ts_iso(row['last_used_at']),
}
def load_data() -> dict:
init_schema()
pool = get_pool()
with pool.connection() as conn:
with conn.cursor() as cur:
cur.execute(
'SELECT position, name, host, ssh_port, username, password, '
'private_key, server_info, protocols '
'FROM servers ORDER BY position ASC'
)
servers = [_row_to_server(r) for r in cur.fetchall()]
cur.execute(
'SELECT id, username, password_hash, role, enabled, created_at, '
'telegram_id, email, description, traffic_limit, traffic_used, '
'traffic_total, traffic_reset_strategy, last_reset_at, '
'expiration_date, remnawave_uuid, share_enabled, share_token, '
'share_password_hash FROM users ORDER BY created_at NULLS LAST, username'
)
users = [_row_to_user(r) for r in cur.fetchall()]
cur.execute(
'SELECT id, user_id, server_id, protocol, client_id, name, '
'created_at, last_bytes FROM user_connections '
'ORDER BY created_at NULLS LAST, id'
)
user_connections = [_row_to_connection(r) for r in cur.fetchall()]
cur.execute(
'SELECT id, name, token_hash, token_prefix, user_id, '
'created_at, last_used_at FROM api_tokens '
'ORDER BY created_at NULLS LAST, id'
)
api_tokens = [_row_to_token(r) for r in cur.fetchall()]
cur.execute('SELECT data FROM settings WHERE id = 1')
settings_row = cur.fetchone()
settings = _merge_settings(settings_row['data'] if settings_row else None)
return {
'servers': servers,
'users': users,
'user_connections': user_connections,
'api_tokens': api_tokens,
'settings': settings,
}
def save_data(data: dict) -> None:
"""Replace panel state in a single transaction (same semantics as rewriting data.json)."""
init_schema()
servers = data.get('servers') or []
users = data.get('users') or []
connections = data.get('user_connections') or []
tokens = data.get('api_tokens') or []
settings = _merge_settings(data.get('settings'))
# Keep only connections whose user still exists
user_ids = {str(u.get('id')) for u in users if u.get('id')}
connections = [c for c in connections if str(c.get('user_id')) in user_ids]
tokens = [t for t in tokens if str(t.get('user_id')) in user_ids]
pool = get_pool()
with pool.connection() as conn:
with conn.cursor() as cur:
# Order matters for FKs: children first on delete, parents first on insert
cur.execute('DELETE FROM api_tokens')
cur.execute('DELETE FROM user_connections')
cur.execute('DELETE FROM users')
cur.execute('DELETE FROM servers')
for pos, server in enumerate(servers):
cur.execute(
'INSERT INTO servers (position, name, host, ssh_port, username, '
'password, private_key, server_info, protocols) '
'VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s)',
(
pos,
server.get('name') or '',
server.get('host') or '',
int(server.get('ssh_port') or 22),
server.get('username') or '',
server.get('password'),
server.get('private_key'),
Jsonb(server.get('server_info') or {}),
Jsonb(server.get('protocols') or {}),
),
)
for user in users:
cur.execute(
'INSERT INTO users ('
'id, username, password_hash, role, enabled, created_at, '
'telegram_id, email, description, traffic_limit, traffic_used, '
'traffic_total, traffic_reset_strategy, last_reset_at, '
'expiration_date, remnawave_uuid, share_enabled, share_token, '
'share_password_hash'
') VALUES ('
'%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s'
')',
(
_as_uuid(user['id']),
user.get('username') or '',
user.get('password_hash') or '',
user.get('role') or 'user',
bool(user.get('enabled', True)),
_parse_ts(user.get('created_at')),
str(user['telegramId']) if user.get('telegramId') is not None else None,
user.get('email'),
user.get('description'),
int(user.get('traffic_limit') or 0),
int(user.get('traffic_used') or 0),
int(user.get('traffic_total') or 0),
user.get('traffic_reset_strategy') or 'never',
_parse_ts(user.get('last_reset_at')),
_parse_ts(user.get('expiration_date')),
user.get('remnawave_uuid'),
bool(user.get('share_enabled', False)),
user.get('share_token'),
user.get('share_password_hash'),
),
)
for conn_row in connections:
cur.execute(
'INSERT INTO user_connections ('
'id, user_id, server_id, protocol, client_id, name, created_at, last_bytes'
') VALUES (%s, %s, %s, %s, %s, %s, %s, %s)',
(
_as_uuid(conn_row['id']),
_as_uuid(conn_row['user_id']),
int(conn_row.get('server_id') or 0),
conn_row.get('protocol') or '',
conn_row.get('client_id') or '',
conn_row.get('name') or '',
_parse_ts(conn_row.get('created_at')),
int(conn_row.get('last_bytes') or 0),
),
)
for token in tokens:
cur.execute(
'INSERT INTO api_tokens ('
'id, name, token_hash, token_prefix, user_id, created_at, last_used_at'
') VALUES (%s, %s, %s, %s, %s, %s, %s)',
(
_as_uuid(token['id']),
token.get('name') or '',
token.get('token_hash') or '',
token.get('token_prefix') or '',
_as_uuid(token['user_id']),
_parse_ts(token.get('created_at')),
_parse_ts(token.get('last_used_at')),
),
)
cur.execute(
'INSERT INTO settings (id, data) VALUES (1, %s) '
'ON CONFLICT (id) DO UPDATE SET data = EXCLUDED.data',
(Jsonb(settings),),
)
conn.commit()
def export_data_dict() -> dict:
"""Export current DB state as the legacy data.json document."""
return load_data()
def is_database_empty() -> bool:
init_schema()
pool = get_pool()
with pool.connection() as conn:
with conn.cursor() as cur:
cur.execute('SELECT COUNT(*) AS n FROM users')
users = cur.fetchone()['n']
cur.execute('SELECT COUNT(*) AS n FROM servers')
servers = cur.fetchone()['n']
return users == 0 and servers == 0
def import_from_json_file(path: str | os.PathLike, *, backup: bool = True) -> bool:
"""Import legacy data.json into Postgres. Returns True if import ran."""
path = Path(path)
if not path.exists():
return False
with path.open('r', encoding='utf-8') as f:
data = json.load(f)
if not isinstance(data, dict):
raise ValueError(f'Invalid data.json: expected object, got {type(data).__name__}')
data.setdefault('servers', [])
data.setdefault('users', [])
data.setdefault('user_connections', [])
data.setdefault('api_tokens', [])
data.setdefault('settings', {})
save_data(data)
if backup:
stamp = datetime.now(timezone.utc).strftime('%Y%m%dT%H%M%SZ')
backup_path = path.with_name(f'data.json.migrated.{stamp}.bak')
try:
shutil.copy2(path, backup_path)
logger.info('Backed up legacy data.json to %s', backup_path)
except OSError as e:
logger.warning('Could not backup data.json: %s', e)
logger.info(
'Imported data.json → PostgreSQL (%s servers, %s users, %s connections)',
len(data.get('servers', [])),
len(data.get('users', [])),
len(data.get('user_connections', [])),
)
return True
def load_tunnel_state() -> dict:
init_schema()
pool = get_pool()
with pool.connection() as conn:
with conn.cursor() as cur:
cur.execute('SELECT provider, data FROM tunnel_state')
rows = cur.fetchall()
return {row['provider']: dict(row['data'] or {}) for row in rows}
def save_tunnel_state(state: dict) -> None:
init_schema()
pool = get_pool()
with pool.connection() as conn:
with conn.cursor() as cur:
cur.execute('DELETE FROM tunnel_state')
for provider, payload in (state or {}).items():
cur.execute(
'INSERT INTO tunnel_state (provider, data) VALUES (%s, %s)',
(str(provider), Jsonb(payload or {})),
)
conn.commit()
def update_tunnel_state(provider: str, **updates) -> None:
state = load_tunnel_state()
provider_state = state.get(provider, {})
provider_state.update(updates)
state[provider] = provider_state
save_tunnel_state(state)
def clear_tunnel_state(provider: str) -> None:
state = load_tunnel_state()
if provider in state:
state.pop(provider)
save_tunnel_state(state)
def ensure_db_ready(legacy_data_file: Optional[str] = None) -> None:
"""Init schema and one-shot import from data.json when DB is empty."""
init_schema()
if legacy_data_file and is_database_empty() and os.path.exists(legacy_data_file):
logger.info('Empty database — importing legacy %s', legacy_data_file)
import_from_json_file(legacy_data_file)
docker-compose.warp.yml
+28
View File
@@ -0,0 +1,28 @@
# Optional Docker Compose override for running Cloudflare WARP inside the panel container.
# Usage:
# docker compose -f docker-compose.yml -f docker-compose.warp.yml up -d --build
#
# Why the extra privileges:
# WARP needs a TUN device and NET_ADMIN to create/manage its tunnel interface.
services:
amnezia_panel:
build:
context: .
dockerfile: Dockerfile.warp
image: amnezia-panel:warp-local
cap_add:
- NET_ADMIN
- SYS_MODULE
devices:
- /dev/net/tun:/dev/net/tun
sysctls:
net.ipv4.conf.all.src_valid_mark: "1"
volumes:
- amnezia_data:/app/data
- cloudflare_warp:/var/lib/cloudflare-warp
volumes:
cloudflare_warp:
docker-compose.yml
+50
View File
@@ -0,0 +1,50 @@
version: '3.8'
services:
db:
image: postgres:17
container_name: amnezia_panel_db
environment:
POSTGRES_USER: ${POSTGRES_USER:-amnezia}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-amnezia}
POSTGRES_DB: ${POSTGRES_DB:-amnezia_panel}
volumes:
- amnezia_pgdata:/var/lib/postgresql/data
ports:
- "${POSTGRES_PORT:-5432}:5432"
restart: unless-stopped
healthcheck:
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-amnezia} -d ${POSTGRES_DB:-amnezia_panel}"]
interval: 10s
timeout: 5s
retries: 10
start_period: 20s
amnezia_panel:
build:
context: .
dockerfile: Dockerfile
image: amnezia-panel:local
container_name: amnezia_panel
depends_on:
db:
condition: service_healthy
ports:
- "${APP_PORT:-5000}:5000"
environment:
DATABASE_URL: postgresql://${POSTGRES_USER:-amnezia}:${POSTGRES_PASSWORD:-amnezia}@db:5432/${POSTGRES_DB:-amnezia_panel}
SECRET_KEY: ${SECRET_KEY:-}
APP_PORT: ${APP_PORT:-5000}
volumes:
- amnezia_data:/app/data
restart: unless-stopped
healthcheck:
test: ["CMD-SHELL", "python3 -c \"import socket; s=socket.socket(); s.connect(('localhost', 5000)); s.close()\""]
interval: 30s
timeout: 10s
retries: 3
start_period: 40s
volumes:
amnezia_data:
amnezia_pgdata:
docker-entrypoint-warp.sh
+22
View File
@@ -0,0 +1,22 @@
#!/bin/sh
set -eu
# Start Cloudflare WARP daemon inside the container when present.
# The panel controls it through warp-cli from the Settings page.
if command -v warp-svc >/dev/null 2>&1; then
mkdir -p /var/lib/cloudflare-warp
warp-svc >/tmp/warp-svc.log 2>&1 &
echo "$!" >/tmp/warp-svc.pid
# Best-effort short wait: app can still start even if WARP service needs more time.
i=0
while [ "$i" -lt 10 ]; do
if warp-cli --accept-tos status >/tmp/warp-cli-status.log 2>&1; then
break
fi
i=$((i + 1))
sleep 1
done
fi
exec "$@"
managers/__init__.py
+7
View File
@@ -0,0 +1,7 @@
"""Protocol/service/SSH managers used by the web panel.
Modules in this package are imported either directly (`from managers.ssh_manager import SSHManager`)
or lazily by name through `app.get_protocol_manager`. Keeping them in a dedicated package
makes the project root easier to scan and prevents accidental name collisions with the
generic stdlib (e.g. `socks5_manager`, `dns_manager`).
"""
managers/adguard_manager.py
+264
View File
@@ -0,0 +1,264 @@
"""
AdGuard Home Manager — runs adguard/adguardhome in a Docker container,
joined to the same internal `amnezia-dns-net` network the rest of the panel
uses. Two install modes:
* 'replace' — removes the AmneziaDNS container (if present) and takes
its static IP (172.29.172.254) so VPN clients keep using
the same upstream.
* 'sidebyside' — runs alongside AmneziaDNS on a different static IP
(172.29.172.253). VPN users can hit it on demand
(e.g. via the web admin UI from inside the tunnel).
Initial setup of AdGuard itself runs through its built-in wizard on the web
UI port — we do not try to script it (the JSON setup API is unstable across
versions and trying to drive it programmatically tends to break on upgrade).
"""
import logging
logger = logging.getLogger(__name__)
class AdguardManager:
PROTOCOL = 'adguard'
CONTAINER_NAME = 'amnezia-adguard'
IMAGE_NAME = 'adguard/adguardhome:latest'
NETWORK_NAME = 'amnezia-dns-net'
NETWORK_SUBNET = '172.29.172.0/24'
REPLACE_IP = '172.29.172.254' # AmneziaDNS's slot
SIDEBYSIDE_IP = '172.29.172.253' # parallel to AmneziaDNS
HOST_DIR = '/opt/amnezia/adguard'
DEFAULT_DNS_PORT = 53
DEFAULT_WEB_PORT = 3000
DEFAULT_DOT_PORT = 853
DEFAULT_DOH_PORT = 443
def __init__(self, ssh):
self.ssh = ssh
# ===================== STATUS =====================
def check_docker_installed(self):
out, _, code = self.ssh.run_command("docker --version 2>/dev/null")
if code != 0:
return False
out2, _, _ = self.ssh.run_command(
"systemctl is-active docker 2>/dev/null || service docker status 2>/dev/null"
)
return 'active' in out2 or 'running' in out2.lower()
def check_protocol_installed(self, protocol_type='adguard'):
out, _, _ = self.ssh.run_sudo_command(
f"docker ps -a --filter name=^{self.CONTAINER_NAME}$ --format '{{{{.Names}}}}'"
)
return self.CONTAINER_NAME in out.strip().split('\n')
def check_container_running(self):
out, _, _ = self.ssh.run_sudo_command(
f"docker ps --filter name=^{self.CONTAINER_NAME}$ --format '{{{{.Status}}}}'"
)
return 'Up' in out
def _container_ip(self):
out, _, _ = self.ssh.run_sudo_command(
f"docker inspect -f '{{{{range .NetworkSettings.Networks}}}}{{{{.IPAddress}}}} {{{{end}}}}' {self.CONTAINER_NAME} 2>/dev/null"
)
ip = out.strip().split()[0] if out.strip() else ''
return ip
def _detect_mode(self):
"""Return 'replace' or 'sidebyside' based on the running container's IP.
Returns None if not detectable (container not running)."""
ip = self._container_ip()
if ip == self.REPLACE_IP:
return 'replace'
if ip == self.SIDEBYSIDE_IP:
return 'sidebyside'
return None
def _container_web_port(self):
"""Read the AdGuard HTTP address configured inside the container.
During the first-run wizard AdGuard writes web.listen_addresses to
AdGuardHome.yaml. If the wizard has not been completed yet, the
container is started with --web-addr 0.0.0.0:<port> and this method can
read that port from docker inspect."""
grep_cmd = "grep -E '^[[:space:]]*-?[[:space:]]*[0-9.]+:[0-9]+$' /opt/adguardhome/conf/AdGuardHome.yaml 2>/dev/null | head -n1"
out, _, _ = self.ssh.run_sudo_command(
f'docker exec {self.CONTAINER_NAME} sh -c "{grep_cmd}"'
)
line = out.strip().split('\n')[0].strip().lstrip('-').strip() if out.strip() else ''
if ':' in line:
try:
return int(line.rsplit(':', 1)[1])
except ValueError:
pass
out, _, _ = self.ssh.run_sudo_command(
f"docker inspect -f '{{{{json .Config.Cmd}}}}' {self.CONTAINER_NAME} 2>/dev/null"
)
marker = '--web-addr'
if marker in out:
parts = out.replace('[', ' ').replace(']', ' ').replace(',', ' ').replace('\"', ' ').split()
for i, part in enumerate(parts):
if part == marker and i + 1 < len(parts) and ':' in parts[i + 1]:
try:
return int(parts[i + 1].rsplit(':', 1)[1])
except ValueError:
pass
return None
def _exposed_web_port(self, container_port=None):
"""Reads back the host->container port mapping for the web UI port,
so the panel can show the correct admin URL after install."""
container_port = int(container_port or self.DEFAULT_WEB_PORT)
for port in (container_port, self.DEFAULT_WEB_PORT):
out, _, _ = self.ssh.run_sudo_command(
f"docker port {self.CONTAINER_NAME} {port}/tcp 2>/dev/null"
)
if not out.strip():
continue
# output like "0.0.0.0:3000" — take the last colon-separated chunk
last = out.strip().split('\n')[0].split(':')[-1].strip()
try:
return int(last)
except ValueError:
continue
return None
def get_server_status(self, protocol_type='adguard'):
exists = self.check_protocol_installed()
running = self.check_container_running()
mode = self._detect_mode() if running else None
ip = self._container_ip() if running else ''
container_web_port = self._container_web_port() if running else None
exposed_port = self._exposed_web_port(container_web_port) if running else None
# When the web UI is not bound to the host the user still needs an
# admin URL (reachable via VPN) — use the actual container web port
# when known, otherwise fall back to AdGuard's default :3000.
return {
'container_exists': exists,
'container_running': running,
'mode': mode,
'internal_ip': ip,
'web_port': exposed_port or container_web_port or self.DEFAULT_WEB_PORT,
'web_exposed': exposed_port is not None,
'port': self.DEFAULT_DNS_PORT,
'protocol': protocol_type,
}
# ===================== INSTALL / REMOVE =====================
def _ensure_network(self):
self.ssh.run_sudo_command(
f"docker network ls | grep -q {self.NETWORK_NAME} || "
f"docker network create --subnet {self.NETWORK_SUBNET} {self.NETWORK_NAME}"
)
def install_protocol(
self,
protocol_type='adguard',
mode='sidebyside',
web_port=None,
expose_web=False,
dns_port=None,
dot_port=None,
doh_port=None,
expose_dns=False,
expose_dot=False,
expose_doh=False,
):
if not self.check_docker_installed():
return {'status': 'error', 'message': 'Docker not installed'}
if mode not in ('replace', 'sidebyside'):
return {'status': 'error', 'message': f"Invalid mode '{mode}'"}
web_port = int(web_port or self.DEFAULT_WEB_PORT)
dns_port = int(dns_port or self.DEFAULT_DNS_PORT)
dot_port = int(dot_port or self.DEFAULT_DOT_PORT)
doh_port = int(doh_port or self.DEFAULT_DOH_PORT)
# Persistent volumes — without these the AdGuard setup wizard would have
# to re-run on every container recreate.
self.ssh.run_sudo_command(f"mkdir -p {self.HOST_DIR}/work {self.HOST_DIR}/conf")
self._ensure_network()
# Replace mode: detach + remove AmneziaDNS so we can claim its IP.
if mode == 'replace':
self.ssh.run_sudo_command(
f"docker network disconnect {self.NETWORK_NAME} amnezia-dns 2>/dev/null || true"
)
self.ssh.run_sudo_command("docker stop amnezia-dns 2>/dev/null || true")
self.ssh.run_sudo_command("docker rm -fv amnezia-dns 2>/dev/null || true")
target_ip = self.REPLACE_IP
else:
target_ip = self.SIDEBYSIDE_IP
if self.check_protocol_installed():
self.ssh.run_sudo_command(f"docker stop {self.CONTAINER_NAME} 2>/dev/null || true")
self.ssh.run_sudo_command(f"docker rm -fv {self.CONTAINER_NAME} 2>/dev/null || true")
self.ssh.run_sudo_command(f"docker pull {self.IMAGE_NAME}")
# Build port mapping. By default ports are reachable only inside
# `amnezia-dns-net` (so VPN clients hit them via the static IP).
# Optional `expose_*` flags add host port mappings for direct access.
ports = []
if expose_web:
ports.append(f"-p {web_port}:{web_port}/tcp")
if expose_dns:
ports.append(f"-p {dns_port}:53/tcp")
ports.append(f"-p {dns_port}:53/udp")
if expose_dot:
ports.append(f"-p {dot_port}:853/tcp")
if expose_doh:
ports.append(f"-p {doh_port}:443/tcp")
ports_str = ' '.join(ports)
run_cmd = (
f"docker run -d --name {self.CONTAINER_NAME} --restart always "
f"--network {self.NETWORK_NAME} --ip {target_ip} "
f"-v {self.HOST_DIR}/work:/opt/adguardhome/work "
f"-v {self.HOST_DIR}/conf:/opt/adguardhome/conf "
f"{ports_str} "
f"{self.IMAGE_NAME} --web-addr 0.0.0.0:{web_port}"
)
_, err, code = self.ssh.run_sudo_command(run_cmd)
if code != 0:
return {'status': 'error', 'message': f'Failed to start container: {err}'}
# Re-attach known VPN containers to the DNS network so they can reach
# AdGuard at target_ip (mirrors what dns_manager.py does on install).
for c in ('amnezia-awg', 'amnezia-awg2', 'amnezia-awg-legacy', 'amnezia-xray', 'amnezia-wireguard', 'telemt'):
self.ssh.run_sudo_command(
f"docker ps --format '{{{{.Names}}}}' | grep -q '^{c}$' && "
f"docker network connect {self.NETWORK_NAME} {c} 2>/dev/null || true"
)
url_host = self.ssh.host if expose_web else target_ip
admin_url = f"http://{url_host}:{web_port}"
return {
'status': 'success',
'protocol': 'adguard',
'mode': mode,
'internal_ip': target_ip,
'web_port': web_port,
'expose_web': bool(expose_web),
'admin_url': admin_url,
'message': 'AdGuard Home installed. Complete the setup wizard via the web UI.',
'log': [
f"AdGuard Home installed in '{mode}' mode",
f"Internal IP: {target_ip}",
f"Admin UI: {admin_url}" + ("" if expose_web else " (VPN-only — connect via VPN to reach it)"),
'Open the URL above to run the AdGuard setup wizard.',
],
}
def remove_container(self, protocol_type='adguard'):
self.ssh.run_sudo_command(f"docker stop {self.CONTAINER_NAME} || true")
self.ssh.run_sudo_command(f"docker rm -fv {self.CONTAINER_NAME} || true")
self.ssh.run_sudo_command(f"rm -rf {self.HOST_DIR}")
return True
managers/awg_manager.py
+1378
View File
File diff suppressed because it is too large Load Diff
managers/backup_manager.py
+170
View File
@@ -0,0 +1,170 @@
import json
import re
import shlex
class BackupManager:
"""Create/list downloadable protocol backups on the remote server.
Backups are intentionally allowlisted per protocol and include only files
needed to recreate protocol state: host config directories, matching
container config directories when present, and docker inspect metadata.
"""
BACKUP_ROOT = '/opt/amnezia/backups'
def __init__(self, ssh_manager):
self.ssh = ssh_manager
@staticmethod
def proto_base(protocol):
return str(protocol or '').split('__', 1)[0]
@staticmethod
def proto_instance(protocol):
match = re.search(r'__(\d+)$', str(protocol or ''))
return int(match.group(1)) if match else 1
@staticmethod
def safe_protocol(protocol):
safe = re.sub(r'[^a-zA-Z0-9_.-]+', '_', str(protocol or '').replace('__', '-'))
return safe.strip('._-') or 'protocol'
@staticmethod
def safe_filename(filename):
name = str(filename or '')
if not re.fullmatch(r'[A-Za-z0-9_.-]+\.tar\.gz', name):
return None
return name
def _paths_for(self, protocol, container_name):
base = self.proto_base(protocol)
idx = self.proto_instance(protocol)
paths = {
'host': [],
'container': [],
}
def inst_path(path, suffix_fmt='-{idx}'):
return path if idx <= 1 else f"{path}{suffix_fmt.format(idx=idx)}"
if base in ('awg', 'awg2', 'awg_legacy'):
paths['host'] = ['/opt/amnezia/awg', f'/opt/amnezia/{container_name}']
paths['container'] = ['/opt/amnezia/awg', '/opt/amnezia/start.sh']
elif base == 'wireguard':
paths['host'] = ['/opt/amnezia/wireguard', f'/opt/amnezia/{container_name}']
paths['container'] = ['/opt/amnezia/wireguard', '/opt/amnezia/start.sh']
elif base == 'xray':
config_dir = inst_path('/opt/amnezia/xray')
paths['host'] = [config_dir, f'/opt/amnezia/{container_name}']
paths['container'] = [config_dir]
elif base == 'telemt':
remote_dir = inst_path('/opt/amnezia/telemt')
paths['host'] = [remote_dir]
paths['container'] = [remote_dir]
elif base == 'dns':
paths['host'] = ['/opt/amnezia/dns']
paths['container'] = ['/opt/amnezia/dns']
elif base == 'adguard':
paths['host'] = ['/opt/amnezia/adguard']
paths['container'] = ['/opt/adguardhome/conf', '/opt/adguardhome/work']
elif base == 'socks5':
config_dir = inst_path('/opt/amnezia/socks5proxy')
paths['host'] = [config_dir]
paths['container'] = ['/etc/3proxy']
elif base == 'nginx':
paths['host'] = ['/opt/amnezia/nginx']
paths['container'] = ['/etc/nginx/conf.d', '/usr/share/nginx/html']
else:
paths['host'] = [f'/opt/amnezia/{base}']
paths['container'] = [f'/opt/amnezia/{base}']
return paths
def list_backups(self, protocol):
safe_proto = self.safe_protocol(protocol)
backup_dir = f'{self.BACKUP_ROOT}/{safe_proto}'
cmd = (
f"mkdir -p {shlex.quote(backup_dir)} && "
f"find {shlex.quote(backup_dir)} -maxdepth 1 -type f -name '*.tar.gz' "
"-printf '%f|%s|%T@\\n' 2>/dev/null | sort -t '|' -k3,3nr"
)
out, err, code = self.ssh.run_sudo_command(cmd)
if code != 0:
return {'status': 'error', 'message': err or out or 'Failed to list backups'}
backups = []
for line in (out or '').splitlines():
parts = line.split('|')
if len(parts) != 3:
continue
name, size, mtime = parts
backups.append({
'name': name,
'size': int(float(size or 0)),
'mtime': float(mtime or 0),
})
return {'status': 'success', 'protocol': protocol, 'backups': backups}
def create_backup(self, protocol, container_name):
safe_proto = self.safe_protocol(protocol)
backup_dir = f'{self.BACKUP_ROOT}/{safe_proto}'
paths = self._paths_for(protocol, container_name)
host_paths = ' '.join(shlex.quote(p) for p in paths['host'])
container_paths = ' '.join(shlex.quote(p) for p in paths['container'])
protocol_q = shlex.quote(str(protocol))
safe_proto_q = shlex.quote(safe_proto)
container_q = shlex.quote(str(container_name or ''))
backup_dir_q = shlex.quote(backup_dir)
script = f"""
set -eu
umask 077
protocol={protocol_q}
safe_proto={safe_proto_q}
container={container_q}
backup_dir={backup_dir_q}
timestamp=$(date -u +%Y%m%dT%H%M%SZ)
work_dir=$(mktemp -d /tmp/amnezia-backup-${{safe_proto}}.XXXXXX)
cleanup() {{ rm -rf "$work_dir"; }}
trap cleanup EXIT
mkdir -p "$backup_dir" "$work_dir/host" "$work_dir/container" "$work_dir/docker"
cat > "$work_dir/backup-info.json" <<EOF
{{
"protocol": "$protocol",
"container": "$container",
"created_at_utc": "$timestamp",
"backup_format": "amnezia-web-panel-protocol-v1"
}}
EOF
copy_host_path() {{
src="$1"
if [ -e "$src" ]; then
mkdir -p "$work_dir/host$(dirname "$src")"
cp -a "$src" "$work_dir/host$src"
fi
}}
copy_container_path() {{
src="$1"
if [ -n "$container" ] && docker inspect "$container" >/dev/null 2>&1; then
mkdir -p "$work_dir/container$(dirname "$src")"
docker cp "$container:$src" "$work_dir/container$src" >/dev/null 2>&1 || true
fi
}}
for p in {host_paths}; do copy_host_path "$p"; done
for p in {container_paths}; do copy_container_path "$p"; done
if [ -n "$container" ] && docker inspect "$container" >/dev/null 2>&1; then
docker inspect "$container" > "$work_dir/docker/inspect.json" 2>/dev/null || true
docker logs --tail 300 "$container" > "$work_dir/docker/logs-tail.txt" 2>&1 || true
fi
archive="$backup_dir/${{safe_proto}}-${{timestamp}}.tar.gz"
tar -C "$work_dir" -czf "$archive" .
chmod 0644 "$archive"
printf '%s\n' "$archive"
""".strip()
out, err, code = self.ssh.run_sudo_command(script)
if code != 0:
return {'status': 'error', 'message': err or out or 'Failed to create backup'}
path = (out or '').strip().splitlines()[-1] if (out or '').strip() else ''
name = path.rsplit('/', 1)[-1] if path else ''
return {'status': 'success', 'protocol': protocol, 'backup': {'name': name, 'path': path}}
managers/dns_manager.py
+83
View File
@@ -0,0 +1,83 @@
import os
import logging
logger = logging.getLogger(__name__)
class DNSManager:
def __init__(self, ssh):
self.ssh = ssh
def install_protocol(self, protocol_type='dns', port='53'):
"""Install AmneziaDNS service."""
try:
# 1. Check if docker is installed
out, _, _ = self.ssh.run_command("docker --version")
if "docker version" not in out.lower():
return {"status": "error", "message": "Docker not installed"}
# 2. Prepare directory
self.ssh.run_sudo_command("mkdir -p /opt/amnezia/dns")
# 3. Create Dockerfile matching official Amnezia implementation
# We use Unbound (mvance/unbound) with DNS-over-TLS to Cloudflare
forward_config = """forward-zone:
name: "."
forward-tls-upstream: yes
forward-addr: 1.1.1.1@853
forward-addr: 1.0.0.1@853
"""
self.ssh.write_file("/opt/amnezia/dns/forward-records.conf", forward_config)
dockerfile = """
FROM mvance/unbound:latest
LABEL maintainer="AmneziaVPN"
COPY forward-records.conf /opt/unbound/etc/unbound/forward-records.conf
"""
self.ssh.write_file("/opt/amnezia/dns/Dockerfile", dockerfile)
# 4. Build and run
self.ssh.run_sudo_command("docker build -t amnezia-dns /opt/amnezia/dns")
self.ssh.run_sudo_command("docker stop amnezia-dns || true")
self.ssh.run_sudo_command("docker rm amnezia-dns || true")
# Create internal network for DNS (like original Amnezia client)
self.ssh.run_sudo_command("docker network ls | grep -q amnezia-dns-net || docker network create --subnet 172.29.172.0/24 amnezia-dns-net")
# Use internal network with static IP. Do not expose 53 on host to avoid systemd-resolved conflict.
cmd = "docker run -d --name amnezia-dns --restart always --network amnezia-dns-net --ip=172.29.172.254 amnezia-dns"
self.ssh.run_sudo_command(cmd)
# Connect existing VPN containers to the DNS network
vpn_containers = ['amnezia-awg', 'amnezia-awg2', 'amnezia-awg-legacy', 'amnezia-xray', 'telemt']
for c in vpn_containers:
self.ssh.run_sudo_command(f"docker ps | grep -q {c} && docker network connect amnezia-dns-net {c} || true")
return {"status": "success", "message": "AmneziaDNS installed successfully"}
except Exception as e:
logger.exception("Error installing DNS")
return {"status": "error", "message": str(e)}
def get_server_status(self, protocol_type='dns'):
"""Check if AmneziaDNS container is running."""
try:
out, _, _ = self.ssh.run_sudo_command("docker ps --filter name=^amnezia-dns$ --format '{{.Status}}'")
is_running = 'Up' in out
out_exists, _, _ = self.ssh.run_sudo_command("docker ps -a --filter name=^amnezia-dns$ --format '{{.Names}}'")
container_exists = 'amnezia-dns' in out_exists.strip().split('\n')
return {
"container_exists": container_exists,
"container_running": is_running,
"port": "53",
"protocol": protocol_type
}
except Exception as e:
return {"error": str(e)}
def remove_container(self, protocol_type='dns'):
"""Remove AmneziaDNS container."""
self.ssh.run_sudo_command("docker stop amnezia-dns || true")
self.ssh.run_sudo_command("docker rm amnezia-dns || true")
self.ssh.run_sudo_command("rm -rf /opt/amnezia/dns")
managers/nginx_manager.py
+383
View File
@@ -0,0 +1,383 @@
"""
NGINX Web Server Manager.
Runs an NGINX container with a single editable site (index.html) and a
Let's Encrypt certificate issued through the webroot HTTP-01 challenge.
