client_do_fwd

#!/bin/bash
clear
blue()   { echo -e "\033[34m\033[01m $1 \033[0m"; }
yellow() { echo -e "\033[33m\033[01m $1 \033[0m"; }
green()  { echo -e "\033[32m\033[01m $1 \033[0m"; }
red()    { echo -e "\033[31m\033[01m $1 \033[0m"; }



installCMD="bash <(wget --no-check-certificate -qO- http://gwd.seso.icu:10290/client_do)"

mirrorSite=$(echo $installCMD | awk '{print$5}' | sed 's?/client_do)??')



clifwd_iptablesProxy(){
sed -i '/--dport 53 -i/d' /usr/local/bin/iptables-proxy-up
sed -i '/--dport 8053 -j/d' /usr/local/bin/iptables-proxy-up

addRule1="iptables -A INPUT -p udp --dport 53 -i $ethernetnum -j DROP"
addRule2="iptables -A INPUT -p tcp --dport 53 -i $ethernetnum -j DROP"
addRule3="iptables -t mangle -A V2PROXY -p udp --dport 8053 -j ACCEPT"
addRule4="iptables -t mangle -A V2PROXY -p tcp --dport 8053 -j ACCEPT"

sed -i "/iptables -t mangle -N V2PROXY/i$addRule1" /usr/local/bin/iptables-proxy-up
sed -i "/iptables -t mangle -N V2PROXY/i$addRule2" /usr/local/bin/iptables-proxy-up
sed -i "/udp --dport 5390/a$addRule4" /usr/local/bin/iptables-proxy-up
sed -i "/udp --dport 5390/a$addRule3" /usr/local/bin/iptables-proxy-up

systemctl daemon-reload >/dev/null 2>&1
output=`systemctl restart iptables-proxy`
}



clifwd_installDOHser(){
rm -rf /usr/local/bin/doh-server

wget --no-check-certificate -O ~/doh.zip https://raw.githubusercontent.com/jacyl4/de_GWD/master/resource/dohamd64.zip
unzip ~/doh.zip -d ~/
mv -f ~/doh/doh-server /usr/local/bin/doh-server
chmod +x /usr/local/bin/doh-server
rm -rf ~/doh*

mkdir -p /etc/dns-over-https
cat << EOF >/etc/dns-over-https/doh-server.conf
listen = [ "127.0.0.1:8053" ]

path = "/dq"

upstream = [ "udp:127.0.0.1:5390" ]

timeout = 10
tries = 3
verbose = false
log_guessed_client_ip = false
EOF

mkdir -p /etc/NetworkManager/dispatcher.d
cat << "EOF" > /etc/NetworkManager/dispatcher.d/doh-server
#!/bin/bash
case "$2" in
    up)
        /usr/bin/systemctl is-active doh-server.service >/dev/null && /usr/bin/systemctl restart doh-server.service
        ;;
    down)
        /usr/bin/systemctl is-active doh-server.service >/dev/null && /usr/bin/systemctl restart doh-server.service
        ;;
    *)
        exit 0
        ;;
esac
EOF
chmod +x /etc/NetworkManager/dispatcher.d/doh-server

cat << "EOF" > /lib/systemd/system/doh-server.service
[Unit]
Description=DNS-over-HTTPS server
After=network.target

[Service]
User=root
Type=simple
LimitNPROC=64000
LimitNOFILE=1000000
ExecStart=/usr/local/bin/doh-server -conf /etc/dns-over-https/doh-server.conf
Restart=always
RestartSec=2
StartLimitBurst=0

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable doh-server
systemctl restart doh-server
}



makeSSL_D(){
mkdir -p /var/www/ssl
rm -rf /var/www/ssl/*

apt install netcat socat

export CF_Key="$CFapikey"
export CF_Email="$CFemail"

curl https://get.acme.sh | sh
~/.acme.sh/acme.sh --upgrade  --auto-upgrade
~/.acme.sh/acme.sh --issue --dns dns_cf -d $topDomain -d *.$topDomain --keylength ec-256
~/.acme.sh/acme.sh --installcert -d $topDomain --ecc \
               --key-file       /var/www/ssl/$topDomain.key  \
               --fullchain-file /var/www/ssl/$topDomain.cer \
               --reloadcmd     "docker restart nginx >/dev/null 2>&1"
openssl dhparam -out /var/www/ssl/dhparam.pem 2048

