diff options
Diffstat (limited to 'update.sh')
| -rwxr-xr-x | update.sh | 566 |
1 files changed, 283 insertions, 283 deletions
@@ -12,16 +12,16 @@ xui_service="${XUI_SERVICE:=/etc/systemd/system}" # Don't edit this config b_source="${BASH_SOURCE[0]}" while [ -h "$b_source" ]; do - b_dir="$(cd -P "$(dirname "$b_source")" >/dev/null 2>&1 && pwd || pwd -P)" + b_dir="$(cd -P "$(dirname "$b_source")" > /dev/null 2>&1 && pwd || pwd -P)" b_source="$(readlink "$b_source")" [[ $b_source != /* ]] && b_source="$b_dir/$b_source" done -cur_dir="$(cd -P "$(dirname "$b_source")" >/dev/null 2>&1 && pwd || pwd -P)" +cur_dir="$(cd -P "$(dirname "$b_source")" > /dev/null 2>&1 && pwd || pwd -P)" script_name=$(basename "$0") # Check command exist function _command_exists() { - type "$1" &>/dev/null + type "$1" &> /dev/null } # Fail, log and exit script function @@ -44,7 +44,7 @@ fi if [[ -f /etc/os-release ]]; then source /etc/os-release release=$ID - elif [[ -f /usr/lib/os-release ]]; then +elif [[ -f /usr/lib/os-release ]]; then source /usr/lib/os-release release=$ID else @@ -61,7 +61,7 @@ arch() { armv6* | armv6) echo 'armv6' ;; armv5* | armv5) echo 'armv5' ;; s390x) echo 's390x' ;; - *) echo -e "${red}Unsupported CPU architecture!${plain}" && rm -f "${cur_dir}/${script_name}" >/dev/null 2>&1 && exit 2;; + *) echo -e "${red}Unsupported CPU architecture!${plain}" && rm -f "${cur_dir}/${script_name}" > /dev/null 2>&1 && exit 2 ;; esac } @@ -84,23 +84,23 @@ is_domain() { # Port helpers is_port_in_use() { local port="$1" - if command -v ss >/dev/null 2>&1; then - ss -ltn 2>/dev/null | awk -v p=":${port}$" '$4 ~ p {exit 0} END {exit 1}' + if command -v ss > /dev/null 2>&1; then + ss -ltn 2> /dev/null | awk -v p=":${port}$" '$4 ~ p {exit 0} END {exit 1}' return fi - if command -v netstat >/dev/null 2>&1; then - netstat -lnt 2>/dev/null | awk -v p=":${port} " '$4 ~ p {exit 0} END {exit 1}' + if command -v netstat > /dev/null 2>&1; then + netstat -lnt 2> /dev/null | awk -v p=":${port} " '$4 ~ p {exit 0} END {exit 1}' return fi - if command -v lsof >/dev/null 2>&1; then - lsof -nP -iTCP:${port} -sTCP:LISTEN >/dev/null 2>&1 && return 0 + if command -v lsof > /dev/null 2>&1; then + lsof -nP -iTCP:${port} -sTCP:LISTEN > /dev/null 2>&1 && return 0 fi return 1 } gen_random_string() { local length="$1" - openssl rand -base64 $(( length * 2 )) \ + openssl rand -base64 $((length * 2)) \ | tr -dc 'a-zA-Z0-9' \ | head -c "$length" } @@ -109,37 +109,37 @@ install_base() { echo -e "${green}Updating and install dependency packages...${plain}" case "${release}" in ubuntu | debian | armbian) - apt-get update >/dev/null 2>&1 && apt-get install -y -q cron curl tar tzdata socat openssl >/dev/null 2>&1 - ;; + apt-get update > /dev/null 2>&1 && apt-get install -y -q cron curl tar tzdata socat openssl > /dev/null 2>&1 + ;; fedora | amzn | virtuozzo | rhel | almalinux | rocky | ol) - dnf -y update >/dev/null 2>&1 && dnf install -y -q cronie curl tar tzdata socat openssl >/dev/null 2>&1 - ;; + dnf -y update > /dev/null 2>&1 && dnf install -y -q cronie curl tar tzdata socat openssl > /dev/null 2>&1 + ;; centos) if [[ "${VERSION_ID}" =~ ^7 ]]; then - yum -y update >/dev/null 2>&1 && yum install -y -q cronie curl tar tzdata socat openssl >/dev/null 2>&1 + yum -y update > /dev/null 2>&1 && yum install -y -q cronie curl tar tzdata socat openssl > /dev/null 2>&1 else - dnf -y update >/dev/null 2>&1 && dnf install -y -q cronie curl tar tzdata socat openssl >/dev/null 2>&1 + dnf -y update > /dev/null 2>&1 && dnf install -y -q cronie curl tar tzdata socat openssl > /dev/null 2>&1 fi - ;; + ;; arch | manjaro | parch) - pacman -Syu >/dev/null 2>&1 && pacman -Syu --noconfirm cronie curl tar tzdata socat openssl >/dev/null 2>&1 - ;; + pacman -Syu > /dev/null 2>&1 && pacman -Syu --noconfirm cronie curl tar tzdata socat openssl > /dev/null 2>&1 + ;; opensuse-tumbleweed | opensuse-leap) - zypper refresh >/dev/null 2>&1 && zypper -q install -y cron curl tar timezone socat openssl >/dev/null 2>&1 - ;; + zypper refresh > /dev/null 2>&1 && zypper -q install -y cron curl tar timezone socat openssl > /dev/null 2>&1 + ;; alpine) - apk update >/dev/null 2>&1 && apk add dcron curl tar tzdata socat openssl>/dev/null 2>&1 - ;; + apk update > /dev/null 2>&1 && apk add dcron curl tar tzdata socat openssl > /dev/null 2>&1 + ;; *) - apt-get update >/dev/null 2>&1 && apt install -y -q cron curl tar tzdata socat openssl >/dev/null 2>&1 - ;; + apt-get update > /dev/null 2>&1 && apt install -y -q cron curl tar tzdata socat openssl > /dev/null 2>&1 + ;; esac } install_acme() { echo -e "${green}Installing acme.sh for SSL certificate management...