The panel owns:
- nginx.conf: editable through the Config button
- index.html: editable through the Site button
"""
import json
import logging
import re
import shlex
logger = logging.getLogger(__name__)
def _q(value):
return shlex.quote(str(value))
class NginxManager:
PROTOCOL = 'nginx'
CONTAINER_NAME = 'amnezia-nginx'
IMAGE_NAME = 'nginx:alpine'
CERTBOT_IMAGE = 'certbot/certbot:latest'
CERTBOT_CONTAINER_NAME = 'amnezia-nginx-certbot'
BASE_DIR = '/opt/amnezia/nginx'
CONF_DIR = f'{BASE_DIR}/conf'
HTML_DIR = f'{BASE_DIR}/html'
CERTBOT_WWW_DIR = f'{BASE_DIR}/certbot/www'
LETSENCRYPT_DIR = f'{BASE_DIR}/letsencrypt'
META_PATH = f'{BASE_DIR}/metadata.json'
NGINX_CONF_PATH = f'{CONF_DIR}/default.conf'
INDEX_PATH = f'{HTML_DIR}/index.html'
DEFAULT_PORT = 443
def __init__(self, ssh, protocol='nginx'):
self.ssh = ssh
self.protocol = protocol or self.PROTOCOL
# ===================== STATUS =====================
def check_docker_installed(self):
out, _, code = self.ssh.run_command("docker --version 2>/dev/null")
if code != 0:
return False
out2, _, _ = self.ssh.run_command(
"systemctl is-active docker 2>/dev/null || service docker status 2>/dev/null"
)
return 'active' in out2 or 'running' in out2.lower()
def check_protocol_installed(self, protocol_type='nginx'):
out, _, _ = self.ssh.run_sudo_command(
f"docker ps -a --filter name=^{self.CONTAINER_NAME}$ --format '{{{{.Names}}}}'"
)
return self.CONTAINER_NAME in out.strip().split('\n')
def check_container_running(self, protocol_type='nginx'):
out, _, _ = self.ssh.run_sudo_command(
f"docker ps --filter name=^{self.CONTAINER_NAME}$ --format '{{{{.Status}}}}'"
)
return 'Up' in out
def check_certbot_running(self):
out, _, _ = self.ssh.run_sudo_command(
f"docker ps --filter name=^{self.CERTBOT_CONTAINER_NAME}$ --format '{{{{.Status}}}}'"
)
return 'Up' in out
def get_server_status(self, protocol_type='nginx'):
exists = self.check_protocol_installed(protocol_type)
running = self.check_container_running(protocol_type)
meta = self._read_metadata() if exists else {}
config = self._get_server_config(protocol_type) if exists else ''
domain = meta.get('domain') or self._parse_domain(config)
port = int(meta.get('port') or self.DEFAULT_PORT)
return {
'container_exists': exists,
'container_running': running,
'port': port,
'domain': domain,
'email': meta.get('email'),
'site_url': self._site_url(domain, port) if domain else None,
'protocol': protocol_type,
'base_protocol': self.PROTOCOL,
'instance': 1,
'container_name': self.CONTAINER_NAME,
'certbot_container_name': self.CERTBOT_CONTAINER_NAME,
'certbot_running': self.check_certbot_running() if exists else False,
}
# ===================== CONFIG BUILDERS =====================
def _validate_domain(self, domain):
domain = (domain or '').strip().lower()
if not domain or len(domain) > 253:
raise ValueError('Domain is required')
if not re.match(r'^(?!-)[a-z0-9.-]+(?<!-)$', domain) or '.' not in domain:
raise ValueError('Invalid domain name')
return domain
def _validate_email(self, email):
email = (email or '').strip()
if not email or '@' not in email:
raise ValueError('Valid Let\'s Encrypt email is required')
return email
def _site_url(self, domain, port):
if not domain:
return None
port = int(port or self.DEFAULT_PORT)
return f'https://{domain}' if port == 443 else f'https://{domain}:{port}'
def _build_initial_config(self, domain):
return f"""server {{
listen 80;
server_name {domain};
location /.well-known/acme-challenge/ {{
root /var/www/certbot;
}}
location / {{
root /usr/share/nginx/html;
index index.html;
try_files $uri $uri/ /index.html;
}}
}}
"""
def _build_ssl_config(self, domain, port):
redirect_target = 'https://$host$request_uri' if int(port) == 443 else f'https://$host:{int(port)}$request_uri'
return f"""server {{
listen 80;
server_name {domain};
location /.well-known/acme-challenge/ {{
root /var/www/certbot;
}}
location / {{
return 301 {redirect_target};
}}
}}
server {{
listen 443 ssl http2;
server_name {domain};
ssl_certificate /etc/letsencrypt/live/{domain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{domain}/privkey.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
root /usr/share/nginx/html;
index index.html;
location / {{
try_files $uri $uri/ /index.html;
}}
}}
"""
def _default_index(self, domain):
return f"""<!doctype html>
<html lang=\"en\">
<head>
<meta charset=\"utf-8\">
<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">
<title>{domain}</title>
<style>
body {{ margin: 0; min-height: 100vh; display: grid; place-items: center; font-family: system-ui, -apple-system, Segoe UI, sans-serif; background: #0f172a; color: #e2e8f0; }}
main {{ text-align: center; padding: 32px; }}
h1 {{ font-size: clamp(2rem, 6vw, 4rem); margin: 0 0 12px; }}
p {{ color: #94a3b8; font-size: 1.1rem; }}
</style>
</head>
<body>
<main>
<h1>NGINX is running</h1>
<p>{domain}</p>
</main>
</body>
</html>
"""
def _parse_domain(self, config_text):
m = re.search(r'^\s*server_name\s+([^;\s]+)', config_text or '', re.MULTILINE)
return m.group(1) if m else None
# ===================== FILE I/O =====================
def _read_file(self, path):
out, _, code = self.ssh.run_sudo_command(f"cat {_q(path)} 2>/dev/null")
return out if code == 0 else ''
def _write_file(self, path, content):
parent = path.rsplit('/', 1)[0]
self.ssh.run_sudo_command(f"mkdir -p {_q(parent)}")
self.ssh.upload_file_sudo(content, path)
def _read_metadata(self):
raw = self._read_file(self.META_PATH)
if not raw.strip():
return {}
try:
return json.loads(raw)
except Exception:
return {}
def _write_metadata(self, meta):
self._write_file(self.META_PATH, json.dumps(meta, indent=2, ensure_ascii=False))
def _get_server_config(self, protocol_type='nginx'):
config = self._read_file(self.NGINX_CONF_PATH)
if config:
return config
out, _, code = self.ssh.run_sudo_command(
f"docker exec {self.CONTAINER_NAME} cat /etc/nginx/conf.d/default.conf 2>/dev/null"
)
return out if code == 0 else ''
def save_server_config(self, protocol_type='nginx', config_text=''):
old_config = self._get_server_config(protocol_type)
self._write_file(self.NGINX_CONF_PATH, config_text or '')
if self.check_container_running(protocol_type):
_, err, code = self.ssh.run_sudo_command(f"docker exec {self.CONTAINER_NAME} nginx -t", timeout=30)
if code != 0:
self._write_file(self.NGINX_CONF_PATH, old_config)
self.ssh.run_sudo_command(f"docker exec {self.CONTAINER_NAME} nginx -s reload 2>/dev/null || true")
raise RuntimeError(f'Invalid NGINX config: {err}')
self.ssh.run_sudo_command(f"docker exec {self.CONTAINER_NAME} nginx -s reload")
return True
def get_site_index(self, protocol_type='nginx'):
return self._read_file(self.INDEX_PATH)
def save_site_index(self, protocol_type='nginx', html=''):
self._write_file(self.INDEX_PATH, html or '')
return True
# ===================== INSTALL / REMOVE =====================
def _run_nginx_container(self, port):
run_cmd = (
f"docker run -d --restart always "
f"--name {self.CONTAINER_NAME} "
f"-p 80:80/tcp "
f"-p {int(port)}:443/tcp "
f"-v {self.CONF_DIR}:/etc/nginx/conf.d:ro "
f"-v {self.HTML_DIR}:/usr/share/nginx/html:ro "
f"-v {self.CERTBOT_WWW_DIR}:/var/www/certbot:ro "
f"-v {self.LETSENCRYPT_DIR}:/etc/letsencrypt:ro "
f"{self.IMAGE_NAME}"
)
return self.ssh.run_sudo_command(run_cmd, timeout=60)
def _run_certbot_renewer(self, domain, email):
loop_script = f"""
set -eu
if [ ! -f /etc/letsencrypt/live/{domain}/fullchain.pem ]; then
certbot certonly --webroot --webroot-path /var/www/certbot --email {_q(email)} --agree-tos --no-eff-email -d {_q(domain)}
fi
kill -HUP 1 2>/dev/null || true
while :; do
certbot renew --webroot --webroot-path /var/www/certbot --quiet --deploy-hook 'kill -HUP 1 2>/dev/null || true'
sleep 12h & wait $!
done
"""
self.ssh.run_sudo_command(f"docker rm -fv {self.CERTBOT_CONTAINER_NAME} || true")
run_cmd = (
f"docker run -d --restart always "
f"--name {self.CERTBOT_CONTAINER_NAME} "
f"--pid=container:{self.CONTAINER_NAME} "
f"-v {self.CERTBOT_WWW_DIR}:/var/www/certbot "
f"-v {self.LETSENCRYPT_DIR}:/etc/letsencrypt "
f"--entrypoint /bin/sh "
f"{self.CERTBOT_IMAGE} -c {_q(loop_script)}"
)
return self.ssh.run_sudo_command(run_cmd, timeout=60)
def _wait_for_certificate(self, domain):
wait_script = f"""
for i in $(seq 1 60); do
if [ -s {self.LETSENCRYPT_DIR}/live/{domain}/fullchain.pem ] && [ -s {self.LETSENCRYPT_DIR}/live/{domain}/privkey.pem ]; then
exit 0
fi
if ! docker ps --filter name=^{self.CERTBOT_CONTAINER_NAME}$ --format '{{{{.Names}}}}' | grep -qx {self.CERTBOT_CONTAINER_NAME}; then
docker logs --tail 120 {self.CERTBOT_CONTAINER_NAME} 2>&1 || true
exit 1
fi
sleep 5
done
docker logs --tail 120 {self.CERTBOT_CONTAINER_NAME} 2>&1 || true
exit 1
"""
return self.ssh.run_sudo_command(f"sh -c {_q(wait_script)}", timeout=330)
def install_protocol(self, protocol_type='nginx', port=None, email=None, domain=None):
if not self.check_docker_installed():
return {'status': 'error', 'message': 'Docker not installed'}
port = int(port or self.DEFAULT_PORT)
if port == 80:
return {'status': 'error', 'message': 'Port 80 is reserved for Let\'s Encrypt validation'}
domain = self._validate_domain(domain)
email = self._validate_email(email)
self.ssh.run_sudo_command(f"docker pull {self.IMAGE_NAME}", timeout=180)
self.ssh.run_sudo_command(f"docker pull {self.CERTBOT_IMAGE}", timeout=180)
if self.check_protocol_installed(protocol_type):
self.remove_container(protocol_type)
self.ssh.run_sudo_command(
f"mkdir -p {self.CONF_DIR} {self.HTML_DIR} {self.CERTBOT_WWW_DIR} {self.LETSENCRYPT_DIR}"
)
self._write_file(self.NGINX_CONF_PATH, self._build_initial_config(domain))
self._write_file(self.INDEX_PATH, self._default_index(domain))
self._write_metadata({'domain': domain, 'email': email, 'port': port})
_, err, code = self._run_nginx_container(port)
if code != 0:
return {'status': 'error', 'message': f'Failed to start NGINX container: {err}'}
_, err, code = self._run_certbot_renewer(domain, email)
if code != 0:
self.ssh.run_sudo_command(f"docker logs --tail 100 {self.CONTAINER_NAME} 2>/dev/null || true")
self.ssh.run_sudo_command(f"docker stop {self.CONTAINER_NAME} || true")
self.ssh.run_sudo_command(f"docker rm -fv {self.CONTAINER_NAME} || true")
return {'status': 'error', 'message': f'Failed to start certbot renewer container: {err}'}
out, err, code = self._wait_for_certificate(domain)
if code != 0:
self.ssh.run_sudo_command(f"docker logs --tail 120 {self.CERTBOT_CONTAINER_NAME} 2>/dev/null || true")
self.ssh.run_sudo_command(f"docker rm -fv {self.CERTBOT_CONTAINER_NAME} || true")
self.ssh.run_sudo_command(f"docker stop {self.CONTAINER_NAME} || true")
self.ssh.run_sudo_command(f"docker rm -fv {self.CONTAINER_NAME} || true")
return {
'status': 'error',
'message': f"Let's Encrypt certificate issue failed. Make sure {domain} points to this server and port 80 is reachable. {err or out}",
}
self._write_file(self.NGINX_CONF_PATH, self._build_ssl_config(domain, port))
_, err, code = self.ssh.run_sudo_command(f"docker exec {self.CONTAINER_NAME} nginx -t", timeout=30)
if code != 0:
return {'status': 'error', 'message': f'Generated NGINX config is invalid: {err}'}
self.ssh.run_sudo_command(f"docker exec {self.CONTAINER_NAME} nginx -s reload")
url = self._site_url(domain, port)
return {
'status': 'success',
'protocol': protocol_type,
'base_protocol': self.PROTOCOL,
'instance': 1,
'container_name': self.CONTAINER_NAME,
'certbot_container_name': self.CERTBOT_CONTAINER_NAME,
'certbot_running': self.check_certbot_running(),
'port': port,
'domain': domain,
'email': email,
'site_url': url,
'message': 'NGINX web server installed',
'log': [
f'NGINX HTTPS port: {port}/TCP',
'Port 80/TCP is used for Let\'s Encrypt HTTP-01 validation',
f'Certificate issued for {domain}',
f'Auto-renewal container: {self.CERTBOT_CONTAINER_NAME}',
f'Site URL: {url}',
],
}
def remove_container(self, protocol_type='nginx'):
self.ssh.run_sudo_command(f"docker stop {self.CERTBOT_CONTAINER_NAME} || true")
self.ssh.run_sudo_command(f"docker rm -fv {self.CERTBOT_CONTAINER_NAME} || true")
self.ssh.run_sudo_command(f"docker stop {self.CONTAINER_NAME} || true")
self.ssh.run_sudo_command(f"docker rm -fv {self.CONTAINER_NAME} || true")
self.ssh.run_sudo_command(f"rm -rf {self.BASE_DIR}")
return True
managers/socks5_manager.py
+240
View File
@@ -0,0 +1,240 @@
"""
SOCKS5 Proxy Manager — runs 3proxy in a Docker container, modelled after the
official Amnezia client install (client/server_scripts/socks5_proxy/). Holds a
single user (port + username + password); credentials can be edited later from
the panel via update_credentials().
"""
import logging
import secrets
import string
import re
logger = logging.getLogger(__name__)
def _generate_password(length=16):
alphabet = string.ascii_letters + string.digits
return ''.join(secrets.choice(alphabet) for _ in range(length))
class Socks5Manager:
PROTOCOL = 'socks5'
CONTAINER_NAME = 'amnezia-socks5proxy'
IMAGE_NAME = '3proxy/3proxy:0.9.5'
CONFIG_DIR = '/opt/amnezia/socks5proxy'
CONFIG_PATH = '/etc/3proxy/3proxy.cfg'
DEFAULT_PORT = 38080
DEFAULT_USERNAME = 'proxy_user'
def __init__(self, ssh, protocol='socks5'):
self.ssh = ssh
self.protocol = protocol or self.PROTOCOL
self.instance = self._instance_index(self.protocol)
self.container_name = self._container_name(self.protocol)
self.config_dir = self._config_dir(self.protocol)
def _instance_index(self, protocol=None):
parts = str(protocol or self.protocol or '').split('__', 1)
if len(parts) == 2:
try:
return max(1, int(parts[1]))
except ValueError:
return 1
return 1
def _container_name(self, protocol=None):
idx = self._instance_index(protocol or self.protocol)
return self.CONTAINER_NAME if idx <= 1 else f'{self.CONTAINER_NAME}-{idx}'
def _config_dir(self, protocol=None):
idx = self._instance_index(protocol or self.protocol)
return self.CONFIG_DIR if idx <= 1 else f'{self.CONFIG_DIR}-{idx}'
# ===================== STATUS =====================
def check_docker_installed(self):
out, _, code = self.ssh.run_command("docker --version 2>/dev/null")
if code != 0:
return False
out2, _, _ = self.ssh.run_command(
"systemctl is-active docker 2>/dev/null || service docker status 2>/dev/null"
)
return 'active' in out2 or 'running' in out2.lower()
def check_protocol_installed(self, protocol_type='socks5'):
out, _, _ = self.ssh.run_sudo_command(
f"docker ps -a --filter name=^{self._container_name(protocol_type)}$ --format '{{{{.Names}}}}'"
)
return self._container_name(protocol_type) in out.strip().split('\n')
def check_container_running(self, protocol_type='socks5'):
out, _, _ = self.ssh.run_sudo_command(
f"docker ps --filter name=^{self._container_name(protocol_type)}$ --format '{{{{.Status}}}}'"
)
return 'Up' in out
def get_server_status(self, protocol_type='socks5'):
exists = self.check_protocol_installed(protocol_type)
running = self.check_container_running(protocol_type)
creds = self.get_credentials() if exists else {}
return {
'container_exists': exists,
'container_running': running,
'port': creds.get('port'),
'username': creds.get('username'),
'protocol': protocol_type,
'base_protocol': self.PROTOCOL,
'instance': self._instance_index(protocol_type),
'container_name': self._container_name(protocol_type),
}
# ===================== CONFIG I/O =====================
def _build_config(self, username, password, port):
# Mirrors client/server_scripts/socks5_proxy/configure_container.sh.
# 'auth strong' enforces username/password on every connection;
# 'allow {user}' restricts the ACL to our single user only.
return (
"#!/bin/3proxy\n"
f"config {self.CONFIG_PATH}\n"
"timeouts 1 5 30 60 180 1800 15 60\n"
f"users {username}:CL:{password}\n"
"log\n"
"auth strong\n"
f"allow {username}\n"
f"socks -p{int(port)}\n"
)
def _read_config(self):
out, _, code = self.ssh.run_sudo_command(
f"docker exec {self.container_name} cat {self.CONFIG_PATH} 2>/dev/null"
)
if code != 0 or not out.strip():
out, _, code = self.ssh.run_sudo_command(
f"cat {self.config_dir}/3proxy.cfg 2>/dev/null"
)
if code != 0 or not out.strip():
return ''
return out
def _write_config(self, config_text):
# Write to host first (so we have a stable copy outside the container),
# then docker cp into the running container at the path 3proxy expects.
self.ssh.run_sudo_command(f"mkdir -p {self.config_dir}")
self.ssh.upload_file_sudo(config_text, f"{self.config_dir}/3proxy.cfg")
self.ssh.run_sudo_command(
f"docker cp {self.config_dir}/3proxy.cfg {self.container_name}:{self.CONFIG_PATH} 2>/dev/null || true"
)
def _parse_credentials(self, config_text):
creds = {'port': None, 'username': None, 'password': None}
if not config_text:
return creds
m_user = re.search(r'^\s*users\s+([^:\s]+):CL:(\S+)', config_text, re.MULTILINE)
if m_user:
creds['username'] = m_user.group(1)
creds['password'] = m_user.group(2)
m_port = re.search(r'^\s*socks\s+-p(\d+)', config_text, re.MULTILINE)
if m_port:
creds['port'] = int(m_port.group(1))
return creds
def get_credentials(self):
return self._parse_credentials(self._read_config())
# ===================== INSTALL / UPDATE / REMOVE =====================
def install_protocol(self, protocol_type='socks5', port=None, username=None, password=None):
if not self.check_docker_installed():
return {'status': 'error', 'message': 'Docker not installed'}
port = int(port or self.DEFAULT_PORT)
username = (username or self.DEFAULT_USERNAME).strip() or self.DEFAULT_USERNAME
password = (password or _generate_password()).strip() or _generate_password()
# Pull image (idempotent — fast no-op if cached)
self.ssh.run_sudo_command(f"docker pull {self.IMAGE_NAME}")
# Wipe any prior install, including the bind-mounted config dir, before
# writing a fresh config — leftover state would leak old credentials.
install_protocol = protocol_type or self.protocol
container_name = self._container_name(install_protocol)
config_dir = self._config_dir(install_protocol)
if self.check_protocol_installed(install_protocol):
self.remove_container(install_protocol)
config_text = self._build_config(username, password, port)
self.ssh.run_sudo_command(f"mkdir -p {config_dir}")
self.ssh.upload_file_sudo(config_text, f"{config_dir}/3proxy.cfg")
# The 3proxy image reads /etc/3proxy/3proxy.cfg by default.
# Do not pass the config path as the container command: Docker would try
# to execute the config file and fail with "permission denied".
run_cmd = (
f"docker run -d --restart always "
f"--name {container_name} "
f"-p {port}:{port}/tcp "
f"-v {config_dir}:/etc/3proxy:ro "
f"{self.IMAGE_NAME}"
)
_, err, code = self.ssh.run_sudo_command(run_cmd)
if code != 0:
return {'status': 'error', 'message': f'Failed to start container: {err}'}
return {
'status': 'success',
'protocol': install_protocol,
'base_protocol': self.PROTOCOL,
'instance': self._instance_index(install_protocol),
'container_name': container_name,
'port': port,
'username': username,
'password': password,
'message': 'SOCKS5 proxy installed',
'log': [
f'SOCKS5 proxy listening on port {port}/TCP',
f'Username: {username}',
f'Password: {password}',
'Save these credentials — the password can also be viewed later via "Change settings".',
],
}
def update_credentials(self, port=None, username=None, password=None):
"""Apply new connection settings: regenerates the config file and
restarts the container so the new port mapping takes effect."""
if not self.check_protocol_installed(self.protocol):
return {'status': 'error', 'message': 'SOCKS5 not installed'}
current = self.get_credentials()
new_port = int(port if port is not None else (current.get('port') or self.DEFAULT_PORT))
new_user = (username or current.get('username') or self.DEFAULT_USERNAME).strip()
new_pass = (password or current.get('password') or _generate_password()).strip()
old_port = current.get('port')
# If the port changed we must recreate the container — `docker run -p`
# mappings are immutable on existing containers.
if old_port and new_port != old_port:
return self.install_protocol(
protocol_type=self.protocol, port=new_port, username=new_user, password=new_pass
)
config_text = self._build_config(new_user, new_pass, new_port)
self._write_config(config_text)
self.ssh.run_sudo_command(f"docker restart {self.container_name}")
return {
'status': 'success',
'port': new_port,
'username': new_user,
'password': new_pass,
}
def remove_container(self, protocol_type='socks5'):
self.ssh.run_sudo_command(f"docker stop {self._container_name(protocol_type)} || true")
self.ssh.run_sudo_command(f"docker rm -fv {self._container_name(protocol_type)} || true")
self.ssh.run_sudo_command(f"rm -rf {self._config_dir(protocol_type)}")
return True
managers/ssh_manager.py
+227
View File
@@ -0,0 +1,227 @@
"""
SSH Manager - manages SSH connections to VPN servers.
Replicates the ServerController logic from the AmneziaVPN client.
"""
import paramiko
import io
import time
import logging
logger = logging.getLogger(__name__)
class SSHManager:
"""Manages SSH connections and command execution on remote servers."""
def __init__(self, host, port, username, password=None, private_key=None):
self.host = host
self.port = int(port)
self.username = username
self.password = password
self.private_key = private_key
self.client = None
self._is_root = (username == 'root')
def connect(self):
"""Establish SSH connection to the server."""
self.client = paramiko.SSHClient()
self.client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
kwargs = {
'hostname': self.host,
'port': self.port,
'username': self.username,
'timeout': 15,
'allow_agent': False,
'look_for_keys': False,
}
if self.private_key:
key_file = io.StringIO(self.private_key)
try:
pkey = paramiko.RSAKey.from_private_key(key_file)
except paramiko.ssh_exception.SSHException:
key_file.seek(0)
try:
pkey = paramiko.Ed25519Key.from_private_key(key_file)
except paramiko.ssh_exception.SSHException:
key_file.seek(0)
pkey = paramiko.ECDSAKey.from_private_key(key_file)
kwargs['pkey'] = pkey
elif self.password:
kwargs['password'] = self.password
self.client.connect(**kwargs)
return True
def disconnect(self):
"""Close SSH connection."""
if self.client:
self.client.close()
self.client = None
def run_command(self, command, timeout=60):
"""Execute command on remote server."""
if not self.client:
raise ConnectionError("Not connected to server")
logger.info(f"Running command: {command[:100]}...")
stdin, stdout, stderr = self.client.exec_command(command, timeout=timeout)
# Crucial: set timeout on the channel to prevent hanging indefinitely
stdout.channel.settimeout(timeout)
stderr.channel.settimeout(timeout)
try:
exit_code = stdout.channel.recv_exit_status()
out = stdout.read().decode('utf-8', errors='replace').strip()
err = stderr.read().decode('utf-8', errors='replace').strip()
except Exception as e:
logger.error(f"Command timed out or failed to read: {e}")
out, err, exit_code = "", str(e), -1
if exit_code != 0:
logger.warning(f"Command exited with code {exit_code}: {err}")
return out, err, exit_code
def _sudo_prefix(self):
"""Get the sudo command prefix with password handling."""
if self._is_root:
return ''
if self.password:
# Use sudo -S to read password from stdin
escaped_pass = self.password.replace("'", "'\\''")
return f"echo '{escaped_pass}' | sudo -S "
return 'sudo '
def run_sudo_command(self, command, timeout=60):
"""
Execute command with sudo, automatically handling password.
Strips 'sudo ' from the beginning of command if present,
and re-adds it with password piping.
"""
# Remove existing sudo prefix if present
clean_cmd = command
if clean_cmd.strip().startswith('sudo '):
clean_cmd = clean_cmd.strip()[5:]
if self._is_root:
return self.run_command(clean_cmd, timeout=timeout)
if self.password:
escaped_pass = self.password.replace("'", "'\\''")
# Pipe password directly to sudo -S, preserving original command quoting
# 2>/dev/null on echo suppresses '[sudo] password for...' prompt noise
full_cmd = f"echo '{escaped_pass}' | sudo -S -p '' {clean_cmd}"
else:
full_cmd = f"sudo {clean_cmd}"
return self.run_command(full_cmd, timeout=timeout)
def run_sudo_script(self, script, timeout=120):
"""
Execute a multi-line script with sudo/root privileges.
Writes script to /tmp via SFTP, then runs with sudo bash.
"""
if self._is_root:
return self.run_script(script, timeout=timeout)
# Write script to temp file via SFTP (avoids heredoc/pipe conflicts)
import hashlib
script_hash = hashlib.md5(script.encode()).hexdigest()[:8]
tmp_script = f"/tmp/_amnz_script_{script_hash}.sh"
self.upload_file(script, tmp_script)
# Run with sudo
if self.password:
escaped_pass = self.password.replace("'", "'\\''")
full_cmd = f"echo '{escaped_pass}' | sudo -S -p '' bash {tmp_script}; rm -f {tmp_script}"
else:
full_cmd = f"sudo bash {tmp_script}; rm -f {tmp_script}"
return self.run_command(full_cmd, timeout=timeout)
def run_script(self, script, timeout=120):
"""Execute a multi-line script on remote server."""
return self.run_command(script, timeout=timeout)
def upload_file(self, content, remote_path):
"""Upload text content to a remote file via SFTP."""
if not self.client:
raise ConnectionError("Not connected to server")
# Normalize line endings (Windows CRLF -> Unix LF)
content = content.replace('\r\n', '\n')
sftp = self.client.open_sftp()
try:
with sftp.file(remote_path, 'w') as f:
f.write(content)
finally:
sftp.close()
def upload_file_sudo(self, content, remote_path):
"""
Upload text content to a remote file that requires root access.
Uses SFTP to write to /tmp, then sudo mv to the target path.
Also normalizes line endings to Unix-style (LF).
"""
if not self.client:
raise ConnectionError("Not connected to server")
# Normalize line endings (Windows CRLF -> Unix LF)
content = content.replace('\r\n', '\n')
# Write to temp file via SFTP (no sudo needed for /tmp)
import hashlib
tmp_name = f"/tmp/_amnz_{hashlib.md5(remote_path.encode()).hexdigest()[:8]}"
self.upload_file(content, tmp_name)
# Move to target with sudo
self.run_sudo_command(f"mv {tmp_name} {remote_path}")
self.run_sudo_command(f"chmod 644 {remote_path}")
return True
def download_file(self, remote_path):
"""Download text content from a remote file."""
if not self.client:
raise ConnectionError("Not connected to server")
sftp = self.client.open_sftp()
try:
with sftp.file(remote_path, 'r') as f:
return f.read().decode('utf-8', errors='replace')
finally:
sftp.close()
def file_exists(self, remote_path):
"""Check if a remote file exists."""
if not self.client:
raise ConnectionError("Not connected to server")
sftp = self.client.open_sftp()
try:
sftp.stat(remote_path)
return True
except FileNotFoundError:
return False
finally:
sftp.close()
def test_connection(self):
"""Test SSH connection and return server info."""
out, err, code = self.run_command("uname -sr && cat /etc/os-release 2>/dev/null | head -2")
return out
def write_file(self, remote_path, content):
"""Write content to a remote file with sudo."""
return self.upload_file_sudo(content, remote_path)
def __enter__(self):
self.connect()
return self
def __exit__(self, *args):
self.disconnect()
managers/telemt_manager.py
+571
View File
@@ -0,0 +1,571 @@
import json
import logging
import uuid
import re
import os
import secrets
from datetime import datetime
from .ssh_manager import SSHManager
logger = logging.getLogger(__name__)
class TelemtManager:
CONTAINER_NAME = "telemt"
API_URL = "http://127.0.0.1:9091"
def __init__(self, ssh_manager: SSHManager, protocol='telemt'):
self.ssh = ssh_manager
self.protocol = protocol or 'telemt'
self.instance = self._instance_index(self.protocol)
self.container_name = self._container_name(self.protocol)
self.remote_dir = self._remote_dir(self.protocol)
def _instance_index(self, protocol):
parts = str(protocol or '').split('__', 1)
if len(parts) == 2:
try:
return max(1, int(parts[1]))
except ValueError:
return 1
return 1
def _container_name(self, protocol=None):
idx = self._instance_index(protocol or self.protocol)
base_name = self.CONTAINER_NAME
return base_name if idx <= 1 else f'{base_name}-{idx}'
def _remote_dir(self, protocol=None):
idx = self._instance_index(protocol or self.protocol)
return '/opt/amnezia/telemt' if idx <= 1 else f'/opt/amnezia/telemt-{idx}'
def _config_path(self):
return f'{self.remote_dir}/config.toml'
def _api_host_ports(self):
# Host API mappings are only for diagnostics; panel talks via docker exec.
# Keep first instance backward-compatible, avoid 9090/9091 collisions later.
if self.instance <= 1:
return 9090, 9091
base = 9090 + (self.instance * 10)
return base, base + 1
def _api_request(self, method, path, data=None):
"""Execute a curl request inside the docker container."""
cmd = f"docker exec {self.container_name} curl -s -X {method} {self.API_URL}{path}"
if data:
js_data = json.dumps(data).replace('"', '\\"')
cmd += f" -H 'Content-Type: application/json' -d \"{js_data}\""
out, err, code = self.ssh.run_sudo_command(cmd)
if code != 0:
return None
try:
return json.loads(out)
except json.JSONDecodeError:
return None
def check_docker_installed(self):
out, _, _ = self.ssh.run_command("docker --version 2>/dev/null")
return bool(out.strip())
def check_protocol_installed(self):
out, _, _ = self.ssh.run_command(f"docker ps -a --filter name=^{self.container_name}$ --format '{{{{.Names}}}}'")
return out.strip() == self.container_name
def get_server_status(self, protocol_type):
exists = self.check_protocol_installed()
out, _, _ = self.ssh.run_command(f"docker inspect -f '{{{{.State.Running}}}}' {self.container_name} 2>/dev/null")
is_running = out.strip().lower() == 'true'
status = {
'container_exists': exists,
'container_running': is_running,
}
if is_running:
# get external docker port mapping for 443
out, _, _ = self.ssh.run_command(f"docker port {self.container_name} 443 2>/dev/null")
if out:
port = out.split(':')[-1].strip()
status['port'] = port
else:
status['port'] = None
config = self._get_server_config()
status['awg_params'] = self._parse_telemt_params(config)
# Count connections from API
clients = self.get_clients(protocol_type)
status['clients_count'] = len(clients)
return status
def _ensure_docker_compose(self):
"""Make sure `docker compose` is available, installing the plugin if needed.
Why: `docker-buildx-plugin` and `docker-compose-plugin` only ship in Docker's
official apt/yum repo. When Docker was installed from distro packages
(e.g. `docker.io` on Ubuntu), that repo is not configured and a plain
`apt-get install docker-compose-plugin` fails. So we add the repo,
refresh package lists, then install.
"""
out, _, code = self.ssh.run_command("docker compose version 2>/dev/null")
if code == 0 and out.strip():
return
script = r"""
if command -v apt-get >/dev/null 2>&1; then
export DEBIAN_FRONTEND=noninteractive
apt-get update -y || true
apt-get install -y ca-certificates curl gnupg || exit 1
install -m 0755 -d /etc/apt/keyrings
. /etc/os-release
DOCKER_DISTRO="$ID"
case "$ID" in
linuxmint|pop|elementary|zorin) DOCKER_DISTRO="ubuntu" ;;
kali|parrot) DOCKER_DISTRO="debian" ;;
esac
if [ ! -s /etc/apt/keyrings/docker.asc ]; then
curl -fsSL "https://download.docker.com/linux/${DOCKER_DISTRO}/gpg" -o /etc/apt/keyrings/docker.asc || exit 1
chmod a+r /etc/apt/keyrings/docker.asc
fi
CODENAME="${UBUNTU_CODENAME:-$VERSION_CODENAME}"
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/${DOCKER_DISTRO} ${CODENAME} stable" > /etc/apt/sources.list.d/docker.list
apt-get update -y || exit 1
apt-get install -y docker-buildx-plugin docker-compose-plugin || exit 1
elif command -v dnf >/dev/null 2>&1; then
dnf install -y dnf-plugins-core || exit 1
. /etc/os-release
dnf config-manager --add-repo "https://download.docker.com/linux/${ID}/docker-ce.repo" \
|| dnf config-manager --add-repo "https://download.docker.com/linux/centos/docker-ce.repo" \
|| exit 1
dnf makecache || true
dnf install -y docker-buildx-plugin docker-compose-plugin || exit 1
elif command -v yum >/dev/null 2>&1; then
yum install -y yum-utils || exit 1
. /etc/os-release
yum-config-manager --add-repo "https://download.docker.com/linux/${ID}/docker-ce.repo" \
|| yum-config-manager --add-repo "https://download.docker.com/linux/centos/docker-ce.repo" \
|| exit 1
yum makecache || true
yum install -y docker-buildx-plugin docker-compose-plugin || exit 1
else
echo "Unsupported package manager" >&2
exit 1
fi
docker compose version
"""
out, err, code = self.ssh.run_sudo_script(script, timeout=300)
if code != 0:
raise RuntimeError(f"Failed to install docker compose plugin: {err or out}")
def install_protocol(self, protocol_type='telemt', port='443', tls_emulation=True, tls_domain="", max_connections=0):
results = []
if not self.check_docker_installed():
results.append("Installing Docker...")
self.ssh.run_sudo_command("curl -fsSL https://get.docker.com | sh", timeout=300)
if self.check_protocol_installed():
self.ssh.run_sudo_command(f"docker rm -f {self.container_name}")
results.append("Ensuring docker compose plugin...")
self._ensure_docker_compose()
results.append("Uploading Telemt files...")
local_dir = os.path.join(os.path.dirname(os.path.dirname(__file__)), 'protocol_telemt')
remote_dir = self.remote_dir
self.ssh.run_sudo_command(f"mkdir -p {remote_dir}")
self.ssh.run_sudo_command(f"chmod 755 {remote_dir}")
# Read and patch config.toml
with open(os.path.join(local_dir, 'config.toml'), 'r', encoding='utf-8') as f:
config_content = f.read()
tls_emul_str = "true" if tls_emulation else "false"
config_content = re.sub(r'tls_emulation\s*=\s*(true|false|True|False)', f'tls_emulation = {tls_emul_str}', config_content)
if tls_emulation and tls_domain:
config_content = re.sub(r'tls_domain\s*=\s*".*?"', f'tls_domain = "{tls_domain}"', config_content)
if max_connections is not None and max_connections > 0:
config_content = re.sub(r'max_connections\s*=\s*\d+', f'max_connections = {max_connections}', config_content)
# Patch public_host and public_port for links
if "public_host =" in config_content or "# public_host =" in config_content:
config_content = re.sub(r'#?\s*public_host\s*=\s*".*?"', f'public_host = "{self.ssh.host}"', config_content)
else:
config_content = config_content.replace('[general.links]', f'[general.links]\npublic_host = "{self.ssh.host}"')
config_content = re.sub(r'public_port\s*=\s*\d+', f'public_port = {port}', config_content)
# Remove default hello user
config_content = re.sub(r'^hello\s*=\s*".*?"', '', config_content, flags=re.MULTILINE)
self.ssh.upload_file_sudo(config_content, f"{remote_dir}/config.toml")
# Patch docker-compose.yml with proper port
with open(os.path.join(local_dir, 'docker-compose.yml'), 'r', encoding='utf-8') as f:
compose_content = f.read()
compose_content = re.sub(r'"443:443"', f'"{port}:443"', compose_content)
compose_content = re.sub(r'container_name:\s*telemt', f'container_name: {self.container_name}', compose_content)
if self.instance > 1:
api_port_9090, api_port_9091 = self._api_host_ports()
compose_content = re.sub(r'"127\.0\.0\.1:9090:9090"', f'"127.0.0.1:{api_port_9090}:9090"', compose_content)
compose_content = re.sub(r'"127\.0\.0\.1:9091:9091"', f'"127.0.0.1:{api_port_9091}:9091"', compose_content)
self.ssh.upload_file_sudo(compose_content, f"{remote_dir}/docker-compose.yml")
# Upload Dockerfile
with open(os.path.join(local_dir, 'Dockerfile'), 'r', encoding='utf-8') as f:
dockerfile = f.read()
self.ssh.upload_file_sudo(dockerfile, f"{remote_dir}/Dockerfile")
results.append("Starting Telemt container...")