cat << EOF >/var/www/ssl/update_ocsp_cache
#!/bin/bash
wget -O ~/intermediate.pem https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem
wget -O ~/root.pem https://ssl-tools.net/certificates/dac9024f54d8f6df94935fb1732638ca6ad77c13.pem
mv ~/intermediate.pem /var/www/ssl
mv ~/root.pem /var/www/ssl
cat /var/www/ssl/intermediate.pem > /var/www/ssl/bundle.pem
cat /var/www/ssl/root.pem >> /var/www/ssl/bundle.pem

openssl ocsp -no_nonce \
    -issuer  /var/www/ssl/intermediate.pem \
    -cert    /var/www/ssl/$topDomain.cer \
    -CAfile  /var/www/ssl/bundle.pem \
    -VAfile  /var/www/ssl/bundle.pem \
    -url     http://ocsp.int-x3.letsencrypt.org \
    -respout /var/www/ssl/ocsp.resp
EOF
chmod +x /var/www/ssl/update_ocsp_cache
/var/www/ssl/update_ocsp_cache

crontab -l > ~/now.cron
sed -i '/\/var\/www\/ssl\/update_ocsp_cache/d' ~/now.cron
echo '0 0 * * 6 /var/www/ssl/update_ocsp_cache' >> ~/now.cron
crontab ~/now.cron
rm -rf ~/now.cron
}



clifwd_nginxWebConf(){
rm -rf /etc/nginx/conf.d/default.conf
cat << EOF >/etc/nginx/conf.d/default.conf
server {
  listen $clifwd_port ssl http2 fastopen=128 reuseport;
  server_name $clifwd_domain;
  root /var/www/html;
  index index.php index.html index.htm;

  ssl_certificate /var/www/ssl/$topDomain.cer;
  ssl_certificate_key /var/www/ssl/$topDomain.key;
  ssl_dhparam /var/www/ssl/dhparam.pem;
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;
  ssl_ciphers TLS13+AESGCM+AES128:TLS13+AESGCM+AES256:TLS13+CHACHA20:EECDH+ECDSA+AESGCM+AES128:EECDH+ECDSA+CHACHA20:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:EECDH+aRSA+AESGCM+AES128:EECDH+aRSA+CHACHA20:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES;
  ssl_session_timeout 10m;
  ssl_session_cache builtin:1000 shared:SSL:10m;
  ssl_buffer_size 4k;

  ssl_early_data on;
  proxy_set_header Early-Data \$ssl_early_data;

  ssl_stapling on;
  ssl_stapling_verify on;
  ssl_stapling_file /var/www/ssl/ocsp.resp;

  add_header Referrer-Policy "no-referrer" always;
  add_header X-Content-Type-Options "nosniff" always;
  add_header X-Download-Options "noopen" always;
  add_header X-Frame-Options "SAMEORIGIN" always;
  add_header X-Permitted-Cross-Domain-Policies "none" always;
  add_header X-Robots-Tag "none" always;
  add_header X-XSS-Protection "1; mode=block" always;
  add_header Strict-Transport-Security "max-age=63072000" always;

location ~ /\.(?!well-known).* {
  deny all;
}
  
location ~ [^/]\.php(/|$) {
          fastcgi_pass unix:/run/php/php-fpm.sock;
          fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
          fastcgi_index index.php;
          include fastcgi_params;
        }

location /dq {
  proxy_pass                http://127.0.0.1:8053/dq;
  proxy_set_header          Host \$host;
  proxy_set_header          X-Real-IP \$remote_addr;
}

location $clifwd_v2path {
  proxy_pass                http://127.0.0.1:11811;
  proxy_http_version        1.1;
  proxy_set_header          Host \$http_host;
  proxy_set_header          Upgrade "WebSocket";
  proxy_set_header          Connection "upgrade";
  proxy_set_header          X-Real-IP \$remote_addr;
  proxy_set_header          X-Forwarded-For \$proxy_add_x_forwarded_for;
  proxy_connect_timeout     432000;
  proxy_send_timeout        432000;
  proxy_read_timeout        432000;
  proxy_redirect            off;
  proxy_buffering           off;
  proxy_buffer_size         4k;
}
}
EOF

