setup.sh

#!/bin/bash
#
# Скрипт для установки на своём сервере AntiZapret VPN + полный VPN
#
# https://github.com/GubernievS/AntiZapret-VPN
#
export LC_ALL=C

# Проверка необходимости перезагрузить
if [[ -f /var/run/reboot-required ]] || pidof apt apt-get dpkg unattended-upgrades &>/dev/null; then
	echo 'Error: You need to reboot this server before installation!'
	exit 2
fi

# Остановим фоновые обновления системы
systemctl stop apt-daily.timer 2>/dev/null
systemctl stop apt-daily-upgrade.timer 2>/dev/null
systemctl stop apt-daily 2>/dev/null
systemctl stop apt-daily-upgrade 2>/dev/null
systemctl stop unattended-upgrades 2>/dev/null

# Проверка прав root
if [[ "$EUID" -ne 0 ]]; then
	echo 'Error: You need to run this as root!'
	exit 3
fi

cd /root

# Проверка на OpenVZ и LXC
if [[ "$(systemd-detect-virt)" == 'openvz' || "$(systemd-detect-virt)" == 'lxc' ]]; then
	echo 'Error: OpenVZ and LXC are not supported!'
	exit 4
fi

# Проверка версии системы
OS="$(lsb_release -si | tr '[:upper:]' '[:lower:]')"
VERSION="$(lsb_release -rs | cut -d '.' -f1)"
CODENAME="$(lsb_release -cs)"
ARCH="$(dpkg --print-architecture)"

if [[ "$OS" == 'debian' ]]; then
	if (( VERSION < 13 )); then
		echo "Error: Debian $VERSION is not supported! Minimal supported version is 13"
		exit 5
	fi
elif [[ "$OS" == 'ubuntu' ]]; then
	if (( VERSION < 24 )); then
		echo "Error: Ubuntu $VERSION is not supported! Minimal supported version is 24"
		exit 6
	fi
else
	echo "Error: Your Linux distribution ($OS) is not supported!"
	exit 7
fi

# Очистка диска
echo 'Cleaning disk, please wait...'
journalctl --vacuum-size=1B -q
find /var/log -name "*.gz" -delete
find /var/log -name "*.1" -delete
find /var/log -type f -exec truncate -s 0 {} +
[[ -d /etc/openvpn/server/logs ]] && find /etc/openvpn/server/logs -type f -exec truncate -s 0 {} +
dpkg --configure -a >/dev/null
apt-get install -f -y >/dev/null
apt-get clean >/dev/null
apt-get autoremove --purge -y >/dev/null

# Проверка свободного места (минимум 2Гб)
if [[ $(df --output=avail / | tail -n 1) -lt $((2 * 1024 * 1024)) ]]; then
	echo 'Error: Low disk space! You need 2GB of free space!'
	exit 8
fi

# Проверка наличия сетевого интерфейса и IPv4-адреса
DEFAULT_INTERFACE="$(ip route get 1.2.3.4 2>/dev/null | grep -oP 'dev \K\S+')"
if [[ -z "$DEFAULT_INTERFACE" ]]; then
	echo 'Default network interface not found!'
	exit 9
fi

DEFAULT_IP="$(ip route get 1.2.3.4 2>/dev/null | grep -oP 'src \K\S+')"
if [[ -z "$DEFAULT_IP" ]]; then
	echo 'Default IPv4 address not found!'
	exit 10
fi

echo
echo -e '\e[1;32mInstalling AntiZapret VPN + full VPN...\e[0m'
echo 'OpenVPN + WireGuard + AmneziaWG'
echo 'More details: https://github.com/GubernievS/AntiZapret-VPN'
echo

MTU=$(< /sys/class/net/$DEFAULT_INTERFACE/mtu)
if (( MTU < 1500 )); then
	echo "Warning! Low MTU on $DEFAULT_INTERFACE: $MTU"
	echo "Change MTU in OpenVPN and WireGuard configs from 1420 to $((MTU-80)) on this server after installation"
	echo
fi