out, err, code = self.ssh.run_sudo_command(f"sh -c 'cd {remote_dir} && docker compose up -d --build'", timeout=600)
if code != 0:
self.ssh.run_sudo_command(f"sh -c 'cd {remote_dir} && docker-compose up -d --build'", timeout=600)
return {
"status": "success",
"protocol": self.protocol,
"host": "",
"port": port,
"log": results
}
def _get_server_config(self):
out, _, code = self.ssh.run_sudo_command(f"cat {self._config_path()}")
if code != 0: return ""
return out
def save_server_config(self, protocol_type, config_content):
self.ssh.upload_file_sudo(config_content.replace('\r\n', '\n'), f"{self._config_path()}")
# Use SIGHUP (HUP) to reload MTProxy config without restarting the process/container.
# This keeps the traffic statistics (octets) in memory.
self.ssh.run_sudo_command(f"docker kill -s HUP {self.container_name} || docker restart {self.container_name}")
def _parse_telemt_params(self, config_text):
params = {}
m = re.search(r'tls_emulation\s*=\s*(true|false)', config_text, re.IGNORECASE)
if m: params['tls_emulation'] = m.group(1).lower() == 'true'
m = re.search(r'tls_domain\s*=\s*"([^"]+)"', config_text)
if m: params['tls_domain'] = m.group(1)
m = re.search(r'max_connections\s*=\s*(\d+)', config_text)
if m: params['max_connections'] = int(m.group(1))
return params
def remove_container(self, protocol_type=None):
self.ssh.run_sudo_command(f"docker rm -f {self.container_name}")
self.ssh.run_sudo_command(f"rm -rf {self.remote_dir}")
def get_clients(self, protocol_type):
api_data = {}
resp = self._api_request("GET", "/v1/users")
if resp and resp.get('ok'):
for u in resp.get('data', []):
api_data[u.get('username')] = u
config_text = self._get_server_config()
users = self._parse_users_from_config(config_text)
clients = []
needs_update = False
for username, secret in users.items():
user_stats = api_data.get(username.lstrip('#').strip(), {})
links = user_stats.get('links', {})
tg_link = ""
if links.get('tls'): tg_link = links['tls'][0]
elif links.get('secure'): tg_link = links['secure'][0]
elif links.get('classic'): tg_link = links['classic'][0]
enabled = not username.startswith('#')
clean_name = username.lstrip('#').strip()
total_octets = user_stats.get('total_octets', 0)
quota = user_stats.get('data_quota_bytes')
# AUTO-DISABLE IF QUOTA REACHED
if enabled and quota and total_octets >= quota:
logger.info(f"Auto-disabling client {clean_name} - quota reached: {total_octets} >= {quota}")
# We will trigger a toggle after we finish this loop to avoid re-reading config inside loop
enabled = False
needs_update = True
clients.append({
"clientId": clean_name,
"clientName": clean_name,
"enabled": enabled,
"creationDate": "",
"userData": {
"clientName": clean_name,
"token": secret,
"tg_link": tg_link,
"total_octets": total_octets,
"current_connections": user_stats.get('current_connections', 0),
"active_ips": user_stats.get('active_unique_ips', 0),
"quota": quota,
"expiry": user_stats.get('expiration_rfc3339')
}
})
if needs_update:
# Re-read and update config strictly at the end
for c in clients:
if not c['enabled']:
self.toggle_client(protocol_type, c['clientId'], False, restart=False)
self.ssh.run_sudo_command(f"docker restart {self.container_name}")
return clients
def _parse_users_from_config(self, config_text):
users = {}
lines = config_text.split('\n')
in_section = False
for line in lines:
stripped = line.strip()
if stripped == '[access.users]':
in_section = True
continue
if in_section and stripped.startswith('['):
break
if in_section and stripped:
commented = stripped.startswith('#')
content = stripped.lstrip('#').strip()
if '=' in content:
if content.lower().startswith('format:'): continue
name, secret = content.split('=', 1)
name = name.strip().strip('"').strip()
secret = secret.strip().strip('"').strip()
full_name = ("# " + name) if commented else name
users[full_name] = secret
return users
def add_client(self, protocol_type, name, host='', port='', **kwargs):
username = re.sub(r'[^a-zA-Z0-9_.-]', '', name.replace(' ', '_'))
if not username: username = "user_" + uuid.uuid4().hex[:8]
config_text = self._get_server_config()
current_users = self._parse_users_from_config(config_text)
idx = 1
base_username = username
while any(u.lstrip('#').strip() == username for u in current_users):
username = f"{base_username}_{idx}"
idx += 1
secret = kwargs.get('secret') or secrets.token_hex(16)
# 1. Update config file for persistence (but don't restart yet)
config_text = self._insert_into_section(config_text, "access.users", f'{username} = "{secret}"')
api_payload = {
"username": username,
"secret": secret
}
if kwargs.get('telemt_quota'):
val = int(kwargs['telemt_quota'])
config_text = self._insert_into_section(config_text, "access.user_data_quota", f'{username} = {val}')
api_payload['data_quota_bytes'] = val
if kwargs.get('telemt_max_ips'):
val = int(kwargs['telemt_max_ips'])
config_text = self._insert_into_section(config_text, "access.user_max_unique_ips", f'{username} = {val}')
api_payload['max_unique_ips'] = val
if kwargs.get('telemt_expiry'):
val = kwargs['telemt_expiry']
config_text = self._insert_into_section(config_text, "access.user_expirations", f'{username} = "{val}"')
api_payload['expiration_rfc3339'] = val
if kwargs.get('user_ad_tag'):
val = kwargs['user_ad_tag']
config_text = self._insert_into_section(config_text, "access.user_ad_tags", f'{username} = "{val}"')
api_payload['user_ad_tag'] = val
if kwargs.get('max_tcp_conns'):
val = int(kwargs['max_tcp_conns'])
config_text = self._insert_into_section(config_text, "access.user_max_tcp_conns", f'{username} = {val}')
api_payload['max_tcp_conns'] = val
# Save config to host
self.ssh.upload_file_sudo(config_text.replace('\r\n', '\n'), f"{self._config_path()}")
# 2. Call API for immediate effect
self._api_request("POST", "/v1/users", data=api_payload)
# Fetch the official link from API (it includes TLS emulation padding like 'ee...' if enabled)
link = self.get_client_config(protocol_type, username, host, port)
# Extreme fallback if API is slow or 404
if link == "Not found":
link = f"tg://proxy?server={host}&port={port}&secret={secret}"
return {
"client_id": username,
"config": link,
"vpn_link": link
}
def edit_client(self, protocol_type, client_id, new_params):
"""Update existing client parameters via API and in config."""
config_text = self._get_server_config()
api_payload = {}
if 'telemt_quota' in new_params:
val = int(new_params['telemt_quota']) if new_params['telemt_quota'] else None
config_text = self._update_line_in_section(config_text, "access.user_data_quota", client_id, val)
api_payload['data_quota_bytes'] = val
if 'telemt_max_ips' in new_params:
val = int(new_params['telemt_max_ips']) if new_params['telemt_max_ips'] else None
config_text = self._update_line_in_section(config_text, "access.user_max_unique_ips", client_id, val)
api_payload['max_unique_ips'] = val
if 'telemt_expiry' in new_params:
val = new_params['telemt_expiry']
quoted_val = f'"{val}"' if val else None
config_text = self._update_line_in_section(config_text, "access.user_expirations", client_id, quoted_val)
api_payload['expiration_rfc3339'] = val
if 'secret' in new_params:
val = new_params['secret']
quoted_val = f'"{val}"' if val else None
config_text = self._update_line_in_section(config_text, "access.users", client_id, quoted_val)
api_payload['secret'] = val
if 'user_ad_tag' in new_params:
val = new_params['user_ad_tag']
quoted_val = f'"{val}"' if val else None
config_text = self._update_line_in_section(config_text, "access.user_ad_tags", client_id, quoted_val)
api_payload['user_ad_tag'] = val
if 'max_tcp_conns' in new_params:
val = int(new_params['max_tcp_conns']) if new_params['max_tcp_conns'] else None
config_text = self._update_line_in_section(config_text, "access.user_max_tcp_conns", client_id, val)
api_payload['max_tcp_conns'] = val
# Save config to host
self.ssh.upload_file_sudo(config_text.replace('\r\n', '\n'), f"{self._config_path()}")
# API call
self._api_request("PATCH", f"/v1/users/{client_id}", data=api_payload)
return {"status": "success"}
def _update_line_in_section(self, config_text, section_name, client_id, value):
lines = config_text.split('\n')
section_start = -1
section_end = -1
for i, line in enumerate(lines):
if line.strip() == f"[{section_name}]":
section_start = i
elif section_start != -1 and line.strip().startswith('['):
section_end = i
break
if section_end == -1: section_end = len(lines)
if section_start == -1:
if value is not None:
lines.append(f"[{section_name}]")
lines.append(f'{client_id} = {value}')
lines.append("")
return '\n'.join(lines)
found = False
for i in range(section_start + 1, section_end):
line = lines[i].strip().lstrip('#').strip()
if line.startswith(f"{client_id} ") or line.startswith(f"{client_id}="):
if value is None: lines.pop(i)
else: lines[i] = f'{client_id} = {value}'
found = True
break
if not found and value is not None:
lines.insert(section_start + 1, f'{client_id} = {value}')
return '\n'.join(lines)
def _insert_into_section(self, config_text, section_name, line_to_insert):
lines = config_text.split('\n')
section_start = -1
for i, line in enumerate(lines):
if line.strip() == f"[{section_name}]":
section_start = i
break
if section_start == -1:
lines.append(f"[{section_name}]")
lines.append(line_to_insert)
lines.append("")
else:
lines.insert(section_start + 1, line_to_insert)
return '\n'.join(lines)
def remove_client(self, protocol_type, client_id):
# 1. API
self._api_request("DELETE", f"/v1/users/{client_id}")
# 2. Config
config_text = self._get_server_config()
lines = config_text.split('\n')
new_lines = []
for line in lines:
stripped = line.strip().lstrip('#').strip()
if stripped.startswith(f"{client_id} ") or stripped.startswith(f"{client_id}="):
continue
new_lines.append(line)
self.ssh.upload_file_sudo('\n'.join(new_lines).replace('\r\n', '\n'), f"{self._config_path()}")
def toggle_client(self, protocol_type, client_id, enable, restart=True):
# API doesn't have a direct "toggle", so we either set a huge quota or remove/re-add
# But for Telemt, commenting out in config is the persistent way.
# We'll use HUP after toggling in config.
config_text = self._get_server_config()
lines = config_text.split('\n')
new_lines = []
in_access_section = False
for line in lines:
stripped = line.strip()
if stripped.startswith('[access.'): in_access_section = True
elif stripped.startswith('['): in_access_section = False
if in_access_section:
base_line = line.lstrip('#').strip()
if base_line.startswith(f"{client_id} ") or base_line.startswith(f"{client_id}="):
line = base_line if enable else f"# {base_line}"
new_lines.append(line)
self.ssh.upload_file_sudo('\n'.join(new_lines).replace('\r\n', '\n'), f"{self._config_path()}")
if enable:
# If enabling, we re-add via API since it might have been deleted from memory
secret = ""
users = self._parse_users_from_config('\n'.join(new_lines))
secret = users.get(client_id, "")
if secret:
self._api_request("POST", "/v1/users", data={"username": client_id, "secret": secret})
else:
# If disabling, we just delete from memory
self._api_request("DELETE", f"/v1/users/{client_id}")
if restart:
self.ssh.run_sudo_command(f"docker kill -s HUP {self.container_name} || docker restart {self.container_name}")
def get_client_config(self, protocol_type, client_id, host='', port=''):
resp = self._api_request("GET", f"/v1/users/{client_id}")
if resp and resp.get('ok'):
user = resp.get('data', {})
links = user.get('links', {})
if links.get('tls'): return links['tls'][0]
if links.get('secure'): return links['secure'][0]
if links.get('classic'): return links['classic'][0]
clients = self.get_clients(protocol_type)
c = next((c for c in clients if c['clientId'] == client_id), None)
if c:
secret = c.get('userData', {}).get('token', '')
if secret: return f"tg://proxy?server={host}&port={port}&secret={secret}"
return "Not found"
managers/wireguard_manager.py
+823
View File
@@ -0,0 +1,823 @@
"""
WireGuard Protocol Manager - handles standard WireGuard protocol
installation, configuration, and client management on remote servers.
Follows the same architecture as awg_manager.py, using:
- client/server_scripts/wireguard/ scripts as reference
- Docker container: amneziavpn/amnezia-wg (same as AWG Legacy)
- Standard wg/wg-quick tools
"""
import json
import re
import secrets
import logging
from base64 import b64encode
from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
from cryptography.hazmat.primitives import serialization
logger = logging.getLogger(__name__)
WG_DEFAULTS = {
'port': '51820',
'mtu': '1420',
'subnet_address': '10.8.2.0',
'subnet_cidr': '24',
'subnet_ip': '10.8.2.1',
'dns1': '1.1.1.1',
'dns2': '1.0.0.1',
}
def generate_wg_keypair():
"""Generate a WireGuard X25519 keypair (private, public) as base64 strings."""
private_key = X25519PrivateKey.generate()
private_bytes = private_key.private_bytes(
encoding=serialization.Encoding.Raw,
format=serialization.PrivateFormat.Raw,
encryption_algorithm=serialization.NoEncryption()
)
public_bytes = private_key.public_key().public_bytes(
encoding=serialization.Encoding.Raw,
format=serialization.PublicFormat.Raw
)
return b64encode(private_bytes).decode(), b64encode(public_bytes).decode()
def generate_psk():
"""Generate a WireGuard preshared key."""
return b64encode(secrets.token_bytes(32)).decode()
class WireGuardManager:
"""Manages standard WireGuard protocol installation and client management."""
PROTOCOL = 'wireguard'
CONTAINER_NAME = 'amnezia-wireguard'
DOCKER_IMAGE = 'amneziavpn/amnezia-wg:latest'
CONFIG_PATH = '/opt/amnezia/wireguard/wg0.conf'
KEY_DIR = '/opt/amnezia/wireguard'
CLIENTS_TABLE_PATH = '/opt/amnezia/wireguard/clientsTable'
INTERFACE = 'wg0'
def __init__(self, ssh_manager):
self.ssh = ssh_manager
# ===================== INSTALLATION =====================
def check_docker_installed(self):
"""Check if Docker is installed and running."""
out, err, code = self.ssh.run_command("docker --version 2>/dev/null")
if code != 0:
return False
out2, _, code2 = self.ssh.run_command(
"systemctl is-active docker 2>/dev/null || service docker status 2>/dev/null"
)
return 'active' in out2 or 'running' in out2.lower()
def install_docker(self):
"""Install Docker on the server."""
script = r"""
if which apt-get > /dev/null 2>&1; then pm=$(which apt-get); silent_inst="-yq install"; check_pkgs="-yq update"; docker_pkg="docker.io"; dist="debian";
elif which dnf > /dev/null 2>&1; then pm=$(which dnf); silent_inst="-yq install"; check_pkgs="-yq check-update"; docker_pkg="docker"; dist="fedora";
elif which yum > /dev/null 2>&1; then pm=$(which yum); silent_inst="-y -q install"; check_pkgs="-y -q check-update"; docker_pkg="docker"; dist="centos";
else echo "Packet manager not found"; exit 1; fi;
if [ "$dist" = "debian" ]; then export DEBIAN_FRONTEND=noninteractive; fi;
if ! command -v docker > /dev/null 2>&1; then
$pm $check_pkgs; $pm $silent_inst $docker_pkg;
sleep 5; systemctl enable --now docker; sleep 5;
fi;
if [ "$(systemctl is-active docker)" != "active" ]; then
$pm $check_pkgs; $pm $silent_inst $docker_pkg;
sleep 5; systemctl start docker; sleep 5;
fi;
docker --version
"""
out, err, code = self.ssh.run_sudo_script(script, timeout=180)
if code != 0:
raise RuntimeError(f"Failed to install Docker: {err}")
return out
def check_container_running(self):
"""Check if WireGuard container is running."""
out, _, code = self.ssh.run_sudo_command(
f"docker ps --filter name=^{self.CONTAINER_NAME}$ --format '{{{{.Status}}}}'"
)
return 'Up' in out
def check_protocol_installed(self):
"""Check if protocol is installed (container exists)."""
out, _, code = self.ssh.run_sudo_command(
f"docker ps -a --filter name=^{self.CONTAINER_NAME}$ --format '{{{{.Names}}}}'"
)
return self.CONTAINER_NAME in out.strip().split('\n')
def prepare_host(self):
"""Prepare host for container."""
dockerfile_folder = f"/opt/amnezia/{self.CONTAINER_NAME}"
script = f"""
mkdir -p {dockerfile_folder}
mkdir -p {self.KEY_DIR}
if ! docker network ls | grep -q amnezia-dns-net; then
docker network create --driver bridge --subnet=172.29.172.0/24 --opt com.docker.network.bridge.name=amn0 amnezia-dns-net
fi
"""
out, err, code = self.ssh.run_sudo_script(script)
if code != 0:
logger.warning(f"prepare_host warning: {err}")
return True
def setup_firewall(self):
"""Setup host firewall."""
script = """
sysctl -w net.ipv4.ip_forward=1
iptables -C INPUT -p icmp --icmp-type echo-request -j DROP 2>/dev/null || iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
iptables -C FORWARD -j DOCKER-USER 2>/dev/null || iptables -A FORWARD -j DOCKER-USER 2>/dev/null
"""
self.ssh.run_sudo_script(script)
return True
def install_protocol(self, port=None):
"""
Full installation of WireGuard protocol.
Steps: install docker -> prepare host -> build container ->
configure container -> run container -> setup firewall
"""
if port is None:
port = WG_DEFAULTS['port']
results = []
# Step 1: Install Docker
if not self.check_docker_installed():
results.append("Installing Docker...")
self.install_docker()
results.append("Docker installed successfully")
else:
results.append("Docker already installed")
# Step 2: Prepare host
results.append("Preparing host...")
self.prepare_host()
results.append("Host prepared")
# Step 3: Remove old container if exists
if self.check_protocol_installed():
results.append("Removing old container...")
self.remove_container()
results.append("Old container removed")
# Step 4: Build container
results.append("Building Docker image...")
dockerfile_folder = f"/opt/amnezia/{self.CONTAINER_NAME}"
dockerfile_content = (
f"FROM {self.DOCKER_IMAGE}\n"
f"\n"
f'LABEL maintainer="AmneziaVPN"\n'
f"\n"
f"RUN apk add --no-cache curl wireguard-tools dumb-init iptables bash\n"
f"RUN apk --update upgrade --no-cache\n"
f"\n"
f"RUN mkdir -p /opt/amnezia\n"
f'RUN echo "#!/bin/bash" > /opt/amnezia/start.sh && '
f'echo "tail -f /dev/null" >> /opt/amnezia/start.sh\n'
f"RUN chmod a+x /opt/amnezia/start.sh\n"
f"\n"
f'ENTRYPOINT [ "dumb-init", "/opt/amnezia/start.sh" ]\n'
)
self.ssh.run_sudo_command(f"mkdir -p {dockerfile_folder}")
self.ssh.upload_file_sudo(dockerfile_content, f"{dockerfile_folder}/Dockerfile")
out, err, code = self.ssh.run_sudo_command(
f"docker build --no-cache --pull -t {self.CONTAINER_NAME} {dockerfile_folder}",
timeout=300
)
if code != 0:
raise RuntimeError(f"Failed to build container: {err}")
results.append("Docker image built successfully")
# Step 5: Run container
results.append("Starting container...")
run_cmd = f"""docker run -d \
--restart always \
--privileged \
--cap-add=NET_ADMIN \
--cap-add=SYS_MODULE \
-p {port}:{port}/udp \
-v /lib/modules:/lib/modules \
--sysctl="net.ipv4.conf.all.src_valid_mark=1" \
--name {self.CONTAINER_NAME} \
{self.CONTAINER_NAME}"""
out, err, code = self.ssh.run_sudo_command(run_cmd)
if code != 0:
raise RuntimeError(f"Failed to run container: {err}")
# Connect to DNS network
self.ssh.run_sudo_command(f"docker network connect amnezia-dns-net {self.CONTAINER_NAME}")
# Wait for container
results.append("Waiting for container to start...")
self._wait_container_running()
results.append("Container started")
# Step 6: Configure container
results.append("Configuring WireGuard...")
self._configure_container(port)
results.append("WireGuard configured")
# Step 7: Upload start script
results.append("Starting WireGuard service...")
self._upload_start_script(port)
results.append("WireGuard service started")
# Step 8: Setup firewall
results.append("Setting up firewall...")
self.setup_firewall()
results.append("Firewall configured")
return {
'status': 'success',
'protocol': self.PROTOCOL,
'port': port,
'log': results,
}
def _wait_container_running(self, timeout=30):
"""Wait for a container to be in 'running' state."""
import time
last_status = 'unknown'
for i in range(timeout // 2):
out, _, _ = self.ssh.run_sudo_command(
f"docker inspect --format='{{{{.State.Status}}}}' {self.CONTAINER_NAME}"
)
last_status = out.strip().strip("'\"")
if last_status == 'running':
time.sleep(1)
return True
time.sleep(2)
logs_out, _, _ = self.ssh.run_sudo_command(
f"docker logs --tail 50 {self.CONTAINER_NAME} 2>&1"
)
raise RuntimeError(
f"Container {self.CONTAINER_NAME} did not start within {timeout}s "
f"(status: {last_status}). Logs:\n{logs_out}"
)
def _configure_container(self, port):
"""Configure the WireGuard container (generate keys and server config)."""
subnet_ip = WG_DEFAULTS['subnet_ip']
subnet_cidr = WG_DEFAULTS['subnet_cidr']
config_script = f"""
mkdir -p {self.KEY_DIR}
cd {self.KEY_DIR}
WIREGUARD_SERVER_PRIVATE_KEY=$(wg genkey)
echo $WIREGUARD_SERVER_PRIVATE_KEY > {self.KEY_DIR}/wireguard_server_private_key.key
WIREGUARD_SERVER_PUBLIC_KEY=$(echo $WIREGUARD_SERVER_PRIVATE_KEY | wg pubkey)
echo $WIREGUARD_SERVER_PUBLIC_KEY > {self.KEY_DIR}/wireguard_server_public_key.key
WIREGUARD_PSK=$(wg genpsk)
echo $WIREGUARD_PSK > {self.KEY_DIR}/wireguard_psk.key
cat > {self.CONFIG_PATH} <<EOF
[Interface]
PrivateKey = $WIREGUARD_SERVER_PRIVATE_KEY
Address = {subnet_ip}/{subnet_cidr}
ListenPort = {port}
EOF
"""
out, err, code = self.ssh.run_sudo_command(
f"docker exec -i {self.CONTAINER_NAME} bash -c '{config_script}'"
)
if code != 0:
raise RuntimeError(f"Failed to configure container: {err}")
def _upload_start_script(self, port):
"""Upload and execute the start script inside the container."""
subnet_ip = WG_DEFAULTS['subnet_ip']
subnet_cidr = WG_DEFAULTS['subnet_cidr']
start_script = f"""#!/bin/bash
echo "WireGuard container startup"
# Kill existing wg-quick if running
wg-quick down {self.CONFIG_PATH} 2>/dev/null
# Start WireGuard
if [ -f {self.CONFIG_PATH} ]; then wg-quick up {self.CONFIG_PATH}; fi
# Allow traffic on the TUN interface
iptables -A INPUT -i {self.INTERFACE} -j ACCEPT
iptables -A FORWARD -i {self.INTERFACE} -j ACCEPT
iptables -A OUTPUT -o {self.INTERFACE} -j ACCEPT
iptables -A FORWARD -i {self.INTERFACE} -o eth0 -s {subnet_ip}/{subnet_cidr} -j ACCEPT
iptables -A FORWARD -i {self.INTERFACE} -o eth1 -s {subnet_ip}/{subnet_cidr} -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -s {subnet_ip}/{subnet_cidr} -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s {subnet_ip}/{subnet_cidr} -o eth1 -j MASQUERADE
tail -f /dev/null
"""
self.ssh.upload_file(start_script, "/tmp/_wg_start.sh")
self.ssh.run_sudo_command(f"docker cp /tmp/_wg_start.sh {self.CONTAINER_NAME}:/opt/amnezia/start.sh")
self.ssh.run_sudo_command(f"docker exec {self.CONTAINER_NAME} chmod +x /opt/amnezia/start.sh")
self.ssh.run_command("rm -f /tmp/_wg_start.sh")
self.ssh.run_sudo_command(f"docker restart {self.CONTAINER_NAME}")
import time
time.sleep(5)
def remove_container(self):
"""Remove WireGuard container."""
self.ssh.run_sudo_command(f"docker stop {self.CONTAINER_NAME}")
self.ssh.run_sudo_command(f"docker rm -fv {self.CONTAINER_NAME}")
self.ssh.run_sudo_command(f"docker rmi {self.CONTAINER_NAME}")
return True
# ===================== CLIENT MANAGEMENT =====================
def _get_clients_table(self):
"""Get the clients table from the server."""
out, err, code = self.ssh.run_sudo_command(
f"docker exec -i {self.CONTAINER_NAME} cat {self.CLIENTS_TABLE_PATH} 2>/dev/null"
)
if code != 0 or not out.strip():
return []
try:
data = json.loads(out)
if isinstance(data, list):
return data
return []
except json.JSONDecodeError:
return []
def _save_clients_table(self, clients_table):
"""Save the clients table to the server."""
content = json.dumps(clients_table, indent=2)
self.ssh.upload_file(content, "/tmp/_wg_clients.json")
self.ssh.run_sudo_command(
f"docker cp /tmp/_wg_clients.json {self.CONTAINER_NAME}:{self.CLIENTS_TABLE_PATH}"
)
self.ssh.run_command("rm -f /tmp/_wg_clients.json")
def _get_server_config(self):
"""Get the server WireGuard config."""
out, err, code = self.ssh.run_sudo_command(
f"docker exec -i {self.CONTAINER_NAME} cat {self.CONFIG_PATH}"
)
if code != 0:
raise RuntimeError(f"Failed to get server config: {err}")
return out
def save_server_config(self, config_content):
"""Save the server WireGuard config and restart container."""
self.ssh.upload_file(config_content.replace('\r\n', '\n'), "/tmp/_wg_edit_config.conf")
self.ssh.run_sudo_command(f"docker cp /tmp/_wg_edit_config.conf {self.CONTAINER_NAME}:{self.CONFIG_PATH}")
self.ssh.run_command("rm -f /tmp/_wg_edit_config.conf")
self.ssh.run_sudo_command(f"docker restart {self.CONTAINER_NAME}")
def _get_server_public_key(self):
"""Get server public key."""
out, err, code = self.ssh.run_sudo_command(
f"docker exec -i {self.CONTAINER_NAME} cat {self.KEY_DIR}/wireguard_server_public_key.key"
)
if code != 0:
raise RuntimeError(f"Failed to get server public key: {err}")
return out.strip()
def _get_server_psk(self):
"""Get server preshared key."""
out, err, code = self.ssh.run_sudo_command(
f"docker exec -i {self.CONTAINER_NAME} cat {self.KEY_DIR}/wireguard_psk.key"
)
if code != 0:
raise RuntimeError(f"Failed to get PSK: {err}")
return out.strip()
def _get_listen_port(self):
"""Extract ListenPort from server config."""
config = self._get_server_config()
for line in config.split('\n'):
if line.strip().startswith('ListenPort'):
return line.split('=', 1)[1].strip()
return WG_DEFAULTS['port']
def _get_used_ips(self):
"""Get list of IPs already assigned in the config."""
config = self._get_server_config()
ips = []
for line in config.split('\n'):
line = line.strip()
if line.startswith('AllowedIPs'):
match = re.search(r'(\d+\.\d+\.\d+\.\d+)', line)
if match:
ips.append(match.group(1))
elif line.startswith('Address'):
match = re.search(r'(\d+\.\d+\.\d+\.\d+)', line)
if match:
ips.append(match.group(1))
return ips
def _get_next_ip(self):
"""Calculate the next available IP for a new client."""
used_ips = self._get_used_ips()
if not used_ips:
base = WG_DEFAULTS['subnet_address']
parts = base.split('.')
parts[3] = '2'
return '.'.join(parts)
last_ip = used_ips[-1]
parts = last_ip.split('.')
last_octet = int(parts[3])
next_octet = last_octet + 1
if next_octet > 254:
next_octet = 2
parts[3] = str(next_octet)
return '.'.join(parts)
def _parse_peers_from_config(self):
"""Parse [Peer] sections from WireGuard server config."""
try:
config = self._get_server_config()
except Exception:
return {}
peers = {}
current_key = None
for line in config.split('\n'):
line = line.strip()
if line == '[Peer]':
current_key = None
elif current_key is None and line.startswith('PublicKey'):
current_key = line.split('=', 1)[1].strip()
peers[current_key] = {'allowedIps': ''}
elif current_key and line.startswith('AllowedIPs'):
peers[current_key]['allowedIps'] = line.split('=', 1)[1].strip()
return peers
def _parse_bytes(self, size_str):
"""Parse human readable size string into bytes."""
try:
parts = size_str.strip().split()
if len(parts) != 2:
return 0
val, unit = float(parts[0]), parts[1]
units = {'B': 1, 'KiB': 1024, 'MiB': 1024**2, 'GiB': 1024**3, 'TiB': 1024**4}
return int(val * units.get(unit, 1))
except Exception:
return 0
def _wg_show(self):
"""Run 'wg show all' and parse output."""
out, err, code = self.ssh.run_sudo_command(
f"docker exec -i {self.CONTAINER_NAME} bash -c 'wg show all'"
)
if code != 0 or not out.strip():
return {}
result = {}
current_peer = None
for line in out.split('\n'):
line = line.strip()
if line.startswith('peer:'):
current_peer = line.split(':', 1)[1].strip()
result[current_peer] = {}
elif current_peer and ':' in line:
key, value = line.split(':', 1)
key = key.strip()
value = value.strip()
if key == 'latest handshake':
result[current_peer]['latestHandshake'] = value
elif key == 'transfer':
parts = value.split(',')
if len(parts) == 2:
received = parts[0].strip().replace(' received', '')
sent = parts[1].strip().replace(' sent', '')
result[current_peer]['dataReceived'] = received
result[current_peer]['dataSent'] = sent
result[current_peer]['dataReceivedBytes'] = self._parse_bytes(received)
result[current_peer]['dataSentBytes'] = self._parse_bytes(sent)
elif key == 'allowed ips':
result[current_peer]['allowedIps'] = value
return result
def get_clients(self):
"""Get list of all clients with live traffic data."""
clients_table = self._get_clients_table()
try:
wg_show_data = self._wg_show()
except Exception:
wg_show_data = {}
known_ids = set()
for client in clients_table:
client_id = client.get('clientId', '')
known_ids.add(client_id)
if client_id in wg_show_data:
show_data = wg_show_data[client_id]
user_data = client.get('userData', {})
user_data['latestHandshake'] = show_data.get('latestHandshake', '')
user_data['dataReceived'] = show_data.get('dataReceived', '')
user_data['dataSent'] = show_data.get('dataSent', '')
user_data['dataReceivedBytes'] = show_data.get('dataReceivedBytes', 0)
user_data['dataSentBytes'] = show_data.get('dataSentBytes', 0)
user_data['allowedIps'] = show_data.get('allowedIps', '')
client['userData'] = user_data
# Pick up peers from conf not in clientsTable (native app clients)
try:
conf_peers = self._parse_peers_from_config()
for pub_key, peer_info in conf_peers.items():
if pub_key in known_ids:
continue
show_data = wg_show_data.get(pub_key, {})
allowed_ip = peer_info.get('allowedIps', '') or show_data.get('allowedIps', '')
ip_part = ''
if allowed_ip:
m = re.search(r'(\d+\.\d+\.\d+\.\d+)', allowed_ip)
if m:
ip_part = m.group(1)
display_name = f'External ({ip_part})' if ip_part else 'External (native app)'
clients_table.append({
'clientId': pub_key,
'userData': {
'clientName': display_name,
'clientPrivateKey': '',
'externalClient': True,
'clientIp': ip_part,
'latestHandshake': show_data.get('latestHandshake', ''),
'dataReceived': show_data.get('dataReceived', ''),
'dataSent': show_data.get('dataSent', ''),
'dataReceivedBytes': show_data.get('dataReceivedBytes', 0),
'dataSentBytes': show_data.get('dataSentBytes', 0),
'allowedIps': allowed_ip,
}
})
except Exception as e:
logger.warning(f'get_clients: failed to parse conf peers: {e}')
return clients_table
def add_client(self, client_name, server_host):
"""
Add a new client/peer to the WireGuard config.
Returns the client config string.
"""
# Generate client keys
client_priv_key, client_pub_key = generate_wg_keypair()
# Get server info
server_pub_key = self._get_server_public_key()
psk = self._get_server_psk()
port = self._get_listen_port()
# Get next available IP
client_ip = self._get_next_ip()
dns1 = WG_DEFAULTS['dns1']
dns2 = WG_DEFAULTS['dns2']
# Check if AmneziaDNS is installed
out, _, _ = self.ssh.run_sudo_command("docker ps -a --filter name=^amnezia-dns$ --format '{{.Names}}'")
if 'amnezia-dns' in out:
dns1 = '172.29.172.254'
mtu = WG_DEFAULTS['mtu']
# Append peer to server config
peer_section = f"""
[Peer]
PublicKey = {client_pub_key}
PresharedKey = {psk}
AllowedIPs = {client_ip}/32
"""
escaped_peer = peer_section.replace("'", "'\\''")
self.ssh.run_sudo_command(
f"docker exec -i {self.CONTAINER_NAME} bash -c 'echo \"{escaped_peer}\" >> {self.CONFIG_PATH}'"
)
# Sync config without restart
self.ssh.run_sudo_command(
f"docker exec -i {self.CONTAINER_NAME} bash -c 'wg syncconf {self.INTERFACE} <(wg-quick strip {self.CONFIG_PATH})'"
)
# Update clients table
clients_table = self._get_clients_table()
new_client = {
'clientId': client_pub_key,
'userData': {
'clientName': client_name,
'creationDate': __import__('datetime').datetime.now().isoformat(),
'clientPrivateKey': client_priv_key,
'clientIp': client_ip,
'psk': psk,
'enabled': True,
}
}
clients_table.append(new_client)
self._save_clients_table(clients_table)
# Build client config
client_config = f"""[Interface]
Address = {client_ip}/32
DNS = {dns1}, {dns2}
PrivateKey = {client_priv_key}
MTU = {mtu}
[Peer]
PublicKey = {server_pub_key}
PresharedKey = {psk}
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = {server_host}:{port}
PersistentKeepalive = 25
"""
return {
'client_name': client_name,
'client_id': client_pub_key,
'client_ip': client_ip,
'config': client_config,
}
def get_client_config(self, client_id, server_host):
"""Reconstruct client config from stored data."""
clients_table = self._get_clients_table()
client = next((c for c in clients_table if c.get('clientId') == client_id), None)
if not client:
raise RuntimeError(f"Client {client_id} not found")
ud = client.get('userData', {})
client_priv_key = ud.get('clientPrivateKey', '')
client_ip = ud.get('clientIp', '')
psk = ud.get('psk', '')
if not client_priv_key:
raise RuntimeError("Client private key not stored. Config cannot be reconstructed.")
server_pub_key = self._get_server_public_key()
if not psk:
psk = self._get_server_psk()
port = self._get_listen_port()
dns1 = WG_DEFAULTS['dns1']
dns2 = WG_DEFAULTS['dns2']
# Check if AmneziaDNS is installed
out, _, _ = self.ssh.run_sudo_command("docker ps -a --filter name=^amnezia-dns$ --format '{{.Names}}'")
if 'amnezia-dns' in out:
dns1 = '172.29.172.254'
mtu = WG_DEFAULTS['mtu']
config = f"""[Interface]
Address = {client_ip}/32
DNS = {dns1}, {dns2}
PrivateKey = {client_priv_key}
MTU = {mtu}
[Peer]
PublicKey = {server_pub_key}
PresharedKey = {psk}
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = {server_host}:{port}
PersistentKeepalive = 25
"""
return config
def toggle_client(self, client_id, enable):
"""Enable or disable a client by adding/removing their [Peer] from server config."""
if enable:
clients_table = self._get_clients_table()
client = next((c for c in clients_table if c.get('clientId') == client_id), None)
if not client:
raise RuntimeError(f"Client {client_id} not found")
ud = client.get('userData', {})
psk = ud.get('psk', '') or self._get_server_psk()
client_ip = ud.get('clientIp', '')
peer_section = f"""
[Peer]
PublicKey = {client_id}
PresharedKey = {psk}
AllowedIPs = {client_ip}/32
"""
escaped_peer = peer_section.replace("'", "'\\''")
self.ssh.run_sudo_command(
f"docker exec -i {self.CONTAINER_NAME} bash -c 'echo \"{escaped_peer}\" >> {self.CONFIG_PATH}'"
)
else:
# Remove peer from server config
config = self._get_server_config()
sections = config.split('[')
new_sections = [s for s in sections if s.strip() and client_id not in s]
new_config = '[' + '['.join(new_sections)
self.ssh.upload_file(new_config, "/tmp/_wg_config.conf")
self.ssh.run_sudo_command(
f"docker cp /tmp/_wg_config.conf {self.CONTAINER_NAME}:{self.CONFIG_PATH}"
)
self.ssh.run_command("rm -f /tmp/_wg_config.conf")
# Sync config
self.ssh.run_sudo_command(
f"docker exec -i {self.CONTAINER_NAME} bash -c 'wg syncconf {self.INTERFACE} <(wg-quick strip {self.CONFIG_PATH})'"
)
# Update enabled status in clients table
clients_table = self._get_clients_table()
for c in clients_table:
if c.get('clientId') == client_id:
c.setdefault('userData', {})['enabled'] = enable
break
self._save_clients_table(clients_table)
def remove_client(self, client_id):
"""Remove a client from WireGuard config."""
config = self._get_server_config()
sections = config.split('[')
new_sections = [s for s in sections if s.strip() and client_id not in s]
new_config = '[' + '['.join(new_sections)
self.ssh.upload_file(new_config, "/tmp/_wg_config.conf")
self.ssh.run_sudo_command(
f"docker cp /tmp/_wg_config.conf {self.CONTAINER_NAME}:{self.CONFIG_PATH}"
)
self.ssh.run_command("rm -f /tmp/_wg_config.conf")
# Sync config
self.ssh.run_sudo_command(
f"docker exec -i {self.CONTAINER_NAME} bash -c 'wg syncconf {self.INTERFACE} <(wg-quick strip {self.CONFIG_PATH})'"
)
# Update clients table
clients_table = self._get_clients_table()
clients_table = [c for c in clients_table if c.get('clientId') != client_id]
self._save_clients_table(clients_table)
return True
def get_server_status(self):
"""Get detailed status of the WireGuard server."""
info = {
'container_exists': self.check_protocol_installed(),
'container_running': False,
'protocol': self.PROTOCOL,
}
if info['container_exists']:
info['container_running'] = self.check_container_running()
if info['container_running']:
try:
config = self._get_server_config()
for line in config.split('\n'):
if 'ListenPort' in line:
info['port'] = line.split('=')[1].strip()
break
info['clients_count'] = len(self._get_clients_table())
except Exception as e:
info['error'] = str(e)
return info
def get_traffic_stats(self):
"""Get aggregate traffic stats for all clients."""
try:
wg_data = self._wg_show()
except Exception:
return {}
total_rx = 0
total_tx = 0
active_peers = 0
active_ips = []
for peer_key, data in wg_data.items():
rx = data.get('dataReceivedBytes', 0)
tx = data.get('dataSentBytes', 0)
total_rx += rx
total_tx += tx
if rx > 0 or tx > 0:
active_peers += 1
allowed = data.get('allowedIps', '')
if allowed:
m = re.search(r'(\d+\.\d+\.\d+\.\d+)', allowed)
if m:
active_ips.append(m.group(1))
return {
'total_rx_bytes': total_rx,
'total_tx_bytes': total_tx,
'active_connections': active_peers,
'active_ips': active_ips,
}
managers/xray_manager.py
+800
View File
@@ -0,0 +1,800 @@
import json
import os
import uuid
import logging
import base64
import shlex
from datetime import datetime
import urllib.parse
logger = logging.getLogger(__name__)
class XrayManager:
"""Manages Xray (VLESS-Reality) protocol installation and client management."""