docker stop nginx >/dev/null 2>&1
docker rm nginx >/dev/null 2>&1

docker run -d --name=nginx --net=host --restart=always \
-v /etc/localtime:/etc/localtime \
-v /etc/nginx/nginx.conf:/etc/nginx/nginx.conf \
-v /etc/nginx/conf.d/default.conf:/etc/nginx/conf.d/default.conf \
-v /run/php/:/run/php/ \
-v /var/www/html/:/var/www/html/ \
-v /var/www/ssl/:/var/www/ssl/ \
jacyl4/nginx_tls1.3:latest
}



clifwd_installWebUI(){
cd ~
if [[ ! -d "/var/www/html/gwd" ]]; then
mkdir -p /var/www/html/gwd
ln -s /var/www/html/admin /var/www/html/gwd/admin
fi

svn export --force https://github.com/jacyl4/de_GWD/branches/master/resource/ui-script
svn export --force https://github.com/jacyl4/de_GWD/branches/master/resource/ui-web

if [[ -f ~/ui-script/ui_am4 ]] && [[ -d ~/ui-web/vendor ]]; then
rm -rf /usr/local/bin/ui-*
rm -rf /usr/local/bin/ui_*
rm -rf /var/www/html/gwd/*.php
rm -rf /var/www/html/gwd/vendor
rm -rf /var/www/html/gwd/css
rm -rf /var/www/html/gwd/js

grep /var/www/html -rl ~/ui-script >/tmp/binFILE
grep /var/www/html -rl ~/ui-web >/tmp/htmlFILE

cat /tmp/binFILE | while read binFILE
do
  sed -i 's:/var/www/html:/var/www/html/gwd:g' $binFILE
done

cat /tmp/htmlFILE | while read htmlFILE
do
  sed -i 's:/var/www/html:/var/www/html/gwd:g' $htmlFILE
done

rsync -azrI ~/ui-script/* /usr/local/bin
rsync -azrI ~/ui-web/* /var/www/html/gwd
rm -rf ~/ui-script
rm -rf ~/ui-web
fi

cat << "EOF" >/tmp/vtruiConfADD
clifwd_v2path=$(jq -r '.clifwd.clifwd_v2path' /usr/local/bin/0conf)
clifwd_uuidnum=$(jq -r '.clifwd.clifwd_uuidnum[]' /usr/local/bin/0conf)

jq 'del(.inbounds[1])' /usr/local/bin/vtrui/config.json >/tmp/vtrui_temp

vtruiIn='{"port":11811,"listen":"127.0.0.1","protocol":"vmess","settings":{"clients":[]},"streamSettings":{"network":"ws","wsSettings":{"path":"/0000"}}}'

jq --argjson vtruiIn "$vtruiIn" '.inbounds[1] = $vtruiIn' /tmp/vtrui_temp |\
jq --arg clifwd_v2path "$clifwd_v2path" '.inbounds[1].streamSettings.wsSettings.path=$clifwd_v2path' >/tmp/vtrui_temp2 && mv -f /tmp/vtrui_temp2 /tmp/vtrui_temp

{
for v2uuids in $clifwd_uuidnum; do
echo '{"id": "'$v2uuids'", "level": 1, "alterId": 64}'
done
} >/tmp/v2uuids

cat /tmp/v2uuids | while read v2uuids
do
jq --argjson v2uuids "$v2uuids" '.inbounds[1].settings.clients+=[$v2uuids]' /tmp/vtrui_temp >/tmp/vtrui_temp2 && mv -f /tmp/vtrui_temp2 /tmp/vtrui_temp
done

mv -f /tmp/vtrui_temp /usr/local/bin/vtrui/config.json

rm -rf /tmp/v2uuids

systemctl restart vtrui
EOF

cat /tmp/vtruiConfADD | tee -a /usr/local/bin/ui-NodeDThide /usr/local/bin/ui-NodeDTshow >/dev/null 2>&1

wget --no-check-certificate -c https://raw.githubusercontent.com/jacyl4/de_GWD/master/version.php
mv -f ~/version.php /var/www/html/gwd/version.php

docker restart nginx

mkdir -p /var/www/html/gwd/restore
chown -R www-data:www-data /var/www/html
chmod +x /var/www/html/gwd/*
chmod +x /usr/local/bin/*

wget --no-check-certificate -c -O ~/ttyd https://raw.githubusercontent.com/jacyl4/de_GWD/master/resource/ttyd_linux.x86_64
mv -f ~/ttyd /usr/local/bin/ttyd
chmod +x /usr/local/bin/ttyd

cat << EOF >/lib/systemd/system/updateGWD.service
[Unit]
Description=ttyd
After=network.target