# Спрашиваем о настройках
until [[ "$OPENVPN_UDP_ENABLE" =~ (y|n) ]]; do
	read -rp 'Enable OpenVPN UDP? [y/n]: ' -e -i y OPENVPN_UDP_ENABLE
done
echo
until [[ "$OPENVPN_TCP_ENABLE" =~ (y|n) ]]; do
	read -rp 'Enable OpenVPN TCP? [y/n]: ' -e -i n OPENVPN_TCP_ENABLE
done
echo
until [[ "$WIREGUARD_ENABLE" =~ (y|n) ]]; do
	read -rp 'Enable WireGuard/AmneziaWG? [y/n]: ' -e -i y WIREGUARD_ENABLE
done
echo
echo 'Choose anti-censorship patch for OpenVPN (UDP only):'
echo '    1) None        - Do not install anti-censorship patch, or remove if already installed'
echo '    2) Random      - Recommended by default, randomly selects Strong or Error-Free'
echo '    3) Strong      - Better protocol masking'
echo '    4) Error-Free  - Use if Strong patch causes connection error, recommended for routers'
until [[ "$OPENVPN_PATCH" =~ ^[1-4]$ ]]; do
	read -rp 'Version choice [1-4]: ' -e -i 2 OPENVPN_PATCH
done
echo
echo 'OpenVPN DCO lowers CPU load, boosts data speeds, and only supports AES-128-GCM, AES-256-GCM and CHACHA20-POLY1305 encryption'
until [[ "$OPENVPN_DCO" =~ (y|n) ]]; do
	read -rp 'Turn on OpenVPN DCO? [y/n]: ' -e -i y OPENVPN_DCO
done
echo
echo -e 'Choose Cloudflare WARP for \e[1;32mAntiZapret VPN\e[0m (antizapret-*) outbound traffic:'
echo '    1) None    - Do not use'
echo '    2) All     - Route all traffic (domains and IPs)'
echo '    3) Domain  - Route AntiZapret domains and config/include-warp-hosts.txt, excluding config/exclude-warp-hosts.txt'
echo '    4) Custom  - Route domains only from config/include-warp-hosts.txt, excluding config/exclude-warp-hosts.txt'
until [[ "$ANTIZAPRET_WARP" =~ ^[1-4]$ ]]; do
	read -rp 'WARP choice [1-4]: ' -e -i 4 ANTIZAPRET_WARP
done
echo
echo -e 'Choose Cloudflare WARP for \e[1;32mfull VPN\e[0m (vpn-*) outbound traffic:'
echo '    1) None  - Do not use'
echo '    2) All   - Route all traffic (domains and IPs)'
until [[ "$VPN_WARP" =~ ^[1-2]$ ]]; do
	read -rp 'WARP choice [1-2]: ' -e -i 2 VPN_WARP
done
echo
echo -e 'Warning! WARP protection blocks \e[1;32mAntiZapret VPN\e[0m and \e[1;32mfull VPN\e[0m traffic if WARP failed to connect!'
until [[ "$WARP_PROTECTION" =~ (y|n) ]]; do
	read -rp 'Enable WARP protection? [y/n]: ' -e -i y WARP_PROTECTION
done
echo
echo -e 'Choose DNS resolvers for \e[1;32mAntiZapret VPN\e[0m (antizapret-*):'
echo '    1) MSK-IX+NSDI      - DNS resolvers optimized for users located in Russia, recommended by default'
echo '       +BI.ZONE+TransTeleCom'
echo '       +Cloudflare+Quad9'
echo '       +ControlD+UltraDNS'
echo '    2) Cloudflare+Quad9  - Use if default choice fails to resolve domains'
echo '       +ControlD+UltraDNS'
echo '    3) Yandex *         - Use if previous choice fails to resolve domains'
echo '    4) Google *         - Use if previous choice fails to resolve domains'
echo '    5) AdGuard *        - Use for blocking ads, trackers, malware and phishing websites'
echo '    6) Comss **         - More details: https://comss.ru/page.php?id=7315'
echo '    7) XBox **          - More details: https://xbox-dns.ru'
echo '    8) GeoHide **       - More details: https://geohide.ru'
echo '  * - DNS resolvers support EDNS Client Subnet'