${plain}" cd ~ || return 1 - curl -s https://get.acme.sh | sh >/dev/null 2>&1 + curl -s https://get.acme.sh | sh > /dev/null 2>&1 if [ $? -ne 0 ]; then echo -e "${red}Failed to install acme.sh${plain}" return 1 @@ -154,59 +154,59 @@ setup_ssl_certificate() { local server_ip="$2" local existing_port="$3" local existing_webBasePath="$4" - + echo -e "${green}Setting up SSL certificate...${plain}" - + # Check if acme.sh is installed - if ! command -v ~/.acme.sh/acme.sh &>/dev/null; then + if ! command -v ~/.acme.sh/acme.sh &> /dev/null; then install_acme if [ $? -ne 0 ]; then echo -e "${yellow}Failed to install acme.sh, skipping SSL setup${plain}" return 1 fi fi - + # Create certificate directory local certPath="/root/cert/${domain}" mkdir -p "$certPath" - + # Issue certificate echo -e "${green}Issuing SSL certificate for ${domain}...${plain}" echo -e "${yellow}Note: Port 80 must be open and accessible from the internet${plain}" - - ~/.acme.sh/acme.sh --set-default-ca --server letsencrypt --force >/dev/null 2>&1 + + ~/.acme.sh/acme.sh --set-default-ca --server letsencrypt --force > /dev/null 2>&1 ~/.acme.sh/acme.sh --issue -d ${domain} --listen-v6 --standalone --httpport 80 --force - + if [ $? -ne 0 ]; then echo -e "${yellow}Failed to issue certificate for ${domain}${plain}" echo -e "${yellow}Please ensure port 80 is open and try again later with: x-ui${plain}" - rm -rf ~/.acme.sh/${domain} 2>/dev/null - rm -rf "$certPath" 2>/dev/null + rm -rf ~/.acme.sh/${domain} 2> /dev/null + rm -rf "$certPath" 2> /dev/null return 1 fi - + # Install certificate ~/.acme.sh/acme.sh --installcert -d ${domain} \ --key-file /root/cert/${domain}/privkey.pem \ --fullchain-file /root/cert/${domain}/fullchain.pem \ - --reloadcmd "systemctl restart x-ui" >/dev/null 2>&1 - + --reloadcmd "systemctl restart x-ui" > /dev/null 2>&1 + if [ $? -ne 0 ]; then echo -e "${yellow}Failed to install certificate${plain}" return 1 fi - + # Enable auto-renew - ~/.acme.sh/acme.sh --upgrade --auto-upgrade >/dev/null 2>&1 - chmod 600 $certPath/privkey.pem 2>/dev/null - chmod 644 $certPath/fullchain.pem 2>/dev/null - + ~/.acme.sh/acme.sh --upgrade --auto-upgrade > /dev/null 2>&1 + chmod 600 $certPath/privkey.pem 2> /dev/null + chmod 644 $certPath/fullchain.pem 2> /dev/null + # Set certificate for panel local webCertFile="/root/cert/${domain}/fullchain.pem" local webKeyFile="/root/cert/${domain}/privkey.pem" - + if [[ -f "$webCertFile" && -f "$webKeyFile" ]]; then - ${xui_folder}/x-ui cert -webCert "$webCertFile" -webCertKey "$webKeyFile" >/dev/null 2>&1 + ${xui_folder}/x-ui cert -webCert "$webCertFile" -webCertKey "$webKeyFile" > /dev/null 2>&1 echo -e "${green}SSL certificate installed and configured successfully!${plain}" return 0 else @@ -219,14 +219,14 @@ setup_ssl_certificate() { # Requires acme.sh and port 80 open for HTTP-01 challenge setup_ip_certificate() { local ipv4="$1" - local ipv6="$2" # optional + local ipv6="$2" # optional echo -e "${green}Setting up Let's Encrypt IP certificate (shortlived profile)...${plain}" echo -e "${yellow}Note: IP certificates are valid for ~6 days and will auto-renew.${plain}" echo -e "${yellow}Default listener is port 80. If you choose another port, ensure external port 80 forwards to it.${plain}" # Check for acme.sh - if ! command -v ~/.acme.sh/acme.sh &>/dev/null; then + if ! command -v ~/.acme.sh/acme.sh &> /dev/null; then install_acme if [ $? -ne 0 ]; then echo -e "${red}Failed to install acme.sh${plain}" @@ -298,8 +298,8 @@ setup_ip_certificate() { # Issue certificate with shortlived profile echo -e "${green}Issuing IP certificate for ${ipv4}...