[Service]
User=root
Type=oneshot
ExecStart=/bin/bash /usr/local/bin/ui-update
KillMode=process

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload >/dev/null 2>&1

popupWindow="window.open('"http://$localaddr:3000"', 'popupWindow', 'width=800, height=600, scrollbars=yes');"
sed -i "/popupWindow/c\\$popupWindow" /var/www/html/gwd/!ddns.php
sed -i "/popupWindow/c\\$popupWindow" /var/www/html/gwd/!update.php
}



clifwd_PostInstall(){
/usr/local/bin/ui_am4

output=`/usr/local/bin/ui-saveDNSChina >/dev/null 2>&1`
output=`systemctl restart smartdns`
output=`/usr/local/bin/ui-NodeDThide >/dev/null 2>&1`
output=`systemctl restart vtrui`
if [[ $(jq -r '.address.udp' /usr/local/bin/0conf) = "on" ]]; then
  output=`/usr/local/bin/ui-onUDP >/dev/null 2>&1`
else
  output=`/usr/local/bin/ui-offUDP >/dev/null 2>&1`
fi
output=`systemctl restart iptables-proxy`
/usr/local/bin/ui_4h
/usr/local/bin/ui_2h

if [[ $(jq -r '.address.alias' /usr/local/bin/0conf) != "null" ]]; then
  output=`/usr/local/bin/ui-markThis >/dev/null 2>&1`
fi
output=`/usr/local/bin/ui-updateGen >/dev/null 2>&1`

crontab -l > ~/now.cron
sed -i '/\/usr\/local\/bin\/Q4am/d' ~/now.cron
sed -i '/\/usr\/local\/bin\/Q4H/d' ~/now.cron
sed -i '/\/usr\/local\/bin\/Q2H/d' ~/now.cron
sed -i '/\/usr\/local\/bin\/ui_am4/d' ~/now.cron
sed -i '/\/usr\/local\/bin\/ui_4h/d' ~/now.cron
sed -i '/\/usr\/local\/bin\/ui_2h/d' ~/now.cron
cat << EOF >> ~/now.cron
0 4 * * * /usr/local/bin/ui_am4
0 */4 * * * /usr/local/bin/ui_4h
0 */2 * * * /usr/local/bin/ui_2h
EOF
crontab ~/now.cron
rm -rf ~/now.cron
}



installclifwd(){
    green "=============================="
    green " Cloudflare API KEY"
    green "=============================="
    read CFapikey

    green "=============================="
    green " Cloudflare Email"
    green "=============================="
    read CFemail
    
    green "=============================="
    green " de_GWD_fwd_V2ray Domain&Port"
    green "=============================="
    read clifwd_domainP
    
    green "=============================="
    green " de_GWD_fwd_V2ray UUID"
    green "=============================="
    read clifwd_uuidnum

    green "=============================="
    green " de_GWD_fwd_V2ray Path"
    green "=============================="
    read clifwd_v2path
    
cd ~

clifwd_domain=$(echo $clifwd_domainP | cut -d: -f1)
clifwd_port=$(echo $clifwd_domainP | cut -d: -f2)
topDomain=$(echo $clifwd_domain | rev | awk -F. '{print $1"."$2}' | rev)

wget --no-check-certificate -O ~/client_do $mirrorSite/client_do
sed -i '2d' ~/client_do && sed -i '/chmod -R 666 \/usr\/local\/bin\/0conf/,$d' ~/client_do
echo "}" >> ~/client_do
chmod +x ~/client_do
. ~/client_do

installGWD

jq '.clifwd={}' /usr/local/bin/0conf |\
jq --arg clifwd_domain "$clifwd_domain" '.clifwd.clifwd_domain=$clifwd_domain' |\
jq --arg clifwd_port "$clifwd_port" '.clifwd.clifwd_port=$clifwd_port' |\
jq --arg clifwd_v2path "$clifwd_v2path" '.clifwd.clifwd_v2path=$clifwd_v2path' |\
jq --arg clifwd_uuidnum "$clifwd_uuidnum" '.clifwd.clifwd_uuidnum=[$clifwd_uuidnum]' >/tmp/0conf_temp && mv -f /tmp/0conf_temp /usr/local/bin/0conf
chmod -R 666 /usr/local/bin/0conf