echo ' ** - Enable additional proxying and hide this server IP on some internet resources'
echo '      Use only if this server is geolocated in Russia or problems accessing some internet resources'
until [[ "$ANTIZAPRET_DNS" =~ ^[1-8]$ ]]; do
	read -rp 'DNS choice [1-8]: ' -e -i 1 ANTIZAPRET_DNS
done
echo
echo -e 'Choose DNS resolvers for \e[1;32mfull VPN\e[0m (vpn-*):'
echo '    1) Self-hosted        - Use previous choice for AntiZapret VPN, recommended by default'
echo '    2) Cloudflare/Custom  - Disables replacement answer from self‑hosted DNS, allows custom DNS'
until [[ "$VPN_DNS" =~ ^[1-9]$ ]]; do
	read -rp 'DNS choice [1-9]: ' -e -i 1 VPN_DNS
done
echo
until [[ "$ANTIZAPRET_ADBLOCK" =~ (y|n) ]]; do
	read -rp $'Enable blocking ads, trackers, malware and phishing websites in \001\e[1;32m\002AntiZapret VPN\001\e[0m\002 (antizapret-*) based on AdGuard and OISD rules? [y/n]: ' -e -i y ANTIZAPRET_ADBLOCK
done
echo
until [[ "$VPN_ADBLOCK" =~ (y|n) ]]; do
	read -rp $'Enable blocking ads, trackers, malware and phishing websites in \001\e[1;32m\002full VPN\001\e[0m\002 (vpn-*) based on AdGuard and OISD rules? [y/n]: ' -e -i n VPN_ADBLOCK
done
echo
echo 'Default CLIENT IP address range:     10.28.0.0/15'
echo 'Alternative CLIENT IP address range: 172.28.0.0/15'
until [[ "$ALTERNATIVE_CLIENT_IP" =~ (y|n) ]]; do
	read -rp 'Use alternative CLIENT IP address range? [y/n]: ' -e -i n ALTERNATIVE_CLIENT_IP
done
echo
[[ "$ALTERNATIVE_CLIENT_IP" == 'y' ]] && IP=172 || IP=10
echo "Default FAKE IP address range:     $IP.30.0.0/15"
echo 'Alternative FAKE IP address range: 198.18.0.0/15'
until [[ "$ALTERNATIVE_FAKE_IP" =~ (y|n) ]]; do
	read -rp 'Use alternative range of FAKE IP addresses? [y/n]: ' -e -i y ALTERNATIVE_FAKE_IP
done
echo
until [[ "$OPENVPN_BACKUP_UDP" =~ (y|n) ]]; do
	read -rp 'Use UDP ports 80, 443, 504, 508 as backup for OpenVPN connections? [y/n]: ' -e -i y OPENVPN_BACKUP_UDP
done
echo
until [[ "$OPENVPN_BACKUP_TCP" =~ (y|n) ]]; do
	read -rp 'Use TCP ports 80, 443, 504, 508 as backup for OpenVPN connections? [y/n]: ' -e -i n OPENVPN_BACKUP_TCP
done
echo
until [[ "$WIREGUARD_BACKUP" =~ (y|n) ]]; do
	read -rp 'Use UDP ports 540, 580 as backup for WireGuard/AmneziaWG connections? [y/n]: ' -e -i y WIREGUARD_BACKUP
done
echo
until [[ "$OPENVPN_DUPLICATE" =~ (y|n) ]]; do
	read -rp 'Allow multiple clients connecting to OpenVPN using same profile file (*.ovpn)? [y/n]: ' -e -i y OPENVPN_DUPLICATE
done
echo
until [[ "$OPENVPN_LOG" =~ (y|n) ]]; do
	read -rp 'Enable detailed logs and status in OpenVPN? [y/n]: ' -e -i n OPENVPN_LOG
done
echo
echo 'Warning! SSH protection may block your IP after 5 logins/minute!'
until [[ "$SSH_PROTECTION" =~ (y|n) ]]; do
	read -rp 'Enable SSH brute-force protection? [y/n]: ' -e -i y SSH_PROTECTION
done
echo
echo 'Warning! Attack protection may block VPN or third-party applications!'
until [[ "$ATTACK_PROTECTION" =~ (y|n) ]]; do
	read -rp 'Enable network attack protection? [y/n]: ' -e -i y ATTACK_PROTECTION
done
echo
echo 'Warning! Scan protection blocks ping and closed-port replies!'
until [[ "$SCAN_PROTECTION" =~ (y|n) ]]; do
	read -rp 'Enable network scan protection? [y/n]: ' -e -i y SCAN_PROTECTION
done
echo