${plain}" - ~/.acme.sh/acme.sh --set-default-ca --server letsencrypt --force >/dev/null 2>&1 - + ~/.acme.sh/acme.sh --set-default-ca --server letsencrypt --force > /dev/null 2>&1 + ~/.acme.sh/acme.sh --issue \ ${domain_args} \ --standalone \ @@ -313,9 +313,9 @@ setup_ip_certificate() { echo -e "${red}Failed to issue IP certificate${plain}" echo -e "${yellow}Please ensure port ${WebPort} is reachable (or forwarded from external port 80)${plain}" # Cleanup acme.sh data for both IPv4 and IPv6 if specified - rm -rf ~/.acme.sh/${ipv4} 2>/dev/null - [[ -n "$ipv6" ]] && rm -rf ~/.acme.sh/${ipv6} 2>/dev/null - rm -rf ${certDir} 2>/dev/null + rm -rf ~/.acme.sh/${ipv4} 2> /dev/null + [[ -n "$ipv6" ]] && rm -rf ~/.acme.sh/${ipv6} 2> /dev/null + rm -rf ${certDir} 2> /dev/null return 1 fi @@ -333,19 +333,19 @@ setup_ip_certificate() { if [[ ! -f "${certDir}/fullchain.pem" || ! -f "${certDir}/privkey.pem" ]]; then echo -e "${red}Certificate files not found after installation${plain}" # Cleanup acme.sh data for both IPv4 and IPv6 if specified - rm -rf ~/.acme.sh/${ipv4} 2>/dev/null - [[ -n "$ipv6" ]] && rm -rf ~/.acme.sh/${ipv6} 2>/dev/null - rm -rf ${certDir} 2>/dev/null + rm -rf ~/.acme.sh/${ipv4} 2> /dev/null + [[ -n "$ipv6" ]] && rm -rf ~/.acme.sh/${ipv6} 2> /dev/null + rm -rf ${certDir} 2> /dev/null return 1 fi - + echo -e "${green}Certificate files installed successfully${plain}" # Enable auto-upgrade for acme.sh (ensures cron job runs) - ~/.acme.sh/acme.sh --upgrade --auto-upgrade >/dev/null 2>&1 + ~/.acme.sh/acme.sh --upgrade --auto-upgrade > /dev/null 2>&1 - chmod 600 ${certDir}/privkey.pem 2>/dev/null - chmod 644 ${certDir}/fullchain.pem 2>/dev/null + chmod 600 ${certDir}/privkey.pem 2> /dev/null + chmod 644 ${certDir}/fullchain.pem 2> /dev/null # Configure panel to use the certificate echo -e "${green}Setting certificate paths for the panel...${plain}" @@ -369,9 +369,9 @@ setup_ip_certificate() { ssl_cert_issue() { local existing_webBasePath=$(${xui_folder}/x-ui setting -show true | grep 'webBasePath:' | awk -F': ' '{print $2}' | tr -d '[:space:]' | sed 's#^/##') local existing_port=$(${xui_folder}/x-ui setting -show true | grep 'port:' | awk -F': ' '{print $2}' | tr -d '[:space:]') - + # check for acme.sh first - if ! command -v ~/.acme.sh/acme.sh &>/dev/null; then + if ! command -v ~/.acme.sh/acme.sh &> /dev/null; then echo "acme.sh could not be found. Installing now..." cd ~ || return 1 curl -s https://get.acme.sh | sh @@ -387,18 +387,18 @@ ssl_cert_issue() { local domain="" while true; do read -rp "Please enter your domain name: " domain - domain="${domain// /}" # Trim whitespace - + domain="${domain// /}" # Trim whitespace + if [[ -z "$domain" ]]; then echo -e "${red}Domain name cannot be empty. Please try again.${plain}" continue fi - + if ! is_domain "$domain"; then echo -e "${red}Invalid domain format: ${domain}. Please enter a valid domain name.${plain}" continue fi - + break done echo -e "${green}Your domain is: ${domain}, checking it...${plain}" @@ -406,9 +406,9 @@ ssl_cert_issue() { # detect existing certificate and reuse it if present local cert_exists=0 - if ~/.acme.sh/acme.sh --list 2>/dev/null | awk '{print $1}' | grep -Fxq "${domain}"; then + if ~/.acme.sh/acme.sh --list 2> /dev/null | awk '{print $1}' | grep -Fxq "${domain}"; then cert_exists=1 - local certInfo=$(~/.acme.sh/acme.sh --list 2>/dev/null | grep -F "${domain}") + local certInfo=$(~/.acme.sh/acme.sh --list 2> /dev/null | grep -F "${domain}") echo -e "${yellow}Existing certificate found for ${domain}, will reuse it.${plain}" [[ -n "${certInfo}" ]] && echo "$certInfo" else @@ -435,7 +435,7 @@ ssl_cert_issue() { # Stop panel temporarily echo -e "${yellow}Stopping panel temporarily...${plain}" - systemctl stop x-ui 2>/dev/null || rc-service x-ui stop 2>/dev/null + systemctl stop x-ui 2> /dev/null || rc-service x-ui stop 2> /dev/null if [[ ${cert_exists} -eq 0 ]]; then # issue the certificate @@ -444,7 +444,7 @@ ssl_cert_issue() { if [ $? -ne 0 ]; then echo -e "${red}Issuing certificate failed, please check logs.