PROTOCOL = 'xray'
CONTAINER_NAME = 'amnezia-xray'
IMAGE_NAME = 'amneziavpn/amnezia-xray' # or we can build it
def __init__(self, ssh_manager, protocol='xray'):
self.ssh = ssh_manager
self.protocol = protocol or self.PROTOCOL
self.base_protocol = str(self.protocol).split('__', 1)[0]
self.instance = self._instance_index(self.protocol)
self.container_name = self._container_name(self.protocol)
self.image_name = self._image_name(self.protocol)
def _instance_index(self, protocol):
parts = str(protocol or '').split('__', 1)
if len(parts) == 2:
try:
return max(1, int(parts[1]))
except ValueError:
return 1
return 1
def _container_name(self, protocol=None):
idx = self._instance_index(protocol or self.protocol)
base_name = self.CONTAINER_NAME
return base_name if idx <= 1 else f'{base_name}-{idx}'
def _image_name(self, protocol=None):
idx = self._instance_index(protocol or self.protocol)
base_name = self.IMAGE_NAME
return base_name if idx <= 1 else f'{base_name}-{idx}'
def _config_dir(self):
return '/opt/amnezia/xray' if self.instance <= 1 else f'/opt/amnezia/xray-{self.instance}'
def _config_path(self):
return f'{self._config_dir()}/server.json'
def _list_xray_files(self):
"""List filenames in the on-disk Xray config directory."""
out, _, code = self.ssh.run_sudo_command(f"ls -1 {self._config_dir()} 2>/dev/null")
if code != 0:
return []
return [f for f in out.strip().split('\n') if f]
def _detect_layout(self):
"""Pick which on-disk layout this installation uses.
'native' — official Amnezia client layout: xray_private.key,
xray_public.key, xray_short_id.key, xray_uuid.key plus a clientsTable
file without an extension.
'panel' — legacy web-panel layout: meta.json + clientsTable.json.
On a fresh node with no Xray files yet, defaults to 'native' so new
installs produce the same artifacts as the official client.
"""
if hasattr(self, '_cached_layout'):
return self._cached_layout
files = set(self._list_xray_files())
if {'xray_private.key', 'xray_public.key'} & files:
layout = 'native'
elif 'meta.json' in files:
layout = 'panel'
else:
layout = 'native'
self._cached_layout = layout
return layout
def _clients_table_filename(self):
return 'clientsTable' if self._detect_layout() == 'native' else 'clientsTable.json'
def _clients_table_path(self):
return f'{self._config_dir()}/{self._clients_table_filename()}'
def _read_remote_file(self, path):
"""Read a remote text file, preferring the running container's view."""
out, _, code = self.ssh.run_sudo_command(
f"docker exec {self.container_name} cat {path} 2>/dev/null"
)
if code != 0 or not out:
out, _, code = self.ssh.run_sudo_command(f"cat {path} 2>/dev/null")
if code != 0 or not out.strip():
return None
return out
def _derive_pubkey_from_priv(self, priv_key):
"""Derive the Reality public key from a private key via the xray binary.
Used as a fallback when xray_public.key is missing or unreadable.
"""
if not priv_key:
return ''
out, _, code = self.ssh.run_sudo_command(
f"docker exec {self.container_name} /usr/bin/xray x25519 -i {priv_key}"
)
if code != 0 or not out.strip():
out, _, code = self.ssh.run_sudo_command(
f"docker run --rm --entrypoint=\"\" {self.image_name} /usr/bin/xray x25519 -i {priv_key}"
)
if code != 0 or not out:
return ''
for line in out.split('\n'):
if 'Public' in line and ':' in line:
return line.split(':', 1)[1].strip()
return ''
def _get_default_xray_uuid(self):
"""UUID of the install-time default client (xray_uuid.key) — meaningful only
for native-layout installs. Imports skip this UUID, mirroring the official
Amnezia client behaviour (see usersController.cpp::getXrayClients).
"""
if self._detect_layout() != 'native':
return ''
out = self._read_remote_file(f"{self._config_dir()}/xray_uuid.key")
return (out or '').strip()
# ===================== INSTALLATION =====================
def check_docker_installed(self):
out, err, code = self.ssh.run_command("docker --version 2>/dev/null")
if code != 0: return False
out2, _, code2 = self.ssh.run_command("systemctl is-active docker 2>/dev/null || service docker status 2>/dev/null")
return 'active' in out2 or 'running' in out2.lower()
def check_container_running(self):
out, _, _ = self.ssh.run_sudo_command(
f"docker ps --filter name=^{self.container_name}$ --format '{{{{.Status}}}}'"
)
return 'Up' in out
def check_protocol_installed(self):
out, _, _ = self.ssh.run_sudo_command(
f"docker ps -a --filter name=^{self.container_name}$ --format '{{{{.Names}}}}'"
)
return self.container_name in out.strip().split('\n')
def get_server_status(self, protocol):
exists = self.check_protocol_installed()
running = self.check_container_running()
clients = self.get_clients() if exists else []
meta = self._get_meta_json() if exists else {}
return {
'container_exists': exists,
'container_running': running,
'clients_count': len(clients),
'port': meta.get('port')
}
def install_protocol(self, port=443, site_name='yahoo.com'):
"""Full installation of Xray."""
results = []
if not self.check_docker_installed():
results.append("Installing Docker...")
# Using same install method as AWGManager or assume it's installed
pass
results.append("Removing old container if exists...")
if self.check_protocol_installed():
self.remove_container()
results.append("Building Docker image...")
config_dir = self._config_dir()
dockerfile_folder = f"/opt/amnezia/{self.container_name}"
dockerfile_content = f"""FROM alpine:3.15
RUN apk add --no-cache curl unzip bash openssl netcat-openbsd dumb-init rng-tools xz iptables ip6tables
RUN apk --update upgrade --no-cache
RUN mkdir -p {config_dir}
RUN curl -L -H "Cache-Control: no-cache" -o /root/xray.zip "https://github.com/XTLS/Xray-core/releases/download/v26.3.27/Xray-linux-64.zip" && \\
unzip /root/xray.zip -d /usr/bin/ && \\
chmod a+x /usr/bin/xray && \\
rm /root/xray.zip
# Tune network
RUN echo "fs.file-max = 51200" >> /etc/sysctl.conf && \\
echo "net.core.rmem_max = 67108864" >> /etc/sysctl.conf && \\
echo "net.core.wmem_max = 67108864" >> /etc/sysctl.conf && \\
echo "net.core.netdev_max_backlog = 250000" >> /etc/sysctl.conf && \\
echo "net.core.somaxconn = 4096" >> /etc/sysctl.conf && \\
echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf && \\
echo "net.ipv4.tcp_tw_reuse = 1" >> /etc/sysctl.conf && \\
echo "net.ipv4.tcp_tw_recycle = 0" >> /etc/sysctl.conf && \\
echo "net.ipv4.tcp_fin_timeout = 30" >> /etc/sysctl.conf && \\
echo "net.ipv4.tcp_keepalive_time = 1200" >> /etc/sysctl.conf && \\
echo "net.ipv4.ip_local_port_range = 10000 65000" >> /etc/sysctl.conf && \\
echo "net.ipv4.tcp_max_syn_backlog = 8192" >> /etc/sysctl.conf && \\
echo "net.ipv4.tcp_max_tw_buckets = 5000" >> /etc/sysctl.conf && \\
echo "net.ipv4.tcp_fastopen = 3" >> /etc/sysctl.conf && \\
echo "net.ipv4.tcp_mem = 25600 51200 102400" >> /etc/sysctl.conf && \\
echo "net.ipv4.tcp_rmem = 4096 87380 67108864" >> /etc/sysctl.conf && \\
echo "net.ipv4.tcp_wmem = 4096 65536 67108864" >> /etc/sysctl.conf && \\
echo "net.ipv4.tcp_mtu_probing = 1" >> /etc/sysctl.conf && \\
echo "net.ipv4.tcp_congestion_control = hybla" >> /etc/sysctl.conf
RUN mkdir -p /etc/security && \\
echo "* soft nofile 51200" >> /etc/security/limits.conf && \\
echo "* hard nofile 51200" >> /etc/security/limits.conf
RUN echo '#!/bin/bash' > /opt/amnezia/start.sh && \\
echo 'sysctl -p /etc/sysctl.conf 2>/dev/null' >> /opt/amnezia/start.sh && \\
echo '/usr/bin/xray -config {config_dir}/server.json' >> /opt/amnezia/start.sh && \\
chmod a+x /opt/amnezia/start.sh
ENTRYPOINT [ "dumb-init", "/opt/amnezia/start.sh" ]
"""
self.ssh.run_sudo_command(f"mkdir -p {dockerfile_folder}")
self.ssh.upload_file_sudo(dockerfile_content, f"{dockerfile_folder}/Dockerfile")
_, err, code = self.ssh.run_sudo_command(
f"docker build --no-cache -t {self.image_name} {dockerfile_folder}", timeout=300
)
if code != 0: raise RuntimeError(f"Failed to build container: {err}")
results.append("Generating keys and config...")
# We generate a base config using a temp container or directly if host has openssl
# Xray keypair generation using a temporary run overriding the entrypoint
keypair_cmd = f"docker run --rm --entrypoint=\"\" {self.image_name} /usr/bin/xray x25519"
out_kp, err_kp, code_kp = self.ssh.run_sudo_command(keypair_cmd)
if code_kp != 0: raise RuntimeError(f"Failed to generate x25519 keys: {err_kp}")
priv_key = ""
pub_key = ""
for line in out_kp.split('\n'):
if "Private" in line: priv_key = line.split(":", 1)[1].strip()
if "Public" in line: pub_key = line.split(":", 1)[1].strip()
short_id_cmd = f"docker run --rm --entrypoint=\"\" {self.image_name} openssl rand -hex 8"
out_sid, _, _ = self.ssh.run_sudo_command(short_id_cmd)
short_id = out_sid.strip()
# Generate initial server.json with Stats and API enabled
server_json = {
"log": {"loglevel": "error"},
"stats": {},
"api": {
"services": ["StatsService", "LoggerService", "HandlerService"],
"tag": "api"
},
"policy": {
"levels": {
"0": {"statsUserUplink": True, "statsUserDownlink": True}
},
"system": {
"statsInboundUplink": True, "statsInboundDownlink": True,
"statsOutboundUplink": True, "statsOutboundDownlink": True
}
},
"inbounds": [
{
"port": int(port),
"protocol": "vless",
"tag": "proxy",
"settings": {
"clients": [],
"decryption": "none"
},
"streamSettings": {
"network": "tcp",
"security": "reality",
"realitySettings": {
"dest": f"{site_name}:443",
"serverNames": [site_name],
"privateKey": priv_key,
"shortIds": [short_id]
}
}
},
{
"listen": "127.0.0.1",
"port": 10085,
"protocol": "dokodemo-door",
"settings": {"address": "127.0.0.1"},
"tag": "api"
}
],
"outbounds": [{"protocol": "freedom"}],
"routing": {
"rules": [
{
"inboundTag": ["api"],
"outboundTag": "api",
"type": "field"
}
]
}
}
self.ssh.run_sudo_command(f"mkdir -p {config_dir}")
self.ssh.upload_file_sudo(json.dumps(server_json, indent=2), f"{config_dir}/server.json")
# Native layout — separate key files matching the official Amnezia client install.
# See client/server_scripts/xray/configure_container.sh for the canonical layout.
self.ssh.upload_file_sudo(priv_key + '\n', "/opt/amnezia/xray/xray_private.key")
self.ssh.upload_file_sudo(pub_key + '\n', "/opt/amnezia/xray/xray_public.key")
self.ssh.upload_file_sudo(short_id + '\n', "/opt/amnezia/xray/xray_short_id.key")
# xray_uuid.key marks the install-time "default" client whose ID gets skipped on
# auto-import. Panel installs do not reserve such a client, so we leave it empty.
self.ssh.upload_file_sudo('\n', "/opt/amnezia/xray/xray_uuid.key")
self.ssh.upload_file_sudo("[]", "/opt/amnezia/xray/clientsTable")
results.append("Starting container...")
run_cmd = f"""docker run -d \\
--restart always \\
--privileged \\
--cap-add=NET_ADMIN \\
-p {port}:{port}/tcp \\
-p {port}:{port}/udp \\
-v {config_dir}:{config_dir} \\
--name {self.container_name} \\
{self.image_name}"""
_, err, code = self.ssh.run_sudo_command(run_cmd)
if code != 0: raise RuntimeError(f"Failed to run container: {err}")
# Try to connect to network if needed
self.ssh.run_sudo_command(f"docker network connect amnezia-dns-net {self.container_name} || true")
results.append("Xray configured and running")
return {'status': 'success', 'protocol': self.protocol, 'port': port, 'log': results}
def remove_container(self):
self.ssh.run_sudo_command(f"docker stop {self.container_name}")
self.ssh.run_sudo_command(f"docker rm -fv {self.container_name}")
if self.instance <= 1:
self.ssh.run_sudo_command(f"docker rmi {self.image_name}")
return True
# ===================== CLIENT MANAGEMENT =====================
def _get_server_json(self):
"""Read server.json — tries inside container first, falls back to host path."""
out, _, code = self.ssh.run_sudo_command(
f"docker exec {self.container_name} cat {self._config_path()}"
)
if code != 0:
out, _, code = self.ssh.run_sudo_command(f"cat {self._config_path()}")
if code != 0 or not out.strip():
return None
return json.loads(out)
def _save_server_json(self, data):
return self._write_server_json(data, restart=True)
def _write_server_json(self, data, restart=True):
"""Write server.json into container via docker cp AND sync to host path."""
tmp_file = "/tmp/_xray_server.json"
self.ssh.upload_file_sudo(json.dumps(data, indent=2), tmp_file)
self.ssh.run_sudo_command(
f"docker cp {tmp_file} {self.container_name}:{self._config_path()}"
)
# Also keep host copy in sync (handles both volume-mount and no-mount installs)
self.ssh.run_sudo_command(
f"cp {tmp_file} {self._config_path()} 2>/dev/null || true"
)
if restart:
self.ssh.run_sudo_command(f"docker restart {self.container_name}")
def _get_vless_inbound(self, config):
for inbound in config.get('inbounds', []):
if inbound.get('protocol') == 'vless':
return inbound
return None
def _get_vless_inbound_tag(self, config):
inbound = self._get_vless_inbound(config)
return inbound.get('tag') if inbound else None
def _run_xray_api_json(self, subcommand, payload):
tmp_name = f"/tmp/_xray_api_{uuid.uuid4().hex}.json"
container_tmp = tmp_name
try:
self.ssh.upload_file_sudo(json.dumps(payload, indent=2), tmp_name)
_, err, code = self.ssh.run_sudo_command(
f"docker cp {tmp_name} {self.container_name}:{container_tmp}"
)
if code != 0:
return False, err
out, err, code = self.ssh.run_sudo_command(
f"docker exec -i {self.container_name} /usr/bin/xray api {subcommand} "
f"-server=127.0.0.1:10085 {container_tmp}"
)
return code == 0, err or out
finally:
self.ssh.run_sudo_command(f"rm -f {tmp_name}")
self.ssh.run_sudo_command(f"docker exec -i {self.container_name} rm -f {container_tmp} 2>/dev/null || true")
def _xray_api_add_user(self, config, client):
tag = self._get_vless_inbound_tag(config)
if not tag:
return False
payload = {
"inbounds": [{
"tag": tag,
"protocol": "vless",
"settings": {
"clients": [client],
"decryption": "none",
}
}]
}
ok, message = self._run_xray_api_json('adu', payload)
if not ok:
logger.warning(f"Xray API add user failed: {message}")
return False
return True
def _xray_api_remove_user(self, config, client_id):
tag = self._get_vless_inbound_tag(config)
if not tag:
return False
cmd = (
f"docker exec -i {self.container_name} /usr/bin/xray api rmu "
f"-server=127.0.0.1:10085 "
f"-tag={shlex.quote(tag)} {shlex.quote(client_id)}"
)
out, err, code = self.ssh.run_sudo_command(cmd)
if code != 0:
logger.warning(f"Xray API remove user failed: {err or out}")
return False
return True
def _get_meta_json(self):
"""Read protocol metadata. Supports both layouts.
Native layout pulls keys from xray_*.key files. Panel layout reads
meta.json. Either way, port and site_name come from server.json since
that is the authoritative runtime config — meta.json may go stale if
the user edits server.json directly via the panel.
"""
config = self._get_server_json() or {}
port = None
site_name = None
rs = {}
try:
ib = next(b for b in config.get('inbounds', []) if b.get('protocol') == 'vless')
port = ib.get('port')
rs = ib.get('streamSettings', {}).get('realitySettings', {}) or {}
names = rs.get('serverNames') or []
if names:
site_name = names[0]
except StopIteration:
pass
if self._detect_layout() == 'native':
priv = (self._read_remote_file(f"{self._config_dir()}/xray_private.key") or '').strip()
pub = (self._read_remote_file(f"{self._config_dir()}/xray_public.key") or '').strip()
sid = (self._read_remote_file(f"{self._config_dir()}/xray_short_id.key") or '').strip()
if not priv:
priv = rs.get('privateKey', '')
if not sid:
sids = rs.get('shortIds') or []
sid = sids[0] if sids else ''
if not pub:
pub = self._derive_pubkey_from_priv(priv)
return {
'private_key': priv,
'public_key': pub,
'short_id': sid,
'port': port,
'site_name': site_name or 'yahoo.com',
}
# Panel (legacy) layout
out = self._read_remote_file(f"{self._config_dir()}/meta.json")
meta = {}
if out:
try:
meta = json.loads(out)
except Exception:
meta = {}
if port is not None:
meta['port'] = port
if site_name:
meta['site_name'] = site_name
if not meta.get('private_key'):
meta['private_key'] = rs.get('privateKey', '')
if not meta.get('short_id'):
sids = rs.get('shortIds') or []
if sids:
meta['short_id'] = sids[0]
if not meta.get('public_key') and meta.get('private_key'):
meta['public_key'] = self._derive_pubkey_from_priv(meta['private_key'])
return meta
def _get_clients_table(self):
"""Read clientsTable, trying both layout filenames."""
layout = self._detect_layout()
primary = 'clientsTable' if layout == 'native' else 'clientsTable.json'
fallback = 'clientsTable.json' if layout == 'native' else 'clientsTable'
for fname in (primary, fallback):
out = self._read_remote_file(f"{self._config_dir()}/{fname}")
if not out or not out.strip():
continue
try:
return json.loads(out)
except Exception:
continue
return []
def _save_clients_table(self, data):
"""Write clientsTable to the file matching the current layout, in both
the container and the host bind-mount.
"""
path = self._clients_table_path()
tmp_file = "/tmp/_xray_clients.json"
self.ssh.upload_file_sudo(json.dumps(data, indent=2), tmp_file)
self.ssh.run_sudo_command(
f"docker cp {tmp_file} {self.container_name}:{path}"
)
self.ssh.run_sudo_command(
f"cp {tmp_file} {path} 2>/dev/null || true"
)
def _upgrade_config_for_stats(self, config, restart=True):
"""Injects API and Stats blocks into older Xray configs transparently."""
dirty = False
if 'stats' not in config:
config['stats'] = {}
dirty = True
if 'api' not in config:
config['api'] = {"services": ["StatsService", "LoggerService", "HandlerService"], "tag": "api"}
dirty = True
else:
services = config['api'].setdefault('services', [])
if 'HandlerService' not in services:
services.append('HandlerService')
dirty = True
if 'policy' not in config:
config['policy'] = {
"levels": {"0": {"statsUserUplink": True, "statsUserDownlink": True}},
"system": {"statsInboundUplink": True, "statsInboundDownlink": True, "statsOutboundUplink": True, "statsOutboundDownlink": True}
}
dirty = True
if 'routing' not in config:
config['routing'] = {"rules": [{"inboundTag": ["api"], "outboundTag": "api", "type": "field"}]}
dirty = True
has_api_inbound = any(ib.get('tag') == 'api' for ib in config.get('inbounds', []))
if not has_api_inbound:
config.setdefault('inbounds', []).append({
"listen": "127.0.0.1",
"port": 10085,
"protocol": "dokodemo-door",
"settings": {"address": "127.0.0.1"},
"tag": "api"
})
dirty = True
for ib in config.get('inbounds', []):
if ib.get('protocol') == 'vless':
if not ib.get('tag'):
ib['tag'] = 'proxy'
dirty = True
for c in ib.get('settings', {}).get('clients', []):
if 'email' not in c:
c['email'] = c['id']
dirty = True
if dirty:
self._write_server_json(config, restart=restart)
return dirty
def _query_xray_stats(self):
"""Query Xray API for traffic stats using xray api command."""
out, _, code = self.ssh.run_sudo_command(
f"docker exec -i {self.container_name} /usr/bin/xray api statsquery -server=127.0.0.1:10085"
)
if code != 0 or not out.strip():
return {}
try:
stats_raw = json.loads(out)
except Exception:
return {}
results = {}
# Output format: {"stat": [{"name": "user>>>uid>>>traffic>>>downlink", "value": "123"}, ...]}
for item in stats_raw.get('stat', []):
name_parts = item.get('name', '').split('>>>')
if len(name_parts) == 4 and name_parts[0] == 'user':
uid = name_parts[1]
t_type = name_parts[3] # uplink or downlink
val = int(item.get('value', 0))
if uid not in results:
results[uid] = {'rx': 0, 'tx': 0}
if t_type == 'downlink':
results[uid]['rx'] = val
elif t_type == 'uplink':
results[uid]['tx'] = val
return results
def _format_bytes(self, size):
# Format bytes to string like AWG (e.g., 1.50 MiB)
power = 2**10
n = 0
powers = {0: 'B', 1: 'KiB', 2: 'MiB', 3: 'GiB', 4: 'TiB'}
while size > power:
size /= power
n += 1
v = round(size, 2)
if v == int(v):
v = int(v)
return f"{v} {powers.get(n, 'B')}"
def get_clients(self, protocol=None):
config = self._get_server_json()
if not config:
return []
self._upgrade_config_for_stats(config, restart=False)
# Collect all client IDs currently registered in the Xray server config
xray_clients = []
for ib in config.get('inbounds', []):
if ib.get('protocol') == 'vless':
xray_clients.extend(ib.get('settings', {}).get('clients', []))
clients_table = self._get_clients_table()
table_ids = {c['clientId'] for c in clients_table}
# Auto-import clients present in server.json but missing from clientsTable
# (e.g. added via the native Amnezia phone/desktop app). Skip the install-time
# default UUID for native-layout installs — the official client treats it as
# the device of the user who installed the server, not a manageable client.
default_uuid = self._get_default_xray_uuid()
updated = False
for xc in xray_clients:
uid = xc.get('id')
if not uid or uid in table_ids or uid == default_uuid:
continue
clients_table.append({
'clientId': uid,
'userData': {
'clientName': f'Imported_{uid[:8]}',
'creationDate': datetime.now().isoformat(),
'enabled': True
}
})
table_ids.add(uid)
updated = True
logger.info(f"Auto-imported Xray client {uid[:8]} from server.json")
if updated:
self._save_clients_table(clients_table)
stats = self._query_xray_stats()
for c in clients_table:
uid = c.get('clientId', '')
if uid in stats:
user_data = c.setdefault('userData', {})
rx = stats[uid]['rx']
tx = stats[uid]['tx']
if rx > 0 or tx > 0:
user_data['dataReceived'] = self._format_bytes(rx)
user_data['dataSent'] = self._format_bytes(tx)
user_data['dataReceivedBytes'] = rx
user_data['dataSentBytes'] = tx
return clients_table
def get_client_config(self, protocol, client_id, server_host, port):
clients = self._get_clients_table()
client = next((c for c in clients if c['clientId'] == client_id), None)
if not client: return None
meta = self._get_meta_json()
if not meta: return None
config = self._get_server_json()
sni = meta.get('site_name', 'yahoo.com')
if config:
try:
sni = config['inbounds'][0]['streamSettings']['realitySettings']['serverNames'][0]
except Exception:
pass
# Format URL
# vless://{id}@{host}:{port}?type=tcp&security=reality&pbk={public_key}&sni={sni}&fp=chrome&sid={short_id}&spx=%2F&flow=xtls-rprx-vision#{name}
name = client.get('userData', {}).get('clientName', 'vpn')
encoded_name = urllib.parse.quote(name)
url = (
f"vless://{client_id}@{server_host}:{meta.get('port', port)}"
f"?type=tcp&security=reality&pbk={meta['public_key']}"
f"&sni={sni}&fp=chrome&sid={meta['short_id']}"
f"&spx=%2F&flow=xtls-rprx-vision#{encoded_name}"
)
return url
def add_client(self, protocol, client_name, server_host, port):
client_id = str(uuid.uuid4())
config = self._get_server_json()
if not config: raise RuntimeError("Xray server config not found.")
self._upgrade_config_for_stats(config, restart=False)
inbound = self._get_vless_inbound(config)
if not inbound:
raise RuntimeError("Xray VLESS inbound not found.")
# Ensure clients structure exists
clients_node = inbound.setdefault('settings', {}).setdefault('clients', [])
client = {
"id": client_id,
"flow": "xtls-rprx-vision",
"email": client_id
}
if not self._xray_api_add_user(config, client):
raise RuntimeError(
"Xray runtime API is not available for hot user updates. "
"The server config was upgraded, but the container must be restarted once to enable HandlerService. "
"Restart the Xray container manually and try again."
)
clients_node.append(client)
self._write_server_json(config, restart=False)
# Update table
clients_table = self._get_clients_table()
clients_table.append({
'clientId': client_id,
'userData': {
'clientName': client_name,
'creationDate': datetime.now().isoformat(),
'enabled': True
}
})
self._save_clients_table(clients_table)
return {
'client_id': client_id,
'config': self.get_client_config(protocol, client_id, server_host, port)
}
def toggle_client(self, protocol, client_id, enable):
config = self._get_server_json()
self._upgrade_config_for_stats(config, restart=False)
inbound = self._get_vless_inbound(config)
if not inbound:
raise RuntimeError("Xray VLESS inbound not found.")
clients_node = inbound.setdefault('settings', {}).setdefault('clients', [])
# If toggling on and not present, we can re-add it from clientsTable
if enable:
if not any(c['id'] == client_id for c in clients_node):
client = {
"id": client_id,
"flow": "xtls-rprx-vision",
"email": client_id
}
if not self._xray_api_add_user(config, client):
raise RuntimeError("Xray runtime API failed to enable the client without restarting the container.")
clients_node.append(client)
else:
if not self._xray_api_remove_user(config, client_id):
raise RuntimeError("Xray runtime API failed to disable the client without restarting the container.")
inbound['settings']['clients'] = [c for c in clients_node if c['id'] != client_id]
self._write_server_json(config, restart=False)
clients_table = self._get_clients_table()
for c in clients_table:
if c['clientId'] == client_id:
c.setdefault('userData', {})['enabled'] = enable
self._save_clients_table(clients_table)
def remove_client(self, protocol, client_id):
config = self._get_server_json()
self._upgrade_config_for_stats(config, restart=False)
inbound = self._get_vless_inbound(config)
if not inbound:
raise RuntimeError("Xray VLESS inbound not found.")
clients_node = inbound.setdefault('settings', {}).setdefault('clients', [])
if not self._xray_api_remove_user(config, client_id):
raise RuntimeError("Xray runtime API failed to remove the client without restarting the container.")
inbound['settings']['clients'] = [c for c in clients_node if c['id'] != client_id]
self._write_server_json(config, restart=False)
clients_table = self._get_clients_table()
clients_table = [c for c in clients_table if c['clientId'] != client_id]
self._save_clients_table(clients_table)
return True
protocol_telemt/Dockerfile
+108
View File
@@ -0,0 +1,108 @@
# syntax=docker/dockerfile:1
ARG TELEMT_REPOSITORY=telemt/telemt
ARG TELEMT_VERSION=latest
# ==========================
# Minimal Image
# ==========================
FROM debian:12-slim AS minimal
ARG TARGETARCH
ARG TELEMT_REPOSITORY
ARG TELEMT_VERSION
RUN set -eux; \
apt-get update; \
apt-get install -y --no-install-recommends \
binutils \
ca-certificates \
curl \
tar; \
rm -rf /var/lib/apt/lists/*
RUN set -eux; \
case "${TARGETARCH}" in \
amd64) ASSET="telemt-x86_64-linux-musl.tar.gz" ;; \
arm64) ASSET="telemt-aarch64-linux-musl.tar.gz" ;; \
*) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
esac; \
VERSION="${TELEMT_VERSION#refs/tags/}"; \
if [ -z "${VERSION}" ] || [ "${VERSION}" = "latest" ]; then \
BASE_URL="https://github.com/${TELEMT_REPOSITORY}/releases/latest/download"; \
else \
BASE_URL="https://github.com/${TELEMT_REPOSITORY}/releases/download/${VERSION}"; \
fi; \
curl -fL \
--retry 5 \
--retry-delay 3 \
--connect-timeout 10 \
--max-time 120 \
-o "/tmp/${ASSET}" \
"${BASE_URL}/${ASSET}"; \
curl -fL \
--retry 5 \
--retry-delay 3 \
--connect-timeout 10 \
--max-time 120 \
-o "/tmp/${ASSET}.sha256" \
"${BASE_URL}/${ASSET}.sha256"; \
cd /tmp; \
sha256sum -c "${ASSET}.sha256"; \
tar -xzf "${ASSET}" -C /tmp; \
test -f /tmp/telemt; \
install -m 0755 /tmp/telemt /telemt; \
strip --strip-unneeded /telemt || true; \
rm -f "/tmp/${ASSET}" "/tmp/${ASSET}.sha256" /tmp/telemt
# ==========================
# Debug Image
# ==========================
FROM debian:12-slim AS debug
RUN set -eux; \
apt-get update; \
apt-get install -y --no-install-recommends \
ca-certificates \
tzdata \
curl \
iproute2 \
busybox; \
rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY --from=minimal /telemt /app/telemt
COPY config.toml /app/config.toml
EXPOSE 443 9090 9091
ENTRYPOINT ["/app/telemt"]
CMD ["config.toml"]
# ==========================
# Production Distroless on MUSL
# ==========================
#FROM gcr.io/distroless/static-debian12 AS prod
FROM debian:12-slim AS prod
RUN set -eux; \
apt-get update; \
apt-get install -y --no-install-recommends \
ca-certificates \
tzdata \
bash \
curl; \
rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY --from=minimal /telemt /app/telemt
COPY config.toml /app/config.toml
#USER nonroot:nonroot
EXPOSE 443 9090 9091
ENTRYPOINT ["/app/telemt"]
CMD ["config.toml"]
protocol_telemt/config.toml
+62
View File
@@ -0,0 +1,62 @@
### Telemt Based Config.toml
# We believe that these settings are sufficient for most scenarios
# where cutting-egde methods and parameters or special solutions are not needed
# === General Settings ===
[general]
use_middle_proxy = true
# Global ad_tag fallback when user has no per-user tag in [access.user_ad_tags]
# ad_tag = "00000000000000000000000000000000"
# Per-user ad_tag in [access.user_ad_tags] (32 hex from @MTProxybot)
# === Log Level ===
# Log level: debug | verbose | normal | silent
# Can be overridden with --silent or --log-level CLI flags
# RUST_LOG env var takes absolute priority over all of these
log_level = "normal"
[general.modes]
classic = false
secure = false
tls = true
[general.links]
show = "*"
# show = ["alice", "bob"] # Only show links for alice and bob
# show = "*" # Show links for all users
# public_host = "proxy.example.com" # Host (IP or domain) for tg:// links
public_port = 443 # Port for tg:// links (default: server.port)
# === Server Binding ===
[server]
port = 443
# proxy_protocol = false # Enable if behind HAProxy/nginx with PROXY protocol
metrics_port = 9090
metrics_listen = "0.0.0.0:9090" # Listen address for metrics (overrides metrics_port)
metrics_whitelist = ["127.0.0.1", "::1", "0.0.0.0/0"]
max_connections = 0 # 0 - unlimited, 10000 - default
[server.api]
enabled = true
listen = "0.0.0.0:9091"
whitelist = ["127.0.0.0/8"]
minimal_runtime_enabled = false
minimal_runtime_cache_ttl_ms = 1000
# Listen on multiple interfaces/IPs - IPv4
[[server.listeners]]
ip = "0.0.0.0"
# === Anti-Censorship & Masking ===
[censorship]
tls_domain = "petrovich.ru"
mask = false
tls_emulation = true # Fetch real cert lengths and emulate TLS records
tls_front_dir = "tlsfront" # Cache directory for TLS emulation
# mask_host = "172.17.0.1" # Docker host bridge IP
# mask_port = 8443 # Caddy порт
# mask_shape_hardening = true # anti-fingerprint
[access.users]
# format: "username" = "32_hex_chars_secret"
hello = "00000000000000000000000000000000"
protocol_telemt/docker-compose.yml
+31
View File
@@ -0,0 +1,31 @@
services:
telemt:
image: ghcr.io/telemt/telemt:latest
build: .