echo 'Warning! Torrent guard blocks VPN traffic for 1 minute on torrent detection!'
until [[ "$TORRENT_GUARD" =~ (y|n) ]]; do
	read -rp $'Enable torrent guard for \001\e[1;32m\002full VPN\001\e[0m\002? [y/n]: ' -e -i y TORRENT_GUARD
done
echo
until [[ "$RESTRICT_FORWARD" =~ (y|n) ]]; do
	read -rp $'Restrict forwarding in \001\e[1;32m\002AntiZapret VPN\001\e[0m\002 to IPs from config/forward-ips.txt and result/route-ips.txt? [y/n]: ' -e -i y RESTRICT_FORWARD
done
echo
until [[ "$CLIENT_ISOLATION" =~ (y|n) ]]; do
	read -rp $'Enable \001\e[1;32m\002all VPN\001\e[0m\002 client and server isolation? [y/n]: ' -e -i y CLIENT_ISOLATION
done
echo
while read -rp 'Enter valid domain name for this OpenVPN server or press Enter to skip: ' -e OPENVPN_HOST
do
	[[ -z "$OPENVPN_HOST" ]] && break
	[[ -n $(getent ahostsv4 "$OPENVPN_HOST") ]] && break
done
echo
while read -rp 'Enter valid domain name for this WireGuard/AmneziaWG server or press Enter to skip: ' -e WIREGUARD_HOST
do
	[[ -z "$WIREGUARD_HOST" ]] && break
	[[ -n $(getent ahostsv4 "$WIREGUARD_HOST") ]] && break
done
echo
until [[ "$ROUTE_ALL" =~ (y|n) ]]; do
	read -rp $'Route all domains via \001\e[1;32m\002AntiZapret VPN\001\e[0m\002, excluding Russian domains and config/exclude-hosts.txt? [y/n]: ' -e -i n ROUTE_ALL
done
echo
#until [[ "$DISCORD_INCLUDE" =~ (y|n) ]]; do
#	read -rp $'Include Discord voice IPs in \001\e[1;32m\002AntiZapret VPN\001\e[0m\002? [y/n]: ' -e -i n DISCORD_INCLUDE
#done
#echo
until [[ "$CLOUDFLARE_INCLUDE" =~ (y|n) ]]; do
	read -rp $'Include Cloudflare IPs in \001\e[1;32m\002AntiZapret VPN\001\e[0m\002? [y/n]: ' -e -i y CLOUDFLARE_INCLUDE
done
echo
until [[ "$TELEGRAM_INCLUDE" =~ (y|n) ]]; do
	read -rp $'Include Telegram IPs in \001\e[1;32m\002AntiZapret VPN\001\e[0m\002? [y/n]: ' -e -i y TELEGRAM_INCLUDE
done
echo
until [[ "$WHATSAPP_INCLUDE" =~ (y|n) ]]; do
	read -rp $'Include WhatsApp IPs in \001\e[1;32m\002AntiZapret VPN\001\e[0m\002? [y/n]: ' -e -i y WHATSAPP_INCLUDE
done
echo
#until [[ "$ROBLOX_INCLUDE" =~ (y|n) ]]; do
#	read -rp $'Include Roblox IPs in \001\e[1;32m\002AntiZapret VPN\001\e[0m\002? [y/n]: ' -e -i n ROBLOX_INCLUDE
#done
#echo
#until [[ "$AMAZON_INCLUDE" =~ (y|n) ]]; do
#	read -rp $'Include Amazon IPs in \001\e[1;32m\002AntiZapret VPN\001\e[0m\002? [y/n]: ' -e -i n AMAZON_INCLUDE
#done
#echo
#until [[ "$HETZNER_INCLUDE" =~ (y|n) ]]; do
#	read -rp $'Include Hetzner IPs in \001\e[1;32m\002AntiZapret VPN\001\e[0m\002? [y/n]: ' -e -i n HETZNER_INCLUDE
#done
#echo
#until [[ "$DIGITALOCEAN_INCLUDE" =~ (y|n) ]]; do
#	read -rp $'Include DigitalOcean IPs in \001\e[1;32m\002AntiZapret VPN\001\e[0m\002? [y/n]: ' -e -i n DIGITALOCEAN_INCLUDE
#done
#echo
#until [[ "$OVH_INCLUDE" =~ (y|n) ]]; do
#	read -rp $'Include OVH IPs in \001\e[1;32m\002AntiZapret VPN\001\e[0m\002? [y/n]: ' -e -i n OVH_INCLUDE
#done
#echo
#until [[ "$GOOGLE_INCLUDE" =~ (y|n) ]]; do
#	read -rp $'Include Google IPs in \001\e[1;32m\002AntiZapret VPN\001\e[0m\002? [y/n]: ' -e -i n GOOGLE_INCLUDE
#done
#echo
#until [[ "$AKAMAI_INCLUDE" =~ (y|n) ]]; do
#	read -rp $'Include Akamai IPs in \001\e[1;32m\002AntiZapret VPN\001\e[0m\002? [y/n]: ' -e -i n AKAMAI_INCLUDE
#done
#echo
echo 'Installation, please wait...'