${plain}" rm -rf ~/.acme.sh/${domain} - systemctl start x-ui 2>/dev/null || rc-service x-ui start 2>/dev/null + systemctl start x-ui 2> /dev/null || rc-service x-ui start 2> /dev/null return 1 else echo -e "${green}Issuing certificate succeeded, installing certificates...${plain}" @@ -464,18 +464,18 @@ ssl_cert_issue() { echo -e "${green}\t0.${plain} Keep default reloadcmd" read -rp "Choose an option: " choice case "$choice" in - 1) - echo -e "${green}Reloadcmd is: systemctl reload nginx ; systemctl restart x-ui${plain}" - reloadCmd="systemctl reload nginx ; systemctl restart x-ui" - ;; - 2) - echo -e "${yellow}It's recommended to put x-ui restart at the end${plain}" - read -rp "Please enter your custom reloadcmd: " reloadCmd - echo -e "${green}Reloadcmd is: ${reloadCmd}${plain}" - ;; - *) - echo -e "${green}Keeping default reloadcmd${plain}" - ;; + 1) + echo -e "${green}Reloadcmd is: systemctl reload nginx ; systemctl restart x-ui${plain}" + reloadCmd="systemctl reload nginx ; systemctl restart x-ui" + ;; + 2) + echo -e "${yellow}It's recommended to put x-ui restart at the end${plain}" + read -rp "Please enter your custom reloadcmd: " reloadCmd + echo -e "${green}Reloadcmd is: ${reloadCmd}${plain}" + ;; + *) + echo -e "${green}Keeping default reloadcmd${plain}" + ;; esac fi @@ -492,14 +492,14 @@ ssl_cert_issue() { installWroteFiles=1 fi - if [[ -f "/root/cert/${domain}/privkey.pem" && -f "/root/cert/${domain}/fullchain.pem" && ( ${installRc} -eq 0 || ${installWroteFiles} -eq 1 ) ]]; then + if [[ -f "/root/cert/${domain}/privkey.pem" && -f "/root/cert/${domain}/fullchain.pem" && (${installRc} -eq 0 || ${installWroteFiles} -eq 1) ]]; then echo -e "${green}Installing certificate succeeded, enabling auto renew...${plain}" else echo -e "${red}Installing certificate failed, exiting.${plain}" if [[ ${cert_exists} -eq 0 ]]; then rm -rf ~/.acme.sh/${domain} fi - systemctl start x-ui 2>/dev/null || rc-service x-ui start 2>/dev/null + systemctl start x-ui 2> /dev/null || rc-service x-ui start 2> /dev/null return 1 fi @@ -518,7 +518,7 @@ ssl_cert_issue() { fi # Restart panel - systemctl start x-ui 2>/dev/null || rc-service x-ui start 2>/dev/null + systemctl start x-ui 2> /dev/null || rc-service x-ui start 2> /dev/null # Prompt user to set panel paths after successful certificate installation read -rp "Would you like to set this certificate for the panel? (y/n): " setPanel @@ -534,21 +534,21 @@ ssl_cert_issue() { echo "" echo -e "${green}Access URL: https://${domain}:${existing_port}/${existing_webBasePath}${plain}" echo -e "${yellow}Panel will restart to apply SSL certificate...${plain}" - systemctl restart x-ui 2>/dev/null || rc-service x-ui restart 2>/dev/null + systemctl restart x-ui 2> /dev/null || rc-service x-ui restart 2> /dev/null else echo -e "${red}Error: Certificate or private key file not found for domain: $domain.${plain}" fi else echo -e "${yellow}Skipping panel path setting.${plain}" fi - + return 0 } # Unified interactive SSL setup (domain or IP) # Sets global `SSL_HOST` to the chosen domain/IP prompt_and_setup_ssl() { local panel_port="$1" - local web_base_path="$2" # expected without leading slash + local web_base_path="$2" # expected without leading slash local server_ip="$3" local ssl_choice="" @@ -559,132 +559,132 @@ prompt_and_setup_ssl() { echo -e "${green}3.${plain} Custom SSL Certificate (Path to existing files)" echo -e "${blue}Note:${plain} Options 1 & 2 require port 80 open. Option 3 requires manual paths." read -rp "Choose an option (default 2 for IP): " ssl_choice - ssl_choice="${ssl_choice// /}" # Trim whitespace - + ssl_choice="${ssl_choice// /}" # Trim whitespace + # Default to 2 (IP cert) if input is empty or invalid (not 1 or 3) if [[ "$ssl_choice" != "1" && "$ssl_choice" != "3" ]]; then ssl_choice="2" fi case "$ssl_choice" in - 1) - # User chose Let's Encrypt domain option - echo -e "${green}Using Let's Encrypt for domain certificate...