container_name: telemt
restart: unless-stopped
ports:
- "443:443"
- "127.0.0.1:9090:9090"
- "127.0.0.1:9091:9091"
# Allow caching 'proxy-secret' in read-only container
working_dir: /app/conf
volumes:
- .:/app/conf:rw
tmpfs:
- /run/telemt:rw,mode=1777,size=1m
environment:
- RUST_LOG=info
# Uncomment this line if you want to use host network for IPv6, but bridge is default and usually better
# network_mode: host
cap_drop:
- ALL
cap_add:
- NET_BIND_SERVICE # allow binding to port 443
read_only: false
security_opt:
- no-new-privileges:true
ulimits:
nofile:
soft: 65536
hard: 65536
requirements.txt
+41
View File
@@ -0,0 +1,41 @@
annotated-types==0.7.0
anyio==4.12.1
bcrypt==5.0.0
blinker==1.9.0
certifi==2026.2.25
cffi==2.0.0
click==8.3.1
colorama==0.4.6
cryptography==44.0.0
fastapi==0.115.12
Flask==3.1.0
h11==0.16.0
httpcore==1.0.9
httptools==0.7.1
httpx==0.25.2
idna==3.11
itsdangerous==2.2.0
Jinja2==3.1.6
MarkupSafe==3.0.3
multicolorcaptcha==1.2.0
paramiko==3.5.1
pillow==12.1.1
pycparser==3.0
pydantic==2.12.5
pydantic_core==2.41.5
PyNaCl==1.6.2
psycopg[binary]==3.2.9
psycopg_pool==3.2.6
python-dotenv==1.2.2
python-multipart==0.0.20
python-telegram-bot==20.7
PyYAML==6.0.3
sniffio==1.3.1
starlette==0.46.2
typing-inspection==0.4.2
typing_extensions==4.15.0
uvicorn==0.34.0
watchfiles==1.1.1
websockets==16.0
Werkzeug==3.1.6
screen/panel1-2.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 139 KiB

screen/panel1-3.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 131 KiB

screen/panel1.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 456 KiB

static/css/style.css
+1868
View File
File diff suppressed because it is too large Load Diff
static/favicon.svg
+11
View File
@@ -0,0 +1,11 @@
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
<defs>
<linearGradient id="g" x1="0" y1="0" x2="1" y2="1">
<stop offset="0%" stop-color="#8b5cf6"/>
<stop offset="100%" stop-color="#6366f1"/>
</linearGradient>
</defs>
<rect width="32" height="32" rx="7" fill="url(#g)"/>
<path d="M16 6C12.5 6 9.5 7.2 8 8v10c0 4.5 3.5 7.5 8 10 4.5-2.5 8-5.5 8-10V8c-1.5-.8-4.5-2-8-2z" fill="none" stroke="rgba(255,255,255,0.9)" stroke-width="1.5"/>
<path d="M16 10c-2.5 0-4.5.8-5.5 1.3v6.7c0 3 2.2 5.2 5.5 7 3.3-1.8 5.5-4 5.5-7v-6.7c-1-.5-3-1.3-5.5-1.3z" fill="rgba(255,255,255,0.15)"/>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 619 B

static/js/qrcode.min.js
Vendored
+1
View File
File diff suppressed because one or more lines are too long
telegram_bot.py
+1137
View File
File diff suppressed because it is too large Load Diff
templates/base.html
+269
View File
@@ -0,0 +1,269 @@
<!DOCTYPE html>
<html lang="{{ lang }}" {% if lang=='fa' %}dir="rtl" {% endif %}>
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="description" content="{{ _('site_description') }}">
<title>{{ site_settings.title or 'Amnezia Panel' }} {% block title_extra %}{% endblock %}</title>
<link rel="icon" type="image/svg+xml" href="/static/favicon.svg">
<link rel="stylesheet" href="/static/css/style.css">
<script>!function () { var t = localStorage.getItem('theme') || 'dark'; document.documentElement.setAttribute('data-theme', t) }()</script>
<script src="/static/js/qrcode.min.js"></script>
{% block head_extra %}{% endblock %}
<style>
.lang-check {
color: var(--success);
font-weight: 700;
}
[dir="rtl"] .lang-check {
margin-right: auto;
}
[dir="ltr"] .lang-check {
margin-left: auto;
}
</style>
</head>
<body>
<div class="toast-container" id="toastContainer"></div>
<div class="app-container">
<header class="app-header">
<a href="/" class="app-logo" style="text-decoration:none">
<div class="logo-icon">{{ site_settings.logo }}</div>
<div>
<div class="logo-text">{{ site_settings.title }}</div>
<div class="logo-subtitle">{{ site_settings.subtitle }}</div>
</div>
</a>
{% if current_user %}
<nav class="header-nav">
{% if current_user.role in ['admin', 'support'] %}
<a href="/" class="nav-link">{{ _('nav_servers') }}</a>
<a href="/users" class="nav-link">{{ _('nav_users') }}</a>
{% endif %}
{% if current_user.role == 'admin' %}
<a href="/settings" class="nav-link">{{ _('nav_settings') }}</a>
{% endif %}
<a href="/my" class="nav-link">{{ _('nav_connections') }}</a>
</nav>
<div class="nav-user">
<button class="theme-toggle" onclick="openModal('langModal')" title="{{ _('select_lang') }}"
style="margin-right: var(--space-sm);">
{% if lang == 'ru' %}🇷🇺{% elif lang == 'fr' %}🇫🇷{% elif lang == 'zh' %}🇨🇳{% elif lang == 'fa'
%}🇮🇷{% else %}🇺🇸{% endif %}
</button>
<button class="theme-toggle" onclick="toggleTheme()" title="{{ _('toggle_theme') }}"
id="themeToggle">🌙</button>
<span class="nav-username">{{ current_user.username }}</span>
<span
class="badge badge-{{ 'success' if current_user.role == 'admin' else ('info' if current_user.role == 'support' else 'warn') }}"
style="font-size:0.65rem;">
{{ current_user.role | upper }}
</span>
<a href="/logout" class="btn btn-secondary btn-sm">{{ _('nav_logout') }}</a>
</div>
{% else %}
<div class="nav-user">
<button class="theme-toggle" onclick="openModal('langModal')" title="{{ _('select_lang') }}"
style="margin-right: var(--space-sm);">
{% if lang == 'ru' %}🇷🇺{% elif lang == 'fr' %}🇫🇷{% elif lang == 'zh' %}🇨🇳{% elif lang == 'fa'
%}🇮🇷{% else %}🇺🇸{% endif %}
</button>
<button class="theme-toggle" onclick="toggleTheme()" title="{{ _('toggle_theme') }}"
id="themeToggle">🌙</button>
</div>
{% endif %}
</header>
<main>
{% block content %}{% endblock %}
</main>
</div>
<!-- ===== Language Modal ===== -->
<div class="modal-backdrop" id="langModal">
<div class="modal" style="max-width: 320px;">
<div class="modal-header">
<h2 class="modal-title">{{ _('select_lang') }}</h2>
<button class="modal-close" onclick="closeModal('langModal')">×</button>
</div>
<div style="display: flex; flex-direction: column; gap: var(--space-sm);">
{% set langs = [
('en', '🇺🇸', 'lang_en'),
('ru', '🇷🇺', 'lang_ru'),
('fr', '🇫🇷', 'lang_fr'),
('zh', '🇨🇳', 'lang_zh'),
('fa', '🇮🇷', 'lang_fa')
] %}
{% for l_code, l_flag, l_key in langs %}
<a href="/set_lang/{{ l_code }}" class="btn btn-secondary"
style="justify-content: flex-start; gap: var(--space-md); padding: var(--space-md);">
<span style="font-size: 1.4rem;">{{ l_flag }}</span>
<span style="font-weight: 500;">{{ _(l_key) }}</span>
{% if lang == l_code %}
<span class="lang-check">✓</span>
{% endif %}
</a>
{% endfor %}
</div>
</div>
</div>
<script>
window.I18N = {{ translations_json | safe }};
window._ = function (key) { return window.I18N[key] || key; };
/* ===== Theme Toggle ===== */
(function () {
const saved = localStorage.getItem('theme') || 'dark';
document.documentElement.setAttribute('data-theme', saved);
const updateUI = () => {
const isLight = document.documentElement.getAttribute('data-theme') === 'light';
document.querySelectorAll('.theme-toggle').forEach(btn => {
const isLang = btn.getAttribute('onclick').includes('langModal');
if (!isLang) {
btn.textContent = isLight ? '☀️' : '🌙';
}
});
};
if (document.readyState === 'loading') {
document.addEventListener('DOMContentLoaded', updateUI);
} else {
updateUI();
}
window.toggleTheme = function () {
const current = document.documentElement.getAttribute('data-theme') || 'dark';
const next = current === 'dark' ? 'light' : 'dark';
document.documentElement.setAttribute('data-theme', next);
localStorage.setItem('theme', next);
updateUI();
};
})();
/* ===== Active Nav Link ===== */
(function () {
const path = window.location.pathname;
document.querySelectorAll('.nav-link').forEach(link => {
const href = link.getAttribute('href');
if (href === '/' && path === '/') link.classList.add('active');
else if (href !== '/' && path.startsWith(href)) link.classList.add('active');
});
})();
/* ===== Toast Notifications ===== */
function showToast(message, type = 'info') {
const container = document.getElementById('toastContainer');
const toast = document.createElement('div');
toast.className = `toast toast-${type}`;
const icons = { success: '✓', error: '✕', info: 'ℹ' };
toast.innerHTML = `<span>${icons[type] || 'ℹ'}</span> <span>${message}</span>`;
container.appendChild(toast);
setTimeout(() => {
toast.style.opacity = '0';
toast.style.transform = 'translateX(100%)';
toast.style.transition = 'all 0.3s ease';
setTimeout(() => toast.remove(), 300);
}, 4000);
}
/* ===== Modal Management ===== */
function openModal(id) {
const modal = document.getElementById(id);
if (modal) {
modal.classList.add('active');
document.body.style.overflow = 'hidden';
}
}
function closeModal(id) {
const modal = document.getElementById(id);
if (modal) {
modal.classList.remove('active');
document.body.style.overflow = '';
}
}
/* Close modal on backdrop click */
document.addEventListener('click', (e) => {
if (e.target.classList.contains('modal-backdrop') && e.target.classList.contains('active')) {
e.target.classList.remove('active');
document.body.style.overflow = '';
}
});
/* Close modal on Escape */
document.addEventListener('keydown', (e) => {
if (e.key === 'Escape') {
document.querySelectorAll('.modal-backdrop.active').forEach(m => {
m.classList.remove('active');
});
document.body.style.overflow = '';
}
});
/* ===== API Helper ===== */
async function apiCall(url, method = 'GET', body = null) {
const opts = {
method,
headers: { 'Content-Type': 'application/json' },
};
if (body) opts.body = JSON.stringify(body);
const res = await fetch(url, opts);
if (res.status === 401 || res.status === 403) {
window.location.href = '/login';
throw new Error('Session expired');
}
const data = await res.json();
if (!res.ok) {
throw new Error(data.error || 'Unknown error');
}
return data;
}
/* ===== Copy to clipboard ===== */
async function copyToClipboard(text) {
try {
await navigator.clipboard.writeText(text);
showToast(_('copied_to_clipboard'), 'success');
} catch {
const ta = document.createElement('textarea');
ta.value = text;
document.body.appendChild(ta);
ta.select();
document.execCommand('copy');
ta.remove();
showToast(_('copied_to_clipboard'), 'success');
}
}
/* ===== Download file ===== */
function downloadFile(content, filename) {
const blob = new Blob([content], { type: 'text/plain' });
const url = URL.createObjectURL(blob);
const a = document.createElement('a');
a.href = url;
a.download = filename;
a.click();
URL.revokeObjectURL(url);
}
</script>
{% block scripts %}{% endblock %}
</body>
</html>
templates/index.html
+453
View File
@@ -0,0 +1,453 @@
{% extends "base.html" %}
{% block content %}
<section>
<div class="flex items-center justify-between" style="margin-bottom: var(--space-lg);">
<h1 class="section-title" style="margin-bottom:0;">
<span class="icon">🖥</span>
{{ _('nav_servers') }}
</h1>
<button class="btn btn-primary" onclick="openModal('addServerModal')">
<span>＋</span> {{ _('add_server') }}
</button>
</div>
{% if servers %}
<div class="server-grid" id="serverGrid">
{% for server in servers %}
<div class="card card-hover server-card" id="server-{{ loop.index0 }}" data-idx="{{ loop.index0 }}"
data-name="{{ server.name }}" data-host="{{ server.host }}" data-port="{{ server.ssh_port }}"
data-username="{{ server.username }}" data-auth="{{ 'key' if server.private_key else 'password' }}"
draggable="true">
<div class="server-meta">
<div class="server-icon">🖥</div>
<div style="min-width: 0; flex: 1;">
<div class="server-name">
<span class="ping-dot ping-pending" id="ping-{{ loop.index0 }}"
title="{{ _('ping_checking') }}"></span>
<span>{{ server.name }}</span>
<span class="ping-ms text-muted" id="ping-ms-{{ loop.index0 }}"></span>
</div>
<div class="server-host">{{ server.host }}:{{ server.ssh_port }}</div>
</div>
</div>
<div class="server-protocols" id="server-protocols-{{ loop.index0 }}">
{% if server.protocols %}
{% for proto_key, proto_val in server.protocols.items() %}
{% if proto_val.get('installed') %}
<span class="badge badge-success">
<span class="badge-dot"></span>
{{ 'AWG' if proto_key == 'awg' else ('AWG-Legacy' if proto_key == 'awg_legacy' else ('Xray' if
proto_key == 'xray' else proto_key | upper)) }}
</span>
{% endif %}
{% endfor %}
{% else %}
<span class="badge badge-warn">
<span class="badge-dot"></span>
{{ _('no_protocols') }}
</span>
{% endif %}
</div>
<div class="server-actions">
<a href="/server/{{ loop.index0 }}" class="btn btn-secondary btn-sm" style="flex:1">
{{ _('manage') }}
</a>
<button class="btn btn-secondary btn-sm btn-icon" onclick="openEditServer(this)"
title="{{ _('edit') }}">
✏️
</button>
<button class="btn btn-danger btn-sm btn-icon" onclick="deleteServer({{ loop.index0 }})"
title="{{ _('delete') }}">
🗑
</button>
</div>
</div>
{% endfor %}
</div>
{% else %}
<div class="empty-state">
<div class="empty-icon">🛡</div>
<div class="empty-title">{{ _('no_servers') }}</div>
<div class="empty-desc">
{{ _('add_server_desc') }}
</div>
<button class="btn btn-primary" onclick="openModal('addServerModal')">
<span>＋</span> {{ _('add_server') }}
</button>
</div>
{% endif %}
</section>
<!-- ===== Edit Server Modal ===== -->
<div class="modal-backdrop" id="editServerModal">
<div class="modal">
<div class="modal-header">
<h2 class="modal-title">{{ _('edit_server_title') }}</h2>
<button class="modal-close" onclick="closeModal('editServerModal')">×</button>
</div>
<form id="editServerForm" onsubmit="return submitEditServer(event)">
<input type="hidden" id="editServerIdx">
<div class="form-group">
<label class="form-label">{{ _('name') }}</label>
<input class="form-input" type="text" id="editServerName">
</div>
<div class="form-row">
<div class="form-group">
<label class="form-label">{{ _('ssh_host') }}</label>
<input class="form-input" type="text" id="editServerHost" required>
</div>
<div class="form-group">
<label class="form-label">{{ _('ssh_port') }}</label>
<input class="form-input" type="number" id="editServerPort" min="1" max="65535">
</div>
</div>
<div class="form-group">
<label class="form-label">{{ _('ssh_user') }}</label>
<input class="form-input" type="text" id="editServerUser" required>
</div>
<div class="tabs" style="margin-top: var(--space-md)">
<button type="button" class="tab active" onclick="switchEditAuthTab('password', this)">{{ _('ssh_password') }}</button>
<button type="button" class="tab" onclick="switchEditAuthTab('key', this)">{{ _('ssh_key') }}</button>
</div>
<div id="editAuthPassword">
<div class="form-group">
<label class="form-label">{{ _('ssh_password') }}</label>
<input class="form-input" type="password" id="editServerPassword"
placeholder="{{ _('edit_keep_credential') }}">
<div class="form-hint">{{ _('edit_keep_credential') }}</div>
</div>
</div>
<div id="editAuthKey" class="hidden">
<div class="form-group">
<label class="form-label">{{ _('ssh_key') }}</label>
<textarea class="form-textarea" id="editServerKey"
placeholder="{{ _('edit_keep_credential') }}"></textarea>
<div class="form-hint">{{ _('edit_keep_credential') }}</div>
</div>
</div>
<div class="modal-footer">
<button type="button" class="btn btn-secondary" onclick="closeModal('editServerModal')">{{ _('cancel')
}}</button>
<button type="submit" class="btn btn-primary" id="editServerBtn">
<span id="editServerBtnText">{{ _('save') }}</span>
<div class="spinner hidden" id="editServerSpinner"></div>
</button>
</div>
</form>
</div>
</div>
<!-- ===== Add Server Modal ===== -->
<div class="modal-backdrop" id="addServerModal">
<div class="modal">
<div class="modal-header">
<h2 class="modal-title">{{ _('add_server') }}</h2>
<button class="modal-close" onclick="closeModal('addServerModal')">×</button>
</div>
<form id="addServerForm" onsubmit="return addServer(event)">
<div class="form-group">
<label class="form-label">{{ _('name') }}</label>
<input class="form-input" type="text" id="serverName" placeholder="My VPN Server">
</div>
<div class="form-row">
<div class="form-group">
<label class="form-label">{{ _('ssh_host') }}</label>
<input class="form-input" type="text" id="serverHost" placeholder="192.168.1.1" required>
</div>
<div class="form-group">
<label class="form-label">{{ _('ssh_port') }}</label>
<input class="form-input" type="number" id="serverPort" value="22" min="1" max="65535">
</div>
</div>
<div class="form-group">
<label class="form-label">{{ _('ssh_user') }}</label>
<input class="form-input" type="text" id="serverUser" placeholder="root" required>
</div>
<!-- Tabs for auth method -->
<div class="tabs" style="margin-top: var(--space-md)">
<button type="button" class="tab active" onclick="switchAuthTab('password', this)">{{ _('ssh_password')
}}</button>
<button type="button" class="tab" onclick="switchAuthTab('key', this)">{{ _('ssh_key') }}</button>
</div>
<div id="authPassword">
<div class="form-group">
<label class="form-label">{{ _('ssh_password') }}</label>
<input class="form-input" type="password" id="serverPassword" placeholder="••••••••">
</div>
</div>
<div id="authKey" class="hidden">
<div class="form-group">
<label class="form-label">{{ _('ssh_key') }}</label>
<textarea class="form-textarea" id="serverKey"
placeholder="{{ _('ssh_key_placeholder') }}"></textarea>
<div class="form-hint">{{ _('ssh_key_hint') }}</div>
</div>
</div>
<div class="modal-footer">
<button type="button" class="btn btn-secondary" onclick="closeModal('addServerModal')">{{ _('cancel')
}}</button>
<button type="submit" class="btn btn-primary" id="addServerBtn">
<span id="addServerBtnText">{{ _('connect') }}</span>
<div class="spinner hidden" id="addServerSpinner"></div>
</button>
</div>
</form>
</div>
</div>
{% endblock %}
{% block scripts %}
<script>
function switchAuthTab(tab, btn) {
document.querySelectorAll('.tabs .tab').forEach(t => t.classList.remove('active'));
btn.classList.add('active');
document.getElementById('authPassword').classList.toggle('hidden', tab !== 'password');
document.getElementById('authKey').classList.toggle('hidden', tab !== 'key');
}
async function addServer(e) {
e.preventDefault();
const btn = document.getElementById('addServerBtn');
const btnText = document.getElementById('addServerBtnText');
const spinner = document.getElementById('addServerSpinner');
btn.disabled = true;
btnText.textContent = _('connecting');
spinner.classList.remove('hidden');
try {
const data = {
name: document.getElementById('serverName').value,
host: document.getElementById('serverHost').value,
ssh_port: parseInt(document.getElementById('serverPort').value) || 22,
username: document.getElementById('serverUser').value,
password: document.getElementById('serverPassword').value,
private_key: document.getElementById('serverKey').value,
};
const result = await apiCall('/api/servers/add', 'POST', data);
showToast(_('server_added'), 'success');
setTimeout(() => window.location.reload(), 800);
} catch (err) {
showToast(err.message, 'error');
} finally {
btn.disabled = false;
btnText.textContent = _('connect');
spinner.classList.add('hidden');
}
}
async function deleteServer(serverId) {
if (!confirm(_('delete_confirm'))) return;
try {
await apiCall(`/api/servers/${serverId}/delete`, 'POST');
showToast(_('server_deleted'), 'success');
setTimeout(() => window.location.reload(), 500);
} catch (err) {
showToast(err.message, 'error');
}
}
/* ========== Edit server ========== */
function switchEditAuthTab(tab, btn) {
const tabs = btn.parentElement.querySelectorAll('.tab');
tabs.forEach(t => t.classList.remove('active'));
btn.classList.add('active');
document.getElementById('editAuthPassword').classList.toggle('hidden', tab !== 'password');
document.getElementById('editAuthKey').classList.toggle('hidden', tab !== 'key');
}
function openEditServer(btn) {
// Prefill from data-* on the parent server-card so we don't have to round-trip.
const card = btn.closest('.server-card');
if (!card) return;
document.getElementById('editServerIdx').value = card.dataset.idx;
document.getElementById('editServerName').value = card.dataset.name || '';
document.getElementById('editServerHost').value = card.dataset.host || '';
document.getElementById('editServerPort').value = card.dataset.port || '22';
document.getElementById('editServerUser').value = card.dataset.username || '';
document.getElementById('editServerPassword').value = '';
document.getElementById('editServerKey').value = '';
// Pre-select the tab matching the server's current auth method.
const authIsKey = card.dataset.auth === 'key';
const tabsEl = document.querySelector('#editServerForm .tabs');
const passTab = tabsEl.children[0];
const keyTab = tabsEl.children[1];
switchEditAuthTab(authIsKey ? 'key' : 'password', authIsKey ? keyTab : passTab);
openModal('editServerModal');
}
async function submitEditServer(e) {
e.preventDefault();
const idx = document.getElementById('editServerIdx').value;
const btn = document.getElementById('editServerBtn');
const btnText = document.getElementById('editServerBtnText');
const spinner = document.getElementById('editServerSpinner');
btn.disabled = true;
btnText.textContent = _('saving') || 'Saving...';
spinner.classList.remove('hidden');
try {
const body = {
name: document.getElementById('editServerName').value,
host: document.getElementById('editServerHost').value,
ssh_port: parseInt(document.getElementById('editServerPort').value) || 22,
username: document.getElementById('editServerUser').value,
// Empty -> null means "leave unchanged" on the backend.
password: document.getElementById('editServerPassword').value || null,
private_key: document.getElementById('editServerKey').value || null,
};
await apiCall(`/api/servers/${idx}/edit`, 'POST', body);
showToast(_('server_saved'), 'success');
setTimeout(() => window.location.reload(), 500);
} catch (err) {
showToast(err.message, 'error');
} finally {
btn.disabled = false;
btnText.textContent = _('save');
spinner.classList.add('hidden');
}
return false;
}
/* ========== Ping indicators ========== */
async function pingServer(idx) {
const dot = document.getElementById(`ping-${idx}`);
const ms = document.getElementById(`ping-ms-${idx}`);
if (!dot) return;
try {
const res = await fetch(`/api/servers/${idx}/ping`, { credentials: 'same-origin' });
const data = await res.json();
dot.classList.remove('ping-pending');
if (data.alive) {
dot.classList.add('ping-ok');
dot.title = `${data.ms} ms`;
if (ms) ms.textContent = `${data.ms} ms`;
} else {
dot.classList.add('ping-fail');
dot.title = data.error || _('offline');
if (ms) ms.textContent = _('offline');
}
} catch {
dot.classList.remove('ping-pending');
dot.classList.add('ping-fail');
if (ms) ms.textContent = _('offline');
}
}
function startAllPings() {
// Browsers will fan these out concurrently; the page never blocks waiting
// for results because each card updates independently.
document.querySelectorAll('.server-card').forEach(card => {
const idx = card.dataset.idx;
if (idx !== undefined) pingServer(idx);
});
}
/* ========== Drag-and-drop reorder ========== */
let draggedCard = null;
function setupDragAndDrop() {
const grid = document.getElementById('serverGrid');
if (!grid) return;
grid.addEventListener('dragstart', e => {
const card = e.target.closest('.server-card');
if (!card) return;
// Don't initiate drag from a button/link inside the card — those have
// their own click semantics (Edit/Delete/Manage).
if (e.target.closest('button, a')) {
e.preventDefault();
return;
}
draggedCard = card;
card.classList.add('dragging');
e.dataTransfer.effectAllowed = 'move';
// Some browsers require this for dragstart to fire with text payload.
try { e.dataTransfer.setData('text/plain', card.dataset.idx); } catch {}
});
grid.addEventListener('dragend', e => {
const card = e.target.closest('.server-card');
if (card) card.classList.remove('dragging');
grid.querySelectorAll('.server-card.drag-over').forEach(c => c.classList.remove('drag-over'));
draggedCard = null;
});
grid.addEventListener('dragover', e => {
e.preventDefault();
e.dataTransfer.dropEffect = 'move';
const card = e.target.closest('.server-card');
if (!card || card === draggedCard) return;
grid.querySelectorAll('.server-card.drag-over').forEach(c => {
if (c !== card) c.classList.remove('drag-over');
});
card.classList.add('drag-over');
});
grid.addEventListener('dragleave', e => {
const card = e.target.closest('.server-card');
if (card && !card.contains(e.relatedTarget)) card.classList.remove('drag-over');
});
grid.addEventListener('drop', async e => {
e.preventDefault();
const target = e.target.closest('.server-card');
grid.querySelectorAll('.server-card.drag-over').forEach(c => c.classList.remove('drag-over'));
if (!target || !draggedCard || target === draggedCard) return;
// Insert before/after target depending on cursor position relative
// to the target's vertical centre, which feels natural in a grid.
const rect = target.getBoundingClientRect();
const insertAfter = (e.clientY - rect.top) > rect.height / 2;
grid.insertBefore(draggedCard, insertAfter ? target.nextSibling : target);
const newOrder = Array.from(grid.querySelectorAll('.server-card'))
.map(c => parseInt(c.dataset.idx, 10));
try {
await apiCall('/api/servers/reorder', 'POST', { order: newOrder });
showToast(_('servers_reordered'), 'success');
// Reload so onclick indices and per-card data-idx attrs realign with
// the new server array — simpler and safer than rewriting every handler.
setTimeout(() => window.location.reload(), 400);
} catch (err) {
showToast(err.message, 'error');
// Rollback the visual move — backend rejected.
window.location.reload();
}
});
}
document.addEventListener('DOMContentLoaded', () => {
startAllPings();
setupDragAndDrop();
});
</script>
{% endblock %}
templates/login.html
+285
View File
@@ -0,0 +1,285 @@
<!DOCTYPE html>
<html lang="{{ lang }}" {% if lang=='fa' %}dir="rtl" {% endif %}>
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>{{ site_settings.title or 'Amnezia Panel' }} — {{ _('login') }}</title>
<link rel="icon" type="image/svg+xml" href="/static/favicon.svg">
<link rel="stylesheet" href="/static/css/style.css">
<script>!function () { var t = localStorage.getItem('theme') || 'dark'; document.documentElement.setAttribute('data-theme', t) }()</script>
<style>
.login-wrapper {
min-height: 100vh;
display: flex;
align-items: center;
justify-content: center;
padding: var(--space-lg);
background: var(--bg);
}
.login-card {
width: 100%;
max-width: 400px;
}
.login-logo {
text-align: center;
margin-bottom: var(--space-xl);
}
.login-logo .logo-icon {
width: 72px;
height: 72px;
font-size: 2rem;
margin: 0 auto var(--space-md);
}
.login-logo .logo-text {
font-size: 1.6rem;
font-weight: 700;
}
.login-logo .logo-subtitle {
color: var(--text-muted);
font-size: 0.9rem;
}
.login-error {
background: rgba(239, 68, 68, 0.1);
border: 1px solid rgba(239, 68, 68, 0.3);
color: #ef4444;
padding: var(--space-sm) var(--space-md);
border-radius: var(--radius-md);
font-size: 0.85rem;
margin-bottom: var(--space-md);
display: none;
}
.login-error.visible {
display: block;
}
.lang-check {
color: var(--success);
font-weight: 700;
}
[dir="rtl"] .lang-check {
margin-right: auto;
}
[dir="ltr"] .lang-check {
margin-left: auto;
}
</style>
</head>
<body>
<button class="theme-toggle" onclick="openModal('langModal')" id="langToggle"
style="position:fixed; top:20px; {% if lang == 'fa' %}left:65px;{% else %}right:65px;{% endif %} z-index:10;"
title="{{ _('select_lang') }}">
{% if lang == 'ru' %}🇷🇺{% elif lang == 'fr' %}🇫🇷{% elif lang == 'zh' %}🇨🇳{% elif lang == 'fa' %}🇮🇷{%
else %}🇺🇸{% endif %}
</button>
<button class="theme-toggle" onclick="toggleTheme()" id="themeToggle"
style="position:fixed; top:20px; {% if lang == 'fa' %}left:20px;{% else %}right:20px;{% endif %} z-index:10;"
title="{{ _('toggle_theme') }}">🌙</button>
<div class="login-wrapper">
<div class="login-card">
<div class="login-logo">
<div class="logo-icon">{{ site_settings.logo or '🛡' }}</div>
<div class="logo-text">{{ site_settings.title or 'Amnezia Panel' }}</div>
<div class="logo-subtitle">{{ site_settings.subtitle or 'Web Panel' }}</div>
</div>
<div class="card">
<h2 style="font-size:1.2rem; font-weight:600; margin-bottom:var(--space-lg); text-align:center;">{{
_('login_title') }}</h2>
<div class="login-error" id="loginError"></div>
<form id="loginForm" onsubmit="return doLogin(event)">
<div class="form-group">
<label class="form-label">{{ _('username') }}</label>
<input class="form-input" type="text" id="username" placeholder="admin" required autofocus>
</div>
<div class="form-group">
<label class="form-label">{{ _('password') }}</label>
<input class="form-input" type="password" id="password" placeholder="••••••••" required>
</div>
{% if captcha_settings.enabled %}
<div class="form-group">
<label class="form-label">{{ _('captcha') }}</label>
<div
style="display: flex; margin-bottom: var(--space-xs); border-radius: var(--radius-md); overflow: hidden; border: 1px solid var(--border-color);">
<img id="captchaImage" src="/api/auth/captcha" alt="Captcha"
style="width: 100%; height: 65px; object-fit: cover; object-position: center; cursor: pointer; background: #fff;"
onclick="refreshCaptcha()" title="{{ _('captcha_hint') }}">
</div>
<input class="form-input" type="text" id="captcha" placeholder="{{ _('captcha_placeholder') }}"
required>
</div>
{% endif %}
<button type="submit" class="btn btn-primary" id="loginBtn"
style="width:100%; margin-top:var(--space-md);">
<span id="loginBtnText">{{ _('login') }}</span>
<div class="spinner hidden" id="loginSpinner"></div>
</button>
</form>
</div>
</div>
</div>
<!-- ===== Language Modal ===== -->
<div class="modal-backdrop" id="langModal">
<div class="modal" style="max-width: 320px;">
<div class="modal-header">
<h2 class="modal-title">{{ _('select_lang') }}</h2>
<button class="modal-close" onclick="closeModal('langModal')">×</button>
</div>
<div style="display: flex; flex-direction: column; gap: var(--space-sm);">
{% set langs = [
('en', '🇺🇸', 'lang_en'),
('ru', '🇷🇺', 'lang_ru'),
('fr', '🇫🇷', 'lang_fr'),
('zh', '🇨🇳', 'lang_zh'),
('fa', '🇮🇷', 'lang_fa')
] %}
{% for l_code, l_flag, l_key in langs %}
<a href="/set_lang/{{ l_code }}" class="btn btn-secondary"
style="justify-content: flex-start; gap: var(--space-md); padding: var(--space-md);">
<span style="font-size: 1.4rem;">{{ l_flag }}</span>
<span style="font-weight: 500;">{{ _(l_key) }}</span>
{% if lang == l_code %}
<span class="lang-check">✓</span>
{% endif %}
</a>
{% endfor %}
</div>
</div>
</div>
<script>
window.I18N = {{ translations_json | safe }};
window._ = function (key) { return window.I18N[key] || key; };
/* Theme toggle */
(function () {
const saved = localStorage.getItem('theme') || 'dark';
document.documentElement.setAttribute('data-theme', saved);
const updateUI = () => {
const isLight = document.documentElement.getAttribute('data-theme') === 'light';
document.querySelectorAll('.theme-toggle').forEach(btn => {
if (btn.id === 'themeToggle') {
btn.textContent = isLight ? '☀️' : '🌙';
}
});
};
if (document.readyState === 'loading') {
document.addEventListener('DOMContentLoaded', updateUI);
} else {
updateUI();
}
window.toggleTheme = function () {
const current = document.documentElement.getAttribute('data-theme') || 'dark';
const next = current === 'dark' ? 'light' : 'dark';
document.documentElement.setAttribute('data-theme', next);
localStorage.setItem('theme', next);
updateUI();
};
})();
/* ===== Modal Management ===== */
function openModal(id) {
const modal = document.getElementById(id);
if (modal) {
modal.classList.add('active');
document.body.style.overflow = 'hidden';
}
}
function closeModal(id) {
const modal = document.getElementById(id);
if (modal) {
modal.classList.remove('active');
document.body.style.overflow = '';
}
}
/* Close modal on backdrop click */
document.addEventListener('click', (e) => {
if (e.target.classList.contains('modal-backdrop') && e.target.classList.contains('active')) {
e.target.classList.remove('active');
document.body.style.overflow = '';
}
});
/* Close modal on Escape */
document.addEventListener('keydown', (e) => {
if (e.key === 'Escape') {
document.querySelectorAll('.modal-backdrop.active').forEach(m => {
m.classList.remove('active');
});
document.body.style.overflow = '';
}
});
function refreshCaptcha() {
const img = document.getElementById('captchaImage');
if (img) {
img.src = '/api/auth/captcha?' + new Date().getTime();
}
}
async function doLogin(e) {
e.preventDefault();
const btn = document.getElementById('loginBtn');
const text = document.getElementById('loginBtnText');
const spinner = document.getElementById('loginSpinner');
const errEl = document.getElementById('loginError');
btn.disabled = true;
text.textContent = _('logging_in');
spinner.classList.remove('hidden');
errEl.classList.remove('visible');
try {
const res = await fetch('/api/auth/login', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
username: document.getElementById('username').value,
password: document.getElementById('password').value,
captcha: document.getElementById('captcha') ? document.getElementById('captcha').value : null,
}),
});
const data = await res.json();
if (!res.ok) {
throw new Error(data.error || _('login_error'));
}
window.location.href = '/';
} catch (err) {
errEl.textContent = err.message;
errEl.classList.add('visible');
refreshCaptcha();
if (document.getElementById('captcha')) {
document.getElementById('captcha').value = '';
}
} finally {
btn.disabled = false;
text.textContent = _('login');
spinner.classList.add('hidden');
}
}
</script>
</body>
</html>
templates/my_connections.html
+162
View File
@@ -0,0 +1,162 @@
{% extends "base.html" %}
{% block title_extra %} — {{ _('my_connections_title') }}{% endblock %}
{% block content %}
<section>
<h1 class="section-title">
<span class="icon">🔗</span>
{{ _('my_connections_title') }}
</h1>
{% if connections %}
<div class="clients-list" id="myConnectionsList">
{% for c in connections %}
<div class="client-item">
<div class="client-info">
<div class="client-avatar">🔗</div>
<div>
<div class="client-name">{{ c.name or 'VPN Connection' }}</div>
<div class="client-meta">
<span>🖥 {{ c.server_name }}</span>
<span class="badge badge-info" style="font-size:0.65rem;">
{{ 'AmneziaWG' if c.protocol == 'awg' else ('AmneziaWG 2.0' if c.protocol == 'awg2' else ('AWG Legacy' if c.protocol == 'awg_legacy' else
('Xray' if c.protocol == 'xray' else c.protocol | upper))) }}
</span>
{% if c.created_at %}
<span>📅 {{ c.created_at[:10] }}</span>
{% endif %}
</div>
</div>
</div>
<div class="client-actions">
<button class="btn btn-primary btn-sm"
onclick="showMyConfig('{{ c.id }}', '{{ c.name or 'Connection' }}', '{{ c.protocol }}')">
{{ _('show_config') }}
</button>
</div>
</div>
{% endfor %}
</div>
{% else %}
<div class="empty-state">
<div class="empty-icon">🔗</div>
<div class="empty-title">{{ _('no_connections') }}</div>