# Остановим и выключим обновляемые службы
systemctl disable --now kresd@1
systemctl disable --now kresd@2
systemctl disable --now antizapret
systemctl disable --now antizapret-update.timer
systemctl disable --now antizapret-update
systemctl disable --now openvpn-server@antizapret-udp
systemctl disable --now openvpn-server@vpn-udp
systemctl disable --now openvpn-server@antizapret-tcp
systemctl disable --now openvpn-server@vpn-tcp
systemctl disable --now wg-quick@antizapret
systemctl disable --now wg-quick@vpn

# Удалим ненужные службы
dpkg -s ufw &>/dev/null && apt-get purge -y ufw
dpkg -s firewalld &>/dev/null && apt-get purge -y firewalld
dpkg -s apparmor &>/dev/null && apt-get purge -y apparmor
dpkg -s apport &>/dev/null && apt-get purge -y apport
dpkg -s modemmanager &>/dev/null && apt-get purge -y modemmanager
dpkg -s snapd &>/dev/null && apt-get purge -y snapd
dpkg -s upower &>/dev/null && apt-get purge -y upower
dpkg -s multipath-tools &>/dev/null && apt-get purge -y multipath-tools
dpkg -s rsyslog &>/dev/null && apt-get purge -y rsyslog
dpkg -s udisks2 &>/dev/null && apt-get purge -y udisks2
dpkg -s qemu-guest-agent &>/dev/null && apt-get purge -y qemu-guest-agent
dpkg -s tuned &>/dev/null && apt-get purge -y tuned
dpkg -s sysstat &>/dev/null && apt-get purge -y sysstat
dpkg -s acpid &>/dev/null && apt-get purge -y acpid
dpkg -s fwupd &>/dev/null && apt-get purge -y fwupd
dpkg -s watchdog &>/dev/null && apt-get purge -y watchdog
dpkg -s pcscd &>/dev/null && apt-get purge -y pcscd
dpkg -s packagekit &>/dev/null && apt-get purge -y packagekit
dpkg -s thermald &>/dev/null && apt-get purge -y thermald
dpkg -s open-iscsi &>/dev/null && apt-get purge -y open-iscsi
dpkg -s ubuntu-drivers-common &>/dev/null && apt-get purge -y ubuntu-drivers-common
dpkg -s avahi-daemon &>/dev/null && apt-get purge -y avahi-daemon
dpkg -s accountsservice &>/dev/null && apt-get purge -y accountsservice
dpkg -s bolt &>/dev/null && apt-get purge -y bolt
dpkg -s plymouth &>/dev/null && apt-get purge -y plymouth
dpkg -s popularity-contest &>/dev/null && apt-get purge -y popularity-contest
dpkg -s whoopsie &>/dev/null && apt-get purge -y whoopsie
dpkg -s landscape-common &>/dev/null && apt-get purge -y landscape-common
dpkg -s canonical-livepatch &>/dev/null && apt-get purge -y canonical-livepatch
dpkg -s ppp &>/dev/null && apt-get purge -y ppp
dpkg -s speech-dispatcher &>/dev/null && apt-get purge -y speech-dispatcher
dpkg -s brltty &>/dev/null && apt-get purge -y brltty
dpkg -s bluez &>/dev/null && apt-get purge -y bluez
dpkg -s bluetooth &>/dev/null && apt-get purge -y bluetooth
dpkg -s wpasupplicant &>/dev/null && apt-get purge -y wpasupplicant
dpkg -s cups &>/dev/null && apt-get purge -y cups
dpkg -s cups-browsed &>/dev/null && apt-get purge -y cups-browsed
dpkg -s cups-client &>/dev/null && apt-get purge -y cups-client
dpkg -s cups-daemon &>/dev/null && apt-get purge -y cups-daemon
dpkg -s cups-common &>/dev/null && apt-get purge -y cups-common
dpkg -s nfs-common &>/dev/null && apt-get purge -y nfs-common
dpkg -s rpcbind &>/dev/null && apt-get purge -y rpcbind
dpkg -s cifs-utils &>/dev/null && apt-get purge -y cifs-utils
dpkg -s ntfs-3g &>/dev/null && apt-get purge -y ntfs-3g
dpkg -s os-prober &>/dev/null && apt-get purge -y os-prober
dpkg -s laptop-detect &>/dev/null && apt-get purge -y laptop-detect
dpkg -s powermgmt-base &>/dev/null && apt-get purge -y powermgmt-base
dpkg -s xdg-user-dirs &>/dev/null && apt-get purge -y xdg-user-dirs
dpkg -s update-notifier-common &>/dev/null && apt-get purge -y update-notifier-common
dpkg -s at &>/dev/null && apt-get purge -y at
dpkg -s spice-vdagent &>/dev/null && apt-get purge -y spice-vdagent
dpkg -s libnss-mdns &>/dev/null && apt-get purge -y libnss-mdns
dpkg -s byobu &>/dev/null && apt-get purge -y byobu
dpkg -s ubuntu-advantage-tools &>/dev/null && apt-get purge -y ubuntu-advantage-tools
dpkg -s ubuntu-pro-client &>/dev/null && apt-get purge -y ubuntu-pro-client
dpkg -s pollinate &>/dev/null && apt-get purge -y pollinate
dpkg -s secureboot-db &>/dev/null && apt-get purge -y secureboot-db
#dpkg -s pastebinit &>/dev/null && apt-get purge -y pastebinit