${plain}" - if ssl_cert_issue; then - local cert_domain="${SSL_ISSUED_DOMAIN}" - if [[ -z "${cert_domain}" ]]; then - cert_domain=$(~/.acme.sh/acme.sh --list 2>/dev/null | tail -1 | awk '{print $1}') - fi + 1) + # User chose Let's Encrypt domain option + echo -e "${green}Using Let's Encrypt for domain certificate...${plain}" + if ssl_cert_issue; then + local cert_domain="${SSL_ISSUED_DOMAIN}" + if [[ -z "${cert_domain}" ]]; then + cert_domain=$(~/.acme.sh/acme.sh --list 2> /dev/null | tail -1 | awk '{print $1}') + fi - if [[ -n "${cert_domain}" ]]; then - SSL_HOST="${cert_domain}" - echo -e "${green}✓ SSL certificate configured successfully with domain: ${cert_domain}${plain}" + if [[ -n "${cert_domain}" ]]; then + SSL_HOST="${cert_domain}" + echo -e "${green}✓ SSL certificate configured successfully with domain: ${cert_domain}${plain}" + else + echo -e "${yellow}SSL setup may have completed, but domain extraction failed${plain}" + SSL_HOST="${server_ip}" + fi else - echo -e "${yellow}SSL setup may have completed, but domain extraction failed${plain}" + echo -e "${red}SSL certificate setup failed for domain mode.${plain}" SSL_HOST="${server_ip}" fi - else - echo -e "${red}SSL certificate setup failed for domain mode.${plain}" - SSL_HOST="${server_ip}" - fi - ;; - 2) - # User chose Let's Encrypt IP certificate option - echo -e "${green}Using Let's Encrypt for IP certificate (shortlived profile)...${plain}" - - # Ask for optional IPv6 - local ipv6_addr="" - read -rp "Do you have an IPv6 address to include? (leave empty to skip): " ipv6_addr - ipv6_addr="${ipv6_addr// /}" # Trim whitespace - - # Stop panel if running (port 80 needed) - if [[ $release == "alpine" ]]; then - rc-service x-ui stop >/dev/null 2>&1 - else - systemctl stop x-ui >/dev/null 2>&1 - fi - - setup_ip_certificate "${server_ip}" "${ipv6_addr}" - if [ $? -eq 0 ]; then - SSL_HOST="${server_ip}" - echo -e "${green}✓ Let's Encrypt IP certificate configured successfully${plain}" - else - echo -e "${red}✗ IP certificate setup failed. Please check port 80 is open.${plain}" - SSL_HOST="${server_ip}" - fi - - # Restart panel after SSL is configured (restart applies new cert settings) - if [[ $release == "alpine" ]]; then - rc-service x-ui restart >/dev/null 2>&1 - else - systemctl restart x-ui >/dev/null 2>&1 - fi + ;; + 2) + # User chose Let's Encrypt IP certificate option + echo -e "${green}Using Let's Encrypt for IP certificate (shortlived profile)...${plain}" - ;; - 3) - # User chose Custom Paths (User Provided) option - echo -e "${green}Using custom existing certificate...${plain}" - local custom_cert="" - local custom_key="" - local custom_domain="" - - # 3.1 Request Domain to compose Panel URL later - read -rp "Please enter domain name certificate issued for: " custom_domain - custom_domain="${custom_domain// /}" # Remove spaces - - # 3.2 Loop for Certificate Path - while true; do - read -rp "Input certificate path (keywords: .crt / fullchain): " custom_cert - # Strip quotes if present - custom_cert=$(echo "$custom_cert" | tr -d '"' | tr -d "'") - - if [[ -f "$custom_cert" && -r "$custom_cert" && -s "$custom_cert" ]]; then - break - elif [[ ! -f "$custom_cert" ]]; then - echo -e "${red}Error: File does not exist! Try again.${plain}" - elif [[ ! -r "$custom_cert" ]]; then - echo -e "${red}Error: File exists but is not readable (check permissions)!${plain}" + # Ask for optional IPv6 + local ipv6_addr="" + read -rp "Do you have an IPv6 address to include? (leave empty to skip): " ipv6_addr + ipv6_addr="${ipv6_addr// /}" # Trim whitespace + + # Stop panel if running (port 80 needed) + if [[ $release == "alpine" ]]; then + rc-service x-ui stop > /dev/null 2>&1 else - echo -e "${red}Error: File is empty!${plain}" + systemctl stop x-ui > /dev/null 2>&1 fi - done - - # 3.3 Loop for Private Key Path - while true; do - read -rp "Input private key path (keywords: .key / privatekey): " custom_key - # Strip quotes if present - custom_key=$(echo "$custom_key" | tr -d '"' | tr -d "'") - - if [[ -f "$custom_key" && -r "$custom_key" && -s "$custom_key" ]]; then - break - elif [[ ! -f "$custom_key" ]]; then - echo -e "${red}Error: File does not exist! Try again.