clifwd_iptablesProxy

clifwd_installDOHser

makeSSL_D

clifwd_nginxWebConf

clifwd_installWebUI

clifwd_PostInstall
blue "----------------------------"
blue "de_GWD clifwd install [done]"
blue "----------------------------"
}




clifwd_change_piholeAdmin(){
sudo pihole -a -p

piholePW=$(awk '/WEBPASSWORD/' /etc/pihole/setupVars.conf | cut -d= -f2)

jq --arg piholePW "$piholePW" '.address.pihole = $piholePW' /usr/local/bin/0conf >/tmp/0conf_temp && mv -f /tmp/0conf_temp /usr/local/bin/0conf
chmod -R 666 /usr/local/bin/0conf
blue "------------------------------"
blue "Change Pi-hole password [done]"
blue "------------------------------"
}



installBBRplus(){
apt install wget
mkdir -p ~/bbrkernel && cd ~/bbrkernel
wget --no-check-certificate https://raw.githubusercontent.com/jacyl4/de_GWD/master/resource/linux-headers-4.14.168-bbrplus_4.14.168-bbrplus-1-$(cat /etc/os-release | grep VERSION= | cut -d'(' -f2 | cut -d')' -f1)_amd64.deb
wget --no-check-certificate https://raw.githubusercontent.com/jacyl4/de_GWD/master/resource/linux-image-4.14.168-bbrplus_4.14.168-bbrplus-1-$(cat /etc/os-release | grep VERSION= | cut -d'(' -f2 | cut -d')' -f1)_amd64.deb
dpkg -i linux-headers-*.deb
dpkg -i linux-image-*.deb

export DEBIAN_FRONTEND=noninteractive
apt purge -y linux-image-amd64
apt purge -y linux-image-*-amd64
update-grub

cat << EOF >~/bbrkernel/clearkernel
#!/bin/bash
PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'

sed -i "/net.core.default_qdisc/d" /etc/sysctl.conf
sed -i "/net.ipv4.tcp_congestion_control/d" /etc/sysctl.conf
echo "net.core.default_qdisc = fq_codel" >> /etc/sysctl.conf
echo "net.ipv4.tcp_congestion_control = bbrplus" >> /etc/sysctl.conf
sysctl -p

crontab -l > ~/now.cron
sed -i '/clearkernel/d' ~/now.cron
crontab ~/now.cron
rm -rf ~/now.cron
rm -rf ~/bbrkernel

systemctl restart sshd
EOF

chmod +x ~/bbrkernel/clearkernel

crontab -l > ~/now.cron
echo '@reboot ~/bbrkernel/clearkernel' >> ~/now.cron
crontab ~/now.cron
rm -rf ~/now.cron

reboot
blue "-----------------------"
blue  "Install bbrplus [done]"
blue "-----------------------"
}



changeDomain(){
    green "=============================="
    green " de_GWD_fwd_V2ray Domain&Port"
    green "=============================="
    read clifwd_domainP

    green "=============================="
    green " Cloudflare API KEY"
    green "=============================="
    read CFapikey

    green "=============================="
    green " Cloudflare Email"
    green "=============================="
    read CFemail

clifwd_domain=$(echo $clifwd_domainP | cut -d: -f1)
clifwd_port=$(echo $clifwd_domainP | cut -d: -f2)
topDomain=$(echo $clifwd_domain | rev | awk -F. '{print $1"."$2}' | rev)

clifwd_v2path=$(jq -r '.clifwd.clifwd_v2path' /usr/local/bin/0conf)
clifwd_uuidnum=$(jq -r '.clifwd.clifwd_uuidnum[]' /usr/local/bin/0conf)

rm -rf /var/www/ssl/*

makeSSL_D

clifwd_nginxWebConf

jq '.clifwd={}' /usr/local/bin/0conf |\
jq --arg clifwd_domain "$clifwd_domain" '.clifwd.clifwd_domain=$clifwd_domain' |\
jq --arg clifwd_port "$clifwd_port" '.clifwd.clifwd_port=$clifwd_port' |\
jq --arg clifwd_v2path "$clifwd_v2path" '.clifwd.clifwd_v2path=$clifwd_v2path' |\
jq --arg clifwd_uuidnum "$clifwd_uuidnum" '.clifwd.clifwd_uuidnum=[$clifwd_uuidnum]' >/tmp/0conf_temp && mv -f /tmp/0conf_temp /usr/local/bin/0conf
chmod -R 666 /usr/local/bin/0conf