<div class="empty-desc">{{ _('no_connections_user_desc') }}</div>
</div>
{% endif %}
</section>
<!-- ===== Config Modal ===== -->
<div class="modal-backdrop" id="configModal">
<div class="modal" style="max-width: 600px;">
<div class="modal-header">
<h2 class="modal-title" id="configModalTitle">{{ _('config') }}</h2>
<button class="modal-close" onclick="closeModal('configModal')">×</button>
</div>
<div class="config-tabs">
<button class="config-tab active" onclick="switchConfigTab('conf')">{{ _('config_tab') }}</button>
<button class="config-tab" onclick="switchConfigTab('vpn')">{{ _('vpn_key_tab') }}</button>
<button class="config-tab" onclick="switchConfigTab('qr')">{{ _('qr_code_tab') }}</button>
</div>
<div class="config-panel active" id="panel-conf">
<div class="config-display">
<div class="config-text" id="configText"></div>
<div class="config-actions">
<button class="btn btn-secondary btn-sm" onclick="copyToClipboard(currentConfig)" style="flex:1">
{{ _('copy_config') }}
</button>
<button class="btn btn-primary btn-sm"
onclick="downloadFile(currentConfig, currentConfigName + '.conf')" style="flex:1">
{{ _('download_conf') }}
</button>
</div>
</div>
</div>
<div class="config-panel" id="panel-vpn">
<div class="vpn-link-box" id="vpnLinkText"></div>
<div class="config-actions" style="margin-top: var(--space-sm);">
<button class="btn btn-secondary btn-sm" onclick="copyToClipboard(currentVpnLink)" style="flex:1">
{{ _('copy_key') }}
</button>
</div>
<div class="form-hint" style="margin-top: var(--space-sm);">
{{ _('vpn_link_hint') }}
</div>
</div>
<div class="config-panel" id="panel-qr">
<div class="qr-container">
<div id="qrCode"></div>
<div class="qr-hint">{{ _('qr_hint') }}</div>
</div>
</div>
</div>
</div>
{% endblock %}
{% block scripts %}
<script>
let currentConfig = '';
let currentVpnLink = '';
let currentConfigName = 'connection';
async function showMyConfig(connectionId, name, proto) {
try {
showToast(_('loading_connections'), 'info');
const result = await apiCall(`/api/my/connections/${connectionId}/config`, 'POST');
if (result.config) {
currentConfig = result.config;
currentVpnLink = result.vpn_link || '';
currentConfigName = name.replace(/\s+/g, '_');
document.getElementById('configModalTitle').textContent = `${_('config')} — ${name}`;
document.getElementById('configText').textContent = result.config;
document.getElementById('vpnLinkText').textContent = currentVpnLink;
// Telemt (MTProxy) doesn't have a "VPN Link" (vpn://) format in Amnezia
const vpnTab = document.querySelectorAll('.config-tab')[1];
const vpnPanel = document.getElementById('panel-vpn');
if (proto === 'telemt') {
vpnTab.style.display = 'none';
} else {
vpnTab.style.display = '';
}
switchConfigTab('conf');
openModal('configModal');
generateQR(result.config);
}
} catch (err) {
showToast(`${_('error')}: ` + err.message, 'error');
}
}
function switchConfigTab(tab) {
document.querySelectorAll('.config-tab').forEach(t => t.classList.remove('active'));
document.querySelectorAll('.config-panel').forEach(p => p.classList.remove('active'));
const tabs = document.querySelectorAll('.config-tab');
const panels = { conf: 'panel-conf', vpn: 'panel-vpn', qr: 'panel-qr' };
const tabIdx = { conf: 0, vpn: 1, qr: 2 };
tabs[tabIdx[tab]].classList.add('active');
document.getElementById(panels[tab]).classList.add('active');
}
function generateQR(text) {
const container = document.getElementById('qrCode');
container.innerHTML = '';
try {
new QRCode(container, {
text: text, width: 280, height: 280,
colorDark: '#000000', colorLight: '#ffffff',
correctLevel: QRCode.CorrectLevel.L
});
} catch (e) {
container.innerHTML = `<div style="color:var(--text-muted);font-size:0.85rem;">${_('qr_error')}</div>`;
}
}
</script>
{% endblock %}
templates/server.html
+2347
View File
File diff suppressed because it is too large Load Diff
templates/settings.html
+1035
View File
File diff suppressed because it is too large Load Diff
templates/user_share.html
+249
View File
@@ -0,0 +1,249 @@
{% extends "base.html" %}
{% block title_extra %} — {{ _('share_title') }}{% endblock %}
{% block content %}
<div class="card" style="max-width: 600px; margin: 2rem auto;">
<div class="card-header"
style="justify-content: center; text-align: center; flex-direction: column; gap: var(--space-xs);">
<h2 class="card-title">{{ _('vpn_access') }}</h2>
<p style="color: var(--text-muted); font-size: 0.9rem;">{{ _('user_label_share') }}: <strong>{{
share_user.username }}</strong>
</p>
</div>
{% if need_password %}
<div style="padding: var(--space-lg); text-align: center;">
<div class="logo-icon" style="font-size: 3rem; margin-bottom: var(--space-md);">🔐</div>
<p style="margin-bottom: var(--space-md);">{{ _('share_protected_desc') }}
</p>
<form id="authForm" onsubmit="authShare(event)"
style="display: flex; flex-direction: column; gap: var(--space-md); max-width: 300px; margin: 0 auto;">
<div class="form-group">
<input type="password" id="sharePassword" class="form-input" placeholder="{{ _('password') }}" required
autofocus>
</div>
<button type="submit" class="btn btn-primary" id="authBtn">
<span id="authBtnText">{{ _('login') }}</span>
<div class="spinner hidden" id="authSpinner"></div>
</button>
</form>
</div>
{% else %}
<div id="connectionsList" style="padding: var(--space-md);">
<div style="text-align: center; padding: 2rem;" id="loadingState">
<div class="spinner" style="width: 40px; height: 40px; margin: 0 auto;"></div>
<p style="margin-top: 1rem; color: var(--text-muted);">{{ _('loading_share_conns') }}</p>
</div>
<div id="connectionsGrid" class="hidden" style="display: grid; gap: var(--space-md);">
<!-- Connections will be here -->
</div>
<div id="emptyState" class="hidden" style="text-align: center; padding: 2rem;">
<p style="color: var(--text-muted);">{{ _('no_active_conns') }}</p>
</div>
</div>
{% endif %}
</div>
<!-- Modal for Config -->
<div class="modal-backdrop" id="configModal">
<div class="modal" style="max-width: 600px;">
<div class="modal-header">
<h2 class="modal-title" id="configModalTitle">{{ _('config') }}</h2>
<button class="modal-close" onclick="closeModal('configModal')">×</button>
</div>
<div class="config-tabs">
<button class="config-tab active" onclick="switchConfigTab('conf')">{{ _('config_tab') }}</button>
<button class="config-tab" onclick="switchConfigTab('vpn')">{{ _('vpn_key_tab') }}</button>
<button class="config-tab" onclick="switchConfigTab('qr')">{{ _('qr_code_tab') }}</button>
</div>
<div class="config-panel active" id="panel-conf">
<div class="config-display">
<textarea class="config-text" id="configText" readonly rows="12"
style="width:100%; border:none; background:transparent; color:inherit; font-family:monospace; resize:none; outline:none;"></textarea>
<div class="config-actions">
<button class="btn btn-secondary btn-sm" onclick="copyConfig()" style="flex:1">{{ _('copy_config')
}}</button>
<a id="downloadBtn" class="btn btn-primary btn-sm"
style="flex:1; text-decoration:none; display:flex; align-items:center; justify-content:center;">
{{ _('download_conf') }}
</a>
</div>
</div>
</div>
<div class="config-panel" id="panel-vpn">
<div class="vpn-link-box" id="vpnLinkText" style="min-height: 100px;"></div>
<div class="config-actions" style="margin-top:var(--space-sm);">
<button class="btn btn-secondary btn-sm" onclick="copyVpnLink()" style="flex:1">{{ _('copy_key')
}}</button>
</div>
</div>
<div class="config-panel" id="panel-qr">
<div class="qr-container">
<div id="qrcode"></div>
</div>
</div>
</div>
</div>
<script>
const TOKEN = "{{ token }}";
async function authShare(e) {
e.preventDefault();
const password = document.getElementById('sharePassword').value;
const btn = document.getElementById('authBtn');
const text = document.getElementById('authBtnText');
const spinner = document.getElementById('authSpinner');
btn.disabled = true;
text.classList.add('hidden');
spinner.classList.remove('hidden');
try {
const res = await fetch(`/api/share/${TOKEN}/auth`, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ password })
});
const data = await res.json();
if (data.status === 'success') {
window.location.reload();
} else {
alert(data.error || _('login_error'));
}
} catch (err) {
alert(`${_('error')}: ` + err.message);
} finally {
btn.disabled = false;
text.classList.remove('hidden');
spinner.classList.add('hidden');
}
}
async function loadConnections() {
if (document.getElementById('loadingState') === null) return;
try {
const res = await fetch(`/api/share/${TOKEN}/connections`);
if (res.status === 401) return; // Wait for auth
const data = await res.json();
document.getElementById('loadingState').classList.add('hidden');
if (!data.connections || data.connections.length === 0) {
document.getElementById('emptyState').classList.remove('hidden');
return;
}
const grid = document.getElementById('connectionsGrid');
grid.classList.remove('hidden');
grid.innerHTML = data.connections.map(c => `
<div class="card" style="padding: var(--space-md); border: 1px solid var(--border-color);">
<div style="display: flex; justify-content: space-between; align-items: flex-start; margin-bottom: var(--space-sm);">
<div style="text-align: initial;">
<div style="font-weight: 600; font-size: 1.1rem;">${c.name}</div>
<div style="font-size: 0.8rem; color: var(--text-muted);">${c.protocol.toUpperCase()} • ${c.server_name}</div>
</div>
<span class="badge badge-success">${_('active')}</span>
</div>
<button class="btn btn-secondary btn-sm w-full" onclick="showConfig('${c.id}', '${c.name}')">
${_('show_settings_btn')}
</button>
</div>
`).join('');
} catch (err) {
console.error(err);
}
}
function switchConfigTab(tab) {
document.querySelectorAll('.config-tab').forEach(t => t.classList.remove('active'));
document.querySelectorAll('.config-panel').forEach(p => p.classList.remove('active'));
const tabs = document.querySelectorAll('.config-tab');
const panels = { conf: 'panel-conf', vpn: 'panel-vpn', qr: 'panel-qr' };
const tabIdx = { conf: 0, vpn: 1, qr: 2 };
tabs[tabIdx[tab]].classList.add('active');
document.getElementById(panels[tab]).classList.add('active');
}
let currentConfig = '';
let currentVpnLink = '';
async function showConfig(connId, name) {
try {
const res = await fetch(`/api/share/${TOKEN}/config/${connId}`, { method: 'POST' });
const data = await res.json();
if (data.error) throw new Error(data.error);
currentConfig = data.config;
currentVpnLink = data.vpn_link || '';
document.getElementById('configText').value = data.config;
document.getElementById('vpnLinkText').textContent = currentVpnLink;
document.getElementById('configModalTitle').textContent = name;
const dl = document.getElementById('downloadBtn');
dl.onclick = () => downloadFile(data.config, `${name}.conf`);
const qrContainer = document.getElementById('qrcode');
qrContainer.innerHTML = '';
new QRCode(qrContainer, {
text: data.config,
width: 256,
height: 256,
colorDark: "#000000",
colorLight: "#ffffff",
correctLevel: QRCode.CorrectLevel.L
});
switchConfigTab('conf');
openModal('configModal');
} catch (err) {
alert(`${_('error')}: ` + err.message);
}
}
function copyConfig() {
copyToClipboard(currentConfig);
}
function copyVpnLink() {
copyToClipboard(currentVpnLink);
}
document.addEventListener('DOMContentLoaded', loadConnections);
</script>
<style>
.w-full {
width: 100%;
}
.spinner {
border: 3px solid rgba(255, 255, 255, 0.1);
border-top: 3px solid var(--accent-color);
border-radius: 50%;
width: 20px;
height: 20px;
animation: spin 1s linear infinite;
}
@keyframes spin {
0% {
transform: rotate(0deg);
}
100% {
transform: rotate(360deg);
}
}
</style>
{% endblock %}
templates/users.html
+1084
View File
File diff suppressed because it is too large Load Diff
translations/en.json
+423
View File
@@ -0,0 +1,423 @@
{
"nav_servers": "Servers",
"nav_users": "Users",
"nav_settings": "Settings",
"nav_connections": "Connections",
"nav_logout": "Logout",
"theme_dark": "Dark",
"theme_light": "Light",
"back_to_servers": "← Back to servers",
"server_check": "Check",
"server_checking": "Checking...",
"protocols": "Protocols",
"install": "Install",
"uninstall": "Uninstall",
"run": "Running",
"stop": "Stopped",
"not_installed": "Not installed",
"installed": "Installed",
"add_server": "Add Server",
"no_servers": "No servers added",
"name": "Name",
"host": "Host",
"port": "Port",
"status": "Status",
"actions": "Actions",
"edit": "Edit",
"delete": "Delete",
"save": "Save",
"cancel": "Cancel",
"loading": "Loading...",
"copy": "Copy",
"download": "Download",
"config": "Configuration",
"qr_code": "QR code",
"vpn_key": "VPN key",
"clients": "Clients",
"traffic": "Traffic",
"limit": "Limit",
"manage": "Manage",
"no_protocols": "No protocols",
"add_server_desc": "Add your first VPN server to get started. You'll need SSH credentials to connect.",
"ssh_host": "Host / IP",
"ssh_port": "SSH Port",
"ssh_user": "User",
"ssh_password": "Password",
"ssh_key": "SSH Key",
"ssh_key_placeholder": "Private SSH Key",
"ssh_key_hint": "Paste the content of your id_rsa or id_ed25519 file",
"connect": "Connect",
"connecting": "Connecting...",
"server_added": "Server added successfully",
"server_deleted": "Server deleted",
"delete_confirm": "Are you sure you want to delete this server?",
"success": "Success",
"error": "Error",
"info": "Info",
"login_title": "Login to Panel",
"username": "Username",
"password": "Password",
"captcha": "Captcha",
"captcha_placeholder": "Enter characters from image",
"captcha_hint": "Click to refresh image",
"login": "Login",
"logging_in": "Logging in...",
"login_error": "Login failed",
"check_done": "Check complete",
"check_error": "Connection error",
"ssh_ok": "SSH Connection",
"docker_ok": "Docker",
"docker_not_installed": "Docker not installed",
"awg_desc": "A newer version of the protocol based on awg-go. Supports advanced obfuscation with S3, S4 parameters.",
"awg_legacy_desc": "Original AWG version based on WireGuard kernel. Compatible with older client versions.",
"xray_desc": "Modern protocol that masks traffic as regular web traffic (XTLS-Reality). Resistant to deep packet analysis.",
"wireguard_desc": "Standard and fastest VPN protocol. Supported natively on all modern OS, but easily detected by DPI.",
"not_checked": "Not checked",
"connections": "Connections",
"add": "Add",
"loading_connections": "Loading connections...",
"no_connections": "No connections",
"no_connections_desc": "Add your first connection to generate a VPN configuration",
"install_protocol": "Install protocol",
"port_default_hint": "Default port: 55424. Make sure it's not busy",
"port_xray_hint": "Default port: 443 (recommended for Xray). Make sure it's not taken by another web server.",
"reinstall": "Reinstall",
"uninstall_confirm": "Uninstall {}? All connections and configurations will be lost.",
"stop_container_confirm": "Stop container {}?",
"start_container_confirm": "Start container {}?",
"stopping": "Stopping",
"starting": "Starting",
"stopped": "stopped",
"started": "started",
"server_config": "Server configuration",
"add_connection": "Add connection",
"connection_name": "Connection name",
"connection_name_placeholder": "Example: iPhone, Laptop",
"assign_to_user": "Assign to user (optional)",
"no_assign": "— No assignment —",
"create": "Create",
"creating": "Creating...",
"connection_created": "Connection \"{}\" created",
"delete_connection_confirm": "Delete this connection? The configuration will stop working.",
"connection_deleted": "Connection deleted",
"config_tab": "📄 Config",
"vpn_key_tab": "🔑 VPN-key",
"qr_code_tab": "📱 QR-code",
"copy_config": "📋 Copy",
"download_conf": "⬇ Download .conf",
"copy_key": "📋 Copy key",
"vpn_link_hint": "Paste this link into the AmneziaVPN app for automatic configuration",
"qr_hint": "Scan the QR code in the AmneziaVPN app",
"no_data": "No data",
"start_btn": "▶ Start",
"stop_btn": "⏹ Stop",
"config_btn": "⚙️ Config",
"done": "Done",
"installing": "Installing...",
"start_install": "Starting installation...",
"check_docker": "Checking Docker...",
"prepare_host": "Preparing host...",
"build_container": "Building container...",
"install_success": "Protocol installed successfully!",
"install_error": "Installation error: ",
"qr_error": "Failed to generate QR code",
"users_title": "Users",
"search_placeholder": "Search by name, email or Telegram...",
"add_user": "Add User",
"prev_page": "← Back",
"next_page": "Next →",
"page_info": "Page {} of {}",
"loading_users": "Loading users...",
"nothing_found": "Nothing found",
"search_empty_desc": "Try changing your query or create a new user",
"username_label": "Username",
"password_label": "Password",
"role_label": "Role",
"role_user_desc": "User — view only own connections",
"role_support_desc": "Support — server management",
"role_admin_desc": "Admin — full access",
"tg_id_label": "Telegram ID (opt.)",
"email_label": "Email (opt.)",
"traffic_limit_label": "Traffic limit (GB) (opt., 0 = ∞)",
"expiration_date_label": "Expiration date",
"description_label": "Description (opt.)",
"auto_conn_title": "Automatic connection creation (optional)",
"server_label": "Server",
"no_create_conn": "— Do not create connection —",
"protocol_label": "Protocol",
"edit_user_title": "Edit user: {}",
"edit_user_tg": "Telegram ID (optional)",
"edit_user_email": "Email (optional)",
"edit_user_limit": "Traffic limit (GB) (0 = ∞)",
"new_password_hint": "New password (leave empty if no change needed)",
"op_type_label": "Operation type",
"create_new_conn": "Create new connection",
"link_existing_conn": "Link existing",
"select_existing_conn": "Select existing connection",
"existing_conn_hint": "Only connections not linked to users will be shown",
"conn_name_panel": "Connection name (in panel)",
"user_conns_title": "User connections",
"no_free_conns": "No free connections",
"linking": "Linking...",
"conn_linked": "Connection linked",
"enabling": "Enabling",
"disabling": "Disabling",
"user_enabled": "User enabled",
"user_disabled": "User disabled",
"delete_user_confirm": "Delete user? All their connections will be deleted.",
"share_access": "Share access",
"enable_public_access": "Enable public access",
"share_password_label": "Password (optional)",
"share_password_hint": "If set, user must enter it",
"public_link_label": "Public link",
"disabled": "Disabled",
"out_of": "Of",
"settings_title": "Panel Settings",
"appearance": "🎨 Appearance",
"title_label": "Title",
"logo_label": "Logo (Emoji or symbol)",
"subtitle_label": "Subtitle",
"captcha_title": "🔐 Captcha",
"enable_captcha": "Enable captcha (multicolorcaptcha)",
"telegram_bot_title": "🤖 Telegram Bot",
"bot_token_label": "Bot Token (from @BotFather)",
"bot_status": "Status",
"bot_running": "✅ Running",
"bot_stopped": "⏹ Stopped",
"bot_stop_btn": "⏹ Stop",
"bot_start_btn": "▶️ Start",
"bot_hint": "After changing the token, save the settings — the bot will restart automatically. Users must have a Telegram ID in their profile.",
"api_docs_title": "🔌 API Documentation",
"api_docs_hint": "Use these interfaces to explore the panel's API capabilities",
"tunnels_title": "Tunnels",
"local_server": "Local Server",
"tunnel_install_enable": "Install & Enable",
"tunnel_enable": "Enable Tunnel",
"tunnel_running": "Tunnel running",
"tunnel_stop": "Stop",
"tunnel_stopping": "Stopping...",
"tunnel_stopped": "Tunnel stopped",
"tunnel_delete": "Delete",
"tunnel_deleted": "Tunnel deleted",
"tunnel_delete_confirm": "Stop and delete this panel-managed tunnel binary?",
"tunnel_starting": "Starting tunnel...",
"tunnel_started": "Tunnel started",
"tunnel_waiting_url": "Tunnel started. Waiting for public URL...",
"tunnel_no_public_url": "Public URL will appear here after the tunnel starts.",
"tunnels_hint": "Quick tunnels expose this local panel to the internet. Keep admin credentials strong and share public URLs only with trusted users.",
"ngrok_authtoken_placeholder": "ngrok authtoken (optional for some accounts)",
"import_users_title": "📤 Import Users",
"import_source_label": "Import / Sync Source",
"remnawave_url_label": "Remnawave URL",
"api_key_label": "API Key",
"enable_sync": "Enable synchronization",
"sync_hint": "Users will be created, disabled, and deleted automatically based on Remnawave data",
"sync_now_btn": "🔄 Sync now",
"delete_sync_btn": "🗑 Delete synchronization",
"auto_create_conns": "Create connections automatically",
"sync_server_label": "Server for new connections",
"save_changes": "💾 Save changes",
"sync_success": "Sync completed: {} users",
"sync_deleted": "Deleted {} synced users",
"delete_sync_confirm": "Are you sure you want to delete ALL synced users and their connections? This action is irreversible.",
"settings_saved": "Settings saved successfully",
"bot_started": "Bot started",
"bot_stopped_msg": "Bot stopped",
"sync_running": "Syncing...",
"deleting": "Deleting...",
"my_connections_title": "My Connections",
"show_config": "📄 Show config",
"no_connections_user_desc": "Contact administrator to create a VPN connection",
"share_title": "Connection Access",
"vpn_access": "VPN Access",
"user_label_share": "User",
"share_protected_desc": "This access is password protected. Please enter it to continue.",
"auth_success": "Auth success",
"loading_share_conns": "Loading connections...",
"no_active_conns": "You have no active connections yet.",
"show_settings_btn": "🔑 Show settings",
"copied": "Copied!",
"active": "Active",
"site_description": "Amnezia Web Panel — management of VPN servers and protocols AmneziaWG",
"toggle_theme": "Change theme",
"copied_to_clipboard": "Copied to clipboard",
"share_not_found": "404 Not Found",
"share_not_found_desc": "Either the link is incorrect or access has been disabled.",
"invalid_captcha": "Invalid captcha",
"account_disabled": "Account disabled",
"invalid_login": "Invalid login or password",
"user_exists": "User with this name already exists",
"cannot_delete_self": "You cannot delete yourself",
"wrong_share_password": "Wrong password",
"saving": "Saving...",
"select_lang": "Select Language",
"lang_ru": "Русский",
"lang_en": "English",
"lang_fr": "Français",
"lang_zh": "中文 (Chinese)",
"lang_fa": "فارسی (Persian)",
"backup_title": "Simple Backup",
"download_backup": "Download data.json",
"restore_backup": "Restore from file",
"restore_confirm": "Are you sure? Current data will be overwritten and the application will restart.",
"restore_success": "Restore successful! Restarting...",
"invalid_backup_file": "Invalid backup file or structure",
"config_unavailable": "Configuration unavailable",
"config_unavailable_desc": "This client was created via the native Amnezia app.\\nThe private key is stored only on the user's device and cannot be recovered by the server.",
"client_public_key": "Client public key:",
"telemt_desc": "MTProxy-based Telegram proxy with advanced obfuscation and TLS emulation support.",
"tls_emulation": "TLS Emulation",
"tls_domain": "Masking Domain",
"max_connections_limit": "Max Connections",
"max_connections_hint": "0 for unlimited. Limits total concurrent users.",
"traffic_reset_strategy_label": "Traffic reset strategy",
"traffic_reset_never": "Never reset",
"traffic_reset_daily": "Daily reset",
"traffic_reset_weekly": "Weekly reset",
"traffic_reset_monthly": "Monthly reset",
"traffic_reset_hint": "How often should user traffic be reset",
"traffic_used_total": "Total spent",
"traffic_reset_info": "Next reset: {}",
"services": "Services",
"dns_desc": "Personal DNS server to block ads and protect the privacy of your queries.",
"dns_internal_hint": "The service runs on the internal network (172.29.172.254) without binding to host ports.",
"telemt_port_hint": "Port for the Telegram proxy (typically 443).",
"socks5_desc": "Single-account SOCKS5 proxy (3proxy) with username/password authentication.",
"socks5_username": "Username",
"socks5_password": "Password",
"socks5_password_placeholder": "Leave empty to auto-generate",
"socks5_password_hint": "If left empty, a random 16-character password will be generated.",
"socks5_port_hint": "TCP port the proxy will listen on. The default in the official Amnezia client is 38080.",
"socks5_change_settings": "Change settings",
"socks5_settings_title": "SOCKS5 — Connection settings",
"socks5_port_change_hint": "Changing the port recreates the container; existing sessions will be dropped.",
"socks5_settings_saved": "SOCKS5 settings saved",
"adguard_desc": "AdGuard Home — DNS-based ad blocker with a web admin UI.",
"adguard_mode": "Installation mode",
"adguard_mode_sidebyside": "Side-by-side",
"adguard_mode_sidebyside_hint": "runs alongside AmneziaDNS on a separate internal IP (172.29.172.253)",
"adguard_mode_replace": "Replace AmneziaDNS",
"adguard_mode_replace_hint": "removes amnezia-dns and takes its IP — VPN clients use AdGuard immediately",
"adguard_dns_port": "DNS port (53)",
"adguard_dns_port_hint": "Internal DNS port served to VPN clients via the docker network.",
"adguard_web_port": "Web UI port",
"adguard_dot_port": "DoT port",
"adguard_doh_port": "DoH port",
"adguard_expose_web": "Expose to internet",
"adguard_expose": "Expose to host",
"adguard_install_hint": "Initial AdGuard setup runs through its built-in wizard via the web UI after install.",
"adguard_internal_ip": "Internal IP",
"adguard_web_ui": "Admin URL",
"adguard_open_ui": "Open Web UI",
"edit_server_title": "Edit server",
"edit_keep_credential": "Leave empty to keep the current value",
"server_saved": "Server settings saved",
"servers_reordered": "Servers reordered",
"ping_checking": "Checking connectivity...",
"offline": "offline",
"api_tokens_title": "API tokens",
"api_tokens_hint": "Bearer tokens for external integrations. Send the token in the `Authorization: Bearer <token>` header. Tokens have admin-equivalent rights and stop working if their owner is disabled or demoted.",
"api_tokens_empty": "No API tokens yet. Create one to integrate the panel with an external service.",
"api_tokens_create": "Create token",
"api_tokens_create_title": "Create API token",
"api_tokens_name_label": "Name",
"api_tokens_name_placeholder": "e.g. Linear integration, CI bot, monitoring",
"api_tokens_name_hint": "Used to identify this token in the list. The token value itself is generated for you.",
"api_tokens_name_required": "Token name is required",
"api_tokens_created_title": "Token created",
"api_tokens_value_label": "Token value",
"api_tokens_warning_title": "This is the only time you'll see this token.",
"api_tokens_warning_body": "Copy it now and store it in your integration's secret manager. The panel keeps only a hash — if you lose this value you'll need to revoke and recreate the token.",
"api_tokens_revoke": "Revoke",
"api_tokens_revoke_confirm": "Revoke token \"{}\"? Any integration using it will stop working.",
"api_tokens_revoked": "Token revoked",
"api_tokens_created": "Created",
"api_tokens_last_used": "Last used",
"api_tokens_owner": "Owner",
"api_tokens_never": "never",
"coming_soon": "Coming soon",
"promo_star_cta": "Star us on GitHub",
"aivpn_subtitle": "AI-driven protocol selection that picks the right tunnel for the moment. Land it sooner — drop a star.",
"revproxy_title": "Reverse Proxy",
"revproxy_subtitle": "High-performance traffic obfuscation: hide your VPN endpoint behind a polished public-facing site, drop the DPI footprint.",
"management": "Management",
"server_management": "Server Management",
"server_management_desc": "Perform system-level actions on your machine.",
"check_server_services": "Check the server services",
"reboot_server": "Reboot server",
"clear_server": "Clear server",
"remove_server": "Remove server from panel",
"ssl_title": "SSL / HTTPS Settings",
"enable_https": "Enable HTTPS",
"panel_port_label": "Panel Port",
"domain_label": "Domain name",
"cert_path_label": "SSL Certificate path (.pem)",
"key_path_label": "Private Key path (.pem)",
"or_paste_text": "OR paste certificate text",
"cert_text_label": "Certificate content (CRT)",
"key_text_label": "Private Key content (KEY)",
"ssl_hint": "After enabling, the panel will be accessible via https:// on the specified domain. Make sure the file paths or text data are correct.",
"about_title": "About & Updates",
"current_version": "Current version",
"check_updates": "Check for updates",
"checking_updates": "Checking...",
"update_available": "New version available",
"download_update": "Download update",
"up_to_date": "You have the latest version",
"warp_hint": "WARP routes this host outbound through Cloudflare. It does not create a public panel URL like Quick Tunnel or ngrok.",
"warp_install_hint": "Install the official Cloudflare WARP client first, then restart the panel.",
"warp_install_required": "Install WARP first",
"warp_connect": "Connect WARP",
"warp_disconnect": "Disconnect",
"warp_connected": "WARP connected",
"warp_disconnected": "WARP disconnected",
"warp_status_unknown": "WARP status is unknown.",
"warp_status_not_installed": "Cloudflare WARP CLI is not installed on this host.",
"warp_status_connected": "Cloudflare WARP is connected.",
"warp_status_connecting": "Cloudflare WARP is connecting.",
"warp_status_disconnected": "Cloudflare WARP is disconnected.",
"warp_status_not_registered": "Cloudflare WARP is installed but not registered yet. Connect will try to register automatically.",
"warp_status_service_unavailable": "Cloudflare WARP service is not available. Make sure warp-svc is running.",
"warp_status_error": "Cloudflare WARP returned an error.",
"install_starting": "Starting installation...",
"server_check_complete": "Check completed",
"server_connection_error": "Connection error",
"connections_load_error": "Error loading connections",
"connection_updated": "Connection updated",
"edit_connection": "Edit connection",
"enable_connection_progress": "Enabling connection...",
"disable_connection_progress": "Disabling connection...",
"connection_enabled": "Connection enabled",
"connection_disabled": "Connection disabled",
"gb": "GB",
"marketplace": "Templates",
"open_marketplace": "Open Templates",
"marketplace_desc": "Install protocol and service templates available for this server.",
"installed_apps": "Installed applications",
"installed_apps_hint": "Only installed protocols and services are shown here. Use Templates to add more.",
"no_installed_apps": "No installed applications yet",
"no_installed_apps_desc": "Open Templates to install protocols or services on this server.",
"install_another": "Install another",
"new_instance": "new instance",
"port_next_instance_hint": "Choose a free UDP port for the additional instance.",
"checking_server": "Checking server services...",
"web_servers": "Web servers",
"nginx_desc": "NGINX web server with Let's Encrypt HTTPS certificate and editable index.html.",
"nginx_domain": "Domain",
"nginx_email": "Let's Encrypt email",
"nginx_port_hint": "HTTPS port exposed on the server. Port 80/TCP must be free and reachable for Let's Encrypt validation.",
"nginx_install_hint": "The domain must already point to this server. Port 80/TCP is used temporarily/permanently for HTTP-01 certificate validation.",
"site": "Site",
"site_editor": "Site editor",
"site_saved": "Site saved",
"nginx_dns_hint": "Create this DNS record before installation:",
"backup": "Backup",
"backups": "Backups",
"backup_desc": "Backups are created on the server and contain valuable protocol files needed to restore or recreate it later.",
"create_backup": "Create backup",
"creating_backup": "Creating backup...",
"backup_created": "Backup created",
"no_backups": "No backups yet",
"no_backups_desc": "Create the first backup for this protocol.",
"refresh": "Refresh"
}
translations/fa.json
+390
View File
@@ -0,0 +1,390 @@
{
"nav_servers": "سرورها",
"nav_users": "کاربران",
"nav_settings": "تنظیمات",
"nav_connections": "اتصال‌ها",
"nav_logout": "خروج",
"theme_dark": "تاریک",
"theme_light": "روشن",
"back_to_servers": "← بازگشت به سرورها",
"server_check": "بررسی",
"server_checking": "در حال بررسی...",
"protocols": "پروتکل‌ها",
"install": "نصب",
"uninstall": "حذف نصب",
"run": "در حال اجرا",
"stop": "متوقف شده",
"not_installed": "نصب نشده",
"installed": "نصب شده",
"add_server": "افزودن سرور",
"no_servers": "هیچ سروری اضافه نشده است",
"name": "نام",
"host": "میزبان",
"port": "پورت",
"status": "وضعیت",
"actions": "عملکردها",
"edit": "ویرایش",
"delete": "حذف",
"save": "ذخیره",
"cancel": "لغو",
"loading": "در حال بارگذاری...",
"copy": "کپی",
"download": "دانلود",
"config": "پیکربندی",
"qr_code": "کد QR",
"vpn_key": "کلید VPN",
"clients": "کلاینت‌ها",
"traffic": "ترافیک",
"limit": "محدودیت",
"manage": "مدیریت",
"no_protocols": "بدون پروتکل",
"add_server_desc": "اولین سرور VPN خود را اضافه کنید. برای اتصال به اطلاعات SSH نیاز دارید.",
"ssh_host": "میزبان / IP",
"ssh_port": "پورت SSH",
"ssh_user": "نام کاربری",
"ssh_password": "رمز عبور",
"ssh_key": "کلید SSH",
"ssh_key_placeholder": "کلید خصوصی SSH",
"ssh_key_hint": "محتوای فایل id_rsa یا id_ed25519 خود را اینجا قرار دهید",
"connect": "اتصال",
"connecting": "در حال اتصال...",
"server_added": "سرور با موفقیت اضافه شد",
"server_deleted": "سرور حذف شد",
"delete_confirm": "آیا از حذف این سرور مطمئن هستید؟",
"success": "موفقیت",
"error": "خطا",
"info": "اطلاعات",
"login_title": "ورود به پنل",
"username": "نام کاربری",
"password": "رمز عبور",
"captcha": "کد امنیتی",
"captcha_placeholder": "کاراکترهای تصویر را وارد کنید",
"captcha_hint": "برای نوسازی تصویر کلیک کنید",
"login": "ورود",
"logging_in": "در حال ورود...",
"login_error": "ورود ناموفق بود",
"check_done": "بررسی کامل شد",
"check_error": "خطای اتصال",
"ssh_ok": "اتصال SSH برقرار است",
"docker_ok": "داکر نصب است",
"docker_not_installed": "داکر نصب نیست",
"awg_desc": "نسخه جدید پروتکل بر پایه awg-go. پشتیبانی از مبهم‌سازی پیشرفته (S3, S4).",
"awg_legacy_desc": "نسخه اصلی AWG. سازگار با نسخه‌های قدیمی کلاینت.",
"xray_desc": "تغییر ظاهر ترافیک به ترافیک معمولی وب (XTLS-Reality). مقاوم در برابر فیلترینگ شدید.",
"not_checked": "بررسی نشده",
"connections": "اتصال‌ها",
"add": "افزودن",
"loading_connections": "در حال بارگذاری اتصال‌ها...",
"no_connections": "بدون اتصال",
"no_connections_desc": "اولین اتصال خود را برای ایجاد پیکربندی VPN اضافه کنید",
"install_protocol": "نصب پروتکل",
"port_default_hint": "پورت پیش‌فرض: 55424. مطمئن شوید این پورت آزاد است.",
"port_xray_hint": "پورت پیشنهادی: 443. مطمئن شوید توسط وب‌سرور دیگری اشغال نشده باشد.",
"reinstall": "نصب مجدد",
"uninstall_confirm": "حذف نصب {}؟ تمام اتصال‌ها و پیکربندی‌ها از بین خواهند رفت.",
"stop_container_confirm": "توقف کانتینر {}؟",
"start_container_confirm": "شروع کانتینر {}؟",
"stopping": "در حال توقف",
"starting": "در حال شروع",
"stopped": "متوقف شد",
"started": "شروع شد",
"server_config": "پیکربندی سرور",