# Отключим ненужные службы
systemctl disable --now ifupdown-wait-online
systemctl disable --now setvtrgb
systemctl disable --now e2scrub_reap
systemctl disable --now systemd-pstore
#systemctl disable --now networkd-dispatcher
#systemctl disable --now secureboot-db

# SSH protection включён
if [[ "$SSH_PROTECTION" == 'y' ]]; then
	dpkg -s fail2ban &>/dev/null && apt-get purge -y fail2ban
	dpkg -s sshguard &>/dev/null && apt-get purge -y sshguard
fi

# Удаляем кэш Knot Resolver
rm -rf /var/cache/knot-resolver/*
rm -rf /var/cache/knot-resolver2/*

# Удаляем старые файлы OpenVPN и WireGuard
rm -rf /etc/openvpn/server/*
rm -rf /etc/openvpn/client/*
rm -rf /etc/wireguard/templates/*

# Удаляем скомпилированный патченный OpenVPN
make -C /usr/local/src/openvpn uninstall
rm -rf /usr/local/src/openvpn

# Отключим IPv6
sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1
sysctl -w net.ipv6.conf.lo.disable_ipv6=1

# Удаляем переопределённые параметры ядра
sed -i '/^$/!{/^#/!d}' /etc/sysctl.conf

# Принудительная загрузка модуля nf_conntrack
echo 'nf_conntrack' > /etc/modules-load.d/nf_conntrack.conf

# Завершим выполнение скрипта при ошибке
set -e

# Обработка ошибок
handle_error() {
	echo "$(lsb_release -ds) $(uname -r) $(date --iso-8601=seconds)"
	echo -e "\e[1;31mError at line $1: $2\e[0m"
	exit 1
}
trap 'handle_error $LINENO "$BASH_COMMAND"' ERR

# Обновляем систему
rm -rf /etc/apt/sources.list.d/cznic-labs-knot-resolver.list
rm -rf /etc/apt/sources.list.d/openvpn-aptrepo.list
rm -rf /etc/apt/sources.list.d/backports.list
export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get dist-upgrade -y --fix-missing
apt-get install -y curl gpg

# Папка для ключей
mkdir -p /etc/apt/keyrings

# Добавим репозиторий Knot Resolver
curl -fL --connect-timeout 30 https://pkg.labs.nic.cz/gpg -o /etc/apt/keyrings/cznic-labs-pkg.gpg
echo "deb [signed-by=/etc/apt/keyrings/cznic-labs-pkg.gpg] https://pkg.labs.nic.cz/knot-resolver $CODENAME main" > /etc/apt/sources.list.d/cznic-labs-knot-resolver.list

# Добавим репозиторий OpenVPN
curl -fL --connect-timeout 30 https://swupdate.openvpn.net/repos/repo-public.gpg | gpg --yes --dearmor -o /etc/apt/keyrings/openvpn-repo-public.gpg
echo "deb [signed-by=/etc/apt/keyrings/openvpn-repo-public.gpg] https://build.openvpn.net/debian/openvpn/release/2.7 $CODENAME main" > /etc/apt/sources.list.d/openvpn-aptrepo.list

# Добавим репозиторий Debian Backports
if [[ "$OS" == 'debian' ]]; then
	echo "deb http://deb.debian.org/debian $CODENAME-backports main" > /etc/apt/sources.list.d/backports.list
fi

# Ставим необходимое ядро и пакеты
apt-get update
INSTALL=
# Обновляем ядро только на Ubuntu ниже 26 и Debian ниже 14
if [[ "$OS" == 'ubuntu' ]] && (( VERSION < 26 )); then
	INSTALL="linux-generic-hwe-${VERSION}.04"
elif [[ "$OS" == 'debian' ]] && (( VERSION < 14 )); then
	INSTALL="-t $CODENAME-backports linux-image-$ARCH linux-headers-$ARCH"
fi
apt-get install -y $INSTALL git openvpn iptables easy-rsa gawk knot-resolver idn sipcalc python3-pip wireguard diffutils socat lua-cqueues ipset irqbalance unattended-upgrades jq iproute2
systemctl disable --now openvpn
apt-get autoremove --purge -y
apt-get clean

# Конфигурируем пакеты
dpkg-reconfigure -f noninteractive unattended-upgrades
git config --global http.version HTTP/1.1

# Клонируем репозиторий и устанавливаем dnslib
rm -rf /tmp/dnslib
git clone https://github.com/paulc/dnslib.git /tmp/dnslib
PIP_BREAK_SYSTEM_PACKAGES=1 python3 -m pip install --force-reinstall --user /tmp/dnslib

# Клонируем репозиторий antizapret
rm -rf /tmp/antizapret
git clone https://github.com/GubernievS/AntiZapret-VPN.git /tmp/antizapret

# Сохраняем пользовательские настройки и обработчики custom*.sh
cp /root/antizapret/config/*.txt /tmp/antizapret/setup/root/antizapret/config/ || true
cp /root/antizapret/custom*.sh /tmp/antizapret/setup/root/antizapret/ || true
cp /etc/knot-resolver/*.lua /tmp/antizapret/setup/etc/knot-resolver/ || true

# Восстанавливаем из бэкапа пользовательские настройки и обработчики custom*.sh, пользователей OpenVPN и WireGuard
if [[ -e /root/backup*.tar.gz ]]; then
	rm -rf /root/easyrsa3
	rm -rf /root/wireguard
	rm -rf /root/config
	rm -rf /root/knot-resolver
	rm -rf /root/custom
fi

tar -xzf /root/backup*.tar.gz || true
rm -f /root/backup*.tar.gz || true

mkdir -p /tmp/antizapret/setup/etc/openvpn/easyrsa3
cp -r /root/easyrsa3/* /tmp/antizapret/setup/etc/openvpn/easyrsa3/ || true
cp /root/wireguard/* /tmp/antizapret/setup/etc/wireguard/ || true
cp /root/config/* /tmp/antizapret/setup/root/antizapret/config/ || true
cp /root/knot-resolver/* /tmp/antizapret/setup/etc/knot-resolver/ || true
cp /root/custom/* /tmp/antizapret/setup/root/antizapret/ || true

rm -rf /root/easyrsa3
rm -rf /root/wireguard
rm -rf /root/config
rm -rf /root/knot-resolver
rm -rf /root/custom