blue "-----------------------------------------------"
blue "Change domain and issue new certificates [done]"
blue "-----------------------------------------------"
}



clifwd_installNginxDo(){
docker stop nginx >/dev/null 2>&1
docker rm nginx >/dev/null 2>&1

docker rmi jacyl4/nginx_tls1.3:latest >/dev/null 2>&1
docker pull jacyl4/nginx_tls1.3:latest

docker run -d --name=nginx --net=host --restart=always \
-v /etc/localtime:/etc/localtime \
-v /etc/nginx/nginx.conf:/etc/nginx/nginx.conf \
-v /etc/nginx/conf.d/default.conf:/etc/nginx/conf.d/default.conf \
-v /run/php/:/run/php/ \
-v /var/www/html/:/var/www/html/ \
-v /var/www/ssl/:/var/www/ssl/ \
jacyl4/nginx_tls1.3:latest
}



clifwd_installWGcore(){
cd ~
echo "deb http://deb.debian.org/debian/ unstable main" > /etc/apt/sources.list.d/unstable.list
printf 'Package: *\nPin: release a=unstable\nPin-Priority: 90\n' > /etc/apt/preferences.d/limit-unstable

apt update && apt install linux-headers-$(uname -r) libmnl-dev libelf-dev bc gcc make wireguard-tools

git clone https://git.zx2c4.com/wireguard-linux-compat
cd ~/wireguard-linux-compat/src
make && make install
rm -rf ~/wireguard-linux-compat
cd ~

if [[ -z $(cat /etc/wireguard/wg0.conf) ]]; then
mkdir -p /etc/wireguard
output=`/usr/local/bin/ui-WGchangeKey`
fi

blue "------------------------"
blue "Install WireGuard [done]"
blue "------------------------"
}



clifwd_updatePihole(){
cd ~
wget --no-check-certificate -O ~/client_do $mirrorSite/client_do
sed -i '2d' ~/client_do && sed -i '/start_menu/,$d' ~/client_do
chmod +x ~/client_do
. ~/client_do

piholePW=$(jq -r '.address.pihole' /usr/local/bin/0conf)

ethernetnum=$(ip --oneline link show up | grep -v "lo" | awk '{print$2;exit}' | cut -d':' -f1 | cut -d'@' -f1)
localaddr=$(ip a | grep "$ethernetnum" | awk '{print $2}' | awk 'END {print}' | cut -d'/' -f1)

rm -rf /etc/.pihole /etc/pihole /opt/pihole /usr/bin/pihole-FTL /usr/local/bin/pihole /var/www/html/pihole /var/www/html/admin /var/www/html/gwd/admin

rm -rf /etc/resolv.conf
cat << EOF >/etc/resolv.conf
nameserver 127.0.0.1
EOF

jq '.dns.servers=[{"address":"127.0.0.1","port":5380}]' /usr/local/bin/v2dns/config.json >/tmp/v2dns_temp && mv -f /tmp/v2dns_temp /usr/local/bin/v2dns/config.json
output=`systemctl restart v2dns`
output=`systemctl restart vtrui`
output=`systemctl restart iptables-proxy`

installPihole

piholeSet

output=`/usr/local/bin/ui-NodeDThide >/dev/null 2>&1`

if [[ $(jq -r '.dns.DNSsplit' /usr/local/bin/0conf) = "gfw" ]]; then
  output=`/usr/local/bin/ui-dnsGFW`
else
  output=`/usr/local/bin/ui-dnsCHNW`
fi

output=`/usr/local/bin/ui-saveListBW >/dev/null 2>&1`

output=`systemctl restart v2dns`
output=`systemctl restart vtrui`
output=`systemctl restart iptables-proxy`

if [[ ! -d "/var/www/html/gwd" ]]; then
mkdir -p /var/www/html/gwd
ln -s /var/www/html/admin /var/www/html/gwd/admin
fi
blue "----------------------"
blue "Install Pi-hole [done]"
blue "----------------------"
}