${plain}" - elif [[ ! -r "$custom_key" ]]; then - echo -e "${red}Error: File exists but is not readable (check permissions)!${plain}" + + setup_ip_certificate "${server_ip}" "${ipv6_addr}" + if [ $? -eq 0 ]; then + SSL_HOST="${server_ip}" + echo -e "${green}✓ Let's Encrypt IP certificate configured successfully${plain}" else - echo -e "${red}Error: File is empty!${plain}" + echo -e "${red}✗ IP certificate setup failed. Please check port 80 is open.${plain}" + SSL_HOST="${server_ip}" fi - done - # 3.4 Apply Settings via x-ui binary - ${xui_folder}/x-ui cert -webCert "$custom_cert" -webCertKey "$custom_key" >/dev/null 2>&1 + # Restart panel after SSL is configured (restart applies new cert settings) + if [[ $release == "alpine" ]]; then + rc-service x-ui restart > /dev/null 2>&1 + else + systemctl restart x-ui > /dev/null 2>&1 + fi - # Set SSL_HOST for composing Panel URL - if [[ -n "$custom_domain" ]]; then - SSL_HOST="$custom_domain" - else - SSL_HOST="${server_ip}" - fi + ;; + 3) + # User chose Custom Paths (User Provided) option + echo -e "${green}Using custom existing certificate...${plain}" + local custom_cert="" + local custom_key="" + local custom_domain="" + + # 3.1 Request Domain to compose Panel URL later + read -rp "Please enter domain name certificate issued for: " custom_domain + custom_domain="${custom_domain// /}" # Remove spaces + + # 3.2 Loop for Certificate Path + while true; do + read -rp "Input certificate path (keywords: .crt / fullchain): " custom_cert + # Strip quotes if present + custom_cert=$(echo "$custom_cert" | tr -d '"' | tr -d "'") + + if [[ -f "$custom_cert" && -r "$custom_cert" && -s "$custom_cert" ]]; then + break + elif [[ ! -f "$custom_cert" ]]; then + echo -e "${red}Error: File does not exist! Try again.${plain}" + elif [[ ! -r "$custom_cert" ]]; then + echo -e "${red}Error: File exists but is not readable (check permissions)!${plain}" + else + echo -e "${red}Error: File is empty!${plain}" + fi + done + + # 3.3 Loop for Private Key Path + while true; do + read -rp "Input private key path (keywords: .key / privatekey): " custom_key + # Strip quotes if present + custom_key=$(echo "$custom_key" | tr -d '"' | tr -d "'") + + if [[ -f "$custom_key" && -r "$custom_key" && -s "$custom_key" ]]; then + break + elif [[ ! -f "$custom_key" ]]; then + echo -e "${red}Error: File does not exist! Try again.${plain}" + elif [[ ! -r "$custom_key" ]]; then + echo -e "${red}Error: File exists but is not readable (check permissions)!${plain}" + else + echo -e "${red}Error: File is empty!${plain}" + fi + done - echo -e "${green}✓ Custom certificate paths applied.${plain}" - echo -e "${yellow}Note: You are responsible for renewing these files externally.${plain}" + # 3.4 Apply Settings via x-ui binary + ${xui_folder}/x-ui cert -webCert "$custom_cert" -webCertKey "$custom_key" > /dev/null 2>&1 - systemctl restart x-ui >/dev/null 2>&1 || rc-service x-ui restart >/dev/null 2>&1 - ;; - *) - echo -e "${red}Invalid option. Skipping SSL setup.${plain}" - SSL_HOST="${server_ip}" - ;; + # Set SSL_HOST for composing Panel URL + if [[ -n "$custom_domain" ]]; then + SSL_HOST="$custom_domain" + else + SSL_HOST="${server_ip}" + fi + + echo -e "${green}✓ Custom certificate paths applied.${plain}" + echo -e "${yellow}Note: You are responsible for renewing these files externally.${plain}" + + systemctl restart x-ui > /dev/null 2>&1 || rc-service x-ui restart > /dev/null 2>&1 + ;; + *) + echo -e "${red}Invalid option. Skipping SSL setup.${plain}" + SSL_HOST="${server_ip}" + ;; esac } @@ -692,12 +692,12 @@ config_after_update() { echo -e "${yellow}x-ui settings:${plain}" ${xui_folder}/x-ui setting -show true ${xui_folder}/x-ui migrate - + # Properly detect empty cert by checking if cert: line exists and has content after it - local existing_cert=$(${xui_folder}/x-ui setting -getCert true 2>/dev/null | grep 'cert:' | awk -F': ' '{print $2}' | tr -d '[:space:]') + local existing_cert=$(${xui_folder}/x-ui setting -getCert true 2> /dev/null | grep 'cert:' | awk -F': ' '{print $2}' | tr -d '[:space:]') local existing_port=$(${xui_folder}/x-ui setting -show true | grep -Eo 'port: .