# Сохраняем настройки
echo "SETUP_DATE=$(date --iso-8601=seconds)
OPENVPN_UDP_ENABLE=$OPENVPN_UDP_ENABLE
OPENVPN_TCP_ENABLE=$OPENVPN_TCP_ENABLE
WIREGUARD_ENABLE=$WIREGUARD_ENABLE
OPENVPN_PATCH=$OPENVPN_PATCH
OPENVPN_DCO=$OPENVPN_DCO
ANTIZAPRET_WARP=$ANTIZAPRET_WARP
ANTIZAPRET_WARP_PRIVATE_KEY=
ANTIZAPRET_WARP_PUBLIC_KEY=
ANTIZAPRET_WARP_ENDPOINT=
ANTIZAPRET_WARP_ADDRESS=
VPN_WARP=$VPN_WARP
WARP_PROTECTION=$WARP_PROTECTION
VPN_WARP_PRIVATE_KEY=
VPN_WARP_PUBLIC_KEY=
VPN_WARP_ENDPOINT=
VPN_WARP_ADDRESS=
ANTIZAPRET_DNS=$ANTIZAPRET_DNS
VPN_DNS=$VPN_DNS
ANTIZAPRET_ADBLOCK=$ANTIZAPRET_ADBLOCK
VPN_ADBLOCK=$VPN_ADBLOCK
ALTERNATIVE_CLIENT_IP=$ALTERNATIVE_CLIENT_IP
ALTERNATIVE_FAKE_IP=$ALTERNATIVE_FAKE_IP
OPENVPN_BACKUP_UDP=$OPENVPN_BACKUP_UDP
OPENVPN_BACKUP_TCP=$OPENVPN_BACKUP_TCP
WIREGUARD_BACKUP=$WIREGUARD_BACKUP
OPENVPN_DUPLICATE=$OPENVPN_DUPLICATE
OPENVPN_LOG=$OPENVPN_LOG
SSH_PROTECTION=$SSH_PROTECTION
ATTACK_PROTECTION=$ATTACK_PROTECTION
SCAN_PROTECTION=$SCAN_PROTECTION
TORRENT_GUARD=$TORRENT_GUARD
RESTRICT_FORWARD=$RESTRICT_FORWARD
CLIENT_ISOLATION=$CLIENT_ISOLATION
OPENVPN_HOST=$OPENVPN_HOST
WIREGUARD_HOST=$WIREGUARD_HOST
ROUTE_ALL=$ROUTE_ALL
DISCORD_INCLUDE=$DISCORD_INCLUDE
CLOUDFLARE_INCLUDE=$CLOUDFLARE_INCLUDE
TELEGRAM_INCLUDE=$TELEGRAM_INCLUDE
WHATSAPP_INCLUDE=$WHATSAPP_INCLUDE
ROBLOX_INCLUDE=$ROBLOX_INCLUDE
AMAZON_INCLUDE=$AMAZON_INCLUDE
HETZNER_INCLUDE=$HETZNER_INCLUDE
DIGITALOCEAN_INCLUDE=$DIGITALOCEAN_INCLUDE
OVH_INCLUDE=$OVH_INCLUDE
GOOGLE_INCLUDE=$GOOGLE_INCLUDE
AKAMAI_INCLUDE=$AKAMAI_INCLUDE
CLEAR_HOSTS=y
TXQUEUELEN=10000
MTU=1420
WARP_MTU=1280
DEFAULT_INTERFACE=
DEFAULT_IP=
ANTIZAPRET_OUT_INTERFACE=
ANTIZAPRET_OUT_IP=
VPN_OUT_INTERFACE=
VPN_OUT_IP=
CLIENT_IP=
FAKE_IP=" > /tmp/antizapret/setup/root/antizapret/setup

# Создаем папки для кэша Knot Resolver
mkdir -p /var/cache/knot-resolver
mkdir -p /var/cache/knot-resolver2

# Выставляем разрешения
find /tmp/antizapret -type f -exec chmod 644 {} +
find /tmp/antizapret -type d -exec chmod 755 {} +
find /tmp/antizapret/setup/root/antizapret -type f -exec chmod +x {} +
find /tmp/antizapret/setup/etc/openvpn/server/scripts -type f -exec chmod +x {} +
chown -R knot-resolver:knot-resolver /var/cache/knot-resolver
chown -R knot-resolver:knot-resolver /var/cache/knot-resolver2

# Копируем нужное, удаляем не нужное
rm -rf /root/antizapret
cp -r /tmp/antizapret/setup/* /
rm -rf /tmp/dnslib
rm -rf /tmp/antizapret

# Настраиваем DNS в AntiZapret VPN
if [[ "$ANTIZAPRET_DNS" != '1' ]]; then
	sed -i "s/local dns1 = 1/local dns1 = $ANTIZAPRET_DNS/" /etc/knot-resolver/kresd.conf
fi