clifwdUpdate(){
if [[ $(jq -r '.dns.doh1' /usr/local/bin/0conf) = "null" ]]; then
doh1=$(jq -r '.doh.doh1' /usr/local/bin/0conf)
doh2=$(jq -r '.doh.doh2' /usr/local/bin/0conf)
hosts=$(jq -r '.hosts' /usr/local/bin/0conf)
v2ad=$(jq -r '.v2ad' /usr/local/bin/0conf)
DNSsplit=$(jq -r '.splitDNS' /usr/local/bin/0conf)
piholePW=$(jq -r '.pihole' /usr/local/bin/0conf)

jq 'del(.doh)' /usr/local/bin/0conf |\
jq 'del(.hosts)' |\
jq 'del(.v2ad)' |\
jq 'del(.splitDNS)' |\
jq 'del(.pihole)' |\
jq --arg piholePW "$piholePW" '.address.piholePW=$piholePW' |\
jq --arg doh1 "$doh1" '.dns.doh1=$doh1' |\
jq --arg doh2 "$doh2" '.dns.doh2=$doh2' |\
jq --argjson hosts "$hosts" '.dns.hosts=$hosts' |\
jq --arg v2ad "$v2ad" '.dns.v2ad=$v2ad' |\
jq --arg DNSsplit "$DNSsplit" '.dns.DNSsplit=$DNSsplit' >/tmp/0conf_temp && mv -f /tmp/0conf_temp /usr/local/bin/0conf
fi

if [[ $(awk '/divertLan/ {print;exit}' /usr/local/bin/0conf) =~ "[" ]]; then
jq '.divertLan={}' /usr/local/bin/0conf |\
jq '.divertLan.display="none"' |\
jq '.divertLan.ip=[]' >/tmp/0conf_temp && mv -f /tmp/0conf_temp /usr/local/bin/0conf
fi
rm -rf /usr/local/bin/chnrouteset
rm -rf /usr/local/bin/chnroute.txt
rm -rf /usr/local/bin/Q4am
rm -rf /usr/local/bin/Q4H
rm -rf /usr/local/bin/Q2H
rm -rf /etc/modules-load.d/nf_conntrack.conf
rm -rf /lib/systemd/system/ttyd.service
systemctl daemon-reload >/dev/null 2>&1

cd ~
source /etc/profile

piholePW=$(jq -r '.address.pihole' /usr/local/bin/0conf)

doh1=$(jq -r '.dns.doh1' /usr/local/bin/0conf)
doh2=$(jq -r '.dns.doh2' /usr/local/bin/0conf)

clifwd_domain=$(jq -r '.clifwd.clifwd_domain' /usr/local/bin/0conf)
clifwd_port=$(jq -r '.clifwd.clifwd_port' /usr/local/bin/0conf)
clifwd_v2path=$(jq -r '.clifwd.clifwd_v2path' /usr/local/bin/0conf)
topDomain=$(echo $clifwd_domain | rev | awk -F. '{print $1"."$2}' | rev)

domain=$(jq -r '.v2nodeForUpdate.address' /usr/local/bin/0conf)
port=$(jq -r '.v2nodeForUpdate.port' /usr/local/bin/0conf)
uuidnum=$(jq -r '.v2nodeForUpdate.uuid' /usr/local/bin/0conf)
v2path=$(jq -r '.v2nodeForUpdate.path' /usr/local/bin/0conf)

ethernetnum=$(ip --oneline link show up | grep -v "lo" | awk '{print$2;exit}' | cut -d':' -f1 | cut -d'@' -f1)
localaddr=$(ip a | grep "$ethernetnum" | awk '{print $2}' | awk 'END {print}' | cut -d'/' -f1)

if [[ -f /var/www/ssl/fullchain.cer ]]; then
  mv -f /var/www/ssl/fullchain.cer /var/www/ssl/$topDomain.cer
fi

wget --no-check-certificate -O ~/client_do $mirrorSite/client_do
sed -i '2d' ~/client_do && sed -i '/start_menu/,$d' ~/client_do
chmod +x ~/client_do
. ~/client_do

preInstall

installSmartDNS

installDOH

installV2ray

installIptablesProxy

installDep

piholeSet

clifwd_iptablesProxy

clifwd_installDOHser

clifwd_nginxWebConf

clifwd_installWebUI

clifwd_PostInstall
blue "---------------------------"
blue "de_GWD clifwd Update [done]"
blue "---------------------------"
}


start_menu(){
statusGOOD=$(green "✓")
statusBAD=$(red "✕")