+' | awk '{print $2}') local existing_webBasePath=$(${xui_folder}/x-ui setting -show true | grep -Eo 'webBasePath: .+' | awk '{print $2}' | sed 's#^/##') - + # Get server IP local URL_lists=( "https://api4.ipify.org" @@ -709,7 +709,7 @@ config_after_update() { ) local server_ip="" for ip_address in "${URL_lists[@]}"; do - local response=$(curl -s -w "\n%{http_code}" --max-time 3 "${ip_address}" 2>/dev/null) + local response=$(curl -s -w "\n%{http_code}" --max-time 3 "${ip_address}" 2> /dev/null) local http_code=$(echo "$response" | tail -n1) local ip_result=$(echo "$response" | head -n-1 | tr -d '[:space:]') if [[ "${http_code}" == "200" && -n "${ip_result}" ]]; then @@ -717,7 +717,7 @@ config_after_update() { break fi done - + # Handle missing/short webBasePath if [[ ${#existing_webBasePath} -lt 4 ]]; then echo -e "${yellow}WebBasePath is missing or too short. Generating a new one...${plain}" @@ -726,7 +726,7 @@ config_after_update() { existing_webBasePath="${config_webBasePath}" echo -e "${green}New WebBasePath: ${config_webBasePath}${plain}" fi - + # Check and prompt for SSL if missing if [[ -z "$existing_cert" ]]; then echo "" @@ -736,16 +736,16 @@ config_after_update() { echo -e "${yellow}For security, SSL certificate is MANDATORY for all panels.${plain}" echo -e "${yellow}Let's Encrypt now supports both domains and IP addresses!${plain}" echo "" - + if [[ -z "${server_ip}" ]]; then echo -e "${red}Failed to detect server IP${plain}" echo -e "${yellow}Please configure SSL manually using: x-ui${plain}" return fi - + # Prompt and setup SSL (domain or IP) prompt_and_setup_ssl "${existing_port}" "${existing_webBasePath}" "${server_ip}" - + echo "" echo -e "${green}═══════════════════════════════════════════${plain}" echo -e "${green} Panel Access Information ${plain}" @@ -768,17 +768,17 @@ config_after_update() { update_x-ui() { cd ${xui_folder%/x-ui}/ - + if [ -f "${xui_folder}/x-ui" ]; then current_xui_version=$(${xui_folder}/x-ui -v) echo -e "${green}Current x-ui version: ${current_xui_version}${plain}" else _fail "ERROR: Current x-ui version: unknown" fi - + echo -e "${green}Downloading new x-ui version...${plain}" - - tag_version=$(${curl_bin} -Ls "https://api.github.com/repos/MHSanaei/3x-ui/releases/latest" 2>/dev/null | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/') + + tag_version=$(${curl_bin} -Ls "https://api.github.com/repos/MHSanaei/3x-ui/releases/latest" 2> /dev/null | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/') if [[ ! -n "$tag_version" ]]; then echo -e "${yellow}Trying to fetch version with IPv4...${plain}" tag_version=$(${curl_bin} -4 -Ls "https://api.github.com/repos/MHSanaei/3x-ui/releases/latest" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/') @@ -787,110 +787,110 @@ update_x-ui() { fi fi echo -e "Got x-ui latest version: ${tag_version}, beginning the installation..." - ${curl_bin} -fLRo ${xui_folder}-linux-$(arch).tar.gz https://github.com/MHSanaei/3x-ui/releases/download/${tag_version}/x-ui-linux-$(arch).tar.gz 2>/dev/null + ${curl_bin} -fLRo ${xui_folder}-linux-$(arch).tar.gz https://github.com/MHSanaei/3x-ui/releases/download/${tag_version}/x-ui-linux-$(arch).tar.gz 2> /dev/null if [[ $? -ne 0 ]]; then echo -e "${yellow}Trying to fetch version with IPv4...${plain}" - ${curl_bin} -4fLRo ${xui_folder}-linux-$(arch).tar.gz https://github.com/MHSanaei/3x-ui/releases/download/${tag_version}/x-ui-linux-$(arch).tar.gz 2>/dev/null + ${curl_bin} -4fLRo ${xui_folder}-linux-$(arch).tar.gz https://github.com/MHSanaei/3x-ui/releases/download/${tag_version}/x-ui-linux-$(arch).tar.gz 2> /dev/null if [[ $? -ne 0 ]]; then _fail "ERROR: Failed to download x-ui, please be sure that your server can access GitHub" fi fi - + if [[ -e ${xui_folder}/ ]]; then echo -e "${green}Stopping x-ui...${plain}" if [[ $release == "alpine" ]]; then if [ -f "/etc/init.d/x-ui" ]; then - rc-service x-ui stop >/dev/null 2>&1 - rc-update del x-ui >/dev/null 2>&1 + rc-service x-ui stop > /dev/null 2>&1 + rc-update del x-ui > /dev/null 2>&1 echo -e "${green}Removing old service unit version...