# Настраиваем DNS в full VPN
if [[ "$VPN_DNS" == '1' && "$ANTIZAPRET_DNS" != '1' ]]; then
	sed -i "s/local dns2 = 2/local dns2 = $ANTIZAPRET_DNS/" /etc/knot-resolver/kresd.conf
fi

# Не используем альтернативный диапазон подменных IPv4-адресов
# 198.18.0.0/15 => 10.30.0.0/15 или 172.30.0.0/15
if [[ "$ALTERNATIVE_FAKE_IP" == 'n' ]]; then
	sed -i "s/198\.18\./${IP}\.30\./g" /root/antizapret/proxy.py
fi

# Используем альтернативный диапазон клиентских IPv4-адресов
# 10.28.0.0/15 => 172.28.0.0/15
if [[ "$ALTERNATIVE_CLIENT_IP" == 'y' ]]; then
	sed -i 's/10\./172\./g' /etc/knot-resolver/kresd.conf
	sed -i 's/10\./172\./g' /etc/openvpn/server/*.conf
	sed -i 's/10\./172\./g' /etc/wireguard/templates/*.conf
	find /etc/wireguard -name '*.conf' -exec sed -i 's/s = 10\./s = 172\./g' {} +
else
	find /etc/wireguard -name '*.conf' -exec sed -i 's/s = 172\./s = 10\./g' {} +
fi

# Запрещаем несколько одновременных подключений к OpenVPN для одного клиента
if [[ "$OPENVPN_DUPLICATE" == 'n' ]]; then
	sed -i '/duplicate-cn/s/^/#/' /etc/openvpn/server/*.conf
fi

# Включим подробные логи и статус в OpenVPN
if [[ "$OPENVPN_LOG" == 'y' ]]; then
	sed -i '/^#\(verb\|log\|status\)/s/^#//' /etc/openvpn/server/*.conf
fi

# Изменяем поведение Knot Resolver
sed -i '/function policy\.PASS(state, _)/,/^end$/s/return state/return nil/' /usr/lib/knot-resolver/kres_modules/policy.lua
sed -i -z -E 's/policy\.DENY_MSG\([^)]*kres\.extended_error\.NOTSUP[^)]*\)/policy.DENY/g' /usr/lib/knot-resolver/kres_modules/policy.lua

# Загружаем и создаем списки исключений
/root/antizapret/doall.sh noclear

# Настраиваем сервера OpenVPN и WireGuard/AmneziaWG для первого запуска
# Пересоздаем для всех существующих пользователей файлы подключений
# Если пользователей нет, то создаем новых пользователей 'antizapret-client' для OpenVPN и WireGuard/AmneziaWG
/root/antizapret/client.sh 7

# Включим обновляемые службы
systemctl enable kresd@1
systemctl enable kresd@2
systemctl enable antizapret
systemctl enable antizapret-update.timer
systemctl enable antizapret-update
if [[ "$OPENVPN_UDP_ENABLE" == 'y' ]]; then
	systemctl enable openvpn-server@antizapret-udp
	systemctl enable openvpn-server@vpn-udp
fi
if [[ "$OPENVPN_TCP_ENABLE" == 'y' ]]; then
	systemctl enable openvpn-server@antizapret-tcp
	systemctl enable openvpn-server@vpn-tcp
fi
if [[ "$WIREGUARD_ENABLE" == 'y' ]]; then
	systemctl enable wg-quick@antizapret
	systemctl enable wg-quick@vpn
fi

ERRORS=

if [[ "$OPENVPN_PATCH" != '1' ]]; then
	if ! /root/antizapret/patch-openvpn.sh "$OPENVPN_PATCH"; then
		ERRORS+="\n\e[1;31mAnti-censorship patch for OpenVPN has not installed!\e[0m Please run '/root/antizapret/patch-openvpn.sh' after rebooting\n"
	fi
fi

if [[ "$OPENVPN_DCO" == 'y' ]]; then
	if ! /root/antizapret/openvpn-dco.sh y; then
		ERRORS+="\n\e[1;31mOpenVPN DCO has not turn on!\e[0m Please run '/root/antizapret/openvpn-dco.sh y' after rebooting\n"
	fi
fi

# Если есть ошибки, выводим их
if [[ -n "$ERRORS" ]]; then
	echo -e "$ERRORS"
fi

# Создадим файл подкачки размером 1 Гб если его нет
if [[ -z "$(swapon --show)" ]]; then
	set +e
	SWAPFILE=/swapfile
	SWAPSIZE=1024
	dd if=/dev/zero of=$SWAPFILE bs=1M count=$SWAPSIZE
	chmod 600 $SWAPFILE
	mkswap $SWAPFILE
	swapon $SWAPFILE
	echo $SWAPFILE none swap sw 0 0 >> /etc/fstab
fi

# Перезагружаем
echo
echo -e '\e[1;32mAntiZapret VPN + full VPN installed successfully!\e[0m'
reboot