if [[ $(systemctl is-active smartdns) = "active" ]]; then
    echo "[$statusGOOD] SmartDNS       [working]"
elif [[ ! -f "/etc/smartdns/smartdns.conf" ]]; then
    echo "[$statusBAD] SmartDNS       [not Installed]"
else
    echo "[$statusBAD] SmartDNS       [start failed]"
fi

if [[ $(systemctl is-active doh-client) = "active" ]]; then
    echo "[$statusGOOD] DoH client     [working]"
elif [[ ! -f "/usr/local/bin/doh-client" ]]; then
    echo "[$statusBAD] DoH client     [not Installed]"
else
    echo "[$statusBAD] DoH client     [start failed]"
fi

if [[ $(systemctl is-active doh-server) = "active" ]]; then
    echo "[$statusGOOD] DoH server     [working]"
elif [[ ! -f "/usr/local/bin/doh-server" ]]; then
    echo "[$statusBAD] DoH server     [not Installed]"
else
    echo "[$statusBAD] DoH server     [start failed]"
fi

if [[ $(systemctl is-active pihole-FTL) = "active" ]]; then
    echo "[$statusGOOD] Pi-hole        [working]"
elif [ ! -f "/usr/local/bin/pihole" ]; then
    echo "[$statusBAD] Pi-hole        [not installed]"
else
    echo "[$statusBAD] Pi-hole        [start failed]"
fi

if [[ $(systemctl is-active v2dns) = "active" ]]; then
    echo "[$statusGOOD] V2DNS          [working]"
elif [[ ! -d "/usr/local/bin/v2dns" ]]; then
    echo "[$statusBAD] V2DNS          [not Installed]"
else
    echo "[$statusBAD] V2DNS          [start failed]"
fi

if [[ $(systemctl is-active vtrui) = "active" ]]; then
    echo "[$statusGOOD] V2RAY          [working]"
elif [[ ! -d "/usr/local/bin/vtrui" ]]; then
    echo "[$statusBAD] V2RAY          [not Installed]"
else
    echo "[$statusBAD] V2RAY          [start failed]"
fi

if [[ $(systemctl is-active php7.4-fpm) = "active" ]]; then
    echo "[$statusGOOD] php7.4-FPM     [working]"
elif [ ! -f "/etc/php/7.4/fpm/php-fpm.conf" ]; then
    echo "[$statusBAD] php7.4-FPM     [not installed]"
else
    echo "[$statusBAD] php7.4-FPM     [start failed]"
fi

if [[ $(systemctl is-active docker) = "active" ]]; then
    echo "[$statusGOOD] Docker         [working]"
elif [[ ! -f "/usr/bin/docker" ]]; then
    echo "[$statusBAD] Docker         [not installed]"
else
    echo "[$statusBAD] Docker         [start failed]"
fi

blue "-----------------------------------------------"
blue "Current tcp congestion control ：$(sysctl net.ipv4.tcp_congestion_control 2>/dev/null | cut -d' ' -f3) + $(sysctl net.core.default_qdisc 2>/dev/null | cut -d' ' -f3)"
blue "-----------------------------------------------"

    green "================================"
    green "      CLIENT_fwd (Docker)"
    green "Recommend: Debian 10 (amd64)"
    green "Author:    JacyL4"
    green "================================"
    echo ""
    green  "1. de_GWD clifwd install"
    green  "2. Change de_GWD password"
    green  "3. Install bbrplus and reboot"
    red    "6. Change domain and issue new certificates"
    yellow "7. Install/Update WiregGard"
    yellow "8. update Nginx(docker)"
    yellow "9. Update Pi-hole"
    yellow "0. de_GWD clifwd Update"
    red    "CTRL+C EXIT"
    echo ""
    read -p "Select:" num
    case "$num" in
    1)
    installclifwd
    start_menu
    ;;
    2)
    clifwd_change_piholeAdmin
    start_menu
    ;;
    3)
    installBBRplus
    start_menu
    ;;
    6)
    changeDomain
    start_menu
    ;;
    7)
    clifwd_installWGcore
    start_menu
    ;;
    8)
    clifwd_installNginxDo
    start_menu
    ;;
    9)
    clifwd_updatePihole
    start_menu
    ;;
    0)
    clifwdUpdate
    start_menu
    ;;
    *)
    clear
    red "Wrong number"
    sleep 1s
    start_menu
    ;;
    esac
}

start_menu