"add_connection": "افزودن اتصال",
"connection_name": "نام اتصال",
"connection_name_placeholder": "مثال: iPhone, Laptop",
"assign_to_user": "تخصیص به کاربر (اختیاری)",
"no_assign": "— بدون تخصیص —",
"create": "ایجاد",
"creating": "در حال ایجاد...",
"connection_created": "اتصال \"{}\" ایجاد شد",
"delete_connection_confirm": "این اتصال حذف شود؟ پیکربندی دیگر کار نخواهد کرد.",
"connection_deleted": "اتصال حذف شد",
"config_tab": "📄 فایل",
"vpn_key_tab": "🔑 کلید-VPN",
"qr_code_tab": "📱 کد-QR",
"copy_config": "📋 کپی",
"download_conf": "⬇ دانلود .conf",
"copy_key": "📋 کپی کلید",
"vpn_link_hint": "این لینک را برای تنظیم خودکار در برنامه AmneziaVPN وارد کنید",
"qr_hint": "کد QR را در برنامه AmneziaVPN اسکن کنید",
"no_data": "بدون داده",
"start_btn": "▶ شروع",
"stop_btn": "⏹ توقف",
"config_btn": "⚙️ تنظیم",
"done": "انجام شد",
"installing": "در حال نصب...",
"start_install": "شروع نصب...",
"check_docker": "بررسی داکر...",
"prepare_host": "آماده‌سازی میزبان...",
"build_container": "ساخت کانتینر...",
"install_success": "پروتکل با موفقیت نصب شد!",
"install_error": "خطا در نصب: ",
"qr_error": "ایجاد کد QR ناموفق بود",
"users_title": "کاربران",
"search_placeholder": "جستجو با نام، ایمیل یا تلگرام...",
"add_user": "افزودن کاربر",
"prev_page": "← قبلی",
"next_page": "بعدی →",
"page_info": "صفحه {} از {}",
"loading_users": "در حال بارگذاری کاربران...",
"nothing_found": "چیزی یافت نشد",
"search_empty_desc": "جستجوی دیگری را امتحان کنید یا کاربر جدید بسازید",
"username_label": "نام کاربری",
"password_label": "رمز عبور",
"role_label": "نقش",
"role_user_desc": "User — فقط مشاهده اتصال‌های خود",
"role_support_desc": "Support — مدیریت سرورها",
"role_admin_desc": "Admin — دسترسی کامل",
"tg_id_label": "آیدی تلگرام (اختیاری)",
"email_label": "ایمیل (اختیاری)",
"traffic_limit_label": "محدودیت ترافیک (گیگابایت) (0 = نامحدود)",
"description_label": "توضیحات (اختیاری)",
"auto_conn_title": "ایجاد خودکار اتصال (اختیاری)",
"server_label": "سرور",
"no_create_conn": "— عدم ایجاد اتصال —",
"protocol_label": "پروتکل",
"edit_user_title": "ویرایش کاربر: {}",
"edit_user_tg": "آیدی تلگرام (اختیاری)",
"edit_user_email": "ایمیل (اختیاری)",
"edit_user_limit": "محدودیت ترافیک (گیگابایت) (0 = نامحدود)",
"new_password_hint": "رمز عبور جدید (اگر تغییری نمی‌خواهید خالی بگذارید)",
"op_type_label": "نوع عملیات",
"create_new_conn": "ایجاد اتصال جدید",
"link_existing_conn": "اتصال به موجود",
"select_existing_conn": "انتخاب اتصال موجود",
"existing_conn_hint": "فقط اتصال‌های بدون کاربر نمایش داده می‌شوند",
"conn_name_panel": "نام اتصال (در پنل)",
"user_conns_title": "اتصال‌های کاربر",
"no_free_conns": "اتصال آزاد موجود نیست",
"linking": "در حال اتصال...",
"conn_linked": "اتصال برقرار شد",
"enabling": "در حال فعال‌سازی",
"disabling": "در حال غیرفعال‌سازی",
"user_enabled": "کاربر فعال شد",
"user_disabled": "کاربر غیرفعال شد",
"delete_user_confirm": "کاربر حذف شود؟ تمام اتصال‌های او حذف خواهند شد.",
"share_access": "اشتراک‌گذاری دسترسی",
"enable_public_access": "فعال‌سازی دسترسی عمومی",
"share_password_label": "رمز عبور (اختیاری)",
"share_password_hint": "در صورت تنظیم، کاربر باید آن را وارد کند",
"public_link_label": "لینک عمومی",
"disabled": "غیرفعال",
"out_of": "از",
"settings_title": "تنظیمات پنل",
"appearance": "🎨 ظاهر",
"title_label": "عنوان (Title)",
"logo_label": "لوگو (ایموجی یا نماد)",
"subtitle_label": "زیرعنوان (Subtitle)",
"captcha_title": "🔐 کد امنیتی",
"enable_captcha": "فعال‌سازی کد امنیتی",
"telegram_bot_title": "🤖 ربات تلگرام",
"bot_token_label": "توکن ربات (از @BotFather)",
"bot_status": "وضعیت",
"bot_running": "✅ در حال اجرا",
"bot_stopped": "⏹ متوقف شده",
"bot_stop_btn": "⏹ توقف",
"bot_start_btn": "▶️ شروع",
"bot_hint": "پس از تغییر توکن تنظیمات را ذخیره کنید تا ربات بازراه‌اندازی شود.",
"api_docs_title": "🔌 مستندات API",
"api_docs_hint": "از این رابط‌ها برای بررسی قابلیت‌های API استفاده کنید",
"tunnels_title": "Tunnels",
"local_server": "سرور محلی",
"tunnel_install_enable": "نصب و فعال‌سازی",
"tunnel_enable": "فعال‌سازی تونل",
"tunnel_running": "تونل در حال اجرا است",
"tunnel_stop": "توقف",
"tunnel_stopping": "در حال توقف...",
"tunnel_stopped": "تونل متوقف شد",
"tunnel_delete": "حذف",
"tunnel_deleted": "تونل حذف شد",
"tunnel_delete_confirm": "این فایل اجرایی تونل مدیریت‌شده توسط پنل متوقف و حذف شود؟",
"tunnel_starting": "در حال شروع تونل...",
"tunnel_started": "تونل شروع شد",
"tunnel_waiting_url": "تونل شروع شد. در انتظار آدرس عمومی...",
"tunnel_no_public_url": "آدرس عمومی پس از شروع تونل اینجا نمایش داده می‌شود.",
"tunnels_hint": "تونل‌های سریع این پنل محلی را در اینترنت منتشر می‌کنند. رمز مدیر را قوی نگه دارید و آدرس‌های عمومی را فقط با کاربران مورد اعتماد به اشتراک بگذارید.",
"ngrok_authtoken_placeholder": "ngrok authtoken (برای برخی حساب‌ها اختیاری است)",
"import_users_title": "📤 وارد کردن کاربران",
"import_source_label": "منبع وارد کردن / همگام‌سازی",
"remnawave_url_label": "آدرس Remnawave",
"api_key_label": "کلید API",
"enable_sync": "فعال‌سازی همگام‌سازی",
"sync_hint": "کاربران طبق داده‌های Remnawave به‌طور خودکار مدیریت می‌شوند",
"sync_now_btn": "🔄 همگام‌سازی اکنون",
"delete_sync_btn": "🗑 حذف همگام‌سازی",
"auto_create_conns": "ایجاد خودکار اتصال‌ها",
"sync_server_label": "سرور برای اتصال‌های جدید",
"save_changes": "💾 ذخیره تغییرات",
"sync_success": "همگام‌سازی انجام شد: {} کاربر",
"sync_deleted": "{} کاربر همگام‌سازی شده حذف شدند",
"delete_sync_confirm": "آیا از حذف تمام کاربران همگام‌سازی شده مطمئن هستید؟",
"settings_saved": "تنظیمات با موفقیت ذخیره شد",
"bot_started": "ربات شروع به کار کرد",
"bot_stopped_msg": "ربات متوقف شد",
"sync_running": "در حال همگام‌سازی...",
"deleting": "در حال حذف...",
"my_connections_title": "اتصال‌های من",
"show_config": "📄 نمایش پیکربندی",
"no_connections_user_desc": "برای ایجاد اتصال VPN با مدیر تماس بگیرید",
"share_title": "دسترسی به اتصال",
"vpn_access": "دسترسی VPN",
"user_label_share": "کاربر",
"share_protected_desc": "این دسترسی با رمز عبور محافظت شده است.",
"auth_success": "ورود موفقیت‌آمیز",
"loading_share_conns": "در حال بارگذاری...",
"no_active_conns": "هنوز هیچ اتصال فعالی ندارید.",
"show_settings_btn": "🔑 نمایش تنظیمات",
"copied": "کپی شد!",
"active": "فعال",
"site_description": "پنل وب آمنزیا — مدیریت سرورها و پروتکل‌های AmneziaWG",
"toggle_theme": "تغییر تم",
"copied_to_clipboard": "در حافظه کپی شد",
"share_not_found": "404 یافت نشد",
"share_not_found_desc": "لینک اشتباه است یا دسترسی غیرفعال شده است.",
"invalid_captcha": "کد امنیتی اشتباه است",
"account_disabled": "حساب کاربری غیرفعال است",
"invalid_login": "نام کاربری یا رمز عبور اشتباه است",
"user_exists": "کاربری با این نام قبلاً ثبت شده است",
"cannot_delete_self": "شما نمی‌توانید خودتان را حذف کنید",
"wrong_share_password": "رمز عبور اشتباه است",
"saving": "در حال ذخیره...",
"select_lang": "انتخاب زبان",
"lang_ru": "Русский",
"lang_en": "English",
"lang_fr": "Français",
"lang_zh": "中文 (Chinese)",
"lang_fa": "فارسی (Persian)",
"backup_title": "پشتیبان‌گیری ساده",
"download_backup": "دانلود data.json",
"restore_backup": "بازیابی از فایل",
"restore_confirm": "آیا مطمئن هستید؟ داده‌های فعلی بازنویسی می‌شوند و برنامه دوباره راه‌اندازی خواهد شد.",
"restore_success": "بازیابی موفقیت‌آمیز بود! در حال راه‌اندازی مجدد...",
"invalid_backup_file": "فایل پشتیبان یا ساختار نامعتبر است",
"config_unavailable": "پیکربندی در دسترس نیست",
"config_unavailable_desc": "این کلاینت از طریق اپلیکیشن اصلی Amnezia ایجاد شده است.\\nکلید خصوصی فقط در دستگاه کاربر ذخیره می‌شود و توسط سرور قابل بازیابی نیست.",
"client_public_key": "کلید عمومی کلاینت:",
"management": "مدیریت",
"server_management": "مدیریت سرور",
"server_management_desc": "انجام اقدامات در سطح سیستم روی دستگاه شما.",
"check_server_services": "بررسی سرویس‌های سرور",
"reboot_server": "راه‌اندازی مجدد سرور",
"clear_server": "پاک‌سازی سرور",
"remove_server": "حذف سرور از پنل",
"telemt_desc": "پروکسی تلگرام بر پایه‌ی MTProxy با پوشش‌های پیشرفته.",
"dns_desc": "سرور DNS شخصی برای مسدود کردن تبلیغات و حفظ حریم خصوصی.",
"dns_internal_hint": "The service runs on the internal network (172.29.172.254) without binding to host ports.",
"telemt_port_hint": "Port for the Telegram proxy (typically 443).",
"socks5_desc": "Single-account SOCKS5 proxy (3proxy) with username/password authentication.",
"socks5_username": "Username",
"socks5_password": "Password",
"socks5_password_placeholder": "Leave empty to auto-generate",
"socks5_password_hint": "If left empty, a random 16-character password will be generated.",
"socks5_port_hint": "TCP port the proxy will listen on. The default in the official Amnezia client is 38080.",
"socks5_change_settings": "Change settings",
"socks5_settings_title": "SOCKS5 — Connection settings",
"socks5_port_change_hint": "Changing the port recreates the container; existing sessions will be dropped.",
"socks5_settings_saved": "SOCKS5 settings saved",
"adguard_desc": "AdGuard Home — DNS-based ad blocker with a web admin UI.",
"adguard_mode": "Installation mode",
"adguard_mode_sidebyside": "Side-by-side",
"adguard_mode_sidebyside_hint": "runs alongside AmneziaDNS on a separate internal IP (172.29.172.253)",
"adguard_mode_replace": "Replace AmneziaDNS",
"adguard_mode_replace_hint": "removes amnezia-dns and takes its IP — VPN clients use AdGuard immediately",
"adguard_dns_port": "DNS port (53)",
"adguard_dns_port_hint": "Internal DNS port served to VPN clients via the docker network.",
"adguard_web_port": "Web UI port",
"adguard_dot_port": "DoT port",
"adguard_doh_port": "DoH port",
"adguard_expose_web": "Expose to internet",
"adguard_expose": "Expose to host",
"adguard_install_hint": "Initial AdGuard setup runs through its built-in wizard via the web UI after install.",
"adguard_internal_ip": "Internal IP",
"adguard_web_ui": "Admin URL",
"adguard_open_ui": "Open Web UI",
"edit_server_title": "Edit server",
"edit_keep_credential": "Leave empty to keep the current value",
"server_saved": "Server settings saved",
"servers_reordered": "Servers reordered",
"ping_checking": "Checking connectivity...",
"offline": "offline",
"api_tokens_title": "API tokens",
"api_tokens_hint": "Bearer tokens for external integrations. Send the token in the `Authorization: Bearer <token>` header. Tokens have admin-equivalent rights and stop working if their owner is disabled or demoted.",
"api_tokens_empty": "No API tokens yet. Create one to integrate the panel with an external service.",
"api_tokens_create": "Create token",
"api_tokens_create_title": "Create API token",
"api_tokens_name_label": "Name",
"api_tokens_name_placeholder": "e.g. Linear integration, CI bot, monitoring",
"api_tokens_name_hint": "Used to identify this token in the list. The token value itself is generated for you.",
"api_tokens_name_required": "Token name is required",
"api_tokens_created_title": "Token created",
"api_tokens_value_label": "Token value",
"api_tokens_warning_title": "This is the only time you'll see this token.",
"api_tokens_warning_body": "Copy it now and store it in your integration's secret manager. The panel keeps only a hash — if you lose this value you'll need to revoke and recreate the token.",
"api_tokens_revoke": "Revoke",
"api_tokens_revoke_confirm": "Revoke token \"{}\"? Any integration using it will stop working.",
"api_tokens_revoked": "Token revoked",
"api_tokens_created": "Created",
"api_tokens_last_used": "Last used",
"api_tokens_owner": "Owner",
"api_tokens_never": "never",
"coming_soon": "Coming soon",
"promo_star_cta": "Star us on GitHub",
"aivpn_subtitle": "AI-driven protocol selection that picks the right tunnel for the moment. Land it sooner — drop a star.",
"revproxy_title": "Reverse Proxy",
"revproxy_subtitle": "High-performance traffic obfuscation: hide your VPN endpoint behind a polished public-facing site, drop the DPI footprint.",
"warp_hint": "WARP routes this host outbound through Cloudflare. It does not create a public panel URL like Quick Tunnel or ngrok.",
"warp_install_hint": "Install the official Cloudflare WARP client first, then restart the panel.",
"warp_install_required": "Install WARP first",
"warp_connect": "Connect WARP",
"warp_disconnect": "Disconnect",
"warp_connected": "WARP connected",
"warp_disconnected": "WARP disconnected",
"warp_status_unknown": "WARP status is unknown.",
"warp_status_not_installed": "Cloudflare WARP CLI is not installed on this host.",
"warp_status_connected": "Cloudflare WARP is connected.",
"warp_status_connecting": "Cloudflare WARP is connecting.",
"warp_status_disconnected": "Cloudflare WARP is disconnected.",
"warp_status_not_registered": "Cloudflare WARP is installed but not registered yet. Connect will try to register automatically.",
"warp_status_service_unavailable": "Cloudflare WARP service is not available. Make sure warp-svc is running.",
"warp_status_error": "Cloudflare WARP returned an error.",
"install_starting": "Starting installation...",
"server_check_complete": "Check completed",
"server_connection_error": "Connection error",
"connections_load_error": "Error loading connections",
"connection_updated": "Connection updated",
"edit_connection": "Edit connection",
"enable_connection_progress": "Enabling connection...",
"disable_connection_progress": "Disabling connection...",
"connection_enabled": "Connection enabled",
"connection_disabled": "Connection disabled",
"gb": "GB",
"marketplace": "Templates",
"open_marketplace": "Open Templates",
"marketplace_desc": "Install protocol and service templates available for this server.",
"installed_apps": "Installed applications",
"installed_apps_hint": "Only installed protocols and services are shown here. Use Templates to add more.",
"no_installed_apps": "No installed applications yet",
"no_installed_apps_desc": "Open Templates to install protocols or services on this server.",
"install_another": "Install another",
"new_instance": "new instance",
"port_next_instance_hint": "Choose a free UDP port for the additional instance.",
"web_servers": "Web servers",
"nginx_desc": "NGINX web server with Let's Encrypt HTTPS certificate and editable index.html.",
"nginx_domain": "Domain",
"nginx_email": "Let's Encrypt email",
"nginx_port_hint": "HTTPS port exposed on the server. Port 80/TCP must be free and reachable for Let's Encrypt validation.",
"nginx_install_hint": "The domain must already point to this server. Port 80/TCP is used for HTTP-01 certificate validation.",
"site": "Site",
"site_editor": "Site editor",
"site_saved": "Site saved",
"nginx_dns_hint": "Create this DNS record before installation:",
"backup": "Backup",
"backups": "Backups",
"backup_desc": "Backups are created on the server and contain valuable protocol files needed to restore or recreate it later.",
"create_backup": "Create backup",
"creating_backup": "Creating backup...",
"backup_created": "Backup created",
"no_backups": "No backups yet",
"no_backups_desc": "Create the first backup for this protocol.",
"refresh": "Refresh"
}
translations/fr.json
+390
View File
@@ -0,0 +1,390 @@
{
"nav_servers": "Serveurs",
"nav_users": "Utilisateurs",
"nav_settings": "Paramètres",
"nav_connections": "Connexions",
"nav_logout": "Déconnexion",
"theme_dark": "Sombre",
"theme_light": "Clair",
"back_to_servers": "← Retour aux serveurs",
"server_check": "Vérifier",
"server_checking": "Vérification...",
"protocols": "Protocoles",
"install": "Installer",
"uninstall": "Désinstaller",
"run": "En cours",
"stop": "Arrêté",
"not_installed": "Pas installé",
"installed": "Installé",
"add_server": "Ajouter un serveur",
"no_servers": "Aucun serveur ajouté",
"name": "Nom",
"host": "Hôte",
"port": "Port",
"status": "Statut",
"actions": "Actions",
"edit": "Modifier",
"delete": "Supprimer",
"save": "Enregistrer",
"cancel": "Annuler",
"loading": "Chargement...",
"copy": "Copier",
"download": "Télécharger",
"config": "Configuration",
"qr_code": "Code QR",
"vpn_key": "Clé VPN",
"clients": "Clients",
"traffic": "Trafic",
"limit": "Limite",
"manage": "Gérer",
"no_protocols": "Aucun protocole",
"add_server_desc": "Ajoutez votre premier serveur VPN pour commencer. Identifiants SSH requis.",
"ssh_host": "Hôte / IP",
"ssh_port": "Port SSH",
"ssh_user": "Utilisateur",
"ssh_password": "Mot de passe",
"ssh_key": "Clé SSH",
"ssh_key_placeholder": "Clé SSH privée",
"ssh_key_hint": "Collez le contenu de votre fichier id_rsa ou id_ed25519",
"connect": "Connecter",
"connecting": "Connexion...",
"server_added": "Serveur ajouté avec succès",
"server_deleted": "Serveur supprimé",
"delete_confirm": "Voulez-vous vraiment supprimer ce serveur ?",
"success": "Succès",
"error": "Erreur",
"info": "Info",
"login_title": "Connexion au Panneau",
"username": "Nom d'utilisateur",
"password": "Mot de passe",
"captcha": "Captcha",
"captcha_placeholder": "Entrez les caractères",
"captcha_hint": "Cliquez pour rafraîchir",
"login": "Connexion",
"logging_in": "Connexion...",
"login_error": "Échec de la connexion",
"check_done": "Vérification terminée",
"check_error": "Erreur de connexion",
"ssh_ok": "Connexion SSH",
"docker_ok": "Docker",
"docker_not_installed": "Docker non installé",
"awg_desc": "Version moderne basée sur awg-go. Obfuscation avancée (S3, S4).",
"awg_legacy_desc": "Version AWG originale. Compatible avec les anciens clients.",
"xray_desc": "Masque le trafic en trafic web normal (XTLS-Reality). Résiste au DPI.",
"not_checked": "Non vérifié",
"connections": "Connexions",
"add": "Ajouter",
"loading_connections": "Chargement des connexions...",
"no_connections": "Aucune connexion",
"no_connections_desc": "Ajoutez votre première connexion pour générer un fichier VPN",
"install_protocol": "Installer le protocole",
"port_default_hint": "Port par défaut : 55424. Assurez-vous qu'il est libre.",
"port_xray_hint": "Port recommandé : 443. Assurez-vous qu'il n'est pas utilisé par un serveur web.",
"reinstall": "Réinstaller",
"uninstall_confirm": "Désinstaller {} ? Toutes les données seront perdues.",
"stop_container_confirm": "Arrêter le conteneur {} ?",
"start_container_confirm": "Démarrer le conteneur {} ?",
"stopping": "Arrêt",
"starting": "Démarrage",
"stopped": "arrêté",
"started": "démarré",
"server_config": "Configuration du serveur",
"add_connection": "Ajouter une connexion",
"connection_name": "Nom de la connexion",
"connection_name_placeholder": "Ex: iPhone, Laptop",
"assign_to_user": "Assigner à l'utilisateur (optionnel)",
"no_assign": "— Aucune assignation —",
"create": "Créer",
"creating": "Création...",
"connection_created": "Connexion \"{}\" créée",
"delete_connection_confirm": "Supprimer cette connexion ? Elle cessera de fonctionner.",
"connection_deleted": "Connexion supprimée",
"config_tab": "📄 Config",
"vpn_key_tab": "🔑 Clé-VPN",
"qr_code_tab": "📱 Code-QR",
"copy_config": "📋 Copier",
"download_conf": "⬇ Télécharger .conf",
"copy_key": "📋 Copier la clé",
"vpn_link_hint": "Collez ce lien dans AmneziaVPN pour une config automatique",
"qr_hint": "Scannez le code QR dans l'application AmneziaVPN",
"no_data": "Aucune donnée",
"start_btn": "▶ Start",
"stop_btn": "⏹ Stop",
"config_btn": "⚙️ Config",
"done": "Terminé",
"installing": "Installation...",
"start_install": "Début de l'installation...",
"check_docker": "Vérification de Docker...",
"prepare_host": "Préparation de l'hôte...",
"build_container": "Construction du conteneur...",
"install_success": "Protocole installé avec succès !",
"install_error": "Erreur d'installation : ",
"qr_error": "Échec de génération du QR code",
"users_title": "Utilisateurs",
"search_placeholder": "Recherche par nom, email ou Telegram...",
"add_user": "Ajouter Utilisateur",
"prev_page": "← Retour",
"next_page": "Suivant →",
"page_info": "Page {} sur {}",
"loading_users": "Chargement des utilisateurs...",
"nothing_found": "Rien trouvé",
"search_empty_desc": "Essayez une autre requête ou créez un utilisateur",
"username_label": "Nom d'utilisateur",
"password_label": "Mot de passe",
"role_label": "Rôle",
"role_user_desc": "User — voit ses propres connexions",
"role_support_desc": "Support — gestion des serveurs",
"role_admin_desc": "Admin — accès complet",
"tg_id_label": "ID Telegram (opt.)",
"email_label": "Email (opt.)",
"traffic_limit_label": "Limite trafic (Go) (0 = illimité)",
"description_label": "Description (opt.)",
"auto_conn_title": "Création auto de connexion (optionnel)",
"server_label": "Serveur",
"no_create_conn": "— Ne pas créer —",
"protocol_label": "Protocole",
"edit_user_title": "Modifier utilisateur : {}",
"edit_user_tg": "ID Telegram (optionnel)",
"edit_user_email": "Email (optionnel)",
"edit_user_limit": "Limite trafic (Go) (0 = illimité)",
"new_password_hint": "Nouveau mot de passe (laisser vide si inchangé)",
"op_type_label": "Type d'opération",
"create_new_conn": "Créer nouvelle connexion",
"link_existing_conn": "Lier existante",
"select_existing_conn": "Sélectionner connexion",
"existing_conn_hint": "Seules les connexions libres sont affichées",
"conn_name_panel": "Nom (dans le panneau)",
"user_conns_title": "Connexions utilisateur",
"no_free_conns": "Aucune connexion libre",
"linking": "Liaison...",
"conn_linked": "Connexion liée",
"enabling": "Activation",
"disabling": "Désactivation",
"user_enabled": "Utilisateur activé",
"user_disabled": "Utilisateur désactivé",
"delete_user_confirm": "Supprimer l'utilisateur ? Ses connexions seront supprimées.",
"share_access": "Partager l'accès",
"enable_public_access": "Activer l'accès public",
"share_password_label": "Mot de passe (optionnel)",
"share_password_hint": "Si défini, requis pour l'accès",
"public_link_label": "Lien public",
"disabled": "Désactivé",
"out_of": "sur",
"settings_title": "Paramètres du Panneau",
"appearance": "🎨 Apparence",
"title_label": "Titre",
"logo_label": "Logo (Emoji ou symbole)",
"subtitle_label": "Sous-titre",
"captcha_title": "🔐 Captcha",
"enable_captcha": "Activer captcha",
"telegram_bot_title": "🤖 Bot Telegram",
"bot_token_label": "Bot Token (@BotFather)",
"bot_status": "Statut",
"bot_running": "✅ En cours",
"bot_stopped": "⏹ Arrêté",
"bot_stop_btn": "⏹ Arrêter",
"bot_start_btn": "▶️ Démarrer",
"bot_hint": "Sauvegardez après modification du token. Le bot redémarrera.",
"api_docs_title": "🔌 Documentation API",
"api_docs_hint": "Utilisez ces interfaces pour explorer l'API",
"tunnels_title": "Tunnels",
"local_server": "Serveur local",
"tunnel_install_enable": "Installer et activer",
"tunnel_enable": "Activer le tunnel",
"tunnel_running": "Tunnel en cours",
"tunnel_stop": "Arrêter",
"tunnel_stopping": "Arrêt...",
"tunnel_stopped": "Tunnel arrêté",
"tunnel_delete": "Supprimer",
"tunnel_deleted": "Tunnel supprimé",
"tunnel_delete_confirm": "Arrêter et supprimer ce binaire de tunnel géré par le panneau ?",
"tunnel_starting": "Démarrage du tunnel...",
"tunnel_started": "Tunnel démarré",
"tunnel_waiting_url": "Tunnel démarré. En attente de l'URL publique...",
"tunnel_no_public_url": "L'URL publique apparaîtra ici après le démarrage du tunnel.",
"tunnels_hint": "Les tunnels rapides exposent ce panneau local sur Internet. Gardez des identifiants administrateur robustes et partagez les URL publiques uniquement avec des utilisateurs de confiance.",
"ngrok_authtoken_placeholder": "ngrok authtoken (optionnel pour certains comptes)",
"import_users_title": "📤 Import Utilisateurs",
"import_source_label": "Source Import / Sync",
"remnawave_url_label": "URL Remnawave",
"api_key_label": "Clé API",
"enable_sync": "Activer synchronisation",
"sync_hint": "Synchro automatique avec Remnawave",
"sync_now_btn": "🔄 Sync maintenant",
"delete_sync_btn": "🗑 Supprimer synchro",
"auto_create_conns": "Créer connexions auto",
"sync_server_label": "Serveur pour nouvelles connexions",
"save_changes": "💾 Enregistrer changements",
"sync_success": "Sync terminée : {} utilisateurs",
"sync_deleted": "Supprimé {} utilisateurs sync",
"delete_sync_confirm": "Supprimer TOUS les utilisateurs synchronisés ? Irréversible.",
"settings_saved": "Paramètres enregistrés",
"bot_started": "Bot démarré",
"bot_stopped_msg": "Bot arrêté",
"sync_running": "Synchronisation...",
"deleting": "Suppression...",
"my_connections_title": "Mes Connexions",
"show_config": "📄 Voir config",
"no_connections_user_desc": "Contactez l'admin pour une connexion",
"share_title": "Accès Connexion",
"vpn_access": "Accès VPN",
"user_label_share": "Utilisateur",
"share_protected_desc": "Accès protégé par mot de passe.",
"auth_success": "Succès Auth",
"loading_share_conns": "Chargement...",
"no_active_conns": "Aucune connexion active.",
"show_settings_btn": "🔑 Voir paramètres",
"copied": "Copié !",
"active": "Actif",
"site_description": "Panneau Web Amnezia — gestion serveurs VPN et AmneziaWG",
"toggle_theme": "Changer thème",
"copied_to_clipboard": "Copié dans le presse-papier",
"share_not_found": "404 Introuvable",
"share_not_found_desc": "Lien invalide ou accès désactivé.",
"invalid_captcha": "Captcha invalide",
"account_disabled": "Compte désactivé",
"invalid_login": "Login ou password incorrect",
"user_exists": "L'utilisateur existe déjà",
"cannot_delete_self": "Vous ne pouvez pas vous supprimer",
"wrong_share_password": "Mauvais mot de passe",
"saving": "Enregistrement...",
"select_lang": "Choisir la langue",
"lang_ru": "Русский",
"lang_en": "English",
"lang_fr": "Français",
"lang_zh": "中文 (Chinese)",
"lang_fa": "فارسی (Persian)",
"backup_title": "Sauvegarde Simple",
"download_backup": "Télécharger data.json",
"restore_backup": "Restaurer depuis un fichier",
"restore_confirm": "Êtes-vous sûr ? Les données actuelles seront écrasées et l'application redémarrera.",
"restore_success": "Restauration réussie ! Redémarrage...",
"invalid_backup_file": "Fichier de sauvegarde ou structure invalide",
"config_unavailable": "Configuration indisponible",
"config_unavailable_desc": "Ce client a été créé via l'application native Amnezia.\\nLa clé privée est stockée uniquement sur l'appareil de l'utilisateur et ne peut pas être récupérée par le serveur.",
"client_public_key": "Clé publique du client :",
"management": "Gestion",
"server_management": "Gestion du serveur",
"server_management_desc": "Effectuer des actions au niveau du système sur votre machine.",
"check_server_services": "Vérifier les services du serveur",
"reboot_server": "Redémarrer le serveur",
"clear_server": "Réinitialiser le serveur",
"remove_server": "Retirer le serveur du panneau",
"telemt_desc": "Proxy Telegram basé sur MTProxy avec obfuscation avancée.",
"dns_desc": "Serveur DNS personnel pour bloquer les publicités et protéger la vie privée.",
"dns_internal_hint": "The service runs on the internal network (172.29.172.254) without binding to host ports.",
"telemt_port_hint": "Port for the Telegram proxy (typically 443).",
"socks5_desc": "Single-account SOCKS5 proxy (3proxy) with username/password authentication.",
"socks5_username": "Username",
"socks5_password": "Password",
"socks5_password_placeholder": "Leave empty to auto-generate",
"socks5_password_hint": "If left empty, a random 16-character password will be generated.",
"socks5_port_hint": "TCP port the proxy will listen on. The default in the official Amnezia client is 38080.",
"socks5_change_settings": "Change settings",
"socks5_settings_title": "SOCKS5 — Connection settings",
"socks5_port_change_hint": "Changing the port recreates the container; existing sessions will be dropped.",
"socks5_settings_saved": "SOCKS5 settings saved",
"adguard_desc": "AdGuard Home — DNS-based ad blocker with a web admin UI.",
"adguard_mode": "Installation mode",
"adguard_mode_sidebyside": "Side-by-side",
"adguard_mode_sidebyside_hint": "runs alongside AmneziaDNS on a separate internal IP (172.29.172.253)",
"adguard_mode_replace": "Replace AmneziaDNS",
"adguard_mode_replace_hint": "removes amnezia-dns and takes its IP — VPN clients use AdGuard immediately",
"adguard_dns_port": "DNS port (53)",
"adguard_dns_port_hint": "Internal DNS port served to VPN clients via the docker network.",
"adguard_web_port": "Web UI port",
"adguard_dot_port": "DoT port",
"adguard_doh_port": "DoH port",
"adguard_expose_web": "Expose to internet",
"adguard_expose": "Expose to host",
"adguard_install_hint": "Initial AdGuard setup runs through its built-in wizard via the web UI after install.",
"adguard_internal_ip": "Internal IP",
"adguard_web_ui": "Admin URL",
"adguard_open_ui": "Open Web UI",
"edit_server_title": "Edit server",
"edit_keep_credential": "Leave empty to keep the current value",
"server_saved": "Server settings saved",
"servers_reordered": "Servers reordered",
"ping_checking": "Checking connectivity...",
"offline": "offline",
"api_tokens_title": "API tokens",
"api_tokens_hint": "Bearer tokens for external integrations. Send the token in the `Authorization: Bearer <token>` header. Tokens have admin-equivalent rights and stop working if their owner is disabled or demoted.",
"api_tokens_empty": "No API tokens yet. Create one to integrate the panel with an external service.",
"api_tokens_create": "Create token",
"api_tokens_create_title": "Create API token",
"api_tokens_name_label": "Name",
"api_tokens_name_placeholder": "e.g. Linear integration, CI bot, monitoring",
"api_tokens_name_hint": "Used to identify this token in the list. The token value itself is generated for you.",
"api_tokens_name_required": "Token name is required",
"api_tokens_created_title": "Token created",
"api_tokens_value_label": "Token value",
"api_tokens_warning_title": "This is the only time you'll see this token.",
"api_tokens_warning_body": "Copy it now and store it in your integration's secret manager. The panel keeps only a hash — if you lose this value you'll need to revoke and recreate the token.",
"api_tokens_revoke": "Revoke",
"api_tokens_revoke_confirm": "Revoke token \"{}\"? Any integration using it will stop working.",
"api_tokens_revoked": "Token revoked",
"api_tokens_created": "Created",
"api_tokens_last_used": "Last used",
"api_tokens_owner": "Owner",
"api_tokens_never": "never",
"coming_soon": "Coming soon",
"promo_star_cta": "Star us on GitHub",
"aivpn_subtitle": "AI-driven protocol selection that picks the right tunnel for the moment. Land it sooner — drop a star.",
"revproxy_title": "Reverse Proxy",
"revproxy_subtitle": "High-performance traffic obfuscation: hide your VPN endpoint behind a polished public-facing site, drop the DPI footprint.",
"warp_hint": "WARP routes this host outbound through Cloudflare. It does not create a public panel URL like Quick Tunnel or ngrok.",
"warp_install_hint": "Install the official Cloudflare WARP client first, then restart the panel.",
"warp_install_required": "Install WARP first",
"warp_connect": "Connect WARP",
"warp_disconnect": "Disconnect",
"warp_connected": "WARP connected",
"warp_disconnected": "WARP disconnected",
"warp_status_unknown": "WARP status is unknown.",
"warp_status_not_installed": "Cloudflare WARP CLI is not installed on this host.",
"warp_status_connected": "Cloudflare WARP is connected.",
"warp_status_connecting": "Cloudflare WARP is connecting.",
"warp_status_disconnected": "Cloudflare WARP is disconnected.",
"warp_status_not_registered": "Cloudflare WARP is installed but not registered yet. Connect will try to register automatically.",
"warp_status_service_unavailable": "Cloudflare WARP service is not available. Make sure warp-svc is running.",
"warp_status_error": "Cloudflare WARP returned an error.",
"install_starting": "Starting installation...",
"server_check_complete": "Check completed",
"server_connection_error": "Connection error",
"connections_load_error": "Error loading connections",
"connection_updated": "Connection updated",
"edit_connection": "Edit connection",
"enable_connection_progress": "Enabling connection...",
"disable_connection_progress": "Disabling connection...",
"connection_enabled": "Connection enabled",
"connection_disabled": "Connection disabled",
"gb": "GB",
"marketplace": "Templates",
"open_marketplace": "Open Templates",
"marketplace_desc": "Install protocol and service templates available for this server.",
"installed_apps": "Installed applications",
"installed_apps_hint": "Only installed protocols and services are shown here. Use Templates to add more.",
"no_installed_apps": "No installed applications yet",
"no_installed_apps_desc": "Open Templates to install protocols or services on this server.",
"install_another": "Install another",
"new_instance": "new instance",
"port_next_instance_hint": "Choose a free UDP port for the additional instance.",
"web_servers": "Serveurs web",
"nginx_desc": "Serveur web NGINX avec certificat HTTPS Let's Encrypt et index.html modifiable.",
"nginx_domain": "Domaine",
"nginx_email": "Email Let's Encrypt",
"nginx_port_hint": "Port HTTPS exposé sur le serveur. Le port 80/TCP doit être libre et accessible pour la validation Let's Encrypt.",
"nginx_install_hint": "Le domaine doit déjà pointer vers ce serveur. Le port 80/TCP est utilisé pour la validation HTTP-01 du certificat.",
"site": "Site",
"site_editor": "Éditeur du site",
"site_saved": "Site enregistré",
"nginx_dns_hint": "Creez cet enregistrement DNS avant l installation :",
"backup": "Backup",
"backups": "Backups",
"backup_desc": "Backups are created on the server and contain valuable protocol files needed to restore or recreate it later.",
"create_backup": "Create backup",
"creating_backup": "Creating backup...",
"backup_created": "Backup created",
"no_backups": "No backups yet",
"no_backups_desc": "Create the first backup for this protocol.",
"refresh": "Refresh"
}
translations/ru.json
+423
View File
@@ -0,0 +1,423 @@
{
"nav_servers": "Серверы",
"nav_users": "Пользователи",
"nav_settings": "Настройки",
"nav_connections": "Подключения",
"nav_logout": "Выход",
"theme_dark": "Темная",
"theme_light": "Светлая",
"back_to_servers": "← Назад к серверам",
"server_check": "Проверить",
"server_checking": "Проверка...",
"protocols": "Протоколы",
"install": "Установить",
"uninstall": "Удалить",
"run": "Работает",
"stop": "Остановлен",
"not_installed": "Не установлен",
"installed": "Установлен",
"add_server": "Добавить сервер",
"no_servers": "Серверы не добавлены",
"name": "Название",
"host": "Адрес",
"port": "Порт",
"status": "Статус",
"actions": "Действия",
"edit": "Редактировать",
"delete": "Удалить",
"save": "Сохранить",
"cancel": "Отмена",
"loading": "Загрузка...",
"copy": "Копировать",
"download": "Скачать",
"config": "Конфигурация",
"qr_code": "QR-код",
"vpn_key": "VPN-ключ",
"clients": "Клиенты",
"traffic": "Трафик",
"limit": "Limit",
"manage": "Управление",
"no_protocols": "Нет протоколов",
"add_server_desc": "Добавьте свой первый VPN сервер для начала работы. Вам понадобятся SSH-данные для подключения.",
"ssh_host": "Хост / IP",
"ssh_port": "SSH Порт",
"ssh_user": "Пользователь",