${plain}" - rm -f /etc/init.d/x-ui >/dev/null 2>&1 + rm -f /etc/init.d/x-ui > /dev/null 2>&1 else - rm x-ui-linux-$(arch).tar.gz -f >/dev/null 2>&1 + rm x-ui-linux-$(arch).tar.gz -f > /dev/null 2>&1 _fail "ERROR: x-ui service unit not installed." fi else if [ -f "${xui_service}/x-ui.service" ]; then - systemctl stop x-ui >/dev/null 2>&1 - systemctl disable x-ui >/dev/null 2>&1 + systemctl stop x-ui > /dev/null 2>&1 + systemctl disable x-ui > /dev/null 2>&1 echo -e "${green}Removing old systemd unit version...${plain}" - rm ${xui_service}/x-ui.service -f >/dev/null 2>&1 - systemctl daemon-reload >/dev/null 2>&1 + rm ${xui_service}/x-ui.service -f > /dev/null 2>&1 + systemctl daemon-reload > /dev/null 2>&1 else - rm x-ui-linux-$(arch).tar.gz -f >/dev/null 2>&1 + rm x-ui-linux-$(arch).tar.gz -f > /dev/null 2>&1 _fail "ERROR: x-ui systemd unit not installed." fi fi echo -e "${green}Removing old x-ui version...${plain}" - rm ${xui_folder} -f >/dev/null 2>&1 - rm ${xui_folder}/x-ui.service -f >/dev/null 2>&1 - rm ${xui_folder}/x-ui.service.debian -f >/dev/null 2>&1 - rm ${xui_folder}/x-ui.service.arch -f >/dev/null 2>&1 - rm ${xui_folder}/x-ui.service.rhel -f >/dev/null 2>&1 - rm ${xui_folder}/x-ui -f >/dev/null 2>&1 - rm ${xui_folder}/x-ui.sh -f >/dev/null 2>&1 + rm ${xui_folder} -f > /dev/null 2>&1 + rm ${xui_folder}/x-ui.service -f > /dev/null 2>&1 + rm ${xui_folder}/x-ui.service.debian -f > /dev/null 2>&1 + rm ${xui_folder}/x-ui.service.arch -f > /dev/null 2>&1 + rm ${xui_folder}/x-ui.service.rhel -f > /dev/null 2>&1 + rm ${xui_folder}/x-ui -f > /dev/null 2>&1 + rm ${xui_folder}/x-ui.sh -f > /dev/null 2>&1 echo -e "${green}Removing old xray version...${plain}" - rm ${xui_folder}/bin/xray-linux-amd64 -f >/dev/null 2>&1 + rm ${xui_folder}/bin/xray-linux-amd64 -f > /dev/null 2>&1 echo -e "${green}Removing old README and LICENSE file...${plain}" - rm ${xui_folder}/bin/README.md -f >/dev/null 2>&1 - rm ${xui_folder}/bin/LICENSE -f >/dev/null 2>&1 + rm ${xui_folder}/bin/README.md -f > /dev/null 2>&1 + rm ${xui_folder}/bin/LICENSE -f > /dev/null 2>&1 else - rm x-ui-linux-$(arch).tar.gz -f >/dev/null 2>&1 + rm x-ui-linux-$(arch).tar.gz -f > /dev/null 2>&1 _fail "ERROR: x-ui not installed." fi - + echo -e "${green}Installing new x-ui version...${plain}" - tar zxvf x-ui-linux-$(arch).tar.gz >/dev/null 2>&1 - rm x-ui-linux-$(arch).tar.gz -f >/dev/null 2>&1 - cd x-ui >/dev/null 2>&1 - chmod +x x-ui >/dev/null 2>&1 - + tar zxvf x-ui-linux-$(arch).tar.gz > /dev/null 2>&1 + rm x-ui-linux-$(arch).tar.gz -f > /dev/null 2>&1 + cd x-ui > /dev/null 2>&1 + chmod +x x-ui > /dev/null 2>&1 + # Check the system's architecture and rename the file accordingly if [[ $(arch) == "armv5" || $(arch) == "armv6" || $(arch) == "armv7" ]]; then - mv bin/xray-linux-$(arch) bin/xray-linux-arm >/dev/null 2>&1 - chmod +x bin/xray-linux-arm >/dev/null 2>&1 + mv bin/xray-linux-$(arch) bin/xray-linux-arm > /dev/null 2>&1 + chmod +x bin/xray-linux-arm > /dev/null 2>&1 fi - - chmod +x x-ui bin/xray-linux-$(arch) >/dev/null 2>&1 - + + chmod +x x-ui bin/xray-linux-$(arch) > /dev/null 2>&1 + echo -e "${green}Downloading and installing x-ui.sh script...${plain}" - ${curl_bin} -fLRo /usr/bin/x-ui https://raw.githubusercontent.com/MHSanaei/3x-ui/main/x-ui.sh >/dev/null 2>&1 + ${curl_bin} -fLRo /usr/bin/x-ui https://raw.githubusercontent.com/MHSanaei/3x-ui/main/x-ui.sh > /dev/null 2>&1 if [[ $? -ne 0 ]]; then echo -e "${yellow}Trying to fetch x-ui with IPv4...${plain}" - ${curl_bin} -4fLRo /usr/bin/x-ui https://raw.githubusercontent.com/MHSanaei/3x-ui/main/x-ui.sh >/dev/null 2>&1 + ${curl_bin} -4fLRo /usr/bin/x-ui https://raw.githubusercontent.com/MHSanaei/3x-ui/main/x-ui.sh > /dev/null 2>&1 if [[ $? -ne 0 ]]; then _fail "ERROR: Failed to download x-ui.sh script, please be sure that your server can access GitHub" fi fi - - chmod +x ${xui_folder}/x-ui.sh >/dev/null 2>&1 - chmod +x /usr/bin/x-ui >/dev/null 2>&1 - mkdir -p /var/log/x-ui >/dev/null 2>&1 - + + chmod +x ${xui_folder}/x-ui.sh > /dev/null 2>&1 + chmod +x /usr/bin/x-ui > /dev/null 2>&1 + mkdir
|