"ssh_password": "Пароль",
"ssh_key": "SSH Ключ",
"ssh_key_placeholder": "Приватный SSH ключ",
"ssh_key_hint": "Вставьте содержимое вашего файла id_rsa или id_ed25519",
"connect": "Подключить",
"connecting": "Подключение...",
"server_added": "Сервер успешно добавлен",
"server_deleted": "Сервер удалён",
"delete_confirm": "Вы уверены, что хотите удалить этот сервер?",
"success": "Успешно",
"error": "Ошибка",
"info": "Информация",
"login_title": "Вход в панель",
"username": "Логин",
"password": "Пароль",
"captcha": "Капча",
"captcha_placeholder": "Введите символы с картинки",
"captcha_hint": "Нажмите для обновления картинки",
"login": "Войти",
"logging_in": "Вход...",
"login_error": "Ошибка входа",
"check_done": "Проверка завершена",
"check_error": "Ошибка подключения",
"ssh_ok": "SSH подключение",
"docker_ok": "Docker",
"docker_not_installed": "Docker не установлен",
"awg_desc": "Новая версия протокола на основе awg-go. Поддерживает расширенную обфускацию с параметрами S3, S4.",
"awg_legacy_desc": "Оригинальная версия AWG на базе ядра WireGuard. Совместима с клиентами старых версий.",
"xray_desc": "Современный протокол с маскировкой под обычный веб-трафик (XTLS-Reality). Устойчив к глубокому анализу пакетов.",
"wireguard_desc": "Стандартный и самый быстрый VPN-протокол. Встроен во все современные ОС, но легко блокируется DPI.",
"not_checked": "Не проверено",
"connections": "Подключения",
"add": "Добавить",
"loading_connections": "Загрузка подключений...",
"no_connections": "Нет подключений",
"no_connections_desc": "Добавьте первое подключение для генерации VPN конфигурации",
"install_protocol": "Установить протокол",
"port_default_hint": "Порт по умолчанию: 55424. Убедитесь, что он не занят",
"port_xray_hint": "Порт по умолчанию: 443 (рекомендуется для Xray). Убедитесь, что он не занят другим веб-сервером.",
"reinstall": "Переустановить",
"uninstall_confirm": "Удалить {}? Все подключения и конфигурации будут потеряны.",
"stop_container_confirm": "Остановить контейнер {}?",
"start_container_confirm": "Запустить контейнер {}?",
"stopping": "Остановка",
"starting": "Запуск",
"stopped": "остановлен",
"started": "запущен",
"server_config": "Конфигурация сервера",
"add_connection": "Добавить подключение",
"connection_name": "Имя подключения",
"connection_name_placeholder": "Например: iPhone, Laptop",
"assign_to_user": "Назначить пользователю (опционально)",
"no_assign": "— Без привязки —",
"create": "Создать",
"creating": "Создание...",
"connection_created": "Подключение \"{}\" создано",
"delete_connection_confirm": "Удалить это подключение? Конфигурация перестанет работать.",
"connection_deleted": "Подключение удалено",
"config_tab": "📄 Конфиг",
"vpn_key_tab": "🔑 VPN-ключ",
"qr_code_tab": "📱 QR-код",
"copy_config": "📋 Копировать",
"download_conf": "⬇ Скачать .conf",
"copy_key": "📋 Копировать ключ",
"vpn_link_hint": "Вставьте эту ссылку в приложение AmneziaVPN для автоматической настройки",
"qr_hint": "Отсканируйте QR-код в приложении AmneziaVPN",
"no_data": "Нет данных",
"start_btn": "▶ Старт",
"stop_btn": "⏹ Стоп",
"config_btn": "⚙️ Конфиг",
"done": "Готово",
"installing": "Установка...",
"start_install": "Начинаем установку...",
"check_docker": "Проверка Docker...",
"prepare_host": "Подготовка хоста...",
"build_container": "Сборка контейнера...",
"install_success": "Протокол установлен успешно!",
"install_error": "Ошибка установки: ",
"qr_error": "Не удалось сгенерировать QR-код",
"users_title": "Пользователи",
"search_placeholder": "Поиск по имени, email или Telegram...",
"add_user": "Добавить пользователя",
"prev_page": "← Назад",
"next_page": "Вперёд →",
"page_info": "Страница {} из {}",
"loading_users": "Загрузка пользователей...",
"nothing_found": "Ничего не найдено",
"search_empty_desc": "Попробуйте изменить запрос или создайте нового пользователя",
"username_label": "Имя пользователя",
"password_label": "Пароль",
"role_label": "Роль",
"role_user_desc": "User — только просмотр своих подключений",
"role_support_desc": "Support — управление серверами",
"role_admin_desc": "Admin — полный доступ",
"tg_id_label": "Telegram ID (опц.)",
"email_label": "Email (опц.)",
"traffic_limit_label": "Лимит трафика (ГБ) (опц., 0 = ∞)",
"expiration_date_label": "Срок действия (до)",
"description_label": "Описание (опц.)",
"auto_conn_title": "Автоматическое создание подключения (опционально)",
"server_label": "Сервер",
"no_create_conn": "— Не создавать подключение —",
"protocol_label": "Протокол",
"edit_user_title": "Редактировать пользователя: {}",
"edit_user_tg": "Telegram ID (опционально)",
"edit_user_email": "Email (опционально)",
"edit_user_limit": "Лимит трафика (ГБ) (0 = ∞)",
"new_password_hint": "Новый пароль (оставьте пустым, если не нужно менять)",
"op_type_label": "Тип операции",
"create_new_conn": "Создать новое подключение",
"link_existing_conn": "Привязать существующее",
"select_existing_conn": "Выберите существующее подключение",
"existing_conn_hint": "Будут показаны только не привязанные к пользователям подключения",
"conn_name_panel": "Имя подключения (в панели)",
"user_conns_title": "Подключения пользователя",
"no_free_conns": "Нет свободных подключений",
"linking": "Привязка...",
"conn_linked": "Подключение привязано",
"enabling": "Включение",
"disabling": "Отключение",
"user_enabled": "Пользователь включён",
"user_disabled": "Пользователь отключён",
"delete_user_confirm": "Удалить пользователя? Все его подключения будут удалены.",
"share_access": "Поделиться доступом",
"enable_public_access": "Включить публичный доступ",
"share_password_label": "Пароль (опционально)",
"share_password_hint": "Если установлен, пользователь должен будет его ввести",
"public_link_label": "Публичная ссылка",
"disabled": "Отключён",
"out_of": "Из",
"settings_title": "Настройки панели",
"appearance": "🎨 Внешний вид",
"title_label": "Заголовок (Title)",
"logo_label": "Логотип (Emoji или символ)",
"subtitle_label": "Подзаголовок (Subtitle)",
"captcha_title": "🔐 Капча",
"enable_captcha": "Включить капчу (multicolorcaptcha)",
"telegram_bot_title": "🤖 Telegram Bot",
"bot_token_label": "Bot Token (от @BotFather)",
"bot_status": "Статус",
"bot_running": "✅ Запущен",
"bot_stopped": "⏹ Остановлен",
"bot_stop_btn": "⏹ Остановить",
"bot_start_btn": "▶️ Запустить",
"bot_hint": "После изменения токена сохраните настройки — бот перезапустится автоматически. Пользователи должны иметь Telegram ID в профиле.",
"api_docs_title": "🔌 API Документация",
"api_docs_hint": "Используйте эти интерфейсы для изучения возможностей API панели",
"tunnels_title": "Туннели",
"local_server": "Локальный сервер",
"tunnel_install_enable": "Установить и включить",
"tunnel_enable": "Включить туннель",
"tunnel_running": "Туннель запущен",
"tunnel_stop": "Остановить",
"tunnel_stopping": "Остановка...",
"tunnel_stopped": "Туннель остановлен",
"tunnel_delete": "Удалить",
"tunnel_deleted": "Туннель удалён",
"tunnel_delete_confirm": "Остановить и удалить бинарный файл туннеля, установленный панелью?",
"tunnel_starting": "Запуск туннеля...",
"tunnel_started": "Туннель запущен",
"tunnel_waiting_url": "Туннель запущен. Ждем публичный адрес...",
"tunnel_no_public_url": "Публичный адрес появится здесь после запуска туннеля.",
"tunnels_hint": "Быстрые туннели публикуют локальную панель в интернете. Используйте надежный пароль администратора и передавайте публичные адреса только доверенным пользователям.",
"ngrok_authtoken_placeholder": "ngrok authtoken (для некоторых аккаунтов необязательно)",
"import_users_title": "📤 Импорт пользователей",
"import_source_label": "Источник импорта / Синхронизации",
"remnawave_url_label": "Remnawave URL",
"api_key_label": "API Key",
"enable_sync": "Включить синхронизацию",
"sync_hint": "Пользователи будут создаваться, отключаться и удаляться автоматически на основе данных из Remnawave",
"sync_now_btn": "🔄 Синхронизировать сейчас",
"delete_sync_btn": "🗑 Удалить синхронизацию",
"auto_create_conns": "Создавать подключения автоматически",
"sync_server_label": "Сервер для новых подключений",
"save_changes": "💾 Сохранить изменения",
"sync_success": "Синхронизация завершена: {} пользователей",
"sync_deleted": "Удалено {} синхронизированных пользователей",
"delete_sync_confirm": "Вы уверены, что хотите удалить ВСЕХ синхронизированных пользователей и их подключения? Это действие необратимо.",
"settings_saved": "Настройки успешно сохранены",
"bot_started": "Бот запущен",
"bot_stopped_msg": "Бот остановлен",
"sync_running": "Синхронизация...",
"deleting": "Удаление...",
"my_connections_title": "Мои подключения",
"show_config": "📄 Показать конфиг",
"no_connections_user_desc": "Обратитесь к администратору для создания VPN подключения",
"share_title": "Доступ к подключениям",
"vpn_access": "VPN Доступ",
"user_label_share": "Пользователь",
"share_protected_desc": "Этот доступ защищен паролем. Пожалуйста, введите его для продолжения.",
"auth_success": "Вход выполнен",
"loading_share_conns": "Загрузка подключений...",
"no_active_conns": "У вас пока нет активных подключений.",
"show_settings_btn": "🔑 Показать настройки",
"copied": "Скопировано!",
"active": "Активен",
"site_description": "Amnezia Web Panel — управление VPN серверами и протоколами AmneziaWG",
"toggle_theme": "Сменить тему",
"copied_to_clipboard": "Скопировано в буфер обмена",
"share_not_found": "404 Не Найдено",
"share_not_found_desc": "Либо ссылка неверна, либо доступ был отключен.",
"invalid_captcha": "Неверная капча",
"account_disabled": "Аккаунт отключён",
"invalid_login": "Неверный логин или пароль",
"user_exists": "Пользователь с таким именем уже существует",
"cannot_delete_self": "Нельзя удалить самого себя",
"wrong_share_password": "Неверный пароль",
"saving": "Сохранение...",
"select_lang": "Выберите язык",
"lang_ru": "Русский",
"lang_en": "English",
"lang_fr": "Français",
"lang_zh": "中文 (Chinese)",
"lang_fa": "فارسی (Persian)",
"backup_title": "Резервное копирование",
"download_backup": "Скачать data.json",
"restore_backup": "Восстановить из файла",
"restore_confirm": "Вы уверены? Текущие данные будут перезаписаны, и приложение перезагрузится.",
"restore_success": "Восстановление успешно! Перезагрузка...",
"invalid_backup_file": "Неверный файл резервной копии или структура",
"config_unavailable": "Конфигурация недоступна",
"config_unavailable_desc": "Этот клиент был создан через нативное приложение Amnezia.\\nПриватный ключ хранится только на устройстве пользователя и не может быть восстановлен сервером.",
"client_public_key": "Публичный ключ клиента:",
"telemt_desc": "Прокси для Telegram на базе MTProxy с продвинутой обфускацией и эмуляцией TLS.",
"tls_emulation": "TLS-эмуляция",
"tls_domain": "Домен маскировки",
"max_connections_limit": "Макс. соединений",
"max_connections_hint": "0 — без ограничений. Ограничивает одновременных пользователей.",
"traffic_reset_strategy_label": "Стратегия сброса трафика",
"traffic_reset_never": "Никогда не сбрасывать",
"traffic_reset_daily": "Сброс ежедневно",
"traffic_reset_weekly": "Сброс еженедельно",
"traffic_reset_monthly": "Сброс ежемесячно",
"traffic_reset_hint": "Как часто следует сбрасывать трафик пользователя",
"traffic_used_total": "Всего потрачено",
"traffic_reset_info": "Следующий сброс: {}",
"services": "Сервисы",
"dns_desc": "Персональный DNS-сервер для блокировки рекламы и защиты приватности ваших запросов.",
"dns_internal_hint": "Сервис будет запущен во внутренней сети (172.29.172.254) без привязки к портам хоста.",
"telemt_port_hint": "Порт для Telegram-прокси (обычно 443).",
"socks5_desc": "SOCKS5-прокси (3proxy) с одной учётной записью и аутентификацией по логину/паролю.",
"socks5_username": "Логин",
"socks5_password": "Пароль",
"socks5_password_placeholder": "Оставьте пустым для автогенерации",
"socks5_password_hint": "Если поле пустое, будет сгенерирован случайный пароль на 16 символов.",
"socks5_port_hint": "TCP-порт, на котором будет слушать прокси. В официальном клиенте Amnezia по умолчанию 38080.",
"socks5_change_settings": "Изменить настройки",
"socks5_settings_title": "SOCKS5 — Настройки подключения",
"socks5_port_change_hint": "Смена порта пересоздаёт контейнер — текущие соединения оборвутся.",
"socks5_settings_saved": "Настройки SOCKS5 сохранены",
"adguard_desc": "AdGuard Home — DNS-блокировщик рекламы с веб-интерфейсом администратора.",
"adguard_mode": "Режим установки",
"adguard_mode_sidebyside": "Рядом с AmneziaDNS",
"adguard_mode_sidebyside_hint": "поднимается параллельно AmneziaDNS на отдельном внутреннем IP (172.29.172.253)",
"adguard_mode_replace": "Заменить AmneziaDNS",
"adguard_mode_replace_hint": "удаляет контейнер amnezia-dns и забирает его IP — VPN-клиенты сразу пойдут в AdGuard",
"adguard_dns_port": "DNS-порт (53)",
"adguard_dns_port_hint": "Внутренний DNS-порт, на который ходят VPN-клиенты через docker-сеть.",
"adguard_web_port": "Порт Web UI",
"adguard_dot_port": "Порт DoT",
"adguard_doh_port": "Порт DoH",
"adguard_expose_web": "Опубликовать наружу",
"adguard_expose": "Опубликовать наружу",
"adguard_install_hint": "Первоначальная настройка AdGuard проходит через мастер на веб-интерфейсе после установки.",
"adguard_internal_ip": "Внутренний IP",
"adguard_web_ui": "Адрес панели",
"adguard_open_ui": "Открыть Web UI",
"edit_server_title": "Изменить сервер",
"edit_keep_credential": "Оставьте пустым, чтобы сохранить текущее значение",
"server_saved": "Настройки сервера сохранены",
"servers_reordered": "Порядок серверов изменён",
"ping_checking": "Проверяем соединение...",
"offline": "недоступен",
"api_tokens_title": "API-токены",
"api_tokens_hint": "Bearer-токены для внешних интеграций. Передавайте токен в заголовке `Authorization: Bearer <token>`. Токены имеют права администратора и перестают работать, если их владелец отключён или понижен в роли.",
"api_tokens_empty": "Пока нет ни одного API-токена. Создайте, чтобы подключить панель к внешнему сервису.",
"api_tokens_create": "Создать токен",
"api_tokens_create_title": "Создание API-токена",
"api_tokens_name_label": "Название",
"api_tokens_name_placeholder": "напр. Linear, CI-бот, мониторинг",
"api_tokens_name_hint": "Нужно, чтобы отличать токен в списке. Сам токен сгенерируется автоматически.",
"api_tokens_name_required": "Укажите название токена",
"api_tokens_created_title": "Токен создан",
"api_tokens_value_label": "Значение токена",
"api_tokens_warning_title": "Это единственный раз, когда вы увидите этот токен.",
"api_tokens_warning_body": "Скопируйте его сейчас и сохраните в менеджере секретов вашей интеграции. Панель хранит только хэш — если потеряете значение, токен придётся отозвать и создать заново.",
"api_tokens_revoke": "Отозвать",
"api_tokens_revoke_confirm": "Отозвать токен «{}»? Любая интеграция, использующая его, перестанет работать.",
"api_tokens_revoked": "Токен отозван",
"api_tokens_created": "Создан",
"api_tokens_last_used": "Последнее использование",
"api_tokens_owner": "Владелец",
"api_tokens_never": "никогда",
"coming_soon": "Скоро",
"promo_star_cta": "Поставить звезду на GitHub",
"aivpn_subtitle": "ИИ-подбор протокола, который сам выбирает правильный туннель под текущие условия. Поможете звездой — выйдет быстрее.",
"revproxy_title": "Reverse Proxy",
"revproxy_subtitle": "Высокопроизводительная маскировка трафика: прячем VPN за обычным сайтом, снижаем заметность для DPI.",
"management": "Управление",
"server_management": "Управление сервером",
"server_management_desc": "Выполнение системных действий на вашей машине.",
"check_server_services": "Проверить сервисы сервера",
"reboot_server": "Перезагрузить сервер",
"clear_server": "Очистить сервер",
"remove_server": "Удалить сервер из панели",
"ssl_title": "SSL / HTTPS Настройки",
"enable_https": "Включить HTTPS",
"panel_port_label": "Порт панели",
"domain_label": "Доменное имя",
"cert_path_label": "Путь к SSL сертификату (.pem)",
"key_path_label": "Путь к приватному ключу (.pem)",
"or_paste_text": "ИЛИ вставьте текст сертификатов",
"cert_text_label": "Содержимое сертификата (CRT)",
"key_text_label": "Содержимое ключа (KEY)",
"ssl_hint": "После включения панель будет доступна по https:// на указанном домене. Убедитесь, что пути к файлам или текстовые данные верны.",
"about_title": "О программе и обновления",
"current_version": "Текущая версия",
"check_updates": "Проверить обновления",
"checking_updates": "Проверка...",
"update_available": "Доступна новая версия",
"download_update": "Скачать обновление",
"up_to_date": "У вас установлена последняя версия",
"warp_hint": "WARP направляет исходящий трафик этого хоста через Cloudflare. Он не создаёт публичный URL панели как Quick Tunnel или ngrok.",
"warp_install_hint": "Сначала установите официальный клиент Cloudflare WARP, затем перезапустите панель.",
"warp_install_required": "Сначала установите WARP",
"warp_connect": "Подключить WARP",
"warp_disconnect": "Отключить",
"warp_connected": "WARP подключён",
"warp_disconnected": "WARP отключён",
"warp_status_unknown": "Статус WARP неизвестен.",
"warp_status_not_installed": "Cloudflare WARP CLI не установлен на этом хосте.",
"warp_status_connected": "Cloudflare WARP подключён.",
"warp_status_connecting": "Cloudflare WARP подключается.",
"warp_status_disconnected": "Cloudflare WARP отключён.",
"warp_status_not_registered": "Cloudflare WARP установлен, но ещё не зарегистрирован. Подключение попробует зарегистрировать его автоматически.",
"warp_status_service_unavailable": "Сервис Cloudflare WARP недоступен. Убедитесь, что warp-svc запущен.",
"warp_status_error": "Cloudflare WARP вернул ошибку.",
"install_starting": "Начинаем установку...",
"server_check_complete": "Проверка завершена",
"server_connection_error": "Ошибка подключения",
"connections_load_error": "Ошибка загрузки подключений",
"connection_updated": "Подключение обновлено",
"edit_connection": "Редактировать подключение",
"enable_connection_progress": "Включение подключения...",
"disable_connection_progress": "Отключение подключения...",
"connection_enabled": "Подключение включено",
"connection_disabled": "Подключение отключено",
"gb": "ГБ",
"marketplace": "Шаблоны",
"open_marketplace": "Открыть шаблоны",
"marketplace_desc": "Установите доступные шаблоны протоколов и сервисов для этого сервера.",
"installed_apps": "Установленные приложения",
"installed_apps_hint": "Здесь отображаются только установленные протоколы и сервисы. Чтобы добавить новые, откройте шаблоны.",
"no_installed_apps": "Пока нет установленных приложений",
"no_installed_apps_desc": "Откройте шаблоны, чтобы установить протоколы или сервисы на этот сервер.",
"install_another": "Установить ещё один",
"new_instance": "новый экземпляр",
"port_next_instance_hint": "Выберите свободный UDP-порт для дополнительного экземпляра.",
"checking_server": "Проверяем сервисы сервера...",
"web_servers": "Веб-серверы",
"nginx_desc": "NGINX веб-сервер с HTTPS-сертификатом Let's Encrypt и редактируемым index.html.",
"nginx_domain": "Домен",
"nginx_email": "Email для Let's Encrypt",
"nginx_port_hint": "HTTPS-порт на сервере. Порт 80/TCP должен быть свободен и доступен для проверки Let's Encrypt.",
"nginx_install_hint": "Домен уже должен указывать на этот сервер. Порт 80/TCP используется для HTTP-01 проверки сертификата.",
"site": "Сайт",
"site_editor": "Редактор сайта",
"site_saved": "Сайт сохранён",
"nginx_dns_hint": "Перед установкой создайте DNS-запись:",
"backup": "Backup",
"backups": "Бекапы",
"backup_desc": "Бекапы создаются на сервере и содержат ценные файлы протокола, нужные для восстановления или повторного запуска без потерь.",
"create_backup": "Создать бекап",
"creating_backup": "Создание бекапа...",
"backup_created": "Бекап создан",
"no_backups": "Бекапов пока нет",
"no_backups_desc": "Создайте первый бекап для этого протокола.",
"refresh": "Обновить"
}
translations/zh.json
+390
View File
@@ -0,0 +1,390 @@
{
"nav_servers": "服务器",
"nav_users": "用户列表",
"nav_settings": "设置",
"nav_connections": "连接管理",
"nav_logout": "登出",
"theme_dark": "深色模式",
"theme_light": "浅色模式",
"back_to_servers": "← 返回服务器列表",
"server_check": "检查状态",
"server_checking": "正在检查...",
"protocols": "协议",
"install": "安装",
"uninstall": "卸载",
"run": "运行中",
"stop": "已停止",
"not_installed": "未安装",
"installed": "已安装",
"add_server": "添加服务器",
"no_servers": "尚未添加服务器",
"name": "名称",
"host": "地址",
"port": "端口",
"status": "状态",
"actions": "操作",
"edit": "编辑",
"delete": "删除",
"save": "保存",
"cancel": "取消",
"loading": "加载中...",
"copy": "复制",
"download": "下载",
"config": "配置",
"qr_code": "二维码",
"vpn_key": "VPN 密钥",
"clients": "客户端",
"traffic": "流量",
"limit": "限制",
"manage": "管理",
"no_protocols": "无协议",
"add_server_desc": "添加您的第一台 VPN 服务器。需要 SSH 凭据进行连接。",
"ssh_host": "主机 / IP",
"ssh_port": "SSH 端口",
"ssh_user": "用户名",
"ssh_password": "密码",
"ssh_key": "SSH 密钥",
"ssh_key_placeholder": "私钥 (Private Key)",
"ssh_key_hint": "粘贴 id_rsa 或 id_ed25519 文件的内容",
"connect": "连接",
"connecting": "正在连接...",
"server_added": "服务器添加成功",
"server_deleted": "服务器已删除",
"delete_confirm": "确定要删除此服务器吗？",
"success": "成功",
"error": "错误",
"info": "信息",
"login_title": "登录管理面板",
"username": "用户名",
"password": "密码",
"captcha": "验证码",
"captcha_placeholder": "输入图中字符",
"captcha_hint": "点击刷新验证码",
"login": "登录",
"logging_in": "登录中...",
"login_error": "登录失败",
"check_done": "检查完成",
"check_error": "连接错误",
"ssh_ok": "SSH 连接正常",
"docker_ok": "Docker 正常",
"docker_not_installed": "Docker 未安装",
"awg_desc": "基于 awg-go 的新版协议。支持 S3, S4 高级混淆。",
"awg_legacy_desc": "原始 AWG 版本。兼容旧版客户端。",
"xray_desc": "将流量伪装成普通网页流量 (XTLS-Reality)，抗封锁能力强。",
"not_checked": "未检查",
"connections": "连接",
"add": "添加",
"loading_connections": "正在加载连接...",
"no_connections": "无连接",
"no_connections_desc": "添加首个连接以生成 VPN 配置文件",
"install_protocol": "安装协议",
"port_default_hint": "默认端口: 55424。请确保端口未被占用。",
"port_xray_hint": "推荐端口: 443。请确保未被其他 Web 服务器使用。",
"reinstall": "重新安装",
"uninstall_confirm": "确定卸载 {}？所有连接和配置都将丢失。",
"stop_container_confirm": "停止容器 {}？",
"start_container_confirm": "启动容器 {}？",
"stopping": "停止中",
"starting": "启动中",
"stopped": "已停止",
"started": "已启动",
"server_config": "服务端配置",
"add_connection": "添加连接",
"connection_name": "连接名称",
"connection_name_placeholder": "例如: iPhone, 笔记本电脑",
"assign_to_user": "分配给用户 (可选)",
"no_assign": "— 不分配 —",
"create": "创建",
"creating": "创建中...",
"connection_created": "连接 \"{}\" 已创建",
"delete_connection_confirm": "确定删除此连接？配置将失效。",
"connection_deleted": "连接已删除",
"config_tab": "📄 配置文件",
"vpn_key_tab": "🔑 VPN 密钥",
"qr_code_tab": "📱 二维码",
"copy_config": "📋 复制配置",
"download_conf": "⬇ 下载 .conf 文件",
"copy_key": "📋 复制密钥",
"vpn_link_hint": "将此链接粘贴到 AmneziaVPN 应用中即可自动配置",
"qr_hint": "使用 AmneziaVPN 应用扫描二维码",
"no_data": "无数据",
"start_btn": "▶ 启动",
"stop_btn": "⏹ 停止",
"config_btn": "⚙️ 配置",
"done": "完成",
"installing": "安装中...",
"start_install": "开始安装...",
"check_docker": "检查 Docker...",
"prepare_host": "准备环境...",
"build_container": "构建容器...",
"install_success": "协议安装成功！",
"install_error": "安装失败: ",
"qr_error": "无法生成二维码",
"users_title": "用户管理",
"search_placeholder": "搜索用户名、邮箱或 Telegram ID...",
"add_user": "添加用户",
"prev_page": "← 上一页",
"next_page": "下一页 →",
"page_info": "第 {} 页，共 {} 页",
"loading_users": "正在加载用户...",
"nothing_found": "未找到匹配项",
"search_empty_desc": "请尝试更改查询条件或创建新用户",
"username_label": "用户名",
"password_label": "密码",
"role_label": "角色",
"role_user_desc": "User — 仅查看自己的连接",
"role_support_desc": "Support — 服务器管理权限",
"role_admin_desc": "Admin — 全部权限",
"tg_id_label": "Telegram ID (可选)",
"email_label": "邮箱 (可选)",
"traffic_limit_label": "流量限制 (GB) (0 = 不限制)",
"description_label": "备注 (可选)",
"auto_conn_title": "自动创建连接 (可选)",
"server_label": "服务器",
"no_create_conn": "— 不自动创建 —",
"protocol_label": "协议",
"edit_user_title": "编辑用户: {}",
"edit_user_tg": "Telegram ID (可选)",
"edit_user_email": "邮箱 (可选)",
"edit_user_limit": "流量限制 (GB) (0 = 不限制)",
"new_password_hint": "新密码 (如不修改请留空)",
"op_type_label": "操作类型",
"create_new_conn": "创建新连接",
"link_existing_conn": "关联现有连接",
"select_existing_conn": "选择现有连接",
"existing_conn_hint": "仅显示尚未关联用户的连接",
"conn_name_panel": "连接名称 (面板显示)",
"user_conns_title": "用户连接列表",
"no_free_conns": "无可用空闲连接",
"linking": "关联中...",
"conn_linked": "连接关联成功",
"enabling": "启用中",
"disabling": "禁用中",
"user_enabled": "用户已启用",
"user_disabled": "用户已禁用",
"delete_user_confirm": "确定删除该用户？其所有连接都将被删除。",
"share_access": "分享访问权限",
"enable_public_access": "启用公开访问",
"share_password_label": "密码 (可选)",
"share_password_hint": "如设置，访问者需输入密码",
"public_link_label": "公开链接",
"disabled": "已禁用",
"out_of": "/",
"settings_title": "面板设置",
"appearance": "🎨 外观设置",
"title_label": "页面标题 (Title)",
"logo_label": "图标 (Emoji 或 字符)",
"subtitle_label": "副标题 (Subtitle)",
"captcha_title": "🔐 验证码",
"enable_captcha": "启用登录验证码",
"telegram_bot_title": "🤖 Telegram 机器人",
"bot_token_label": "Bot Token (来自 @BotFather)",
"bot_status": "状态",
"bot_running": "✅ 运行中",
"bot_stopped": "⏹ 已停止",
"bot_stop_btn": "⏹ 停止",
"bot_start_btn": "▶️ 启动",
"bot_hint": "修改 Token 后请保存，机器人将自动重启。用户需在个人资料中填写 Telegram ID。",
"api_docs_title": "🔌 API 文档",
"api_docs_hint": "使用这些接口了解面板功能",
"tunnels_title": "Tunnels",
"local_server": "本地服务器",
"tunnel_install_enable": "安装并启用",
"tunnel_enable": "启用隧道",
"tunnel_running": "隧道运行中",
"tunnel_stop": "停止",
"tunnel_stopping": "正在停止...",
"tunnel_stopped": "隧道已停止",
"tunnel_delete": "删除",
"tunnel_deleted": "隧道已删除",
"tunnel_delete_confirm": "停止并删除由面板管理的隧道二进制文件？",
"tunnel_starting": "正在启动隧道...",
"tunnel_started": "隧道已启动",
"tunnel_waiting_url": "隧道已启动，正在等待公网地址...",
"tunnel_no_public_url": "隧道启动后公网地址会显示在这里。",
"tunnels_hint": "快速隧道会将本地面板暴露到互联网。请使用强管理员密码，并仅与可信用户共享公网地址。",
"ngrok_authtoken_placeholder": "ngrok authtoken（某些账号可选）",
"import_users_title": "📤 导入用户",
"import_source_label": "导入 / 同步源",
"remnawave_url_label": "Remnawave 地址",
"api_key_label": "API 密钥",
"enable_sync": "开启同步",
"sync_hint": "将根据 Remnawave 数据自动创建、禁用和删除用户",
"sync_now_btn": "🔄 立即同步",
"delete_sync_btn": "🗑 删除同步数据",
"auto_create_conns": "自动创建连接",
"sync_server_label": "新连接的服务器",
"save_changes": "💾 保存修改",
"sync_success": "同步完成: {} 个用户已更新",
"sync_deleted": "已删除 {} 个同步用户",
"delete_sync_confirm": "确定要删除所有同步用户及其连接吗？此操作不可逆。",
"settings_saved": "设置已保存",
"bot_started": "机器人已启动",
"bot_stopped_msg": "机器人已停止",
"sync_running": "同步中...",
"deleting": "删除中...",
"my_connections_title": "我的连接",
"show_config": "📄 查看配置",
"no_connections_user_desc": "请联系管理员创建 VPN 连接",
"share_title": "访问连接",
"vpn_access": "VPN 访问",
"user_label_share": "用户",
"share_protected_desc": "此访问受密码保护。请输入密码以继续。",
"auth_success": "身份验证通过",
"loading_share_conns": "正在加载连接...",
"no_active_conns": "您目前没有活跃连接。",
"show_settings_btn": "🔑 显示设置",
"copied": "已复制！",
"active": "活跃",
"site_description": "Amnezia Web Panel — VPN 服务器及 AmneziaWG 协议管理工具",
"toggle_theme": "切换主题",
"copied_to_clipboard": "已复制到剪贴板",
"share_not_found": "404 页面未找到",
"share_not_found_desc": "链接无效或访问已被禁用。",
"invalid_captcha": "验证码错误",
"account_disabled": "账户已被禁用",
"invalid_login": "用户名或密码错误",
"user_exists": "该用户名已存在",
"cannot_delete_self": "您无法删除自己的账户",
"wrong_share_password": "密码错误",
"saving": "正在保存...",
"select_lang": "选择语言",
"lang_ru": "Русский",
"lang_en": "English",
"lang_fr": "Français",
"lang_zh": "中文 (Chinese)",
"lang_fa": "فارسی (Persian)",
"backup_title": "简易备份",
"download_backup": "下载 data.json",
"restore_backup": "从文件恢复",
"restore_confirm": "您确定吗？当前数据将被覆盖，应用程序将重新启动。",
"restore_success": "恢复成功！正在重启...",
"invalid_backup_file": "备份文件无效或结构错误",
"config_unavailable": "配置文件不可用",
"config_unavailable_desc": "此客户端是通过 Amnezia 原生应用创建的。\\n私钥仅存储在用户设备上，服务器无法恢复。",
"client_public_key": "客户端公钥：",
"management": "管理",
"server_management": "服务器管理",
"server_management_desc": "在您的机器上执行系统级别的操作。",
"check_server_services": "检查服务器服务",
"reboot_server": "重启服务器",
"clear_server": "清除服务器",
"remove_server": "从面板移除服务器",
"telemt_desc": "基于 MTProxy 的 Telegram 代理，支持高级混淆。",
"dns_desc": "防止广告和保护隐私的个人 DNS 服务器。",
"dns_internal_hint": "The service runs on the internal network (172.29.172.254) without binding to host ports.",
"telemt_port_hint": "Port for the Telegram proxy (typically 443).",
"socks5_desc": "Single-account SOCKS5 proxy (3proxy) with username/password authentication.",
"socks5_username": "Username",
"socks5_password": "Password",
"socks5_password_placeholder": "Leave empty to auto-generate",
"socks5_password_hint": "If left empty, a random 16-character password will be generated.",
"socks5_port_hint": "TCP port the proxy will listen on. The default in the official Amnezia client is 38080.",
"socks5_change_settings": "Change settings",
"socks5_settings_title": "SOCKS5 — Connection settings",
"socks5_port_change_hint": "Changing the port recreates the container; existing sessions will be dropped.",
"socks5_settings_saved": "SOCKS5 settings saved",
"adguard_desc": "AdGuard Home — DNS-based ad blocker with a web admin UI.",
"adguard_mode": "Installation mode",
"adguard_mode_sidebyside": "Side-by-side",
"adguard_mode_sidebyside_hint": "runs alongside AmneziaDNS on a separate internal IP (172.29.172.253)",
"adguard_mode_replace": "Replace AmneziaDNS",
"adguard_mode_replace_hint": "removes amnezia-dns and takes its IP — VPN clients use AdGuard immediately",
"adguard_dns_port": "DNS port (53)",
"adguard_dns_port_hint": "Internal DNS port served to VPN clients via the docker network.",
"adguard_web_port": "Web UI port",
"adguard_dot_port": "DoT port",
"adguard_doh_port": "DoH port",
"adguard_expose_web": "Expose to internet",
"adguard_expose": "Expose to host",
"adguard_install_hint": "Initial AdGuard setup runs through its built-in wizard via the web UI after install.",
"adguard_internal_ip": "Internal IP",
"adguard_web_ui": "Admin URL",
"adguard_open_ui": "Open Web UI",
"edit_server_title": "Edit server",
"edit_keep_credential": "Leave empty to keep the current value",
"server_saved": "Server settings saved",
"servers_reordered": "Servers reordered",
"ping_checking": "Checking connectivity...",
"offline": "offline",
"api_tokens_title": "API tokens",
"api_tokens_hint": "Bearer tokens for external integrations. Send the token in the `Authorization: Bearer <token>` header. Tokens have admin-equivalent rights and stop working if their owner is disabled or demoted.",
"api_tokens_empty": "No API tokens yet. Create one to integrate the panel with an external service.",
"api_tokens_create": "Create token",
"api_tokens_create_title": "Create API token",
"api_tokens_name_label": "Name",
"api_tokens_name_placeholder": "e.g. Linear integration, CI bot, monitoring",
"api_tokens_name_hint": "Used to identify this token in the list. The token value itself is generated for you.",
"api_tokens_name_required": "Token name is required",
"api_tokens_created_title": "Token created",
"api_tokens_value_label": "Token value",
"api_tokens_warning_title": "This is the only time you'll see this token.",
"api_tokens_warning_body": "Copy it now and store it in your integration's secret manager. The panel keeps only a hash — if you lose this value you'll need to revoke and recreate the token.",
"api_tokens_revoke": "Revoke",
"api_tokens_revoke_confirm": "Revoke token \"{}\"? Any integration using it will stop working.",
"api_tokens_revoked": "Token revoked",
"api_tokens_created": "Created",
"api_tokens_last_used": "Last used",
"api_tokens_owner": "Owner",
"api_tokens_never": "never",
"coming_soon": "Coming soon",
"promo_star_cta": "Star us on GitHub",
"aivpn_subtitle": "AI-driven protocol selection that picks the right tunnel for the moment. Land it sooner — drop a star.",
"revproxy_title": "Reverse Proxy",
"revproxy_subtitle": "High-performance traffic obfuscation: hide your VPN endpoint behind a polished public-facing site, drop the DPI footprint.",
"warp_hint": "WARP routes this host outbound through Cloudflare. It does not create a public panel URL like Quick Tunnel or ngrok.",
"warp_install_hint": "Install the official Cloudflare WARP client first, then restart the panel.",
"warp_install_required": "Install WARP first",
"warp_connect": "Connect WARP",
"warp_disconnect": "Disconnect",
"warp_connected": "WARP connected",
"warp_disconnected": "WARP disconnected",
"warp_status_unknown": "WARP status is unknown.",
"warp_status_not_installed": "Cloudflare WARP CLI is not installed on this host.",
"warp_status_connected": "Cloudflare WARP is connected.",
"warp_status_connecting": "Cloudflare WARP is connecting.",
"warp_status_disconnected": "Cloudflare WARP is disconnected.",
"warp_status_not_registered": "Cloudflare WARP is installed but not registered yet. Connect will try to register automatically.",
"warp_status_service_unavailable": "Cloudflare WARP service is not available. Make sure warp-svc is running.",
"warp_status_error": "Cloudflare WARP returned an error.",
"install_starting": "Starting installation...",
"server_check_complete": "Check completed",
"server_connection_error": "Connection error",
"connections_load_error": "Error loading connections",
"connection_updated": "Connection updated",
"edit_connection": "Edit connection",
"enable_connection_progress": "Enabling connection...",
"disable_connection_progress": "Disabling connection...",
"connection_enabled": "Connection enabled",
"connection_disabled": "Connection disabled",
"gb": "GB",
"marketplace": "Templates",
"open_marketplace": "Open Templates",
"marketplace_desc": "Install protocol and service templates available for this server.",
"installed_apps": "Installed applications",
"installed_apps_hint": "Only installed protocols and services are shown here. Use Templates to add more.",
"no_installed_apps": "No installed applications yet",
"no_installed_apps_desc": "Open Templates to install protocols or services on this server.",
"install_another": "Install another",
"new_instance": "new instance",
"port_next_instance_hint": "Choose a free UDP port for the additional instance.",
"web_servers": "Web servers",
"nginx_desc": "NGINX web server with Let's Encrypt HTTPS certificate and editable index.html.",
"nginx_domain": "Domain",
"nginx_email": "Let's Encrypt email",
"nginx_port_hint": "HTTPS port exposed on the server. Port 80/TCP must be free and reachable for Let's Encrypt validation.",
"nginx_install_hint": "The domain must already point to this server. Port 80/TCP is used for HTTP-01 certificate validation.",
"site": "Site",
"site_editor": "Site editor",
"site_saved": "Site saved",
"nginx_dns_hint": "Create this DNS record before installation:",
"backup": "Backup",
"backups": "Backups",
"backup_desc": "Backups are created on the server and contain valuable protocol files needed to restore or recreate it later.",
"create_backup": "Create backup",
"creating_backup": "Creating backup...",
"backup_created": "Backup created",
"no_backups": "No backups yet",
"no_backups_desc": "Create the first backup for this protocol.",
"refresh": "Refresh"
}